File Manager

003 File Manager

Current Path: /var/db/pkg

📁 ..
📄 FreeBSD.meta(246 B)
📄 local.sqlite(8.68 MB)
📄 newimage.meta(158 B)
📄 repo-FreeBSD.sqlite(51.98 MB)
📄 repo-newimage.sqlite(2.23 MB)
📄 repo-newimage.sqlite-journal(0 B)
📄 vuln.xml(8.73 MB)

Editing: vuln.xml

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE vuxml PUBLIC "-//vuxml.org//DTD VuXML 1.1//EN" "http://www.vuxml.org/dtd/vuxml-1/vuxml-11.dtd" [
<!ENTITY vuln-2003 SYSTEM "vuln/2003.xml">
<!ENTITY vuln-2004 SYSTEM "vuln/2004.xml">
<!ENTITY vuln-2005 SYSTEM "vuln/2005.xml">
<!ENTITY vuln-2006 SYSTEM "vuln/2006.xml">
<!ENTITY vuln-2007 SYSTEM "vuln/2007.xml">
<!ENTITY vuln-2008 SYSTEM "vuln/2008.xml">
<!ENTITY vuln-2009 SYSTEM "vuln/2009.xml">
<!ENTITY vuln-2010 SYSTEM "vuln/2010.xml">
<!ENTITY vuln-2011 SYSTEM "vuln/2011.xml">
<!ENTITY vuln-2012 SYSTEM "vuln/2012.xml">
<!ENTITY vuln-2013 SYSTEM "vuln/2013.xml">
<!ENTITY vuln-2014 SYSTEM "vuln/2014.xml">
<!ENTITY vuln-2015 SYSTEM "vuln/2015.xml">
<!ENTITY vuln-2016 SYSTEM "vuln/2016.xml">
<!ENTITY vuln-2017 SYSTEM "vuln/2017.xml">
<!ENTITY vuln-2018 SYSTEM "vuln/2018.xml">
<!ENTITY vuln-2019 SYSTEM "vuln/2019.xml">
<!ENTITY vuln-2020 SYSTEM "vuln/2020.xml">
<!ENTITY vuln-2021 SYSTEM "vuln/2021.xml">
<!ENTITY vuln-2022 SYSTEM "vuln/2022.xml">
<!ENTITY vuln-2023 SYSTEM "vuln/2023.xml">
<!ENTITY vuln-2024 SYSTEM "vuln/2024.xml">
<!ENTITY vuln-2025 SYSTEM "vuln/2025.xml">
<!ENTITY vuln-2026 SYSTEM "vuln/2026.xml">
]>
<!--
Copyright 2003-2026 Jacques Vidrine and contributors

Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
HTML, PDF, PostScript, RTF and so forth) with or without modification,
are permitted provided that the following conditions are met:
1. Redistributions of source code (VuXML) must retain the above
   copyright notice, this list of conditions and the following
   disclaimer as the first lines of this file unmodified.
2. Redistributions in compiled form (transformed to other DTDs,
   published online in any format, converted to PDF, PostScript,
   RTF and other formats) must reproduce the above copyright
   notice, this list of conditions and the following disclaimer
   in the documentation and/or other materials provided with the
   distribution.

THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

QUICK GUIDE TO ADDING A NEW ENTRY

1. run 'make newentry' to add a template to the top of the document
2. fill in the template
3. use 'make validate' to verify syntax correctness (you might need to install
   textproc/libxml2 for parser, and this port for catalogs)
4. fix any errors
5. use 'make VID=xxx-yyy-zzz html' to emit the entry's html file for formatting review
6. profit!

Additional tests can be done this way:
 $ make vuln-flat.xml
 $ pkg audit -f ./vuln-flat.xml py26-django-1.6
 $ pkg audit -f ./vuln-flat.xml py27-django-1.6.1

Extensive documentation of the format and help with writing and verifying
a new entry is available in The Porter's Handbook at:

https://docs.freebsd.org/en/books/porters-handbook/security/#security-notify

Help is also available from ports-security@freebsd.org.

Notes:

* Please add new entries to the beginning of the current year's file.
 * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
 <vuln vid="a117f43b-2f7b-11f1-89f4-b42e991fc52e">
 <topic>MongoDB Server -- CWE-617: Reachable Assertion</topic>
 <affects>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.18</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.31</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://jira.mongodb.org/browse/SERVER-101758 reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-101758">
	
	A user with access to the cluster with a limited set of
	privilege actions can trigger a crash of amongod process
	during the limited and unpredictable window when the
	cluster is being promoted from a replica set to a sharded
	cluster. This may cause a denial of service by taking
	down the primary of the replica set.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-5170</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-5170</url>
 </references>
 <dates>
 <discovery>2026-03-30</discovery>
 <entry>2026-04-03</entry>
 </dates>
 </vuln>

<vuln vid="adb096d4-2e72-11f1-acc1-339a1a6999b0">
 <topic>openexr -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openexr</name>
	<range><lt>3.4.9</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Cary Phillips reports:
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/blob/v3.4.9-rc/CHANGES.md#version-349-april--3-2026">
	 [OpenEXR 3.4.9] addresses the following CVEs:
	 <ul>
	 <li>CVE-2026-34589 DWA Lossy Decoder Heap Out-of-Bounds Write</li>
	 <li>CVE-2026-34588 Signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write</li>
	 <li>CVE-2026-34380 Signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression</li>
	 <li>CVE-2026-34379 Misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)</li>
	 <li>CVE-2026-34378 Signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-34589</cvename>
 <cvename>CVE-2026-34588</cvename>
 <cvename>CVE-2026-34380</cvename>
 <cvename>CVE-2026-34379</cvename>
 <cvename>CVE-2026-34378</cvename>
 <url>https://github.com/AcademySoftwareFoundation/openexr/blob/v3.4.9-rc/CHANGES.md#version-349-april--3-2026</url>
 <url>https://lists.aswf.io/g/openexr-dev/message/5436</url>
 </references>
 <dates>
 <discovery>2026-03-26</discovery>
 <entry>2026-04-02</entry>
 </dates>
 </vuln>

<vuln vid="9fdad262-2e0f-11f1-88c7-00a098b42aeb">
 <topic>Python -- The webbrowser.open() API allows leading dashes</topic>
 <affects>
 <package><name>python310</name> <range><lt>3.10.20_2</lt></range></package>
 <package><name>python311</name> <range><lt>3.11.15_2</lt></range></package>
 <package><name>python312</name> <range><lt>3.12.13_2</lt></range></package>
 <package><name>python313</name> <range><lt>3.13.12_3</lt></range></package>
 <package><name>python313t</name> <range><lt>3.13.12_3</lt></range></package>
 <package><name>python314</name> <range><ge>0</ge></range></package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://github.com/python/cpython/pull/143931 reports:
	<blockquote cite="https://github.com/python/cpython/pull/143931">
	 The webbrowser.open() API would accept leading dashes in the URL
	 which could be handled as command line options for certain web
	 browsers. New behavior rejects leading dashes. Users are recommended
	 to sanitize URLs prior to passing to webbrowser.open().
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-4519</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-4519</url>
 </references>
 <dates>
 <discovery>2026-03-20</discovery>
 <entry>2026-04-01</entry>
 <modified>2026-04-04</modified>
 </dates>
 </vuln>

<vuln vid="6d3488ae-2e0f-11f1-88c7-00a098b42aeb">
 <topic>Python -- poplib module, when passed a user-controlled command, can have additional commands injected using newlines</topic>
 <affects>
 <package><name>python310</name> <range><ge>0</ge></range></package>
 <package><name>python311</name> <range><ge>0</ge></range></package>
 <package><name>python312</name> <range><ge>0</ge></range></package>
 <package><name>python313</name> <range><ge>0</ge></range></package>
 <package><name>python313t</name> <range><ge>0</ge></range></package>
 <package><name>python314</name> <range><ge>0</ge></range></package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Python Software Foundation Security Developer reports:
	<blockquote cite="https://github.com/python/cpython/pull/143924">
	 The poplib module, when passed a user-controlled command, can have
	 additional commands injected using newlines. Mitigation rejects
	 commands containing control characters.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-15367</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-15367</url>
 </references>
 <dates>
 <discovery>2026-01-20</discovery>
 <entry>2026-04-01</entry>
 <modified>2026-04-04</modified>
 </dates>
 </vuln>

<vuln vid="0be929a5-2e0f-11f1-88c7-00a098b42aeb">
 <topic>Python -- imaplib module, when passed a user-controlled command, can have additional commands injected using newlines</topic>
 <affects>
 <package><name>python310</name> <range><ge>0</ge></range></package>
 <package><name>python311</name> <range><ge>0</ge></range></package>
 <package><name>python312</name> <range><ge>0</ge></range></package>
 <package><name>python313</name> <range><ge>0</ge></range></package>
 <package><name>python313t</name> <range><ge>0</ge></range></package>
 <package><name>python314</name> <range><ge>0</ge></range></package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Python Software Foundation Security Developer reports:
	<blockquote cite="https://github.com/python/cpython/issues/143921">
	 The imaplib module, when passed a user-controlled command, can have
	 additional commands injected using newlines. Mitigation rejects
	 commands containing control characters.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-15366</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-15366</url>
 </references>
 <dates>
 <discovery>2026-01-20</discovery>
 <entry>2026-04-01</entry>
 <modified>2026-04-04</modified>
 </dates>
 </vuln>

<vuln vid="1dc2aae1-0793-4dbd-8548-e63ae0e1bdaf">
 <topic>chromium -- security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>146.0.7680.177</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>146.0.7680.177</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html">
	 This update includes 21 security fixes:
	 <ul>
	 <li>[493952652] High CVE-2026-5273: Use after free in CSS. Reported by Anonymous on 2026-03-18</li>
	 <li>[491732188] High CVE-2026-5272: Heap buffer overflow in GPU. Reported by inspector-ambitious on 2026-03-11</li>
	 <li>[488596746] High CVE-2026-5274: Integer overflow in Codecs. Reported by heapracer (@heapracer) on 2026-03-01</li>
	 <li>[489494022] High CVE-2026-5275: Heap buffer overflow in ANGLE. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-04</li>
	 <li>[489711638] High CVE-2026-5276: Insufficient policy enforcement in WebUSB. Reported by Ariel Simon on 2026-03-04</li>
	 <li>[489791424] High CVE-2026-5277: Integer overflow in ANGLE. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-05</li>
	 <li>[490254128] High CVE-2026-5278: Use after free in Web MIDI. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-06</li>
	 <li>[490642836] High CVE-2026-5279: Object corruption in V8. Reported by Hyeonjun Ahn (@_deayzl) on 2026-03-08</li>
	 <li>[491515787] High CVE-2026-5280: Use after free in WebCodecs. Reported by heapracer (@heapracer) on 2026-03-11</li>
	 <li>[491518608] High CVE-2026-5281: Use after free in Dawn. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-10</li>
	 <li>[491655161] High CVE-2026-5282: Out of bounds read in WebCodecs. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-11</li>
	 <li>[492131521] High CVE-2026-5283: Inappropriate implementation in ANGLE. Reported by sweetchip on 2026-03-12</li>
	 <li>[492139412] High CVE-2026-5284: Use after free in Dawn. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-12</li>
	 <li>[492228019] High CVE-2026-5285: Use after free in WebGL. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-13</li>
	 <li>[493900619] High CVE-2026-5286: Use after free in Dawn. Reported by sweetchip on 2026-03-18</li>
	 <li>[494644471] High CVE-2026-5287: Use after free in PDF. Reported by Syn4pse on 2026-03-21</li>
	 <li>[495507390] High CVE-2026-5288: Use after free in WebView. Reported by Google on 2026-03-23</li>
	 <li>[495931147] High CVE-2026-5289: Use after free in Navigation. Reported by Google on 2026-03-25</li>
	 <li>[496205576] High CVE-2026-5290: Use after free in Compositing. Reported by Google on 2026-03-25</li>
	 <li>[490118036] Medium CVE-2026-5291: Inappropriate implementation in WebGL. Reported by heapracer (@heapracer) on 2026-03-06</li>
	 <li>[492213293] Medium CVE-2026-5292: Out of bounds read in WebCodecs. Reported by Google on 2026-03-12</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-5273</cvename>
 <cvename>CVE-2026-5272</cvename>
 <cvename>CVE-2026-5274</cvename>
 <cvename>CVE-2026-5275</cvename>
 <cvename>CVE-2026-5276</cvename>
 <cvename>CVE-2026-5277</cvename>
 <cvename>CVE-2026-5278</cvename>
 <cvename>CVE-2026-5279</cvename>
 <cvename>CVE-2026-5280</cvename>
 <cvename>CVE-2026-5281</cvename>
 <cvename>CVE-2026-5282</cvename>
 <cvename>CVE-2026-5283</cvename>
 <cvename>CVE-2026-5284</cvename>
 <cvename>CVE-2026-5285</cvename>
 <cvename>CVE-2026-5286</cvename>
 <cvename>CVE-2026-5287</cvename>
 <cvename>CVE-2026-5288</cvename>
 <cvename>CVE-2026-5289</cvename>
 <cvename>CVE-2026-5290</cvename>
 <cvename>CVE-2026-5291</cvename>
 <cvename>CVE-2026-5292</cvename>
 <url>https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html</url>
 </references>
 <dates>
 <discovery>2026-03-31</discovery>
 <entry>2026-04-01</entry>
 </dates>
 </vuln>

<vuln vid="09e36f7e-2b5b-11f1-852e-5404a68ad561">
 <topic>traefik -- Multiple vulnerabilities</topic>
 <affects>
<package>
<name>traefik</name>
<range><lt>3.6.12</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The traefik project releases a new version addressing multiple CVEs:
	<blockquote cite="https://github.com/traefik/traefik/releases/tag/v3.6.12">
	 <ul>
	 <li>CVE-2026-33433 (BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField)</li>
	 <li>CVE-2026-33186 (authorization bypass via missing leading slash in :path)</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-33433</cvename>
 <cvename>CVE-2026-33186</cvename>
 <url>https://github.com/traefik/traefik/releases/tag/v3.6.12</url>
 </references>
 <dates>
 <discovery>2026-03-26</discovery>
 <entry>2026-03-29</entry>
 </dates>
 </vuln>

<vuln vid="095e9db2-2b5b-11f1-9839-8447094a420f">
 <topic>Roundcube -- SVG Attribute Bypass</topic>
 <affects>
 <package>
	<name>roundcube-php82</name>
	<name>roundcube-php83</name>
	<name>roundcube-php84</name>
	<name>roundcube-php85</name>
	<range><lt>1.6.15,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Roundcube project reports:
	<blockquote cite="https://github.com/roundcube/roundcubemail/releases/tag/1.6.15">
	 .
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/roundcube/roundcubemail/releases/tag/1.6.15</url>
 </references>
 <dates>
 <discovery>2026-03-29</discovery>
 <entry>2026-03-29</entry>
 </dates>
 </vuln>

<vuln vid="b933083e-2b2e-11f1-b60a-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.10.0</ge><lt>18.10.1</lt></range>
<range><ge>18.9.0</ge><lt>18.9.3</lt></range>
<range><ge>7.11.0</ge><lt>18.8.7</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/">
	 Improper Handling of Parameters issue in Jira Connect installations impacts GitLab CE/EE
	 Cross-Site Request Forgery issue in GLQL API impacts GitLab CE/EE
	 HTML Injection in vulnerability report impacts GitLab EE
	 Denial of Service issue in GraphQL API impacts GitLab CE/EE
	 Improper Access Control issue in WebAuthn 2FA impacts GitLab CE/EE
	 Improper Access Control issue in GraphQL query impacts GitLab EE
	 Denial of Service issue in CI configuration processing impacts GitLab CE/EE
	 Denial of Service issue in webhook configuration impacts GitLab CE/EE
	 Cross-site Scripting issue in Mermaid diagram renderer impacts GitLab CE/EE
	 Improper Access Control issue in Merge Requests impacts GitLab CE/EE
	 Access Control issue in GraphQL API impacts GitLab EE
	 Incorrect Authorization issue in authorization caching impacts GitLab EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-2370</cvename>
 <cvename>CVE-2026-3857</cvename>
 <cvename>CVE-2026-2995</cvename>
 <cvename>CVE-2026-3988</cvename>
 <cvename>CVE-2026-2745</cvename>
 <cvename>CVE-2026-1724</cvename>
 <cvename>CVE-2025-13436</cvename>
 <cvename>CVE-2025-13078</cvename>
 <cvename>CVE-2026-2973</cvename>
 <cvename>CVE-2026-2726</cvename>
 <cvename>CVE-2025-14595</cvename>
 <cvename>CVE-2026-4363</cvename>
 <url>https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/</url>
 </references>
 <dates>
 <discovery>2026-03-25</discovery>
 <entry>2026-03-29</entry>
 </dates>
 </vuln>

<vuln vid="970fd0ec-26f5-11f1-a9b1-0cc47ada5f32">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.555</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.541.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory 2026-03-18:
	<blockquote cite="https://www.jenkins.io/security/advisory/2026-03-18/">
	 <ul>
	 <li>SECURITY-3657 / CVE-2026-33001: Arbitrary file write
	 vulnerability through specially crafted archives in Jenkins
	 (High)</li>
	 <li>SECURITY-3674 / CVE-2026-33002: DNS rebinding vulnerability
	 in WebSocket CLI origin validation in Jenkins (High)</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-33001</cvename>
 <cvename>CVE-2026-33002</cvename>
 <url>https://www.jenkins.io/security/advisory/2026-03-18/</url>
 </references>
 <dates>
 <discovery>2026-03-18</discovery>
 <entry>2026-03-27</entry>
 </dates>
 </vuln>

<vuln vid="26c24872-2943-11f1-8461-b42e991fc52e">
 <topic>Mozilla -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>149.0.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>149.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE-2026-4729: Memory safety bugs
	CVE-2026-4728: Spoofing issue in the Privacy: Anti-Tracking
	component.
	CVE-2026-4727: Denial-of-service in the Libraries component
	in NSS.
	CVE-2026-4726: Denial-of-service in the XML component.
	CVE-2026-4725: Sandbox escape due to use-after-free in the
	Graphics: Canvas2D component.
	CVE-2026-4724: Undefined behavior in the Audio/Video
	component.
	CVE-2026-4723: Use-after-free in the JavaScript Engine
	component.
	CVE-2026-4722: Privilege escalation in the IPC component.
 </body>
 </description>
 <references>
 <cvename>CVE-2026-4729</cvename>
 <cvename>CVE-2026-4728</cvename>
 <cvename>CVE-2026-4727</cvename>
 <cvename>CVE-2026-4726</cvename>
 <cvename>CVE-2026-4725</cvename>
 <cvename>CVE-2026-4724</cvename>
 <cvename>CVE-2026-4723</cvename>
 <cvename>CVE-2026-4722</cvename>
 </references>
 <dates>
 <discovery>2026-03-24</discovery>
 <entry>2026-03-26</entry>
 </dates>
 </vuln>

<vuln vid="32819a60-2943-11f1-8461-b42e991fc52e">
 <topic>Mozilla -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>149.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.9.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>149.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE-2026-4721: Memory safety bugs. Potential arbitrary code
	execution.
	CVE-2026-4709: Incorrect boundary conditions in the
	Audio/Video: GMP component.
	CVE-2026-4707: Incorrect boundary conditions in the Graphics:
	Canvas2D component.
	CVE-2026-4706: Incorrect boundary conditions in the Graphics:
	Canvas2D component.
	CVE-2026-4699: Incorrect boundary conditions in the Layout:
	Text and Fonts component.
	CVE-2026-4698: JIT miscompilation in the JavaScript Engine:
	JIT component.
	CVE-2026-4696: Use-after-free in the Layout: Text and Fonts
	component.
	CVE-2026-4694: Incorrect boundary conditions, integer
	overflow in the Graphics component.
	CVE-2026-4693: Incorrect boundary conditions in the
	Audio/Video: Playback component.
	CVE-2026-4692: Sandbox escape in the Responsive Design Mode
	component.
	CVE-2026-4691: Use-after-free in the CSS Parsing and
	Computation component.
	CVE-2026-4690: Sandbox escape due to integer overflow in the
	XPCOM component.
	CVE-2026-4689: Sandbox escape due to integer overflow in the
	XPCOM component.
	CVE-2026-4687: Sandbox escape in the Telemetry component.
	CVE-2026-4686: Incorrect boundary conditions in the Graphics:
	Canvas2D component.
	CVE-2026-4685: Incorrect boundary conditions in the Graphics:
	Canvas2D component.
	CVE-2026-4684: Race condition, use-after-free in the
	Graphics: WebRender component.
 </body>
 </description>
 <references>
 <cvename>CVE-2026-4721</cvename>
 <cvename>CVE-2026-4709</cvename>
 <cvename>CVE-2026-4707</cvename>
 <cvename>CVE-2026-4706</cvename>
 <cvename>CVE-2026-4699</cvename>
 <cvename>CVE-2026-4698</cvename>
 <cvename>CVE-2026-4696</cvename>
 <cvename>CVE-2026-4694</cvename>
 <cvename>CVE-2026-4693</cvename>
 <cvename>CVE-2026-4692</cvename>
 <cvename>CVE-2026-4691</cvename>
 <cvename>CVE-2026-4690</cvename>
 <cvename>CVE-2026-4689</cvename>
 <cvename>CVE-2026-4687</cvename>
 <cvename>CVE-2026-4686</cvename>
 <cvename>CVE-2026-4685</cvename>
 <cvename>CVE-2026-4684</cvename>
 </references>
 <dates>
 <discovery>2026-03-24</discovery>
 <entry>2026-03-26</entry>
 </dates>
 </vuln>

<vuln vid="6d445322-2945-11f1-8461-b42e991fc52e">
 <topic>Mozilla -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>149.0.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>149.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE-2026-4688: Sandbox escape due to use-after-free in
	Disability Access APIs.
	CVE-2026-4695: Incorrect boundary conditions in the
	Audio/Video: Web Codecs component.
	CVE-2026-4697: Incorrect boundary conditions in the
	Audio/Video: Web Codecs component.
	CVE-2026-4700: Mitigation bypass in the Networking: HTTP
	component.
	CVE-2026-4701: Use-after-free in the JavaScript Engine
	component.
	CVE-2026-4702: JIT miscompilation in the JavaScript Engine
	component.
	CVE-2026-4704: Denial-of-service in the WebRTC: Signaling
	component.
	CVE-2026-4705: Undefined behavior in the WebRTC: Signaling
	component.
	CVE-2026-4708: Incorrect boundary conditions in the Graphics
	component.
	CVE-2026-4710: Incorrect boundary conditions in the
	Audio/Video component.
	CVE-2026-4711: Use-after-free in the Widget: Cocoa
	component.
	CVE-2026-4712: Information disclosure in the Widget: Cocoa
	component.
	CVE-2026-4713: Incorrect boundary conditions in the Graphics
	component.
	CVE-2026-4714: Incorrect boundary conditions in the
	Audio/Video component.
	CVE-2026-4715: Uninitialized memory in the Graphics: Canvas2D
	component.
	CVE-2026-4716: Incorrect boundary conditions and
	uninitialized memory in the JavaScript Engine.
	CVE-2026-4717: Privilege escalation in the Netmonitor
	component.
	CVE-2026-4718: Undefined behavior in the WebRTC: Signaling
	component.
	CVE-2026-4719: Incorrect boundary conditions in the Graphics:
	Text component.
	CVE-2026-4720: Memory safety bugs
 </body>
 </description>
 <references>
 <cvename>CVE-2026-4688</cvename>
 <cvename>CVE-2026-4695</cvename>
 <cvename>CVE-2026-4697</cvename>
 <cvename>CVE-2026-4700</cvename>
 <cvename>CVE-2026-4701</cvename>
 <cvename>CVE-2026-4702</cvename>
 <cvename>CVE-2026-4704</cvename>
 <cvename>CVE-2026-4705</cvename>
 <cvename>CVE-2026-4708</cvename>
 <cvename>CVE-2026-4710</cvename>
 <cvename>CVE-2026-4711</cvename>
 <cvename>CVE-2026-4712</cvename>
 <cvename>CVE-2026-4713</cvename>
 <cvename>CVE-2026-4714</cvename>
 <cvename>CVE-2026-4715</cvename>
 <cvename>CVE-2026-4716</cvename>
 <cvename>CVE-2026-4717</cvename>
 <cvename>CVE-2026-4718</cvename>
 <cvename>CVE-2026-4719</cvename>
 <cvename>CVE-2026-4720</cvename>
 </references>
 <dates>
 <discovery>2026-03-24</discovery>
 <entry>2026-03-26</entry>
 </dates>
 </vuln>

<vuln vid="733febba-28d2-11f1-b35e-bc241121aa0a">
 <topic>FreeBSD -- Remote code execution via RPCSEC_GSS packet validation</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>15.0</ge><lt>15.0_5</lt></range>
	<range><ge>14.4</ge><lt>14.4_1</lt></range>
	<range><ge>14.3</ge><lt>14.3_10</lt></range>
	<range><ge>13.5</ge><lt>13.5_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	 Each RPCSEC_GSS data packet is validated by a routine which
	 checks a signature in the packet. This routine copies a portion
	 of the packet into a stack buffer, but fails to ensure that the
	 buffer is sufficiently large, and a malicious client can trigger a
	 stack overflow. Notably, this does not require the client to
	 authenticate itself first.
	<h1>Impact:</h1>
	 As kgssapi.ko's RPCSEC_GSS implementation is vulnerable, remote
	 code execution in the kernel is possible by an authenticated user
	 that is able to send packets to the kernel's NFS server while
	 kgssapi.ko is loaded into the kernel.
	 In userspace, applications which have librpcgss_sec loaded and run
	 an RPC server are vulnerable to remote code execution from any
	 client able to send it packets. We are not aware of any such
	 applications in the FreeBSD base system.
 </body>
 </description>
 <references>
 <cvename>CVE-2026-4747</cvename>
 <freebsdsa>SA-26:08.rpcsec_gss</freebsdsa>
 </references>
 <dates>
 <discovery>2026-03-25</discovery>
 <entry>2026-03-26</entry>
 </dates>
 </vuln>

<vuln vid="11bf64f0-28d2-11f1-b35e-bc241121aa0a">
 <topic>FreeBSD -- Remote denial of service via null pointer dereference</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>15.0</ge><lt>15.0_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	 On a system exposing an NVMe/TCP target, a remote client can
	 trigger a kernel panic by sending a CONNECT command for an I/O queue
	 with a bogus or stale CNTLID.
	<h1>Impact:</h1>
	 An attacker with network access to the NVMe/TCP target can
	 trigger an unauthenticated Denial of Service condition on the
	 affected machine.
 </body>
 </description>
 <references>
 <cvename>CVE-2026-4652</cvename>
 <freebsdsa>SA-26:07.nvmf</freebsdsa>
 </references>
 <dates>
 <discovery>2026-03-25</discovery>
 <entry>2026-03-26</entry>
 </dates>
 </vuln>

<vuln vid="7aa913e9-28d1-11f1-b35e-bc241121aa0a">
 <topic>FreeBSD -- TCP: remotely exploitable DoS vector (mbuf leak)</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>15.0</ge><lt>15.0_5</lt></range>
	<range><ge>14.4</ge><lt>14.4_1</lt></range>
	<range><ge>14.3</ge><lt>14.3_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	 When a challenge ACK is to be sent tcp_respond() constructs and
	 sends the challenge ACK and consumes the mbuf that is passed in.
	 When no challenge ACK should be sent the function returns and leaks
	 the mbuf.
	<h1>Impact:</h1>
	 If an attacker is either on path with an established TCP
	 connection, or can themselves establish a TCP connection, to an
	 affected FreeBSD machine, they can easily craft and send packets
	 which meet the challenge ACK criteria and cause the FreeBSD host
	 to leak an mbuf for each crafted packet in excess of the configured
	 rate limit settings i.e. with default settings, crafted packets
	 in excess of the first 5 sent within a 1s period will leak an mbuf.
	 Technically, off-path attackers can also exploit this problem by
	 guessing the IP addresses, TCP port numbers and in some cases the
	 sequence numbers of established connections and spoofing packets
	 towards a FreeBSD machine, but this is harder to do effectively.
 </body>
 </description>
 <references>
 <cvename>CVE-2026-4247</cvename>
 <freebsdsa>SA-26:06.tcp</freebsdsa>
 </references>
 <dates>
 <discovery>2026-03-25</discovery>
 <entry>2026-03-26</entry>
 </dates>
 </vuln>

<vuln vid="07d6b170-fed8-4ee2-ba96-b6d61b6d6a26">
 <topic>chromium -- security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>146.0.7680.164</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>146.0.7680.164</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_23.html">
	 This update includes 8 security fixes:
	 <ul>
	 <li>[485397284] High CVE-2026-4673: Heap buffer overflow in WebAudio. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-18</li>
	 <li>[488188166] High CVE-2026-4674: Out of bounds read in CSS. Reported by Syn4pse on 2026-02-27</li>
	 <li>[488270257] High CVE-2026-4675: Heap buffer overflow in WebGL. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-02-27</li>
	 <li>[488613135] High CVE-2026-4676: Use after free in Dawn. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-01</li>
	 <li>[490533968] High CVE-2026-4677: Out of bounds read in WebAudio. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-07</li>
	 <li>[491164019] High CVE-2026-4678: Use after free in WebGPU. Reported by Google on 2026-03-10</li>
	 <li>[491516670] High CVE-2026-4679: Integer overflow in Fonts. Reported by GF, Un3xploitable Of DeadSec on 2026-03-11</li>
	 <li>[491869946] High CVE-2026-4680: Use after free in FedCM. Reported by Shaheen Fazim on 2026-03-12</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-4673</cvename>
 <cvename>CVE-2026-4674</cvename>
 <cvename>CVE-2026-4675</cvename>
 <cvename>CVE-2026-4676</cvename>
 <cvename>CVE-2026-4677</cvename>
 <cvename>CVE-2026-4678</cvename>
 <cvename>CVE-2026-4679</cvename>
 <cvename>CVE-2026-4680</cvename>
 <url>https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_23.html</url>
 </references>
 <dates>
 <discovery>2026-03-23</discovery>
 <entry>2026-03-24</entry>
 </dates>
 </vuln>

<vuln vid="3c370171-b6b6-463a-8746-ee49bea08c87">
 <topic>chromium -- security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>146.0.7680.153</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>146.0.7680.153</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html">
	 This update includes 26 security fixes:
	 <ul>
	 <li>[475877320] Critical CVE-2026-4439: Out of bounds memory access in WebGL. Reported by Goodluck on 2026-01-15</li>
	 <li>[485935305] Critical CVE-2026-4440: Out of bounds read and write in WebGL. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-20</li>
	 <li>[489381399] Critical CVE-2026-4441: Use after free in Base. Reported by Google on 2026-03-03</li>
	 <li>[484751092] High CVE-2026-4442: Heap buffer overflow in CSS. Reported by Syn4pse on 2026-02-16</li>
	 <li>[485292589] High CVE-2026-4443: Heap buffer overflow in WebAudio. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-18</li>
	 <li>[486349161] High CVE-2026-4444: Stack buffer overflow in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-21</li>
	 <li>[486421953] High CVE-2026-4445: Use after free in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-22</li>
	 <li>[486421954] High CVE-2026-4446: Use after free in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-22</li>
	 <li>[486657483] High CVE-2026-4447: Inappropriate implementation in V8. Reported by Erge on 2026-02-23</li>
	 <li>[486972661] High CVE-2026-4448: Heap buffer overflow in ANGLE. Reported by M. Fauzan Wijaya (Gh05t666nero) on 2026-02-23</li>
	 <li>[487117772] High CVE-2026-4449: Use after free in Blink. Reported by Syn4pse on 2026-02-24</li>
	 <li>[487746373] High CVE-2026-4450: Out of bounds write in V8. Reported by qymag1c on 2026-02-26</li>
	 <li>[487768779] High CVE-2026-4451: Insufficient validation of untrusted input in Navigation. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-26</li>
	 <li>[487977696] High CVE-2026-4452: Integer overflow in ANGLE. Reported by cinzinga on 2026-02-26</li>
	 <li>[488400770] High CVE-2026-4453: Integer overflow in Dawn. Reported by sweetchip on 2026-02-27</li>
	 <li>[488585488] High CVE-2026-4454: Use after free in Network. Reported by heapracer (@heapracer) on 2026-03-01</li>
	 <li>[488585504] High CVE-2026-4455: Heap buffer overflow in PDFium. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-01</li>
	 <li>[488617440] High CVE-2026-4456: Use after free in Digital Credentials API. Reported by sean wong on 2026-02-28</li>
	 <li>[488803413] High CVE-2026-4457: Type Confusion in V8. Reported by Zhenpeng (Leo) Lin at depthfirst on 2026-03-01</li>
	 <li>[489619753] High CVE-2026-4458: Use after free in Extensions. Reported by Shaheen Fazim on 2026-03-04</li>
	 <li>[490246422] High CVE-2026-4459: Out of bounds read and write in WebAudio. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-03-06</li>
	 <li>[490254124] High CVE-2026-4460: Out of bounds read in Skia. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-06</li>
	 <li>[490558172] High CVE-2026-4461: Inappropriate implementation in V8. Reported by Google on 2026-03-07</li>
	 <li>[491080830] High CVE-2026-4462: Out of bounds read in Blink. Reported by heapracer (@heapracer) on 2026-03-09</li>
	 <li>[491358681] High CVE-2026-4463: Heap buffer overflow in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-10</li>
	 <li>[487208468] Medium CVE-2026-4464: Integer overflow in ANGLE. Reported by heesun on 2026-02-24</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-4439</cvename>
 <cvename>CVE-2026-4440</cvename>
 <cvename>CVE-2026-4441</cvename>
 <cvename>CVE-2026-4442</cvename>
 <cvename>CVE-2026-4443</cvename>
 <cvename>CVE-2026-4444</cvename>
 <cvename>CVE-2026-4445</cvename>
 <cvename>CVE-2026-4446</cvename>
 <cvename>CVE-2026-4447</cvename>
 <cvename>CVE-2026-4448</cvename>
 <cvename>CVE-2026-4449</cvename>
 <cvename>CVE-2026-4450</cvename>
 <cvename>CVE-2026-4451</cvename>
 <cvename>CVE-2026-4452</cvename>
 <cvename>CVE-2026-4453</cvename>
 <cvename>CVE-2026-4454</cvename>
 <cvename>CVE-2026-4455</cvename>
 <cvename>CVE-2026-4456</cvename>
 <cvename>CVE-2026-4457</cvename>
 <cvename>CVE-2026-4458</cvename>
 <cvename>CVE-2026-4459</cvename>
 <cvename>CVE-2026-4460</cvename>
 <cvename>CVE-2026-4461</cvename>
 <cvename>CVE-2026-4462</cvename>
 <cvename>CVE-2026-4463</cvename>
 <cvename>CVE-2026-4464</cvename>
 <url>https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html</url>
 </references>
 <dates>
 <discovery>2026-03-18</discovery>
 <entry>2026-03-24</entry>
 </dates>
 </vuln>

<vuln vid="832a823b-25b5-11f1-b6f8-5404a68ad561">
 <topic>traefik -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>traefik</name>
	<range><lt>3.6.11</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The traefik project releases a new version addressing multiple CVEs:
	<blockquote cite="https://github.com/traefik/traefik/releases/tag/v3.6.11">
	 <ul>
	 <li>CVE-2026-32595 (BasicAuth Middleware Timing Attack)</li>
	 <li>CVE-2026-32305 (Potential mTLS Bypass via Fragmented TLS ClientHello)</li>
	 <li>CVE-2026-32695 (Details not yet available)</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-32595</cvename>
 <cvename>CVE-2026-32305</cvename>
 <cvename>CVE-2026-32695</cvename>
 <url>https://github.com/traefik/traefik/releases/tag/v3.6.11</url>
 </references>
 <dates>
 <discovery>2026-03-19</discovery>
 <entry>2026-03-22</entry>
 </dates>
 </vuln>

<vuln vid="71b4ce56-23c5-11f1-b865-b42e991fc52e">
 <topic>UniFi Network Application - Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>unifi10</name>
	<range><lt>10.1.89</lt></range>
 </package>
 <package>
	<name>unifi9</name>
	<range><lt>9.0.114</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://community.ui.com/releases/Security-Advisory-Bulletin-062-062/c29719c0-405e-4d4a-8f26-e343e99f931b reports:
	<blockquote cite="https://community.ui.com/releases/Security-Advisory-Bulletin-062-062/c29719c0-405e-4d4a-8f26-e343e99f931b">
	 An Authenticated NoSQL Injection vulnerability found in
	 UniFi Network Application could allow a malicious actor with
	 authenticated access to the network to escalate
	 privileges.
	 A malicious actor with access to the network could
	 exploit a Path Traversal vulnerability found in the UniFi
	 Network Application to access files on the underlying system
	 that could be manipulated to access an underlying
	 account.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-22558</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-22558</url>
 <cvename>CVE-2026-22557</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-22557</url>
 </references>
 <dates>
 <discovery>2026-03-19</discovery>
 <entry>2026-03-19</entry>
 </dates>
 </vuln>

<vuln vid="c5b93cb5-2363-11f1-81da-8447094a420f">
 <topic>Roundcube -- Multiple vulnerabilities</topic>
 <affects>
	<package>
	<name>roundcube-php82</name>
	<name>roundcube-php83</name>
	<name>roundcube-php84</name>
	<name>roundcube-php85</name>
	<range><lt>1.6.14,1</lt></range>
	</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Roundcube project reports:
	<blockquote cite="https://github.com/roundcube/roundcubemail/releases/tag/1.6.14">
	 pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler
	 password could get changed without providing the old password
	 IMAP Injection + CSRF bypass in mail search
	 remote image blocking bypass via various SVG animate attributes
	 remote image blocking bypass via a crafted body background attribute
	 fixed position mitigation bypass via use of !important
	 XSS issue in a HTML attachment preview
	 SSRF + Information Disclosure via stylesheet links to a local network hosts
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/roundcube/roundcubemail/releases/tag/1.6.14</url>
 </references>
 <dates>
 <discovery>2026-03-18</discovery>
 <entry>2026-03-19</entry>
 </dates>
 </vuln>

<vuln vid="db3bdcc6-377f-47d9-9ce8-4bdede4fdafe">
 <topic>homebox -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>homebox</name>
	<range><lt>0.24.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Homebox reports:
	<ul>
	 <li>[HIGH] CVE-2026-27981: Auth Rate Limit Bypass via IP Spoofing</li>
	 <li>[MODERATE] CVE-2026-27600: Blind SSRF</li>
	 <li>[MODERATE] CVE-2026-26272: Stored XSS via HTML/SVG Attachment Upload</li>
	</ul>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-27981</cvename>
 <cvename>CVE-2026-27600</cvename>
 <cvename>CVE-2026-26272</cvename>
 </references>
 <dates>
 <discovery>2026-03-01</discovery>
 <entry>2026-03-17</entry>
 </dates>
 </vuln>

<vuln vid="73eeb578-fd13-4d79-b50b-ed25c3614528">
 <topic>chromium -- security fix</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>146.0.7680.80</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>146.0.7680.80</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[491421267] High CVE-2026-3909: Out of bounds write in Skia. Reported by Google Threat Analysis Group on 2026-03-10</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-3909</cvename>
 <url>https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html</url>
 </references>
 <dates>
 <discovery>2026-03-13</discovery>
 <entry>2026-03-15</entry>
 </dates>
 </vuln>

<vuln vid="26776062-fd24-4c2f-bf6c-7f231948ab19">
 <topic>chromium -- security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>146.0.7680.75</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>146.0.7680.75</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[491421267] High CVE-2026-3909: Out of bounds write in Skia. Reported by Google on 2026-03-10</li>
	 <li>[491410818] High CVE-2026-3910: Inappropriate implementation in V8. Reported by Google on 2026-03-10</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-3909</cvename>
 <cvename>CVE-2026-3910</cvename>
 <url>https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html</url>
 </references>
 <dates>
 <discovery>2026-03-12</discovery>
 <entry>2026-03-15</entry>
 </dates>
 </vuln>

<vuln vid="e45fb606-b731-4871-881d-27a1d5e2fd03">
 <topic>chromium -- security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>146.0.7680.71</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>146.0.7680.71</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_10.html">
	 This update includes 29 security fixes:
	 <ul>
	 <li>[483445078] Critical CVE-2026-3913: Heap buffer overflow in WebML. Reported by Tobias Wienand on 2026-02-10</li>
	 <li>[481776048] High CVE-2026-3914: Integer overflow in WebML. Reported by cinzinga on 2026-02-04</li>
	 <li>[483971526] High CVE-2026-3915: Heap buffer overflow in WebML. Reported by Tobias Wienand on 2026-02-12</li>
	 <li>[482828615] High CVE-2026-3916: Out of bounds read in Web Speech. Reported by Grischa Hauser on 2026-02-09</li>
	 <li>[483569512] High CVE-2026-3917: Use after free in Agents. Reported by Syn4pse on 2026-02-11</li>
	 <li>[483853103] High CVE-2026-3918: Use after free in WebMCP. Reported by Syn4pse on 2026-02-12</li>
	 <li>[444176961] High CVE-2026-3919: Use after free in Extensions. Reported by Huinian Yang (@vmth6) of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2025-09-10</li>
	 <li>[482875307] High CVE-2026-3920: Out of bounds memory access in WebML. Reported by Google on 2026-02-09</li>
	 <li>[484946544] High CVE-2026-3921: Use after free in TextEncoding. Reported by Pranamya Keshkamat &amp; Cantina.xyz on 2026-02-17</li>
	 <li>[485397139] High CVE-2026-3922: Use after free in MediaStream. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-18</li>
	 <li>[485935314] High CVE-2026-3923: Use after free in WebMIDI. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-20</li>
	 <li>[487338366] High CVE-2026-3924: Use after free in WindowDialog. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-25</li>
	 <li>[418214610] Medium CVE-2026-3925: Incorrect security UI in LookalikeChecks. Reported by NDevTK and Alesandro Ortiz on 2025-05-17</li>
	 <li>[478659010] Medium CVE-2026-3926: Out of bounds read in V8. Reported by qymag1c on 2026-01-26</li>
	 <li>[474948986] Medium CVE-2026-3927: Incorrect security UI in PictureInPicture. Reported by Barath Stalin K on 2026-01-11</li>
	 <li>[435980394] Medium CVE-2026-3928: Insufficient policy enforcement in Extensions. Reported by portsniffer443 on 2025-08-03</li>
	 <li>[477180001] Medium CVE-2026-3929: Side-channel information leakage in ResourceTiming. Reported by Povcfe of Tencent Security Xuanwu Lab on 2026-01-20</li>
	 <li>[476898368] Medium CVE-2026-3930: Unsafe navigation in Navigation. Reported by Povcfe of Tencent Security Xuanwu Lab on 2026-01-19</li>
	 <li>[417599694] Medium CVE-2026-3931: Heap buffer overflow in Skia. Reported by Huinian Yang (@vmth6) of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2025-05-14</li>
	 <li>[478296121] Medium CVE-2026-3932: Insufficient policy enforcement in PDF. Reported by Ayato Shitomi on 2026-01-23 </li>
	 <li>[478783560] Medium CVE-2026-3934: Insufficient policy enforcement in ChromeDriver. Reported by Povcfe of Tencent Security Xuanwu Lab on 2026-01-26</li>
	 <li>[479326680] Medium CVE-2026-3935: Incorrect security UI in WebAppInstalls. Reported by Barath Stalin K on 2026-01-28</li>
	 <li>[481920229] Medium CVE-2026-3936: Use after free in WebView. Reported by Am4deu$ on 2026-02-05</li>
	 <li>[473118648] Low CVE-2026-3937: Incorrect security UI in Downloads. Reported by Abhishek Kumar on 2026-01-03</li>
	 <li>[474763968] Low CVE-2026-3938: Insufficient policy enforcement in Clipboard. Reported by vicevirus on 2026-01-10</li>
	 <li>[40058077] Low CVE-2026-3939: Insufficient policy enforcement in PDF. Reported by NDevTK on 2021-11-30</li>
	 <li>[470574526] Low CVE-2026-3940: Insufficient policy enforcement in DevTools. Reported by Jorian Woltjer, Mian, bug_blitzer on 2025-12-21</li>
	 <li>[474670215] Low CVE-2026-3941: Insufficient policy enforcement in DevTools. Reported by Lyra Rebane (rebane2001) on 2026-01-10</li>
	 <li>[475238879] Low CVE-2026-3942: Incorrect security UI in PictureInPicture. Reported by Barath Stalin K on 2026-01-12</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-3913</cvename>
 <cvename>CVE-2026-3914</cvename>
 <cvename>CVE-2026-3915</cvename>
 <cvename>CVE-2026-3916</cvename>
 <cvename>CVE-2026-3917</cvename>
 <cvename>CVE-2026-3918</cvename>
 <cvename>CVE-2026-3919</cvename>
 <cvename>CVE-2026-3920</cvename>
 <cvename>CVE-2026-3921</cvename>
 <cvename>CVE-2026-3922</cvename>
 <cvename>CVE-2026-3923</cvename>
 <cvename>CVE-2026-3924</cvename>
 <cvename>CVE-2026-3925</cvename>
 <cvename>CVE-2026-3926</cvename>
 <cvename>CVE-2026-3927</cvename>
 <cvename>CVE-2026-3928</cvename>
 <cvename>CVE-2026-3929</cvename>
 <cvename>CVE-2026-3930</cvename>
 <cvename>CVE-2026-3931</cvename>
 <cvename>CVE-2026-3932</cvename>
 <cvename>CVE-2026-3934</cvename>
 <cvename>CVE-2026-3935</cvename>
 <cvename>CVE-2026-3936</cvename>
 <cvename>CVE-2026-3937</cvename>
 <cvename>CVE-2026-3938</cvename>
 <cvename>CVE-2026-3939</cvename>
 <cvename>CVE-2026-3940</cvename>
 <cvename>CVE-2026-3941</cvename>
 <cvename>CVE-2026-3942</cvename>
 <url>https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_10.html</url>
 </references>
 <dates>
 <discovery>2026-03-10</discovery>
 <entry>2026-03-15</entry>
 </dates>
 </vuln>

<vuln vid="ee1e6a24-1eeb-11f1-81da-8447094a420f">
 <topic>OpenSSL -- key agreement vulnerability</topic>
 <affects>
 <package>
	<name>openssl35</name>
	<range><lt>3.5.5_1</lt></range>
 </package>
 <package>
	<name>openssl36</name>
	<range><lt>3.6.1_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://openssl-library.org/news/secadv/20260313.txt">
	 TLS 1.3 server may choose unexpected key agreement group (Low)
	 An OpenSSL TLS 1.3 server may fail to negotiate the expected
	 preferred key exchange group when its key exchange group configuration includes
	 the default by using the "DEFAULT" keyword.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-2673</cvename>
 <url>https://openssl-library.org/news/secadv/20260313.txt</url>
 </references>
 <dates>
 <discovery>2026-03-13</discovery>
 <entry>2026-03-13</entry>
 </dates>
 </vuln>

<vuln vid="b45d25ab-1de3-11f1-8aff-b42e991fc52e">
 <topic>Mozilla -- Undefined behavior in the DOM: Core &amp; HTML component</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>148.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.8.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>148.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=2014593 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2014593">
	 Undefined behavior in the DOM: Core &amp; HTML component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-2771</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-2771</url>
 </references>
 <dates>
 <discovery>2026-02-24</discovery>
 <entry>2026-03-12</entry>
 </dates>
 </vuln>

<vuln vid="e1e40d50-1de2-11f1-8aff-b42e991fc52e">
 <topic>Firefox -- Same-origin policy bypass</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>148.0.2,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=2018400 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2018400">
	 Same-origin policy bypass in the CSS Parsing and
	 Computation component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-3846</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-3846</url>
 </references>
 <dates>
 <discovery>2026-03-10</discovery>
 <entry>2026-03-12</entry>
 </dates>
 </vuln>

<vuln vid="df82f42c-1de2-11f1-8aff-b42e991fc52e">
 <topic>firefox -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>148.0.2,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/buglist.cgi?bug_id=2017513%2C2017622%2C2019341 reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=2017513%2C2017622%2C2019341">
	 Memory safety bugs present in Firefox 148.0.2. Some of
	 these bugs showed evidence of memory corruption and we
	 presume that with enough effort some of these could have
	 been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-3847</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-3847</url>
 </references>
 <dates>
 <discovery>2026-03-10</discovery>
 <entry>2026-03-12</entry>
 </dates>
 </vuln>

<vuln vid="0236eab0-1d62-11f1-88f8-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.9.0</ge><lt>18.9.2</lt></range>
<range><ge>18.8.0</ge><lt>18.8.6</lt></range>
<range><ge>1.0.0</ge><lt>18.7.6</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/">
	 Cross-site Scripting issue in Markdown placeholder processing impacts GitLab CE/EE
	 Denial of Service issue in GraphQL API impacts GitLab CE/EE
	 Denial of Service issue in repository archive endpoint impacts GitLab CE/EE
	 Denial of Service issue in protected branches API impacts GitLab CE/EE
	 Denial of Service issue in webhook custom headers impacts GitLab CE/EE
	 Denial of Service issue in webhook endpoint impacts GitLab CE/EE
	 Improper Neutralization of CRLF Sequences issue impacts GitLab CE/EE
	 Improper Access Control issue in runners API impacts GitLab CE/EE
	 Improper Access Control issue in snippet rendering impacts GitLab CE/EE
	 Information Disclosure issue in inaccessible issues impacts GitLab CE/EE
	 Missing Authorization issue in Group Import impacts GitLab CE/EE
	 Incorrect Reference issue in repository download impacts GitLab CE/EE
	 Incorrect Authorization issue in Virtual Registry impacts GitLab EE
	 Improper Escaping of Output issue in Datadog integration impacts GitLab CE/EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-1090</cvename>
 <cvename>CVE-2026-1069</cvename>
 <cvename>CVE-2025-13929</cvename>
 <cvename>CVE-2025-14513</cvename>
 <cvename>CVE-2025-13690</cvename>
 <cvename>CVE-2025-12576</cvename>
 <cvename>CVE-2026-3848</cvename>
 <cvename>CVE-2025-12555</cvename>
 <cvename>CVE-2026-0602</cvename>
 <cvename>CVE-2026-1732</cvename>
 <cvename>CVE-2026-1663</cvename>
 <cvename>CVE-2026-1230</cvename>
 <cvename>CVE-2025-12704</cvename>
 <cvename>CVE-2025-12697</cvename>
 <url>https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/</url>
 </references>
 <dates>
 <discovery>2026-03-11</discovery>
 <entry>2026-03-11</entry>
 </dates>
 </vuln>

<vuln vid="086d53fa-1d47-11f1-81da-8447094a420f">
 <topic>curl -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>8.18.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The curl project reports:
	<blockquote cite="https://curl.se/docs/vuln-8.17.0.html">
	 Multiple vulnerabilities
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-15224</cvename>
 <cvename>CVE-2025-15079</cvename>
 <cvename>CVE-2025-14819</cvename>
 <cvename>CVE-2025-14524</cvename>
 <cvename>CVE-2025-14017</cvename>
 <cvename>CVE-2025-13034</cvename>
 <url>https://curl.se/docs/vuln-8.17.0.html</url>
 </references>
 <dates>
 <discovery>2026-01-06</discovery>
 <entry>2026-03-11</entry>
 </dates>
 </vuln>

<vuln vid="1933737d-1d46-11f1-81da-8447094a420f">
 <topic>curl -- Multiple vulnerabilties</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>8.19.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The curl project reports:
	<blockquote cite="https://curl.se/docs/vuln-8.18.0.html">
	 <ul>
	 <li>use after free in SMB connection reuse</li>
	 <li>wrong proxy connection reuse with credentials</li>
	 <li>token leak with redirect and netrc</li>
	 <li>bad reuse of HTTP Negotiate connection</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-3805</cvename>
 <cvename>CVE-2026-3784</cvename>
 <cvename>CVE-2026-3783</cvename>
 <cvename>CVE-2026-1965</cvename>
 <url>https://curl.se/docs/vuln-8.18.0.html</url>
 </references>
 <dates>
 <discovery>2026-03-11</discovery>
 <entry>2026-03-11</entry>
 </dates>
 </vuln>

<vuln vid="791d4b29-19fb-11f1-87cc-e73692421fef">
 <topic>gstreamer1 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gstreamer1</name>
	<range><lt>1.28.1</lt></range>
 </package>
 <package>
	<name>gstreamer1-plugins</name>
	<range><lt>1.28.1</lt></range>
 </package>
 <package>
	<name>gstreamer1-plugins-good</name>
	<range><lt>1.28.1</lt></range>
 </package>
 <package>
	<name>gstreamer1-plugins-bad</name>
	<range><lt>1.28.1</lt></range>
 </package>
 <package>
	<name>gstreamer1-plugins-ugly</name>
	<range><lt>1.28.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GStreamer project reports multiple security vulnerabilities fixed in the 1.28.1 release:
	<blockquote cite="https://gstreamer.freedesktop.org/security/">
	 Twelve security vulnerabilities were addressed, including:
	 <ul>
	 <li>Out-of-bounds reads and writes in the H.266 video parser, WAV parser,
	 MP4 and ASF demuxers, and DVB subtitle decoder.</li>
	 <li>Integer overflows in the RIFF parser and Huffman table handling in the JPEG parser.</li>
	 <li>Stack buffer overflows in the RTP QDM2 depayloader and H.266 parser.</li>
	 </ul>
	 These could lead to application crashes or potentially arbitrary code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-1940</cvename>
 <cvename>CVE-2026-3082</cvename>
 <cvename>CVE-2026-2921</cvename>
 <cvename>CVE-2026-2922</cvename>
 <cvename>CVE-2026-2920</cvename>
 <cvename>CVE-2026-2923</cvename>
 <cvename>CVE-2026-3083</cvename>
 <cvename>CVE-2026-3085</cvename>
 <cvename>CVE-2026-3086</cvename>
 <cvename>CVE-2026-3081</cvename>
 <cvename>CVE-2026-3084</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2026-0001.html</url>
 <url>https://gstreamer.freedesktop.org/security/sa-2026-0002.html</url>
 <url>https://gstreamer.freedesktop.org/security/sa-2026-0003.html</url>
 <url>https://gstreamer.freedesktop.org/security/sa-2026-0004.html</url>
 <url>https://gstreamer.freedesktop.org/security/sa-2026-0005.html</url>
 <url>https://gstreamer.freedesktop.org/security/sa-2026-0006.html</url>
 <url>https://gstreamer.freedesktop.org/security/sa-2026-0007.html</url>
 <url>https://gstreamer.freedesktop.org/security/sa-2026-0008.html</url>
 <url>https://gstreamer.freedesktop.org/security/sa-2026-0009.html</url>
 <url>https://gstreamer.freedesktop.org/security/sa-2026-0010.html</url>
 <url>https://gstreamer.freedesktop.org/security/sa-2026-0011.html</url>
 <url>https://gstreamer.freedesktop.org/security/sa-2026-0012.html</url>
 </references>
 <dates>
 <discovery>2026-02-25</discovery>
 <entry>2026-03-07</entry>
 </dates>
 </vuln>

<vuln vid="10319b08-f050-4beb-95e3-fe025cdafd25">
 <topic>oauth2-proxy -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>oauth2-proxy</name>
	<range><lt>7.14.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed.
 </body>
 </description>
 <references>
 <cvename>CVE-2025-68121</cvename>
 </references>
 <dates>
 <discovery>2026-02-05</discovery>
 <entry>2026-02-27</entry>
 </dates>
 </vuln>

<vuln vid="15f4e0f6-1338-11f1-a55d-b42e991fc52e">
 <topic>Mozilla -- Multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>firefox</name>
 <range><lt>148.0.0,2</lt></range>
 </package>
 <package>
 <name>firefox-esr</name>
 <range><lt>140.8.0</lt></range>
 </package>
 <package>
 <name>thunderbird</name>
 <range><lt>148.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE-2026-2809: Memory safety bug in the JavaScript: WebAssembly component.
	CVE-2026-2808: Integer overflow in the JavaScript: Standard Library component.
 </body>
 </description>
 <references>
 <cvename>CVE-2026-2809</cvename>
 <cvename>CVE-2026-2808</cvename>
 </references>
 <dates>
 <discovery>2026-02-24</discovery>
 <entry>2026-02-26</entry>
 </dates>
 </vuln>

<vuln vid="1124a7b0-1338-11f1-a55d-b42e991fc52e">
 <topic>Firefox -- Multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>firefox</name>
 <range><lt>148.0.0,2</lt></range>
 </package>
 <package>
 <name>thunderbird</name>
 <range><lt>148.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE-2026-2807: Memory safety bugs present in Firefox 147 and Thunderbird 147
	CVE-2026-2806: Uninitialized memory in the Graphics: Text component.
	CVE-2026-2805: Invalid pointer in the DOM: Core &amp; HTML component.
	CVE-2026-2804: Use-after-free in the JavaScript: WebAssembly component.
	CVE-2026-2803: Information disclosure, mitigation bypass in the Settings
 UI component.
	CVE-2026-2802: Race condition in the JavaScript: GC component.
	CVE-2026-2801: Incorrect boundary conditions in the JavaScript:
 WebAssembly component.
	CVE-2026-2799: Use-after-free in the DOM: Core &amp; HTML component.
	CVE-2026-2798: Use-after-free in the DOM: Core &amp; HTML component.
	CVE-2026-2797: Use-after-free in the JavaScript: GC component.
	CVE-2026-2796: JIT miscompilation in the JavaScript: WebAssembly component
	CVE-2026-2795: Use-after-free in the JavaScript: GC component.
 </body>
 </description>
 <references>
 <cvename>CVE-2026-2807</cvename>
 <cvename>CVE-2026-2806</cvename>
 <cvename>CVE-2026-2805</cvename>
 <cvename>CVE-2026-2804</cvename>
 <cvename>CVE-2026-2803</cvename>
 <cvename>CVE-2026-2802</cvename>
 <cvename>CVE-2026-2801</cvename>
 <cvename>CVE-2026-2799</cvename>
 <cvename>CVE-2026-2798</cvename>
 <cvename>CVE-2026-2797</cvename>
 <cvename>CVE-2026-2796</cvename>
 <cvename>CVE-2026-2795</cvename>
 </references>
 <dates>
 <discovery>2026-02-24</discovery>
 <entry>2026-02-26</entry>
 </dates>
 </vuln>

<vuln vid="102a03c9-1316-11f1-93ca-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.9.0</ge><lt>18.9.1</lt></range>
<range><ge>18.8.0</ge><lt>18.8.5</lt></range>
<range><ge>9.0.0</ge><lt>18.7.5</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/">
	 Cross-site Scripting issue in Mermaid sandbox impacts GitLab CE/EE
	 Denial of Service issue in container registry impacts GitLab CE/EE
	 Denial of Service issue in Jira events endpoint impacts GitLab CE/EE
	 Regular Expression Denial of Service issue in GitLab merge requests impacts GitLab CE/EE
	 Missing rate limit in Bitbucket Server importer impacts GitLab CE/EE
	 Denial of Service issue in CI trigger API impacts GitLab CE/EE
	 Denial of Service issue in token decoder impacts GitLab CE/EE
	 Improper Access Control issue in Conan package registry impacts GitLab EE
	 Access Control issue in CI job mutation impacts GitLab CE/EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-0752</cvename>
 <cvename>CVE-2025-14511</cvename>
 <cvename>CVE-2026-1662</cvename>
 <cvename>CVE-2026-1388</cvename>
 <cvename>CVE-2026-2845</cvename>
 <cvename>CVE-2025-3525</cvename>
 <cvename>CVE-2026-1725</cvename>
 <cvename>CVE-2026-1747</cvename>
 <cvename>CVE-2025-14103</cvename>
 <url>https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/</url>
 </references>
 <dates>
 <discovery>2026-02-25</discovery>
 <entry>2026-02-26</entry>
 </dates>
 </vuln>

<vuln vid="fe6209a3-126c-11f1-8a62-0897988a1c07">
 <topic>mail/mailpit -- Server-Side Request Forgery (SSRF) via Link Check API</topic>
 <affects>
 <package>
	<name>mailpit</name>
	<range><lt>1.29.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Mailpit author reports:
	<blockquote cite="https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3">
	 The Link Check API (/api/v1/message/{ID}/link-check)
	 is vulnerable to Server-Side Request Forgery (SSRF). The
	 server performs HTTP HEAD requests to every URL found in
	 an email without validating target hosts or filtering
	 private/internal IP addresses. The response returns status
	 codes and status text per link, making this a non-blind
	 SSRF. In the default configuration (no authentication on
	 SMTP or API), this is fully exploitable remotely with
	 zero user interaction.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-27808</cvename>
 <url>https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3</url>
 </references>
 <dates>
 <discovery>2026-02-25</discovery>
 <entry>2026-02-25</entry>
 </dates>
 </vuln>

<vuln vid="fbc47390-11e9-11f1-8148-bc241121aa0a">
 <topic>FreeBSD -- Local DoS and possible privilege escalation via routing sockets</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>15.0</ge><lt>15.0_4</lt></range>
	<range><ge>14.3</ge><lt>14.3_9</lt></range>
	<range><ge>13.5</ge><lt>13.5_10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The rtsock_msg_buffer() function serializes routing information
	into a buffer. As a part of this, it copies sockaddr structures
	into a sockaddr_storage structure on the stack. It assumes that
	the source sockaddr length field had already been validated, but
	this is not necessarily the case, and it's possible for a malicious
	userspace program to craft a request which triggers a 127-byte
	overflow.
	In practice, this overflow immediately overwrites the canary for
	the rtsock_msg_buffer() stack frame, resulting in a panic once the
	function returns.
	<h1>Impact:</h1>
	The bug allows an unprivileged user to crash the kernel by
	triggering a stack buffer overflow in rtsock_msg_buffer(). In
	particular, the overflow will corrupt a stack canary value that is
	verified when the function returns; this mitigates the impact of
	the stack overflow by triggering a kernel panic.
	Other kernel bugs may exist which allow userspace to find the canary
	value and thus defeat the mitigation, at which point local privilege
	escalation may be possible.
 </body>
 </description>
 <references>
 <cvename>CVE-2026-3038</cvename>
 <freebsdsa>SA-26:05.route</freebsdsa>
 </references>
 <dates>
 <discovery>2026-02-24</discovery>
 <entry>2026-02-25</entry>
 </dates>
 </vuln>

<vuln vid="a88f5b2d-11e9-11f1-8148-bc241121aa0a">
 <topic>FreeBSD -- Jail chroot escape via fd exchange with a different jail</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.3</ge><lt>14.3_9</lt></range>
	<range><ge>13.5</ge><lt>13.5_10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	If two sibling jails are restricted to separate filesystem
	trees, which is to say that neither of the two jail root directories
	is an ancestor of the other, jailed processes may nonetheless be
	able to access a shared directory via a nullfs mount, if the
	administrator has configured one.
	In this case, cooperating processes in the two jails may establish
	a connection using a unix domain socket and exchange directory
	descriptors with each other.
	When performing a filesystem name lookup, at each step of the lookup,
	the kernel checks whether the lookup would descend below the jail
	root of the current process. If the jail root directory is not
	encountered, the lookup continues.
	<h1>Impact:</h1>
	In a configuration where processes in two different jails are
	able to exchange file descriptors using a unix domain socket, it
	is possible for a jailed process to receive a directory for a
	descriptor that is below that process' jail root. This enables
	full filesystem access for a jailed process, breaking the chroot.
	Note that the system administrator is still responsible for ensuring
	that an unprivileged user on the jail host is not able to pass
	directory descriptors to a jailed process, even in a patched
	kernel.
 </body>
 </description>
 <references>
 <cvename>CVE-2025-15576</cvename>
 <freebsdsa>SA-26:04.jail</freebsdsa>
 </references>
 <dates>
 <discovery>2026-02-24</discovery>
 <entry>2026-02-25</entry>
 </dates>
 </vuln>

<vuln vid="4594110e-1151-11f1-b3f8-8447094a420f">
 <topic>Vaultwarden -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>vaultwarden</name>
	<range><lt>1.35.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Vaultwarden project reports:
	<blockquote cite="https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.4">
	 <ul>
	 <li>GHSA-w9f8-m526-h7fh. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID.</li>
	 <li>GHSA-h4hq-rgvh-wh27. This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them.</li>
	 <li>GHSA-r32r-j5jq-3w4m. This vulnerability allows an attacker with manager-level access within an organization to modify collections they are not assigned.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.4</url>
 </references>
 <dates>
 <discovery>2026-02-23</discovery>
 <entry>2026-02-24</entry>
 </dates>
 </vuln>

<vuln vid="716d25a6-0fdc-11f1-bfdf-ff9355aecb00">
 <topic>openexr -- buffer overflow in istream_nonparallel_read on invalid input data</topic>
 <affects>
 <package>
	<name>openexr</name>
	<range><lt>3.3.7</lt></range>
	<range><ge>3.4.0</ge><lt>3.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cary Phillips reports:
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.5">
	 [openexr] v3.4.5 [...] fixes an incorrect size check in istream_nonparallel_read that could lead to a buffer overflow on invalid input data.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.5</url>
 <url>https://github.com/AcademySoftwareFoundation/openexr/commit/6bb2ddf1068573d073edf81270a015b38cc05cef</url>
 </references>
 <dates>
 <discovery>2026-02-16</discovery>
 <entry>2026-02-22</entry>
 </dates>
 </vuln>

<vuln vid="428e782a-0e92-11f1-a9b1-0cc47ada5f32">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.551</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.541.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2026-02-18/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-3669 / CVE-2026-27099</h5>
	 Stored XSS vulnerability in node offline cause description
	 <h5>(Medium) SECURITY-3658 / CVE-2026-27100</h5>
	 Build information disclosure vulnerability through Run Parameter
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-27099</cvename>
 <cvename>CVE-2026-27100</cvename>
 <url>https://www.jenkins.io/security/advisory/2026-02-18/</url>
 </references>
 <dates>
 <discovery>2026-02-18</discovery>
 <entry>2026-02-20</entry>
 </dates>
 </vuln>

<vuln vid="6a81dc74-0e8b-11f1-b7d1-b42e991fc52e">
 <topic>Mozilla -- Heap buffer overflow</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>147.0.4,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.7.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>147.0.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=2014390 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2014390">
	 Heap buffer overflow in libvpx.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-2447</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-2447</url>
 </references>
 <dates>
 <discovery>2026-02-16</discovery>
 <entry>2026-02-20</entry>
 </dates>
 </vuln>

<vuln vid="a977cb1c-0d7d-11f1-85c5-a8a1599412c6">
 <topic>chromium -- security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>145.0.7632.109</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>145.0.7632.109</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_18.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[477033835] High CVE-2026-2648: Heap buffer overflow in PDFium. Reported by soiax on 2026-01-19</li>
	 <li>[481074858] High CVE-2026-2649: Integer overflow in V8. Reported by JunYoung Park(@candymate) of KAIST Hacking Lab on 2026-02-03</li>
	 <li>[476461867] Medium CVE-2026-2650: Heap buffer overflow in Media. Reported by Google on 2026-01-18</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-2648</cvename>
 <cvename>CVE-2026-2649</cvename>
 <cvename>CVE-2026-2650</cvename>
 <url>https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_18.html</url>
 </references>
 <dates>
 <discovery>2026-02-18</discovery>
 <entry>2026-02-19</entry>
 </dates>
 </vuln>

<vuln vid="67793feb-0b5b-11f1-a1c0-0050569f0b83">
 <topic>powerdns-recursor -- Denial of Service</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><lt>5.3.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://blog.powerdns.com/2025/12/08/powerdns-security-advisories-2025-07-and-2025-08">
	2025-07: Internal logic flaw in cache management can lead to
	a denial of service in Recursor
	2025-08: Insufficient validation of incoming notifies over
	TCP can lead to a denial of service in Recursor
	2026-01: Crafted zones can lead to increased resource usage in Recursor
	2026-01: This problem can be triggered by publishing and querying a crafted
	zone that causes large memory usage.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-59029</cvename>
 <cvename>CVE-2025-59030</cvename>
 <cvename>CVE-2026-24027</cvename>
 <cvename>CVE-2026-0398</cvename>
 <url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-07.html</url>
 <url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-08.html</url>
 <url>https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-01.html</url>
 </references>
 <dates>
 <discovery>2025-12-08</discovery>
 <entry>2026-02-16</entry>
 </dates>
 </vuln>

<vuln vid="f9cb72e4-0b52-11f1-8e75-b42e991fc52e">
 <topic>png -- CWE-122: Heap-based Buffer Overflow</topic>
 <affects>
 <package>
	<name>png</name>
	<range><lt>1.6.55</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3 reports:
	<blockquote cite="https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3">
	 LIBPNG is a reference library for use in applications
	 that read, create, and manipulate PNG (Portable Network
	 Graphics) raster image files. Prior to 1.6.55, an
	 out-of-bounds read vulnerability exists in the
	 png_set_quantize() API function. When the function is
	 called with no histogram and the number of colors in the
	 palette is more than twice the maximum supported by the
	 user's display, certain palettes will cause the function to
	 enter into an infinite loop that reads past the end of an
	 internal heap-allocated buffer. The images that trigger
	 this vulnerability are valid per the PNG specification.
	 This vulnerability is fixed in 1.6.55.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-25646</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-25646</url>
 </references>
 <dates>
 <discovery>2026-02-10</discovery>
 <entry>2026-02-16</entry>
 </dates>
 </vuln>

<vuln vid="590979aa-09f7-11f1-a730-5404a68ad561">
 <topic>traefik -- TCP readTimeout bypass via STARTTLS on Postgres</topic>
 <affects>
 <package>
	<name>traefik</name>
	<range><lt>3.6.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The traefik project reports:
	<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-89p3-4642-cr2w">
	 There is a potential vulnerability in Traefik managing STARTTLS requests.
	 An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout
	 by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling,
	 causing connections to remain open indefinitely, leading to a denial of service
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-25949</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2026-25949</url>
 </references>
 <dates>
 <discovery>2026-02-11</discovery>
 <entry>2026-02-14</entry>
 </dates>
 </vuln>

<vuln vid="17186409-09d2-11f1-a39c-b42e991fc52e">
 <topic>munge -- CWE-787: Out-of-bounds Write</topic>
 <affects>
 <package>
	<name>munge</name>
	<range><lt>0.5.18</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh reports:
	<blockquote cite="https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh">
	 MUNGE is an authentication service for creating and
	 validating user credentials. From 0.5 to 0.5.17, local
	 attacker can exploit a buffer overflow vulnerability in
	 munged (the MUNGE authentication daemon) to leak
	 cryptographic key material from process memory. With the
	 leaked key material, the attacker could forge arbitrary
	 MUNGE credentials to impersonate any user (including root)
	 to services that rely on MUNGE for authentication. The
	 vulnerability allows a buffer overflow by sending a crafted
	 message with an oversized address length field, corrupting
	 munged's internal state and enabling extraction of the MAC
	 subkey used for credential verification. This vulnerability
	 is fixed in 0.5.18.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-25506</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-25506</url>
 </references>
 <dates>
 <discovery>2026-02-10</discovery>
 <entry>2026-02-14</entry>
 </dates>
 </vuln>

<vuln vid="424d598b-09c4-11f1-85c5-a8a1599412c6">
 <topic>chromium -- security fix</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>145.0.7632.75</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>145.0.7632.75</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[483569511] High CVE-2026-2441: Use after free in CSS. Reported by Shaheen Fazim on 2026-02-11</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-2441</cvename>
 <url>https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html</url>
 </references>
 <dates>
 <discovery>2026-02-13</discovery>
 <entry>2026-02-14</entry>
 </dates>
 </vuln>

<vuln vid="027c6c07-065b-11f1-baae-589cfc023192">
 <topic>expat -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>expat</name>
 <range><lt>2.7.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 expat team reports:
 <blockquote cite="https://github.com/libexpat/libexpat/blob/R_2_7_4/expat/Changes">
 Update contains 2 security fixes:
 <ul>
 <li>CVE-2026-24515: NULL dereference in function XML_ExternalEntityParserCreate</li>
 <li>CVE-2026-25210: missing check for integer overflow in function doContent</li>
 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-24515</cvename>
 <cvename>CVE-2026-25210</cvename>
 </references>
 <dates>
 <discovery>2026-01-31</discovery>
 <entry>2026-02-10</entry>
 </dates>
 </vuln>

<vuln vid="e3afc190-0821-11f1-a857-6cc21735f730">
 <topic>PostgreSQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>postgresql14-server</name>
 <range><lt>14.21</lt></range>
 </package>
 <package>
 <name>postgresql15-server</name>
 <range><lt>15.16</lt></range>
 </package>
 <package>
 <name>postgresql16-server</name>
 <range><lt>16.12</lt></range>
 </package>
 <package>
 <name>postgresql17-server</name>
 <range><lt>17.8</lt></range>
 </package>
 <package>
 <name>postgresql18-server</name>
 <range><lt>18.2</lt></range>
 </package>
 <package>
 <name>postgresql14-server</name>
 <range><lt>14.21</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/about/news/postgresql-182-178-1612-1516-and-1421-released-3235/">
	
	 Improper validation of type oidvector in PostgreSQL
	 allows a database user to disclose a few bytes of server
	 memory. We have not ruled out viability of attacks that
	 arrange for presence of confidential information in
	 disclosed bytes, but they seem unlikely.
	
	
	 Missing validation of type of input in PostgreSQL
	 intarray extension selectivity estimator function allows
	 an object creator to execute arbitrary code as the
	 operating system user running the database.
	
	
	 Heap buffer overflow in PostgreSQL pgcrypto allows a
	 ciphertext provider to execute arbitrary code as the
	 operating system user running the database.
	
	
	 Missing validation of multibyte character length in
	 PostgreSQL text manipulation allows a database user to
	 issue crafted queries that achieve a buffer overrun.
	 That suffices to execute arbitrary code as the operating
	 system user running the database.
	
	
	 Heap buffer overflow in PostgreSQL pg_trgm allows a
	 database user to achieve unknown impacts via a crafted
	 input string. The attacker has limited control over the
	 byte patterns to be written, but we have not ruled out
	 the viability of attacks that lead to privilege
	 escalation.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-2003</cvename>
 <cvename>CVE-2026-2004</cvename>
 <cvename>CVE-2026-2005</cvename>
 <cvename>CVE-2026-2006</cvename>
 <cvename>CVE-2026-2007</cvename>
 <url>https://www.postgresql.org/about/news/postgresql-182-178-1612-1516-and-1421-released-3235/</url>
 </references>
 <dates>
 <discovery>2026-02-12</discovery>
 <entry>2026-02-12</entry>
 </dates>
 </vuln>

<vuln vid="7f9bac32-0800-11f1-8a6f-b42e991fc52e">
 <topic>MongoDB Server -- CWE-704 Incorrect Type Conversion or Cast</topic>
 <affects>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.29</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://jira.mongodb.org/browse/SERVER-113685 reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-113685">
	 An authorized user may disable the MongoDB server by
	 issuing a query against a collection that contains an
	 invalid compound wildcard index.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-25613</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-25613</url>
 </references>
 <dates>
 <discovery>2026-02-10</discovery>
 <entry>2026-02-12</entry>
 </dates>
 </vuln>

<vuln vid="7b5671f9-0800-11f1-8a6f-b42e991fc52e">
 <topic>MongoDB Server -- CWE-617 Reachable Assertion</topic>
 <affects>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.13</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://jira.mongodb.org/browse/SERVER-99119 reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-99119">
	 An authorized user may trigger a server crash by running
	 a $geoNear pipeline with certain invalid index hints.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-25610</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-25610</url>
 </references>
 <dates>
 <discovery>2026-02-10</discovery>
 <entry>2026-02-12</entry>
 </dates>
 </vuln>

<vuln vid="77e32b14-0800-11f1-8a6f-b42e991fc52e">
 <topic>MongoDB Server -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	https://jira.mongodb.org/browse/SERVER-114126 reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-114126">
	 Complex queries can cause excessive memory usage in
	 MongoDB Query Planner resulting in an Out-Of-Memory
	 Crash.
	</blockquote>
	https://jira.mongodb.org/browse/SERVER-102364 reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-102364">
	 MongoDB Server may experience an out-of-memory failure while
	 evaluating expressions that produce deeply nested documents. The
	 issue arises in recursive functions because the server does not
	 periodically check the depth of the expression.
	</blockquote>
	https://jira.mongodb.org/browse/SERVER-113532 reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-113532">
	 Inserting certain large documents into a replica set could lead to
	 replica set secondaries not being able to fetch the oplog from the
	 primary. This could stall replication inside the replica set leading
	 to server crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-1850</cvename>
 <cvename>CVE-2026-1849</cvename>
 <cvename>CVE-2026-1847</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-1850</url>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-1849</url>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-1847</url>
 </references>
 <dates>
 <discovery>2026-02-10</discovery>
 <entry>2026-02-12</entry>
 </dates>
 </vuln>

<vuln vid="9d9940e7-071c-11f1-93ca-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.8.0</ge><lt>18.8.4</lt></range>
<range><ge>18.7.0</ge><lt>18.7.4</lt></range>
<range><ge>8.0.0</ge><lt>18.6.6</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/">
	 Incomplete Validation issue in Web IDE impacts GitLab CE/EE
	 Denial of Service issue in GraphQL introspection impacts GitLab CE/EE
	 Denial of Service issue in JSON validation middleware impacts GitLab CE/EE
	 Cross-site Scripting issue in Code Flow impacts GitLab CE/EE
	 HTML Injection issue in test case titles impacts GitLab CE/EE
	 Denial of Service issue in Markdown processor impacts GitLab CE/EE
	 Denial of Service issue in Markdown Preview impacts GitLab CE/EE
	 Denial of Service issue in dashboard impacts GitLab EE
	 Server-Side Request Forgery issue in Virtual Registry impacts GitLab EE
	 Improper Validation issue in diff parser impacts GitLab CE/EE
	 Server-Side Request Forgery issue in Git repository import impacts GitLab CE/EE
	 Authorization Bypass issue in iterations API impacts GitLab EE
	 Missing Authorization issue in GLQL API impacts GitLab CE/EE
	 Stored HTML Injection issue in project label impacts GitLab CE/EE
	 Authorization Bypass issue in Pipeline Schedules API impacts GitLab CE/EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-7659</cvename>
 <cvename>CVE-2025-8099</cvename>
 <cvename>CVE-2026-0958</cvename>
 <cvename>CVE-2025-14560</cvename>
 <cvename>CVE-2026-0595</cvename>
 <cvename>CVE-2026-1458</cvename>
 <cvename>CVE-2026-1456</cvename>
 <cvename>CVE-2026-1387</cvename>
 <cvename>CVE-2025-12575</cvename>
 <cvename>CVE-2026-1094</cvename>
 <cvename>CVE-2025-12073</cvename>
 <cvename>CVE-2026-1080</cvename>
 <cvename>CVE-2025-14592</cvename>
 <cvename>CVE-2026-1282</cvename>
 <cvename>CVE-2025-14594</cvename>
 <url>https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/</url>
 </references>
 <dates>
 <discovery>2026-02-10</discovery>
 <entry>2026-02-11</entry>
 </dates>
 </vuln>

<vuln vid="8d8012e5-0705-11f1-8148-bc241121aa0a">
 <topic>FreeBSD -- blocklistd(8) socket leak</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>15.0</ge><lt>15.0_3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to a programming error, blocklistd leaks a socket descriptor
	for each adverse event report it receives.
	Once a certain number of leaked sockets is reached, blocklistd
	becomes unable to run the helper script: a child process is forked,
	but this child dereferences a null pointer and crashes before it
	is able to exec the helper. At this point, blocklistd still records
	adverse events but is unable to block new addresses or unblock
	addresses whose database entries have expired.
	Once a second, much higher number of leaked sockets is reached,
	blocklistd becomes unable to receive new adverse event reports.
	<h1>Impact:</h1>
	An attacker may take advantage of this by triggering a large
	number of adverse events from sacrificial IP addresses to effectively
	disable blocklistd before launching an attack.
	Even in the absence of attacks or probes by would-be attackers,
	adverse events will occur regularly in the course of normal operations,
	and blocklistd will gradually run out file descriptors and become
	ineffective.
	The accumulation of open sockets may have knock-on effects on other
	parts of the system, resulting in a general slowdown until blocklistd
	is restarted.
 </body>
 </description>
 <references>
 <cvename>CVE-2026-2261</cvename>
 <freebsdsa>SA-26:03.blocklistd</freebsdsa>
 </references>
 <dates>
 <discovery>2026-02-10</discovery>
 <entry>2026-02-11</entry>
 </dates>
 </vuln>

<vuln vid="9bc5a730-0585-11f1-85c5-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>144.0.7559.132</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>144.0.7559.132</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[478942410] High CVE-2026-1861: Heap buffer overflow in libvpx. Reported by Google on 2026-01-26</li>
	 <li>[479726070] High CVE-2026-1862: Type Confusion in V8. Reported by Chaoyuan Peng (@ret2happy) on 2026-01-29</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-1861</cvename>
 <cvename>CVE-2026-1862</cvename>
 <url>https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2026-02-03</discovery>
 <entry>2026-02-09</entry>
 </dates>
 </vuln>

<vuln vid="f301a241-04d3-11f1-a38c-8447094a420f">
 <topic>Roundcube -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>roundcube-php82</name>
	<name>roundcube-php83</name>
	<name>roundcube-php84</name>
	<name>roundcube-php85</name>
	<range><lt>1.6.13,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Roundcube project reports:
	<blockquote cite="https://github.com/roundcube/roundcubemail/releases/tag/1.6.13">
	 Unspecified CSS injection vulnerability.
	 Remote image blocking bypass via SVG content.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/roundcube/roundcubemail/releases/tag/1.6.13</url>
 </references>
 <dates>
 <discovery>2026-02-08</discovery>
 <entry>2026-02-08</entry>
 </dates>
 </vuln>

<vuln vid="73ff246b-04b2-11f1-84fc-4ccc6adda413">
 <topic>qt6-webengine -- multiple vulnerabilities</topic>
 <affects>
<package>
<name>qt6-pdf</name>
<name>qt6-webengine</name>
<range><lt>6.10.2</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Qt qtwebengine-chromium repo reports:
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=134-based">
	 Backports for 7 security bugs in Chromium:
	 <ul>
	 <li>CVE-2025-13638: Prevent media element GC in callbacks in WebMediaPlayerMS</li>
	 <li>CVE-2025-13639: Improve validation of SDP direction in remote description</li>
	 <li>CVE-2025-13720: Avoid downcasting Hash and Integrity reports</li>
	 <li>CVE-2025-14174: Metal: Don't use pixelsDepthPitch to size buffers</li>
	 <li>CVE-2025-14765: Polyfill unary negation and abs for amd mesa frontend</li>
	 <li>CVE-2026-0908: Use CheckedNumerics in HandleAllocator</li>
	 <li>CVE-2026-1504: Block opaque 416 responses to non-range requests</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-13638</cvename>
 <cvename>CVE-2025-13639</cvename>
 <cvename>CVE-2025-13720</cvename>
 <cvename>CVE-2025-14174</cvename>
 <cvename>CVE-2025-14765</cvename>
 <cvename>CVE-2026-0908</cvename>
 <cvename>CVE-2026-1504</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=134-based</url>
 </references>
 <dates>
 <discovery>2026-02-02</discovery>
 <entry>2026-02-08</entry>
 </dates>
 </vuln>

<vuln vid="a6effa17-1fd4-4895-8471-d5c684d7807c">
 <topic>navidrome -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>navidrome</name>
	<range><lt>0.60.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An XSS vulnerability in the frontend allows a malicious attacker to inject code through the comment metadata of a song to exfiltrate user credentials.
	Authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/{token}). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage.
 </body>
 </description>
 <references>
 <cvename>CVE-2026-25578</cvename>
 <url>https://github.com/navidrome/navidrome/security/advisories/GHSA-rh3r-8pxm-hg4w</url>
 <cvename>CVE-2026-25579</cvename>
 <url>https://github.com/navidrome/navidrome/security/advisories/GHSA-hrr4-3wgr-68x3</url>
 </references>
 <dates>
 <discovery>2026-02-03</discovery>
 <entry>2026-02-07</entry>
 </dates>
 </vuln>

<vuln vid="1a82bf18-0417-11f1-be6f-5404a68ad561">
 <topic>traefik -- ACME TLS-ALPN fast path potential DoS</topic>
 <affects>
<package>
<name>traefik</name>
<range><lt>3.6.7</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The traefik project reports:
	<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-cwjm-3f7h-9hwq">
	 There is a potential vulnerability in Traefik ACME TLS certificates' automatic
	 generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to
	 tie up goroutines and file descriptors indefinitely when the ACME TLS challenge
	 is enabled.A malicious client can open many connections, send a minimal ClientHello
	 with acme-tls/1, then stop responding, leading to denial of service of the entrypoint.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-22045</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2026-22045</url>
 </references>
 <dates>
 <discovery>2026-01-15</discovery>
 <entry>2026-02-07</entry>
 </dates>
 </vuln>

<vuln vid="bfe9adc8-0224-11f1-8790-c5fb948922ad">
 <topic>python -- several security vulnerabilities</topic>
 <affects>
 <package><name>python310</name> <range><lt>3.10.19_2</lt></range></package>
 <package><name>python311</name> <range><lt>3.11.14_2</lt></range></package>
 <package><name>python312</name> <range><lt>3.12.12_4</lt></range></package>
 <package><name>python313</name> <range><lt>3.13.12</lt></range></package>
 <package><name>python313t</name> <range><lt>3.13.12</lt></range></package>
 <package><name>python314</name> <range><lt>3.14.3</lt></range></package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Python project announces a new release with several security fixes:
	<blockquote cite="https://docs.python.org/release/3.14.3/whatsnew/changelog.html">
	 <ul>
	 <li>CVE-2026-1299: gh-144125: BytesGenerator will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in gh-121650).</li>
	 <li>gh-143935: Fixed a bug in the folding of comments when flattening an email message using a modern email policy. Comments consisting of a very long sequence of non-foldable characters could trigger a forced line wrap that omitted the required leading space on the continuation line, causing the remainder of the comment to be interpreted as a new header field. This enabled header injection with carefully crafted inputs.</li>
	 <li>gh-143925: Reject control characters in data: URL media types.</li>
	 <li>gh-143919: Reject control characters in http.cookies.Morsel fields and values.</li>
	 <li>CVE-2026-0865: gh-143916: Reject C0 control characters within wsgiref.headers.Headers fields, values, and parameters.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-1299</cvename>
 <cvename>CVE-2026-0865</cvename>
 <url>https://docs.python.org/release/3.14.3/whatsnew/changelog.html</url>
 </references>
 <dates>
 <discovery>2026-01-16</discovery>
 <entry>2026-02-04</entry>
 <modified>2026-03-03</modified>
 </dates>
 </vuln>

<vuln vid="232e16cc-fd83-11f0-981a-98b78501ef2a">
 <topic>xrdp -- remote code execution</topic>
 <affects>
<package>
<name>xrdp</name>
<range><lt>0.10.5</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Denis Skvortsov, Security Researcher at Kaspersky reports:
	<blockquote cite="https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rwvg-gp87-gh6f">
	 xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-68670</cvename>
 <url>https://www.cve.org/CVERecord?id=CVE-2025-68670</url>
 </references>
 <dates>
 <discovery>2025-12-06</discovery>
 <entry>2026-01-27</entry>
 </dates>
 </vuln>

<vuln vid="8173e68a-88f3-4862-882c-6e58779d98e7">
 <topic>zeek -- potential DoS vulnerability</topic>
 <affects>
<package>
<name>zeek</name>
<range><lt>8.0.6</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v8.0.6">
	 Zeek's HTTP analyzer can be tricked into interpreting
	 Transfer-Encoding or Content-Length headers set in MIME
	 entities within HTTP bodies and change the analyzer
	 behavior.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v8.0.6</url>
 </references>
 <dates>
 <discovery>2026-01-29</discovery>
 <entry>2026-01-29</entry>
 </dates>
 </vuln>

<vuln vid="409d70ab-fc23-11f0-85c5-a8a1599412c6">
 <topic>chromium -- security fix</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>144.0.7559.109</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>144.0.7559.109</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_27.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[474435504] High CVE-2026-1504: Inappropriate implementation in Background Fetch API. Reported by Luan Herrera (@lbherrera_) on 2026-01-09</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-1504</cvename>
 <url>https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_27.html</url>
 </references>
 <dates>
 <discovery>2026-01-27</discovery>
 <entry>2026-01-28</entry>
 </dates>
 </vuln>

<vuln vid="9dac4f05-fc65-11f0-96db-b42e991fc52e">
 <topic>Firefox -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>147.0.2,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=2007302 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2007302">
	 Mitigation bypass in the Privacy: Anti-Tracking component.
	 Use-after-free in the Layout: Scrolling and Overflow component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-24868</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-24868</url>
 <cvename>CVE-2026-24869</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-24869</url>
 </references>
 <dates>
 <discovery>2026-01-27</discovery>
 <entry>2026-01-28</entry>
 </dates>
 </vuln>

<vuln vid="90071333-fbe5-11f0-a13f-bc241121aa0a">
 <topic>FreeBSD -- Jail escape by a privileged user via nullfs</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.3</ge><lt>14.3_8</lt></range>
	<range><ge>13.5</ge><lt>13.5_9</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	 By default, jailed processes cannot mount filesystems, including
	 nullfs(4). However, the allow.mount.nullfs option enables mounting
	 nullfs filesystems, subject to privilege checks.
	 If a privileged user within a jail is able to nullfs-mount directories,
	 a limitation of the kernel's path lookup logic allows that user to
	 escape the jail's chroot, yielding access to the full filesystem
	 of the host or parent jail.
	<h1>Impact:</h1>
	 In a jail configured to allow nullfs(4) mounts from within the
	 jail, the jailed root user can escape the jail's filesystem root.
 </body>
 </description>
 <references>
 <cvename>CVE-2025-15547</cvename>
 <freebsdsa>SA-26:02.jail</freebsdsa>
 </references>
 <dates>
 <discovery>2026-01-27</discovery>
 <entry>2026-01-28</entry>
 </dates>
 </vuln>

<vuln vid="4b824428-fb93-11f0-b194-8447094a420f">
 <topic>OpenSSL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>15.0</ge><lt>15.0_2</lt></range>
	<range><ge>14.3</ge><lt>14.3_8</lt></range>
	<range><ge>13.5</ge><lt>13.5_9</lt></range>
 </package>
 <package>
	<name>openssl</name>
	<range><lt>3.0.19,1</lt></range>
 </package>
 <package>
	<name>openssl33</name>
	<range><lt>3.3.6</lt></range>
 </package>
 <package>
	<name>openssl34</name>
	<range><lt>3.4.4</lt></range>
 </package>
 <package>
	<name>openssl35</name>
	<range><lt>3.5.5</lt></range>
 </package>
 <package>
	<name>openssl36</name>
	<range><lt>3.6.1</lt></range>
 </package>
 <package>
	<name>openssl</name>
	<range><lt>3.0.19</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://openssl-library.org/news/secadv/20260127.txt">
	 <ul>
	 <li>Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (CVE-2025-11187)</li>
	 <li>Stack buffer overflow in CMS AuthEnvelopedData parsing (CVE-2025-15467)</li>
	 <li>NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (CVE-2025-15468)</li>
	 <li>"openssl dgst" one-shot codepath silently truncates inputs &gt;16MB (CVE-2025-15469)</li>
	 <li>TLS 1.3 CompressedCertificate excessive memory allocation (CVE-2025-66199)</li>
	 <li>Heap out-of-bounds write in BIO_f_linebuffer on short writes (CVE-2025-68160)</li>
	 <li>Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (CVE-2025-69418)</li>
	 <li>Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (CVE-2025-69419)</li>
	 <li>Missing ASN1_TYPE validation in TS_RESP_verify_response() function (CVE-2025-69420)</li>
	 <li>NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (CVE-2025-69421)</li>
	 <li>Missing ASN1_TYPE validation in PKCS#12 parsing (CVE-2026-22795)</li>
	 <li>ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (CVE-2026-22796)</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11187</cvename>
 <cvename>CVE-2025-15467</cvename>
 <cvename>CVE-2025-15468</cvename>
 <cvename>CVE-2025-15469</cvename>
 <cvename>CVE-2025-66199</cvename>
 <cvename>CVE-2025-68160</cvename>
 <cvename>CVE-2025-69418</cvename>
 <cvename>CVE-2025-69419</cvename>
 <cvename>CVE-2025-69420</cvename>
 <cvename>CVE-2025-69421</cvename>
 <cvename>CVE-2026-22795</cvename>
 <cvename>CVE-2026-22796</cvename>
 <url>https://openssl-library.org/news/secadv/20260127.txt</url>
 <freebsdsa>SA-26:01.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2026-01-27</discovery>
 <entry>2026-01-27</entry>
 <modified>2026-01-28</modified>
 </dates>
 </vuln>

<vuln vid="ab01cb11-f911-11f0-b194-8447094a420f">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.45</lt></range>
 </package>
 <package>
	<name>mysql84-server</name>
	<range><lt>8.4.8</lt></range>
 </package>
 <package>
	<name>mysql91-server</name>
	<range><lt>9.1.3</lt></range>
 </package>
 <package>
	<name>mysql94-server</name>
	<range><lt>9.4.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujan2026.html#AppendixMSQL">
	 Oracle reports multiple vulnerabilities in its MySQL server products.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-21949</cvename>
 <cvename>CVE-2026-21950</cvename>
 <cvename>CVE-2026-21968</cvename>
 <cvename>CVE-2026-21929</cvename>
 <cvename>CVE-2026-21936</cvename>
 <cvename>CVE-2026-21937</cvename>
 <cvename>CVE-2026-21941</cvename>
 <cvename>CVE-2026-21948</cvename>
 <cvename>CVE-2026-21952</cvename>
 <cvename>CVE-2026-21964</cvename>
 <cvename>CVE-2026-21965</cvename>
 <url>https://www.oracle.com/security-alerts/cpujan2026.html#AppendixMSQL</url>
 </references>
 <dates>
 <discovery>2026-01-20</discovery>
 <entry>2026-01-24</entry>
 </dates>
 </vuln>

<vuln vid="65439aa0-f77d-11f0-9821-b0416f0c4c67">
 <topic>wheel -- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')</topic>
 <affects>
 <package>
	<name>py310-wheel</name>
	<name>py311-wheel</name>
	<name>py312-wheel</name>
	<name>py313-wheel</name>
	<name>py313t-wheel</name>
	<name>py314-wheel</name>
	<range><lt>0.46.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx reports:
	<blockquote cite="https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx">
	 wheel is a command line tool for manipulating Python wheel files,
as defined in PEP 427. In versions 0.46.1 and below, the unpack
function is vulnerable to file permission modification through
mishandling of file permissions after extraction. The logic blindly
trusts the filename from the archive header for the chmod operation,
even though the extraction process itself might have sanitized the
path. Attackers can craft a malicious wheel file that, when unpacked,
changes the permissions of critical system files (e.g., /etc/passwd,
SSH keys, config files), allowing for Privilege Escalation or
arbitrary code execution by modifying now-writable scripts. This
issue has been fixed in version 0.46.2.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-24049</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-24049</url>
 </references>
 <dates>
 <discovery>2026-01-22</discovery>
 <entry>2026-01-22</entry>
 </dates>
 </vuln>

<vuln vid="f8560c1b-f772-11f0-85c5-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>144.0.7559.96</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>144.0.7559.96</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_20.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[473851441] High CVE-2026-1220: Race in V8. Reported by @p1nky4745 on 2026-01-07</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-1220</cvename>
 <url>https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_20.html</url>
 </references>
 <dates>
 <discovery>2026-01-20</discovery>
 <entry>2026-01-22</entry>
 </dates>
 </vuln>

<vuln vid="61dc7f67-f6e5-11f0-b051-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.8.0</ge><lt>18.8.2</lt></range>
<range><ge>18.7.0</ge><lt>18.7.2</lt></range>
<range><ge>11.9.0</ge><lt>18.6.4</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2026/01/21/patch-release-gitlab-18-8-2-released/">
	 Denial of Service issue in Jira Connect integration impacts GitLab CE/EE
	 Incorrect Authorization issue in Releases API impacts GitLab CE/EE
	 Unchecked Return Value issue in authentication services impacts GitLab CE/EE
	 Infinite Loop issue in Wiki redirects impacts GitLab CE/EE
	 Denial of Service issue in API endpoint impacts GitLab CE/EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-13927</cvename>
 <cvename>CVE-2025-13928</cvename>
 <cvename>CVE-2026-0723</cvename>
 <cvename>CVE-2025-13335</cvename>
 <cvename>CVE-2026-1102</cvename>
 <url>https://about.gitlab.com/releases/2026/01/21/patch-release-gitlab-18-8-2-released/</url>
 </references>
 <dates>
 <discovery>2026-01-21</discovery>
 <entry>2026-01-21</entry>
 </dates>
 </vuln>

<vuln vid="01f34a27-f560-11f0-bbdc-10ffe07f9334">
 <topic>mail/mailpit -- multiple vulnerabilities</topic>
 <affects>
<package>
<name>mailpit</name>
<range><lt>1.28.3</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Mailpit author reports:
	<blockquote cite="https://github.com/axllent/mailpit/releases/tag/v1.28.3">
	 Ensure SMTP TO &amp; FROM addresses are RFC 5322
	 compliant and prevent header injection (GHSA-54wq-72mp-cq7c)
	 Prevent Server-Side Request Forgery (SSRF) via HTML
	 Check API (GHSA-6jxm-fv7w-rw5j)
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-23829</cvename>
 <url>https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c</url>
 <cvename>CVE-2026-23845</cvename>
 <url>https://github.com/axllent/mailpit/security/advisories/GHSA-6jxm-fv7w-rw5j</url>
 </references>
 <dates>
 <discovery>2026-01-18</discovery>
 <entry>2026-01-19</entry>
 </dates>
 </vuln>

<vuln vid="fb561db9-0fc1-4d92-81a2-ee01839c9119">
 <topic>oauth2-proxy -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>oauth2-proxy</name>
	<range><lt>7.14.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.
	A flaw was found in the crypto/x509 package in the Go standard library. This vulnerability allows a certificate validation bypass via an excluded subdomain constraint in a certificated chain as it does not restrict the usage of wildcard SANs in the leaf certificate.
	SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
	SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
 </body>
 </description>
 <references>
 <cvename>CVE-2025-61729</cvename>
 <cvename>CVE-2025-61727</cvename>
 <cvename>CVE-2025-47914</cvename>
 <cvename>CVE-2025-58181</cvename>
 </references>
 <dates>
 <discovery>2026-01-16</discovery>
 <entry>2026-01-18</entry>
 </dates>
 </vuln>

<vuln vid="ff20d3a3-f211-11f0-9ca3-b42e991fc52e">
 <topic>Mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>147.0.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>147.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	
	Memory safety bugs present in Firefox 146 and Thunderbird
	146. Some of these bugs showed evidence of memory corruption
	and we presume that with enough effort some of these could
	have been exploited to run arbitrary code.
	
	Denial-of-service in the DOM: Service Workers component.
	Information disclosure in the XML component.
	Sandbox escape in the Messaging System component.
 </body>
 </description>
 <references>
 <cvename>CVE-2026-0892</cvename>
 <cvename>CVE-2026-0889</cvename>
 <cvename>CVE-2026-0888</cvename>
 <cvename>CVE-2026-0881</cvename>
 </references>
 <dates>
 <discovery>2026-01-13</discovery>
 <entry>2026-01-15</entry>
 </dates>
 </vuln>

<vuln vid="085101eb-f212-11f0-9ca3-b42e991fc52e">
 <topic>Mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>147.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.7.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>147</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Memory safety bugs present in firefox-esr 140.6,
	Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146.
	Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp;
	Drop component.
	Clickjacking issue and information disclosure in the PDF
	Viewer component.
	Use-after-free in the JavaScript: GC component.
	Use-after-free in the JavaScript Engine component.
	Information disclosure in the Networking component.
	Sandbox escape due to incorrect boundary conditions in the
	Graphics: CanvasWebGL component.
 </body>
 </description>
 <references>
 <cvename>CVE-2026-0891</cvename>
 <cvename>CVE-2026-0890</cvename>
 <cvename>CVE-2026-0887</cvename>
 <cvename>CVE-2026-0885</cvename>
 <cvename>CVE-2026-0884</cvename>
 <cvename>CVE-2026-0883</cvename>
 <cvename>CVE-2026-0878</cvename>
 </references>
 <dates>
 <discovery>2026-01-13</discovery>
 <entry>2026-01-15</entry>
 </dates>
 </vuln>

<vuln vid="06061c59-f212-11f0-9ca3-b42e991fc52e">
 <topic>Mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>147.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.7</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>147.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Incorrect boundary conditions in the Graphics
	component.
	Use-after-free in the IPC component.
	Sandbox escape due to integer overflow in the Graphics
	component.
	Sandbox escape due to incorrect boundary conditions in the
	Graphics component.
	Mitigation bypass in the DOM: Security component.
 </body>
 </description>
 <references>
 <cvename>CVE-2026-0886</cvename>
 <cvename>CVE-2026-0882</cvename>
 <cvename>CVE-2026-0880</cvename>
 <cvename>CVE-2026-0879</cvename>
 <cvename>CVE-2026-0877</cvename>
 </references>
 <dates>
 <discovery>2026-01-13</discovery>
 <entry>2026-01-15</entry>
 </dates>
 </vuln>

<vuln vid="6f76a1db-f124-11f0-85c5-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>144.0.7559.59</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>144.0.7559.59</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_13.html">
	 This update includes 10 security fixes:
	 <ul>
	 <li>[458914193] High CVE-2026-0899: Out of bounds memory access in V8. Reported by @p1nky4745 on 2025-11-08</li>
	 <li>[465730465] High CVE-2026-0900: Inappropriate implementation in V8. Reported by Google on 2025-12-03</li>
	 <li>[40057499] High CVE-2026-0901: Inappropriate implementation in Blink. Reported by Irvan Kurniawan (sourc7) on 2021-10-04</li>
	 <li>[469143679] Medium CVE-2026-0902: Inappropriate implementation in V8. Reported by 303f06e3 on 2025-12-16</li>
	 <li>[444803530] Medium CVE-2026-0903: Insufficient validation of untrusted input in Downloads. Reported by Azur on 2025-09-13</li>
	 <li>[452209495] Medium CVE-2026-0904: Incorrect security UI in Digital Credentials. Reported by Hafiizh on 2025-10-15</li>
	 <li>[465466773] Medium CVE-2026-0905: Insufficient policy enforcement in Network. Reported by Google on 2025-12-02</li>
	 <li>[467448811] Low CVE-2026-0906: Incorrect security UI. Reported by Khalil Zhani on 2025-12-10</li>
	 <li>[444653104] Low CVE-2026-0907: Incorrect security UI in Split View. Reported by Hafiizh on 2025-09-12</li>
	 <li>[452209503] Low CVE-2026-0908: Use after free in ANGLE. Reported by Glitchers BoB 14th. on 2025-10-15</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-0899</cvename>
 <cvename>CVE-2026-0900</cvename>
 <cvename>CVE-2026-0901</cvename>
 <cvename>CVE-2026-0902</cvename>
 <cvename>CVE-2026-0903</cvename>
 <cvename>CVE-2026-0904</cvename>
 <cvename>CVE-2026-0905</cvename>
 <cvename>CVE-2026-0906</cvename>
 <cvename>CVE-2026-0907</cvename>
 <cvename>CVE-2026-0908</cvename>
 <url>https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_13.html</url>
 </references>
 <dates>
 <discovery>2026-01-13</discovery>
 <entry>2026-01-15</entry>
 </dates>
 </vuln>

<vuln vid="fd3855b8-efbc-11f0-9e3f-b0416f0c4c67">
 <topic>virtualenv -- CWE-59: Improper Link Resolution Before File Access ('Link Following')</topic>
 <affects>
 <package>
	<name>py310-virtualenv</name>
	<name>py311-virtualenv</name>
	<name>py312-virtualenv</name>
	<name>py313-virtualenv</name>
	<name>py313t-virtualenv</name>
	<name>py314-virtualenv</name>
	<range><lt>20.36.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986 reports:
	<blockquote cite="https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986">
	 virtualenv is a tool for creating isolated virtual python environments.
Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use)
vulnerabilities in virtualenv allow local attackers to perform
symlink-based attacks on directory creation operations. An attacker
with local access can exploit a race condition between directory
existence checks and creation to redirect virtualenv's app_data and
lock file operations to attacker-controlled locations. This issue
has been patched in version 20.36.1.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-22702</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2026-22702</url>
 </references>
 <dates>
 <discovery>2026-01-10</discovery>
 <entry>2026-01-12</entry>
 </dates>
 </vuln>

<vuln vid="7e63d0dd-eeff-11f0-b135-c01803b56cc4">
 <topic>libtasn1 -- Stack-based buffer overflow</topic>
 <affects>
<package>
<name>libtasn1</name>
<range><lt>4.21.0</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	oss-security@ list reports:
	<blockquote cite="https://www.openwall.com/lists/oss-security/2026/01/08/5">
	Stack-based buffer overflow in libtasn1 version: v4.20.0.
	The function fails to validate the size of input data resulting
	in a buffer overflow in asn1_expend_octet_string.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-13151</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-13151</url>
 </references>
 <dates>
 <discovery>2026-01-07</discovery>
 <entry>2026-01-11</entry>
 </dates>
 </vuln>

<vuln vid="c9b610e9-eebc-11f0-b051-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.7.0</ge><lt>18.7.1</lt></range>
	<range><ge>18.6.0</ge><lt>18.6.3</lt></range>
	<range><ge>8.3.0</ge><lt>18.5.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2026/01/07/patch-release-gitlab-18-7-1-released/">
	 Stored Cross-site Scripting issue in GitLab Flavored Markdown placeholders impacts GitLab CE/EE
	 Cross-site Scripting issue in Web IDE impacts GitLab CE/EE
	 Missing Authorization issue in Duo Workflows API impacts GitLab EE
	 Missing Authorization issue in AI GraphQL mutation impacts GitLab EE
	 Denial of Service issue in import functionality impacts GitLab CE/EE
	 Insufficient Access Control Granularity issue in GraphQL runnerUpdate mutation impacts GitLab CE/EE
	 Information Disclosure issue in Mermaid diagram rendering impacts GitLab CE/EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-9222</cvename>
 <cvename>CVE-2025-13761</cvename>
 <cvename>CVE-2025-13772</cvename>
 <cvename>CVE-2025-13781</cvename>
 <cvename>CVE-2025-10569</cvename>
 <cvename>CVE-2025-11246</cvename>
 <cvename>CVE-2025-3950</cvename>
 <url>https://about.gitlab.com/releases/2026/01/07/patch-release-gitlab-18-7-1-released/</url>
 </references>
 <dates>
 <discovery>2026-01-07</discovery>
 <entry>2026-01-11</entry>
 </dates>
 </vuln>

<vuln vid="d822839e-ee4f-11f0-b53e-0897988a1c07">
 <topic>mail/mailpit -- Cross-Site WebSocket Hijacking</topic>
 <affects>
<package>
<name>mailpit</name>
<range><lt>1.28.2</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Mailpit author reports:
	<blockquote cite="https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm">
	 The Mailpit WebSocket server is configured to accept
	 connections from any origin. This lack of Origin header
	 validation introduces a Cross-Site WebSocket Hijacking
	 (CSWSH) vulnerability.

An attacker can host a malicious website that, when
	 visited by a developer running Mailpit locally, establishes
	 a WebSocket connection to the victim's Mailpit instance
	 (default ws://localhost:8025). This allows the attacker
	 to intercept sensitive data such as email contents,
	 headers, and server statistics in real-time.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-22689</cvename>
 <url>https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm</url>
 </references>
 <dates>
 <discovery>2026-01-10</discovery>
 <entry>2026-01-10</entry>
 </dates>
 </vuln>

<vuln vid="79c3c751-ee20-11f0-b17e-50ebf6bdf8e9">
 <topic>phpmyfaq -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyfaq-php82</name>
	<name>phpmyfaq-php83</name>
	<name>phpmyfaq-php84</name>
	<name>phpmyfaq-php85</name>
	<range><lt>4.0.16</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	phpMyFAQ team reports:
	<blockquote cite="https://www.phpmyfaq.de/security/advisory-2025-12-29/">
	 Stored cross-site scripting (XSS) and unauthenticated config backup
	 download vulnerability
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://www.phpmyfaq.de/security/advisory-2025-12-29/</url>
 </references>
 <dates>
 <discovery>2025-12-29</discovery>
 <entry>2026-01-10</entry>
 </dates>
 </vuln>

<vuln vid="8826fb1c-ebd8-11f0-a15a-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>143.0.7499.192</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>143.0.7499.192</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[463155954] High CVE-2026-0628: Insufficient policy enforcement in WebView tag. Reported by Gal Weizman on 2025-11-23</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2026-0628</cvename>
 <url>https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2026-01-06</discovery>
 <entry>2026-01-07</entry>
 </dates>
 </vuln>

<vuln vid="583b63f5-ebae-11f0-939f-47e3830276dd">
	 <topic>security/libsodium -- crypto_core_ed25519_is_valid_point mishandles checks for whether an elliptic curve point is valid</topic>
 <affects>
<package>
<name>libsodium</name>
<range><lt>1.0.21</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Libsodium maintainer reports:
	<blockquote cite="https://00f.net/2025/12/30/libsodium-vulnerability/">
	 The function crypto_core_ed25519_is_valid_point(), a low-level function
	 used to check if a given elliptic curve point is valid, was supposed to
	 reject points that aren't in the main cryptographic group,
	 but some points were slipping through.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-69277</cvename>
 <url>https://00f.net/2025/12/30/libsodium-vulnerability/</url>
 </references>
 <dates>
 <discovery>2025-12-30</discovery>
 <entry>2026-01-07</entry>
 </dates>
 </vuln>

<vuln vid="df33c83b-eb4f-11f0-a46f-0897988a1c07">
 <topic>mail/mailpit -- Server-Side Request Forgery</topic>
 <affects>
<package>
<name>mailpit</name>
<range><lt>1.28.1</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Mailpit author reports:
	<blockquote cite="https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr">
	 A Server-Side Request Forgery (SSRF) vulnerability
	 exists in Mailpit's /proxy endpoint that allows attackers
	 to make requests to internal network resources.
	 The /proxy endpoint allows requests to internal network
	 resources. While it validates http:// and https:// schemes,
	 it does not block internal IP addresses, allowing attackers
	 to access internal services and APIs.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2026-21859</cvename>
 <url>https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr</url>
 </references>
 <dates>
 <discovery>2026-01-06</discovery>
 <entry>2026-01-06</entry>
 </dates>
 </vuln>

<vuln vid="e2cd20fd-eb10-11f0-a1c0-0050569f0b83">
 <topic>net-mgmt/net-snmp -- Remote Code Execution (snmptrapd)</topic>
 <affects>
<package>
<name>net-snmp</name>
<range><lt>5.9.5</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	net-snmp development team reports:
	<blockquote cite="https://github.com/net-snmp/net-snmp/security/advisories/GHSA-4389-rwqf-q9gq">
	 A specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and
	 the daemon to crash.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-68615</cvename>
 <url>https://github.com/net-snmp/net-snmp/security/advisories/GHSA-4389-rwqf-q9gq</url>
 </references>
 <dates>
 <discovery>2025-12-23</discovery>
 <entry>2026-01-06</entry>
 </dates>
 </vuln>

<vuln vid="500cc49c-e93b-11f0-b8d8-4ccc6adda413">
 <topic>gstreamer1-plugins-bad -- Out-of-bounds reads in MIDI parser</topic>
 <affects>
<package>
<name>gstreamer1-plugins-bad</name>
<range><lt>1.26.10</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The GStreamer Security Center reports:
	<blockquote cite="https://gstreamer.freedesktop.org/security/sa-2025-0009.html">
	 Multiple out-of-bounds reads in the MIDI parser that can cause
	 crashes for certain input files.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-67326</cvename>
 <cvename>CVE-2025-67327</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2025-0009.html</url>
 </references>
 <dates>
 <discovery>2025-12-27</discovery>
 <entry>2026-01-04</entry>
 </dates>
 </vuln>

<vuln vid="963f4e9d-e4d5-11f0-984f-b42e991fc52e">
 <topic>Forgejo -- Symbolic Link (Symlink) Following</topic>
 <affects>
 <package>
	<name>forgejo</name>
	<range><lt>13.0.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/13.0.2.md reports:
	<blockquote cite="https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/13.0.2.md">
	 Forgejo before 13.0.2 allows attackers to write to
	 unintended files, and possibly obtain server shell access,
	 because of mishandling of out-of-repository symlink
	 destinations for template repositories. This is also fixed
	 for 11 LTS in 11.0.7 and later.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-68937</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-68937</url>
 </references>
 <dates>
 <discovery>2025-12-25</discovery>
 <entry>2025-12-29</entry>
 </dates>
 </vuln>

<vuln vid="bf854a37-e180-11f0-ac0c-5404a68ad561">
 <topic>fluidsynth -- Use after free when using DLS files</topic>
 <affects>
<package>
<name>fluidsynth</name>
<range><lt>2.5.2</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The fluidsynth authors report:
	<blockquote cite="https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-ffw2-xvvp-39ch">
	 A race condition during unloading of a DLS file can trigger
	 a heap-based use-after-free. A concurrently running thread may
	 be pending to unload a DLS file, leading to use of freed memory, if
	 the synthesizer is being concurrently destroyed, or samples of
	 the (unloaded) DLS file are concurrently used to synthesize audio.
	 Realistically, both scenarios will result in a denial of service.
	 In worst cases, it may result in arbitrary code execution in the
	 context of an application using FluidSynth.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-68617</cvename>
 <url>https://www.cve.org/CVERecord?id=CVE-2025-68617</url>
 </references>
 <dates>
 <discovery>2025-12-23</discovery>
 <entry>2025-12-25</entry>
 </dates>
 </vuln>

<vuln vid="c1613867-df16-11f0-8870-b42e991fc52e">
 <topic>MongoDB -- Improper Handling of Length Parameter Inconsistency</topic>
 <affects>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.17</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.28</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://jira.mongodb.org/browse/SERVER-115508 reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-115508">
	Mismatched length fields in Zlib compressed protocol
	headers may allow a read of uninitialized heap memory by an
	unauthenticated client.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14847</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14847</url>
 </references>
 <dates>
 <discovery>2025-12-19</discovery>
 <entry>2025-12-22</entry>
 <modified>2025-12-28</modified>
 </dates>
 </vuln>

<vuln vid="dc7e30db-de67-11f0-b893-5404a68ad561">
 <topic>traefik -- Inverted TLS Verification Logic in Kubernetes NGINX Provider</topic>
 <affects>
<package>
<name>traefik</name>
<range><lt>3.6.3</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The traefik project reports:
	<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-7vww-mvcr-x6vj">
	 
	 There is a potential vulnerability in Traefik NGINX
	 provider managing the
	 nginx.ingress.kubernetes.io/proxy-ssl-verify annotation.
	 The provider inverts the semantics of the
	 nginx.ingress.kubernetes.io/proxy-ssl-verify annotation.
	 Setting the annotation to "on" (intending to enable
	 backend TLS certificate verification) actually disables
	 verification, allowing man-in-the-middle attacks against
	 HTTPS backends when operators believe they are
	 protected.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-66491</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-66491</url>
 </references>
 <dates>
 <discovery>2025-12-08</discovery>
 <entry>2025-12-21</entry>
 </dates>
 </vuln>

<vuln vid="91b9790e-de65-11f0-b893-5404a68ad561">
 <topic>traefik -- Bypassing security controls via special characters</topic>
 <affects>
<package>
<name>traefik</name>
<range><lt>3.6.3</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The traefik project reports:
	<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-gm3x-23wp-hc2c">
	 There is a potential vulnerability in Traefik managing
	 the requests using a PathPrefix, Path or PathRegex
	 matcher.
	 When Traefik is configured to route the requests to a
	 backend using a matcher based on the path; if the
	 request path contains an encoded restricted character
	 from the following set ('/', '', 'Null', ';', '?', '#'),
	 it is possible to target a backend, exposed using
	 another router, by-passing the middlewares chain.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-66490</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-66490</url>
 </references>
 <dates>
 <discovery>2025-12-08</discovery>
 <entry>2025-12-21</entry>
 </dates>
 </vuln>

<vuln vid="c32cb4b7-ddcb-11f0-902c-b42e991fc52e">
 <topic>smb4k -- Critical vulnerabilities in Mount Helper</topic>
 <affects>
<package>
<name>smb4k</name>
<range><lt>4.0.4</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	vulndb reports:
	<blockquote cite="https://vuldb.com/?id.336198">
	 A vulnerability, which was classified as critical, was
	 found in smb4k up to 4.0.4. Affected is some unknown
	 functionality of the component Mount Helper. The
	 manipulation with an unknown input leads to a access control
	 vulnerability. CWE is classifying the issue as CWE-284. The
	 product does not restrict or incorrectly restricts access to
	 a resource from an unauthorized actor. This is going to have
	 an impact on integrity, and availability. The advisory is
	 available at seclists.org. The exploitability is told to be
	 easy. Local access is required to approach this attack. The
	 technical details are unknown and an exploit is not
	 available.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-66002</cvename>
 <url>https://vuldb.com/?id.336198</url>
 <cvename>CVE-2025-66003</cvename>
 <url>https://vuldb.com/?id.336199</url>
 </references>
 <dates>
 <discovery>2025-12-20</discovery>
 <entry>2025-12-20</entry>
 </dates>
 </vuln>

<vuln vid="2a33d28e-ddc0-11f0-902c-b42e991fc52e">
 <topic>Firefox -- Use-after-free</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>146.0.1,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=2000597 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2000597">
	 Use-after-free in the Disability Access APIs component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14860</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14860</url>
 </references>
 <dates>
 <discovery>2025-12-18</discovery>
 <entry>2025-12-20</entry>
 </dates>
 </vuln>

<vuln vid="23437e07-ddc0-11f0-902c-b42e991fc52e">
 <topic>Firefox -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>146.0.1,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/buglist.cgi?bug_id=1996570%2C1999700 reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1996570%2C1999700">
	 Memory safety bugs present in Firefox 146. Some of these
	 bugs showed evidence of memory corruption and we presume
	 that with enough effort some of these could have been
	 exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14861</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14861</url>
 </references>
 <dates>
 <discovery>2025-12-18</discovery>
 <entry>2025-12-20</entry>
 </dates>
 </vuln>

<vuln vid="f99e70c2-dcb8-11f0-a15a-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>143.0.7499.146</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>143.0.7499.146</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_16.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[448294721] High CVE-2025-14765: Use after free in WebGPU. Reported by Anonymous on 2025-09-30</li>
	 <li>[466786677] High CVE-2025-14766: Out of bounds read and write in V8. Reported by Shaheen Fazim on 2025-12-08</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-14765</cvename>
 <cvename>CVE-2025-14766</cvename>
 <url>https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_16.html</url>
 </references>
 <dates>
 <discovery>2025-12-16</discovery>
 <entry>2025-12-19</entry>
 </dates>
 </vuln>

<vuln vid="eca46635-db51-11f0-9b8d-40a6b7c3b3b8">
 <topic>step-certificates -- Authorization Bypass in ACME and SCEP Provisioners</topic>
 <affects>
<package>
<name>step-certificates</name>
<range><lt>0.29.0</lt></range>
</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	smallstep reports:
	<blockquote cite="https://github.com/smallstep/certificates/security/advisories/GHSA-h8cp-697h-8c8p">
	 An attacker can bypass authorization checks and force a Step CA
	 ACME or SCEP provisioner to create certificates without completing
	 certain protocol authorization checks.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-44005</cvename>
 <url>https://github.com/advisories/ghsa-h8cp-697h-8c8p</url>
 </references>
 <dates>
 <discovery>2025-12-03</discovery>
 <entry>2025-12-17</entry>
 </dates>
 </vuln>

<vuln vid="6c9318c7-dae9-11f0-80b8-bc241121aa0a">
 <topic>FreeBSD -- Remote code execution via ND6 Router Advertisements</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>15.0</ge><lt>15.0_1</lt></range>
	<range><ge>14.3</ge><lt>14.3_7</lt></range>
	<range><ge>13.5</ge><lt>13.5_8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	 The rtsol(8) and rtsold(8) programs do not validate the domain
	 search list options provided in router advertisement messages; the
	 option body is passed to resolvconf(8) unmodified.
	 resolvconf(8) is a shell script which does not validate its input.
	 A lack of quoting meant that shell commands pass as input to
	 resolvconf(8) may be executed.
	<h1>Impact:</h1>
	 Systems running rtsol(8) or rtsold(8) are vulnerable to remote
	 code execution from systems on the same network segment. In
	 particular, router advertisement messages are not routable and
	 should be dropped by routers, so the attack does not cross network
	 boundaries.
 </body>
 </description>
 <references>
 <cvename>CVE-2025-14558</cvename>
 <freebsdsa>SA-25:12.rtsold</freebsdsa>
 </references>
 <dates>
 <discovery>2025-12-16</discovery>
 <entry>2025-12-17</entry>
 </dates>
 </vuln>

<vuln vid="0b22e22a-dae9-11f0-80b8-bc241121aa0a">
 <topic>FreeBSD -- ipfw denial of service</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>15.0</ge><lt>15.0_1</lt></range>
	<range><ge>14.3</ge><lt>14.3_7</lt></range>
	<range><ge>13.5</ge><lt>13.5_8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	 In some cases, the `tcp-setmss` handler may free the packet
	 data and throw an error without halting the rule processing engine.
	 A subsequent rule can then allow the traffic after the packet data
	 is gone, resulting in a NULL pointer dereference.
	<h1>Impact:</h1>
	 Maliciously crafted packets sent from a remote host may result
	 in a Denial of Service (DoS) if the `tcp-setmss` directive is used
	 and a subsequent rule would allow the traffic to pass.
 </body>
 </description>
 <references>
 <cvename>CVE-2025-14769</cvename>
 <freebsdsa>SA-25:11.ipfw</freebsdsa>
 </references>
 <dates>
 <discovery>2025-12-16</discovery>
 <entry>2025-12-17</entry>
 </dates>
 </vuln>

<vuln vid="3a59024c-d8cf-11f0-af8c-8447094a420f">
 <topic>Roundcube -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><lt>1.6.12,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Roundcube project reports:
	<blockquote cite="https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12">
	 Cross-Site-Scripting vulnerability via SVG’s animate tag
	 Information Disclosure vulnerability in the HTML style sanitizer
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12</url>
 </references>
 <dates>
 <discovery>2025-12-14</discovery>
 <entry>2025-12-14</entry>
 </dates>
 </vuln>

<vuln vid="7a1bd1ca-cf40-41e2-9c5f-143a0d4b17af">
 <topic>github-release-monitor -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>github-release-monitor</name>
	<range><lt>1.4.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://nextjs.org/blog/security-update-2025-12-11 reports:
	<blockquote cite="https://nextjs.org/blog/security-update-2025-12-11">
	 <h1>Description</h1>
	 <h5>(Medium) Source Code Exposure: CVE-2025-55183</h5>
	 A specifically crafted HTTP request can cause a Server Function to
	 return the compiled source code of other Server Functions in your
	 application. This could reveal business logic. Secrets could also be exposed
	 if they are defined directly in your code (rather than accessed via environment
	 variables at runtime) and referenced within a Server Function.
	 Depending on your bundler configuration, these values may be inlined into the
	 compiled function output.
	 <h5>(High) Denial of Service: CVE-2025-55184</h5>
	 A specifically crafted HTTP request can be sent to any App Router endpoint
	 that, when deserialized, can cause an infinite loop that hangs the server
	 process and prevents future HTTP requests from being served.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-55183</cvename>
 <cvename>CVE-2025-55184</cvename>
 <url>https://nextjs.org/blog/security-update-2025-12-11</url>
 </references>
 <dates>
 <discovery>2025-12-11</discovery>
 <entry>2025-12-13</entry>
 </dates>
 </vuln>

<vuln vid="64bec4c7-d785-11f0-a1c0-0050569f0b83">
 <topic>www/varnish-libvmod-digest -- base64 decoding vulnerability</topic>
 <affects>
 <package>
 <name>varnish-libvmod-digest</name>
 <range><lt>1.0.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	varnish developers report:
	<blockquote cite="https://vinyl-cache.org/security/VSV00012.html">
	 Common usage of vmod-digest is for basic HTTP authentication, in
	 which case it may be possible for an attacker to circumvent the
	 authentication check. If the decoded result string is somehow
	 being made visible to the attacker (for example the result of
	 the decoding is added to a response header), then there is the
	 potential for information disclosure from reading out of band
	 workspace data.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-41104</cvename>
 <url>https://vinyl-cache.org/security/VSV00012.html</url>
 </references>
 <dates>
 <discovery>2023-08-17</discovery>
 <entry>2025-12-12</entry>
 </dates>
 </vuln>

<vuln vid="2956aba3-1fcb-4c39-9cea-d88a46a3bf93">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.541</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.528.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2025-12-10/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-3630 / CVE-2025-67635</h5>
	 Denial of service vulnerability in HTTP-based CLI
	 <h5>(Medium) SECURITY-1809 / CVE-2025-67636</h5>
	 Missing permission check on password fields
	 <h5>(Medium) SECURITY-783 / CVE-2025-67637 (storage), CVE-2025-67638 (masking)</h5>
	 Build authorization token stored and displayed in plain text
	 <h5>(Low) SECURITY-1166 / CVE-2025-67639</h5>
	 CSRF vulnerability on the login form
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-67635</cvename>
 <cvename>CVE-2025-67636</cvename>
 <cvename>CVE-2025-67637</cvename>
 <cvename>CVE-2025-67638</cvename>
 <cvename>CVE-2025-67639</cvename>
 <url>https://www.jenkins.io/security/advisory/2025-12-10/</url>
 </references>
 <dates>
 <discovery>2025-12-10</discovery>
 <entry>2025-12-12</entry>
 </dates>
 </vuln>

<vuln vid="1adf9ece-d4a3-11f0-83a2-843a4b343614">
 <topic>c-ares -- Use After Free</topic>
 <affects>
 <package>
	<name>c-ares</name>
 <range><ge>1.32.3</ge><lt>1.34.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://github.com/c-ares/c-ares/security/advisories/GHSA-jq53-42q6-pqr5 reports:
	<blockquote cite="https://github.com/c-ares/c-ares/security/advisories/GHSA-jq53-42q6-pqr5">
	 c-ares is an asynchronous resolver library. Versions
	 1.32.3 through 1.34.5 terminate a query after maximum
	 attempts when using read_answer() and process_answer(),
	 which can cause a Denial of Service. This issue is fixed in
	 version 1.34.6.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-62408</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-62408</url>
 </references>
 <dates>
 <discovery>2025-12-08</discovery>
 <entry>2025-12-09</entry>
 </dates>
 </vuln>

<vuln vid="ff25a369-d730-11f0-a15a-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>143.0.7499.109</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>143.0.7499.109</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_10.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[466192044] High: Under coordination.</li>
	 <li>[460599518] Medium CVE-2025-14372: Use after free in Password Manager. Reported by Weipeng Jiang (@Krace) of VRI on 2025-11-14</li>
	 <li>[461532432] Medium CVE-2025-14373: Inappropriate implementation in Toolbar. Reported by Khalil Zhani on 2025-11-18</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-14372</cvename>
 <cvename>CVE-2025-14373</cvename>
 <url>https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_10.html</url>
 </references>
 <dates>
 <discovery>2025-12-10</discovery>
 <entry>2025-12-12</entry>
 </dates>
 </vuln>

<vuln vid="c11e0878-d6a8-11f0-8e1b-b42e991fc52e">
 <topic>MongoDB Server -- Improper Locking</topic>
 <affects>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.26</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://jira.mongodb.org/browse/SERVER-106075 reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-106075">
	 A post-authenticationflaw in the network two-phase commit
	 protocol used for cross-shard transactions in MongoDB Server
	 may lead to logical data inconsistencies under specific
	 conditions which are not predictable and exist for a very
	 short period of time. This error can cause the transaction
	 coordination logic to misinterpret the transaction as
	 committed, resulting in inconsistent state on those shards.
	 This may lead to low integrity and availability impact.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14345</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14345</url>
 </references>
 <dates>
 <discovery>2025-12-09</discovery>
 <entry>2025-12-11</entry>
 </dates>
 </vuln>

<vuln vid="bb326db4-d6a8-11f0-8e1b-b42e991fc52e">
 <topic>Mozilla -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>146.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.6</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>146.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/buglist.cgi?bug_id=1966501%2C1997639 reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1966501%2C1997639">
	 Memory safety bugs. Some of these bugs showed evidence of
	 memory corruption and we presume that with enough effort
	 some of these could have been exploited to run arbitrary
	 code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14333</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14333</url>
 </references>
 <dates>
 <discovery>2025-12-09</discovery>
 <entry>2025-12-11</entry>
 </dates>
 </vuln>

<vuln vid="b6e19247-d6a8-11f0-8e1b-b42e991fc52e">
 <topic>Mozilla -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>146.0.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>146.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/buglist.cgi?bug_id=1963153%2C1985058%2C1995637%2C1997118 reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1963153%2C1985058%2C1995637%2C1997118">
	 Memory safety bugs. Some of these bugs showed evidence of
	 memory corruption and we presume that with enough effort
	 some of these could have been exploited to run arbitrary
	 code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14332</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14332</url>
 </references>
 <dates>
 <discovery>2025-12-09</discovery>
 <entry>2025-12-11</entry>
 </dates>
 </vuln>

<vuln vid="b463bded-d6a8-11f0-8e1b-b42e991fc52e">
 <topic>Mozilla -- Same-origin policy bypass</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>146.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.6</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>146.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=2000218 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2000218">
	 Same-origin policy bypass in the Request Handling
	 component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14331</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14331</url>
 </references>
 <dates>
 <discovery>2025-12-09</discovery>
 <entry>2025-12-11</entry>
 </dates>
 </vuln>

<vuln vid="b25f61b8-d6a8-11f0-8e1b-b42e991fc52e">
 <topic>Mozilla -- JIT miscompilation in the JavaScript Engine: JIT component</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>146.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.6</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>146.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1997503 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1997503">
	 JIT miscompilation in the JavaScript Engine: JIT
	 component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14330</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14330</url>
 </references>
 <dates>
 <discovery>2025-12-09</discovery>
 <entry>2025-12-11</entry>
 </dates>
 </vuln>

<vuln vid="b06e1b9a-d6a8-11f0-8e1b-b42e991fc52e">
 <topic>Mozilla -- Privilege escalation</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>146.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.6</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>146.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1997018 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1997018">
	 Privilege escalation in the Netmonitor component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14329</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14329</url>
 </references>
 <dates>
 <discovery>2025-12-09</discovery>
 <entry>2025-12-11</entry>
 </dates>
 </vuln>

<vuln vid="ae40f296-d6a8-11f0-8e1b-b42e991fc52e">
 <topic>Mozilla -- Privilege escalation</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>146.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.6</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>146.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1996761 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1996761">
	 Privilege escalation in the Netmonitor component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14328</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14328</url>
 </references>
 <dates>
 <discovery>2025-12-09</discovery>
 <entry>2025-12-11</entry>
 </dates>
 </vuln>

<vuln vid="aad09be1-d6a8-11f0-8e1b-b42e991fc52e">
 <topic>Mozilla -- Spoofing issue</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>146.0.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>146.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1970743 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1970743">
	 Spoofing issue in the Downloads Panel component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14327</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14327</url>
 </references>
 <dates>
 <discovery>2025-12-09</discovery>
 <entry>2025-12-11</entry>
 </dates>
 </vuln>

<vuln vid="a74a1ffc-d6a8-11f0-8e1b-b42e991fc52e">
 <topic>Mozilla -- Use-after-free</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>146.0.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>146.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1840666 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1840666">
	 Use-after-free in the Audio/Video: GMP component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14326</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14326</url>
 </references>
 <dates>
 <discovery>2025-12-09</discovery>
 <entry>2025-12-11</entry>
 </dates>
 </vuln>

<vuln vid="a3c77387-d6a8-11f0-8e1b-b42e991fc52e">
 <topic>Mozilla -- JIT miscompilation</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>146.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.6</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>146.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1998050 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1998050">
	 JIT miscompilation in the JavaScript Engine: JIT
	 component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14325</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14325</url>
 <cvename>CVE-2025-14324</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14324</url>
 </references>
 <dates>
 <discovery>2025-12-09</discovery>
 <entry>2025-12-11</entry>
 </dates>
 </vuln>

<vuln vid="9c923dc2-d6a8-11f0-8e1b-b42e991fc52e">
 <topic>Mozilla -- Privilege escalation</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>146.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.6</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>146.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1996555 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1996555">
	 Privilege escalation in the DOM: Notifications
	 component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14323</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14323</url>
 </references>
 <dates>
 <discovery>2025-12-09</discovery>
 <entry>2025-12-11</entry>
 </dates>
 </vuln>

<vuln vid="9a9d50a6-d6a8-11f0-8e1b-b42e991fc52e">
 <topic>Mozilla -- Sandbox escape</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>146.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.6</lt></range>
 </package>
 <package>
	<name>Thunderbird</name>
	<range><lt>146.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1996473 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1996473">
	 Sandbox escape due to incorrect boundary conditions in
	 the Graphics: CanvasWebGL component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14322</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14322</url>
 </references>
 <dates>
 <discovery>2025-12-09</discovery>
 <entry>2025-12-11</entry>
 </dates>
 </vuln>

<vuln vid="9525edbf-d6a8-11f0-8e1b-b42e991fc52e">
 <topic>Mozilla -- Use-after-free</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>146.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.6</lt></range>
 </package>
 <package>
	<name>Thunderbird</name>
	<range><lt>146.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1992760 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1992760">
	 Use-after-free in the WebRTC: Signaling component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-14321</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-14321</url>
 </references>
 <dates>
 <discovery>2025-12-09</discovery>
 <entry>2025-12-11</entry>
 </dates>
 </vuln>

<vuln vid="c6c9306e-d645-11f0-8ce2-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.6.0</ge><lt>18.6.2</lt></range>
	<range><ge>18.5.0</ge><lt>18.5.4</lt></range>
	<range><ge>6.3.0</ge><lt>18.4.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/">
	 Cross-site scripting issue in Wiki impacts GitLab CE/EE
	 Improper encoding in vulnerability reports impacts GitLab CE/EE
	 Cross-site scripting issue in Swagger UI impacts GitLab CE/EE
	 Denial of service issue in GraphQL endpoints impacts GitLab CE/EE
	 Authentication bypass issue for WebAuthn users impacts GitLab CE/EE
	 Denial of service issue in ExifTool processing impacts GitLab CE/EE
	 Denial of service issue in Commit API impacts GitLab CE/EE
	 Information disclosure issue in compliance frameworks impacts GitLab EE
	 Information disclosure through error messages impacts GitLab CE/EE
	 HTML injection issue in merge request titles impacts GitLab CE/EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-12716</cvename>
 <cvename>CVE-2025-8405</cvename>
 <cvename>CVE-2025-12029</cvename>
 <cvename>CVE-2025-12562</cvename>
 <cvename>CVE-2025-11984</cvename>
 <cvename>CVE-2025-4097</cvename>
 <cvename>CVE-2025-14157</cvename>
 <cvename>CVE-2025-11247</cvename>
 <cvename>CVE-2025-13978</cvename>
 <cvename>CVE-2025-12734</cvename>
 <url>https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/</url>
 </references>
 <dates>
 <discovery>2025-12-10</discovery>
 <entry>2025-12-11</entry>
 </dates>
 </vuln>

<vuln vid="613d0f9e-d477-11f0-9e85-03ddfea11990">
 <topic>python -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>python39</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>python310</name>
	<range><lt>3.10.19_1</lt></range>
 </package>
 <package>
	<name>python311</name>
	<range><lt>3.11.14_1</lt></range>
 </package>
 <package>
	<name>python312</name>
	<range><lt>3.12.12_3</lt></range>
 </package>
 <package>
	<name>python313</name>
	<range><lt>3.13.11</lt></range>
 </package>
 <package>
	<name>python314</name>
	<range><lt>3.14.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Hugo van Kemenade reports:
	<blockquote cite="https://pythoninsider.blogspot.com/2025/12/python-3142-and-31311-are-now-available.html">
	 Python 3.14.2 and 3.13.11 are now available [... and] come with some bonus security fixes.
	 <ul><li>gh-142145: Remove quadratic behavior in node ID cache clearing (CVE-2025-12084)</li>
	 <li>gh-119451: Fix a potential denial of service in http.client [only in 3.13; CVE-2025-13836]</li>
	 <li>gh-119452: Fix a potential virtual memory allocation denial of service in http.server [affects platforms without fork()]</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-12084</cvename>
 <cvename>CVE-2025-13836</cvename>
 <url>https://pythoninsider.blogspot.com/2025/12/python-3142-and-31311-are-now-available.html</url>
 <url>https://github.com/python/cpython/issues/142145</url>
 <url>https://github.com/python/cpython/issues/119451</url>
 <url>https://github.com/python/cpython/issues/119452</url>
 <url>https://docs.python.org/release/3.14.2/whatsnew/changelog.html</url>
 <url>https://docs.python.org/release/3.13.11/whatsnew/changelog.html</url>
 </references>
 <dates>
 <discovery>2024-05-23</discovery>
 <entry>2025-12-08</entry>
 <modified>2026-01-25</modified>
 </dates>
 </vuln>

<vuln vid="ea34264d-d289-11f0-a15a-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>143.0.7499.40</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>143.0.7499.40</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html">
	 This update includes 13 security fixes:
	 <ul>
	 <li>[456547591] High CVE-2025-13630: Type Confusion in V8. Reported by Shreyas Penkar (@streypaws) on 2025-10-31</li>
	 <li>[448113221] High CVE-2025-13631: Inappropriate implementation in Google Updater. Reported by Jota Domingos on 2025-09-29</li>
	 <li>[439058242] High CVE-2025-13632: Inappropriate implementation in DevTools. Reported by Leandro Teles on 2025-08-16</li>
	 <li>[458082926] High CVE-2025-13633: Use after free in Digital Credentials. Reported by Chrome on 2025-11-05</li>
	 <li>[429140219] Medium CVE-2025-13634: Inappropriate implementation in Downloads. Reported by Eric Lawrence of Microsoft on 2025-07-02</li>
	 <li>[457818670] Medium CVE-2025-13720: Bad cast in Loader. Reported by Chrome on 2025-11-04</li>
	 <li>[355120682] Medium CVE-2025-13721: Race in v8. Reported by Chrome on 2024-07-23</li>
	 <li>[405727341] Low CVE-2025-13635: Inappropriate implementation in Downloads. Reported by Hafiizh on 2025-03-24</li>
	 <li>[446181124] Low CVE-2025-13636: Inappropriate implementation in Split View. Reported by Khalil Zhani on 2025-09-20</li>
	 <li>[392375329] Low CVE-2025-13637: Inappropriate implementation in Downloads. Reported by Hafiizh on 2025-01-27</li>
	 <li>[448046109] Low CVE-2025-13638: Use after free in Media Stream. Reported by sherkito on 2025-09-29</li>
	 <li>[448408148] Low CVE-2025-13639: Inappropriate implementation in WebRTC. Reported by Philipp Hancke on 2025-10-01</li>
	 <li>[452071826] Low CVE-2025-13640: Inappropriate implementation in Passwords. Reported by Anonymous on 2025-10-14</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-13631</cvename>
 <cvename>CVE-2025-13632</cvename>
 <cvename>CVE-2025-13633</cvename>
 <cvename>CVE-2025-13634</cvename>
 <cvename>CVE-2025-13635</cvename>
 <cvename>CVE-2025-13636</cvename>
 <cvename>CVE-2025-13637</cvename>
 <cvename>CVE-2025-13638</cvename>
 <cvename>CVE-2025-13639</cvename>
 <cvename>CVE-2025-13640</cvename>
 <cvename>CVE-2025-13634</cvename>
 <cvename>CVE-2025-13720</cvename>
 <cvename>CVE-2025-13721</cvename>
 <url>https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2025-12-02</discovery>
 <entry>2025-12-06</entry>
 </dates>
 </vuln>

<vuln vid="8acfcfdc-d27c-11f0-8512-b0416f0c4c67">
 <topic>spotipy -- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')</topic>
 <affects>
 <package>
	 <name>py310-spotipy</name>
	 <name>py311-spotipy</name>
	 <name>py312-spotipy</name>
	 <name>py313-spotipy</name>
	 <name>py313t-spotipy</name>
	 <name>py314-spotipy</name>
	 <range><lt>2.25.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-r77h-rpp9-w2xm reports:
	<blockquote cite="https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-r77h-rpp9-w2xm">
	 Spotipy is a Python library for the Spotify Web API. Prior to
version 2.25.2, there is a cross-site scripting (XSS) vulnerability
in the OAuth callback server that allows for JavaScript injection
through the unsanitized error parameter. Attackers can execute
arbitrary JavaScript in the user's browser during OAuth authentication.
This issue has been patched in version 2.25.2.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-66040</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-66040</url>
 </references>
 <dates>
 <discovery>2025-11-26</discovery>
 <entry>2025-12-06</entry>
 </dates>
 </vuln>

<vuln vid="c7187676-d176-11f0-841f-843a4b343614">
 <topic>xkbcomp -- Several vulnerabilities</topic>
 <affects>
 <package>
	<name>xkbcomp</name>
	<range><lt>1.5.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	X.Org reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2025-December/003644.html">
 Multiple issues have been found in xkbcomp that have been previously
 been published as CVEs in libxbkcommon. libxkbcommon is (to some degree)
 a fork of xkbcomp and some of the code base is identical. These CVEs
 were published earlier as:
 <ul>
 <li>CVE-2018-15853: Endless recursion in xkbcomp/expr.c resulting in a crash</li>
 <li>CVE-2018-15859: NULL pointer dereference when parsing invalid atoms in
	ExprResolveLhs resulting in a crash</li>
 <li>CVE-2018-15861: NULL pointer dereference in ExprResolveLhs resulting
	in a crash</li>
 <li>CVE-2018-15863: NULL pointer dereference in ResolveStateAndPredicate
	resulting in a crash</li>
 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2018-15863</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2018-15863</url>
 <cvename>CVE-2018-15859</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2018-15859</url>
 <cvename>CVE-2018-15861</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2018-15861</url>
 <cvename>CVE-2018-15863</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2018-15863</url>
 </references>
 <dates>
 <discovery>2025-12-03</discovery>
 <entry>2025-12-05</entry>
 </dates>
 </vuln>

<vuln vid="f323f148-d181-11f0-841f-843a4b343614">
 <topic>png -- Out-of-bounds read</topic>
 <affects>
 <package>
	<name>png</name>
	<range><lt>1.6.52</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f reports:
	<blockquote cite="https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f">
	 Prior to 1.6.52, an out-of-bounds read vulnerability in
 libpng's simplified API allows reading up to 1012 bytes beyond the
 png_sRGB_base[512] array when processing valid palette PNG images
 with partial transparency and gamma correction. The PNG files that
 trigger this vulnerability are valid per the PNG specification; the
 bug is in libpng's internal state management.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-66293</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-66293</url>
 </references>
 <dates>
 <discovery>2025-12-03</discovery>
 <entry>2025-12-05</entry>
 </dates>
 </vuln>

<vuln vid="be3167b5-d140-11f0-ad27-c01803b56cc4">
 <topic>libvirt -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libvirt</name>
	<range><lt>11.10.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The libvirt project reports:
	<blockquote cite="https://libvirt.org/news.html#v11-10-0-2025-12-01">
		See <a href="https://libvirt.org/news.html#v11-10-0-2025-12-01">
					changelog</a> for details.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-12748</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-12748</url>
 <cvename>CVE-2025-13193</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13193</url>
 </references>
 <dates>
 <discovery>2025-11-11</discovery>
 <entry>2025-12-04</entry>
 </dates>
 </vuln>

<vuln vid="6ebe4a30-d138-11f0-af8c-8447094a420f">
 <topic>Apache httpd -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.66</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="https://downloads.apache.org/httpd/CHANGES_2.4.66">
	 See <a href="https://downloads.apache.org/httpd/CHANGES_2.4.66">
	 changelog</a> or <a href="https://httpd.apache.org/security/vulnerabilities_24.html">
	 2.4 vulnerabilities</a> for details.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-66200</cvename>
 <cvename>CVE-2025-65082</cvename>
 <cvename>CVE-2025-59775</cvename>
 <cvename>CVE-2025-58098</cvename>
 <cvename>CVE-2025-55753</cvename>
 <url>https://downloads.apache.org/httpd/CHANGES_2.4.66</url>
 </references>
 <dates>
 <discovery>2025-12-04</discovery>
 <entry>2025-12-04</entry>
 </dates>
 </vuln>

<vuln vid="245bd19f-d035-11f0-84e9-c7a56e37e3f0">
 <topic>go -- excessive resource consumption</topic>
 <affects>
 <package>
 <name>go124</name>
 <range><lt>1.24.11</lt></range>
 </package>
 <package>
 <name>go125</name>
 <range><lt>1.25.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	 The Go project reports:
	 <blockquote cite="https://pkg.go.dev/vuln/GO-2025-4155">
	 Within HostnameError.Error(), when constructing an error
	 string, there is no limit to the number of hosts that will
	 be printed out.
	 Furthermore, the error string is constructed by repeated
	 string concatenation, leading to quadratic runtime.
	 Therefore, a certificate provided by a malicious actor can
	 result in excessive resource consumption.
	 </blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-61729</cvename>
 <url>https://pkg.go.dev/vuln/GO-2025-4155</url>
 </references>
 <dates>
 <discovery>2025-12-02</discovery>
 <entry>2025-12-03</entry>
 </dates>
 </vuln>

<vuln vid="eda92945-ced4-11f0-a958-b42e991fc52e">
 <topic>MongoDB -- Missing Authorization</topic>
 <affects>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.14</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.26</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://jira.mongodb.org/browse/SERVER-103582 reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-103582">
	 A user with access to the cluster with a limited set of
	 privilege actions may be able to terminate queries that are
	 being executed by other users. This may cause a denial of
	 service by preventing a fraction of queries from
	 successfully completing.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-13643</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13643</url>
 </references>
 <dates>
 <discovery>2025-11-25</discovery>
 <entry>2025-12-01</entry>
 </dates>
 </vuln>

<vuln vid="ea64d2ec-ced4-11f0-a958-b42e991fc52e">
 <topic>MongoDB -- Improper Validation of Specified Quantity in Input</topic>
 <affects>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.16</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.26</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://jira.mongodb.org/browse/SERVER-108565 reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-108565">
	 Inconsistent object size validation in time series
	 processing logic may result in later processing of oversized
	 BSON documents leading to an assert failing and process
	 termination.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-13507</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13507</url>
 </references>
 <dates>
 <discovery>2025-11-25</discovery>
 <entry>2025-12-01</entry>
 </dates>
 </vuln>

<vuln vid="e72ec9c1-ced4-11f0-a958-b42e991fc52e">
 <topic>MongoDB -- Reachable Assertion</topic>
 <affects>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.13</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.26</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://jira.mongodb.org/browse/SERVER-101180 reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-101180">
	 MongoDB Server may experience an invariant failure during
	 batched delete operations when handling documents. The
	 issue arises when the server mistakenly assumes the presence
	 of multiple documents in a batch based solely on document
	 size exceeding BSONObjMaxSize.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-13644</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13644</url>
 </references>
 <dates>
 <discovery>2025-11-25</discovery>
 <entry>2025-12-01</entry>
 </dates>
 </vuln>

<vuln vid="ba02dfb6-ce31-11f0-a327-589cfc01894a">
 <topic>wolfssl -- multiple issues</topic>
 <affects>
 <package>
 <name>wolfssl</name>
	 <range><lt>5.8.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wolfSSL blog reports:
	<blockquote cite="https://www.wolfssl.com/wolfssl-5-8-4-now-available/">
	 This release includes multiple fixes across TLS 1.2, TLS 1.3, X25519,
	 XChaCha20-Poly1305, and PSK processing. Highlights include:
 <ul>
 <li>A timing-side-channel issue in X25519 specifically affecting
 Xtensa-based ESP32 devices. Low-memory X25519 implementations are now
 the default for Xtensa.</li>
 <li>A medium-severity TLS 1.3 server-side DoS risk from repeated
 KeyShareEntry values in malicious ClientHello messages.</li>
 <li>Several TLS 1.3 downgrade-related issues (PFS downgrades, signature
 algorithm downgrades, and duplicate extension parsing).</li>
 <li>A memory leak risk in TLS 1.2 certificate digest handling.</li>
 <li>XChaCha20-Poly1305 decryption bounds-check fix and constant-time
 improvements in PSK binder verification.</li>
 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-12888</cvename>
 <cvename>CVE-2025-11936</cvename>
 <cvename>CVE-2025-11935</cvename>
 <cvename>CVE-2025-11934</cvename>
 <cvename>CVE-2025-11933</cvename>
 <cvename>CVE-2025-11932</cvename>
 <cvename>CVE-2025-11931</cvename>
 <cvename>CVE-2025-12889</cvename>
 <url>https://github.com/wolfSSL/wolfssl/releases/tag/v5.8.4-stable</url>
 </references>
 <dates>
 <discovery>2025-11-20</discovery>
 <entry>2025-11-30</entry>
 </dates>
 </vuln>

<vuln vid="d2f2c691-cd42-11f0-85d4-b42e991fc52e">
 <topic>MongoDB Server -- Improper Certificate Validation</topic>
 <affects>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.26</lt></range>
 </package>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.16</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://jira.mongodb.org/browse/SERVER-105783 reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-105783">
	Clients may successfully perform a TLS handshake with a
	MongoDB server despite presenting a client certificate not
	aligning with the documented Extended Key Usage (EKU)
	requirements. A certificate that specifies extendedKeyUsage
	but is missing extendedKeyUsage = clientAuth may still be
	successfully authenticated via the TLS handshake as a
	client. This issue is specific to MongoDB servers running
	on Windows or Apple as the expected validation behavior
	functions correctly on Linux systems. Additionally, MongoDB
	servers may successfully establish egress TLS connections
	with servers that present server certificates not aligning
	with the documented Extended Key Usage (EKU) requirements.
	A certificate that specifies extendedKeyUsage but is missing
	extendedKeyUsage = serverAuth may still be successfully
	authenticated via the TLS handshake as a server. This issue
	is specific to MongoDB servers running on Apple as the
	expected validation behavior functions correctly on both
	Linux and Windows systems.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-12893</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-12893</url>
 </references>
 <dates>
 <discovery>2025-11-25</discovery>
 <entry>2025-11-29</entry>
 </dates>
 </vuln>

<vuln vid="4b297f5a-cbad-11f0-ac9f-b42e991fc52e">
 <topic>png -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>png</name>
	<range><lt>1.6.51</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g reports:
	<blockquote cite="https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g">
	LIBPNG is a reference library for use in applications
	that read, create, and manipulate PNG (Portable Network
	Graphics) raster image files.
	
	<ul>
	<li>From version 1.6.0 to before 1.6.51, there is a heap
	buffer overflow vulnerability in the libpng simplified API
	function png_image_finish_read when processing 16-bit
	interlaced PNGs with 8-bit output format. Attacker-crafted
	interlaced PNG files cause heap writes beyond allocated
	buffer bounds. This issue has been patched in version
	1.6.51.</li>
	<li>From version 1.6.0 to before 1.6.51, an out-of-bounds read
	vulnerability exists in png_image_read_composite when
	processing palette images with PNG_FLAG_OPTIMIZE_ALPHA
	enabled. The palette compositing code in
	png_init_read_transformations incorrectly applies background
	compositing during premultiplication, violating the invariant
	component alpha 257 required by the simplified PNG API.</li>
	<li>From version 1.6.0 to before 1.6.51, a heap buffer over-read
	vulnerability exists in libpng's png_write_image_8bit function
	when processing 8-bit images through the simplified write API
	with convert_to_8bit enabled. The vulnerability affects 8-bit
	grayscale+alpha, RGB/RGBA, and images with incomplete row data.
	A conditional guard incorrectly allows 8-bit input to enter code
	expecting 16-bit input, causing reads up to 2 bytes beyond
	allocated buffer boundaries.</li>
	<li>Prior to version 1.6.51, a heap buffer over-read vulnerability
	exists in libpng's png_do_quantize function when processing PNG
	files with malformed palette indices. The vulnerability occurs
	when palette_lookup array bounds are not validated against
	externally-supplied image data, allowing an attacker to craft a
	PNG file with out-of-range palette indices that trigger
	out-of-bounds memory access.</li>
	</ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-65018</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-65018</url>
 <cvename>CVE-2025-64720</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-64720</url>
 <cvename>CVE-2025-64506</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-64506</url>
 <cvename>CVE-2025-64505</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-64505</url>
 </references>
 <dates>
 <discovery>2025-11-24</discovery>
 <entry>2025-11-27</entry>
 </dates>
 </vuln>

<vuln vid="4530fc9f-cb47-11f0-85d8-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.6.0</ge><lt>18.6.1</lt></range>
	<range><ge>18.5.0</ge><lt>18.5.3</lt></range>
	<range><ge>8.3.0</ge><lt>18.4.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/11/26/patch-release-gitlab-18-6-1-released/">
	 Race condition issue in CI/CD cache impacts GitLab CE/EE
	 Denial of Service issue in JSON input validation middleware impacts GitLab CE/EE
	 Authentication bypass issue in account registration impacts GitLab CE/EE
	 Denial of Service issue in HTTP response processing impacts GitLab CE/EE
	 Improper authorization issue in markdown rendering impacts GitLab EE
	 Information disclosure issue in terraform registry impacts GitLab CE/EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-9183</cvename>
 <cvename>CVE-2025-12571</cvename>
 <cvename>CVE-2025-12653</cvename>
 <cvename>CVE-2025-7449</cvename>
 <cvename>CVE-2025-6195</cvename>
 <cvename>CVE-2025-13611</cvename>
 <url>https://about.gitlab.com/releases/2025/11/26/patch-release-gitlab-18-6-1-released/</url>
 </references>
 <dates>
 <discovery>2025-11-26</discovery>
 <entry>2025-11-27</entry>
 </dates>
 </vuln>

<vuln vid="b6835edf-c6c8-11f0-8471-74563cf9e4e9">
 <topic>GnuTLS -- Stack write buffer overflow</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>3.8.11</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	GnuTLS reports:
	<blockquote cite="https://gnutls.org/security-new.html#GNUTLS-SA-2025-11-18">
	 When a PKCS#11 token is initialized with gnutls_pkcs11_token_init function
	 and it is passed a token label longer than 32 characters, it may write past
	 the boundary of stack allocated memory.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-9820</cvename>
 <url>https://gnutls.org/security-new.html#GNUTLS-SA-2025-11-18</url>
 </references>
 <dates>
 <discovery>2025-11-18</discovery>
 <entry>2025-11-21</entry>
 </dates>
 </vuln>

<vuln vid="ca5d4e87-c465-11f0-b3f7-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>142.0.7444.175</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>142.0.7444.175</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_17.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[460017370] High CVE-2025-13223: Type Confusion in V8. Reported by Clément Lecigne of Google's Threat Analysis Group on 2025-11-12</li>
	 <li>[450328966] High CVE-2025-13224: Type Confusion in V8. Reported by Google Big Sleep on 2025-10-09</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-13223</cvename>
 <cvename>CVE-2025-13224</cvename>
 <url>https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_17.html</url>
 </references>
 <dates>
 <discovery>2025-11-17</discovery>
 <entry>2025-11-18</entry>
 </dates>
 </vuln>

<vuln vid="1a46e84d-c406-11f0-b513-0da7be77c170">
 <topic>pkcs11-helper -- deserialize buffer overflow</topic>
 <affects>
 <package>
	<name>pkcs11-helper</name>
	<range><lt>1.31.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Alon Bar-Lev reports:
	<blockquote cite="https://github.com/OpenSC/pkcs11-helper/releases/tag/pkcs11-helper-1.31.0">
	 util: fix deserialize buffer overflow. thanks to Aarnav Bos.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/OpenSC/pkcs11-helper/releases/tag/pkcs11-helper-1.31.0</url>
 </references>
 <dates>
 <discovery>2025-11-10</discovery>
 <entry>2025-11-17</entry>
 </dates>
 </vuln>

<vuln vid="50a0c266-c3ff-11f0-b513-0da7be77c170">
 <topic>OpenVPN -- avoid buffer overread parsing routes or endpoints</topic>
 <affects>
 <package>
	<name>openvpn-devel</name>
	<range><lt>g20251117,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mikhail Khachaiants reports:
	<blockquote cite="https://github.com/OpenVPN/openvpn/commit/f1b851dae60eb1e277315dfe6265e3a58660b16a">
	 socket: reject mismatched address family in get_addr_generic.
	 Add a family check to prevent copying address data of the wrong type,
	 which could cause buffer over-read when parsing routes or endpoints.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-12106</cvename>
 <url>https://github.com/OpenVPN/openvpn/commit/f1b851dae60eb1e277315dfe6265e3a58660b16a</url>
 </references>
 <dates>
 <discovery>2025-10-18</discovery>
 <entry>2025-11-17</entry>
 </dates>
 </vuln>

<vuln vid="17a40d76-c3fd-11f0-b513-0da7be77c170">
 <topic>OpenVPN -- HMAC verification on source IP address ineffective</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><lt>2.6.16</lt></range>
 </package>
 <package>
	<name>openvpn-devel</name>
	<range><lt>g20251117,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Arne Schwabe reports:
	<blockquote cite="https://github.com/OpenVPN/openvpn/commit/fa6a1824b0f37bff137204156a74ca28cf5b6f83">
	 Fix memcmp check for the hmac verification in the 3way handshake being inverted
	 This is a stupid mistake but causes all hmac cookies to be accepted,
	 thus breaking source IP address validation.	As a consequence, TLS
	 sessions can be openend and state can be consumed in the server from
	 IP addresses that did not initiate an initial connection.
	 While at it, fix check to only allow [t-2;t] timeslots, disallowing
	 HMACs coming in from a future timeslot.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-13086</cvename>
 <url>https://github.com/OpenVPN/openvpn/commit/fa6a1824b0f37bff137204156a74ca28cf5b6f83</url>
 </references>
 <dates>
 <discovery>2025-10-27</discovery>
 <entry>2025-11-17</entry>
 </dates>
 </vuln>

<vuln vid="fa433f05-c217-11f0-82ac-901b0edee044">
 <topic>py-pdfminer.six -- Arbitrary Code Execution in pdfminer.six via Crafted PDF Input</topic>
 <affects>
 <package>
 <name>py310-pdfminer.six</name>
 <name>py311-pdfminer.six</name>
 <name>py312-pdfminer.six</name>
 <name>py313-pdfminer.six</name>
 <name>py313t-pdfminer.six</name>
 <name>py314-pdfminer.six</name>
 <range><lt>20251230</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Pieter Marsman reports:
	<blockquote cite="https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp">
	 pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The CMapDB._load_data() function in pdfminer.six uses pickle.loads() to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the cmap/ directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in .pickle.gz. A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-64512</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-64512</url>
 </references>
 <dates>
 <discovery>2025-11-07</discovery>
 <entry>2025-11-17</entry>
 <modified>2025-12-30</modified>
 </dates>
 </vuln>

<vuln vid="bf6c9252-c2ec-11f0-8372-98b78501ef2a">
 <topic>sudo-rs -- Authenticating user not recorded properly in timestamp</topic>
 <affects>
 <package>
	<name>sudo-rs</name>
	<range><ge>0.2.5</ge><lt>0.2.10</lt></range>
	</package>
	<package>
	<name>sudo-rs-coexist</name>
	<range><ge>0.2.5</ge><lt>0.2.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Trifecta Tech Foundation reports:
	<blockquote cite="https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-q428-6v73-fc4q">
	 With Defaults targetpw (or Defaults rootpw) enabled, the password of the
	 target account (or root account) instead of the invoking user is used for authentication.
	 sudo-rs prior to 0.2.10 incorrectly recorded the invoking user’s UID instead of the
	 authenticated-as user's UID in the authentication timestamp. Any later sudo invocation
	 on the same terminal while the timestamp was still valid would use that timestamp,
	 potentially bypassing new authentication even if the policy would have required it.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-64517</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-64517</url>
 </references>
 <dates>
 <discovery>2025-11-12</discovery>
 <entry>2025-11-16</entry>
 </dates>
 </vuln>

<vuln vid="c1ceaaea-c2e7-11f0-8372-98b78501ef2a">
 <topic>sudo-rs -- Partial password reveal when password timeout occurs</topic>
 <affects>
 <package>
	<name>sudo-rs</name>
	<range><ge>0.2.7</ge><lt>0.2.10</lt></range>
 </package>
 <package>
	<name>sudo-rs-coexist</name>
	<range><ge>0.2.7</ge><lt>0.2.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Trifecta Tech Foundation reports:
	<blockquote cite="https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw">
	 When typing partial passwords but not pressing return for a long time,
	 a password timeout can occur. When this happens, the keys pressed are
	 replayed onto the console.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-64170</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-64170</url>
 </references>
 <dates>
 <discovery>2025-11-12</discovery>
 <entry>2025-11-16</entry>
 </dates>
 </vuln>

<vuln vid="364e5fa4-c178-11f0-b614-b42e991fc52e">
 <topic>PostgreSQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql13-client</name>
	<range><lt>13.23</lt></range>
 </package>
 <package>
	<name>postgresql14-client</name>
	<range><lt>14.20</lt></range>
 </package>
 <package>
	<name>postgresql15-client</name>
	<range><lt>15.15</lt></range>
 </package>
 <package>
	<name>postgresql16-client</name>
	<range><lt>16.11</lt></range>
 </package>
 <package>
	<name>postgresql17-client</name>
	<range><lt>17.7</lt></range>
 </package>
 <package>
	<name>postgresql18-client</name>
	<range><lt>18.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://www.postgresql.org/support/security/CVE-2025-12818/ reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2025-12818/">
	 <ul>
	 <li>Integer wraparound in multiple PostgreSQL libpq client
	 library functions allows an application input provider or
	 network peer to cause libpq to undersize an allocation and
	 write out-of-bounds by hundreds of megabytes. This results
	 in a segmentation fault for the application using libpq.</li>
	 <li>Missing authorization in PostgreSQL CREATE STATISTICS
	 command allows a table owner to achieve denial of service
	 against other CREATE STATISTICS users by creating in any
	 schema. A later CREATE STATISTICS for the same name, from a
	 user having the CREATE privilege, would then fail.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-12818</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-12818</url>
 <cvename>CVE-2025-12817</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-12817</url>
 </references>
 <dates>
 <discovery>2025-11-13</discovery>
 <entry>2025-11-14</entry>
 </dates>
 </vuln>

<vuln vid="2063f110-c0b8-11f0-a633-8c164580114f">
 <topic>lightdm-kde-greeter -- Privilege Escalation from lightdm Service User to root</topic>
 <affects>
 <package>
	<name>lightdm-kde-greeter</name>
	<range><lt>6.0.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	SUSE Security Team reports:
	<blockquote cite="https://security.opensuse.org/2025/11/13/lightdm-kde-greeter-auth-helper.html">
	 A Execution with Unnecessary Privileges vulnerability in
	 lightdm-kde-greeter allows escalation from the service user to
	 root. This issue affects lightdm-kde-greeter before 6.0.4.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-62876</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-62876</url>
 </references>
 <dates>
 <discovery>2025-11-12</discovery>
 <entry>2025-11-13</entry>
 </dates>
 </vuln>

<vuln vid="bff06006-c0b7-11f0-ab42-b42e991fc52e">
 <topic>Mozilla -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>145.0.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>145.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/buglist.cgi?bug_id=1987237%2C1990079%2C1991715%2C1994994 reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1987237%2C1990079%2C1991715%2C1994994">
	 Memory safety bugs. Some of these bugs showed evidence of
	 memory corruption and we presume that with enough effort
	 some of these could have been exploited to run arbitrary
	 code. 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-13027</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13027</url>
 </references>
 <dates>
 <discovery>2025-11-11</discovery>
 <entry>2025-11-13</entry>
 </dates>
 </vuln>

<vuln vid="a2a815c8-c0b7-11f0-ab42-b42e991fc52e">
 <topic>Firefox -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>145.0.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1994441 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1994441">
	 <ul>
	 <li>Sandbox escape due to incorrect boundary conditions in
	 the Graphics: WebGPU component.</li>
	 <li>Incorrect boundary conditions in the Graphics: WebGPU
	 component.</li>
	 <li>JIT miscompilation in the JavaScript Engine: JIT component.</li>
	 <li>Sandbox escape due to incorrect boundary conditions in
	 the Graphics: WebGPU component.</li>
	 <li>Incorrect boundary conditions in the Graphics: WebGPU
	 component.</li>
	 <li>Incorrect boundary conditions in the Graphics: WebGPU
	 component.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-13026</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13026</url>
 <cvename>CVE-2025-13025</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13025</url>
 <cvename>CVE-2025-13024</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13024</url>
 <cvename>CVE-2025-13023</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13023</url>
 <cvename>CVE-2025-13022</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13022</url>
 <cvename>CVE-2025-13021</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13021</url>
 </references>
 <dates>
 <discovery>2025-11-11</discovery>
 <entry>2025-11-13</entry>
 </dates>
 </vuln>

<vuln vid="c894635c-c0b6-11f0-ab42-b42e991fc52e">
 <topic>firefox -- Use-after-free</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>145.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1995686 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1995686">
	 <ul>
	 <li>Use-after-free in the WebRTC: Audio/Video component.</li>
	 <li>Same-origin policy bypass in the DOM: Workers component.</li>
	 <li>Mitigation bypass in the DOM: Security component.</li>
	 <li>Same-origin policy bypass in the DOM: Notifications
	 component.</li>
	 <li>Incorrect boundary conditions in the JavaScript:
	 WebAssembly component.</li>
	 <li>Spoofing issue in Firefox.</li>
	 <li>Use-after-free in the Audio/Video component.</li>
	 <li>Mitigation bypass in the DOM: Core and HTML component.</li>
	 <li>Race condition in the Graphics component.</li>
	</ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-13020</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13020</url>
 <cvename>CVE-2025-13019</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13019</url>
 <cvename>CVE-2025-13018</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13018</url>
 <cvename>CVE-2025-13017</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13017</url>
 <cvename>CVE-2025-13016</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13016</url>
 <cvename>CVE-2025-13015</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13015</url>
 <cvename>CVE-2025-13014</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13014</url>
 <cvename>CVE-2025-13013</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13013</url>
 <cvename>CVE-2025-13012</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-13012</url>
 </references>
 <dates>
 <discovery>2025-11-11</discovery>
 <entry>2025-11-13</entry>
 </dates>
 </vuln>

<vuln vid="5a1d6309-c04a-11f0-85d8-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.5.0</ge><lt>18.5.2</lt></range>
	<range><ge>18.4.0</ge><lt>18.4.4</lt></range>
	<range><ge>13.2.0</ge><lt>18.3.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/">
	 Cross-site scripting issue in k8s proxy impacts GitLab CE/EE
	 Incorrect Authorization issue in workflows impacts GitLab EE
	 Information Disclosure issue in GraphQL subscriptions impacts GitLab CE/EE
	 Information Disclosure issue in access control impacts GitLab CE/EE
	 Prompt Injection issue in GitLab Duo review impacts GitLab EE
	 Client Side Path Traversal issue in branch names impacts GitLab EE
	 Information Disclosure issue in packages API endpoint impacts GitLab CE/EE
	 Improper Access Control issue in GitLab Pages impacts GitLab CE/EE
	 Denial of service issue in markdown impacts GitLab CE/EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11224</cvename>
 <cvename>CVE-2025-11865</cvename>
 <cvename>CVE-2025-2615</cvename>
 <cvename>CVE-2025-7000</cvename>
 <cvename>CVE-2025-6945</cvename>
 <cvename>CVE-2025-11990</cvename>
 <cvename>CVE-2025-6171</cvename>
 <cvename>CVE-2025-7736</cvename>
 <cvename>CVE-2025-12983</cvename>
 <url>https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/</url>
 </references>
 <dates>
 <discovery>2025-11-12</discovery>
 <entry>2025-11-13</entry>
 </dates>
 </vuln>

<vuln vid="6e1105d8-bfc2-11f0-bb2b-ecf4bbefc954">
 <topic>privatebin XSS</topic>
 <affects>
 <package>
 <name>privatebin</name>
 <range><lt>2.0.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	privatebin reports:
	<blockquote cite="https://privatebin.info/reports/vulnerability-2025-11-12-drag-drop.html">
	 Dragging a file whose filename contains HTML is reflected verbatim
	 into the page via the drag-and-drop helper, so any user who drops a
	 crafted file on PrivateBin will execute arbitrary JavaScript within
	 their own session (self-XSS). This allows an attacker who can entice
	 a victim to drag or otherwise attach such a file to exfiltrate
	 plaintext, encryption keys, or stored pastes before they are
	 encrypted or sent.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-62796</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-62796</url>
 </references>
 <dates>
 <discovery>2025-11-09</discovery>
 <entry>2025-11-12</entry>
 </dates>
 </vuln>

<vuln vid="6e05f716-bf9e-11f0-b3f7-a8a1599412c6">
 <topic>chromium -- security fix</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>142.0.7444.162</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>142.0.7444.162</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_11.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[457351015] High CVE-2025-13042: Inappropriate implementation in V8. Reported by 303f06e3 on 2025-11-03</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-13042</cvename>
 <url>https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_11.html</url>
 </references>
 <dates>
 <discovery>2025-11-11</discovery>
 <entry>2025-11-12</entry>
 </dates>
 </vuln>

<vuln vid="93ff3ebe-bba8-11f0-b3f7-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>142.0.7444.134</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>142.0.7444.134</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html">
	 This update includes 5 security fixes:
	 <ul>
	 <li>[443906252] High CVE-2025-12725: Out of bounds write in WebGPU. Reported by Anonymous on 2025-09-09</li>
	 <li>[447172715] High CVE-2025-12726: Inappropriate implementation in Views. Reported by Alesandro Ortiz on 2025-09-25</li>
	 <li>[454485895] High CVE-2025-12727: Inappropriate implementation in V8. Reported by 303f06e3 on 2025-10-23</li>
	 <li>[452392032] Medium CVE-2025-12728: Inappropriate implementation in Omnibox. Reported by Hafiizh on 2025-10-16</li>
	 <li>[454354281] Medium CVE-2025-12729: Inappropriate implementation in Omnibox. Reported by Khalil Zhani on 2025-10-23</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-12725</cvename>
 <cvename>CVE-2025-12726</cvename>
 <cvename>CVE-2025-12727</cvename>
 <cvename>CVE-2025-12728</cvename>
 <cvename>CVE-2025-12729</cvename>
 <url>https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2025-11-05</discovery>
 <entry>2025-11-07</entry>
 </dates>
 </vuln>

<vuln vid="77bac392-ba98-11f0-aada-f59a8ea34d12">
	 <topic>OpenJPH &lt; 0.24.5 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openjph</name>
	<range><lt>0.24.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aous Naman reports several vulnerabilities fixed in OpenJPH versions
	up to 0.24.5 and credits Cary Phillips for reporting them from the
	 OSS-fuzz project.
	<blockquote cite="https://github.com/aous72/OpenJPH/releases">
	 [0.24.5] Addresses OpenEXR OSS-fuzz issue 5747129672073216 that can cause heap corruption.
	 [0.24.4...] we now check that the ATK marker segment length (Latk) makes sense.
	 The issue was identified in OpenEXR fuzzing.
	 [0.24.3] This is an important bug fix. It protects against illegally long QCD and QCC marker segments. It was discovered during OpenEXR fussing; thanx to [Cary Phillips].
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/aous72/OpenJPH/releases</url>
 </references>
 <dates>
 <discovery>2025-10-29</discovery>
 <entry>2025-11-05</entry>
 </dates>
 </vuln>

<vuln vid="c71a3914-ba96-11f0-aada-f59a8ea34d12">
 <topic>OpenEXR &lt; 3.4.3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openexr</name>
	<range><lt>3.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cary Phillips reports:
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.3">
	 
	 Patch release that addresses several bugs, primarily involving
	 properly rejecting corrupt input data.
	 
	</blockquote>
	
	 He goes on to report various relevant items including heap buffer
	 overflows, use-after-free, use of uninitialized memory and other bugs,
	 several of them found by OSS-fuzz, and some also found in OpenJPH.
	
 </body>
 </description>
 <references>
 <url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.3</url>
 </references>
 <dates>
 <discovery>2025-10-29</discovery>
 <entry>2025-11-05</entry>
 </dates>
 </vuln>

<vuln vid="970159e6-ba60-11f0-8447-b42e991fc52e">
 <topic>MongoDB -- Improper Check for Unusual or Exceptional Conditions</topic>
 <affects>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.22</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://jira.mongodb.org/browse/SERVER-101230 reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-101230">
	 The KMIP response parser built into mongo binaries is
	 overly tolerant of certain malformed packets, and may parse
	 them into invalid objects. Later reads of this object can
	 result in read access violations.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-12657</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-12657</url>
 </references>
 <dates>
 <discovery>2025-11-03</discovery>
 <entry>2025-11-05</entry>
 </dates>
 </vuln>

<vuln vid="e99a32c8-b8e2-11f0-8510-b42e991fc52e">
 <topic>Xorg -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<range><lt>21.1.19,1</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>24.1.9,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://access.redhat.com/errata/RHSA-2025:19432 reports:
	<blockquote cite="https://access.redhat.com/errata/RHSA-2025:19432">
	 CVE-2025-62229: A flaw was found in the X.Org X server
	 and Xwayland when processing X11 Present extension
	 notifications. Improper error handling during notification
	 creation can leave dangling pointers that lead to a
	 use-after-free condition. This can cause memory corruption
	 or a crash, potentially allowing an attacker to execute
	 arbitrary code or cause a denial of service.
	 CVE-2025-62230: A flaw was discovered in the X.Org X
	 servers X Keyboard (Xkb) extension when handling client
	 resource cleanup. The software frees certain data
	 structures without properly detaching related resources,
	 leading to a use-after-free condition. This can cause
	 memory corruption or a crash when affected clients
	 disconnect.
	 CVE-2025-62231: A flaw was identified in the X.Org X
	 servers X Keyboard (Xkb) extension where improper bounds
	 checking in the XkbSetCompatMap() function can cause an
	 unsigned short overflow. If an attacker sends specially
	 crafted input data, the value calculation may overflow,
	 leading to memory corruption or a crash.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-62229</cvename>
 <cvename>CVE-2025-62230</cvename>
 <cvename>CVE-2025-62231</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-62229</url>
 </references>
 <dates>
 <discovery>2025-10-30</discovery>
 <entry>2025-11-03</entry>
 </dates>
 </vuln>

<vuln vid="5523394e-b889-11f0-9446-f02f7497ecda">
 <topic>redis -- Bug in XACKDEL may lead to stack overflow and potential RCE</topic>
 <affects>
 <package>
 <name>redis</name>
 <range><ge>8.2.0</ge><lt>8.2.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Google Big Sleep reports:
 <blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-jhjx-x4cf-4vm8">
 A user can run the XACKDEL command with multiple ID's and
 trigger a stack buffer overflow, which may potentially lead to
 remote code execution.
 The problem exists in Redis 8.2 or newer.
 The code doesn't handle the case where the number of ID's exceeds
 the STREAMID_STATIC_VECTOR_LEN, and skips a reallocation, which
 leads to a stack buffer overflow.
 An additional workaround to mitigate the problem without patching
 the redis-server executable is to prevent users from executing
 XACKDEL operation. This can be done using ACL to restrict XACKDEL
 command.
 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-62507</cvename>
 <url/>
 </references>
 <dates>
 <discovery>2025-11-03</discovery>
 <entry>2025-11-03</entry>
 </dates>
 </vuln>

<vuln vid="1ba0b62b-b80a-11f0-8016-b42e991fc52e">
 <topic>Mozilla -- Denial-of-service due to out-of-memory</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>142.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.2.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>142.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1975837 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1975837">
	 Denial-of-service due to out-of-memory in the Graphics:
	 WebRender component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-9182</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-9182</url>
 </references>
 <dates>
 <discovery>2025-08-19</discovery>
 <entry>2025-11-02</entry>
 </dates>
 </vuln>

<vuln vid="0723a60e-b80a-11f0-8016-b42e991fc52e">
 <topic>Mozilla -- Same-origin policy bypass in the Graphics: Canvas2D component</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>142.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.2.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>142.0.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>140.2.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1979782 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1979782">
	 Same-origin policy bypass in the Graphics: Canvas2D
	 component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-9180</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-9180</url>
 </references>
 <dates>
 <discovery>2025-08-19</discovery>
 <entry>2025-11-02</entry>
 </dates>
 </vuln>

<vuln vid="f752879f-b809-11f0-8016-b42e991fc52e">
 <topic>Firefox -- Sandbox escape due to integer overflow</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.3,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1987246 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1987246">
	 Sandbox escape due to integer overflow in the Graphics:
	 Canvas2D component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11152</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-11152</url>
 </references>
 <dates>
 <discovery>2025-09-30</discovery>
 <entry>2025-11-02</entry>
 </dates>
 </vuln>

<vuln vid="ea017037-b808-11f0-8016-b42e991fc52e">
 <topic>Firefox -- Information disclosure in the Networking: Cache component</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.3.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>143.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1981502 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1981502">
	 Information disclosure in the Networking: Cache
	 component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10536</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-10536</url>
 </references>
 <dates>
 <discovery>2025-09-16</discovery>
 <entry>2025-11-02</entry>
 </dates>
 </vuln>

<vuln vid="d09efc3b-b808-11f0-8016-b42e991fc52e">
 <topic>Firefox -- Spoofing issue in the Site Permissions component</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>143.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1665334 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1665334">
	 Spoofing issue in the Site Permissions component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10534</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-10534</url>
 </references>
 <dates>
 <discovery>2025-09-16</discovery>
 <entry>2025-11-02</entry>
 </dates>
 </vuln>

<vuln vid="c80baae7-b808-11f0-8016-b42e991fc52e">
 <topic>Firefox -- Integer overflow in the SVG component</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.3.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>143.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1980788 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1980788">
	 Integer overflow in the SVG component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10533</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-10533</url>
 </references>
 <dates>
 <discovery>2025-09-16</discovery>
 <entry>2025-11-02</entry>
 </dates>
 </vuln>

<vuln vid="af9c5b99-b808-11f0-8016-b42e991fc52e">
 <topic>Firefox -- Incorrect boundary conditions</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.3.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>143</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1979502 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1979502">
	 Incorrect boundary conditions in the JavaScript: GC
	 component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10532</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-10532</url>
 </references>
 <dates>
 <discovery>2025-09-16</discovery>
 <entry>2025-11-02</entry>
 </dates>
 </vuln>

<vuln vid="a4bebda9-b808-11f0-8016-b42e991fc52e">
 <topic>Firefox -- Mitigation bypass</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>143.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1978453 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1978453">
	 Mitigation bypass in the Web Compatibility: Tooling
	 component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10531</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-10531</url>
 </references>
 <dates>
 <discovery>2025-09-16</discovery>
 <entry>2025-11-02</entry>
 </dates>
 </vuln>

<vuln vid="944d968c-b808-11f0-8016-b42e991fc52e">
 <topic>Firefox -- Same-origin policy bypass</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.3.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>143.0.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>140.3.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1970490 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1970490">
	 Same-origin policy bypass in the Layout component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10529</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-10529</url>
 </references>
 <dates>
 <discovery>2025-09-16</discovery>
 <entry>2025-11-02</entry>
 </dates>
 </vuln>

<vuln vid="8b5f4eb3-b808-11f0-8016-b42e991fc52e">
 <topic>Firefox -- Sandbox escape due to undefined behavior</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.3.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>143.0.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>140.3.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1986185 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1986185">
	 Sandbox escape due to undefined behavior, invalid pointer
	 in the Graphics: Canvas2D component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10528</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-10528</url>
 </references>
 <dates>
 <discovery>2025-09-16</discovery>
 <entry>2025-11-02</entry>
 </dates>
 </vuln>

<vuln vid="82595339-b808-11f0-8016-b42e991fc52e">
 <topic>Firefox -- Sandbox escape due to use-after-free</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.3.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>143.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1984825 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1984825">
	 Sandbox escape due to use-after-free in the Graphics:
	 Canvas2D component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10527</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-10527</url>
 </references>
 <dates>
 <discovery>2025-09-16</discovery>
 <entry>2025-11-02</entry>
 </dates>
 </vuln>

<vuln vid="77a0f93a-b71e-11f0-8d86-d7789240c8c2">
 <topic>python 3.9 -- end of life, not receiving security support</topic>
 <affects>
 <package>
	<name>python39</name>
	<range><ge>3</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://devguide.python.org/versions/">
	 Unsupported versions: [...] End of life: 2025-10-31.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://devguide.python.org/versions/</url>
 </references>
 <dates>
 <discovery>2020-10-05</discovery>
 <entry>2025-11-01</entry>
 </dates>
 </vuln>

<vuln vid="c4fb21e4-b579-11f0-871c-6805ca2fa271">
 <topic>powerdns-recursor -- cache pollution</topic>
 <affects>
 <package>
	<name>powerdns_recursor</name>
	<range><lt>5.3.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://blog.powerdns.com/powerdns-security-advisory-2025-06-2025-10-22">
	 It has been brought to our attention that the Recursor does not
	 apply strict enough validation of received delegation information.
	 The malicious delegation information can be sent by an attacker
	 spoofing packets.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-59023</cvename>
 <cvename>CVE-2025-59024</cvename>
 <url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-06.html</url>
 </references>
 <dates>
 <discovery>2025-10-15</discovery>
 <entry>2025-10-30</entry>
 </dates>
 </vuln>

<vuln vid="7c09fcb7-b5d6-11f0-b3f7-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>142.0.7444.59</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>142.0.7444.59</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html">
	 This update includes 20 security fixes:
	 <ul>
	 <li>[447613211] High CVE-2025-12428: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2025-09-26</li>
	 <li>[450618029] High CVE-2025-12429: Inappropriate implementation in V8. Reported by Aorui Zhang on 2025-10-10</li>
	 <li>[442860743] High CVE-2025-12430: Object lifecycle issue in Media. Reported by round.about on 2025-09-04</li>
	 <li>[436887350] High CVE-2025-12431: Inappropriate implementation in Extensions. Reported by Alesandro Ortiz on 2025-08-06</li>
	 <li>[439522866] High CVE-2025-12432: Race in V8. Reported by Google Big Sleep on 2025-08-18</li>
	 <li>[449760249] High CVE-2025-12433: Inappropriate implementation in V8. Reported by Google Big Sleep on 2025-10-07</li>
	 <li>[452296415] High CVE-2025-12036: Inappropriate implementation in V8. Reported by Google Big Sleep on 2025-10-15</li>
	 <li>[337356054] Medium CVE-2025-12434: Race in Storage. Reported by Lijo A.T on 2024-04-27</li>
	 <li>[446463993] Medium CVE-2025-12435: Incorrect security UI in Omnibox. Reported by Hafiizh on 2025-09-21</li>
	 <li>[40054742] Medium CVE-2025-12436: Policy bypass in Extensions. Reported by Luan Herrera (@lbherrera_) on 2021-02-08</li>
	 <li>[446294487] Medium CVE-2025-12437: Use after free in PageInfo. Reported by Umar Farooq on 2025-09-20</li>
	 <li>[433027577] Medium CVE-2025-12438: Use after free in Ozone. Reported by Wei Yuan of MoyunSec VLab on 2025-07-20</li>
	 <li>[382234536] Medium CVE-2025-12439: Inappropriate implementation in App-Bound Encryption. Reported by Ari Novick on 2024-12-04</li>
	 <li>[430555440] Low CVE-2025-12440: Inappropriate implementation in Autofill. Reported by Khalil Zhani on 2025-07-09</li>
	 <li>[444049512] Medium CVE-2025-12441: Out of bounds read in V8. Reported by Google Big Sleep on 2025-09-10</li>
	 <li>[452071845] Medium CVE-2025-12443: Out of bounds read in WebXR. Reported by Aisle Research on 2025-10-15</li>
	 <li>[390571618] Low CVE-2025-12444: Incorrect security UI in Fullscreen UI. Reported by syrf on 2025-01-18</li>
	 <li>[428397712] Low CVE-2025-12445: Policy bypass in Extensions. Reported by Thomas Greiner on 2025-06-29</li>
	 <li>[444932667] Low CVE-2025-12446: Incorrect security UI in SplitView. Reported by Hafiizh on 2025-09-14</li>
	 <li>[442636157] Low CVE-2025-12447: Incorrect security UI in Omnibox. Reported by Khalil Zhani on 2025-09-03</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-12036</cvename>
 <cvename>CVE-2025-12428</cvename>
 <cvename>CVE-2025-12429</cvename>
 <cvename>CVE-2025-12430</cvename>
 <cvename>CVE-2025-12431</cvename>
 <cvename>CVE-2025-12432</cvename>
 <cvename>CVE-2025-12433</cvename>
 <cvename>CVE-2025-12434</cvename>
 <cvename>CVE-2025-12435</cvename>
 <cvename>CVE-2025-12436</cvename>
 <cvename>CVE-2025-12437</cvename>
 <cvename>CVE-2025-12438</cvename>
 <cvename>CVE-2025-12439</cvename>
 <cvename>CVE-2025-12440</cvename>
 <cvename>CVE-2025-12441</cvename>
 <cvename>CVE-2025-12443</cvename>
 <cvename>CVE-2025-12444</cvename>
 <cvename>CVE-2025-12445</cvename>
 <cvename>CVE-2025-12446</cvename>
 <cvename>CVE-2025-12447</cvename>
 <url>https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html</url>
 </references>
 <dates>
 <discovery>2025-10-29</discovery>
 <entry>2025-10-30</entry>
 </dates>
 </vuln>

<vuln vid="291773e6-b5b2-11f0-8f61-b42e991fc52e">
 <topic>Firefox -- use-after-free in the GPU or browser process</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>144.0.2,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://bugzilla.mozilla.org/show_bug.cgi?id=1993113 reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1993113">
	 Starting with Firefox 142, it was possible for a
	 compromised child process to trigger a use-after-free in the
	 GPU or browser process using WebGPU-related IPC calls.
	 This may have been usable to escape the child process
	 sandbox.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-12380</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-12380</url>
 </references>
 <dates>
 <discovery>2025-10-28</discovery>
 <entry>2025-10-30</entry>
 </dates>
 </vuln>

<vuln vid="237f4f57-b50f-11f0-ae9b-b42e991fc52e">
 <topic>Erlang - Absolute Path in Zip Module</topic>
 <affects>
	<package>
	 <name>erlang</name>
	 <range><ge>17.0</ge><lt>26.2.5.13,4</lt></range>
	</package>
	<package>
	 <name>erlang-runtime26</name>
	 <range><lt>26.2.5.13</lt></range>
	</package>
	<package>
	 <name>erlang-runtime27</name>
	 <range><lt>27.3.4.1</lt></range>
	</package>
	<package>
	 <name>erlang-runtime28</name>
	 <range><lt>28.0.1</lt></range>
	</package>
	</affects>
	<description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://github.com/erlang/otp/security/advisories/GHSA-9g37-pgj9-wrhc reports:
	<blockquote cite="https://github.com/erlang/otp/security/advisories/GHSA-9g37-pgj9-wrhc">
	 Improper Limitation of a Pathname to a Restricted
	 Directory ('Path Traversal') vulnerability in Erlang OTP
	(stdlib modules) allows Absolute Path Traversal, File Manipulation.
	This vulnerability is associated with program files lib/stdlib/src/zip.erl
	and program routines zip:unzip/1, zip:unzip/2, zip:extract/1,
	zip:extract/2unless the memory option is passed. This issue
	affects OTP from OTP 17.0 until OTP28.0.1, OTP27.3.4.1 and
	OTP26.2.5.13, corresponding to stdlib from 2.0 until 7.0.1,
	6.2.2.1 and 5.2.3.4.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4748</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-4748</url>
 </references>
 <dates>
 <discovery>2025-06-16</discovery>
 <entry>2025-10-29</entry>
 </dates>
 </vuln>

<vuln vid="55c4e822-b4e4-11f0-8438-001b217e4ee5">
 <topic>ISC KEA -- Invalid characters cause assert</topic>
 <affects>
 <package>
 <name>kea</name>
 <range><ge>3.0.1</ge><lt>3.0.2</lt></range>
 </package>
 <package>
 <name>kea-devel</name>
 <range><ge>3.1.1</ge><lt>3.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Internet Systems Consortium, Inc. reports:
 <blockquote cite="https://kb.isc.org/docs/cve-2025-11232">
 To trigger the issue, three configuration parameters
 must have specific settings: "hostname-char-set" must be
 left at the default setting, which is "[^A-Za-z0-9.-]";
 "hostname-char-replacement" must be empty (the default);
 and "ddns-qualifying-suffix" must NOT be empty (the default is empty).
 DDNS updates do not need to be enabled for this issue to manifest.
 A client that sends certain option content would then
 cause kea-dhcp4 to exit unexpectedly.
 This addresses CVE-2025-11232 [#4142, #4155].
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-11232</cvename>
 <url>https://kb.isc.org/docs/cve-2025-11232</url>
 </references>
 <dates>
 <discovery>2025-10-29</discovery>
 <entry>2025-10-29</entry>
 </dates>
 </vuln>

<vuln vid="c5889223-b4e1-11f0-ae9b-b42e991fc52e">
 <topic>SQLite &lt; 3.50.3 -- CWE-190 Integer Overflow or Wraparound in FTS5 module</topic>
 <affects>
 <package>
	<name>sqlite3</name>
	<range><ge>3.43.0,1</ge><lt>3.50.3,1</lt></range>
 </package>
 
 <package>
	<name>linux-c7-sqlite</name>
	<range><ge>3.43.0</ge><lt>3.50.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	https://github.com/google/security-research/security/advisories/GHSA-v2c8-vqqp-hv3g reports:
	<blockquote cite="https://github.com/google/security-research/security/advisories/GHSA-v2c8-vqqp-hv3g">
	 An integer overflow exists in the FTS5 https://sqlite.org/fts5.html
	 extension. It occurs when the size of an array of tombstone
	 pointers is calculated and truncated into a 32-bit integer.
	 A pointer to partially controlled data can then be written
	 out of bounds.
	</blockquote>
	The FreeBSD build enables the FTS5 extension by default.
	</body>
 </description>
 <references>
 <cvename>CVE-2025-7709</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-7709</url>
 </references>
 <dates>
 <discovery>2025-07-15</discovery>
 <entry>2025-10-29</entry>
 <modified>2025-11-07</modified>
 </dates>
 </vuln>

<vuln vid="3116b6f3-b433-11f0-82ac-901b0edee044">
 <topic>py-social-auth-app-django -- Unsafe account association</topic>
 <affects>
 <package>
 <name>py39-social-auth-app-django</name>
 <name>py310-social-auth-app-django</name>
 <name>py311-social-auth-app-django</name>
 <name>py312-social-auth-app-django</name>
 <range><lt>5.4.3_1</lt></range>
 </package>
 <package>
 <name>py310-dj51-social-auth-app-django</name>
 <name>py311-dj51-social-auth-app-django</name>
 <name>py312-dj51-social-auth-app-django</name>
 <range><lt>5.6.0</lt></range>
 </package>
 <package>
 <name>py310-dj52-social-auth-app-django</name>
 <name>py311-dj52-social-auth-app-django</name>
 <name>py312-dj52-social-auth-app-django</name>
 <range><lt>5.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michal Čihař reports:
	<blockquote cite="https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-wv4w-6qv2-qqfg">
	Upon authentication, the user could be associated by e-mail even if the
	associate_by_email pipeline was not included. This could lead to account
	compromise when a third-party authentication service does not validate
	provided e-mail addresses or doesn't require unique e-mail addresses.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-61783</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-61783</url>
 </references>
 <dates>
 <discovery>2025-10-09</discovery>
 <entry>2025-10-29</entry>
 </dates>
 </vuln>

<vuln vid="2cd61f76-b41b-11f0-bf21-b42e991fc52e">
 <topic>SQLite -- Integer Overflow vulnerability</topic>
 <affects>
 <package>
	<name>sqlite3</name>
	<range><lt>3.50.1,1</lt></range>
 </package>
 <package>
	<name>linux_base-rl9-9.6</name>
	<range><le>9.6_1</le></range>
 </package>
 <package>
	<name>linux-c7-sqlite</name>
	<range><lt>3.50.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	http://sqlite3.com reports:
	<blockquote cite="http://sqlite3.com">
	 Integer Overflow vulnerability in SQLite SQLite3 v.3.50.0
	 allows a remote attacker to cause a denial of service via
	 the setupLookaside function
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-52099</cvename>
 <url>https://cveawg.mitre.org/api/cve/CVE-2025-52099</url>
 </references>
 <dates>
 <discovery>2025-10-24</discovery>
 <entry>2025-10-28</entry>
 </dates>
 </vuln>

<vuln vid="a8dacd4b-b416-11f0-9f23-ecf4bbefc954">
 <topic>privatebin - Missing HTML sanitisation of attached filename in file size hint enabling persistent XSS</topic>
 <affects>
 <package>
 <name>privatebin</name>
 <range><lt>2.0.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PrivateBin reports:
	<blockquote cite="https://privatebin.info/reports/vulnerability-2025-10-28.html">
	 We've identified an HTML injection/XSS vulnerability in the PrivateBin
	 service that allows the injection of arbitrary HTML markup via the attached
	 filename.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-62796</cvename>
 <url>https://www.cve.org/CVERecord?id=CVE-2025-62796</url>
 </references>
 <dates>
 <discovery>2025-10-23</discovery>
 <entry>2025-10-28</entry>
 </dates>
 </vuln>

<vuln vid="1f1cf967-b35c-11f0-bce7-bc2411002f50">
 <topic>strongSwan -- Heap-based buffer overflow in eap-mschapv2 plugin due to improper handling of failure request packets</topic>
 <affects>
 <package>
 <name>strongswan</name>
 <range><ge>4.2.12</ge><lt>6.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Xu Biang reports:
 <blockquote cite="https://www.strongswan.org/blog/2025/10/27/strongswan-vulnerability-(cve-2025-62291).html">
 The eap-mschapv2 plugin doesn't correctly check the length of an EAP-MSCHAPv2 Failure Request packet on the client,
 which can cause an integer underflow that leads to a crash and, depending on the compiler options, even a heap-based
 buffer overflow that's potentially exploitable for remote code execution. Affected are all strongSwan versions since 4.2.12.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-62291</cvename>
 <url>https://www.cve.org/CVERecord?id=CVE-2025-62291</url>
 </references>
 <dates>
 <discovery>2025-10-27</discovery>
 <entry>2025-10-27</entry>
 </dates>
 </vuln>

<vuln vid="823b4e48-b340-11f0-b3f7-a8a1599412c6">
 <topic>chromium -- security fix</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>141.0.7390.122</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>141.0.7390.122</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_21.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[452296415] High CVE-2025-12036: Inappropriate implementation in V8. Reported by Google Big Sleep on 2025-10-15</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-12036</cvename>
 <url>https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_21.html</url>
 </references>
 <dates>
 <discovery>2025-10-21</discovery>
 <entry>2025-10-27</entry>
 </dates>
 </vuln>

<vuln vid="ea1c485f-b025-11f0-bce7-bc2411002f50">
 <topic>unbound -- Possible domain hijacking via promiscuous records in the authority section</topic>
 <affects>
 <package>
 <name>unbound</name>
 <range><lt>1.24.1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.3</ge><lt>14.3_6</lt></range>
	<range><ge>13.5</ge><lt>13.5_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 sep@nlnetlabs.nl reports:
 <blockquote cite="https://www.nlnetlabs.nl/downloads/unbound/CVE-2025-11411.txt">
 NLnet Labs Unbound up to and including version 1.24.0 is vulnerable
 to possible domain hijack attacks. Promiscuous NS RRSets that
 complement positive DNS replies in the authority section can be
 used to trick resolvers to update their delegation information for
 the zone. Usually these RRSets are used to update the resolver's
 knowledge of the zone's name servers. A malicious actor can
 exploit the possible poisonous effect by injecting NS RRSets (and
 possibly their respective address records) in a reply. This could
 be done for example by trying to spoof a packet or fragmentation
 attacks. Unbound would then proceed to update the NS RRSet data
 it already has since the new data has enough trust for it, i.e.,
 in-zone data for the delegation point. Unbound 1.24.1 includes a
 fix that scrubs unsolicited NS RRSets (and their respective address
 records) from replies mitigating the possible poison effect.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-11411</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-11411</url>
 <freebsdsa>SA-25:10.unbound</freebsdsa>
 </references>
 <dates>
 <discovery>2025-10-22</discovery>
 <entry>2025-10-23</entry>
 <modified>2025-11-27</modified>
 </dates>
 </vuln>

<vuln vid="269c2de7-afaa-11f0-b4c8-792b26d8a051">
 <topic>RT -- XSS via calendar invitations</topic>
 <affects>
 <package>
 <name>rt60</name>
 <name>rt50</name>
 <range><ge>6.0.0</ge><lt>6.0.2</lt></range>
 <range><ge>5.0.4</ge><lt>5.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Mateusz Szymaniec and CERT Polska Reports:
 <blockquote cite="https://github.com/bestpractical/rt/releases/tag/rt-6.0.2">
 RT is vulnerable to XSS via calendar invitations added to a
 ticket. Thanks to Mateusz Szymaniec and CERT Polska for
 reporting this finding.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-9158</cvename>
 <url>https://github.com/bestpractical/rt/releases/tag/rt-6.0.2</url>
 </references>
 <dates>
 <discovery>2025-10-23</discovery>
 <entry>2025-10-23</entry>
 </dates>
 </vuln>

<vuln vid="b374df95-afa8-11f0-b4c8-792b26d8a051">
 <topic>RT -- CSV injection</topic>
 <affects>
 <package>
 <name>rt60</name>
 <name>rt50</name>
 <name>rt44</name>
 <range><ge>6.0.0</ge><lt>6.0.2</lt></range>
 <range><ge>5.0.0</ge><lt>5.0.9</lt></range>
 <range><ge>4.4.0</ge><lt>4.4.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Gareth Watkin-Jones from 4armed reports:
 <blockquote cite="https://github.com/bestpractical/rt/releases/tag/rt-6.0.2">
 RT is vulnerable to CSV injection via ticket values with
 special characters that are exported to a TSV from search
 results. Thanks to Gareth Watkin-Jones from 4armed for
 reporting this finding.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-61873</cvename>
 <url>https://github.com/bestpractical/rt/releases/tag/rt-6.0.2</url>
 </references>
 <dates>
 <discovery>2025-10-23</discovery>
 <entry>2025-10-23</entry>
 </dates>
 </vuln>

<vuln vid="114cc98b-afad-11f0-af12-bc241121aa0a">
 <topic>FreeBSD -- SO_REUSEPORT_LB breaks connect(2) for UDP sockets</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.3</ge><lt>14.3_5</lt></range>
	<range><ge>13.5</ge><lt>13.5_6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Connected sockets are not intended to belong to load-balancing
	groups. However, the kernel failed to check the connection state
	of sockets when adding them to load-balancing groups. Furthermore,
	when looking up the destination socket for an incoming packet, the
	kernel will match a socket belonging to a load-balancing group even
	if it is connected.
	Connected sockets are only supposed to receive packets originating
	from the connected host. The above behavior violates this contract.
	<h1>Impact:</h1>
	Software which sets SO_REUSEPORT_LB on a socket and then connects
	it to a host will not observe any problems. However, due to its
	membership in a load-balancing group, that socket will receive
	packets originating from any host. This breaks the contract of the
	connect(2) and implied connect via sendto(2), and may leave the
	application vulnerable to spoofing attacks.
 </body>
 </description>
 <references>
 <cvename>CVE-2025-24934</cvename>
 <freebsdsa>SA-25:09.netinet</freebsdsa>
 </references>
 <dates>
 <discovery>2025-10-22</discovery>
 <entry>2025-10-23</entry>
 </dates>
 </vuln>

<vuln vid="f741ea93-af61-11f0-98b5-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.5.0</ge><lt>18.5.1</lt></range>
	<range><ge>18.4.0</ge><lt>18.4.3</lt></range>
	<range><ge>10.6.0</ge><lt>18.3.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/">
	 Improper access control issue in runner API impacts GitLab EE
	 Denial of service issue in event collection impacts GitLab CE/EE
	 Denial of service issue in JSON validation impacts GitLab CE/EE
	 Denial of service issue in upload impacts GitLab CE/EE
	 Incorrect Authorization issue in pipeline builds impacts GitLab CE
	 Business logic error issue in group memberships impacts GitLab EE
	 Missing authorization issue in quick actions impacts GitLab EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11702</cvename>
 <cvename>CVE-2025-10497</cvename>
 <cvename>CVE-2025-11447</cvename>
 <cvename>CVE-2025-11974</cvename>
 <cvename>CVE-2025-11971</cvename>
 <cvename>CVE-2025-6601</cvename>
 <cvename>CVE-2025-11989</cvename>
 <url>https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/</url>
 </references>
 <dates>
 <discovery>2025-10-22</discovery>
 <entry>2025-10-22</entry>
 </dates>
 </vuln>

<vuln vid="88f34edb-ae9b-11f0-b3f7-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>141.0.7390.107</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>141.0.7390.107</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_14.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[447192722] High CVE-2025-11756: Use after free in Safe Browsing. Reported by asnine on 2025-09-25</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-11756</cvename>
 <url>https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_14.html</url>
 </references>
 <dates>
 <discovery>2025-10-14</discovery>
 <entry>2025-10-21</entry>
 </dates>
 </vuln>

<vuln vid="60ddafd2-ae9e-11f0-b3f7-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>141.0.7390.65</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>141.0.7390.65</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[443196747] High CVE-2025-11458: Heap buffer overflow in Sync. Reported by raven at KunLun lab on 2025-09-05</li>
	 <li>[446722008] High CVE-2025-11460: Use after free in Storage. Reported by Sombra on 2025-09-23</li>
	 <li>[441917796] Medium CVE-2025-11211: Out of bounds read in WebCodecs. Reported by Jakob Košir on 2025-08-29</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-11458</cvename>
 <cvename>CVE-2025-11460</cvename>
 <cvename>CVE-2025-11211</cvename>
 <url>https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2025-10-07</discovery>
 <entry>2025-10-21</entry>
 </dates>
 </vuln>

<vuln vid="cdf2abf7-ae83-11f0-b5fb-b42e991fc52e">
 <topic>Mongodb -- Use-after-free in the MongoDB</topic>
 <affects>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.25</lt></range>
 </package>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.15</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@mongodb.com reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-105873">
	 An authorized user may crash the MongoDB server by
	 causing buffer over-read. This can be done by issuing a DDL
	 operation while queries are being issued, under some
	 conditions.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11979</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-11979</url>
 </references>
 <dates>
 <discovery>2025-10-20</discovery>
 <entry>2025-10-21</entry>
 </dates>
 </vuln>

<vuln vid="4553e4b3-addf-11f0-9b8d-40a6b7c3b3b8">
 <topic>Hidden/Protected custom variables are prone to filter enumeration</topic>
 <affects>
 <package>
	<name>icingaweb2-module-icingadb-php81</name>
	<range><lt>1.1.4</lt></range>
	<range><ge>1.2</ge><lt>1.2.3,1</lt></range>
 </package>
 <package>
	<name>icingaweb2-module-icingadb-php82</name>
	<range><lt>1.1.4</lt></range>
	<range><ge>1.2</ge><lt>1.2.3,1</lt></range>
 </package>
 <package>
	<name>icingaweb2-module-icingadb-php83</name>
	<range><lt>1.1.4</lt></range>
	<range><ge>1.2</ge><lt>1.2.3,1</lt></range>
 </package>
 <package>
	<name>icingaweb2-module-icingadb-php84</name>
	<range><lt>1.1.4</lt></range>
	<range><ge>1.2</ge><lt>1.2.3,1</lt></range>
 </package>
 <package>
	<name>icingaweb2-module-icingadb-php85</name>
	<range><lt>1.1.4</lt></range>
	<range><ge>1.2</ge><lt>1.2.3,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Icinga reports:
	<blockquote cite="https://github.com/Icinga/icingadb-web/security/advisories/GHSA-w57j-28jc-8429">
	 An authorized user with access to Icinga DB Web, can use
	 a custom variable in a filter that is either protected by
	 icingadb/protect/variables or hidden by icingadb/denylist/variables,
	 to guess values assigned to it.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-61789</cvename>
 <url>https://github.com/Icinga/icingadb-web/security/advisories/GHSA-w57j-28jc-8429</url>
 </references>
 <dates>
 <discovery>2025-10-16</discovery>
 <entry>2025-10-20</entry>
 </dates>
 </vuln>

<vuln vid="4355ce42-ad06-11f0-b2aa-b42e991fc52e">
 <topic>Mozilla -- XSS in sites without content-type header</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>144.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.4.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>144.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1979536">
	 A malicious page could have used the type attribute of an OBJECT
	tag to override the default browser behavior when encountering a
	web resource served without a content-type. This could have
	contributed to an XSS on a site that unsafely serves files without
	a content-type header.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11712</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-11712</url>
 </references>
 <dates>
 <discovery>2025-10-14</discovery>
 <entry>2025-10-19</entry>
 </dates>
 </vuln>

<vuln vid="fff839db-ad04-11f0-b2aa-b42e991fc52e">
 <topic>Mozilla -- JavaScript Object property overriding</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>144.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.4.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>144.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1989978">
	 There was a way to change the value of JavaScript Object
	 properties that were supposed to be non-writeable.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11711</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-11711</url>
 </references>
 <dates>
 <discovery>2025-10-14</discovery>
 <entry>2025-10-19</entry>
 </dates>
 </vuln>

<vuln vid="f7047dfc-ad02-11f0-b2aa-b42e991fc52e">
 <topic>Mozilla -- Memory disclosure</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>144.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.4.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>144.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1989899">
	 A compromised web process using malicious IPC messages
	 could have caused the privileged browser process to reveal
	 blocks of its memory to the compromised process.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11710</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-11710</url>
 </references>
 <dates>
 <discovery>2025-10-14</discovery>
 <entry>2025-10-19</entry>
 </dates>
 </vuln>

<vuln vid="b760c618-ad02-11f0-b2aa-b42e991fc52e">
 <topic>Mozilla -- Out-of-bounds reads and writes</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>144.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.4.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>144.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1989127">
	 A compromised web process was able to trigger out of
	 bounds reads and writes in a more privileged process using
	 manipulated WebGL textures.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11709</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-11709</url>
 </references>
 <dates>
 <discovery>2025-10-14</discovery>
 <entry>2025-10-19</entry>
 </dates>
 </vuln>

<vuln vid="85c17eb8-ad02-11f0-b2aa-b42e991fc52e">
 <topic>Mozilla -- Use-after-free</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>144.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.4.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>144.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1988931">
	 Use-after-free in MediaTrackGraphImpl::GetInstance()
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11708</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-11708</url>
 </references>
 <dates>
 <discovery>2025-10-14</discovery>
 <entry>2025-10-19</entry>
 </dates>
 </vuln>

<vuln vid="247bc43f-ad02-11f0-b2aa-b42e991fc52e">
 <topic>Mozilla -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>144.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.4</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>144.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1973699%2C1989945%2C1990970%2C1991040%2C1992113">
	 Memory safety bugs. Some of these bugs showed evidence of
	 memory corruption and we presume that with enough effort
	 some of these could have been exploited to run arbitrary
	 code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11714</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-11714</url>
 </references>
 <dates>
 <discovery>2025-10-14</discovery>
 <entry>2025-10-19</entry>
 </dates>
 </vuln>

<vuln vid="20840621-ab82-11f0-b961-b42e991fc52e">
 <topic>Mozilla -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>144.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.4.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>140.4.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1983838%2C1987624%2C1988244%2C1988912%2C1989734%2C1990085%2C1991899">
	 Memory safety bugs. Some of these bugs showed evidence of
	 memory corruption and we presume that with enough effort
	 some of these could have been exploited to run arbitrary
	 code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11715</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-11715</url>
 </references>
 <dates>
 <discovery>2025-10-14</discovery>
 <entry>2025-10-17</entry>
 </dates>
 </vuln>

<vuln vid="ed132d42-ab81-11f0-b961-b42e991fc52e">
 <topic>Mozilla -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>144.0.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>144.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1986816">
	 Memory safety bug. This bug showed evidence of memory
	 corruption and we presume that with enough effort this could
	 have been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11721</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-11721</url>
 </references>
 <dates>
 <discovery>2025-10-14</discovery>
 <entry>2025-10-17</entry>
 </dates>
 </vuln>

<vuln vid="f3550d26-ab7d-11f0-b961-b42e991fc52e">
 <topic>Firefox -- Sandbox escape</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.3,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1987246">
	 Sandbox excape due to integer overflow in the Graphics:
	 Canvas2D component
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11152</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-11152</url>
 </references>
 <dates>
 <discovery>2025-09-30</discovery>
 <entry>2025-10-17</entry>
 </dates>
 </vuln>

<vuln vid="7b9a8247-ab7b-11f0-b961-b42e991fc52e">
 <topic>Mozilla -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>142.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.2.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>142.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1938220%2C1980730%2C1981280%2C1981283%2C1984505%2C1985067">
	 Some of these bugs showed evidence of memory corruption
	 and we presume that with enough effort some of these could
	 have been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10537</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-10537</url>
 </references>
 <dates>
 <discovery>2025-09-16</discovery>
 <entry>2025-10-17</entry>
 </dates>
 </vuln>

<vuln vid="4fe6f98e-ab7b-11f0-b961-b42e991fc52e">
 <topic>Mozilla -- Information disclosure</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.3.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>143.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1981502">
	 This vulnerability affects Firefox &lt; 143, Firefox ESR &lt; 140.3,
	Thunderbird &lt; 143, and Thunderbird &lt; 140.3.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10536</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-10536</url>
 </references>
 <dates>
 <discovery>2025-09-16</discovery>
 <entry>2025-10-17</entry>
 </dates>
 </vuln>

<vuln vid="1e8a6581-ab7b-11f0-b961-b42e991fc52e">
 <topic>Mozilla -- spoofing</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>143.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1665334">
	 Spoofing issue in the Site Permission component
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10534</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-10534</url>
 </references>
 <dates>
 <discovery>2025-09-16</discovery>
 <entry>2025-10-17</entry>
 </dates>
 </vuln>

<vuln vid="c7383de4-ab7a-11f0-b961-b42e991fc52e">
 <topic>Mozilla -- integer overflow</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>115.28.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>143.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1980788">
	 Integer overflow in the SVG component
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10533</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-10533</url>
 </references>
 <dates>
 <discovery>2025-09-16</discovery>
 <entry>2025-10-17</entry>
 </dates>
 </vuln>

<vuln vid="511f5aac-ab46-11f0-9446-f02f7497ecda">
 <topic>minio -- Privilege Escalation via Session Policy Bypass in Service Accounts and STS</topic>
 <affects>
 <package>
	<name>minio</name>
	<range><lt>RELEASE.2025-10-15T17-29-55Z</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	mino reports:
 <blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-jjjj-jwhf-8rgr">
 A privilege escalation vulnerability allows service accounts and STS
 (Security Token Service) accounts with restricted session policies to
 bypass their inline policy restrictions when performing "own" account
 operations, specifically when creating new service accounts for the same
 user.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-62506</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-62506</url>
 </references>
 <dates>
 <discovery>2025-10-17</discovery>
 <entry>2025-10-17</entry>
 </dates>
 </vuln>

<vuln vid="50fd6a75-0587-4987-bef2-bb933cd78ea1">
 <topic>zeek -- information leak vulnerability</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>8.0.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="INSERT URL HERE">
	 The KRB analyzer can leak information about hosts in
	 analyzed traffic via external DNS lookups.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v8.0.2</url>
 </references>
 <dates>
 <discovery>2025-10-13</discovery>
 <entry>2025-10-13</entry>
 </dates>
 </vuln>

<vuln vid="6dd86212-a859-11f0-bd95-b42e991fc52e">
 <topic>Firefox -- JIT miscompilation in the JavaScript Engine</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.3,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1987481">
	 JIT miscompilation in the JavaScript Engine: JIT
	 component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11153</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-11153</url>
 </references>
 <dates>
 <discovery>2025-09-30</discovery>
 <entry>2025-10-13</entry>
 </dates>
 </vuln>

<vuln vid="87fdaf3c-a5b5-11f0-98b5-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.4.0</ge><lt>18.4.2</lt></range>
	<range><ge>18.3.0</ge><lt>18.3.4</lt></range>
	<range><ge>5.2.0</ge><lt>18.2.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released/">
	 Incorrect authorization issue in GraphQL mutations impacts GitLab EE
	 Denial of Service issue in GraphQL blob type impacts GitLab CE/EE
	 Missing authorization issue in manual jobs impacts GitLab CE/EE
	 Denial of Service issue in webhook endpoints impacts GitLab CE/EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-11340</cvename>
 <cvename>CVE-2025-10004</cvename>
 <cvename>CVE-2025-9825</cvename>
 <cvename>CVE-2025-2934</cvename>
 <url>https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released/</url>
 </references>
 <dates>
 <discovery>2025-10-08</discovery>
 <entry>2025-10-10</entry>
 </dates>
 </vuln>

<vuln vid="0b5145e9-a500-11f0-a136-10ffe07f9334">
 <topic>Mailpit -- Performance information disclosure</topic>
 <affects>
 <package>
	<name>mailpit</name>
	<range><lt>1.27.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Ralph Slooten (Mailpit developer) reports:
	<blockquote cite="https://github.com/axllent/mailpit/releases/tag/v1.27.10">
	 An HTTP endpoint was found which exposed expvar runtime
	 information (memory usage, goroutine counts, GC behavior,
	 uptime and potential runtime flags) due to the Prometheus
	 client library dependency.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/axllent/mailpit/releases/tag/v1.27.10</url>
 </references>
 <dates>
 <discovery>2025-10-09</discovery>
 <entry>2025-10-09</entry>
 </dates>
 </vuln>

<vuln vid="f60c790a-a394-11f0-9617-b42e991fc52e">
 <topic>Mozilla -- Incorrect boundary conditions</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.3</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>143.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1979502">
	 The vulnerability has been assessed to have moderate
	 impact on affected systems, potentially allowing attackers
	 to exploit incorrect boundary conditions in the JavaScript
	 Garbage Collection component. In Thunderbird specifically,
	 these flaws cannot be exploited through email as scripting
	 is disabled when reading mail, but remain potential risks in
	 browser or browser-like contexts 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10532</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-10532</url>
 </references>
 <dates>
 <discovery>2025-09-16</discovery>
 <entry>2025-10-07</entry>
 </dates>
 </vuln>

<vuln vid="a240c31b-a394-11f0-9617-b42e991fc52e">
 <topic>Mozilla -- mitigation bypass vulnerability</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>143.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1978453">
	 The vulnerability has been rated as having moderate
	 impact, affecting both confidentiality and integrity
	 with low severity, while having no impact on
	 availability. For Thunderbird specifically, the
	 vulnerability cannot be exploited through email as
	 scripting is disabled when reading mail, but remains a
	 potential risk in browser or browser-like contexts 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10531</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-10531</url>
 </references>
 <dates>
 <discovery>2025-09-16</discovery>
 <entry>2025-10-07</entry>
 </dates>
 </vuln>

<vuln vid="f2de2f64-a2cc-11f0-8402-b42e991fc52e">
 <topic>Mozilla -- Sandbox escape due to use-after-free</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>143.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.3.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>143.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1986185">
	 Sandbox escape due to use-after-free
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10527</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-10527</url>
 <cvename>CVE-2025-10528</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-10528</url>
 </references>
 <dates>
 <discovery>2025-09-16</discovery>
 <entry>2025-10-06</entry>
 </dates>
 </vuln>

<vuln vid="a5395e02-a2ca-11f0-8402-b42e991fc52e">
 <topic>mongodb -- Malformed $group Query May Cause MongoDB Server to Crash</topic>
 <affects>
 <package>
	<name>mongodb60</name>
	<range><lt>6.0.25</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.22</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@mongodb.com reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-99616">
	 An authorized user can cause a crash in the MongoDB Server through
	a specially crafted $group query. This vulnerability is related
	to the incorrect handling of certain accumulator functions when
	additional parameters are specified within the $group operation.
	This vulnerability could lead to denial of service if triggered
	repeatedly.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10061</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-10061</url>
 </references>
 <dates>
 <discovery>2025-09-05</discovery>
 <entry>2025-10-06</entry>
 <modified>2025-10-07</modified>
 </dates>
 </vuln>

<vuln vid="6d16b410-a2ca-11f0-8402-b42e991fc52e">
 <topic>mongodb -- MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation</topic>
 <affects>
 <package>
	<name>mongodb60</name>
	<range><lt>6.0.25</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.22</lt></range>
 </package>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.12</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@mongodb.com reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-95524">
	 MongoDB Server may allow upsert operations retried
	 within a transaction to violate unique index constraints,
	 potentially causing an invariant failure and server crash
	 during commit. This issue may be triggered by improper
	 WriteUnitOfWork state management.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10060</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-10060</url>
 </references>
 <dates>
 <discovery>2025-09-05</discovery>
 <entry>2025-10-06</entry>
 </dates>
 </vuln>

<vuln vid="4329e3bd-a2ca-11f0-8402-b42e991fc52e">
 <topic>mongodb -- MongoDB Server router will crash when incorrect lsid is set on a sharded query</topic>
 <affects>
 <package>
	<name>mongodb60</name>
	<range><lt>6.0.24</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.18</lt></range>
 </package>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@mongodb.com reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-100901">
	 An improper setting of the lsid field on any sharded query can cause
	a crash in MongoDB routers. This issue occurs when a generic
	argument (lsid) is provided in a case when it is not applicable.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10059</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-10059</url>
 </references>
 <dates>
 <discovery>2025-09-05</discovery>
 <entry>2025-10-06</entry>
 </dates>
 </vuln>

<vuln vid="a9dc3c61-a20f-11f0-91d8-b42e991fc52e">
 <topic>mongodb -- MongoDB Server access to non-initialized memory</topic>
 <affects>
 <package>
	<name>mongodb6</name>
	<range><lt>6.0.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@mongodb.com reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-71477">
	 MongoDB Server may access non-initialized region of
	 memory leading to unexpected behaviour when zero arguments
	 are called in internal aggregation stage.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-8654</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-8654</url>
 </references>
 <dates>
 <discovery>2024-09-10</discovery>
 <entry>2025-10-05</entry>
 </dates>
 </vuln>

<vuln vid="0af2f18e-a119-11f0-9446-f02f7497ecda">
 <topic>redis,valkey -- Out of bound read due to a bug in LUA</topic>
 <affects>
 <package>
	<name>redis</name>
 <range><ge>8.2.0</ge><lt>8.2.2</lt></range>
 </package>
 <package>
	<name>redis80</name>
 <range><ge>8.0.0</ge><lt>8.0.4</lt></range>
 </package>
 <package>
	<name>redis74</name>
 <range><ge>7.4.0</ge><lt>7.4.6</lt></range>
 </package>
 <package>
	<name>redis72</name>
 <range><ge>7.2.0</ge><lt>7.2.11</lt></range>
 </package>
 <package>
	<name>redis62</name>
 <range><ge>6.2.0</ge><lt>6.2.20</lt></range>
 </package>
 <package>
	<name>valkey</name>
 <range><lt>8.1.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	redis reports:
	<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-4c68-q8q8-3g4f">
	 
	 An authenticated user may use a specially crafted LUA script to read
	 out-of-bound data or crash the server and subsequent denial of
	 service.
	 The problem exists in all versions of Redis with Lua scripting
	 An additional workaround to mitigate the problem without patching
	 the redis-server executable is to prevent users from executing Lua
	 scripts. This can be done using ACL to block a script by restricting
	 both the EVAL and FUNCTION command families.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-46819</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-46819</url>
 </references>
 <dates>
 <discovery>2025-10-03</discovery>
 <entry>2025-10-04</entry>
 </dates>
 </vuln>

<vuln vid="0258d37d-a118-11f0-9446-f02f7497ecda">
 <topic>redis,valkey -- Running Lua function as a different user</topic>
 <affects>
 <package>
	<name>redis</name>
 <range><ge>8.2.0</ge><lt>8.2.2</lt></range>
 </package>
 <package>
	<name>redis80</name>
 <range><ge>8.0.0</ge><lt>8.0.4</lt></range>
 </package>
 <package>
	<name>redis74</name>
 <range><ge>7.4.0</ge><lt>7.4.6</lt></range>
 </package>
 <package>
	<name>redis72</name>
 <range><ge>7.2.0</ge><lt>7.2.11</lt></range>
 </package>
 <package>
	<name>redis62</name>
 <range><ge>6.2.0</ge><lt>6.2.20</lt></range>
 </package>
 <package>
	<name>valkey</name>
 <range><lt>8.1.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	redis reports:
 <blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp">
	 
	 An authenticated user may use a specially crafted Lua script to
	 manipulate different LUA objects and potentially run their own code
	 in the context of another user
	 The problem exists in all versions of Redis with Lua scripting.
	 An additional workaround to mitigate the problem without patching
	 the redis-server executable is to prevent users from executing Lua
	 scripts. This can be done using ACL to block a script by restricting
	 both the EVAL and FUNCTION command families.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-46818</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-46818</url>
 </references>
 <dates>
 <discovery>2025-10-03</discovery>
 <entry>2025-10-04</entry>
 </dates>
 </vuln>

<vuln vid="f6b8de04-a116-11f0-9446-f02f7497ecda">
 <topic>redis,valkey -- Lua library commands may lead to integer overflow and potential RCE</topic>
 <affects>
 <package>
	<name>redis</name>
 <range><ge>8.2.0</ge><lt>8.2.2</lt></range>
 </package>
 <package>
	<name>redis80</name>
 <range><ge>8.0.0</ge><lt>8.0.4</lt></range>
 </package>
 <package>
	<name>redis74</name>
 <range><ge>7.4.0</ge><lt>7.4.6</lt></range>
 </package>
 <package>
	<name>redis72</name>
 <range><ge>7.2.0</ge><lt>7.2.11</lt></range>
 </package>
 <package>
	<name>redis62</name>
 <range><ge>6.2.0</ge><lt>6.2.20</lt></range>
 </package>
 <package>
	<name>valkey</name>
 <range><lt>8.1.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	redis reports:
	<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-m8fj-85cg-7vhp">
	 
	 An authenticated user may use a specially crafted Lua script to
	 cause an integer overflow and potentially lead to remote code
	 execution
	 The problem exists in all versions of Redis with Lua scripting.
	 An additional workaround to mitigate the problem without patching
	 the redis-server executable is to prevent users from executing Lua
	 scripts. This can be done using ACL to block a script by restricting
	 both the EVAL and FUNCTION command families.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-46817</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-46817</url>
 </references>
 <dates>
 <discovery>2025-10-03</discovery>
 <entry>2025-10-04</entry>
 </dates>
 </vuln>

<vuln vid="17e85cae-a115-11f0-9446-f02f7497ecda">
 <topic>redis,valkey -- Lua Use-After-Free may lead to remote code execution</topic>
 <affects>
 <package>
	<name>redis</name>
 <range><ge>8.2.0</ge><lt>8.2.2</lt></range>
 </package>
 <package>
	<name>redis80</name>
 <range><ge>8.0.0</ge><lt>8.0.4</lt></range>
 </package>
 <package>
	<name>redis74</name>
 <range><ge>7.4.0</ge><lt>7.4.6</lt></range>
 </package>
 <package>
	<name>redis72</name>
 <range><ge>7.2.0</ge><lt>7.2.11</lt></range>
 </package>
 <package>
	<name>redis62</name>
 <range><ge>6.2.0</ge><lt>6.2.20</lt></range>
 </package>
 <package>
	<name>valkey</name>
 <range><lt>8.1.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	redis reports:
 <blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q">
 
	An authenticated user may use a specially crafted Lua script to
	manipulate the garbage collector, trigger a use-after-free and
	potentially lead to remote code execution.
	The problem exists in all versions of Redis with Lua scripting.
	An additional workaround to mitigate the problem without patching the
	redis-server executable is to prevent users from executing Lua scripts.
	This can be done using ACL to restrict EVAL and EVALSHA commands.
 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-49844</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-49844</url>
 </references>
 <dates>
 <discovery>2025-10-03</discovery>
 <entry>2025-10-04</entry>
 </dates>
 </vuln>

<vuln vid="c27c05a7-a0c8-11f0-8471-4ccc6adda413">
 <topic>qt6-webengine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>qt6-pdf</name>
	<name>qt6-webengine</name>
	<range><lt>6.9.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Qt qtwebengine-chromium repo reports:
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=130-based">
	 Backports for 9 security bugs in Chromium:
	 <ul>
	 <li>CVE-2025-9866: Determine whether to bypass redirect checks per request</li>
	 <li>CVE-2025-10200: Use after free in Serviceworker</li>
	 <li>CVE-2025-10201: Inappropriate implementation in Mojo</li>
	 <li>CVE-2025-10500: Use after free in Dawn</li>
	 <li>CVE-2025-10501: Use after free in WebRTC</li>
	 <li>CVE-2025-10502: Heap buffer overflow in ANGLE</li>
	 <li>CVE-2025-10890: Side-channel information leakage in V8 (1/2)</li>
	 <li>CVE-2025-10891: Integer overflow in V8</li>
	 <li>CVE-2025-10892: Integer overflow in V8</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-9866</cvename>
 <cvename>CVE-2025-10200</cvename>
 <cvename>CVE-2025-10201</cvename>
 <cvename>CVE-2025-10500</cvename>
 <cvename>CVE-2025-10501</cvename>
 <cvename>CVE-2025-10502</cvename>
 <cvename>CVE-2025-10890</cvename>
 <cvename>CVE-2025-10891</cvename>
 <cvename>CVE-2025-10892</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=130-based</url>
 </references>
 <dates>
 <discovery>2025-09-25</discovery>
 <entry>2025-10-04</entry>
 </dates>
 </vuln>

<vuln vid="21fba35e-a05f-11f0-a8b8-a1ef31191bc1">
 <topic>fetchmail -- potential crash when authenticating to SMTP server</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><ge>5.9.9</ge><lt>6.5.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="https://www.fetchmail.info/fetchmail-SA-2025-01.txt">
	 
	 fetchmail's SMTP client, when configured to authenticate, is
	 susceptible to a protocol violation where, when a trusted but
	 malicious or malfunctioning SMTP server responds to an
	 authentication request with a "334" code but without a following
	 blank on the line, it will attempt to start reading from memory
	 address 0x1 to parse the server's SASL challenge. This address is
	 constant and not under the attacker's control. This event will
	 usually cause a crash of fetchmail.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-61962</cvename>
 <url>https://www.fetchmail.info/fetchmail-SA-2025-01.txt</url>
 <url>https://gitlab.com/fetchmail/fetchmail/-/raw/legacy_6x/fetchmail-SA-2025-01.txt?ref_type=heads</url>
 <url>https://gitlab.com/fetchmail/fetchmail/-/commit/4c3cebfa4e659fb778ca2cae0ccb3f69201609a8</url>
 </references>
 <dates>
 <discovery>2025-10-02</discovery>
 <entry>2025-10-03</entry>
 <modified>2025-10-04</modified>
 </dates>
 </vuln>

<vuln vid="169a87de-a157-4558-9f97-a7395a9ae144">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>141.0.7390.54</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>141.0.7390.54</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html">
	 This update includes 21 security fixes:
	 <ul>
	 <li>[442444724] High CVE-2025-11205: Heap buffer overflow in WebGPU. Reported by Atte Kettunen of OUSPG on 2025-09-02</li>
	 <li>[444755026] High CVE-2025-11206: Heap buffer overflow in Video. Reported by Elias Hohl on 2025-09-12</li>
	 <li>[428189824] Medium CVE-2025-11207: Side-channel information leakage in Storage. Reported by Alesandro Ortiz on 2025-06-27</li>
	 <li>[397878997] Medium CVE-2025-11208: Inappropriate implementation in Media. Reported by Kevin Joensen on 2025-02-20</li>
	 <li>[438226517] Medium CVE-2025-11209: Inappropriate implementation in Omnibox. Reported by Hafiizh on 2025-08-13</li>
	 <li>[440523110] Medium CVE-2025-11210: Side-channel information leakage in Tab. Reported by Umar Farooq on 2025-08-22</li>
	 <li>[441917796] Medium CVE-2025-11211: Out of bounds read in Media. Reported by Kosir Jakob on 2025-08-29</li>
	 <li>[420734141] Medium CVE-2025-11212: Inappropriate implementation in Media. Reported by Ameen Basha M K on 2025-05-28</li>
	 <li>[443408317] Medium CVE-2025-11213: Inappropriate implementation in Omnibox. Reported by Hafiizh on 2025-09-06</li>
	 <li>[439758498] Medium CVE-2025-11215: Off by one error in V8. Reported by Google Big Sleep on 2025-08-19</li>
	 <li>[419721056] Low CVE-2025-11216: Inappropriate implementation in Storage. Reported by Farras Givari on 2025-05-23</li>
	 <li>[439772737] Low CVE-2025-11219: Use after free in V8. Reported by Google Big Sleep on 2025-08-19</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-11205</cvename>
 <cvename>CVE-2025-11206</cvename>
 <cvename>CVE-2025-11207</cvename>
 <cvename>CVE-2025-11208</cvename>
 <cvename>CVE-2025-11209</cvename>
 <cvename>CVE-2025-11210</cvename>
 <cvename>CVE-2025-11211</cvename>
 <cvename>CVE-2025-11212</cvename>
 <cvename>CVE-2025-11213</cvename>
 <cvename>CVE-2025-11215</cvename>
 <cvename>CVE-2025-11216</cvename>
 <cvename>CVE-2025-11219</cvename>
 <url>https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html</url>
 </references>
 <dates>
 <discovery>2025-09-30</discovery>
 <entry>2025-10-03</entry>
 </dates>
 </vuln>

<vuln vid="90fc859e-9fe4-11f0-9fa2-080027836e8b">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py39-django42</name>
	<name>py310-django42</name>
	<name>py311-django42</name>
	<range><lt>4.2.25</lt></range>
 </package>
 <package>
	<name>py310-django51</name>
	<name>py311-django51</name>
	<range><lt>5.1.13</lt></range>
 </package>
 <package>
	<name>py310-django52</name>
	<name>py311-django52</name>
	<range><lt>5.2.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Django reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2025/oct/01/security-releases/">
	 CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB.
	 CVE-2025-59682: Potential partial directory-traversal via archive.extract().
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-59681</cvename>
 <cvename>CVE-2025-59682</cvename>
 <url>https://www.djangoproject.com/weblog/2025/oct/01/security-releases/</url>
 </references>
 <dates>
 <discovery>2025-10-01</discovery>
 <entry>2025-10-02</entry>
 </dates>
 </vuln>

<vuln vid="cb570d6f-9ea9-11f0-9446-f02f7497ecda">
 <topic>py-mysql-connector-python -- Vulnerability in the MySQL Connectors product of Oracle MySQL</topic>
 <affects>
 <package>
	<name>py39-mysql-connector-python</name>
	<name>py310-mysql-connector-python</name>
	<name>py311-mysql-connector-python</name>
	<name>py312-mysql-connector-python</name>
	<range><lt>9.2.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
 <blockquote cite="https://www.oracle.com/security-alerts/cpujan2025.html">
 Vulnerability in the MySQL Connectors product of Oracle MySQL
 (component: Connector/Python). Supported versions that are affected are
 9.1.0 and prior. Easily exploitable vulnerability allows high privileged
 attacker with network access via multiple protocols to compromise MySQL
 Connectors. Successful attacks require human interaction from a person
 other than the attacker. Successful attacks of this vulnerability can
 result in unauthorized creation, deletion or modification access to
 critical data or all MySQL Connectors accessible data as well as
 unauthorized read access to a subset of MySQL Connectors accessible data
 and unauthorized ability to cause a hang or frequently repeatable crash
 (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 6.4
 (Confidentiality, Integrity and Availability impacts). CVSS Vector:
 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:H).
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-21548</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-21548</url>
 </references>
 <dates>
 <discovery>2025-01-21</discovery>
 <entry>2025-10-01</entry>
 </dates>
 </vuln>

<vuln vid="00e912c5-9e92-11f0-bc5f-8447094a420f">
 <topic>OpenSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>3.0.18,1</lt></range>
 </package>
 <package>
	<name>openssl32</name>
	<range><lt>3.2.6</lt></range>
 </package>
 <package>
	<name>openssl33</name>
	<range><lt>3.3.5</lt></range>
 </package>
 <package>
	<name>openssl33-quictls</name>
	<range><lt>3.3.5</lt></range>
 </package>
 <package>
	<name>openssl34</name>
	<range><lt>3.4.3</lt></range>
 </package>
 <package>
	<name>openssl35</name>
	<range><lt>3.5.4</lt></range>
 </package>
 <package>
	<name>openssl36</name>
	<range><lt>3.6.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports reports:
	<blockquote cite="https://openssl-library.org/news/secadv/20250930.txt">
	 Out-of-bounds read &amp; write in RFC 3211 KEK Unwrap
	 Timing side-channel in SM2 algorithm on 64-bit ARM
	 Fix Out-of-bounds read in HTTP client no_proxy handling
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-9230</cvename>
 <cvename>CVE-2025-9231</cvename>
 <cvename>CVE-2025-9232</cvename>
 <freebsdsa>SA-25:08.openssl</freebsdsa>
 <url>https://openssl-library.org/news/secadv/20250930.txt</url>
 </references>
 <dates>
 <discovery>2025-09-30</discovery>
 <entry>2025-10-01</entry>
 <modified>2025-10-03</modified>
 </dates>
 </vuln>

<vuln vid="699ef80f-9e91-11f0-bc5f-8447094a420f">
 <topic>LibreSSL -- overwrite and -read vulnerability</topic>
 <affects>
 <package>
	<name>libressl</name>
	<range><lt>4.1.1</lt></range>
 </package>
 <package>
	<name>libressl-devel</name>
	<range><lt>4.1.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The LibreSSL project reports:
	<blockquote cite="https://github.com/libressl/portable/releases/tag/v4.1.1">
	 An incorrect length check can result in a 4-byte overwrite and an 8-byte overread.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-9230</cvename>
 <url>https://github.com/libressl/portable/releases/tag/v4.1.1</url>
 </references>
 <dates>
 <discovery>2025-10-01</discovery>
 <entry>2025-10-01</entry>
 </dates>
 </vuln>

<vuln vid="4ccd6222-9c83-11f0-a337-b42e991fc52e">
 <topic>goldendict -- dangerous method exposed</topic>
 <affects>
 <package>
	<name>goldendict</name>
	<range><lt>1.5.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://github.com/goldendict/goldendict/releases">
	 GoldenDict 1.5.0 and 1.5.1 has an exposed dangerous
	 method that allows reading and modifying files when a user
	 adds a crafted dictionary and then searches for any term
	 included in that dictionary.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-53964</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-53964</url>
 </references>
 <dates>
 <discovery>2025-07-17</discovery>
 <entry>2025-09-28</entry>
 </dates>
 </vuln>

<vuln vid="3bf134f4-942d-11f0-95de-0800276af896">
 <topic>libudisks -- Udisks: out-of-bounds read in udisks daemon</topic>
 <affects>
 <package>
	<name>libudisks</name>
	<range><lt>2.10.2</lt></range>
	<range><ge>2.10.90</ge><lt>2.10.91</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	secalert@redhat.com reports:
	<blockquote cite="https://access.redhat.com/errata/RHSA-2025:15017">
	 A flaw was found in the Udisks daemon, where it allows unprivileged
	users to create loop devices using the D-BUS system. This is
	achieved via the loop device handler, which handles requests sent
	through the D-BUS interface. As two of the parameters of this
	handle, it receives the file descriptor list and index specifying
	the file where the loop device should be backed. The function
	itself validates the index value to ensure it isn't bigger
	than the maximum value allowed. However, it fails to validate the
	lower bound, allowing the index parameter to be a negative value.
	Under these circumstances, an attacker can cause the UDisks daemon
	to crash or perform a local privilege escalation by gaining access
	to files owned by privileged users.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8067</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8067</url>
 </references>
 <dates>
 <discovery>2025-08-28</discovery>
 <entry>2025-09-26</entry>
 </dates>
 </vuln>

<vuln vid="32bdeb94-9958-11f0-b6e2-6805ca2fa271">
 <topic>quiche -- Infinite loop triggered by connection ID retirement</topic>
 <affects>
 <package>
	<name>quiche</name>
	<range><lt>0.24.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Quiche Releases reports:
	<blockquote cite="https://github.com/cloudflare/quiche/releases/tag/0.24.5">
	 This update includes 1 security fix:
	 <ul>
	 <li>High CVE-2025-7054: Infinite loop triggered by connection ID retirement. Reported by Catena cyber on 2025-08-07.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-7054</cvename>
 <url>https://www.cve.org/CVERecord?id=CVE-2025-7054</url>
 </references>
 <dates>
 <discovery>2025-08-07</discovery>
 <entry>2025-09-26</entry>
 </dates>
 </vuln>

<vuln vid="7b0cbc73-9955-11f0-b6e2-6805ca2fa271">
 <topic>quiche -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>quiche</name>
	<range><lt>0.24.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Quiche Releases reports:
	<blockquote cite="https://github.com/cloudflare/quiche/releases/tag/0.24.4">
	 This update includes 2 security fixes:
	 <ul>
	 <li>Medium CVE-2025-4820: Incorrect congestion window growth by optimistic ACK. Reported by Louis Navarre on 2025-06-18.</li>
	 <li>High CVE-2025-4821: Incorrect congestion window growth by invalid ACK ranges. Reported by Louis Navarre on 2025-06-18.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4820</cvename>
 <cvename>CVE-2025-4821</cvename>
 <url>https://github.com/cloudflare/quiche/releases/tag/0.24.4</url>
 </references>
 <dates>
 <discovery>2025-06-18</discovery>
 <entry>2025-09-26</entry>
 </dates>
 </vuln>

<vuln vid="477fdc04-9aa2-11f0-961b-2cf05da270f3">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.4.0</ge><lt>18.4.1</lt></range>
	<range><ge>18.3.0</ge><lt>18.3.3</lt></range>
	<range><ge>11.10.0</ge><lt>18.2.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/09/25/patch-release-gitlab-18-4-1-released/">
	 Denial of Service issue when uploading specifically crafted JSON files impacts GitLab CE/EE
	 Denial of Service issue bypassing query complexity limits impacts GitLab CE/EE
	 Information disclosure issue in virtual registery configuration for low privileged users impacts GitLab CE/EE
	 Privilege Escalation issue from within the Developer role impacts GitLab EE
	 Denial of Service issue in GraphQL API via Unbounded Array Parameters impacts GitLab CE/EE
	 Improper Authorization issue for Project Maintainers when assigning roles impacts GitLab EE
	 Denial of Service issue in GraphQL API blobSearch impacts GitLab CE/EE
	 Incorrect ownership assignment via Move Issue drop-down impacts GitLab CE/EE
	 Denial of Service issue via string conversion methods impacts GitLab CE/EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10858</cvename>
 <cvename>CVE-2025-8014</cvename>
 <cvename>CVE-2025-9958</cvename>
 <cvename>CVE-2025-7691</cvename>
 <cvename>CVE-2025-10871</cvename>
 <cvename>CVE-2025-10867</cvename>
 <cvename>CVE-2025-5069</cvename>
 <cvename>CVE-2025-10868</cvename>
 <url>https://about.gitlab.com/releases/2025/09/25/patch-release-gitlab-18-4-1-released/</url>
 </references>
 <dates>
 <discovery>2025-09-25</discovery>
 <entry>2025-09-26</entry>
 </dates>
 </vuln>

<vuln vid="e5cf9f44-9a64-11f0-8241-93c889bb8de1">
 <topic>openvpn-devel -- script injection vulnerability from trusted but malicious server</topic>
 <affects>
 <package>
	<name>openvpn-devel</name>
	<range><ge>g20250629,1</ge><lt>g20250925,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gert Doering reports:
	<blockquote cite="https://github.com/OpenVPN/openvpn/commit/0fb5a00549be6b065f9a4d61940ee06786d9fa61">
	 Notable changes beta1 -&gt;
	 beta2 are: [...] add proper input sanitation to DNS strings to
	 prevent an attack coming from a trusted-but-malicous OpenVPN server
	 (CVE: 2025-10680, affects unixoid systems with --dns-updown scripts
	 and windows using the built-in powershell call)
	 
	</blockquote>
	Lev Stipakov writes:
	<blockquote cite="https://github.com/OpenVPN/openvpn/commit/3a66045b407321c9d1c096227db164df3955ab40">
	 On Linux (and similar platforms), those options are written to a tmp
	 file, which is later sourced by a script running as root. Since
	 options are controlled by the server, it is possible for a malicious
	 server to execute script injection attack [...].
	</blockquote>
	The original report is credited to Stanislav Fort &lt;disclosure@aisle.com&gt;.
	</body>
 </description>
 <references>
 <cvename>CVE-2025-10680</cvename>
 <url>https://github.com/OpenVPN/openvpn/commit/0fb5a00549be6b065f9a4d61940ee06786d9fa61</url>
 <url>https://github.com/OpenVPN/openvpn/commit/3a66045b407321c9d1c096227db164df3955ab40</url>
 </references>
 <dates>
 <discovery>2025-09-24</discovery>
 <entry>2025-09-25</entry>
 </dates>
 </vuln>

<vuln vid="c2253bff-9952-11f0-b6e2-6805ca2fa271">
 <topic>dnsdist -- Denial of service via crafted DoH exchange</topic>
 <affects>
 <package>
	<name>dnsdist</name>
	<range><lt>1.9.11</lt></range>
	<range><ge>2.0.0</ge><lt>2.0.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@open-xchange.com reports:
	<blockquote cite="https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2025-05.html">
	 In some circumstances, when DNSdist is configured to use the nghttp2
	 library to process incoming DNS over HTTPS queries, an attacker
	 might be able to cause a denial of service by crafting a DoH exchange
	 that triggers an unbounded I/O read loop, causing an unexpected
	 consumption of CPU resources. The offending code was introduced in
	 DNSdist 1.9.0-alpha1 so previous versions are not affected.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-30187</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-30187</url>
 </references>
 <dates>
 <discovery>2025-09-18</discovery>
 <entry>2025-09-24</entry>
 <modified>2025-09-26</modified>
 </dates>
 </vuln>

<vuln vid="57b54de1-85a5-439a-899e-75d19cbdff54">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>140.0.7339.207</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>140.0.7339.207</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_23.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[430336833] High CVE-2025-10890: Side-channel information leakage in V8. Reported by Mate Marjanović (SharpEdged) on 2025-07-09</li>
	 <li>[443765373] High CVE-2025-10891: Integer overflow in V8. Reported by Google Big Sleep on 2025-09-09</li>
	 <li>[444048019] High CVE-2025-10892: Integer overflow in V8. Reported by Google Big Sleep on 2025-09-10</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-10890</cvename>
 <cvename>CVE-2025-10891</cvename>
 <cvename>CVE-2025-10892</cvename>
 <url>https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_23.html</url>
 </references>
 <dates>
 <discovery>2025-09-23</discovery>
 <entry>2025-09-23</entry>
 </dates>
 </vuln>

<vuln vid="6904ba53-22ff-4478-bfae-059dc2eefee1">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>140.0.7339.185</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>140.0.7339.185</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[445380761] High CVE-2025-10585: Type Confusion in V8. Reported by Google Threat Analysis Group on 2025-09-16</li>
	 <li>[435875050] High CVE-2025-10500: Use after free in Dawn. Reported by Giunash (Gyujeong Jin) on 2025-08-03</li>
	 <li>[440737137] High CVE-2025-10501: Use after free in WebRTC. Reported by sherkito on 2025-08-23</li>
	 <li>[438038775] High CVE-2025-10502: Heap buffer overflow in ANGLE. Reported by Google Big Sleep on 2025-08-12</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-10585</cvename>
 <cvename>CVE-2025-10500</cvename>
 <cvename>CVE-2025-10501</cvename>
 <cvename>CVE-2025-10502</cvename>
 <url>https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html</url>
 </references>
 <dates>
 <discovery>2025-09-17</discovery>
 <entry>2025-09-22</entry>
 </dates>
 </vuln>

<vuln vid="b51a4121-9607-11f0-becf-00a098b42aeb">
 <topic>PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS</topic>
 <affects>
 <package>
	<name>pcre2</name>
	<range><eq>10.45</eq></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/PCRE2Project/pcre2/commit/a141712e5967d448c7ce13090ab530c8e3d82254">
	 The PCRE2 library is a set of C functions that implement regular
	expression pattern matching. In version 10.45, a heap-buffer-overflow
	read vulnerability exists in the PCRE2 regular expression matching
	engine, specifically within the handling of the (*scs:...) (Scan
	SubString) verb when combined with (*ACCEPT) in src/pcre2_match.c.
	This vulnerability may potentially lead to information disclosure
	if the out-of-bounds data read during the memcmp affects the final
	match result in a way observable by the attacker.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-58050</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-58050</url>
 </references>
 <dates>
 <discovery>2025-08-27</discovery>
 <entry>2025-09-20</entry>
 </dates>
 </vuln>

<vuln vid="744966b3-93d8-11f0-b8da-589cfc10a551">
 <topic>expat -- dynamic memory allocations issue</topic>
 <affects>
 <package>
	<name>expat2</name>
	<range><lt>2.7.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	expat security advisory:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2025-59375">
	 libexpat allows attackers to trigger large dynamic memory allocations
	 via a small document that is submitted for parsing.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-59375</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-59375</url>
 </references>
 <dates>
 <discovery>2025-09-17</discovery>
 <entry>2025-09-17</entry>
 </dates>
 </vuln>

<vuln vid="b9b668f0-96ec-4568-b618-2edea45d6933">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.528</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.516.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2025-09-17/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-3618 / CVE-2025-5115</h5>
	 HTTP/2 denial of service vulnerability in bundled Jetty
	 <h5>(Medium) SECURITY-3594 / CVE-2025-59474</h5>
	 Missing permission check allows obtaining agent names
	 <h5>(Medium) SECURITY-3625 / CVE-2025-59475</h5>
	 Missing permission check in authenticated users' profile menu
	 <h5>(Medium) SECURITY-3424 / CVE-2025-59476</h5>
	 Log message injection vulnerability
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5115</cvename>
 <cvename>CVE-2025-59474</cvename>
 <cvename>CVE-2025-59475</cvename>
 <cvename>CVE-2025-59476</cvename>
 <url>https://www.jenkins.io/security/advisory/2025-09-17/</url>
 </references>
 <dates>
 <discovery>2025-09-17</discovery>
 <entry>2025-09-17</entry>
 </dates>
 </vuln>

<vuln vid="f6ca7c47-9190-11f0-b8da-589cfc10a551">
 <topic>unit-java -- security vulnerability</topic>
 <affects>
 <package>
	<name>unit-java</name>
	<range><lt>1.34.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	F5 reports:
	<blockquote cite="https://my.f5.com/manage/s/article/K000149959">
	 When NGINX Unit with the Java Language Module is in use,
	 undisclosed requests can lead to an infinite loop and cause
	 an increase in CPU resource utilization.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1695</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1695</url>
 </references>
 <dates>
 <discovery>2025-09-14</discovery>
 <entry>2025-09-14</entry>
 </dates>
 </vuln>

<vuln vid="3aee6703-8ff6-11f0-b8da-589cfc10a551">
 <topic>cups -- security vulnerabilities</topic>
 <affects>
 <package>
	<name>cups</name>
	<range><lt>2.4.13</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	OpenPrinting reports:
	<blockquote cite="https://github.com/OpenPrinting/cups/security/advisories/GHSA-4c68-qgrh-rmmq">
	 When the AuthType is set to anything but Basic, if the request contains an
	 Authorization: Basic ... header, the password is not checked.
	</blockquote>
	<blockquote cite="https://github.com/OpenPrinting/cups/security/advisories/GHSA-7qx3-r744-6qv4">
	 An unsafe deserialization and validation of printer attributes, causes null
	 dereference in libcups library.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-58060</cvename>
 <cvename>CVE-2025-58364</cvename>
 <url>https://github.com/OpenPrinting/cups/security/advisories/GHSA-4c68-qgrh-rmmq</url>
 <url>https://github.com/OpenPrinting/cups/security/advisories/GHSA-7qx3-r744-6qv4</url>
 </references>
 <dates>
 <discovery>2025-09-11</discovery>
 <entry>2025-09-12</entry>
 <modified>2025-09-16</modified>
 </dates>
 </vuln>

<vuln vid="f50640fa-89a4-4795-a302-47b0dea8cee5">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>140.0.7339.127</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>140.0.7339.127</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_9.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[440454442] Critical CVE-2025-10200: Use after free in Serviceworker. Reported by Looben Yang on 2025-08-22</li>
	 <li>[439305148] High CVE-2025-10201: Inappropriate implementation in Mojo. Reported by Sahan Fernando &amp; Anon on 2025-08-18</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-10200</cvename>
 <cvename>CVE-2025-10201</cvename>
 <url>https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_9.html</url>
 </references>
 <dates>
 <discovery>2025-09-09</discovery>
 <entry>2025-09-11</entry>
 </dates>
 </vuln>

<vuln vid="602fc0fa-8ece-11f0-9d03-2cf05da270f3">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.3.0</ge><lt>18.3.2</lt></range>
	<range><ge>18.2.0</ge><lt>18.2.6</lt></range>
	<range><ge>7.8.0</ge><lt>18.1.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/">
	 Denial of Service issue in SAML Responses impacts GitLab CE/EE
	 Server-Side Request Forgery issue in Webhook custom header impacts GitLab CE/EE
	 Denial of Service issue in User-Controllable Fields impacts GitLab CE/EE
	 Denial of Service issue in endpoint file upload impacts GitLab CE/EE
	 Denial of Service issue in token listing operations impacts GitLab CE/EE
	 Information disclosure issue in runner endpoints impacts GitLab CE/EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-2256</cvename>
 <cvename>CVE-2025-6454</cvename>
 <cvename>CVE-2025-1250</cvename>
 <cvename>CVE-2025-7337</cvename>
 <cvename>CVE-2025-10094</cvename>
 <cvename>CVE-2025-6769</cvename>
 <url>https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/</url>
 </references>
 <dates>
 <discovery>2025-09-10</discovery>
 <entry>2025-09-11</entry>
 </dates>
 </vuln>

<vuln vid="bda50cf1-8bcf-11f0-b3f7-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>140.0.7339.80</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>140.0.7339.80</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html">
	 This update includes 6 security fixes:
	 <ul>
	 <li>[434513380] High CVE-2025-9864: Use after free in V8. Reported by Pavel Kuzmin of Yandex Security Team on 2025-07-28</li>
	 <li>[437147699] Medium CVE-2025-9865: Inappropriate implementation in Toolbar. Reported by Khalil Zhani on 2025-08-07</li>
	 <li>[379337758] Medium CVE-2025-9866: Inappropriate implementation in Extensions. Reported by NDevTK on 2024-11-16</li>
	 <li>[415496161] Medium CVE-2025-9867: Inappropriate implementation in Downloads. Reported by Farras Givari on 2025-05-04</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-9864</cvename>
 <cvename>CVE-2025-9865</cvename>
 <cvename>CVE-2025-9866</cvename>
 <cvename>CVE-2025-9867</cvename>
 <url>https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2025-09-02</discovery>
 <entry>2025-09-07</entry>
 </dates>
 </vuln>

<vuln vid="340dc4c1-895a-11f0-b6e5-4ccc6adda413">
 <topic>exiv2 -- Denial-of-service</topic>
 <affects>
 <package>
	<name>exiv2</name>
	<range><lt>0.28.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Kevin Backhouse reports:
	<blockquote cite="https://github.com/Exiv2/exiv2/security/advisories/GHSA-m54q-mm9w-fp6g">
	 A denial-of-service was found in Exiv2 version v0.28.5: a quadratic
	 algorithm in the ICC profile parsing code in jpegBase::readMetadata()
	 can cause Exiv2 to run for a long time. Exiv2 is a command-line utility
	 and C++ library for reading, writing, deleting, and modifying the
	 metadata of image files. The denial-of-service is triggered when Exiv2
	 is used to read the metadata of a crafted jpg image file.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-55304</cvename>
 <url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-m54q-mm9w-fp6g</url>
 </references>
 <dates>
 <discovery>2025-08-29</discovery>
 <entry>2025-09-04</entry>
 </dates>
 </vuln>

<vuln vid="84a77710-8958-11f0-b6e5-4ccc6adda413">
 <topic>exiv2 -- Out-of-bounds read in Exiv2::EpsImage::writeMetadata()</topic>
 <affects>
 <package>
	<name>exiv2</name>
	<range><lt>0.28.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Kevin Backhouse reports:
	<blockquote cite="https://github.com/Exiv2/exiv2/security/advisories/GHSA-496f-x7cq-cq39">
	 An out-of-bounds read was found in Exiv2 versions v0.28.5 and earlier.
	 Exiv2 is a command-line utility and C++ library for reading, writing,
	 deleting, and modifying the metadata of image files. The out-of-bounds
	 read is triggered when Exiv2 is used to write metadata into a crafted
	 image file. An attacker could potentially exploit the vulnerability to
	 cause a denial of service by crashing Exiv2, if they can trick the victim
	 into running Exiv2 on a crafted image file.
	 Note that this bug is only triggered when writing the metadata, which
	 is a less frequently used Exiv2 operation than reading the metadata. For
	 example, to trigger the bug in the Exiv2 command-line application, you
	 need to add an extra command-line argument such as delete.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-54080</cvename>
 <url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-496f-x7cq-cq39</url>
 </references>
 <dates>
 <discovery>2025-08-29</discovery>
 <entry>2025-09-04</entry>
 </dates>
 </vuln>

<vuln vid="0db8684f-8938-11f0-8325-bc2411f8eb0b">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py39-django42</name>
	<name>py310-django42</name>
	<name>py311-django42</name>
	<range><lt>4.2.24</lt></range>
 </package>
 <package>
	<name>py310-django51</name>
	<name>py311-django51</name>
	<range><lt>5.1.12</lt></range>
 </package>
 <package>
	<name>py310-django52</name>
	<name>py311-django52</name>
	<range><lt>5.2.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Django reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2025/sep/03/security-releases/">
	 CVE-2025-57833: Potential SQL injection in FilteredRelation column aliases.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-57833</cvename>
 <url>https://www.djangoproject.com/weblog/2025/sep/03/security-releases/</url>
 </references>
 <dates>
 <discovery>2025-09-01</discovery>
 <entry>2025-09-04</entry>
 </dates>
 </vuln>

<vuln vid="9f9b0b37-88fa-11f0-90a2-6cc21735f730">
 <topic>Shibboleth Service Provider -- SQL injection vulnerability in ODBC plugin</topic>
 <affects>
 <package>
	<name>shibboleth-sp</name>
	<range><lt>3.5.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Internet2 reports:
	<blockquote cite="https://shibboleth.net/community/advisories/secadv_20250903.txt">
	 The Shibboleth Service Provider includes a storage API usable
	 for a number of different use cases such as the session cache,
	 replay cache, and relay state management. An ODBC extension
	 plugin is provided with some distributions of the software
	 (notably on Windows).
	 A SQL injection vulnerability was identified in some of the
	 queries issued by the plugin, and this can be creatively
	 exploited through specially crafted inputs to exfiltrate
	 information stored in the database used by the SP.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://shibboleth.net/community/advisories/secadv_20250903.txt</url>
 </references>
 <dates>
 <discovery>2025-09-03</discovery>
 <entry>2025-09-03</entry>
 </dates>
 </vuln>

<vuln vid="aaa060af-88d6-11f0-a294-b0416f0c4c67">
 <topic>Vieb -- Remote Code Execution via Visiting Untrusted URLs</topic>
 <affects>
 <package>
	<name>linux-vieb</name>
	<range><lt>12.4.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Zhengyu Liu, Jianjia Yu, Jelmer van Arnhem report:
	<blockquote cite="https://github.com/Jelmerro/Vieb/security/advisories/GHSA-h2fq-667q-7gpm">
 We discovered a remote code execution (RCE) vulnerability in the latest
 release of the Vieb browser (v12.3.0). By luring a user to visit a
 malicious website, an attacker can achieve arbitrary code execution on the
 victim’s machine.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/Jelmerro/Vieb/security/advisories/GHSA-h2fq-667q-7gpm</url>
 </references>
 <dates>
 <discovery>2025-07-31</discovery>
 <entry>2025-09-03</entry>
 </dates>
 </vuln>

<vuln vid="d7b7e505-8486-11f0-9d03-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.3.0</ge><lt>18.3.1</lt></range>
	<range><ge>18.2.0</ge><lt>18.2.5</lt></range>
	<range><ge>8.15.0</ge><lt>18.1.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/08/27/patch-release-gitlab-18-3-1-released/">
	 Allocation of Resources Without Limits issue in import function impacts GitLab CE/EE
	 Missing authentication issue in GraphQL endpoint impacts GitLab CE/EE
	 Allocation of Resources Without Limits issue in GraphQL impacts GitLab CE/EE
	 Code injection issue in GitLab repositories impacts GitLab CE/EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3601</cvename>
 <cvename>CVE-2025-2246</cvename>
 <cvename>CVE-2025-4225</cvename>
 <cvename>CVE-2025-5101</cvename>
 <url>https://about.gitlab.com/releases/2025/08/27/patch-release-gitlab-18-3-1-released/</url>
 </references>
 <dates>
 <discovery>2025-08-27</discovery>
 <entry>2025-08-29</entry>
 </dates>
 </vuln>

<vuln vid="f727fe60-8389-11f0-8438-001b217e4ee5">
 <topic>ISC KEA -- kea-dhcp4 aborts if client sends a broadcast request with particular options</topic>
 <affects>
 <package>
	<name>kea</name>
	<range><ge>3.0.0</ge><lt>3.0.1</lt></range>
 </package>
 <package>
	<name>kea-devel</name>
	<range><ge>3.1.0</ge><lt>3.1.1</lt></range>
	<range><ge>2.7.1</ge><le>2.7.9</le></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Internet Systems Consortium, Inc. reports:
	<blockquote cite="https://kb.isc.org/docs/">
	We corrected an issue in `kea-dhcp4` that caused
	the server to abort if a client sent a broadcast request with particular
	options, and Kea failed to find an appropriate subnet for that client.
	This addresses CVE-2025-40779 [#4055, #4048].
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-40779</cvename>
 </references>
 <dates>
 <discovery>2025-08-27</discovery>
 <entry>2025-08-27</entry>
 </dates>
 </vuln>

<vuln vid="2a11aa1e-83c7-11f0-b6e5-4ccc6adda413">
 <topic>qt6-base -- DoS in QColorTransferGenericFunction</topic>
 <affects>
 <package>
	<name>qt6-base</name>
	<range><lt>6.9.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Andy Shaw reports:
	<blockquote cite="https://www.qt.io/blog/security-advisory-recently-reported-denial-of-service-issue-in-qcolortransfergenericfunction-impacts-qt">
	 When passing values outside of the expected range to QColorTransferGenericFunction
	 it can cause a denial of service, for example, this can happen when passing a
	 specifically crafted ICC profile to QColorSpace::fromICCProfile.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5992</cvename>
 <url>https://www.qt.io/blog/security-advisory-recently-reported-denial-of-service-issue-in-qcolortransfergenericfunction-impacts-qt</url>
 </references>
 <dates>
 <discovery>2025-07-11</discovery>
 <entry>2025-08-28</entry>
 </dates>
 </vuln>

<vuln vid="edf83c10-83b8-11f0-b6e5-4ccc6adda413">
 <topic>qt6-webengine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>qt6-pdf</name>
	<name>qt6-webengine</name>
	<range><lt>6.9.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Qt qtwebengine-chromium repo reports:
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=130-based">
	 Backports for 25 security bugs in Chromium:
	 <ul>
	 <li>CVE-2025-5063: Use after free in Compositing</li>
	 <li>CVE-2025-5064: Inappropriate implementation in Background Fetch</li>
	 <li>CVE-2025-5065: Inappropriate implementation in FileSystemAccess API</li>
	 <li>CVE-2025-5068: Use after free in Blink</li>
	 <li>CVE-2025-5280: Out of bounds write in V8</li>
	 <li>CVE-2025-5281: Inappropriate implementation in BFCache</li>
	 <li>CVE-2025-5283: Use after free in libvpx</li>
	 <li>CVE-2025-5419: Out of bounds read and write in V8</li>
	 <li>CVE-2025-6191: Integer overflow in V8</li>
	 <li>CVE-2025-6192: Use after free in Profiler</li>
	 <li>CVE-2025-6554: Type Confusion in V8</li>
	 <li>CVE-2025-6556: Insufficient policy enforcement in Loader</li>
	 <li>CVE-2025-6557: Insufficient data validation in DevTools</li>
	 <li>CVE-2025-6558: Incorrect validation of untrusted input in ANGLE and GPU</li>
	 <li>CVE-2025-7656: Integer overflow in V8</li>
	 <li>CVE-2025-7657: Use after free in WebRTC</li>
	 <li>CVE-2025-8010: Type Confusion in V8</li>
	 <li>CVE-2025-8576: Use after free in Extensions</li>
	 <li>CVE-2025-8578: Use after free in Cast</li>
	 <li>CVE-2025-8580: Inappropriate implementation in Filesystems</li>
	 <li>CVE-2025-8582: Insufficient validation of untrusted input in DOM</li>
	 <li>CVE-2025-8879: Heap buffer overflow in libaom</li>
	 <li>CVE-2025-8880: Race in V8</li>
	 <li>CVE-2025-8881: Inappropriate implementation in File Picker</li>
	 <li>CVE-2025-8901: Out of bounds write in ANGLE</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5063</cvename>
 <cvename>CVE-2025-5064</cvename>
 <cvename>CVE-2025-5065</cvename>
 <cvename>CVE-2025-5068</cvename>
 <cvename>CVE-2025-5280</cvename>
 <cvename>CVE-2025-5281</cvename>
 <cvename>CVE-2025-5283</cvename>
 <cvename>CVE-2025-5419</cvename>
 <cvename>CVE-2025-6191</cvename>
 <cvename>CVE-2025-6192</cvename>
 <cvename>CVE-2025-6554</cvename>
 <cvename>CVE-2025-6556</cvename>
 <cvename>CVE-2025-6557</cvename>
 <cvename>CVE-2025-6558</cvename>
 <cvename>CVE-2025-7656</cvename>
 <cvename>CVE-2025-7657</cvename>
 <cvename>CVE-2025-8010</cvename>
 <cvename>CVE-2025-8576</cvename>
 <cvename>CVE-2025-8578</cvename>
 <cvename>CVE-2025-8580</cvename>
 <cvename>CVE-2025-8582</cvename>
 <cvename>CVE-2025-8879</cvename>
 <cvename>CVE-2025-8880</cvename>
 <cvename>CVE-2025-8881</cvename>
 <cvename>CVE-2025-8901</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=130-based</url>
 </references>
 <dates>
 <discovery>2025-05-27</discovery>
 <entry>2025-08-28</entry>
 </dates>
 </vuln>

<vuln vid="6989312e-8366-11f0-9bc6-b42e991fc52e">
 <topic>SQLite -- application crash</topic>
 <affects>
 <package>
	<name>sqlite3</name>
	<range><lt>3.49.1,1</lt></range>
 </package>
 <package>
	<name>linux_base-rl9-9.6</name>
	<range><lt>9.6</lt></range>
 </package>
 <package>
	<name>linux-c7-sqlite</name>
	<range><lt>3.7.17_2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://gist.github.com/ylwango613/d3883fb9f6ba8a78086356779ce88248">
	 In SQLite 3.49.0 before 3.49.1, certain argument values
	 to sqlite3_db_config (in the C-language API) can cause a
	 denial of service (application crash). An sz*nBig
	 multiplication is not cast to a 64-bit integer, and
	 consequently some memory allocations may be incorrect.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-29088</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-29088</url>
 </references>
 <dates>
 <discovery>2025-04-10</discovery>
 <entry>2025-08-27</entry>
 </dates>
 </vuln>

<vuln vid="c323bab5-80dd-11f0-97c4-40b034429ecf">
 <topic>p5-Catalyst-Authentication-Credential-HTTP -- Insecure source of randomness</topic>
 <affects>
 <package>
	<name>p5-Catalyst-Authentication-Credential-HTTP</name>
	<range><lt>1.019</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	perl-catalyst project reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2025-40920">
	 Catalyst::Authentication::Credential::HTTP versions 1.018
	 and earlier for Perl generate nonces using
	 the Perl Data::UUID library. * Data::UUID does not use a
	 strong cryptographic source for generating
	 UUIDs.* Data::UUID returns v3 UUIDs, which are generated
	 from known information and are unsuitable for
	 security, as per RFC 9562. * The nonces should be generated
	 from a strong cryptographic source, as per RFC 7616.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-40920</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-40920</url>
 </references>
 <dates>
 <discovery>2025-08-11</discovery>
 <entry>2025-08-24</entry>
 </dates>
 </vuln>

<vuln vid="07335fb9-7eb1-11f0-ba14-b42e991fc52e">
 <topic>Mozilla -- memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>142,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>142</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1825621%2C1970079%2C1976736%2C1979072">
	 Memory safety bugs present in Firefox 141 and Thunderbird
	 141. Some of these bugs showed evidence of memory corruption
	 and we presume that with enough effort some of these could
	 have been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-9187</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-9187</url>
 </references>
 <dates>
 <discovery>2025-08-19</discovery>
 <entry>2025-08-21</entry>
 </dates>
 </vuln>

<vuln vid="feb359ef-7eb0-11f0-ba14-b42e991fc52e">
 <topic>Mozilla -- memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>142,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.14</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>140.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1970154%2C1976782%2C1977166">
	 Memory safety bugs present in Firefox ESR 115.26, Firefox
	 ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
	 Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141.
	 Some of these bugs showed evidence of memory corruption and
	 we presume that with enough effort some of these could have
	 been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-9184</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-9184</url>
 <cvename>CVE-2025-9185</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-9185</url>
 </references>
 <dates>
 <discovery>2025-08-19</discovery>
 <entry>2025-08-21</entry>
 </dates>
 </vuln>

<vuln vid="fa7fd6d4-7eb0-11f0-ba14-b42e991fc52e">
 <topic>Firefox -- Spoofing in the Address Bar</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>142,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1976102">
	 Spoofing issue in the Address Bar component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-9183</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-9183</url>
 </references>
 <dates>
 <discovery>2025-08-19</discovery>
 <entry>2025-08-21</entry>
 </dates>
 </vuln>

<vuln vid="f994cea5-7eb0-11f0-ba14-b42e991fc52e">
 <topic>Mozilla -- DoS in WebRender</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>142,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>142</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1975837">
	 'Denial-of-service due to out-of-memory in the
	 Graphics: WebRender component.'
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-9182</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-9182</url>
 </references>
 <dates>
 <discovery>2025-08-19</discovery>
 <entry>2025-08-21</entry>
 </dates>
 </vuln>

<vuln vid="f7e8e9a3-7eb0-11f0-ba14-b42e991fc52e">
 <topic>Mozilla -- Uninitialized memory</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>142,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>140.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1977130">
	 Uninitialized memory in the JavaScript Engine component.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-9181</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-9181</url>
 </references>
 <dates>
 <discovery>2025-08-19</discovery>
 <entry>2025-08-21</entry>
 </dates>
 </vuln>

<vuln vid="f6219d24-7eb0-11f0-ba14-b42e991fc52e">
 <topic>Mozilla -- Same-origin policy bypass</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>142,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>142</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1979782">
	 'Same-origin policy bypass in the Graphics: Canvas2D
	component.'
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-9180</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-9180</url>
 </references>
 <dates>
 <discovery>2025-08-19</discovery>
 <entry>2025-08-21</entry>
 </dates>
 </vuln>

<vuln vid="f42ee983-7eb0-11f0-ba14-b42e991fc52e">
 <topic>Mozilla -- memory corruption in GMP</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>142,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>140.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1979527">
	 An attacker was able to perform memory corruption in the GMP process
	which processes encrypted media. This process is also heavily
	sandboxed, but represents slightly different privileges from the
	content process.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-9179</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-9179</url>
 </references>
 <dates>
 <discovery>2025-08-19</discovery>
 <entry>2025-08-21</entry>
 </dates>
 </vuln>

<vuln vid="eb03714d-79f0-11f0-b4c1-ac5afc632ba3">
 <topic>nginx -- worker process memory disclosure</topic>
 <affects>
 <package>
	<name>nginx-devel</name>
	<range><lt>1.29.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	F5 reports:
	<blockquote cite="https://my.f5.com/manage/s/article/K000152786">
	 NGINX Open Source and NGINX Plus have a vulnerability in the
	 ngx_mail_smtp_module that might allow an unauthenticated attacker to
	 over-read NGINX SMTP authentication process memory; as a result, the
	 server side may leak arbitrary bytes sent in a request to the
	 authentication server. This issue happens during the NGINX SMTP
	 authentication process and requires the attacker to make preparations
	 against the target system to extract the leaked data. The issue
	 affects NGINX only if (1) it is built with the ngx_mail_smtp_module,
	 (2) the smtp_auth directive is configured with method "none,"
	 and (3) the authentication server returns the "Auth-Wait" response
	 header.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-53859</cvename>
 <url>https://www.cve.org/CVERecord?id=CVE-2025-53859</url>
 </references>
 <dates>
 <discovery>2025-08-13</discovery>
 <entry>2025-08-15</entry>
 </dates>
 </vuln>

<vuln vid="a60e73e0-7942-11f0-b3f7-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>139.0.7258.127</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>139.0.7258.127</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html">
	 This update includes 6 security fixes:
	 <ul>
	 <li>[432035817] High CVE-2025-8879: Heap buffer overflow in libaom. Reported by Anonymous on 2025-07-15</li>
	 <li>[433533359] High CVE-2025-8880: Race in V8. Reported by Seunghyun Lee (@0x10n) on 2025-07-23</li>
	 <li>[435139154] High CVE-2025-8901: Out of bounds write in ANGLE. Reported by Google Big Sleep on 2025-07-30</li>
	 <li>[433800617] Medium CVE-2025-8881: Inappropriate implementation in File Picker. Reported by Alesandro Ortiz on 2025-07-23</li>
	 <li>[435623339] Medium CVE-2025-8882: Use after free in Aura. Reported by Umar Farooq on 2025-08-01</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-8579</cvename>
 <cvename>CVE-2025-8580</cvename>
 <cvename>CVE-2025-8901</cvename>
 <cvename>CVE-2025-8881</cvename>
 <cvename>CVE-2025-8882</cvename>
 <url>https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html</url>
 </references>
 <dates>
 <discovery>2025-08-12</discovery>
 <entry>2025-08-14</entry>
 </dates>
 </vuln>

<vuln vid="fc048b51-7909-11f0-90a2-6cc21735f730">
 <topic>PostgreSQL -- vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql17-server</name>
	<range><lt>17.6</lt></range>
 </package>
 <package>
	<name>postgresql16-server</name>
	<range><lt>16.10</lt></range>
 </package>
 <package>
	<name>postgresql15-server</name>
	<range><lt>14.14</lt></range>
 </package>
 <package>
	<name>postgresql14-server</name>
	<range><lt>14.19</lt></range>
 </package>
 <package>
	<name>postgresql13-server</name>
	<range><lt>13.22</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/">
	 Tighten security checks in planner estimation functions.
	 Prevent pg_dump scripts from being used to attack the user running the restore.
	 Convert newlines to spaces in names included in comments in pg_dump output.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8713</cvename>
 <cvename>CVE-2025-8714</cvename>
 <cvename>CVE-2025-8715</cvename>
 <url>https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/</url>
 </references>
 <dates>
 <discovery>2025-08-11</discovery>
 <entry>2025-08-14</entry>
 </dates>
 </vuln>

<vuln vid="7bfe6f39-78be-11f0-9d03-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.2.0</ge><lt>18.2.2</lt></range>
	<range><ge>18.1.0</ge><lt>18.1.4</lt></range>
	<range><ge>8.14.0</ge><lt>18.0.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/08/13/patch-release-gitlab-18-2-2-released/">
	 Cross-site scripting issue in blob viewer impacts GitLab CE/EE
	 Cross-site scripting issue in labels impacts GitLab CE/EE
	 Cross-site scripting issue in Workitem impacts GitLab CE/EE
	 Improper Handling of Permissions issue in project API impacts GitLab CE/EE
	 Incorrect Privilege Assignment issue in delete issues operation impacts GitLab CE/EE
	 Allocation of Resources Without Limits issue in release name creation impacts GitLab CE/EE
	 Incorrect Authorization issue in jobs API impacts GitLab CE/EE
	 Authorization issue in Merge request approval policy impacts GitLab EE
	 Inefficient Regular Expression Complexity issue in wiki impacts GitLab CE/EE
	 Allocation of Resources Without Limits issue in Mattermost integration impacts GitLab CE/EE
	 Incorrect Permission Assignment issue in ID token impacts GitLab CE/EE
	 Insufficient Access Control issue in IP Restriction impacts GitLab EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-7734</cvename>
 <cvename>CVE-2025-7739</cvename>
 <cvename>CVE-2025-6186</cvename>
 <cvename>CVE-2025-8094</cvename>
 <cvename>CVE-2024-12303</cvename>
 <cvename>CVE-2025-2614</cvename>
 <cvename>CVE-2024-10219</cvename>
 <cvename>CVE-2025-8770</cvename>
 <cvename>CVE-2025-2937</cvename>
 <cvename>CVE-2025-1477</cvename>
 <cvename>CVE-2025-5819</cvename>
 <cvename>CVE-2025-2498</cvename>
 <url>https://about.gitlab.com/releases/2025/08/13/patch-release-gitlab-18-2-2-released/</url>
 </references>
 <dates>
 <discovery>2025-08-13</discovery>
 <entry>2025-08-14</entry>
 </dates>
 </vuln>

<vuln vid="e2d49973-785a-11f0-a1c0-0050569f0b83">
 <topic>www/varnish7 -- Denial of Service in HTTP/2</topic>
 <affects>
 <package>
	<name>varnish7</name>
	<range><lt>7.7.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Varnish Development Team reports:
	<blockquote cite="https://varnish-cache.org/security/VSV00017.html#vsv00017">
	 A denial of service attack can be performed on Varnish Cache servers
	 that have the HTTP/2 protocol turned on. An attacker can create a
	 large number of streams and immediately reset them without ever
	 reaching the maximum number of concurrent streams allowed for the
	 session, causing the Varnish server to consume unnecessary
	 resources processing requests for which the response will not be
	 delivered.
	 This attack is a variant of the HTTP/2 Rapid Reset Attack, which was
	 partially handled as VSV00013.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8671</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8671</url>
 </references>
 <dates>
 <discovery>2025-08-13</discovery>
 <entry>2025-08-13</entry>
 </dates>
 </vuln>

<vuln vid="defe9a20-781e-11f0-97c4-40b034429ecf">
 <topic>p5-Authen-SASL -- Insecure source of randomness</topic>
 <affects>
 <package>
	<name>p5-Authen-SASL</name>
	<range><lt>2.1900</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	p5-Authen-SASL project reports:
	<blockquote cite="https://github.com/advisories/GHSA-496q-8ph2-c4fj">
	 Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely.
	 The cnonce (client nonce) is generated from an MD5 hash of the PID, the epoch time and the built-in rand function.
	 The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header.
	 The built-in rand function is unsuitable for cryptographic usage.
	 According to RFC 2831, The cnonce-value is an opaque quoted string value provided by the client and used by both client and server
	 to avoid chosen plaintext attacks, and to provide mutual authentication. The security of the implementation depends on a good choice.
	 It is RECOMMENDED that it contain at least 64 bits of entropy.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-40918</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-40918</url>
 </references>
 <dates>
 <discovery>2025-07-16</discovery>
 <entry>2025-08-13</entry>
 </dates>
 </vuln>

<vuln vid="15fd1321-768a-11f0-b3f7-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>139.0.7258.66</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>139.0.7258.66</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html">
	 This update includes 12 security fixes:
	 <ul>
	 <li>[414760982] Medium CVE-2025-8576: Use after free in Extensions. Reported by asnine on 2025-04-30</li>
	 <li>[384050903] Medium CVE-2025-8577: Inappropriate implementation in Picture In Picture. Reported by Umar Farooq on 2024-12-14</li>
	 <li>[423387026] Medium CVE-2025-8578: Use after free in Cast. Reported by Fayez on 2025-06-09</li>
	 <li>[407791462] Low CVE-2025-8579: Inappropriate implementation in Gemini Live in Chrome. Reported by Alesandro Ortiz on 2025-04-02</li>
	 <li>[411544197] Low CVE-2025-8580: Inappropriate implementation in Filesystems. Reported by Huuuuu on 2025-04-18</li>
	 <li>[416942878] Low CVE-2025-8581: Inappropriate implementation in Extensions. Reported by Vincent Dragnea on 2025-05-11</li>
	 <li>[40089450] Low CVE-2025-8582: Insufficient validation of untrusted input in DOM. Reported by Anonymous on 2017-10-31</li>
	 <li>[373794472] Low CVE-2025-8583: Inappropriate implementation in Permissions. Reported by Shaheen Fazim on 2024-10-16</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-8576</cvename>
 <cvename>CVE-2025-8577</cvename>
 <cvename>CVE-2025-8578</cvename>
 <cvename>CVE-2025-8579</cvename>
 <cvename>CVE-2025-8580</cvename>
 <cvename>CVE-2025-8581</cvename>
 <cvename>CVE-2025-8582</cvename>
 <cvename>CVE-2025-8583</cvename>
 <url>https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2025-08-05</discovery>
 <entry>2025-08-11</entry>
 </dates>
 </vuln>

<vuln vid="fb08d146-752a-11f0-952c-8447094a420f">
 <topic>Apache httpd -- evaluation always true</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><ge>2.4.64</ge><lt>2.4.65</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="https://downloads.apache.org/httpd/CHANGES_2.4.65">
	 'RewriteCond expr' always evaluates to true in 2.4.64.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-54090</cvename>
 <url>https://downloads.apache.org/httpd/CHANGES_2.4.65</url>
 </references>
 <dates>
 <discovery>2025-07-23</discovery>
 <entry>2025-08-09</entry>
 </dates>
 </vuln>

<vuln vid="66f35fd9-73f5-11f0-8e0e-002590c1f29c">
 <topic>FreeBSD -- Integer overflow in libarchive leading to double free</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.3</ge><lt>14.3_2</lt></range>
	<range><ge>14.2</ge><lt>14.2_5</lt></range>
	<range><ge>13.5</ge><lt>13.5_3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	An integer overflow in the archive_read_format_rar_seek_data()
	function may lead to a double free problem.
	<h1>Impact:</h1>
	Exploiting a double free vulnerability can cause memory corruption.
	This in turn could enable a threat actor to execute arbitrary code.
	It might also result in denial of service.
 </body>
 </description>
 <references>
 <cvename>CVE-2025-5914</cvename>
 <freebsdsa>SA-25:07.libarchive</freebsdsa>
 </references>
 <dates>
 <discovery>2025-08-08</discovery>
 <entry>2025-08-08</entry>
 </dates>
 </vuln>

<vuln vid="b945ce3f-6f9b-11f0-bd96-b42e991fc52e">
 <topic>sqlite -- integer overflow</topic>
 <affects>
 <package>
	<name>sqlite3</name>
	<range><lt>3.49.1,1</lt></range>
 </package>
 <package>
	<name>linux-c7-sqlite</name>
	<range><lt>3.49.1</lt></range>
 </package>
 <package>
	<name>linux_base-rl9</name>
	<range><lt>3.49.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve-coordination@google.com reports:
	<blockquote cite="https://sqlite.org/src/info/498e3f1cf57f164f">
	 An integer overflow can be triggered in SQLites `concat_ws()`
	function. The resulting, truncated integer is then used to allocate
	a buffer. When SQLite then writes the resulting string to the
	buffer, it uses the original, untruncated size and thus a wild Heap
	Buffer overflow of size ~4GB can be triggered.	This can result in
	arbitrary code execution.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3277</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-3277</url>
 </references>
 <dates>
 <discovery>2025-04-14</discovery>
 <entry>2025-08-02</entry>
 </dates>
 </vuln>

<vuln vid="95480188-6ebc-11f0-8a78-bf201f293bce">
 <topic>navidrome -- transcoding permission bypass vulnerability</topic>
 <affects>
 <package>
	<name>navidrome</name>
	<range><lt>0.56.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Deluan Quintão reports:
	<blockquote cite="https://github.com/navidrome/navidrome/security/advisories/GHSA-f238-rggp-82m3">
	 A permission verification flaw in Navidrome allows any authenticated
	 regular user to bypass authorization checks and perform
	 administrator-only transcoding configuration operations, including
	 creating, modifying, and deleting transcoding settings.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-48948</cvename>
 <url>https://github.com/navidrome/navidrome/security/advisories/GHSA-f238-rggp-82m3</url>
 </references>
 <dates>
 <discovery>2025-05-29</discovery>
 <entry>2025-08-01</entry>
 </dates>
 </vuln>

<vuln vid="f51077bd-6dd7-11f0-9d62-b42e991fc52e">
 <topic>SQLite -- integer overflow in key info allocation</topic>
 <affects>
 <package>
	<name>sqlite3</name>
	<range><ge>3.39.2,1</ge><lt>3.41.2,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve-coordination@google.com reports:
	<blockquote cite="https://sqlite.org/forum/forumpost/16ce2bb7a639e29b">
	 An integer overflow in the sqlite3KeyInfoFromExprList function in
	SQLite versions 3.39.2 through 3.41.1 allows an attacker with the
	ability to execute arbitrary SQL statements to cause a denial of
	service or disclose sensitive information from process memory via
	a crafted SELECT statement with a large number of expressions in
	the ORDER BY clause.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-7458</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-7458</url>
 </references>
 <dates>
 <discovery>2025-07-29</discovery>
 <entry>2025-07-31</entry>
 <modified>2025-08-01</modified>
 </dates>
 </vuln>

<vuln vid="cd7f969e-6cb4-11f0-97c4-40b034429ecf">
 <topic>p5-Crypt-CBC -- Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)</topic>
 <affects>
 <package>
	<name>p5-Crypt-CBC</name>
	<range><lt>3.07</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Lib-Crypt-CBC project reports:
	<blockquote cite="https://perldoc.perl.org/functions/rand">
	 
	 Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default
	 source of entropy, which is not cryptographically secure, for cryptographic functions.
	 This issue affects operating systems where "/dev/urandom'" is unavailable.
	 In that case, Crypt::CBC will fallback to use the insecure rand() function.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-2814</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-2814</url>
 </references>
 <dates>
 <discovery>2025-04-12</discovery>
 <entry>2025-07-29</entry>
 </dates>
 </vuln>

<vuln vid="c37f29ba-6ae3-11f0-b4bf-ecf4bbefc954">
 <topic>viewvc -- Arbitrary server filesystem content</topic>
 <affects>
 <package>
	<name>viewvc</name>
	<range><ge>1.1.0</ge><le>1.1.30</le></range>
 </package>
 <package>
	<name>viewvc</name>
	<range><ge>1.2.0</ge><le>1.2.3</le></range>
 </package>
 <package>
	<name>viewvc-devel</name>
	<range><lt>1.3.0.20250316_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cmpilato reports:
	<blockquote cite="https://github.com/viewvc/viewvc/security/advisories/GHSA-rv3m-76rj-q397">
	 
	 The ViewVC standalone web server (standalone.py) is a script provided in the ViewVC
	 distribution for the purposes of quickly testing a ViewVC configuration. This script
	 can in particular configurations expose the contents of the host server's filesystem
	 though a directory traversal-style attack.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-54141</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-54141</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-25</entry>
 </dates>
 </vuln>

<vuln vid="eed1a411-699b-11f0-91fe-000c295725e4">
 <topic>rubygem-resolv -- Possible denial of service</topic>
 <affects>
 <package>
	<name>rubygem-resolv</name>
	<range><lt>0.6.2</lt></range>
 </package>
 <package>
	<name>ruby</name>
	<range><ge>3.2.0.p1,1</ge><lt>3.2.9,1</lt></range>
	<range><ge>3.3.0.p1,1</ge><lt>3.3.9,1</lt></range>
	<range><ge>3.4.0.p1,1</ge><lt>3.4.5,1</lt></range>
	<range><ge>3.5.0.p1,1</ge><lt>3.5.0.p2,1</lt></range>
 </package>
 <package>
	<name>ruby32</name>
	<range><lt>3.2.9,1</lt></range>
 </package>
 <package>
	<name>ruby33</name>
	<range><lt>3.3.9,1</lt></range>
 </package>
 <package>
	<name>ruby34</name>
	<range><lt>3.4.5,1</lt></range>
 </package>
 <package>
	<name>ruby35</name>
	<range><lt>3.5.0.p2,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Manu reports:
	<blockquote cite="https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294/">
	 
	 The vulnerability is caused by an insufficient check on
	 the length of a decompressed domain name within a DNS
	 packet.
	 
	 
	 An attacker can craft a malicious DNS packet containing a
	 highly compressed domain name. When the resolv library
	 parses such a packet, the name decompression process
	 consumes a large amount of CPU resources, as the library
	 does not limit the resulting length of the name.
	 
	 
	 This resource consumption can cause the application thread
	 to become unresponsive, resulting in a Denial of Service
	 condition.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-24294</cvename>
 <url>https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294/</url>
 </references>
 <dates>
 <discovery>2025-07-08</discovery>
 <entry>2025-07-25</entry>
 </dates>
 </vuln>

<vuln vid="67c6461f-685e-11f0-a12d-b42e991fc52e">
 <topic>Mozilla -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>141.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>141.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1933572%2C1971116">
	 Memory safety bugs present in Firefox 140 and
	 Thunderbird 140. Some of these bugs showed evidence of
	 memory corruption and we presume that with enough effort
	 some of these could have been exploited to run arbitrary
	 code.
	 Focus incorrectly truncated URLs towards the beginning instead of
	 around the origin.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8044</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8044</url>
 <cvename>CVE-2025-8043</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8043</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="62f1a68f-685e-11f0-a12d-b42e991fc52e">
 <topic>Mozilla -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>141.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>141.0</lt></range>
 </package>
 <package>
	<name>thunderbird-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1975058%2C1975058%2C1975998%2C1975998">
	 Memory safety bugs present in Firefox ESR 140.0,
	 Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140.
	 Some of these bugs showed evidence of memory corruption and
	 we presume that with enough effort some of these could have
	 been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8040</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8040</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="6088905c-685e-11f0-a12d-b42e991fc52e">
 <topic>Mozilla -- Persisted search terms in the URL bar</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>141.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>141.0</lt></range>
 </package>
 <package>
	<name>thunderbird-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1970997">
	 In some cases search terms persisted in the URL bar even after
	navigating away from the search page.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8039</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8039</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="5d91def0-685e-11f0-a12d-b42e991fc52e">
 <topic>Mozilla -- Ignored paths while checking navigations</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>141.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>141.0</lt></range>
 </package>
 <package>
	<name>thunderbird-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1808979">
	 Thunderbird ignored paths when checking the validity of
	 navigations in a frame.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8038</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8038</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="5abc2187-685e-11f0-a12d-b42e991fc52e">
 <topic>Mozilla -- cookie shadowing</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>141.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>141.0</lt></range>
 </package>
 <package>
	<name>thunderbird-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1964767">
	 Setting a nameless cookie with an equals sign in the
	 value shadowed other cookies. Even if the nameless cookie
	 was set over HTTP and the shadowed cookie included the
	 `Secure` attribute.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8037</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8037</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="58027367-685e-11f0-a12d-b42e991fc52e">
 <topic>Mozilla -- CORS circumvention</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>141.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>141.0</lt></range>
 </package>
 <package>
	<name>thunderbird-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1960834">
	 Thunderbird cached CORS preflight responses across IP
	 address changes. This allowed circumventing CORS with DNS
	 rebinding.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8036</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8036</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="55096bd3-685e-11f0-a12d-b42e991fc52e">
 <topic>Mozilla -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>141.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.13</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>141.0</lt></range>
 </package>
 <package>
	<name>thunderbird-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.13</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1975961%2C1975961%2C1975961">
	 Memory safety bugs present in Firefox ESR 128.12,
	 Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR
	 140.0, Firefox 140 and Thunderbird 140. Some of these bugs
	 showed evidence of memory corruption and we presume that
	 with enough effort some of these could have been exploited
	 to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8035</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8035</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="4faa01cb-685e-11f0-a12d-b42e991fc52e">
 <topic>Mozilla -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>141.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.13</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>115.26</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>141.0</lt></range>
 </package>
 <package>
	<name>thunderbird-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.13</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1970422%2C1970422%2C1970422%2C1970422">
	 Memory safety bugs present in Firefox ESR 115.25, Firefox
	 ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0,
	 Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some
	 of these bugs showed evidence of memory corruption and we
	 presume that with enough effort some of these could have
	 been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8034</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8034</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="4d03efe7-685e-11f0-a12d-b42e991fc52e">
 <topic>Mozilla -- nullptr dereference</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>141.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.13</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>115.26</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>141.0</lt></range>
 </package>
 <package>
	<name>thunderbird-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.13</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1973990">
	 The JavaScript engine did not handle closed generators
	 correctly and it was possible to resume them leading to a
	 nullptr deref.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8033</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8033</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="4a357f4b-685e-11f0-a12d-b42e991fc52e">
 <topic>Mozilla -- XSLT document CSP bypass</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>141.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.13</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>141.0</lt></range>
 </package>
 <package>
	<name>thunderbird-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.13</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1974407">
	 XSLT document loading did not correctly propagate the
	 source document which bypassed its CSP.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8032</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8032</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="477e9eb3-685e-11f0-a12d-b42e991fc52e">
 <topic>Mozilla -- HTTP Basic Authentication credentials leak</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>141.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.13</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>141.0</lt></range>
 </package>
 <package>
	<name>thunderbird-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1971719">
	 The `username:password` part was not correctly stripped
	 from URLs in CSP reports potentially leaking HTTP Basic
	 Authentication credentials.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8031</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8031</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="44b3048b-685e-11f0-a12d-b42e991fc52e">
 <topic>Mozilla -- Insufficient input escaping</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>141.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.13</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>141.0</lt></range>
 </package>
 <package>
	<name>thunderbird-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.13</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1968414">
	 Insufficient escaping in the Copy as cURL feature could
	 potentially be used to trick a user into executing
	 unexpected code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8030</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8030</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="419bcf99-685e-11f0-a12d-b42e991fc52e">
 <topic>Mozilla -- 'javascript:' URLs execution</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>141.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.13</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>141.0</lt></range>
 </package>
 <package>
	<name>thunderbird-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.13</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1928021">
	 Thunderbird executed `javascript:` URLs when used in
	 `object` and `embed` tags.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8029</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8029</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="3e9406a7-685e-11f0-a12d-b42e991fc52e">
 <topic>Mozilla -- Incorrect computation of branch address</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>141.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.13</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>115.26</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>141.0</lt></range>
 </package>
 <package>
	<name>thunderbird-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.13</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1971581">
	 On arm64, a WASM `br_table` instruction with a lot of
	 entries could lead to the label being too far from the
	 instruction causing truncation and incorrect computation of
	 the branch address.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8028</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8028</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="3c234220-685e-11f0-a12d-b42e991fc52e">
 <topic>Mozilla -- IonMonkey-JIT bad stack write</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>141.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.13</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>115.26</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>141.0</lt></range>
 </package>
 <package>
	<name>thunderbird-esr</name>
	<range><lt>140.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.13</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1968423">
	 On 64-bit platforms IonMonkey-JIT only wrote 32 bits of
	 the 64-bit return value space on the stack. Baseline-JIT,
	 however, read the entire 64 bits.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-8027</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8027</url>
 </references>
 <dates>
 <discovery>2025-07-22</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="3d4393b2-68a5-11f0-b2b4-589cfc10832a">
 <topic>gdk-pixbuf2 -- a heap buffer overflow</topic>
 <affects>
 <package>
	<name>gdk-pixbuf2</name>
	<range><lt>2.42.12_2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://www.cve.org/CVERecord?id=CVE-2025-7345">
	 A flaw exists in gdk-pixbuf within the gdk_pixbuf__jpeg_image_load_increment
	function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c).
	When processing maliciously crafted JPEG images, a heap buffer overflow can occur
	during Base64 encoding, allowing out-of-bounds reads from heap memory, potentially
	causing application crashes or arbitrary code execution.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-7345</cvename>
 <url>https://www.cve.org/CVERecord?id=CVE-2025-7345</url>
 </references>
 <dates>
 <discovery>2025-07-24</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="b3948bf3-685e-11f0-bff5-6805ca2fa271">
 <topic>powerdns-recursor -- cache pollution</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><lt>5.2.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://blog.powerdns.com/powerdns-security-advisory-2025-04">
	 An attacker spoofing answers to ECS enabled requests
	 sent out by the Recursor has a chance of success higher
	 than non-ECS enabled queries.	The updated version include
	 various mitigations against spoofing attempts of ECS enabled
	 queries by chaining ECS enabled requests and enforcing
	 stricter validation of the received answers. The most strict
	 mitigation done when the new setting outgoing.edns_subnet_harden
	 (old style name edns-subnet-harden) is enabled.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-30192</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-30192</url>
 </references>
 <dates>
 <discovery>2025-07-21</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="5683b3a7-683d-11f0-966e-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.2.0</ge><lt>18.2.1</lt></range>
	<range><ge>18.1.0</ge><lt>18.1.3</lt></range>
	<range><ge>15.0.0</ge><lt>18.0.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/07/23/patch-release-gitlab-18-2-1-released/">
	 Cross-site scripting issue impacts Kubernetes Proxy in GitLab CE/EE
	 Cross-site scripting issue impacts Kubernetes Proxy in GitLab CE/EE using CDNs
	 Exposure of Sensitive Information to an Unauthorized Actor issue impacts GitLab CE/EE
	 Improper Access Control issue impacts GitLab EE
	 Exposure of Sensitive Information to an Unauthorized Actor issue impacts GitLab CE/EE
	 Improper Access Control issue impacts GitLab CE/EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4700</cvename>
 <cvename>CVE-2025-4439</cvename>
 <cvename>CVE-2025-7001</cvename>
 <cvename>CVE-2025-4976</cvename>
 <cvename>CVE-2025-0765</cvename>
 <cvename>CVE-2025-1299</cvename>
 <url>https://about.gitlab.com/releases/2025/07/23/patch-release-gitlab-18-2-1-released/</url>
 </references>
 <dates>
 <discovery>2025-07-23</discovery>
 <entry>2025-07-24</entry>
 </dates>
 </vuln>

<vuln vid="0f5bcba2-67fb-11f0-9ee5-b42e991fc52e">
 <topic>sqlite -- Integer Truncation on SQLite</topic>
 <affects>
 <package>
	<name>sqlite3</name>
	<range><lt>3.50.2,1</lt></range>
 </package>
 
 <package>
	<name>linux-c7-sqlite</name>
	<range><lt>3.50.2</lt></range>
 </package>
 <package>
	<name>linux_base-rl9</name>
	<range><ge>9.5.14</ge><lt>9.6_1</lt></range>
 </package>
 <package>
	<name>linux-rl9-sqlite3</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve-coordination@google.com reports:
	<blockquote cite="https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8">
	 There exists a vulnerability in SQLite versions before
	 3.50.2 where the number of aggregate terms could exceed the
	 number of columns available. This could lead to a memory
	 corruption issue.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6965</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6965</url>
 </references>
 <dates>
 <discovery>2025-07-15</discovery>
 <entry>2025-07-23</entry>
 <modified>2025-09-07</modified>
 </dates>
 </vuln>

<vuln vid="80411ba2-6729-11f0-a5cb-8c164580114f">
 <topic>7-Zip -- Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder</topic>
 <affects>
 <package>
	<name>7-zip</name>
	<range><lt>25.00</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://securitylab.github.com/advisories/GHSL-2025-058_7-Zip/">
	 7-Zip is a file archiver with a high compression ratio. Zeroes
	written outside heap buffer in RAR5 handler may lead to memory
	corruption and denial of service in versions of 7-Zip prior to
	25.0.0. Version 25.0.0 contains a fix for the issue.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-53816</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-53816</url>
 </references>
 <dates>
 <discovery>2025-07-17</discovery>
 <entry>2025-07-22</entry>
 </dates>
 </vuln>

<vuln vid="605a9d1e-6521-11f0-beb2-ac5afc632ba3">
 <topic>libwasmtime -- host panic with fd_renumber WASIp1 function</topic>
 <affects>
 <package>
	<name>libwasmtime</name>
	<range><ge>24.0.0</ge><lt>24.0.4</lt></range>
	<range><ge>33.0.0</ge><lt>33.0.2</lt></range>
	<range><ge>34.0.0</ge><lt>34.0.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	WasmTime development team reports:
	<blockquote cite="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-fm79-3f68-h2fc">
	 A bug in Wasmtime's implementation of the WASIp1 set of import
	 functions can lead to a WebAssembly guest inducing a panic in the
	 host (embedder).
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-53901</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-53901</url>
 </references>
 <dates>
 <discovery>2025-07-18</discovery>
 <entry>2025-07-20</entry>
 </dates>
 </vuln>

<vuln vid="e27ee4fc-cdc9-45a1-8242-09898cdbdc91">
 <topic>unbound -- Cache poisoning via the ECS-enabled Rebirthday Attack</topic>
 <affects>
 <package>
	<name>unbound</name>
	<range><gt>1.6.1</gt><lt>1.23.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	sep@nlnetlabs.nl reports:
	<blockquote cite="https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt">
	 A multi-vendor cache poisoning vulnerability named 'Rebirthday
	Attack' has been discovered in caching resolvers that support
	EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled
	with ECS support, i.e., '--enable-subnet', AND configured
	to send ECS information along with queries to upstream name servers,
	i.e., at least one of the 'send-client-subnet',
	'client-subnet-zone' or 'client-subnet-always-forward'
	options is used. Resolvers supporting ECS need to segregate outgoing
	queries to accommodate for different outgoing ECS information.	This
	re-opens up resolvers to a birthday paradox attack (Rebirthday
	Attack) that tries to match the DNS transaction ID in order to cache
	non-ECS poisonous replies.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5994</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-5994</url>
 </references>
 <dates>
 <discovery>2025-07-16</discovery>
 <entry>2025-07-18</entry>
 </dates>
 </vuln>

<vuln vid="aeac223e-60e1-11f0-8baa-8447094a420f">
 <topic>liboqs -- Secret-dependent branching in HQC</topic>
 <affects>
 <package>
	<name>liboqs</name>
	<range><lt>0.14.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenQuantumSafe project reports:
	<blockquote cite="https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-qq3m-rq9v-jfgm">
	 Secret-dependent branching in HQC reference implementation when compiled with Clang 17-20 for optimizations above -O0
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-52473</cvename>
 <url>https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-qq3m-rq9v-jfgm</url>
 </references>
 <dates>
 <discovery>2025-07-10</discovery>
 <entry>2025-07-14</entry>
 </dates>
 </vuln>

<vuln vid="c3e1df74-5e73-11f0-95e5-74563cf9e4e9">
 <topic>GnuTLS -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>3.8.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Daiki Ueno reports:
	<blockquote cite="https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html">
	 <ul>
	 <li>libgnutls: Fix heap read buffer overrun in parsing X.509 SCTS timestamps
	 Spotted by oss-fuzz and reported by OpenAI Security Research Team,
	 and fix developed by Andrew Hamilton. [GNUTLS-SA-2025-07-07-1,
	 CVSS: medium] [CVE-2025-32989]</li>
	 <li>libgnutls: Fix double-free upon error when exporting otherName in SAN
	 Reported by OpenAI Security Research Team. [GNUTLS-SA-2025-07-07-2,
	 CVSS: low] [CVE-2025-32988]</li>
	 <li>certtool: Fix 1-byte write buffer overrun when parsing template
	 Reported by David Aitel. [GNUTLS-SA-2025-07-07-3,
	 CVSS: low] [CVE-2025-32990]</li>
	 <li>libgnutls: Fix NULL pointer dereference when 2nd Client Hello omits PSK
	 Reported by Stefan Bühler. [GNUTLS-SA-2025-07-07-4, CVSS: medium]
	 [CVE-2025-6395]</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-32989</cvename>
 <cvename>CVE-2025-32988</cvename>
 <cvename>CVE-2025-32990</cvename>
 <cvename>CVE-2025-6395</cvename>
 <url>https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html</url>
 </references>
 <dates>
 <discovery>2025-07-09</discovery>
 <entry>2025-07-14</entry>
 </dates>
 </vuln>

<vuln vid="b0a3466f-5efc-11f0-ae84-99047d0a6bcc">
 <topic>libxslt -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libxslt</name>
	<range><lt>1.1.44</lt></range> 
 </package>
 <package>
	<name>linux-c7-libxslt</name>
	<range><lt>2</lt></range> 
 </package>
 <package>
	<name>linux-rl9-libxslt</name>
	<range><lt>2</lt></range> 
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Alan Coopersmith reports:
	<blockquote cite="https://www.openwall.com/lists/oss-security/2025/07/11/2">
	 On 6/16/25 15:12, Alan Coopersmith wrote:
	 
	 BTW, users of libxml2 may also be using its sibling project, libxslt,
	 which currently has no active maintainer, but has three unfixed security issues
	 reported against it according to
	 <a href="https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt">
		https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt</a>
	 
	 2 of the 3 have now been disclosed:
	 (CVE-2025-7424) libxslt: Type confusion in xmlNode.psvi between stylesheet and source nodes 
	 <a href="https://gitlab.gnome.org/GNOME/libxslt/-/issues/139">https://gitlab.gnome.org/GNOME/libxslt/-/issues/139</a>
	 <a href="https://project-zero.issues.chromium.org/issues/409761909">https://project-zero.issues.chromium.org/issues/409761909</a>
	 (CVE-2025-7425) libxslt: heap-use-after-free in xmlFreeID caused by `atype` corruption 
	 <a href="https://gitlab.gnome.org/GNOME/libxslt/-/issues/140">https://gitlab.gnome.org/GNOME/libxslt/-/issues/140</a> <a href="https://project-zero.issues.chromium.org/issues/410569369">https://project-zero.issues.chromium.org/issues/410569369</a>
	 Engineers from Apple &amp; Google have proposed patches in the GNOME gitlab issues,
	 but neither has had a fix applied to the git repo since there is currently no
	 maintainer for libxslt.
	</blockquote>
	Note that a fourth vulnerability was reported on June 18, 2025, which remains undisclosed to date (GNOME libxslt issue 148, link below), see
	 <a href="https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt">
	 https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt</a>
	
	Iván Chavero reports vs. v1.1.44:
	<blockquote cite="https://gitlab.gnome.org/GNOME/libxslt/-/blob/v1.1.45/NEWS?ref_type=tags#L23">
	 [CVE-2025-11731] Fix: End function node ancestor search at document
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-7424</cvename> 
 <cvename>CVE-2025-7425</cvename> 
 <cvename>CVE-2025-9714</cvename> 
 <cvename>CVE-2025-11731</cvename> 
 <url>https://gitlab.gnome.org/GNOME/libxslt/-/blob/v1.1.45/NEWS?ref_type=tags#L1</url>
 <url>https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt</url>
 <url>https://gitlab.gnome.org/GNOME/libxslt/-/issues/139</url>
 <url>https://gitlab.gnome.org/GNOME/libxslt/-/issues/140</url>
 <url>https://gitlab.gnome.org/GNOME/libxslt/-/issues/144</url>
 <url>https://gitlab.gnome.org/GNOME/libxslt/-/issues/148</url>
 <url>https://gitlab.gnome.org/GNOME/libxslt/-/commit/923903c59d668af42e3144bc623c9190a0f65988</url>
 </references>
 <dates>
 <discovery>2025-04-10</discovery>
 <entry>2025-07-12</entry>
 <modified>2026-01-02</modified>
 </dates>
 </vuln>

<vuln vid="abbc8912-5efa-11f0-ae84-99047d0a6bcc">
 <topic>libxml2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.14.5</lt></range>
 </package>
 <package>
	<name>linux-c7-libxml2</name>
	<range><lt>2.14.5</lt></range> 
 </package>
 <package>
	<name>linux-rl9-libxml2</name>
	<range><lt>2.14.5</lt></range> 
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Alan Coopersmith reports:
	<blockquote cite="https://www.openwall.com/lists/oss-security/2025/06/16/6">
	 As discussed in
	 <a href="https://gitlab.gnome.org/GNOME/libxml2/-/issues/913">https://gitlab.gnome.org/GNOME/libxml2/-/issues/913</a> the
	 security policy of libxml2 has been changed to disclose vulnerabilities
	 before fixes are available so that people other than the maintainer can
	 contribute to fixing security issues in this library.
	 As part of this, the following 5 CVE's have been disclosed recently:
	 (CVE-2025-49794) Heap use after free (UAF) leads to Denial of service (DoS)
	 <a href="https://gitlab.gnome.org/GNOME/libxml2/-/issues/931">https://gitlab.gnome.org/GNOME/libxml2/-/issues/931</a> [...]
	 (CVE-2025-49795) Null pointer dereference leads to Denial of service (DoS)
	 <a href="https://gitlab.gnome.org/GNOME/libxml2/-/issues/932">https://gitlab.gnome.org/GNOME/libxml2/-/issues/932</a> [...]
	 (CVE-2025-49796) Type confusion leads to Denial of service (DoS)
	 <a href="https://gitlab.gnome.org/GNOME/libxml2/-/issues/933">https://gitlab.gnome.org/GNOME/libxml2/-/issues/933</a> [...]
	 For all three of the above, note that upstream is considering removing Schematron support completely, as discussed in
	 <a href="https://gitlab.gnome.org/GNOME/libxml2/-/issues/935">https://gitlab.gnome.org/GNOME/libxml2/-/issues/935</a>.
	 (CVE-2025-6021) Integer Overflow Leading to Buffer Overflow in xmlBuildQName()
	 <a href="https://gitlab.gnome.org/GNOME/libxml2/-/issues/926">https://gitlab.gnome.org/GNOME/libxml2/-/issues/926</a> [...]
	 (CVE-2025-6170) Stack-based Buffer Overflow in xmllint Shell
	 <a href="https://gitlab.gnome.org/GNOME/libxml2/-/issues/941">https://gitlab.gnome.org/GNOME/libxml2/-/issues/941</a> [...]
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6021</cvename>
 <cvename>CVE-2025-6170</cvename>
 <cvename>CVE-2025-49794</cvename>
 <cvename>CVE-2025-49795</cvename>
 <cvename>CVE-2025-49795</cvename>
 <url>https://www.openwall.com/lists/oss-security/2025/06/16/6</url>
 <url>https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt</url>
 <url>https://gitlab.gnome.org/GNOME/libxml2/-/issues/913</url>
 <url>https://gitlab.gnome.org/GNOME/libxml2/-/issues/931</url>
 <url>https://gitlab.gnome.org/GNOME/libxml2/-/issues/932</url>
 <url>https://gitlab.gnome.org/GNOME/libxml2/-/issues/933</url>
 <url>https://gitlab.gnome.org/GNOME/libxml2/-/issues/935</url>
 <url>https://gitlab.gnome.org/GNOME/libxml2/-/issues/926</url>
 <url>https://gitlab.gnome.org/GNOME/libxml2/-/issues/941</url>
 </references>
 <dates>
 <discovery>2025-05-27</discovery>
 <entry>2025-07-12</entry>
 <modified>2025-07-15</modified>
 </dates>
 </vuln>

<vuln vid="61d74f80-5e9e-11f0-8baa-8447094a420f">
 <topic>mod_http2 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mod_http2</name>
	<range><lt>2.0.33</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The mod_http2 project reports:
	<blockquote cite="https://github.com/icing/mod_h2/releases/tag/v2.0.33">
	 a client can increase memory consumption for a HTTP/2 connection
	 via repeated request header names,leading to denial of service
	 certain proxy configurations whith mod_proxy_http2 as the
	 backend, an assertion can be triggered by certain requests, leading
	 to denial of service
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-53020</cvename>
 <cvename>CVE-2025-49630</cvename>
 <url>https://github.com/icing/mod_h2/releases/tag/v2.0.33</url>
 </references>
 <dates>
 <discovery>2025-07-10</discovery>
 <entry>2025-07-11</entry>
 </dates>
 </vuln>

<vuln vid="342f2a0a-5e9b-11f0-8baa-8447094a420f">
 <topic>Apache httpd -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.64</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
	 moderate: Apache HTTP Server: HTTP response splitting (CVE-2024-42516)
	 low: Apache HTTP Server: SSRF with mod_headers setting Content-Type header (CVE-2024-43204)
	 moderate: Apache HTTP Server: SSRF on Windows due to UNC paths (CVE-2024-43394)
	 low: Apache HTTP Server: mod_ssl error log variable escaping (CVE-2024-47252)
	 moderate: Apache HTTP Server: mod_ssl access control bypass with session resumption (CVE-2025-23048)
	 low: Apache HTTP Server: mod_proxy_http2 denial of service (CVE-2025-49630)
	 moderate: Apache HTTP Server: mod_ssl TLS upgrade attack (CVE-2025-49812)
	 moderate: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020)
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-42516</cvename>
 <cvename>CVE-2024-43204</cvename>
 <cvename>CVE-2024-43394</cvename>
 <cvename>CVE-2024-47252</cvename>
 <cvename>CVE-2025-23048</cvename>
 <cvename>CVE-2025-49630</cvename>
 <cvename>CVE-2025-49812</cvename>
 <cvename>CVE-2025-53020</cvename>
 <url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
 </references>
 <dates>
 <discovery>2025-07-10</discovery>
 <entry>2025-07-11</entry>
 </dates>
 </vuln>

<vuln vid="ef87346f-5dd0-11f0-beb2-ac5afc632ba3">
 <topic>Apache Tomcat -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>tomcat110</name>
	<range><ge>11.0.0</ge><lt>11.0.9</lt></range>
 </package>
 <package>
	<name>tomcat101</name>
	<range><ge>10.1.0</ge><lt>10.1.43</lt></range>
 </package>
 <package>
	<name>tomcat9</name>
	<range><ge>9.0.0</ge><lt>9.0.107</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@apache.org reports:
	<blockquote cite="https://www.mail-archive.com/announce@tomcat.apache.org/msg00710.html">
	 A race condition on connection close could trigger a JVM crash when using the
	 APR/Native connector leading to a DoS. This was particularly noticeable with client
	 initiated closes of HTTP/2 connections.
	</blockquote>
	<blockquote cite="https://www.mail-archive.com/announce@tomcat.apache.org/msg00713.html">
	 An uncontrolled resource consumption vulnerability if an HTTP/2 client did not
	 acknowledge the initial settings frame that reduces the maximum permitted
	 concurrent streams could result in a DoS.
	</blockquote>
	<blockquote cite="https://www.mail-archive.com/announce@tomcat.apache.org/msg00714.html">
	 For some unlikely configurations of multipart upload, an Integer Overflow
	 vulnerability could lead to a DoS via bypassing of size limits.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-52434</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-52434</url>
 <cvename>CVE-2025-52520</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-52520</url>
 <cvename>CVE-2025-53506</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-53506</url>
 </references>
 <dates>
 <discovery>2025-07-10</discovery>
 <entry>2025-07-10</entry>
 <modified>2025-07-15</modified>
 </dates>
 </vuln>

<vuln vid="20823cc0-5d45-11f0-966e-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.1.0</ge><lt>18.1.2</lt></range>
	<range><ge>18.0.0</ge><lt>18.0.4</lt></range>
	<range><ge>13.3.0</ge><lt>17.11.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/07/09/patch-release-gitlab-18-1-2-released/">
	 Cross-site scripting issue impacts GitLab CE/EE
	 Improper authorization issue impacts GitLab CE/EE
	 Improper authorization issue impacts GitLab EE
	 Improper authorization issue impacts GitLab EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6948</cvename>
 <cvename>CVE-2025-3396</cvename>
 <cvename>CVE-2025-4972</cvename>
 <cvename>CVE-2025-6168</cvename>
 <url>https://about.gitlab.com/releases/2025/07/09/patch-release-gitlab-18-1-2-released/</url>
 </references>
 <dates>
 <discovery>2025-07-09</discovery>
 <entry>2025-07-10</entry>
 </dates>
 </vuln>

<vuln vid="2a4472ed-5c0d-11f0-b991-291fce777db8">
 <topic>git -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>git</name>
	<name>git-cvs</name>
	<name>git-gui</name>
	<name>git-p4</name>
	<name>git-svn</name>
	<range><lt>2.50.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Git development team reports:
	<blockquote cite="https://lore.kernel.org/git/xmqq5xg2wrd1.fsf@gitster.g">
	 CVE-2025-27613: Gitk:
	 When a user clones an untrusted repository and runs Gitk without
	 additional command arguments, any writable file can be created and
	 truncated. The option "Support per-file encoding" must have been
	 enabled. The operation "Show origin of this line" is affected as
	 well, regardless of the option being enabled or not.
	 
	 CVE-2025-27614: Gitk:
	 A Git repository can be crafted in such a way that a user who has
	 cloned the repository can be tricked into running any script
	 supplied by the attacker by invoking `gitk filename`, where
	 `filename` has a particular structure.
	 
	 CVE-2025-46835: Git GUI:
	 When a user clones an untrusted repository and is tricked into
	 editing a file located in a maliciously named directory in the
	 repository, then Git GUI can create and overwrite any writable
	 file.
	 
	 CVE-2025-48384: Git:
	 When reading a config value, Git strips any trailing carriage
	 return and line feed (CRLF). When writing a config entry, values
	 with a trailing CR are not quoted, causing the CR to be lost when
	 the config is later read. When initializing a submodule, if the
	 submodule path contains a trailing CR, the altered path is read
	 resulting in the submodule being checked out to an incorrect
	 location. If a symlink exists that points the altered path to the
	 submodule hooks directory, and the submodule contains an executable
	 post-checkout hook, the script may be unintentionally executed
	 after checkout.
	 
	 CVE-2025-48385: Git:
	 When cloning a repository Git knows to optionally fetch a bundle
	 advertised by the remote server, which allows the server-side to
	 offload parts of the clone to a CDN. The Git client does not
	 perform sufficient validation of the advertised bundles, which
	 allows the remote side to perform protocol injection.
	 This protocol injection can cause the client to write the fetched
	 bundle to a location controlled by the adversary. The fetched
	 content is fully controlled by the server, which can in the worst
	 case lead to arbitrary code execution.
	 
	 CVE-2025-48386: Git:
	 The wincred credential helper uses a static buffer (`target`) as a
	 unique key for storing and comparing against internal storage. This
	 credential helper does not properly bounds check the available
	 space remaining in the buffer before appending to it with
	 `wcsncat()`, leading to potential buffer overflows.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-27613</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27613</url>
 <cvename>CVE-2025-27614</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27614</url>
 <cvename>CVE-2025-46835</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46835</url>
 <cvename>CVE-2025-48384</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48384</url>
 <cvename>CVE-2025-48385</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48385</url>
 <cvename>CVE-2025-48386</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48386</url>
 </references>
 <dates>
 <discovery>2025-04-11</discovery>
 <entry>2025-07-08</entry>
 </dates>
 </vuln>

<vuln vid="79251dc8-5bc5-11f0-834f-b42e991fc52e">
 <topic>MongoDB -- Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections</topic>
 <affects>
 <package>
	<name>mongodb60</name>
	<range><lt>6.0.23</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.20</lt></range>
 </package>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.9</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@mongodb.com reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-106753">
	 MongoDB Server's mongos component can become
	unresponsive to new connections due to incorrect handling of
	incomplete data. This affects MongoDB when configured with
	load balancer support.
	Required Configuration:
	This affects MongoDB sharded clusters when configured with load
	balancer support for mongos using HAProxy on specified ports.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6714</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6714</url>
 </references>
 <dates>
 <discovery>2025-07-07</discovery>
 <entry>2025-07-08</entry>
 </dates>
 </vuln>

<vuln vid="77dc1fc4-5bc5-11f0-834f-b42e991fc52e">
 <topic>MongoDB -- may be susceptible to privilege escalation due to $mergeCursors stage</topic>
 <affects>
 <package>
	<name>mongodb60</name>
	<range><lt>6.0.22</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.20</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@mongodb.com reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-106752">
	 An unauthorized user may leverage a specially crafted
	 aggregation pipeline to access data without proper
	 authorization due to improper handling of the $mergeCursors
	 stage in MongoDB Server. This may lead to access to data
	 without further authorisation.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6713</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6713</url>
 </references>
 <dates>
 <discovery>2025-07-07</discovery>
 <entry>2025-07-08</entry>
 </dates>
 </vuln>

<vuln vid="764204eb-5bc5-11f0-834f-b42e991fc52e">
 <topic>MongoDB -- may be susceptible to DoS due to Accumulated Memory Allocation</topic>
 <affects>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@mongodb.com reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-106751">
	 MongoDB Server may be susceptible to disruption caused by
	 high memory usage, potentially leading to server crash. This
	 condition is linked to inefficiencies in memory management
	 related to internal operations. In scenarios where certain
	 internal processes persist longer than anticipated, memory
	 consumption can increase, potentially impacting server
	 stability and availability.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6712</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6712</url>
 </references>
 <dates>
 <discovery>2025-07-07</discovery>
 <entry>2025-07-08</entry>
 </dates>
 </vuln>

<vuln vid="72ddee1f-5bc5-11f0-834f-b42e991fc52e">
 <topic>MongoDB -- Incomplete Redaction of Sensitive Information in MongoDB Server Logs</topic>
 <affects>
 <package>
	<name>mongodb60</name>
	<range><lt>6.0.21</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.18</lt></range>
 </package>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@mongodb.com reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-98720">
	 An issue has been identified in MongoDB Server where
	 unredacted queries may inadvertently appear in server logs
	 when certain error conditions are encountered.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6711</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6711</url>
 </references>
 <dates>
 <discovery>2025-07-07</discovery>
 <entry>2025-07-08</entry>
 </dates>
 </vuln>

<vuln vid="c0f3f54c-5bc4-11f0-834f-b42e991fc52e">
 <topic>ModSecurity -- empty XML tag causes segmentation fault</topic>
 <affects>
 <package>
	<name>ap24-mod_security</name>
	<range><lt>2.9.11</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/owasp-modsecurity/ModSecurity/commit/ecd7b9736836eee391d25f35d5bd06a3ce35a45d">
	 ModSecurity is an open source, cross platform web application
	firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8
	to before 2.9.11, an empty XML tag can cause a segmentation fault.
	If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request
	type is application/xml, and at least one XML tag is empty (eg
	&lt;foo&gt;&lt;/foo&gt;), then a segmentation fault occurs. This
	issue has been patched in version 2.9.11. A workaround involves
	setting SecParseXmlIntoArgs to Off.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-52891</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-52891</url>
 </references>
 <dates>
 <discovery>2025-07-02</discovery>
 <entry>2025-07-08</entry>
 </dates>
 </vuln>

<vuln vid="7b3e7f71-5b30-11f0-b507-000c295725e4">
 <topic>redis,valkey -- DoS Vulnerability due to bad connection error handling</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><ge>8.0.0</ge><lt>8.0.3</lt></range>
 </package>
 <package>
	<name>redis74</name>
	<range><ge>7.4.0</ge><lt>7.4.5</lt></range>
 </package>
 <package>
	<name>redis72</name>
	<range><ge>7.2.0</ge><lt>7.2.10</lt></range>
 </package>
 <package>
	<name>redis62</name>
	<range><ge>6.2.0</ge><lt>6.2.19</lt></range>
 </package>
 <package>
	<name>valkey</name>
	<range><lt>8.1.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	@julienperriercornet reports:
	<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-4q32-c38c-pwgq">
	 
	 An unauthenticated connection can cause repeated IP
	 protocol errors, leading to client starvation and,
	 ultimately, a denial of service.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-48367</cvename>
 <url>https://github.com/redis/redis/security/advisories/GHSA-4q32-c38c-pwgq</url>
 </references>
 <dates>
 <discovery>2025-07-06</discovery>
 <entry>2025-07-07</entry>
 </dates>
 </vuln>

<vuln vid="f11d0a69-5b2d-11f0-b507-000c295725e4">
 <topic>redis,valkey -- Out of bounds write in hyperloglog commands leads to RCE</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><ge>8.0.0</ge><lt>8.0.3</lt></range>
 </package>
 <package>
	<name>redis74</name>
	<range><ge>7.4.0</ge><lt>7.4.5</lt></range>
 </package>
 <package>
	<name>redis72</name>
	<range><ge>7.2.0</ge><lt>7.2.10</lt></range>
 </package>
 <package>
	<name>redis62</name>
	<range><ge>6.2.0</ge><lt>6.2.19</lt></range>
 </package>
 <package>
	<name>valkey</name>
	<range><lt>8.1.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Seunghyun Lee reports:
	<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43">
	 
	 An authenticated user may use a specially crafted string
	 to trigger a stack/heap out of bounds write on hyperloglog
	 operations, potentially leading to remote code execution.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-32023</cvename>
 <url>https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43</url>
 </references>
 <dates>
 <discovery>2025-07-06</discovery>
 <entry>2025-07-07</entry>
 </dates>
 </vuln>

<vuln vid="4ea9cbc3-5b28-11f0-b507-000c295725e4">
 <topic>redis,valkey -- {redis,valkey}-check-aof may lead to stack overflow and potential RCE</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><ge>8.0.0</ge><lt>8.0.2</lt></range>
 </package>
 <package>
	<name>redis74</name>
	<range><ge>7.4.0</ge><lt>7.4.4</lt></range>
 </package>
 <package>
	<name>redis72</name>
	<range><ge>7.2.0</ge><lt>7.2.9</lt></range>
 </package>
 <package>
	<name>valkey</name>
	<range><lt>8.1.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Simcha Kosman &amp; CyberArk Labs reports:
	<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-5453-q98w-cmvm">
	 A user can run the {redis,valkeyu}-check-aof cli and pass
	 a long file path to trigger a stack buffer overflow, which
	 may potentially lead to remote code execution.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-27151</cvename>
 <url>https://github.com/redis/redis/security/advisories/GHSA-5453-q98w-cmvm</url>
 </references>
 <dates>
 <discovery>2025-05-28</discovery>
 <entry>2025-07-07</entry>
 </dates>
 </vuln>

<vuln vid="7642ba72-5abf-11f0-87ba-002590c1f29c">
 <topic>FreeBSD -- Use-after-free in multi-threaded xz decoder</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.2</ge><lt>14.2_4</lt></range>
	<range><ge>13.5</ge><lt>13.5_2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A worker thread could free its input buffer after decoding,
	while the main thread might still be writing to it. This leads to
	an use-after-free condition on heap memory.
	<h1>Impact:</h1>
	An attacker may use specifically crafted .xz file to cause
	multi-threaded xz decoder to crash, or potentially run arbitrary
	code under the credential the decoder was executed.
 </body>
 </description>
 <references>
 <cvename>CVE-2025-31115</cvename>
 <freebsdsa>SA-25:06.xz</freebsdsa>
 </references>
 <dates>
 <discovery>2025-07-02</discovery>
 <entry>2025-07-06</entry>
 </dates>
 </vuln>

<vuln vid="69bfe2a4-5a39-11f0-8792-4ccc6adda413">
 <topic>gstreamer1-plugins-bad -- stack buffer overflow in H.266 video parser</topic>
 <affects>
 <package>
	<name>gstreamer1-plugins-bad</name>
	<range><lt>1.26.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	GStreamer Security Center reports:
	<blockquote cite="https://gstreamer.freedesktop.org/security/sa-2025-0007.html">
	 It is possible for a malicious third party to trigger a buffer overflow that can
	 result in a crash of the application and possibly also allow code execution through
	 stack manipulation.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6663</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2025-0007.html</url>
 </references>
 <dates>
 <discovery>2025-06-26</discovery>
 <entry>2025-07-06</entry>
 </dates>
 </vuln>

<vuln vid="a55d2120-58cf-11f0-b4ad-b42e991fc52e">
 <topic>firefox -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>140.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1941377%2C1960948%2C1966187%2C1966505%2C1970764">
	An attacker was able to bypass the `connect-src`
	 directive of a Content Security Policy by manipulating
	 subdocuments. This would have also hidden the connections
	 from the Network tab in Devtools.
	When Multi-Account Containers was enabled, DNS requests
	could have bypassed a SOCKS proxy when the domain name was
	invalid or the SOCKS proxy was not responding.
	If a user visited a webpage with an invalid TLS
	certificate, and granted an exception, the webpage was able to
	provide a WebAuthn challenge that the user would be prompted
	to complete. This is in violation of the WebAuthN spec which
	requires "a secure transport established without
	errors".
	The exception page for the HTTPS-Only feature, displayed
	when a website is opened via HTTP, lacked an anti-clickjacking
	delay, potentially allowing an attacker to trick a user into
	granting an exception and loading a webpage over HTTP.
	If a user saved a response from the Network tab in Devtools
	using the Save As context menu option, that file may not have
	been saved with the `.download` file extension.
	This could have led to the user inadvertently running a
	malicious executable.
	Memory safety bugs present in Firefox 139 and Thunderbird
	139. Some of these bugs showed evidence of memory corruption
	and we presume that with enough effort some of these could
	have been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6427</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6427</url>
 <cvename>CVE-2025-6432</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6432</url>
 <cvename>CVE-2025-6433</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6433</url>
 <cvename>CVE-2025-6434</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6434</url>
 <cvename>CVE-2025-6435</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6435</url>
 <cvename>CVE-2025-6436</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6436</url>
 </references>
 <dates>
 <discovery>2025-06-24</discovery>
 <entry>2025-07-04</entry>
 </dates>
 </vuln>

<vuln vid="9bad6f79-58cf-11f0-b4ad-b42e991fc52e">
 <topic>firefox -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>128.12.0,2</lt></range>
	<range><lt>140.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1971140">
	Firefox could have incorrectly parsed a URL and rewritten
	it to the youtube.com domain when parsing the URL specified
	in an `embed` tag. This could have bypassed website security
	checks that restricted which domains users were allowed to
	embed.
	When a file download is specified via the
	`Content-Disposition` header, that directive would be ignored
	if the file was included via a `&amp;lt;embed&amp;gt;` or
	`&amp;lt;object&amp;gt;` tag, potentially making a website
	vulnerable to a cross-site scripting attack.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6429</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6429</url>
 <cvename>CVE-2025-6430</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6430</url>
 </references>
 <dates>
 <discovery>2025-06-24</discovery>
 <entry>2025-07-04</entry>
 </dates>
 </vuln>

<vuln vid="9320590b-58cf-11f0-b4ad-b42e991fc52e">
 <topic>Mozilla -- persistent UUID that identifies browser</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>140.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>115.25.0</lt></range>
	<range><lt>128.12</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>140.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.12</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1717672">
	 An attacker who enumerated resources from the WebCompat extension
	could have obtained a persistent UUID that identified the browser,
	and persisted between containers and normal/private browsing mode,
	but not profiles. This vulnerability affects Firefox &lt; 140,
	Firefox ESR &lt; 115.25, Firefox ESR &lt; 128.12, Thunderbird &lt;
	140, and Thunderbird &lt; 128.12.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6425</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6425</url>
 </references>
 <dates>
 <discovery>2025-06-24</discovery>
 <entry>2025-07-04</entry>
 </dates>
 </vuln>

<vuln vid="d607b12c-5821-11f0-ab92-f02f7497ecda">
 <topic>php -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php81</name>
	<range><lt>8.1.33</lt></range>
 </package>
 <package>
	<name>php82</name>
	<range><lt>8.2.29</lt></range>
 </package>
 <package>
	<name>php83</name>
	<range><lt>8.3.23</lt></range>
 </package>
 <package>
	<name>php84</name>
	<range><lt>8.4.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	php.net reports:
 <blockquote cite="https://www.php.net/ChangeLog-8.php">
 <ul>
 <li>
 CVE-2025-1735: pgsql extension does not check for errors during escaping
 </li>
 <li>
 CVE-2025-6491: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
 </li>
 <li>
 CVE-2025-1220: Null byte termination in hostnames
 </li>
 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1735</cvename>
 <cvename>CVE-2025-6491</cvename>
 <cvename>CVE-2025-1220</cvename>
 </references>
 <dates>
 <discovery>2025-02-27</discovery>
 <entry>2025-07-03</entry>
 </dates>
 </vuln>

<vuln vid="bab7386a-582f-11f0-97d0-b42e991fc52e">
 <topic>Mozilla -- exploitable crash</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>140.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>115.25.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>140.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1966423">
	 A use-after-free in FontFaceSet resulted in a potentially
	 exploitable crash.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6424</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6424</url>
 </references>
 <dates>
 <discovery>2025-06-24</discovery>
 <entry>2025-07-03</entry>
 </dates>
 </vuln>

<vuln vid="5c777f88-40ff-4e1e-884b-ad63dfb9bb15">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>138.0.7204.96</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>138.0.7204.96</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[427663123] High CVE-2025-6554: Type Confusion in V8.</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-6554</cvename>
 <url>https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html</url>
 </references>
 <dates>
 <discovery>2025-06-30</discovery>
 <entry>2025-07-02</entry>
 </dates>
 </vuln>

<vuln vid="9c91e1f8-f255-4b57-babe-2e385558f1dc">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>138.0.7204.49</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>138.0.7204.49</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_24.html">
	 This update includes 11 security fixes:
	 <ul>
	 <li>[407328533] Medium CVE-2025-6555: Use after free in Animation. Reported by Lyra Rebane (rebane2001) on 2025-03-30</li>
	 <li>[40062462] Low CVE-2025-6556: Insufficient policy enforcement in Loader. Reported by Shaheen Fazim on 2023-01-02</li>
	 <li>[406631048] Low CVE-2025-6557: Insufficient data validation in DevTools. Reported by Ameen Basha M K on 2025-03-27</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-6555</cvename>
 <cvename>CVE-2025-6556</cvename>
 <cvename>CVE-2025-6557</cvename>
 <url>https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_24.html</url>
 </references>
 <dates>
 <discovery>2025-06-24</discovery>
 <entry>2025-07-02</entry>
 </dates>
 </vuln>

<vuln vid="24f4b495-56a1-11f0-9621-93abbef07693">
 <topic>sudo -- privilege escalation vulnerability through host and chroot options</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><lt>1.9.17p1</lt></range>
 </package>
 <package>
	<name>sudo-sssd</name>
	<range><lt>1.9.17p1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Todd C. Miller reports, crediting Rich Mirch from Stratascale Cyber Research Unit (CRU):
	<blockquote cite="https://www.sudo.ws/releases/stable/">
	 Sudo 1.9.17p1:
	 <ul>
	 <li>
	 Fixed CVE-2025-32462. Sudo's -h (--host) option could be specified
	 when running a command or editing a file. This could enable a
	 local privilege escalation attack if the sudoers file allows the
	 user to run commands on a different host. For more information,
	 see Local Privilege Escalation via host option.
	 </li>
	 <li>
	 Fixed CVE-2025-32463. An attacker can leverage sudo's -R
	 (--chroot) option to run arbitrary commands as root, even if they
	 are not listed in the sudoers file. The chroot support has been
	 deprecated an will be removed entirely in a future release. For
	 more information, see Local Privilege Escalation via chroot
	 option.
	 </li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-32462</cvename>
 <cvename>CVE-2025-32463</cvename>
 <url>https://www.sudo.ws/releases/stable/</url>
 <url>https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host</url>
 <url>https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot</url>
 </references>
 <dates>
 <discovery>2025-04-01</discovery>
 <entry>2025-07-01</entry>
 </dates>
 </vuln>

<vuln vid="8df49466-5664-11f0-943a-18c04d5ea3dc">
 <topic>xorg server -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<name>xephyr</name>
	<name>xorg-vfbserver</name>
	<range><lt>21.1.18,1</lt></range>
 </package>
 <package>
	<name>xorg-nextserver</name>
	<range><lt>21.1.18,2</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>24.1.8,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The X.Org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2025-February/003584.html">
	 <ul>
	 <li>
	 CVE-2025-49176: Integer overflow in Big Requests Extension
	 The Big Requests extension allows requests larger than the 16-bit length
	 limit.
	 It uses integers for the request length and checks for the size not to
	 exceed the maxBigRequestSize limit, but does so after translating the
	 length to integer by multiplying the given size in bytes by 4.
	 In doing so, it might overflow the integer size limit before actually
	 checking for the overflow, defeating the purpose of the test.
	 </li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-49176</cvename>
 <url>https://lists.x.org/archives/xorg/2025-June/062055.html</url>
 </references>
 <dates>
 <discovery>2025-06-17</discovery>
 <entry>2025-07-01</entry>
 </dates>
 </vuln>

<vuln vid="b14cabf7-5663-11f0-943a-18c04d5ea3dc">
 <topic>xorg server -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<name>xephyr</name>
	<name>xorg-vfbserver</name>
	<range><lt>21.1.17,1</lt></range>
 </package>
 <package>
	<name>xorg-nextserver</name>
	<range><lt>21.1.17,2</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>24.1.7,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The X.Org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2025-February/003584.html">
	 <ul>
	 <li>
	 CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors)
	 The X Rendering extension allows creating animated cursors providing a
	 list of cursors.
	 By default, the Xserver assumes at least one cursor is provided while a
	 client may actually pass no cursor at all, which causes an out-of-bound
	 read creating the animated cursor and a crash of the Xserver.
	 </li>
	 <li>
	 CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode)

The handler of XFixesSetClientDisconnectMode does not check the client
	 request length.
	 A client could send a shorter request and read data from a former
	 request.
	 </li>
	 <li>
	 CVE-2025-49178: Unprocessed client request via bytes to ignore

When reading requests from the clients, the input buffer might be shared
	 and used between different clients.
	 If a given client sends a full request with non-zero bytes to ignore,
	 the bytes to ignore may still be non-zero even though the request is
	 full, in which case the buffer could be shared with another client who's
	 request will not be processed because of those bytes to ignore, leading
	 to a possible hang of the other client request.
	 </li>
	 <li>
	 CVE-2025-49179: Integer overflow in X Record extension

The RecordSanityCheckRegisterClients() function in the X Record extension
	 implementation of the Xserver checks for the request length, but does not
	 check for integer overflow.
	 A client might send a very large value for either the number of clients
	 or the number of protocol ranges that will cause an integer overflow in
	 the request length computation, defeating the check for request length.
	 </li>
	 <li>
	 CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty)

A client might send a request causing an integer overflow when computing
	 the total size to allocate in RRChangeProviderProperty().
	 </li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-49175</cvename>
 <cvename>CVE-2025-49177</cvename>
 <cvename>CVE-2025-49178</cvename>
 <cvename>CVE-2025-49179</cvename>
 <cvename>CVE-2025-49180</cvename>
 <url>https://lists.x.org/archives/xorg/2025-June/062055.html</url>
 </references>
 <dates>
 <discovery>2025-06-17</discovery>
 <entry>2025-07-01</entry>
 </dates>
 </vuln>

<vuln vid="6b1b8989-55b0-11f0-ac64-589cfc10a551">
 <topic>podman -- TLS connection used to pull VM images was not validated</topic>
 <affects>
 <package>
	<name>podman</name>
	<range><lt>5.5.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	RedHat, Inc. reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2025-6032">
	 A flaw was found in Podman. The podman machine init command fails to verify the TLS
	 certificate when downloading the VM images from an OCI registry. This issue results
	 in a Man In The Middle attack.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6032</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6032</url>
 </references>
 <dates>
 <discovery>2025-06-30</discovery>
 <entry>2025-06-30</entry>
 </dates>
 </vuln>

<vuln vid="5e64770c-52aa-11f0-b522-b42e991fc52e">
 <topic>MongoDB -- Running certain aggregation operations with the SBE engine may lead to unexpected behavior</topic>
 <affects>
 <package>
	<name>mongodb60</name>
	<range><lt>6.0.21</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.17</lt></range>
 </package>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@mongodb.com reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-106746">
	 An authenticated user may trigger a use after free that may result
	in MongoDB Server crash and other unexpected behavior, even if the
	user does not have authorization to shut down a server. The crash
	is triggered on affected versions by issuing an aggregation framework
	operation using a specific combination of rarely-used aggregation
	pipeline expressions. This issue affects MongoDB Server v6.0 version
	prior to 6.0.21, MongoDB Server v7.0 version prior to 7.0.17 and
	MongoDB Server v8.0 version prior to 8.0.4 when the SBE engine is
	enabled.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6706</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6706</url>
 </references>
 <dates>
 <discovery>2025-06-26</discovery>
 <entry>2025-06-26</entry>
 </dates>
 </vuln>

<vuln vid="5cd2bd2b-52aa-11f0-b522-b42e991fc52e">
 <topic>MongoDB -- Race condition in privilege cache invalidation cycle</topic>
 <affects>
 <package>
	<name>mongodb50</name>
	<range><lt>5.0.31</lt></range>
 </package>
 <package>
	<name>mongodb60</name>
	<range><lt>6.0.24</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.21</lt></range>
 </package>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2025-6707">
	 Under certain conditions, an authenticated user request
	 may execute with stale privileges following an intentional
	 change by an authorized administrator.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6707</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6707</url>
 </references>
 <dates>
 <discovery>2025-06-26</discovery>
 <entry>2025-06-26</entry>
 </dates>
 </vuln>

<vuln vid="5b87eef6-52aa-11f0-b522-b42e991fc52e">
 <topic>MongoDB -- Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication</topic>
 <affects>
 <package>
	<name>mongodb60</name>
	<range><lt>6.0.21</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.17</lt></range>
 </package>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2025-6709">
	 The MongoDB Server is susceptible to a denial of service
	 vulnerability due to improper handling of specific date
	 values in JSON input when using OIDC authentication.
	 This can be reproduced using the mongo shell to send a
	 malicious JSON payload leading to an invariant failure
	 and server crash. 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6709</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6709</url>
 </references>
 <dates>
 <discovery>2025-06-26</discovery>
 <entry>2025-06-26</entry>
 </dates>
 </vuln>

<vuln vid="59ed4b19-52aa-11f0-b522-b42e991fc52e">
 <topic>MongoDB -- Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB</topic>
 <affects>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.17</lt></range>
 </package>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@mongodb.com reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-106749">
	 MongoDB Server may be susceptible to stack overflow due to JSON
	parsing mechanism, where specifically crafted JSON inputs may induce
	unwarranted levels of recursion, resulting in excessive stack space
	consumption. Such inputs can lead to a stack overflow that causes
	the server to crash which could occur pre-authorisation. This issue
	affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB
	Server v8.0 versions prior to 8.0.5.
	The same issue affects MongoDB Server v6.0 versions prior to 6.0.21,
	but an attacker can only induce denial of service after authenticating.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-6710</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-6710</url>
 </references>
 <dates>
 <discovery>2025-06-26</discovery>
 <entry>2025-06-26</entry>
 </dates>
 </vuln>

<vuln vid="e26608ff-5266-11f0-b522-b42e991fc52e">
 <topic>kanboard -- Password Reset Poisoning via Host Header Injection</topic>
 <affects>
 <package>
	<name>kanboard</name>
	<range><lt>1.2.45</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	GitHub Security Advisories reports:
	<blockquote cite="null">
	
	Kanboard allows password reset emails to be sent with URLs
	derived from the unvalidated Host header when the
	application_url configuration is unset (default behavior).
	This allows an attacker to craft a malicious password
	reset link that leaks the token to an attacker-controlled
	domain. If a victim (including an administrator) clicks
	the poisoned link, their account can be taken over. This
	affects all users who initiate a password reset while
	application_url is not set.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-52560</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-52560</url>
 </references>
 <dates>
 <discovery>2025-06-26</discovery>
 <entry>2025-06-26</entry>
 </dates>
 </vuln>

<vuln vid="d45dabd9-5232-11f0-9ca4-2cf05da270f3">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.1.0</ge><lt>18.1.1</lt></range>
	<range><ge>18.0.0</ge><lt>18.0.3</lt></range>
	<range><ge>16.10.0</ge><lt>17.11.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/06/25/patch-release-gitlab-18-1-1-released/">
	 Denial of Service impacts GitLab CE/EE
	 Missing Authentication issue impacts GitLab CE/EE
	 Improper access control issue impacts GitLab CE/EE
	 Elevation of Privilege impacts GitLab CE/EE
	 Improper access control issue impacts GitLab EE
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3279</cvename>
 <cvename>CVE-2025-1754</cvename>
 <cvename>CVE-2025-5315</cvename>
 <cvename>CVE-2025-2938</cvename>
 <cvename>CVE-2025-5846</cvename>
 <url>https://about.gitlab.com/releases/2025/06/25/patch-release-gitlab-18-1-1-released/</url>
 </references>
 <dates>
 <discovery>2025-06-25</discovery>
 <entry>2025-06-26</entry>
 </dates>
 </vuln>

<vuln vid="03ba1cdd-4faf-11f0-af06-00a098b42aeb">
 <topic>cisco -- OpenH264 Decoding Functions Heap Overflow Vulnerability</topic>
 <affects>
 <package>
	<name>openh264</name>
	<range><lt>2.5.1,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Cisco reports:
	<blockquote cite="https://github.com/cisco/openh264/releases/tag/2.5.1">
	 A vulnerability in the decoding functions
	of OpenH264 codec library could allow a remote, unauthenticated
	attacker to trigger a heap overflow. This vulnerability is due to
	a race condition between a Sequence Parameter Set (SPS) memory
	allocation and a subsequent non Instantaneous Decoder Refresh
	(non-IDR) Network Abstraction Layer (NAL) unit memory usage. An
	attacker could exploit this vulnerability by crafting a malicious
	bitstream and tricking a victim user into processing an arbitrary
	video containing the malicious bistream. An exploit could allow
	the attacker to cause an unexpected crash in the victim's user
	decoding client and, possibly, perform arbitrary commands on the
	victim's host by abusing the heap overflow.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-27091</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-27091</url>
 </references>
 <dates>
 <discovery>2025-02-20</discovery>
 <entry>2025-06-22</entry>
 </dates>
 </vuln>

<vuln vid="6c6c1507-4da5-11f0-afcc-f02f7432cf97">
 <topic>clamav -- ClamAV UDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><ge>1.2.0,1</ge><lt>1.4.3,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Cisco reports:
	<blockquote cite="https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html">
	 A vulnerability in Universal Disk Format (UDF) processing of ClamAV
	could allow an unauthenticated, remote attacker to cause a denial
	of service (DoS) condition on an affected device.

This vulnerability is due to a memory overread during UDF file
	scanning. An attacker could exploit this vulnerability by submitting
	a crafted file containing UDF content to be scanned by ClamAV on
	an affected device. A successful exploit could allow the attacker
	to terminate the ClamAV scanning process, resulting in a DoS condition
	on the affected software. For a description of this vulnerability,
	see the .
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-20234</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-20234</url>
 </references>
 <dates>
 <discovery>2025-06-18</discovery>
 <entry>2025-06-20</entry>
 </dates>
 </vuln>

<vuln vid="3dcc0812-4da5-11f0-afcc-f02f7432cf97">
 <topic>clamav -- ClamAV PDF Scanning Buffer Overflow Vulnerability</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>1.4.3,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Cisco reports:
	<blockquote cite="https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html">
	 A vulnerability in the PDF scanning processes of ClamAV could allow
	an unauthenticated, remote attacker to cause a buffer overflow
	condition, cause a denial of service (DoS) condition, or execute
	arbitrary code on an affected device.

This vulnerability exists because memory buffers are allocated
	incorrectly when PDF files are processed. An attacker could exploit
	this vulnerability by submitting a crafted PDF file to be scanned
	by ClamAV on an affected device. A successful exploit could allow
	the attacker to trigger a buffer overflow, likely resulting in the
	termination of the ClamAV scanning process and a DoS condition on
	the affected software.	Although unproven, there is also a possibility
	that an attacker could leverage the buffer overflow to execute
	arbitrary code with the privileges of the ClamAV process.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-20260</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-20260</url>
 </references>
 <dates>
 <discovery>2025-06-18</discovery>
 <entry>2025-06-20</entry>
 </dates>
 </vuln>

<vuln vid="333b4663-4cde-11f0-8cb5-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>137.0.7151.119</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>137.0.7151.119</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_17.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[420697404] High CVE-2025-6191: Integer overflow in V8. Reported by Shaheen Fazim on 2025-05-27</li>
	 <li>[421471016] High CVE-2025-6192: Use after free in Profiler. Reported by Chaoyuan Peng (@ret2happy) on 2025-05-31</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-6191</cvename>
 <cvename>CVE-2025-6192</cvename>
 <url>https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_17.html</url>
 </references>
 <dates>
 <discovery>2025-06-17</discovery>
 <entry>2025-06-19</entry>
 </dates>
 </vuln>

<vuln vid="fc2d2fb8-4c83-11f0-8deb-f8f21e52f724">
 <topic>Navidrome -- SQL Injection via role parameter</topic>
 <affects>
 <package>
	<name>navidrome</name>
	<range><gt>0.55.0</gt><lt>0.56.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Deluan reports:
	<blockquote cite="https://github.com/navidrome/navidrome/security/advisories/GHSA-5wgp-vjxm-3x2r">
	 This vulnerability arises due to improper input validation on the role parameter within the API endpoint /api/artist. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-48949</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-48949</url>
 </references>
 <dates>
 <discovery>2025-05-29</discovery>
 <entry>2025-06-18</entry>
 </dates>
 </vuln>

<vuln vid="6548cb01-4c33-11f0-8a97-6c3be5272acd">
 <topic>Grafana -- DingDing contact points exposed in Grafana Alerting</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><lt>10.4.19+security-01</lt></range>
	<range><ge>11.0.0</ge><lt>11.2.10+security-01</lt></range>
	<range><ge>11.3.0</ge><lt>11.3.7+security-01</lt></range>
	<range><ge>11.4.0</ge><lt>11.4.5+security-01</lt></range>
	<range><ge>11.5.0</ge><lt>11.5.5+security-01</lt></range>
	<range><ge>11.6.0</ge><lt>11.6.2+security-01</lt></range>
	<range><ge>12.0.0</ge><lt>12.0.1+security-01</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.0.0</ge></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2025/06/13/grafana-security-update-medium-severity-security-release-for-cve-2025-3415/">
	 An incident occurred where the DingDing alerting integration URL
	 was inadvertently exposed to viewers due to a setting oversight,
	 which we learned about through a <a href="https://grafana.com/blog/2023/05/04/introducing-the-grafana-labs-bug-bounty-program/">bug bounty report</a>.
	 The CVSS 3.0 score for this vulnerability is 4.3 (Medium).
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3415</cvename>
 <url>https://grafana.com/blog/2025/06/13/grafana-security-update-medium-severity-security-release-for-cve-2025-3415/</url>
 </references>
 <dates>
 <discovery>2025-04-05</discovery>
 <entry>2025-06-18</entry>
 </dates>
 </vuln>

<vuln vid="ee046f5d-37a8-11f0-baaa-6c3be5272acd">
 <topic>Grafana -- User deletion issue</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>5.4.0</ge><lt>10.4.18+security-01</lt></range>
	<range><ge>11.0.0</ge><lt>11.2.9+security-01</lt></range>
	<range><ge>11.3.0</ge><lt>11.3.6+security-01</lt></range>
	<range><ge>11.4.0</ge><lt>11.4.4+security-01</lt></range>
	<range><ge>11.5.0</ge><lt>11.5.4+security-01</lt></range>
	<range><ge>11.6.0</ge><lt>11.6.1+security-01</lt></range>
	<range><ge>12.0.0</ge><lt>12.0.0+security-01</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.0.0</ge></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580/">
	 On April 15, we discovered a vulnerability that stems from the user
	 deletion logic associated with organization administrators.
	 An organization admin could remove any user from the specific
	 organization they manage. Additionally, they have the power to delete
	 users entirely from the system if they have no other org membership.
	 This leads to two situations:
	 <ol>
	 <li>They can delete a server admin if the organization
	 the Organization Admin manages is the server admin’s final
	 organizational membership.</li>
	 <li>They can delete any user (regardless of whether they are a server
	 admin or not) if that user currently belongs to no organizations.</li>
	 </ol>
	 These two situations allow an organization manager to disrupt
	 instance-wide activity by continually deleting server administrators
	 if there is only one organization or if the server administrators are
	 not part of any organization.
	 The CVSS score for this vulnerability is 5.5 Medium.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3580</cvename>
 <url>https://grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580/</url>
 </references>
 <dates>
 <discovery>2025-04-15</discovery>
 <entry>2025-05-23</entry>
 </dates>
 </vuln>

<vuln vid="b704d4b8-4b87-11f0-9605-b42e991fc52e">
 <topic>Firefox -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>139.0.4,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1970095">
	 CVE-2025-49709: Certain canvas operations could have lead
	 to memory corruption.
	 CVE-2025-49710: An integer overflow was present in
	 `OrderedHashTable` used by the JavaScript engine.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-49709</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-49709</url>
 <cvename>CVE-2025-49710</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-49710</url>
 </references>
 <dates>
 <discovery>2025-06-11</discovery>
 <entry>2025-06-17</entry>
 </dates>
 </vuln>

<vuln vid="e3d6d485-c93c-4ada-90b3-09f1c454fb8a">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>137.0.7151.103</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>137.0.7151.103</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_10.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[$8000][420150619] High CVE-2025-5958: Use after free in Media. Reported by Huang Xilin of Ant Group Light-Year Security Lab on 2025-05-25</li>
	 <li>[NA][422313191] High CVE-2025-5959: Type Confusion in V8. Reported by Seunghyun Lee as part of TyphoonPWN 2025 on 2025-06-04</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-5958</cvename>
 <cvename>CVE-2025-5959</cvename>
 <url>https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_10.html</url>
 </references>
 <dates>
 <discovery>2025-06-10</discovery>
 <entry>2025-06-17</entry>
 </dates>
 </vuln>

<vuln vid="4323e86c-2422-4fd7-8c8f-ec71c81ea7dd">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>137.0.7151.68</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>137.0.7151.68</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[420636529] High CVE-2025-5419: Out of bounds read and write in V8. Reported by Clement Lecigne and Benoît Sevens of Google Threat Analysis Group on 2025-05-27. This issue was mitigated on 2025-05-28 by a configuration change pushed out to Stable across all Chrome platforms.</li>
	 <li>[409059706] Medium CVE-2025-5068: Use after free in Blink. Reported by Walkman on 2025-04-07</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-5419</cvename>
 <cvename>CVE-2025-5068</cvename>
 <url>https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2025-06-02</discovery>
 <entry>2025-06-17</entry>
 </dates>
 </vuln>

<vuln vid="201cccc1-4a01-11f0-b0f8-b42e991fc52e">
 <topic>Mozilla -- control access bypass</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>138.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.10</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1917536">
	 Thunderbird's update mechanism allowed a medium-integrity user
	process to interfere with the SYSTEM-level updater by manipulating
	the file-locking behavior. By injecting code into the user-privileged
	process, an attacker could bypass intended access controls, allowing
	SYSTEM-level file operations on paths controlled by a non-privileged
	user and enabling privilege escalation. This vulnerability affects
	Firefox &lt; 138, Firefox ESR &lt; 128.10, Firefox ESR &lt; 115.23,
	Thunderbird &lt; 138, and Thunderbird &lt; 128.10.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-2817</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-2817</url>
 </references>
 <dates>
 <discovery>2025-04-29</discovery>
 <entry>2025-06-15</entry>
 </dates>
 </vuln>

<vuln vid="805ad2e0-49da-11f0-87e8-bcaec55be5e5">
 <topic>webmin -- CGI Command Injection Remote Code Execution</topic>
 <affects>
 <package>
	<name>webmin</name>
	<range><le>2.105</le></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Webmin reports:
	<blockquote cite="https://webmin.com/security/">
	 A less-privileged Webmin user can execute commands as root via a vulnerability in the shell autocomplete feature.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-12828</cvename>
 <url>https://webmin.com/security/</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-12828</url>
 </references>
 <dates>
 <discovery>2024-12-30</discovery>
 <entry>2025-06-15</entry>
 </dates>
 </vuln>

<vuln vid="9449f018-84a3-490d-959f-38c05fbc77a7">
 <topic>Yelp -- arbitrary file read</topic>
 <affects>
 <package>
	<name>yelp-xsl</name>
	<range><lt>42.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	secalert@redhat.com reports:
	<blockquote cite="https://access.redhat.com/errata/RHSA-2025:4450">
	 A flaw was found in Yelp.	The Gnome user help application allows
	the help document to execute arbitrary scripts. This vulnerability
	allows malicious users to input help documents, which may exfiltrate
	user files to an external environment.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3155</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-3155</url>
 </references>
 <dates>
 <discovery>2025-04-03</discovery>
 <entry>2025-06-14</entry>
 </dates>
 </vuln>

<vuln vid="0e200a73-289a-489e-b405-40b997911036">
 <topic>Yelp -- arbitrary file read</topic>
 <affects>
 <package>
	<name>yelp</name>
	<range><lt>42.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	secalert@redhat.com reports:
	<blockquote cite="https://access.redhat.com/errata/RHSA-2025:4450">
	 A flaw was found in Yelp.	The Gnome user help application allows
	the help document to execute arbitrary scripts. This vulnerability
	allows malicious users to input help documents, which may exfiltrate
	user files to an external environment.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3155</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-3155</url>
 </references>
 <dates>
 <discovery>2025-04-03</discovery>
 <entry>2025-06-14</entry>
 </dates>
 </vuln>

<vuln vid="ae028662-475e-11f0-9ca4-2cf05da270f3">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.0.0</ge><lt>18.0.2</lt></range>
	<range><ge>17.11.0</ge><lt>17.11.4</lt></range>
	<range><ge>2.1.0</ge><lt>17.10.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/06/11/patch-release-gitlab-18-0-2-released/">
	 HTML injection impacts GitLab CE/EE
	 Cross-site scripting issue impacts GitLab CE/EE
	 Missing authorization issue impacts GitLab Ultimate EE
	 Denial of Service impacts GitLab CE/EE
	 Denial of Service via unbounded Webhook token names impacts GitLab CE/EE
	 Denial of Service via unbounded Board Names impacts GitLab CE/EE
	 Information disclosure issue impacts GitLab CE/EE
	 Denial of Service (DoS) via uncontrolled HTTP Response Processing impacts GitLab CE/EE
	 Information disclosure via authorization bypass impacts GitLab CE/EE
	 Sensitive information disclosure via Group IP restriction bypass
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4278</cvename>
 <cvename>CVE-2025-2254</cvename>
 <cvename>CVE-2025-5121</cvename>
 <cvename>CVE-2025-0673</cvename>
 <cvename>CVE-2025-1516</cvename>
 <cvename>CVE-2025-1478</cvename>
 <cvename>CVE-2024-9512</cvename>
 <cvename>CVE-2025-5996</cvename>
 <cvename>CVE-2025-5195</cvename>
 <cvename>CVE-2025-5982</cvename>
 <url>https://about.gitlab.com/releases/2025/06/11/patch-release-gitlab-18-0-2-released/</url>
 </references>
 <dates>
 <discovery>2025-06-11</discovery>
 <entry>2025-06-12</entry>
 </dates>
 </vuln>

<vuln vid="2a220a73-4759-11f0-a44a-6cc21735f730">
 <topic>PostgreSQL JDBC library -- Improper Authentication</topic>
 <affects>
 <package>
	<name>postgresql-jdbc</name>
	<range><lt>42.7.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL JDBC Driver project reports:
	<blockquote cite="https://jdbc.postgresql.org/changelogs/2025-06-11-42">
	
	Client Allows Fallback to Insecure Authentication Despite
	channelBinding=require configuration. Fix channel binding
	required handling to reject non-SASL authentication Previously,
	when channel binding was set to "require", the driver
	would silently ignore this requirement for non-SASL
	authentication methods. This could lead to a false sense of
	security when channel binding was explicitly requested but not
	actually enforced. The fix ensures that when channel binding is
	set to "require", the driver will reject connections that use
	non-SASL authentication methods or when SASL authentication has
	not completed properly.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-49146</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-49146</url>
 </references>
 <dates>
 <discovery>2025-06-12</discovery>
 <entry>2025-06-12</entry>
 </dates>
 </vuln>

<vuln vid="fa1d42c8-42fe-11f0-a9fa-b42e991fc52e">
 <topic>ModSecurity -- possible DoS vulnerability</topic>
 <affects>
 <package>
	<name>ap24-mod_security</name>
	<range><lt>2.9.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/owasp-modsecurity/ModSecurity/commit/3a54ccea62d3f7151bb08cb78d60c5e90b53ca2e">
	
		ModSecurity is an open source, cross platform web
		application firewall (WAF) engine for Apache, IIS
		and Nginx. Versions prior to 2.9.10 contain a denial of
		service vulnerability similar to
		GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg`
		(and `sanitizeArg` - this is the same action but an
		alias) is vulnerable to adding an excessive number
		of arguments, thereby leading to denial of service.
		Version 2.9.10 fixes the issue. As a workaround, avoid
		using rules that contain the `sanitiseArg` (or
		`sanitizeArg`) action.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-48866</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-48866</url>
 </references>
 <dates>
 <discovery>2025-06-02</discovery>
 <entry>2025-06-06</entry>
 </dates>
 </vuln>

<vuln vid="ecea70d2-42fe-11f0-a9fa-b42e991fc52e">
 <topic>ModSecurity -- possible DoS vulnerability</topic>
 <affects>
 <package>
	<name>ap24-mod_security</name>
	<range><lt>2.9.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/owasp-modsecurity/ModSecurity/pull/3389">
	 ModSecurity is an open source, cross platform web
	 application firewall (WAF) engine for Apache, IIS and Nginx.
	 Versions up to and including 2.9.8 are vulnerable to denial
	 of service in one special case (in stable released versions):
	 when the payload's content type is `application/json`,
	 and there is at least one rule which does a
	 `sanitiseMatchedBytes` action. A patch is available at
	 pull request 3389 and expected to be part of version 2.9.9.
	 No known workarounds are available.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-47947</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-47947</url>
 </references>
 <dates>
 <discovery>2025-05-21</discovery>
 <entry>2025-06-06</entry>
 </dates>
 </vuln>

<vuln vid="63268efe-4222-11f0-976e-b42e991fc52e">
 <topic>Mozilla -- clickjacking vulnerability</topic>
 <affects>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.11.0</lt></range>
 </package>
 <package>
	<name>firefox</name>
	<range><lt>139.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1954137">
	 A clickjacking vulnerability could have been used to trick a user
	into leaking saved payment card details to a malicious page.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5267</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-5267</url>
 </references>
 <dates>
 <discovery>2025-05-27</discovery>
 <entry>2025-06-05</entry>
 </dates>
 </vuln>

<vuln vid="61be5684-4222-11f0-976e-b42e991fc52e">
 <topic>Mozilla -- XS-leak attack</topic>
 <affects>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.11.0</lt></range>
 </package>
 <package>
	<name>firefox</name>
	<range><lt>139.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1965628">
	 Script elements loading cross-origin resources generated load and
	error events which leaked information enabling XS-Leaks attacks.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5266</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-5266</url>
 </references>
 <dates>
 <discovery>2025-05-27</discovery>
 <entry>2025-06-05</entry>
 </dates>
 </vuln>

<vuln vid="5ec0b4e5-4222-11f0-976e-b42e991fc52e">
 <topic>Mozilla -- local code execution</topic>
 <affects>
 <package>
	<name>firefox-esr</name>
	<range><lt>115.24.0</lt></range>
 </package>
 <package>
	<name>firefox</name>
	<range><lt>139.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1950001">
	 Due to insufficient escaping of the newline character in the Copy
	as cURL feature, an attacker could trick a user into using this
	command, potentially leading to local code execution on the user's
	system.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5264</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-5264</url>
 </references>
 <dates>
 <discovery>2025-05-27</discovery>
 <entry>2025-06-05</entry>
 </dates>
 </vuln>

<vuln vid="5d1e56dc-4222-11f0-976e-b42e991fc52e">
 <topic>Mozilla -- cross-origin leak attack</topic>
 <affects>
 <package>
	<name>firefox-esr</name>
	<range><lt>115.24.0</lt></range>
 </package>
 <package>
	<name>firefox</name>
	<range><lt>139.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1960745">
	 Error handling for script execution was incorrectly isolated from
	web content, which could have allowed cross-origin leak attacks.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5263</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-5263</url>
 </references>
 <dates>
 <discovery>2025-05-27</discovery>
 <entry>2025-06-05</entry>
 </dates>
 </vuln>

<vuln vid="5759c6e2-410a-11f0-a945-b42e991fc52e">
 <topic>Chrome -- Out of bounds read</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>137.0.7151.68</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	chrome-cve-admin@google.com reports:
	<blockquote cite="https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html">
	 Out of bounds read and write in V8 in Google Chrome prior
	 to 137.0.7151.68 allowed a remote attacker to potentially
	 exploit heap corruption via a crafted HTML page.
	 (Chromium security severity: High)
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5419</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-5419</url>
 </references>
 <dates>
 <discovery>2025-06-03</discovery>
 <entry>2025-06-04</entry>
 </dates>
 </vuln>

<vuln vid="8c94ae2a-06f5-4383-9a7f-1211cb0dd476">
 <topic>electron{34,35,36} -- Out of bounds read and write in V8</topic>
 <affects>
 <package>
	<name>electron34</name>
	<range><lt>34.5.8</lt></range>
 </package>
 <package>
	<name>electron35</name>
	<range><lt>35.5.1</lt></range>
 </package>
 <package>
	<name>electron36</name>
	<range><lt>36.4.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v35.5.1">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2025-5419.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5419</cvename>
 <url>https://github.com/advisories/GHSA-x828-wp24-7h9m</url>
 </references>
 <dates>
 <discovery>2025-06-04</discovery>
 <entry>2025-06-04</entry>
 <modified>2025-06-04</modified>
 </dates>
 </vuln>

<vuln vid="0d6094a2-4095-11f0-8c92-00d861a0e66d">
 <topic>Post-Auth Remote Code Execution found in Roundcube Webmail</topic>
 <affects>
 <package>
	<name>roundcube-php81</name>
	<range><lt>1.6.11</lt></range>
 </package>
 <package>
	<name>roundcube-php82</name>
	<range><lt>1.6.11</lt></range>
 </package>
 <package>
	<name>roundcube-php83</name>
	<range><lt>1.6.11</lt></range>
 </package>
 <package>
	<name>roundcube-php84</name>
	<range><lt>1.6.11</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Roundcube Webmail reports:
	<blockquote cite="https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10">
	 Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-49113</cvename>
 <url>https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10</url>
 </references>
 <dates>
 <discovery>2025-06-01</discovery>
 <entry>2025-06-03</entry>
 </dates>
 </vuln>

<vuln vid="dc99c67a-3fc9-11f0-a39d-b42e991fc52e">
 <topic>Gimp -- GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability</topic>
 <affects>
 <package>
	<name>gimp</name>
	<range><lt>3.0.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	zdi-disclosures@trendmicro.com reports:
	<blockquote cite="https://www.zerodayinitiative.com/advisories/ZDI-25-204/">
	 GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution
	Vulnerability.	This vulnerability allows remote attackers to execute
	arbitrary code on affected installations of GIMP. User interaction
	is required to exploit this vulnerability in that the target must
	visit a malicious page or open a malicious file.
	The specific flaw exists within the parsing of FLI files. The issue
	results from the lack of proper validation of user-supplied data,
	which can result in a write past the end of an allocated buffer.
	An attacker can leverage this vulnerability to execute code in the
	context of the current process. Was ZDI-CAN-25100.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-2761</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-2761</url>
 </references>
 <dates>
 <discovery>2025-04-23</discovery>
 <entry>2025-06-02</entry>
 </dates>
 </vuln>

<vuln vid="da0a4374-3fc9-11f0-a39d-b42e991fc52e">
 <topic>Gimp -- GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability</topic>
 <affects>
 <package>
	<name>gimp</name>
	<range><lt>3.0.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	zdi-disclosures@trendmicro.com reports:
	<blockquote cite="https://www.zerodayinitiative.com/advisories/ZDI-25-203/">
	 GIMP XWD File Parsing Integer Overflow Remote Code Execution
	Vulnerability.	This vulnerability allows remote attackers to execute
	arbitrary code on affected installations of GIMP. User interaction
	is required to exploit this vulnerability in that the target must
	visit a malicious page or open a malicious file.
	The specific flaw exists within the parsing of XWD files. The issue
	results from the lack of proper validation of user-supplied data,
	which can result in an integer overflow before allocating a buffer.
	An attacker can leverage this vulnerability to execute code in the
	context of the current process. Was ZDI-CAN-25082.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-2760</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-2760</url>
 </references>
 <dates>
 <discovery>2025-04-23</discovery>
 <entry>2025-06-02</entry>
 </dates>
 </vuln>

<vuln vid="533b4470-3f25-11f0-b440-f02f7432cf97">
 <topic>curl -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>8.5.0</ge><lt>8.14.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	curl security team reports:
	<blockquote cite="https://curl.se/docs/security.html">
	 CVE-2025-5025: No QUIC certificate pinning with wolfSSL
	 CVE-2025-4947: QUIC certificate check skip with wolfSSL
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-5025</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-5025</url>
 <cvename>CVE-2025-4947</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-4947</url>
 </references>
 <dates>
 <discovery>2025-05-28</discovery>
 <entry>2025-06-01</entry>
 </dates>
 </vuln>

<vuln vid="2926c487-3e53-11f0-95d4-00a098b42aeb">
 <topic>libxml2 -- Out-of-bounds memory access</topic>
 <affects>
 <package>
	<name>py39-libxml2</name>
	<name>py310-libxml2</name>
	<name>py311-libxml2</name>
	<name>py312-libxml2</name>
	<range><lt>2.11.9_3</lt></range>
	<range><ge>2.12.0</ge><lt>2.13.8</lt></range>
	<range><ge>2.14.0</ge><lt>2.14.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://gitlab.gnome.org/GNOME/libxml2/-/issues/889">
	 In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds
	memory access can occur in the Python API (Python bindings) because
	of an incorrect return value. This occurs in xmlPythonFileRead and
	xmlPythonFileReadRaw because of a difference between bytes and
	characters.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-32414</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-32414</url>
 </references>
 <dates>
 <discovery>2025-04-08</discovery>
 <entry>2025-05-31</entry>
 </dates>
 </vuln>

<vuln vid="fdd02be0-3e50-11f0-95d4-00a098b42aeb">
 <topic>libxml2 -- Stack-based Buffer Overflow</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.11.9_1</lt></range>
	<range><ge>2.12.0</ge><lt>2.12.10</lt></range>
	<range><ge>2.13.0</ge><lt>2.13.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://gitlab.gnome.org/GNOME/libxml2/-/issues/847">
	 libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based
	buffer overflow in xmlSnprintfElements in valid.c. To exploit this,
	DTD validation must occur for an untrusted document or untrusted
	DTD. NOTE: this is similar to CVE-2017-9047.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-24928</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-24928</url>
 </references>
 <dates>
 <discovery>2025-02-18</discovery>
 <entry>2025-05-31</entry>
 </dates>
 </vuln>

<vuln vid="bd2af307-3e50-11f0-95d4-00a098b42aeb">
 <topic>libxml2 -- Use After Free</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.11.9_1</lt></range>
	<range><ge>2.12.0</ge><lt>2.12.10</lt></range>
	<range><ge>2.13.0</ge><lt>2.13.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://gitlab.gnome.org/GNOME/libxml2/-/issues/828">
	 libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free
	in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in
	xmlschemas.c. To exploit this, a crafted XML document must be
	validated against an XML schema with certain identity constraints,
	or a crafted XML schema must be used.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-56171</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-56171</url>
 </references>
 <dates>
 <discovery>2025-02-18</discovery>
 <entry>2025-05-31</entry>
 </dates>
 </vuln>

<vuln vid="25acd603-3dde-11f0-8cb5-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>137.0.7151.55</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>137.0.7151.55</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_27.html">
	 This update includes 11 security fixes:
	 <ul>
	 <li>[411573532] High CVE-2025-5063: Use after free in Compositing. Reported by Anonymous on 2025-04-18</li>
	 <li>[417169470] High CVE-2025-5280: Out of bounds write in V8. Reported by [pwn2car] on 2025-05-12</li>
	 <li>[40058068] Medium CVE-2025-5064: Inappropriate implementation in Background Fetch API. Reported by Maurice Dauer on 2021-11-29</li>
	 <li>[40059071] Medium CVE-2025-5065: Inappropriate implementation in FileSystemAccess API. Reported by NDevTK on 2022-03-11</li>
	 <li>[356658477] Medium CVE-2025-5066: Inappropriate implementation in Messages. Reported by Mohit Raj (shadow2639)	on 2024-07-31</li>
	 <li>[417215501] Medium CVE-2025-5281: Inappropriate implementation in BFCache. Reported by Jesper van den Ende (Pelican Party Studios) on 2025-05-12</li>
	 <li>[419467315] Medium CVE-2025-5283: Use after free in libvpx. Reported by Mozilla on 2025-05-22</li>
	 <li>[40075024] Low CVE-2025-5067: Inappropriate implementation in Tab Strip. Reported by Khalil Zhani on 2023-10-17</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-5063</cvename>
 <cvename>CVE-2025-5280</cvename>
 <cvename>CVE-2025-5064</cvename>
 <cvename>CVE-2025-5065</cvename>
 <cvename>CVE-2025-5066</cvename>
 <cvename>CVE-2025-5281</cvename>
 <cvename>CVE-2025-5283</cvename>
 <cvename>CVE-2025-5067</cvename>
 <url>https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_27.html</url>
 </references>
 <dates>
 <discovery>2025-05-27</discovery>
 <entry>2025-05-31</entry>
 </dates>
 </vuln>

<vuln vid="4864aec7-3d80-11f0-9a55-b42e991fc52e">
 <topic>Chrome -- Heap corruption exploitation</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>137.0.7151.55</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	chrome-cve-admin@google.com reports:
	<blockquote cite="https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_27.html">
	 Use after free in Compositing in Google Chrome prior to
	 137.0.7151.55 allowed a remote attacker to potentially
	 exploit heap corruption via a crafted HTML page.
	 (Chromium security severity: High)
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5063</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-5063</url>
 </references>
 <dates>
 <discovery>2025-05-27</discovery>
 <entry>2025-05-30</entry>
 </dates>
 </vuln>

<vuln vid="a6e1b7ee-3d7c-11f0-9a55-b42e991fc52e">
 <topic>Mozilla -- memory corruption</topic>
 <affects>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.11.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.11.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1924108">
	 Memory safety bug present in Firefox ESR 128.10, and
	 Thunderbird 128.10.
	 This bug showed evidence of memory corruption and we presume
	 that with enough effort this could have been exploited to run
	 arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5269</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-5269</url>
 </references>
 <dates>
 <discovery>2025-05-27</discovery>
 <entry>2025-05-30</entry>
 </dates>
 </vuln>

<vuln vid="a5b553e5-3d7c-11f0-9a55-b42e991fc52e">
 <topic>Mozilla -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>139.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.11</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.11</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1950136%2C1958121%2C1960499%2C1962634">
	 Memory safety bugs present in Firefox 138, Thunderbird
	 138, Firefox ESR 128.10, and Thunderbird 128.10.
	 Some of these bugs showed evidence of memory corruption and
	 we presume that with enough effort some of these could have
	 been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5268</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-5268</url>
 </references>
 <dates>
 <discovery>2025-05-27</discovery>
 <entry>2025-05-30</entry>
 </dates>
 </vuln>

<vuln vid="a470ac63-3d7c-11f0-9a55-b42e991fc52e">
 <topic>Firefox -- unencrypted SNI</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>139.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1910298">
	 In certain cases, SNI could have been sent unencrypted
	 even when encrypted DNS was enabled.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5270</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-5270</url>
 </references>
 <dates>
 <discovery>2025-05-27</discovery>
 <entry>2025-05-30</entry>
 </dates>
 </vuln>

<vuln vid="a3291f81-3d7c-11f0-9a55-b42e991fc52e">
 <topic>Firefox -- content injection attack</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>139.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1920348">
	 Previewing a response in Devtools ignored CSP headers,
	 which could have allowed content injection attacks.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5271</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-5271</url>
 </references>
 <dates>
 <discovery>2025-05-27</discovery>
 <entry>2025-05-30</entry>
 </dates>
 </vuln>

<vuln vid="a14dbea7-3d7c-11f0-9a55-b42e991fc52e">
 <topic>Mozilla -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>139.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>129.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1726254%2C1742738%2C1960121">
	 Memory safety bugs present in Firefox 138 and Thunderbird
	 138. Some of these bugs showed evidence of memory corruption
	 and we presume that with enough effort some of these could
	 have been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-5272</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-5272</url>
 </references>
 <dates>
 <discovery>2025-05-27</discovery>
 <entry>2025-05-30</entry>
 </dates>
 </vuln>

<vuln vid="a372abb0-3d3c-11f0-86e7-b42e991fc52e">
 <topic>ModSecurity -- Possible DoS Vulnerability</topic>
 <affects>
 <package>
	<name>ap24-mod_security</name>
	<range><lt>2.9.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/owasp-modsecurity/ModSecurity/pull/3389">
	 ModSecurity is an open source, cross platform web application
	firewall (WAF) engine for Apache, IIS and Nginx. Versions up to
	and including 2.9.8 are vulnerable to denial of service in one
	special case (in stable released versions): when the payload's
	content type is `application/json`, and there is at least one rule
	which does a `sanitiseMatchedBytes` action. A patch is available
	at pull request 3389 and expected to be part of version 2.9.9.	No
	known workarounds are available.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-47947</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-47947</url>
 </references>
 <dates>
 <discovery>2025-05-21</discovery>
 <entry>2025-05-30</entry>
 </dates>
 </vuln>

<vuln vid="67dd7a9e-3cd8-11f0-b601-5404a68ad561">
 <topic>traefik -- Path traversal vulnerability</topic>
 <affects>
 <package>
	<name>traefik</name>
	<range><lt>3.4.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The traefik project reports:
	<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-vrch-868g-9jx5">
	 There is a potential vulnerability in Traefik managing the requests
	 using a PathPrefix, Path or PathRegex matcher. When Traefik is configured
	 to route the requests to a backend using a matcher based on the path, if
	 the URL contains a URL encoded string in its path, it's possible to target
	 a backend, exposed using another router, by-passing the middlewares chain.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-47952</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-47952</url>
 </references>
 <dates>
 <discovery>2025-05-27</discovery>
 <entry>2025-05-29</entry>
 </dates>
 </vuln>

<vuln vid="c36decbe-3c84-11f0-8d29-b42e991fc52e">
 <topic>glpi-project -- GLPI multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>10.0.18</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.18">
	
	 CVE-2024-11955: A vulnerability was found in GLPI up to
	 10.0.17. It has been declared as problematic. Affected by
	 this vulnerability is an unknown functionality of the file
	 /index.php.
	 The manipulation of the argument redirect leads to
	 open redirect. The attack can be launched remotely.
	 The exploit has been disclosed to the public and
	 may be used. Upgrading to version 10.0.18 is able to
	 address this issue.
	 It is recommended to upgrade the affected component.
	
	
	 CVE-2025-23024: Starting in version 0.72 and prior to
	 version 10.0.18, an anonymous user can disable all the
	 active plugins. Version 10.0.18 contains a patch.
	 As a workaround, one may delete the `install/update.php`
	 file.
	
	
	 CVE-2025-23046: Prior to version 10.0.18, a low privileged
	 user can enable debug mode and access sensitive information.
	 Version 10.0.18 contains a patch.
	 As a workaround, one may delete the `install/update.php`
	 file.
	
	
	 CVE-2025-25192: Starting in version 9.5.0 and prior to
	 version 10.0.18, if a "Mail servers"
	 authentication provider is configured to use an Oauth
	 connection provided by the OauthIMAP plugin, anyone can
	 connect to GLPI using a user name on which an Oauth
	 authorization has already been established.
	 Version 10.0.18 contains a patch. As a
	 workaround, one may disable any "Mail
	 servers" authentication provider configured to
	 use an Oauth connection provided by the OauthIMAP
	 plugin.
	
	
	 CVE-2025-21626: Starting in version 0.71 and prior to
	 version 10.0.18, an anonymous user can fetch sensitive
	 information from the `status.php` endpoint.
	 Version 10.0.18 contains a fix for the issue.
	 Some workarounds are available. One may delete the
	 `status.php` file, restrict its access, or
	 remove any sensitive values from the `name` field of
	 the active LDAP directories, mail servers authentication
	 providers and mail receivers.
	
	
	 CVE-2025-21627: In versions prior to 10.0.18, a malicious
	 link can be crafted to perform a reflected XSS attack on the
	 search page. If the anonymous ticket creation is enabled,
	 this attack can be performed by an unauthenticated
	 user. Version 10.0.18 contains a fix for the issue.
	
	
	 CVE-2025-21619: An administrator user can perfom a SQL
	 injection through the rules configuration forms.
	 This vulnerability is fixed in 10.0.18.
	
	
	 CVE-2025-24799: An unauthenticated user can perform a SQL
	 injection through the inventory endpoint.
	 This vulnerability is fixed in 10.0.18.
	
	
	 CVE-2025-24801: An authenticated user can upload and force
	 the execution of *.php files located on the GLPI server.
	 This vulnerability is fixed in 10.0.18.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-11955</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-11955</url>
 <cvename>CVE-2025-23024</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-23024</url>
 <cvename>CVE-2025-23046</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-23046</url>
 <cvename>CVE-2025-25192</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-25192</url>
 <cvename>CVE-2025-21626</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-21626</url>
 <cvename>CVE-2025-21627</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-21627</url>
 <cvename>CVE-2025-21619</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-21619</url>
 <cvename>CVE-2025-24799</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-24799</url>
 <cvename>CVE-2025-24801</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-24801</url>
 </references>
 <dates>
 <discovery>2025-02-25</discovery>
 <entry>2025-05-29</entry>
 </dates>
 </vuln>

<vuln vid="47ef0ac6-38fc-4b35-850b-c794f04619fe">
 <topic>electron{34,35} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron34</name>
	<range><lt>34.5.7</lt></range>
 </package>
 <package>
	<name>electron35</name>
	<range><lt>35.5.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v34.5.7">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2025-4609.</li>
	 <li>Security: backported fix for CVE-2025-4664.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4609</cvename>
 <cvename>CVE-2025-4664</cvename>
 <url>https://github.com/advisories/GHSA-vxhm-55mv-5fhx</url>
 </references>
 <dates>
 <discovery>2025-05-29</discovery>
 <entry>2025-05-29</entry>
 </dates>
 </vuln>

<vuln vid="34744aab-3bf7-11f0-b81c-001b217e4ee5">
 <topic>ISC KEA -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>kea</name>
	<range><lt>2.6.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Internet Systems Consortium, Inc. reports:
	<blockquote cite="https://kb.isc.org/docs/">
	<ul>
	 <li>Loading a malicious hook library can lead to local privilege escalation https://kb.isc.org/docs/cve-2025-32801</li>
	 <li>Insecure handling of file paths allows multiple local attacks https://kb.isc.org/docs/cve-2025-32802</li>
	 <li>Insecure file permissions can result in confidential information leakage https://kb.isc.org/docs/cve-2025-32803</li>
	</ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-32801</cvename>
 <cvename>CVE-2025-32802</cvename>
 <cvename>CVE-2025-32803</cvename>
 </references>
 <dates>
 <discovery>2025-05-28</discovery>
 <entry>2025-05-28</entry>
 </dates>
 </vuln>

<vuln vid="45eb98d6-3b13-11f0-97f7-b42e991fc52e">
 <topic>grafana -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>8.0.0</ge><lt>10.4.18+security-01</lt></range>
	<range><ge>11.0.0</ge><lt>11.2.9+security-01</lt></range>
	<range><ge>11.3.0</ge><lt>11.3.6+security-01</lt></range>
	<range><ge>11.4.0</ge><lt>11.4.4+security-01</lt></range>
	<range><ge>11.5.0</ge><lt>11.5.4+security-01</lt></range>
	<range><ge>11.6.0</ge><lt>11.6.1+security-01</lt></range>
	<range><ge>12.0.0</ge><lt>12.0.0+security-01</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.0.0</ge></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@grafana.com reports:
	<blockquote cite="https://grafana.com/security/security-advisories/cve-2025-4123/">
	 A cross-site scripting (XSS) vulnerability exists in Grafana caused
	by combining a client path traversal and open redirect. This allows
	attackers to redirect users to a website that hosts a frontend
	plugin that will execute arbitrary JavaScript.	This vulnerability
	does not require editor permissions and if anonymous access is
	enabled, the XSS will work. If the Grafana Image Renderer plugin
	is installed, it is possible to exploit the open redirect to achieve
	a full read SSRF.

The default Content-Security-Policy (CSP) in Grafana will block the
	XSS though the `connect-src` directive.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4123</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-4123</url>
 </references>
 <dates>
 <discovery>2025-04-26</discovery>
 <entry>2025-05-27</entry>
 </dates>
 </vuln>

<vuln vid="e587b52d-38ac-11f0-b7b6-dcfe074bd614">
 <topic>cpython -- Use-after-free in "unicode_escape" decoder with error handler</topic>
 <affects>
 <package>
	<name>python39</name>
	<range><lt>3.9.22_1</lt></range>
 </package>
 <package>
	<name>python310</name>
	<range><lt>3.10.17_1</lt></range>
 </package>
 <package>
	<name>python311</name>
	<range><lt>3.11.12_1</lt></range>
 </package>
 <package>
	<name>python312</name>
	<range><lt>3.12.10_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@python.org reports:
	<blockquote cite="https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142">
	 There is an issue in CPython when using
	`bytes.decode("unicode_escape",
	error="ignore|replace")`. If you are not using the
	"unicode_escape" encoding or an error handler your
	usage is not affected.	To work-around this issue you may stop
	using the error= handler and instead wrap the bytes.decode()
	call in a try-except catching the DecodeError.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4516</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-4516</url>
 </references>
 <dates>
 <discovery>2025-05-15</discovery>
 <entry>2025-05-24</entry>
 </dates>
 </vuln>

<vuln vid="5baa64d6-37ee-11f0-a116-8447094a420f">
 <topic>OpenSSL -- Inverted security logic in x509 app</topic>
 <affects>
 <package>
	<name>openssl35</name>
	<range><lt>3.5.0_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://openssl-library.org/news/secadv/20250522.txt">
	 The x509 application adds trusted use instead of rejected use (low)
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4575</cvename>
 <url>https://openssl-library.org/news/secadv/20250522.txt</url>
 </references>
 <dates>
 <discovery>2025-05-23</discovery>
 <entry>2025-05-23</entry>
 </dates>
 </vuln>

<vuln vid="6529e5e7-36d5-11f0-8f57-b42e991fc52e">
 <topic>Firefox -- memory corruption due to race condition</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>137.0.2,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1951554">
	 A race condition existed in nsHttpTransaction that could
	 have been exploited to cause memory corruption, potentially
	 leading to an exploitable condition.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3608</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-3608</url>
 </references>
 <dates>
 <discovery>2025-04-15</discovery>
 <entry>2025-05-22</entry>
 </dates>
 </vuln>

<vuln vid="a1a1b0c2-3791-11f0-8600-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.0.0</ge><lt>18.0.1</lt></range>
	<range><ge>17.11.0</ge><lt>17.11.3</lt></range>
	<range><ge>10.2.0</ge><lt>17.10.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/05/21/patch-release-gitlab-18-0-1-released/">
	 Unprotected large blob endpoint in GitLab allows Denial of Service
	 Improper XPath validation allows modified SAML response to bypass 2FA requirement
	 A Discord webhook integration may cause DoS
	 Unbounded Kubernetes cluster tokens may lead to DoS
	 Unvalidated notes position may lead to Denial of Service
	 Hidden/masked variables may get exposed in the UI
	 Two-factor authentication requirement bypass
	 View full email addresses that should be partially obscured
	 Branch name confusion in confidential MRs
	 Unauthorized access to job data via a GraphQL query
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0993</cvename>
 <cvename>CVE-2024-12093</cvename>
 <cvename>CVE-2024-7803</cvename>
 <cvename>CVE-2025-3111</cvename>
 <cvename>CVE-2025-2853</cvename>
 <cvename>CVE-2025-4979</cvename>
 <cvename>CVE-2025-0605</cvename>
 <cvename>CVE-2025-0679</cvename>
 <cvename>CVE-2024-9163</cvename>
 <cvename>CVE-2025-1110</cvename>
 <url>https://about.gitlab.com/releases/2025/05/21/patch-release-gitlab-18-0-1-released/</url>
 </references>
 <dates>
 <discovery>2025-05-21</discovery>
 <entry>2025-05-23</entry>
 </dates>
 </vuln>

<vuln vid="4abd86c1-366d-11f0-9c0c-000c29ffbb6c">
 <topic>screen -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>screen</name>
	<range><lt>5.0.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The screen project reports:
	<blockquote cite="https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00002.html">
	 Multiple security issues in screen.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-46805</cvename>
 <cvename>CVE-2025-46804</cvename>
 <cvename>CVE-2025-46803</cvename>
 <cvename>CVE-2025-46802</cvename>
 <cvename>CVE-2025-23395</cvename>
 <url>https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00002.html</url>
 </references>
 <dates>
 <discovery>2025-05-12</discovery>
 <entry>2025-05-21</entry>
 </dates>
 </vuln>

<vuln vid="07560111-34cc-11f0-af94-b42e991fc52e">
 <topic>firefox -- out-of-bounds read/write</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>138.0.4,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.10.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1966614">
	 An attacker was able to perform an out-of-bounds read or
	 write on a JavaScript object by confusing array index sizes.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4918</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-4918</url>
 <cvename>CVE-2025-4919</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-4919</url>
 </references>
 <dates>
 <discovery>2025-05-17</discovery>
 <entry>2025-05-19</entry>
 </dates>
 </vuln>

<vuln vid="46594aa3-32f7-11f0-a116-8447094a420f">
 <topic>WeeChat -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>weechat</name>
	<range><lt>4.6.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Weechat project reports:
	<blockquote cite="https://weechat.org/doc/weechat/security/">
	 Multiple integer and buffer overflows in WeeChat core.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://weechat.org/doc/weechat/security/</url>
 </references>
 <dates>
 <discovery>2025-05-11</discovery>
 <entry>2025-05-17</entry>
 </dates>
 </vuln>

<vuln vid="79400d31-3166-11f0-8cb5-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>136.0.7103.113</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>136.0.7103.113</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[415810136] High CVE-2025-4664: Insufficient policy enforcement in Loader. Source: X post from @slonser_ on 2025-05-05</li>
	 <li>[412578726] High CVE-2025-4609: Incorrect handle provided in unspecified circumstances in Mojo. Reported by Micky on 2025-04-22</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-4664</cvename>
 <cvename>CVE-2025-4609</cvename>
 <url>https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html</url>
 </references>
 <dates>
 <discovery>2025-05-14</discovery>
 <entry>2025-05-15</entry>
 </dates>
 </vuln>

<vuln vid="52efdd56-30bd-11f0-81be-b42e991fc52e">
 <topic>Mozilla -- memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>138.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.10</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>138.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1951161%2C1952105">
	 Memory safety bugs present in Firefox 137, Thunderbird 137,
	 Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs
	 showed evidence of memory corruption and we presume that
	 with enough effort some of these could have been exploited
	 to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4091</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-4091</url>
 </references>
 <dates>
 <discovery>2025-04-29</discovery>
 <entry>2025-05-14</entry>
 </dates>
 </vuln>

<vuln vid="4f17db64-30bd-11f0-81be-b42e991fc52e">
 <topic>Mozilla -- memory corruption</topic>
 <affects>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.10</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1894100">
	 Memory safety bug present in Firefox ESR 128.9, and
	 Thunderbird 128.9. This bug showed evidence of memory
	 corruption and we presume that with enough effort this could
	 have been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4093</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-4093</url>
 </references>
 <dates>
 <discovery>2025-04-29</discovery>
 <entry>2025-05-14</entry>
 </dates>
 </vuln>

<vuln vid="6f10b49d-07b1-4be4-8abf-edf880b16ad2">
 <topic>vscode -- security feature bypass vulnerability</topic>
 <affects>
 <package>
	<name>vscode</name>
	<range><lt>1.100.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	VSCode developers report:
	<blockquote cite="https://github.com/microsoft/vscode/security/advisories/GHSA-742r-ggwg-vqxm">
	 A security feature bypass vulnerability exists in VS Code 1.100.0 and earlier versions where a maliciously crafted URL could be considered trusted when it should not have due to how VS Code handled glob patterns in the trusted domains feature. When paired with the #fetch tool in Chat, this scenario would require the attacker to convince an LLM (via prompt injection) to fetch the maliciously crafted URL but when fetched, the user would have no moment to confirm the flighting of the request.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-21264</cvename>
 <url>https://github.com/microsoft/vscode/security/advisories/GHSA-742r-ggwg-vqxm</url>
 <url>https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21264</url>
 </references>
 <dates>
 <discovery>2025-05-13</discovery>
 <entry>2025-05-14</entry>
 </dates>
 </vuln>

<vuln vid="a96cd659-303e-11f0-94b5-54ee755069b5">
 <topic>libxslt -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libxslt</name>
	<range><lt>1.1.43</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <h1>[CVE-2024-55549] Fix UAF related to excluded namespaces</h1>
 <blockquote cite="https://gitlab.gnome.org/GNOME/libxslt/-/issues/127">
 xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.
 </blockquote>
 <h1>[CVE-2025-24855] Fix use-after-free of XPath context node</h1>
 <blockquote cite="https://gitlab.gnome.org/GNOME/libxslt/-/issues/128">
 numbers.c in libxslt before 1.1.43 has a use-after-free because
	, in nested XPath evaluations, an XPath context node can be
	modified but never restored. This is related to
	xsltNumberFormatGetValue, xsltEvalXPathPredicate,
	xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-55549</cvename>
 <cvename>CVE-2025-24855</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-55549</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-24855</url>
 </references>
 <dates>
 <discovery>2025-03-13</discovery>
 <entry>2025-05-13</entry>
 </dates>
 </vuln>

<vuln vid="89c668d5-2f80-11f0-9632-641c67a117d8">
 <topic>www/varnish7 -- Request Smuggling Attack</topic>
 <affects>
 <package>
	<name>varnish7</name>
	<range><lt>7.7.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Varnish Development Team reports:
	<blockquote cite="https://varnish-cache.org/security/VSV00016.html">
	A client-side desync vulnerability can be triggered in Varnish Cache
	 and Varnish Enterprise. This vulnerability can be triggered under
	 specific circumstances involving malformed HTTP/1 requests.
	An attacker can abuse a flaw in Varnish's handling of chunked
	 transfer encoding which allows certain malformed HTTP/1 requests
	 to exploit improper framing of the message body to smuggle additional
	 requests. Specifically, Varnish incorrectly permits CRLF to be
	 skipped to delimit chunk boundaries.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://varnish-cache.org/security/VSV00016.html</url>
 </references>
 <dates>
 <discovery>2025-05-12</discovery>
 <entry>2025-05-12</entry>
 </dates>
 </vuln>

<vuln vid="a8a1a8e7-2e85-11f0-a989-b42e991fc52e">
 <topic>Mozilla -- memory corruption</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>138.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>138.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1924108%2C1950780%2C1959367">
	 Memory safety bugs present in Firefox 137 and Thunderbird 137.
	 Some of these bugs showed evidence of memory corruption and
	 we presume that with enough effort some of these could have
	 been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4092</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-4092</url>
 </references>
 <dates>
 <discovery>2025-04-29</discovery>
 <entry>2025-05-11</entry>
 </dates>
 </vuln>

<vuln vid="a59bd59e-2e85-11f0-a989-b42e991fc52e">
 <topic>Mozilla -- insufficient character escaping</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>138.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>138.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1949994%2C1956698%2C1960198">
	 Due to insufficient escaping of special characters in the
	 "copy as cURL" feature, an attacker could trick
	 a user into using this command, potentially leading to local
	 code execution on the user's system.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4089</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-4089</url>
 </references>
 <dates>
 <discovery>2025-04-29</discovery>
 <entry>2025-05-11</entry>
 </dates>
 </vuln>

<vuln vid="a4422500-2e85-11f0-a989-b42e991fc52e">
 <topic>Mozilla -- Cross-Site Request Forgery</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>138.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>138.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1953521">
	 A security vulnerability in Thunderbird allowed malicious
	 sites to use redirects to send credentialed requests to
	 arbitrary endpoints on any site that had invoked the Storage
	 Access API. This enabled potential Cross-Site Request
	 Forgery attacks across origins.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4088</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-4088</url>
 </references>
 <dates>
 <discovery>2025-04-29</discovery>
 <entry>2025-05-11</entry>
 </dates>
 </vuln>

<vuln vid="a2d5bd7b-2e85-11f0-a989-b42e991fc52e">
 <topic>Mozilla -- XPath parsing undefined behavior</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>138.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.10,1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>138</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1952465">
	 A vulnerability was identified in Thunderbird where XPath
	 parsing could trigger undefined behavior due to missing null
	 checks during attribute access. This could lead to
	 out-of-bounds read access and potentially, memory
	 corruption.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4087</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-4087</url>
 </references>
 <dates>
 <discovery>2025-04-29</discovery>
 <entry>2025-05-11</entry>
 </dates>
 </vuln>

<vuln vid="9fa8c4a2-2e85-11f0-a989-b42e991fc52e">
 <topic>Mozilla -- Information leak</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>138.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>138.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1915280">
	 An attacker with control over a content process could
	 potentially leverage the privileged UITour actor to leak
	 sensitive information or escalate privileges.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4085</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-4085</url>
 </references>
 <dates>
 <discovery>2025-04-29</discovery>
 <entry>2025-05-11</entry>
 </dates>
 </vuln>

<vuln vid="9c37a02e-2e85-11f0-a989-b42e991fc52e">
 <topic>Mozilla -- javascript content execution</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>138.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.10,1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>138.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1958350">
	 A process isolation vulnerability in Thunderbird stemmed
	 from improper handling of javascript: URIs, which could
	 allow content to execute in the top-level document's
	 process instead of the intended frame, potentially enabling
	 a sandbox escape.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4083</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-4083</url>
 </references>
 <dates>
 <discovery>2025-04-29</discovery>
 <entry>2025-05-11</entry>
 </dates>
 </vuln>

<vuln vid="6943cbf2-2d55-11f0-9471-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.11.0</ge><lt>17.11.2</lt></range>
	<range><ge>17.10.0</ge><lt>17.10.6</lt></range>
	<range><ge>12.0.0</ge><lt>17.9.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/05/07/patch-release-gitlab-17-11-2-released/">
	 Partial Bypass for Device OAuth flow using Cross Window Forgery
	 Denial of service by abusing Github import API
	 Group IP restriction bypass allows disclosing issue title of restricted project
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0549</cvename>
 <cvename>CVE-2024-8973</cvename>
 <cvename>CVE-2025-1278</cvename>
 <url>https://about.gitlab.com/releases/2025/05/07/patch-release-gitlab-17-11-2-released/</url>
 </references>
 <dates>
 <discovery>2025-05-07</discovery>
 <entry>2025-05-10</entry>
 </dates>
 </vuln>

<vuln vid="78b8e808-2c45-11f0-9a65-6cc21735f730">
 <topic>PostgreSQL -- PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation</topic>
 <affects>
 <package>
	<name>postgresql17-client</name>
	<range><lt>17.5</lt></range>
 </package>
 <package>
	<name>postgresql16-client</name>
	<range><lt>16.9</lt></range>
 </package>
 <package>
	<name>postgresql15-client</name>
	<range><lt>15.13</lt></range>
 </package>
 <package>
	<name>postgresql14-client</name>
	<range><lt>14.18</lt></range>
 </package>
 <package>
	<name>postgresql13-client</name>
	<range><lt>13.21</lt></range>
 </package>
 <package>
	<name>postgresql17-server</name>
	<range><lt>17.5</lt></range>
 </package>
 <package>
	<name>postgresql16-server</name>
	<range><lt>16.9</lt></range>
 </package>
 <package>
	<name>postgresql15-server</name>
	<range><lt>15.13</lt></range>
 </package>
 <package>
	<name>postgresql14-server</name>
	<range><lt>14.18</lt></range>
 </package>
 <package>
	<name>postgresql13-server</name>
	<range><lt>13.21</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2025-4207/">
	 
	 A buffer over-read in PostgreSQL GB18030 encoding
	 validation allows a database input provider to achieve
	 temporary denial of service on platforms where a 1-byte
	 over-read can elicit process termination. This affects
	 the database server and also libpq. Versions before
	 PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are
	 affected.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-4207</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2025-4207/</url>
 </references>
 <dates>
 <discovery>2025-05-08</discovery>
 <entry>2025-05-08</entry>
 </dates>
 </vuln>

<vuln vid="db221414-2b0d-11f0-8cb5-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>136.0.7103.92</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>136.0.7103.92</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[412057896] Medium CVE-2025-4372: Use after free in WebAudio. Reported by Huang Xilin of Ant Group Light-Year Security Lab on 2025-04-20</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-4372</cvename>
 <url>https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2025-05-06</discovery>
 <entry>2025-05-07</entry>
 </dates>
 </vuln>

<vuln vid="e195e915-2a43-11f0-8cb5-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>136.0.7103.59</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>136.0.7103.59</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_29.html">
	 This update includes 8 security fixes:
	 <ul>
	 <li>[409911705] High CVE-2025-4096: Heap buffer overflow in HTML. Reported by Anonymous on 2025-04-11</li>
	 <li>[409342999] Medium CVE-2025-4050: Out of bounds memory access in DevTools. Reported by Anonymous on 2025-04-09</li>
	 <li>[404000989] Medium CVE-2025-4051: Insufficient data validation in DevTools. Reported by Daniel Fröjdendahl on 2025-03-16</li>
	 <li>[401927528] Low CVE-2025-4052: Inappropriate implementation in DevTools. Reported by vanillawebdev on 2025-03-10</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-4096</cvename>
 <cvename>CVE-2025-4050</cvename>
 <cvename>CVE-2025-4051</cvename>
 <cvename>CVE-2025-4052</cvename>
 <url>https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_29.html</url>
 </references>
 <dates>
 <discovery>2025-04-29</discovery>
 <entry>2025-05-06</entry>
 </dates>
 </vuln>

<vuln vid="5f868a5f-2943-11f0-bb22-f02f7432cf97">
 <topic>fcgi -- Heap-based buffer overflow via crafted nameLen/valueLen in ReadParams</topic>
 <affects>
 <package>
	<name>fcgi</name>
	<range><lt>2.4.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://github.com/FastCGI-Archives/fcgi2/issues/67">
	FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer
	overflow (and resultant heap-based buffer overflow) via
	crafted nameLen or valueLen values in data to the IPC socket.
	This occurs in ReadParams in fcgiapp.c.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-23016</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-23016</url>
 <url>https://github.com/FastCGI-Archives/fcgi2/issues/67</url>
 </references>
 <dates>
 <discovery>2025-01-10</discovery>
 <entry>2025-05-04</entry>
 </dates>
 </vuln>

<vuln vid="7e7a32e7-2901-11f0-ab20-b42e991fc52e">
 <topic>dnsdist -- Denial of service via crafted DoH exchange</topic>
 <affects>
 <package>
	<name>null</name>
	<range><lt>null</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@open-xchange.com reports:
	<blockquote cite="https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2025-02.html">
	
	When DNSdist is configured to provide DoH via the
	nghttp2provider, an attacker can cause a denial of service by
	crafting a DoH exchange that triggers an illegal memory
	access (double-free) and crash of DNSdist, causing a denial
	of service. The remedy is: upgrade to the patched 1.9.9
	version. A workaround is to temporarily switch to the h2o
	provider until DNSdist has been upgraded to a fixed version.
	We would like to thank Charles Howes for bringing this issue
	to our attention.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-30194</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-30194</url>
 </references>
 <dates>
 <discovery>2025-04-29</discovery>
 <entry>2025-05-04</entry>
 </dates>
 </vuln>

<vuln vid="d70d5e0a-1f5e-11f0-9c67-6805ca2fa271">
 <topic>powerdns-recursor -- denial of service</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><eq>5.2.0</eq></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://blog.powerdns.com/2025/04/07/powerdns-recursor-5-2-1-released">
	 PowerDNS Security Advisory 2025-01: A crafted zone can
	 lead to an illegal memory access in the Recursor
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-30195</cvename>
 <url>https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-01.html</url>
 </references>
 <dates>
 <discovery>2025-04-07</discovery>
 <entry>2025-04-22</entry>
 </dates>
 </vuln>

<vuln vid="409206f6-25e6-11f0-9360-b42e991fc52e">
 <topic>sqlite -- integer overflow</topic>
 <affects>
 <package>
	<name>sqlite</name>
	<range><lt>3.49.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://gist.github.com/ylwango613/a44a29f1ef074fa783e29f04a0afd62a">
	
	In SQLite 3.44.0 through 3.49.0 before 3.49.1, the
	concat_ws() SQL function can cause memory to be written
	beyond the end of a malloc-allocated buffer. If the
	separator argument is attacker-controlled and has a large
	string (e.g., 2MB or more), an integer overflow occurs in
	calculating the size of the result buffer, and thus malloc
	may not allocate enough memory.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-29087</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-29087</url>
 </references>
 <dates>
 <discovery>2025-04-07</discovery>
 <entry>2025-04-30</entry>
 </dates>
 </vuln>

<vuln vid="df126e23-24fa-11f0-ab92-f02f7497ecda">
 <topic>h11 accepts some malformed Chunked-Encoding bodies</topic>
 <affects>
 <package>
 <name>py39-h11</name>
 <name>py310-h11</name>
 <name>py311-h11</name>
 <name>py312-h11</name>
 <range><lt>0.16.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
 h11 reports:
 <blockquote cite="https://github.com/python-hyper/h11/security/advisories/GHSA-vqfr-h8mv-ghfj">
 h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-43859</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-43859</url>
 </references>
 <dates>
 <discovery>2025-04-24</discovery>
 <entry>2025-04-29</entry>
 </dates>
 </vuln>

<vuln vid="310f5923-211c-11f0-8ca6-6c3be5272acd">
 <topic>Grafana -- Authorization bypass in data source proxy API</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>8.0.0</ge><lt>10.4.17+security-01</lt></range>
	<range><ge>11.0.0</ge><lt>11.2.8+security-01</lt></range>
	<range><ge>11.3.0</ge><lt>11.3.5+security-01</lt></range>
	<range><ge>11.4.0</ge><lt>11.4.3+security-01</lt></range>
	<range><ge>11.5.0</ge><lt>11.5.3+security-01</lt></range>
	<range><ge>11.6.0</ge><lt>11.6.0+security-01</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.0.0</ge></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2025/04/22/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-3260-cve-2025-2703-cve-2025-3454/">
	 This vulnerability, which was discovered while reviewing a pull
	 request from an external contributor, effects Grafana’s data source
	 proxy API and allows authorization checks to be bypassed by adding
	 an extra slash character (/) in the URL path. Among Grafana-maintained
	 data sources, the vulnerability only affects the read paths
	 of Prometheus (all flavors) and Alertmanager when configured with
	 basic authorization.
	 The CVSS score for this vulnerability is
	 <a href="https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N">5.0 MEDIUM</a>.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3454</cvename>
 <url>https://grafana.com/blog/2025/04/22/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-3260-cve-2025-2703-cve-2025-3454/</url>
 </references>
 <dates>
 <discovery>2025-03-25</discovery>
 <entry>2025-04-24</entry>
 </dates>
 </vuln>

<vuln vid="6adfda5a-2118-11f0-8ca6-6c3be5272acd">
 <topic>Grafana -- Bypass Viewer and Editor permissions</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>11.6.0</ge><lt>11.6.0+security-01</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2025/04/22/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-3260-cve-2025-2703-cve-2025-3454/">
	 During the development of a new feature in Grafana 11.6.x,
	 a security vulnerability was introduced that allows for Viewers
	 and Editors to bypass dashboard-specific permissions. As a result,
	 users with the Viewer role could view all the dashboards within their
	 org and users with the Editor role could view, edit, and delete all
	 the dashboards in their org.
	 Note: Organization isolation boundaries still apply, which
	 means viewers and editors in one organization cannot view or edit
	 dashboards in another org. Also this vulnerability does not allow
	 users to query data via data sources they don’t have access to.
	 
	 The CVSS score for this vulnerability is
	 <a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L&amp;version=3.1">8.3 HIGH</a>.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3260</cvename>
 <url>https://grafana.com/blog/2025/04/22/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-3260-cve-2025-2703-cve-2025-3454/</url>
 </references>
 <dates>
 <discovery>2025-04-04</discovery>
 <entry>2025-04-24</entry>
 </dates>
 </vuln>

<vuln vid="f8b7af82-2116-11f0-8ca6-6c3be5272acd">
 <topic>Grafana -- DOM XSS vulnerability</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>11.1.0</ge><lt>11.2.8+security-01</lt></range>
	<range><ge>11.3.0</ge><lt>11.3.5+security-01</lt></range>
	<range><ge>11.4.0</ge><lt>11.4.3+security-01</lt></range>
	<range><ge>11.5.0</ge><lt>11.5.3+security-01</lt></range>
	<range><ge>11.6.0</ge><lt>11.6.0+security-01</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2025/04/22/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-3260-cve-2025-2703-cve-2025-3454/">
	 An external security researcher responsibly reported a security
	 vulnerability in Grafana’s built-in
	 <a href="https://grafana.com/docs/grafana/latest/panels-visualizations/visualizations/xy-chart/">XY chart plugin</a>
	 that is vulnerable to a
	 <a href="https://grafana.com/blog/2023/07/11/trusted-types-how-we-mitigate-xss-threats-in-grafana-10/#what-is-dom-xss">DOM XSS vulnerability</a>.
	 The CVSS score for this vulnerability is
	 <a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L&amp;version=3.1">6.8 MEDIUM</a>.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-2703</cvename>
 <url>https://grafana.com/security/security-advisories/cve-2025-2703/</url>
 </references>
 <dates>
 <discovery>2025-03-14</discovery>
 <entry>2025-04-24</entry>
 </dates>
 </vuln>

<vuln vid="af8d043f-20df-11f0-b9c5-000c295725e4">
 <topic>redis,valkey -- DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><lt>7.4.3</lt></range>
 </package>
 <package>
	<name>redis72</name>
	<range><lt>7.2.8</lt></range>
 </package>
 <package>
	<name>redis62</name>
	<range><lt>6.2.18</lt></range>
 </package>
 <package>
	<name>valkey</name>
	<range><lt>8.1.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Axel Mierczuk reports:
	<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-r67f-p999-2gff">
	 
	 By default, the Redis configuration does not limit the
	 output buffer of normal clients (see
	 client-output-buffer-limit). Therefore, the output buffer
	 can grow unlimitedly over time. As a result, the service
	 is exhausted and the memory is unavailable.
	 
	 
	 When password authentication is enabled on the Redis
	 server, but no password is provided, the client can still
	 cause the output buffer to grow from "NOAUTH" responses
	 until the system will run out of memory.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-21605</cvename>
 <url>https://github.com/redis/redis/security/advisories/GHSA-r67f-p999-2gff</url>
 </references>
 <dates>
 <discovery>2025-04-23</discovery>
 <entry>2025-04-24</entry>
 </dates>
 </vuln>

<vuln vid="11b71871-20ba-11f0-9471-2cf05da270f3">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.11.0</ge><lt>17.11.1</lt></range>
	<range><ge>17.10.0</ge><lt>17.10.5</lt></range>
	<range><ge>16.6.0</ge><lt>17.9.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/04/23/patch-release-gitlab-17-11-1-released/">
	 Cross Site Scripting (XSS) in Maven Dependency Proxy through CSP directives
	 Cross Site Scripting (XSS) in Maven dependency proxy through cache headers
	 Network Error Logging (NEL) Header Injection in Maven Dependency Proxy Allows Browser Activity Monitoring
	 Denial of service (DOS) via issue preview
	 Unauthorized access to branch names when Repository assets are disabled in the project
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1763</cvename>
 <cvename>CVE-2025-2443</cvename>
 <cvename>CVE-2025-1908</cvename>
 <cvename>CVE-2025-0639</cvename>
 <cvename>CVE-2024-12244</cvename>
 <url>https://about.gitlab.com/releases/2025/04/23/patch-release-gitlab-17-11-1-released/</url>
 </references>
 <dates>
 <discovery>2025-04-23</discovery>
 <entry>2025-04-24</entry>
 </dates>
 </vuln>

<vuln vid="194f79c3-1ffe-11f0-8cb5-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>135.0.7049.114</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>135.0.7049.114</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_22.html">
	 This update includes 1 security fix.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_22.html</url>
 </references>
 <dates>
 <discovery>2025-04-22</discovery>
 <entry>2025-04-23</entry>
 </dates>
 </vuln>

<vuln vid="5ca2cafa-1f24-11f0-ab07-f8f21e52f724">
 <topic>Navidrome -- Authentication bypass in Subsonic API</topic>
 <affects>
 <package>
	<name>navidrome</name>
	<range><gt>0.52.0</gt><lt>0.54.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Deluan reports:
	<blockquote cite="https://github.com/navidrome/navidrome/security/advisories/GHSA-c3p4-vm8f-386p">
	 In certain Subsonic API endpoints, authentication can be
	bypassed by using a non-existent username combined with an
	empty (salted) password hash. This allows read-only access to
	the server’s resources, though attempts at write operations
	fail with a “permission denied” error.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-27112</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-27112</url>
 </references>
 <dates>
 <discovery>2025-02-25</discovery>
 <entry>2025-04-22</entry>
 </dates>
 </vuln>

<vuln vid="06269ae8-1e0d-11f0-ad0b-b42e991fc52e">
 <topic>Erlang -- Erlang/OTP SSH Vulnerable to Pre-Authentication RCE</topic>
 <affects>
 <package>
	<name>erlang</name>
	<range><lt>26.2.5.11</lt></range>
 </package>
 <package>
	<name>erlang-runtime21</name>
	<range><lt>25.3.2.20</lt></range>
 </package>
 <package>
	<name>erlang-runtime22</name>
	<range><lt>25.3.2.20</lt></range>
 </package>
 <package>
	<name>erlang-runtime23</name>
	<range><lt>25.3.2.20</lt></range>
 </package>
 <package>
	<name>erlang-runtime24</name>
	<range><lt>25.3.2.20</lt></range>
 </package>
 <package>
	<name>erlang-runtime25</name>
	<range><lt>25.3.2.20</lt></range>
 </package>
 <package>
	<name>erlang-runtime26</name>
	<range><lt>26.2.5.11</lt></range>
 </package>
 <package>
	<name>erlang-runtime27</name>
	<range><lt>27.3.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12">
	
	Erlang/OTP is a set of libraries for the Erlang
	programming language. Prior to versions OTP-27.3.3,
	OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow
	an attacker to perform unauthenticated remote code
	execution (RCE). By exploiting a flaw in SSH protocol
	message handling, a malicious actor could gain
	unauthorized access to affected systems and execute
	arbitrary commands without valid credentials. This issue
	is patched in versions OTP-27.3.3, OTP-26.2.5.11, and
	OTP-25.3.2.20. A temporary workaround involves disabling
	the SSH server or to prevent access via firewall rules.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-32433</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-32433</url>
 </references>
 <dates>
 <discovery>2025-04-16</discovery>
 <entry>2025-04-20</entry>
 </dates>
 </vuln>

<vuln vid="1b8d502e-1cfd-11f0-944d-901b0e9408dc">
 <topic>ejabberd -- mod_muc_occupantid: Fix handling multiple occupant-id</topic>
 <affects>
 <package>
	<name>ejabberd</name>
	<range><lt>25.04</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	ejabberd team reports:
	<blockquote cite="https://www.process-one.net/blog/ejabberd-25-04/#occupantid">
	 Fixed issue with handling of user provided occupant-id in
	 messages and presences sent to muc room. Server was
	 replacing just first instance of occupant-id with its own
	 version, leaving other ones untouched. That would mean that
	 depending on order in which clients send occupant-id, they
	 could see value provided by sender, and that could be used
	 to spoof as different sender.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://www.process-one.net/blog/ejabberd-25-04/#occupantid</url>
 </references>
 <dates>
 <discovery>2025-04-16</discovery>
 <entry>2025-04-19</entry>
 </dates>
 </vuln>

<vuln vid="bf5d29ea-1a93-11f0-8cb5-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>135.0.7049.95</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>135.0.7049.95</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_15.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[409619251] Critical CVE-2025-3619: Heap buffer overflow in Codecs. Reported by Elias Hohl on 2025-04-09</li>
	 <li>[405292639] High CVE-2025-3620: Use after free in USB. Reported by @retsew0x01 on 2025-03-21</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-3619</cvename>
 <cvename>CVE-2025-3620</cvename>
 <url>https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_15.html</url>
 </references>
 <dates>
 <discovery>2025-04-15</discovery>
 <entry>2025-04-16</entry>
 </dates>
 </vuln>

<vuln vid="030778d5-19cc-11f0-8cb5-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>135.0.7049.84</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>135.0.7049.84</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_8.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[405140652] High CVE-2025-3066: Use after free in Site Isolation. Reported by Sven Dysthe (@svn-dys) on 2025-03-21</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-3066</cvename>
 <url>https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_8.html</url>
 </references>
 <dates>
 <discovery>2025-04-08</discovery>
 <entry>2025-04-15</entry>
 </dates>
 </vuln>

<vuln vid="e9b8e519-0d50-11f0-86d8-901b0e934d69">
 <topic>py-matrix-synapse -- federation denial of service via malformed events</topic>
 <affects>
 <package>
	<name>py38-matrix-synapse</name>
	<name>py39-matrix-synapse</name>
	<name>py310-matrix-synapse</name>
	<name>py311-matrix-synapse</name>
	<range><lt>1.127.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	element-hq/synapse developers report:
	<blockquote cite="https://github.com/element-hq/synapse/security/advisories/GHSA-v56r-hwv5-mxg6">
	 A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-30355</cvename>
 <url>https://github.com/element-hq/synapse/security/advisories/GHSA-v56r-hwv5-mxg6</url>
 </references>
 <dates>
 <discovery>2025-03-26</discovery>
 <entry>2025-03-26</entry>
 </dates>
 </vuln>

<vuln vid="45276ea6-1653-4240-9986-ccfc6fec7ece">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.504</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.492.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2025-04-02/">
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-3512 / CVE-2025-31720</h5>
	 Missing permission check allows retrieving agent configurations
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-3513 / CVE-2025-31721</h5>
	 Missing permission check allows retrieving secrets from agent configurations
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-31720</cvename>
 <cvename>CVE-2025-31721</cvename>
 <url>https://www.jenkins.io/security/advisory/2025-04-02/</url>
 </references>
 <dates>
 <discovery>2025-04-02</discovery>
 <entry>2025-04-11</entry>
 </dates>
 </vuln>

<vuln vid="ed602f8b-15c2-11f0-b4e4-2cf05da270f3">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.10.0</ge><lt>17.10.4</lt></range>
	<range><ge>17.9.0</ge><lt>17.9.6</lt></range>
	<range><ge>7.7.0</ge><lt>17.8.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/04/09/patch-release-gitlab-17-10-4-released/">
	 Denial of service via CI pipelines
	 Unintentionally authorizing sensitive actions on users behalf
	 IP Restriction Bypass through GraphQL Subscription
	 Unauthorized users can list the number of confidential issues
	 Debugging Information Disclosed
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1677</cvename>
 <cvename>CVE-2025-0362</cvename>
 <cvename>CVE-2025-2408</cvename>
 <cvename>CVE-2024-11129</cvename>
 <cvename>CVE-2025-2469</cvename>
 <url>https://about.gitlab.com/releases/2025/04/09/patch-release-gitlab-17-10-4-released/</url>
 </references>
 <dates>
 <discovery>2025-04-09</discovery>
 <entry>2025-04-10</entry>
 </dates>
 </vuln>

<vuln vid="8f71ad3b-14f5-11f0-87ba-002590c1f29c">
 <topic>expat: improper restriction of xml entity expansion depth</topic>
 <affects>
 <package>
	<name>expat</name>
	<range><lt>2.7.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	secalert@redhat.com reports:
	<blockquote cite="https://access.redhat.com/errata/RHSA-2025:3531">
	 A stack overflow vulnerability exists in the libexpat library due
	 to the way it handles recursive entity expansion in XML documents.
	 When parsing an XML document with deeply nested entity references,
	 libexpat can be forced to recurse indefinitely, exhausting the stack
	 space and causing a crash. This issue could lead to denial of
	 service (DoS) or, in some cases, exploitable memory corruption,
	 depending on the environment and library usage.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-8176</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-8176</url>
 </references>
 <dates>
 <discovery>2025-03-14</discovery>
 <entry>2025-04-09</entry>
 </dates>
 </vuln>

<vuln vid="34c51a2b-13c8-11f0-a5bd-b42e991fc52e">
 <topic>Mozilla -- memory corruption</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>137.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>137.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>137.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1894100%2C1934086%2C1950360">
	 Memory safety bugs present in Firefox 136 and Thunderbird 136.
	 Some of these bugs showed evidence of memory corruption and
	 we presume that with enough effort some of these could have
	 been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3034</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-3034</url>
 </references>
 <dates>
 <discovery>2025-04-01</discovery>
 <entry>2025-04-07</entry>
 </dates>
 </vuln>

<vuln vid="315f568e-13c8-11f0-a5bd-b42e991fc52e">
 <topic>Mozilla -- privilege escalation attack</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>137.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>137.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>137.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1949987">
	 Leaking of file descriptors from the fork server to web
	 content processes could allow for privilege escalation
	 attacks.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3032</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-3032</url>
 </references>
 <dates>
 <discovery>2025-04-01</discovery>
 <entry>2025-04-07</entry>
 </dates>
 </vuln>

<vuln vid="2fc74cae-13c8-11f0-a5bd-b42e991fc52e">
 <topic>Mozilla -- stack memory read</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>137.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>137.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>137.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1947141">
	 An attacker could read 32 bits of values spilled onto the stack in
	a JIT compiled function.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3031</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-3031</url>
 </references>
 <dates>
 <discovery>2025-04-01</discovery>
 <entry>2025-04-07</entry>
 </dates>
 </vuln>

<vuln vid="2e0ff31b-13c8-11f0-a5bd-b42e991fc52e">
 <topic>Mozilla -- Memory corruption</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>137.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.9.0</lt></range>
 </package>
 <package>
	<name>firefox</name>
	<range><lt>137.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1850615%2C1932468%2C1942551%2C1951017%2C1951494">
	 Memory safety bugs present in Firefox 136, Thunderbird
	 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these
	 bugs showed evidence of memory corruption and we presume
	 that with enough effort some of these could have been
	 exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3030</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-3030</url>
 </references>
 <dates>
 <discovery>2025-04-01</discovery>
 <entry>2025-04-07</entry>
 </dates>
 </vuln>

<vuln vid="2c0180a5-13c8-11f0-a5bd-b42e991fc52e">
 <topic>Mozilla -- URL spoofing attack</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>137.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.9</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>137.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>137.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1952213">
	 A crafted URL containing specific Unicode characters
	 could have hidden the true origin of the page, resulting in
	 a potential spoofing attack.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3029</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-3029</url>
 </references>
 <dates>
 <discovery>2025-04-01</discovery>
 <entry>2025-04-07</entry>
 </dates>
 </vuln>

<vuln vid="28e5f7be-13c8-11f0-a5bd-b42e991fc52e">
 <topic>Mozilla -- use-after-free error</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>137.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>115.22</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>137.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>137.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1941002">
	 JavaScript code running while transforming a document
	 with the XSLTProcessor could lead to a use-after-free.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3028</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-3028</url>
 </references>
 <dates>
 <discovery>2025-04-01</discovery>
 <entry>2025-04-07</entry>
 </dates>
 </vuln>

<vuln vid="789bcfb6-1224-11f0-85f3-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>135.0.7049.52</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>135.0.7049.52</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.html">
	 This update includes 13 security fixes:
	 <ul>
	 <li>[376491759] Medium CVE-2025-3067: Inappropriate implementation in Custom Tabs. Reported by Philipp Beer (TU Wien) on 2024-10-31</li>
	 <li>[401823929] Medium CVE-2025-3068: Inappropriate implementation in Intents. Reported by Simon Rawet on 2025-03-09</li>
	 <li>[40060076] Medium CVE-2025-3069: Inappropriate implementation in Extensions. Reported by NDevTK on 2022-06-26</li>
	 <li>[40086360] Medium CVE-2025-3070: Insufficient validation of untrusted input in Extensions. Reported by Anonymous on 2017-01-01</li>
	 <li>[40051596] Low CVE-2025-3071: Inappropriate implementation in Navigations. Reported by David Erceg on 2020-02-23</li>
	 <li>[362545037] Low CVE-2025-3072: Inappropriate implementation in Custom Tabs. Reported by Om Apip on 2024-08-27</li>
	 <li>[388680893] Low CVE-2025-3073: Inappropriate implementation in Autofill. Reported by Hafiizh on 2025-01-09</li>
	 <li>[392818696] Low CVE-2025-3074: Inappropriate implementation in Downloads. Reported by Farras Givari on 2025-01-28</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-3067</cvename>
 <cvename>CVE-2025-3068</cvename>
 <cvename>CVE-2025-3069</cvename>
 <cvename>CVE-2025-3070</cvename>
 <cvename>CVE-2025-3071</cvename>
 <cvename>CVE-2025-3072</cvename>
 <cvename>CVE-2025-3073</cvename>
 <cvename>CVE-2025-3074</cvename>
 <url>https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2025-04-01</discovery>
 <entry>2025-04-05</entry>
 </dates>
 </vuln>

<vuln vid="1205eccf-116d-11f0-8b2c-b42e991fc52e">
 <topic>Mozilla -- Memory corruption bug</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>134.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>134.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.6.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>134.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1827142%2C1932783">
	 Memory safety bugs present in Firefox 133, Thunderbird 133,
	 Firefox ESR 128.5, and Thunderbird 128.5. Some of these
	 bugs showed evidence of memory corruption and we presume
	 that with enough effort some of these could have been
	 exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0243</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-0243</url>
 </references>
 <dates>
 <discovery>2025-01-07</discovery>
 <entry>2025-04-04</entry>
 </dates>
 </vuln>

<vuln vid="f9d7b6ae-116c-11f0-8b2c-b42e991fc52e">
 <topic>Mozilla -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>134.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>134.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>134.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1835193%2C1910021%2C1919803%2C1931576%2C1931948%2C1932173">
	 Memory safety bugs present in Firefox 133 and Thunderbird 133.
	 Some of these bugs showed evidence of memory corruption and
	 we presume that with enough effort some of these could have
	 been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0247</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-0247</url>
 </references>
 <dates>
 <discovery>2025-01-07</discovery>
 <entry>2025-04-04</entry>
 </dates>
 </vuln>

<vuln vid="f7d80111-116c-11f0-8b2c-b42e991fc52e">
 <topic>firefox -- authentication bypass</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>134.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>134.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1895342">
	 Under certain circumstances, a user opt-in setting that
	 Focus should require authentication before use could have
	 been be bypassed.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0245</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-0245</url>
 </references>
 <dates>
 <discovery>2025-01-07</discovery>
 <entry>2025-04-04</entry>
 </dates>
 </vuln>

<vuln vid="f508f81e-116c-11f0-8b2c-b42e991fc52e">
 <topic>Mozilla -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>134.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>134.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>115.19</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>134.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1874523%2C1926454%2C1931873%2C1932169">
	 Memory safety bugs present in Firefox 133, Thunderbird 133,
	 Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18,
	 and Thunderbird 128.5. Some of these bugs showed evidence
	 of memory corruption and we presume that with enough effort
	 some of these could have been exploited to run arbitrary
	 code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0242</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-0242</url>
 </references>
 <dates>
 <discovery>2025-01-07</discovery>
 <entry>2025-04-04</entry>
 </dates>
 </vuln>

<vuln vid="f38dd0f1-116c-11f0-8b2c-b42e991fc52e">
 <topic>Mozilla -- DoS via segmentation fault</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>134.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>134.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.6.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>134.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1933023">
	 When segmenting specially crafted text, segmentation
	 would corrupt memory leading to a potentially exploitable
	 crash.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0241</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-0241</url>
 </references>
 <dates>
 <discovery>2025-01-07</discovery>
 <entry>2025-04-04</entry>
 </dates>
 </vuln>

<vuln vid="f1f92cd3-116c-11f0-8b2c-b42e991fc52e">
 <topic>Mozilla -- use-after-free while parsing JSON</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>134.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>134.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.6.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>134.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1929623">
	 Parsing a JavaScript module as JSON could, under some
	 circumstances, cause cross-compartment access, which may
	 result in a use-after-free.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0240</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-0240</url>
 </references>
 <dates>
 <discovery>2025-01-07</discovery>
 <entry>2025-04-04</entry>
 </dates>
 </vuln>

<vuln vid="f02e3c59-116c-11f0-8b2c-b42e991fc52e">
 <topic>Mozilla -- redirection to insecure site</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>134.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>134.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.6.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>134.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1929156">
	 When using Alt-Svc, ALPN did not properly validate
	 certificates when the original server is redirecting to an
	 insecure site.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0239</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-0239</url>
 </references>
 <dates>
 <discovery>2025-01-07</discovery>
 <entry>2025-04-04</entry>
 </dates>
 </vuln>

<vuln vid="ee407762-116c-11f0-8b2c-b42e991fc52e">
 <topic>Mozilla -- use-after-free after failed memory allocation</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>134.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>134.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.6.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1915535">
	 Assuming a controlled failed memory allocation, an
	 attacker could have caused a use-after-free, leading to a
	 potentially exploitable crash.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0238</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-0238</url>
 </references>
 <dates>
 <discovery>2025-01-07</discovery>
 <entry>2025-04-04</entry>
 </dates>
 </vuln>

<vuln vid="ea51e89a-116c-11f0-8b2c-b42e991fc52e">
 <topic>Mozilla -- privilege escalation attack</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>134.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>134.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.6.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1915257">
	 The WebChannel API, which is used to transport various
	 information across processes, did not check the sending
	 principal but rather accepted the principal being sent.
	 This could have led to privilege escalation attacks.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0237</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-0237</url>
 </references>
 <dates>
 <discovery>2025-01-07</discovery>
 <entry>2025-04-04</entry>
 </dates>
 </vuln>

<vuln vid="37c368f1-10a2-11f0-8195-b42e991fc52e">
 <topic>mozilla -- memory corruption</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>136.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>136.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>136.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1869650%2C1938451%2C1940326%2C1944052%2C1944063%2C1947281">
	 Memory safety bugs present in Firefox 135 and Thunderbird
	 135. Some of these bugs showed evidence of memory corruption
	 and we presume that with enough effort some of these could
	 have been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1943</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1943</url>
 </references>
 <dates>
 <discovery>2025-03-04</discovery>
 <entry>2025-04-03</entry>
 </dates>
 </vuln>

<vuln vid="b31a4e74-109d-11f0-8195-b42e991fc52e">
 <topic>mozilla -- memory corruption</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>136.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>136.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.8,1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>136.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1922889%2C1935004%2C1943586%2C1943912%2C1948111">
	CVE-2025-1938: Memory safety bugs present in Firefox 135,
	Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7.
	Some of these bugs showed evidence of memory corruption and
	we presume that with enough effort some of these could have
	been exploited to run arbitrary code.
	CVE-2025-1935: A web page could trick a user into setting
	that site as the default handler for a custom URL protocol.
	CVE-2025-1934: It was possible to interrupt the processing
	of a RegExp bailout and run additional JavaScript, potentially
	triggering garbage collection when the engine was not
	expecting it.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1938</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1938</url>
 <cvename>CVE-2025-1935</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1935</url>
 <cvename>CVE-2025-1934</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1934</url>
 </references>
 <dates>
 <discovery>2025-03-04</discovery>
 <entry>2025-04-03</entry>
 </dates>
 </vuln>

<vuln vid="aeb2ca87-109d-11f0-8195-b42e991fc52e">
 <topic>mozilla -- Memory safety bugs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>136.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>136.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>115.21,1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>136.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1938471%2C1940716">
	Memory safety bugs present in Firefox 135, Thunderbird 135,
	Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7.
	Some of these bugs showed evidence of memory corruption and
	we presume that with enough effort some of these could have
	been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1937</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1937</url>
 </references>
 <dates>
 <discovery>2025-03-04</discovery>
 <entry>2025-04-03</entry>
 </dates>
 </vuln>

<vuln vid="acf902f6-109d-11f0-8195-b42e991fc52e">
 <topic>mozilla -- use-after-free in WebTransport connection</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>136.0,2</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>136.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>115.21,1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>136.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1944126">
	 It was possible to cause a use-after-free in the content
	 process side of a WebTransport connection, leading to a
	 potentially exploitable crash.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1931</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1931</url>
 </references>
 <dates>
 <discovery>2025-03-04</discovery>
 <entry>2025-04-03</entry>
 </dates>
 </vuln>

<vuln vid="a93a1d2a-109d-11f0-8195-b42e991fc52e">
 <topic>mozilla -- 64 bit JIT WASM read on left over memory</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>136.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>115.21,1</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>136.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>136.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1946004">
	 On 64-bit CPUs, when the JIT compiles WASM i32 return
	 values they can pick up bits from left over memory.
	 This can potentially cause them to be treated as a different
	 type.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1933</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1933</url>
 </references>
 <dates>
 <discovery>2025-03-04</discovery>
 <entry>2025-04-03</entry>
 </dates>
 </vuln>

<vuln vid="350b3389-107f-11f0-8195-b42e991fc52e">
 <topic>MongoDB -- crash due to improper validation of explain command</topic>
 <affects>
 <package>
	<name>mongodb50</name>
	<range><lt>5.0.31</lt></range>
 </package>
 <package>
	<name>mongodb60</name>
	<range><lt>6.0.20</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.16</lt></range>
 </package>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@mongodb.com reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-103153">
	 When run on commands with certain arguments set, explain may fail
	to validate these arguments before using them.	This can lead to
	crashes in router servers. This affects MongoDB Server v5.0 prior
	to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0
	prior to 7.0.16 and MongoDB Server v8.0 prior to 8.0.4
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3084</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-3084</url>
 </references>
 <dates>
 <discovery>2025-04-01</discovery>
 <entry>2025-04-03</entry>
 </dates>
 </vuln>

<vuln vid="32f5e57f-107f-11f0-8195-b42e991fc52e">
 <topic>MongoDB -- Malformed wire protocol messages may cause mongos to crash</topic>
 <affects>
 <package>
	<name>mongodb50</name>
	<range><lt>5.0.31</lt></range>
 </package>
 <package>
	<name>mongodb60</name>
	<range><lt>6.0.20</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.16</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@mongodb.com reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-103152">
	 Specifically crafted MongoDB wire protocol messages can cause mongos
	to crash during command validation. This can occur without using
	an authenticated connection. This issue affects MongoDB v5.0
	versions prior to 5.0.31, MongoDB v6.0 versions prior to6.0.20 and
	MongoDB v7.0 versions prior to 7.0.16
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3083</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-3083</url>
 </references>
 <dates>
 <discovery>2025-04-01</discovery>
 <entry>2025-04-03</entry>
 </dates>
 </vuln>

<vuln vid="30418b26-107f-11f0-8195-b42e991fc52e">
 <topic>MongoDB -- Unauthorized access to underlying data</topic>
 <affects>
 <package>
	<name>mongodb50</name>
	<range><lt>5.0.31</lt></range>
 </package>
 <package>
	<name>mongodb60</name>
	<range><lt>6.0.20</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.16</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@mongodb.com reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-103151">
	 A user authorized to access a view may be able to alter the intended
	collation, allowing them to access to a different or unintended
	view of underlying data. This issue affects MongoDB Server v5.0
	version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20,
	MongoDB Server v7.0 version prior to 7.0.14 and MongoDB Server v7.3
	versions prior to 7.3.4.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-3082</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-3082</url>
 </references>
 <dates>
 <discovery>2025-04-01</discovery>
 <entry>2025-04-03</entry>
 </dates>
 </vuln>

<vuln vid="2cad4541-0f5b-11f0-89f8-411aefea0df9">
 <topic>openvpn -- server-side denial-of-service vulnerability with tls-crypt-v2</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><ge>2.6.1</ge><lt>2.6.14</lt></range>
 </package>
 <package>
	<name>openvpn-devel</name>
	<range><lt>g20250402,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gert Doering reports:
	<blockquote cite="https://github.com/OpenVPN/openvpn/blob/v2.6.14/Changes.rst#overview-of-changes-in-2614">
	 OpenVPN servers between 2.6.1 and 2.6.13 using
	 --tls-crypt-v2 can be made to abort with an ASSERT() message by
	 sending a particular combination of authenticated and malformed packets.
	 To trigger the bug, a valid tls-crypt-v2 client key is needed, or
	 network observation of a handshake with a valid tls-crypt-v2 client key
	 No crypto integrity is violated, no data is leaked, and no remote
	 code execution is possible.
	 This bug does not affect OpenVPN clients.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-2704</cvename>
 <url>https://github.com/OpenVPN/openvpn/blob/v2.6.14/Changes.rst#overview-of-changes-in-2614</url>
 </references>
 <dates>
 <discovery>2025-03-26</discovery>
 <entry>2025-04-02</entry>
 </dates>
 </vuln>

<vuln vid="300f86de-0e4d-11f0-ae40-b42e991fc52e">
 <topic>gitea -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.23.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@golang.org reports:
	<blockquote cite="https://go.dev/cl/654697">
	Matching of hosts against proxy patterns can improperly treat an
	IPv6 zone ID as a hostname component. For example, when the NO_PROXY
	environment variable is set to "*.example.com", a request
	to "[::1%25.example.com]:80` will incorrectly match and not
	be proxied.
	go-redis is the official Redis client library for the Go programming
	language. Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially
	responds out of order when `CLIENT SETINFO` times out during
	connection establishment. This can happen when the client is
	configured to transmit its identity, there are network connectivity
	issues, or the client was configured with aggressive timeouts.	The
	problem occurs for multiple use cases.	For sticky connections, you
	receive persistent out-of-order responses for the lifetime of the
	connection. All commands in the pipeline receive incorrect responses.
	When used with the default ConnPool once a connection is returned
	after use with ConnPool#Put the read buffer will be checked and the
	connection will be marked as bad due to the unread data. This means
	that at most one out-of-order response before the connection is
	discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.3. You
	can prevent the vulnerability by setting the flag DisableIndentity
	to true when constructing the client instance.
	golang-jwt is a Go implementation of JSON Web Tokens. Prior to
	5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a
	call to strings.Split) its argument (which is untrusted data) on
	periods. As a result, in the face of a malicious request whose
	Authorization header consists of Bearer followed by many period
	characters, a call to that function incurs allocations to the tune
	of O(n) bytes (where n stands for the length of the function's
	argument), with a constant factor of about 16.	This issue is fixed
	in 5.2.2 and 4.5.2.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-22870</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-22870</url>
 <cvename>CVE-2025-29923</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-29923</url>
 <cvename>CVE-2025-30204</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-30204</url>
 </references>
 <dates>
 <discovery>2025-03-12</discovery>
 <entry>2025-03-31</entry>
 </dates>
 </vuln>

<vuln vid="1a67144d-0d86-11f0-8542-b42e991fc52e">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>136.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.8,1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>136.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.8</lt></range>
 </package>
 <package>
	<name>librewolf</name>
	<range><lt>136.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1945392">
	 An inconsistent comparator in xslt/txNodeSorter could have resulted
	in potentially exploitable out-of-bounds access. Only affected
	version 122 and later.	This vulnerability affects Firefox &lt;
	136, Firefox ESR &lt; 128.8, Thunderbird &lt; 136, and Thunderbird
	&lt; 128.8.
	 Under certain circumstances, a user opt-in setting that Focus should
	require authentication before use could have been be bypassed
	(distinct from CVE-2025-0245).	This vulnerability affects Firefox
	&lt; 136.
	 When String.toUpperCase() caused a string to get longer it was
	possible for uninitialized memory to be incorporated into the result
	string This vulnerability affects Firefox &lt; 136 and Thunderbird
	&lt; 136.
	 Websites redirecting to a non-HTTP scheme URL could allow a website
	address to be spoofed for a malicious page This vulnerability affects
	Firefox for iOS &lt; 136.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1932</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1932</url>
 <cvename>CVE-2025-1941</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1941</url>
 <cvename>CVE-2025-1942</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1942</url>
 <cvename>CVE-2025-27424</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-27424</url>
 </references>
 <dates>
 <discovery>2025-03-04</discovery>
 <entry>2025-03-30</entry>
 </dates>
 </vuln>

<vuln vid="1d53db32-0d60-11f0-8542-b42e991fc52e">
 <topic>suricata -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>suricata</name>
	<range><lt>7.0.9</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Suricate team reports:
	<blockquote cite="https://forum.suricata.io/t/suricata-7-0-9-released/5495">
	 Multiple vulnerabilities
	</blockquote>
	<ul>
	<li>
	CVE-2025-29915: Severity HIGH. The AF_PACKET defrag option
	is enabled by default and allows AF_PACKET to re-assemble
	fragmented packets before reaching Suricata. However the
	default packet size in Suricata is based on the network
	interface MTU which leads to Suricata seeing truncated
	packets.
	</li>
	<li>
	CVE-2025-29916: Severity Moderate. Datasets declared in
	rules have an option to specify the `hashsize` to use.
	This size setting isn't properly limited, so the hash
	table allocation can be large. Untrusted rules can lead to
	large memory allocations, potentially leading to denial of
	service due to resource starvation
	</li>
	<li>
	CVE-2025-29917: Severity HIGH. The bytes setting in the
	decode_base64 keyword is not properly limited. Due to
	this, signatures using the keyword and setting can cause
	large memory allocations of up to 4 GiB per thread.
	</li>
	<li>
	CVE-2025-29918: Severity HIGH. A PCRE rule can be written
	that leads to an infinite loop when negated PCRE is used.
	Packet processing thread becomes stuck in infinite loop
	limiting visibility and availability in inline mode.
	</li>
	</ul>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-29915</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29915</url>
 <cvename>CVE-2025-29916</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29916</url>
 <cvename>CVE-2025-29917</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29917</url>
 <cvename>CVE-2025-29918</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29918</url>
 </references>
 <dates>
 <discovery>2025-03-12</discovery>
 <entry>2025-03-30</entry>
 </dates>
 </vuln>

<vuln vid="7cb6642c-0c5a-11f0-8688-4ccc6adda413">
 <topic>qt6-webengine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>qt6-pdf</name>
	<name>qt6-webengine</name>
	<range><lt>6.8.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Qt qtwebengine-chromium repo reports:
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=122-based">
	 Backports for 11 security bugs in Chromium:
	 <ul>
	 <li>CVE-2024-11477: 7-Zip Zstd decompression integer underflow</li>
	 <li>CVE-2025-0762: Use after free in DevTools</li>
	 <li>CVE-2025-0996: Inappropriate implementation in Browser UI</li>
	 <li>CVE-2025-0998: Out of bounds memory access in V8</li>
	 <li>CVE-2025-0999: Heap buffer overflow in V8</li>
	 <li>CVE-2025-1006: Use after free in Network</li>
	 <li>CVE-2025-1426: Heap buffer overflow in GPU</li>
	 <li>CVE-2025-1918: Out of bounds read in Pdfium</li>
	 <li>CVE-2025-1919: Out of bounds read in Media</li>
	 <li>CVE-2025-1921: Inappropriate implementation in Media</li>
	 <li>CVE-2025-2036: Use after free in Inspector</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-11477</cvename>
 <cvename>CVE-2025-0762</cvename>
 <cvename>CVE-2025-0996</cvename>
 <cvename>CVE-2025-0998</cvename>
 <cvename>CVE-2025-0999</cvename>
 <cvename>CVE-2025-1006</cvename>
 <cvename>CVE-2025-1426</cvename>
 <cvename>CVE-2025-1918</cvename>
 <cvename>CVE-2025-1919</cvename>
 <cvename>CVE-2025-1921</cvename>
 <cvename>CVE-2025-2036</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=122-based</url>
 </references>
 <dates>
 <discovery>2025-02-20</discovery>
 <entry>2025-03-29</entry>
 </dates>
 </vuln>

<vuln vid="01a7e1e1-d249-4dd8-9a4a-ef95b5747afb">
 <topic>electron{33,34} -- Incorrect handle provided in unspecified circumstances in Mojo</topic>
 <affects>
 <package>
	<name>electron33</name>
	<range><lt>33.4.8</lt></range>
 </package>
 <package>
	<name>electron34</name>
	<range><lt>34.4.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v33.4.8">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2025-2783.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-2783</cvename>
 <url>https://github.com/advisories/GHSA-hfqm-jfc6-rh2f</url>
 </references>
 <dates>
 <discovery>2025-03-27</discovery>
 <entry>2025-03-28</entry>
 </dates>
 </vuln>

<vuln vid="1daa2814-0a6c-11f0-b4e4-2cf05da270f3">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.10.0</ge><lt>17.10.1</lt></range>
	<range><ge>17.9.0</ge><lt>17.9.3</lt></range>
	<range><ge>12.10.0</ge><lt>17.8.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/03/26/patch-release-gitlab-17-10-1-released/">
	 Cross-site Scripting (XSS) through merge-request error messages
	 Cross-site Scripting (XSS) through improper rendering of certain file types
	 Admin Privileges Persists After Role is Revoked
	 External user can access internal projects
	 Prompt injection in Amazon Q integration may allow unauthorized actions
	 Uncontrolled Resource Consumption via a maliciously crafted terraform file in merge request
	 Maintainer can inject shell code in Harbor project name configuration when using helper scripts
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-2255</cvename>
 <cvename>CVE-2025-0811</cvename>
 <cvename>CVE-2025-2242</cvename>
 <cvename>CVE-2024-12619</cvename>
 <cvename>CVE-2024-10307</cvename>
 <cvename>CVE-2024-9773</cvename>
 <url>https://about.gitlab.com/releases/2025/03/26/patch-release-gitlab-17-10-1-released/</url>
 </references>
 <dates>
 <discovery>2025-03-26</discovery>
 <entry>2025-03-26</entry>
 </dates>
 </vuln>

<vuln vid="964aa5da-f094-47fe-9ebd-2142f9157440">
 <topic>electron{33,34} -- Type Confusion in V8</topic>
 <affects>
 <package>
	<name>electron33</name>
	<range><lt>33.4.6</lt></range>
 </package>
 <package>
	<name>electron34</name>
	<range><lt>34.3.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v33.4.6">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2025-1920.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1920</cvename>
 <url>https://github.com/advisories/GHSA-fhwv-7gx3-h767</url>
 </references>
 <dates>
 <discovery>2025-03-20</discovery>
 <entry>2025-03-25</entry>
 </dates>
 </vuln>

<vuln vid="a58fdfef-07c6-11f0-8688-4ccc6adda413">
 <topic>qt5-webengine -- Use after free in Compositing</topic>
 <affects>
 <package>
	<name>qt5-webengine</name>
	<range><lt>5.15.18p7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Qt qtwebengine-chromium repo reports:
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based">
	 Backports for 1 security bug in Chromium:
	 <ul>
	 <li>CVE-2024-12694: Use after free in Compositing</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-12694</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based</url>
 </references>
 <dates>
 <discovery>2025-02-14</discovery>
 <entry>2025-03-23</entry>
 </dates>
 </vuln>

<vuln vid="26f6733d-06a9-11f0-ba0b-641c67a117d8">
 <topic>www/varnish7 -- client-side desync vulnerability</topic>
 <affects>
 <package>
	<name>varnish7</name>
	<range><lt>7.6.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Varnish Development Team reports:
	<blockquote cite="https://varnish-cache.org/security/VSV00015.html#vsv00015">
	A client-side desync vulnerability can be triggered in Varnish Cache
	 and Varnish Enterprise. This vulnerability can be triggered under
	 specific circumstances involving malformed HTTP/1 requests.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-30346</cvename>
 <url>https://varnish-cache.org/security/VSV00015.html#vsv00015</url>
 </references>
 <dates>
 <discovery>2024-12-17</discovery>
 <entry>2025-03-22</entry>
 </dates>
 </vuln>

<vuln vid="9456d4e9-055f-11f0-85f3-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>134.0.6998.117</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>134.0.6998.117</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_19.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[401029609] Critical CVE-2025-2476: Use after free in Lens. Reported by SungKwon Lee of Enki Whitehat on 2025-03-05</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-2476</cvename>
 <url>https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_19.html</url>
 </references>
 <dates>
 <discovery>2025-03-19</discovery>
 <entry>2025-03-20</entry>
 </dates>
 </vuln>

<vuln vid="2ac2ddc2-0051-11f0-8673-f02f7432cf97">
 <topic>php -- Multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>php81</name>
 <range>
	<lt>8.1.32</lt>
 </range>
 </package>
 <package>
 <name>php82</name>
 <range>
	<lt>8.2.28</lt>
 </range>
 </package>
 <package>
 <name>php83</name>
 <range>
	<lt>8.3.19</lt>
 </range>
 </package>
 <package>
 <name>php84</name>
 <range>
	<lt>8.4.5</lt>
 </range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 php.net reports:
 <blockquote cite="https://www.php.net/ChangeLog-8.php">
	<ul>
	 <li>
	 CVE-2024-11235: Core: Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free).
	 </li>
	 <li>
	 CVE-2025-1219: LibXML: Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource).
	 </li>
	 <li>
	 CVE-2025-1736: Streams: Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header).
	 </li>
	 <li>
	 CVE-2025-1861: Streams: Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes).
	 </li>
	 <li>
	 CVE-2025-1734: Streams: Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon).
	 </li>
	 <li>
	 CVE-2025-1217: Streams: Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers).
	 </li>
	</ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-11235</cvename>
 <cvename>CVE-2025-1219</cvename>
 <cvename>CVE-2025-1736</cvename>
 <cvename>CVE-2025-1861</cvename>
 <cvename>CVE-2025-1734</cvename>
 <cvename>CVE-2025-1217</cvename>
 <url>https://www.php.net/ChangeLog-8.php</url>
 </references>
 <dates>
 <discovery>2025-03-13</discovery>
 <entry>2025-03-13</entry>
 </dates>
 </vuln>

<vuln vid="0b43fac4-005d-11f0-a540-6cc21735f730">
 <topic>shibboleth-sp -- Parameter manipulation allows the forging of signed SAML messages</topic>
 <affects>
 <package>
	<name>opensaml</name>
	<range><lt>3.3.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Shibboleth Project reports:
	<blockquote cite="https://shibboleth.net/community/advisories/secadv_20250313.txt">
	 
	 An updated version of the OpenSAML C++ library is available
	 which corrects a parameter manipulation vulnerability when using
	 SAML bindings that rely on non-XML signatures. The Shibboleth
	 Service Provider is impacted by this issue, and it manifests as
	 a critical security issue in that context.
	 
	 
	 Parameter manipulation allows the forging of signed SAML messages
	 
	 
	 A number of vulnerabilities in the OpenSAML library used by the
	 Shibboleth Service Provider allowed for creative manipulation of
	 parameters combined with reuse of the contents of older requests
	 to fool the library's signature verification of non-XML based
	 signed messages.
	 
	 
	 Most uses of that feature involve very low or
	 low impact use cases without critical security implications;
	 however, there are two scenarios that are much more critical,
	 one affecting the SP and one affecting some implementers who
	 have implemented their own code on top of our OpenSAML library
	 and done so improperly.
	 
	 
	 The SP's support for the HTTP-POST-SimpleSign SAML binding for
	 Single Sign-On responses is its critical vulnerability, and it
	 is enabled by default (regardless of what one's published SAML
	 metadata may advertise).
	 
	 
	 The other critical case involves a mistake that
	 does *not* impact the Shibboleth SP, allowing SSO to occur over
	 the HTTP-Redirect binding contrary to the plain language of the
	 SAML Browser SSO profile. The SP does not support this, but
	 other implementers may have done so.
	 
	 
	 Prior to updating, it is possible to mitigate the POST-SimpleSign
	 vulnerability by editing the protocols.xml configuration file and
	 removing this line:
	 <code>&lt;Binding id="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
		path="/SAML2/POST-SimpleSign" /&gt;</code>
	 
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://shibboleth.net/community/advisories/secadv_20250313.txt</url>
 </references>
 <dates>
 <discovery>2025-03-13</discovery>
 <entry>2025-03-13</entry>
 </dates>
 </vuln>

<vuln vid="a435609c-ffd5-11ef-b4e4-2cf05da270f3">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.9.0</ge><lt>17.9.2</lt></range>
	<range><ge>17.8.0</ge><lt>17.8.5</lt></range>
	<range><ge>11.5</ge><lt>17.7.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released/">
	 CVE-2025-25291 and CVE-2025-25292 (third party gem ruby-saml)
	 CVE-2025-27407 (third party gem graphql)
	 Denial of Service Due to Inefficient Processing of Untrusted Input
	 Credentials disclosed when repository mirroring fails
	 Denial of Service Vulnerability in GitLab Approval Rules due to Unbounded Field
	 Internal Notes in Merge Requests Are Emailed to Non-Members Upon Review Submission
	 Maintainer can inject shell code in Google integrations
	 Guest with custom Admin group member permissions can approve the users invitation despite user caps
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-25291</cvename>
 <cvename>CVE-2025-25292</cvename>
 <cvename>CVE-2025-27407</cvename>
 <cvename>CVE-2024-13054</cvename>
 <cvename>CVE-2024-12380</cvename>
 <cvename>CVE-2025-1257</cvename>
 <cvename>CVE-2025-0652</cvename>
 <cvename>CVE-2024-8402</cvename>
 <cvename>CVE-2024-7296</cvename>
 <url>https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released/</url>
 </references>
 <dates>
 <discovery>2025-03-12</discovery>
 <entry>2025-03-13</entry>
 </dates>
 </vuln>

<vuln vid="9cf03c96-ffa5-11ef-bb15-002590af0794">
 <topic>vim -- potential data loss with zip.vim and specially crafted zip files</topic>
 <affects>
 <package>
	<name>vim</name>
	<range><lt>9.1.1198</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Vim reports:
	<blockquote cite="https://github.com/vim/vim/security/advisories/GHSA-693p-m996-3rmf">
	 See https://github.com/vim/vim/security/advisories/GHSA-693p-m996-3rmf
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-29768</cvename>
 <url>https://github.com/vim/vim/security/advisories/GHSA-693p-m996-3rmf</url>
 </references>
 <dates>
 <discovery>2025-03-12</discovery>
 <entry>2025-03-12</entry>
 </dates>
 </vuln>

<vuln vid="a02a6d94-fe53-11ef-85f3-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>134.0.6998.88</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>134.0.6998.88</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_10.html">
	 This update includes 5 security fixes:
	 <ul>
	 <li>[398065918] High CVE-2025-1920: Type Confusion in V8. Reported by Excello s.r.o. on 2025-02-21</li>
	 <li>[400052777] High CVE-2025-2135: Type Confusion in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2025-03-02</li>
	 <li>[401059730] High CVE-TBD: Out of bounds write in GPU. Reported on 2025-03-05</li>
	 <li>[395032416] Medium CVE-2025-2136: Use after free in Inspector. Reported by Sakana.S on 2025-02-10</li>
	 <li>[398999390] Medium CVE-2025-2137: Out of bounds read in V8. Reported by zeroxiaobai@ on 2025-02-25</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-1920</cvename>
 <cvename>CVE-2025-2135</cvename>
 <cvename>CVE-2025-2136</cvename>
 <cvename>CVE-2025-2137</cvename>
 <url>https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_10.html</url>
 </references>
 <dates>
 <discovery>2025-03-10</discovery>
 <entry>2025-03-11</entry>
 </dates>
 </vuln>

<vuln vid="a86f9189-fdd9-11ef-91ff-b42e991fc52e">
 <topic>libreoffice -- Macro URL arbitrary script execution</topic>
 <affects>
 <package>
	<name>libreoffice</name>
	<range><ge>24.8</ge><lt>24.8.5</lt></range>
	<range><ge>25.2</ge><lt>25.2.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@documentfoundation.org reports:
	<blockquote cite="https://www.libreoffice.org/about-us/security/advisories/cve-2025-1080">
	 LibreOffice supports Office URI Schemes to enable browser integration
	of LibreOffice with MS SharePoint server. An additional scheme
	'vnd.libreoffice.command' specific to LibreOffice was
	added.	In the affected versions of LibreOffice a link in a browser
	using that scheme could be constructed with an embedded inner URL
	that when passed to LibreOffice could call internal macros with
	arbitrary arguments. This issue affects LibreOffice: from 24.8
	before &lt; 24.8.5, from 25.2 before &lt; 25.2.1.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1080</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1080</url>
 </references>
 <dates>
 <discovery>2025-03-04</discovery>
 <entry>2025-03-10</entry>
 </dates>
 </vuln>

<vuln vid="2ec7816d-fdb7-11ef-91ff-b42e991fc52e">
 <topic>vim -- Improper Input Validation in Vim</topic>
 <affects>
 <package>
	<name>vim</name>
	<range><lt>9.1.1164</lt></range>
 </package>
 <package>
	<name>vim-gtk2</name>
	<range><lt>9.1.1164</lt></range>
 </package>
 <package>
	<name>vim-gtk3</name>
	<range><lt>9.1.1164</lt></range>
 </package>
 <package>
	<name>vim-motif</name>
	<range><lt>9.1.1164</lt></range>
 </package>
 <package>
	<name>vim-tiny</name>
	<range><lt>9.1.1164</lt></range>
 </package>
 <package>
	<name>vim-x11</name>
	<range><lt>9.1.1164</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/vim/vim/commit/129a8446d23cd9cb4445fcfea259cba5e0487d29">
	 Vim is distributed with the tar.vim plugin, that allows
	 easy editing and viewing of (compressed or uncompressed) tar
	 files. Starting with 9.1.0858, the tar.vim plugin uses the
	 ":read" ex command line to append below the
	 cursor position, however the is not sanitized and is taken
	 literally from the tar archive. This allows to execute
	 shellcommands via special crafted tar archives. Whether
	 this really happens, depends on the shell being used
	 ('shell' option, which is set using $SHELL).
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-27423</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-27423</url>
 </references>
 <dates>
 <discovery>2025-03-03</discovery>
 <entry>2025-03-10</entry>
 </dates>
 </vuln>

<vuln vid="6ba9e26e-c9c6-49f7-ae43-47e5864f0b66">
 <topic>electron33 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron33</name>
	<range><lt>33.4.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron develpers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v33.4.3">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2025-0445.</li>
	 <li>Security: backported fix for CVE-2025-0995.</li>
	 <li>Security: backported fix for CVE-2025-0998.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0445</cvename>
 <url>https://github.com/advisories/GHSA-q4fq-38gr-ccp3</url>
 <cvename>CVE-2025-0995</cvename>
 <url>https://github.com/advisories/GHSA-377p-4737-hx6m</url>
 <cvename>CVE-2025-0998</cvename>
 <url>https://github.com/advisories/GHSA-4v9x-qxmv-4h58</url>
 </references>
 <dates>
 <discovery>2025-03-06</discovery>
 <entry>2025-03-08</entry>
 </dates>
 </vuln>

<vuln vid="6e27040b-61b7-4989-9471-dfb10c3cd76e">
 <topic>electron32 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron32</name>
	<range><lt>32.3.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v32.3.3">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2025-0445.</li>
	 <li>Security: backported fix for CVE-2025-0998.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0445</cvename>
 <url>https://github.com/advisories/GHSA-q4fq-38gr-ccp3</url>
 <cvename>CVE-2025-0998</cvename>
 <url>https://github.com/advisories/GHSA-4v9x-qxmv-4h58</url>
 </references>
 <dates>
 <discovery>2025-03-03</discovery>
 <entry>2025-03-07</entry>
 </dates>
 </vuln>

<vuln vid="3299cbfd-fa6e-11ef-929d-b0416f0c4c67">
 <topic>Jinja2 -- Sandbox breakout through attr filter selecting format method</topic>
 <affects>
 <package>
	<name>py38-Jinja2</name>
	<name>py39-Jinja2</name>
	<name>py310-Jinja2</name>
	<name>py311-Jinja2</name>
	<range><lt>3.1.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403">
	 Jinja is an extensible templating engine.	Prior to 3.1.6, an
	oversight in how the Jinja sandboxed environment interacts with the
	|attr filter allows an attacker that controls the content of a
	template to execute arbitrary Python code. To exploit the
	vulnerability, an attacker needs to control the content of a template.
	Whether that is the case depends on the type of application using
	Jinja.	This vulnerability impacts users of applications which
	execute untrusted templates. Jinja's sandbox does catch calls
	to str.format and ensures they don't escape the sandbox.
	However, it's possible to use the |attr filter to get a reference
	to a string's plain format method, bypassing the sandbox.
	After the fix, the |attr filter no longer bypasses the environment's
	attribute lookup. This vulnerability is fixed in 3.1.6.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-27516</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-27516</url>
 </references>
 <dates>
 <discovery>2025-03-05</discovery>
 <entry>2025-03-06</entry>
 </dates>
 </vuln>

<vuln vid="f4297478-fa62-11ef-b597-001fc69cd6dc">
 <topic>xorg server -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<name>xephyr</name>
	<name>xorg-vfbserver</name>
	<range><lt>21.1.16,1</lt></range>
 </package>
 <package>
	<name>xorg-nextserver</name>
	<range><lt>21.1.16,2</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>24.1.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The X.Org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2025-February/003584.html">
	 <ul>
	 <li>
	 CVE-2025-26594: Use-after-free of the root cursor

The root cursor is referenced in the xserver as a global variable. If
	 a client manages to free the root cursor, the internal reference points
	 to freed memory and causes a use-after-free.
	 </li>
	 <li>
	 CVE-2025-26595: Buffer overflow in XkbVModMaskText()

The code in XkbVModMaskText() allocates a fixed sized buffer on the
	 stack and copies the names of the virtual modifiers to that buffer.
	 The code however fails to check the bounds of the buffer correctly and
	 would copy the data regardless of the size, which may lead to a buffer
	 overflow.
	 </li>
	 <li>
	 CVE-2025-26596: Heap overflow in XkbWriteKeySyms()

The computation of the length in XkbSizeKeySyms() differs from what is
	 actually written in XkbWriteKeySyms(), which may lead to a heap based
	 buffer overflow.
	 </li>
	 <li>
	 CVE-2025-26597: Buffer overflow in XkbChangeTypesOfKey()

If XkbChangeTypesOfKey() is called with 0 group, it will resize the key
	 symbols table to 0 but leave the key actions unchanged.
	 If later, the same function is called with a non-zero value of groups,
	 this will cause a buffer overflow because the key actions are of the wrong
	 size.
	 </li>
	 <li>
	 CVE-2025-26598: Out-of-bounds write in CreatePointerBarrierClient()

The function GetBarrierDevice() searches for the pointer device based on
	 its device id and returns the matching value, or supposedly NULL if no
	 match was found.
	 However the code will return the last element of the list if no matching
	 device id was found which can lead to out of bounds memory access.
	 </li>
	 <li>
	 CVE-2025-26599: Use of uninitialized pointer in compRedirectWindow()

The function compCheckRedirect() may fail if it cannot allocate the backing
	 pixmap. In that case, compRedirectWindow() will return a BadAlloc error
	 without the validation of the window tree marked just before, which leaves
	 the validate data partly initialized, and the use of an uninitialized pointer
	 later.
	 </li>
	 <li>
	 CVE-2025-26600: Use-after-free in PlayReleasedEvents()

When a device is removed while still frozen, the events queued for that
	 device remain while the device itself is freed and replaying the events
	 will cause a use after free.
	 </li>
	 <li>
	 CVE-2025-26601: Use-after-free in SyncInitTrigger()

When changing an alarm, the values of the change mask are evaluated one
	 after the other, changing the trigger values as requested and eventually,
	 SyncInitTrigger() is called.
	 If one of the changes triggers an error, the function will return early,
	 not adding the new sync object.
	 This can be used to cause a use after free when the alarm eventually
	 triggers.
	 </li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-26594</cvename>
 <cvename>CVE-2025-26595</cvename>
 <cvename>CVE-2025-26596</cvename>
 <cvename>CVE-2025-26597</cvename>
 <cvename>CVE-2025-26598</cvename>
 <cvename>CVE-2025-26599</cvename>
 <cvename>CVE-2025-26600</cvename>
 <cvename>CVE-2025-26601</cvename>
 <url>https://lists.x.org/archives/xorg-announce/2025-February/003584.html</url>
 </references>
 <dates>
 <discovery>2025-02-25</discovery>
 <entry>2025-03-06</entry>
 </dates>
 </vuln>

<vuln vid="d8bd20ae-fa48-11ef-ab7a-ace2d30de67a">
 <topic>caldera -- Remote Code Execution</topic>
 <affects>
 <package>
	<name>caldera</name>
	<range><lt>5.2.0</lt></range>
 </package>
 <package>
	<name>caldera4</name>
	<range><le>4.2.0</le></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Caldera contributor report:
	<blockquote cite="https://github.com/mitre/caldera/pull/3129">
	 In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e,
 a Remote Code Execution (RCE) vulnerability was found in the dynamic
 agent (implant) compilation functionality of the server. This allows
 remote attackers to execute arbitrary code on the server that Caldera
 is running on via a crafted web request to the Caldera server API used
 for compiling and downloading of Caldera's Sandcat or Manx agent
 (implants). This web request can use the gcc -extldflags linker flag
 with sub-commands.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-27364</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-27364</url>
 </references>
 <dates>
 <discovery>2025-02-16</discovery>
 <entry>2025-03-06</entry>
 </dates>
 </vuln>

<vuln vid="cb98d018-f9f5-11ef-a398-00e081b7aa2d">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.500</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.492.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2025-03-05/">
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-3495 / CVE-2025-27622</h5>
	 Encrypted values of secrets stored in agent configuration revealed to users with Agent/Extended Read permission
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-3496 / CVE-2025-27623</h5>
	 Encrypted values of secrets stored in view configuration revealed to users with View/Read permission
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-3498 / CVE-2025-27624</h5>
	 CSRF vulnerability
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-3501 / CVE-2025-27625</h5>
	 Open redirect vulnerability
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-27622</cvename>
 <cvename>CVE-2025-27623</cvename>
 <cvename>CVE-2025-27624</cvename>
 <cvename>CVE-2025-27625</cvename>
 <url>https://www.jenkins.io/security/advisory/2025-03-05/</url>
 </references>
 <dates>
 <discovery>2025-03-05</discovery>
 <entry>2025-03-05</entry>
 </dates>
 </vuln>

<vuln vid="475d1968-f99d-11ef-b382-b0416f0c4c67">
 <topic>Spotipy -- Spotipy's cache file, containing spotify auth token, is created with overly broad permissions</topic>
 <affects>
 <package>
	<name>py38-spotipy</name>
	<name>py39-spotipy</name>
	<name>py310-spotipy</name>
	<name>py311-spotipy</name>
	<range><lt>2.25.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/spotipy-dev/spotipy/blob/master/spotipy/cache_handler.py#L93-L98">
	 Spotipy is a lightweight Python library for the Spotify Web API.
	The `CacheHandler` class creates a cache file to store the auth
	token.	Prior to version 2.25.1, the file created has `rw-r--r--`
	(644) permissions by default, when it could be locked down to
	`rw-------` (600) permissions.	This leads to overly broad exposure
	of the spotify auth token. If this token can be read by an attacker
	(another user on the machine, or a process running as another user),
	it can be used to perform administrative actions on the Spotify
	account, depending on the scope granted to the token. Version
	2.25.1 tightens the cache file permissions.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-27154</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-27154</url>
 </references>
 <dates>
 <discovery>2025-02-27</discovery>
 <entry>2025-03-05</entry>
 </dates>
 </vuln>

<vuln vid="9c62d3f0-f997-11ef-85f3-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>134.0.6998.35</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>134.0.6998.35</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html">
	 This update includes 14 security fixes:
	 <ul>
	 <li>[397731718] High CVE-2025-1914: Out of bounds read in V8. Reported by Zhenghang Xiao (@Kipreyyy) and Nan Wang (@eternalsakura13) on 2025-02-20</li>
	 <li>[391114799] Medium CVE-2025-1915: Improper Limitation of a Pathname to a Restricted Directory in DevTools. Reported by Topi Lassila on 2025-01-20</li>
	 <li>[376493203] Medium CVE-2025-1916: Use after free in Profiles. Reported by parkminchan, SSD Labs Korea on 2024-10-31</li>
	 <li>[329476341] Medium CVE-2025-1917: Inappropriate Implementation in Browser UI. Reported by Khalil Zhani on 2024-03-14</li>
	 <li>[388557904] Medium CVE-2025-1918: Out of bounds read in PDFium. Reported by asnine on 2025-01-09</li>
	 <li>[392375312] Medium CVE-2025-1919: Out of bounds read in Media. Reported by @Bl1nnnk and @Pisanbao on 2025-01-26</li>
	 <li>[387583503] Medium CVE-2025-1921: Inappropriate Implementation in Media Stream. Reported by Kaiido on 2025-01-04</li>
	 <li>[384033062] Low CVE-2025-1922: Inappropriate Implementation in Selection. Reported by Alesandro Ortiz on 2024-12-14</li>
	 <li>[382540635] Low CVE-2025-1923: Inappropriate Implementation in Permission Prompts. Reported by Khalil Zhani on 2024-12-06</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-1914</cvename>
 <cvename>CVE-2025-1915</cvename>
 <cvename>CVE-2025-1916</cvename>
 <cvename>CVE-2025-1917</cvename>
 <cvename>CVE-2025-1918</cvename>
 <cvename>CVE-2025-1919</cvename>
 <cvename>CVE-2025-1921</cvename>
 <cvename>CVE-2025-1922</cvename>
 <cvename>CVE-2025-1923</cvename>
 <url>https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2025-03-04</discovery>
 <entry>2025-03-05</entry>
 </dates>
 </vuln>

<vuln vid="f4f3e001-402b-4d6d-8efa-ab11fcf8de2b">
 <topic>electron{32,33} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron32</name>
	<range><lt>32.3.2</lt></range>
 </package>
 <package>
	<name>electron33</name>
	<range><lt>33.4.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v32.3.2">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2025-0611.</li>
	 <li>Security: backported fix for CVE-2025-0612.</li>
	 <li>Security: backported fix for CVE-2025-0999.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0611</cvename>
 <url>https://github.com/advisories/GHSA-83vc-v46q-mv3w</url>
 <cvename>CVE-2025-0612</cvename>
 <url>https://github.com/advisories/GHSA-c6xg-jh94-mf2w</url>
 <cvename>CVE-2025-0999</cvename>
 <url>https://github.com/advisories/GHSA-f2jv-hxph-r5wm</url>
 </references>
 <dates>
 <discovery>2025-02-27</discovery>
 <entry>2025-03-04</entry>
 </dates>
 </vuln>

<vuln vid="6af5e3a3-f85a-11ef-95b9-589cfc10a551">
 <topic>unit -- potential security issue</topic>
 <affects>
 <package>
	<name>unit</name>
	<name>unit-java</name>
	<range><ge>1.11.0</ge><lt>1.34.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The NGINX Unit team reports:
	<blockquote cite="https://mailman.nginx.org/pipermail/unit/2025-March/QVYLJKLBIDWOJ7OLYGT27VUWH7RGBRQM.html">
	 Unit 1.34.2 fixes two issues in the Java language module websocket code.
	 <ol>
	 <li>It addresses a potential security issue where we could get a negative
	 payload length that could cause the Java language module process(es) to
	 enter an infinite loop and consume excess CPU. This was a bug carried
	 over from the initial Java websocket code import. It has been re-issued
	 a CVE number (CVE-2025-1695).</li>
	 <li>It addresses an issue whereby decoded payload lengths would be limited
	 to 32 bits.</li>
	 </ol>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1695</cvename>
 <url>https://mailman.nginx.org/pipermail/unit/2025-March/QVYLJKLBIDWOJ7OLYGT27VUWH7RGBRQM.html</url>
 </references>
 <dates>
 <discovery>2025-03-03</discovery>
 <entry>2025-03-03</entry>
 </dates>
 </vuln>

<vuln vid="398d1ec1-f7e6-11ef-bb15-002590af0794">
 <topic>vim -- Potential code execution</topic>
 <affects>
 <package>
	<name>vim</name>
	<name>vim-gtk2</name>
	<name>vim-gtk3</name>
	<name>vim-motif</name>
	<name>vim-x11</name>
	<name>vim-tiny</name>
	<range><lt>9.1.1164</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	vim reports:
	<blockquote cite="https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3">
	 <h1>Summary</h1>
	 Potential code execution with tar.vim and special crafted tar files
	 <h1>Description</h1>
	 Vim is distributed with the tar.vim plugin, that allows easy
	 editing and viewing of (compressed or uncompressed) tar files.
	 Since commit 129a844 (Nov 11, 2024 runtime(tar): Update tar.vim to
	 support permissions), the tar.vim plugin uses the ":read " ex command
	 line to append below the cursor position, however the is not sanitized
	 and is taken literaly from the tar archive. This allows to execute
	 shell commands via special crafted tar archives. Whether this really
	 happens, depends on the shell being used ('shell' option, which is set
	 using $SHELL).
	 <h1>Impact</h1>
	 Impact is high but a user must be convinced to edit such a file
	 using Vim which will reveal the filename, so a careful user may suspect
	 some strange things going on.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3</url>
 </references>
 <dates>
 <discovery>2025-03-02</discovery>
 <entry>2025-03-02</entry>
 </dates>
 </vuln>

<vuln vid="8fb9101e-f58a-11ef-b4e4-2cf05da270f3">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.9.0</ge><lt>17.9.1</lt></range>
	<range><ge>17.8.0</ge><lt>17.8.4</lt></range>
	<range><ge>15.10.0</ge><lt>17.7.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/02/26/patch-release-gitlab-17-9-1-released/">
	 XSS in k8s proxy endpoint
	 XSS Maven Dependency Proxy
	 HTML injection leads to XSS on self hosted instances
	 Improper Authorisation Check Allows Guest User to Read Security Policy
	 Planner role can read code review analytics in private projects
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0475</cvename>
 <cvename>CVE-2025-0555</cvename>
 <cvename>CVE-2024-8186</cvename>
 <cvename>CVE-2024-10925</cvename>
 <cvename>CVE-2025-0307</cvename>
 <url>https://about.gitlab.com/releases/2025/02/26/patch-release-gitlab-17-9-1-released/</url>
 </references>
 <dates>
 <discovery>2025-02-26</discovery>
 <entry>2025-02-28</entry>
 </dates>
 </vuln>

<vuln vid="a4cb7f9b-f506-11ef-85f3-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>133.0.6943.141</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>133.0.6943.141</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_25.html">
	 This update includes 1 security fix.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_25.html</url>
 </references>
 <dates>
 <discovery>2025-02-25</discovery>
 <entry>2025-02-27</entry>
 </dates>
 </vuln>

<vuln vid="6ae77556-f31d-11ef-a695-4ccc6adda413">
 <topic>exiv2 -- Use after free in TiffSubIfd</topic>
 <affects>
 <package>
	<name>exiv2</name>
	<range><ge>0.28.0</ge><lt>0.28.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Kevin Backhouse reports:
	<blockquote cite="https://github.com/Exiv2/exiv2/security/advisories/GHSA-38h4-fx85-qcx7">
	 A heap buffer overflow was found in Exiv2 versions v0.28.0 to v0.28.4.
	 Versions prior to v0.28.0, such as v0.27.7, are not affected. Exiv2 is a
	 command-line utility and C++ library for reading, writing, deleting, and
	 modifying the metadata of image files. The heap overflow is triggered when
	 Exiv2 is used to write metadata into a crafted image file. An attacker
	 could potentially exploit the vulnerability to gain code execution, if
	 they can trick the victim into running Exiv2 on a crafted image file.
	 Note that this bug is only triggered when writing the metadata, which
	 is a less frequently used Exiv2 operation than reading the metadata. For
	 example, to trigger the bug in the Exiv2 command-line application, you
	 need to add an extra command-line argument such as fixiso.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-26623</cvename>
 <url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-38h4-fx85-qcx7</url>
 </references>
 <dates>
 <discovery>2025-02-18</discovery>
 <entry>2025-02-25</entry>
 </dates>
 </vuln>

<vuln vid="e60e538f-e795-4a00-b475-cc85a7546e00">
 <topic>Emacs -- Arbitrary code execution vulnerability</topic>
 <affects>
 <package>
	<name>emacs</name>
	<name>emacs-canna</name>
	<name>emacs-nox</name>
	<name>emacs-wayland</name>
	<range><lt>30.1,3</lt></range>
 </package>
 <package>
	<name>emacs-devel</name>
	<name>emacs-devel-nox</name>
	<range><lt>30.0.50.20240115,3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	 <h1>Problem Description</h1>
	 A shell injection vulnerability exists in GNU Emacs due to improper
	 handling of custom man URI schemes.
	 <h1>Impact</h1>
	 Initially considered low severity, as it required user interaction with
	 local files, it was later discovered that an attacker could exploit this
	 vulnerability by tricking a user into visiting a specially crafted
	 website or an HTTP URL with a redirect, leading to arbitrary shell
	 command execution without further user action.
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1244</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1244</url>
 </references>
 <dates>
 <discovery>2025-02-11</discovery>
 <entry>2025-02-24</entry>
 <modified>2025-02-25</modified>
 </dates>
 </vuln>

<vuln vid="7ba6c085-1590-491a-98ce-5452646b196f">
 <topic>Emacs -- Shell injection vulnerability</topic>
 <affects>
 <package>
	<name>emacs</name>
	<name>emacs-canna</name>
	<name>emacs-nox</name>
	<name>emacs-wayland</name>
	<range><lt>30.1,3</lt></range>
 </package>
 <package>
	<name>emacs-devel</name>
	<name>emacs-devel-nox</name>
	<range><lt>31.0.50.20250101,3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	 <h1>Problem Description:</h1>
	 An Emacs user who chooses to invoke elisp-completion-at-point (for
	 code completion) on untrusted Emacs Lisp source code can trigger unsafe
	 Lisp macro expansion that allows attackers to execute arbitrary code.
	 This unsafe expansion also occurs if a user chooses to enable on-the-fly
	 diagnosis that byte compiles untrusted Emacs Lisp source code.
	</body>
 </description>
 <references>
 <cvename>CVE-2024-53920</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-53920</url>
 </references>
 <dates>
 <discovery>2024-11-27</discovery>
 <entry>2025-02-24</entry>
 </dates>
 </vuln>

<vuln vid="07c34df5-f299-11ef-a441-b42e991fc52e">
 <topic>exim -- SQL injection</topic>
 <affects>
 <package>
	<name>exim</name>
	<range><lt>4.98.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://bugzilla.suse.com/show_bug.cgi?id=1237424">
	 Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization
	are used, allows remote SQL injection.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-26794</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-26794</url>
 </references>
 <dates>
 <discovery>2025-02-21</discovery>
 <entry>2025-02-24</entry>
 </dates>
 </vuln>

<vuln vid="a8f1ee74-f267-11ef-87ba-002590c1f29c">
 <topic>FreeBSD -- Multiple vulnerabilities in OpenSSH</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.2</ge><lt>14.2_2</lt></range>
	<range><ge>14.1</ge><lt>14.1_8</lt></range>
	<range><ge>13.4</ge><lt>13.4_4</lt></range>
 </package>
 <package>
	<name>openssh-portable</name>
	<range><lt>9.9.p2_1,1</lt></range>
 </package>
 <package>
	<name>openssh-portable-hpn</name>
	<range><lt>9.9.p2_1,1</lt></range>
 </package>
 <package>
	<name>openssh-portable-gssapi</name>
	<range><lt>9.9.p2_1,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	OpenSSH client host verification error (CVE-2025-26465)
	ssh(1) contains a logic error that allows an on-path attacker to
	impersonate any server during certain conditions when the
	VerifyHostKeyDNS option is enabled.
	OpenSSH server denial of service (CVE-2025-26466)
	The OpenSSH client and server are both vulnerable to a memory/CPU
	denial of service while handling SSH2_MSG_PING packets.
	<h1>Impact:</h1>
	OpenSSH client host verification error (CVE-2025-26465)
	Under specific circumstances, a machine-in-the-middle may impersonate
	any server when the client has the VerifyHostKeyDNS option enabled.
	OpenSSH server denial of service (CVE-2025-26466)
	During the processing of SSH2_MSG_PING packets, a server may be
	subject to a memory/CPU denial of service.
 </body>
 </description>
 <references>
 <cvename>CVE-2025-26465</cvename>
 <cvename>CVE-2025-26466</cvename>
 <freebsdsa>SA-25:05.openssh</freebsdsa>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-26465</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-26466</url>
 </references>
 <dates>
 <discovery>2025-02-21</discovery>
 <entry>2025-02-24</entry>
 <modified>2025-03-08</modified>
 </dates>
 </vuln>

<vuln vid="2a3be628-ef6e-11ef-85f3-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>133.0.6943.126</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>133.0.6943.126</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[394350433] High CVE-2025-0999: Heap buffer overflow in V8. Reported by Seunghyun Lee (@0x10n) on 2025-02-04</li>
	 <li>[383465163] High CVE-2025-1426: Heap buffer overflow in GPU. Reported by un3xploitable and GF on 2024-12-11</li>
	 <li>[390590778] Medium CVE-2025-1006: Use after free in Network. Reported by Tal Keren, Sam Agranat, Eran Rom, Edouard Bochin, Adam Hatsir of Palo Alto Networks on 2025-01-18</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-0999</cvename>
 <cvename>CVE-2025-1426</cvename>
 <cvename>CVE-2025-1006</cvename>
 <url>https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html</url>
 </references>
 <dates>
 <discovery>2025-02-18</discovery>
 <entry>2025-02-20</entry>
 </dates>
 </vuln>

<vuln vid="f572b9d1-ef6d-11ef-85f3-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>133.0.6943.98</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>133.0.6943.98</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_12.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[391907159] High CVE-2025-0995: Use after free in V8. Reported by Popax21 on 2025-01-24</li>
	 <li>[391788835] High CVE-2025-0996: Inappropriate implementation in Browser UI. Reported by yuki yamaoto on 2025-01-23</li>
	 <li>[391666328] High CVE-2025-0997: Use after free in Navigation. Reported by asnine on 2025-01-23</li>
	 <li>[386857213] High CVE-2025-0998: Out of bounds memory access in V8. Reported by Alan Goodman on 2024-12-31</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-0995</cvename>
 <cvename>CVE-2025-0996</cvename>
 <cvename>CVE-2025-0997</cvename>
 <cvename>CVE-2025-0998</cvename>
 <url>https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_12.html</url>
 </references>
 <dates>
 <discovery>2025-02-12</discovery>
 <entry>2025-02-20</entry>
 </dates>
 </vuln>

<vuln vid="b09d0b3b-ef6d-11ef-85f3-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>133.0.6943.53</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>133.0.6943.53</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop.html">
	 This update includes 12 security fixes:
	 <ul>
	 <li>[390889644] High CVE-2025-0444: Use after free in Skia. Reported by Francisco Alonso (@revskills) on 2025-01-19</li>
	 <li>[392521083] High CVE-2025-0445: Use after free in V8. Reported by 303f06e3 on 2025-01-27</li>
	 <li>[40061026] Medium CVE-2025-0451: Inappropriate implementation in Extensions API. Reported by Vitor Torres and Alesandro Ortiz on 2022-09-18</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-0444</cvename>
 <cvename>CVE-2025-0445</cvename>
 <cvename>CVE-2025-0451</cvename>
 <url>https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2025-02-04</discovery>
 <entry>2025-02-20</entry>
 </dates>
 </vuln>

<vuln vid="cbf5d976-656b-4bb6-805f-3af038e2de3e">
 <topic>vscode -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>vscode</name>
	<range><lt>1.97.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	VSCode developers report:
	<blockquote cite="https://github.com/microsoft/vscode/releases/tag/1.97.1">
	 The update addresses these issues, including a fix for a security vulnerability.
	 <ul>
	 <li>Scope node_module binary resolution in js-debug</li>
	 <li>Elevation of Privilege Vulnerability with VS Code server for web UI</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-24042</cvename>
 <url>https://github.com/microsoft/vscode/security/advisories/GHSA-f85p-3684-2g3j</url>
 <cvename>CVE-2025-24039</cvename>
 <url>https://github.com/microsoft/vscode/security/advisories/GHSA-532g-4pv9-25f2</url>
 </references>
 <dates>
 <discovery>2025-02-11</discovery>
 <entry>2025-02-13</entry>
 </dates>
 </vuln>

<vuln vid="e915b60e-ea25-11ef-a1c0-0050569f0b83">
 <topic>security/openvpn-auth-ldap -- Fix buffer overflow in challenge/response</topic>
 <affects>
 <package>
	<name>openvpn-auth-ldap</name>
	<range><lt>2.0.4_3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Graham Northup reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2024-28820">
	 A buffer overflow in extract_openvpn_cr allows attackers with a valid
	 LDAP username and who can control the challenge/response password field
	 to pass a string with more than 14 colons into this field and cause a
	 buffer overflow.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-28820</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-28820</url>
 </references>
 <dates>
 <discovery>2024-06-27</discovery>
 <entry>2025-02-13</entry>
 </dates>
 </vuln>

<vuln vid="fadf3b41-ea19-11ef-a540-6cc21735f730">
 <topic>PostgreSQL -- PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation</topic>
 <affects>
 <package>
	<name>postgresql17-client</name>
	<range><lt>17.3</lt></range>
 </package>
 <package>
	<name>postgresql16-client</name>
	<range><lt>16.7</lt></range>
 </package>
 <package>
	<name>postgresql15-client</name>
	<range><lt>15.11</lt></range>
 </package>
 <package>
	<name>postgresql14-client</name>
	<range><lt>14.16</lt></range>
 </package>
 <package>
	<name>postgresql13-client</name>
	<range><lt>13.19</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL Project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2025-1094/">
	
	 Improper neutralization of quoting syntax in PostgreSQL
	 libpq functions PQescapeLiteral(), PQescapeIdentifier(),
	 PQescapeString(), and PQescapeStringConn() allows a
	 database input provider to achieve SQL injection in
	 certain usage patterns. Specifically, SQL injection
	 requires the application to use the function result to
	 construct input to psql, the PostgreSQL interactive
	 terminal. Similarly, improper neutralization of quoting
	 syntax in PostgreSQL command line utility programs
	 allows a source of command line arguments to achieve SQL
	 injection when client_encoding is BIG5 and
	 server_encoding is one of EUC_TW or MULE_INTERNAL.
	 Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and
	 13.19 are affected.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1094</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2025-1094/</url>
 </references>
 <dates>
 <discovery>2025-02-13</discovery>
 <entry>2025-02-13</entry>
 </dates>
 </vuln>

<vuln vid="1a8c5720-e9cf-11ef-9e96-2cf05da270f3">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.8.0</ge><lt>17.8.2</lt></range>
	<range><ge>17.7.0</ge><lt>17.7.4</lt></range>
	<range><ge>8.3.0</ge><lt>17.6.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/02/12/patch-release-gitlab-17-8-2-released/">
	 A CSP-bypass XSS in merge-request page
	 Denial of Service due to Unbounded Symbol Creation
	 Exfiltrate content from private issues using Prompt Injection
	 A custom permission may allow overriding Repository settings
	 Internal HTTP header leak via route confusion in workhorse
	 SSRF via workspaces
	 Unauthorized Incident Closure and Deletion by Planner Role in GitLab
	 ActionCable does not invalidate tokens after revocation
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0376</cvename>
 <cvename>CVE-2024-12379</cvename>
 <cvename>CVE-2024-3303</cvename>
 <cvename>CVE-2025-1042</cvename>
 <cvename>CVE-2025-1212</cvename>
 <cvename>CVE-2024-9870</cvename>
 <cvename>CVE-2025-0516</cvename>
 <cvename>CVE-2025-1198</cvename>
 <url>https://about.gitlab.com/releases/2025/02/12/patch-release-gitlab-17-8-2-released/</url>
 </references>
 <dates>
 <discovery>2025-02-12</discovery>
 <entry>2025-02-13</entry>
 </dates>
 </vuln>

<vuln vid="d598266d-7772-4a31-9594-83b76b1fb837">
 <topic>Intel CPUs -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cpu-microcode-intel</name>
	<range><lt>20250211</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Intel reports:
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01166.html">
	 
	 A potential security vulnerability in some Intel Processors may allow
	 denial of service. Intel released microcode updates to mitigate this
	 potential vulnerability.
	 
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01213.html">
	 
	 A potential security vulnerability in some Intel Software Guard
	 Extensions (Intel SGX) Platforms may allow denial of service. Intel
	 is released microcode updates to mitigate this potential
	 vulnerability.
	 
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html">
	 
	 Potential security vulnerabilities in the UEFI firmware for some Intel
	 Processors may allow escalation of privilege, denial of service, or
	 information disclosure. Intel released UEFI firmware and CPU microcode
	 updates to mitigate these potential vulnerabilities.
	 
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01228.html">
	 
	 A potential security vulnerability in some 13th and 14th Generation
	 Intel Core™ Processors may allow denial of service. Intel released
	 microcode and UEFI reference code updates to mitigate this potential
	 vulnerability.
	 
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01194.html">
	 
	 A potential security vulnerability in the Intel Data Streaming
	 Accelerator (Intel DSA) for some Intel Xeon Processors may allow
	 denial of service. Intel released software updates to mitigate this
	 potential vulnerability.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-31068</cvename>
 <cvename>CVE-2024-36293</cvename>
 <cvename>CVE-2023-43758</cvename>
 <cvename>CVE-2024-39355</cvename>
 <cvename>CVE-2024-37020</cvename>
 <url>https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20250211</url>
 </references>
 <dates>
 <discovery>2025-02-11</discovery>
 <entry>2025-02-12</entry>
 </dates>
 </vuln>

<vuln vid="a64761a1-e895-11ef-873e-8447094a420f">
 <topic>OpenSSL -- Man-in-the-Middle vulnerability</topic>
 <affects>
 <package>
	<name>openssl32</name>
	<range><lt>3.2.4</lt></range>
 </package>
 <package>
	<name>openssl33</name>
	<range><lt>3.3.2</lt></range>
 </package>
 <package>
	<name>openssl34</name>
	<range><lt>3.4.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://openssl-library.org/news/secadv/20250211.txt">
	 RFC7250 handshakes with unauthenticated servers don't abort as expected (High).
	 Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-12797</cvename>
 <url>https://openssl-library.org/news/secadv/20250211.txt</url>
 </references>
 <dates>
 <discovery>2025-02-11</discovery>
 <entry>2025-02-11</entry>
 </dates>
 </vuln>

<vuln vid="20485d27-e540-11ef-a845-b42e991fc52e">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>135.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.7,1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.7</lt></range>
	<range><gt>129</gt><lt>135</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1926256%2C1935984%2C1935471">
	A bug in WebAssembly code generation could have lead to a crash.
	It may have been possible for an attacker to leverage this to achieve
	code execution.
	A race condition could have led to private browsing tabs being
	opened in normal browsing windows. This could have resulted in a
	potential privacy leak.
	Certificate length was not properly checked when added to a certificate
	store.	In practice only trusted data was processed.
	Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox
	ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence
	of memory corruption and we presume that with enough effort some
	of these could have been exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1011</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1011</url>
 <cvename>CVE-2025-1013</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1013</url>
 <cvename>CVE-2025-1014</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1014</url>
 <cvename>CVE-2025-1017</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1017</url>
 </references>
 <dates>
 <discovery>2025-02-04</discovery>
 <entry>2025-02-07</entry>
 </dates>
 </vuln>

<vuln vid="f7ca4ff7-e53f-11ef-a845-b42e991fc52e">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mozilla</name>
	<range><lt>135.0.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1939063%2C1942169">
	 Memory safety bugs present in Firefox 134 and Thunderbird 134. Some
	of these bugs showed evidence of memory corruption and we presume
	that with enough effort some of these could have been exploited to
	run arbitrary code.
	 The fullscreen notification is prematurely hidden when fullscreen
	is re-requested quickly by the user. This could have been leveraged
	to perform a potential spoofing attack.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1018</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1018</url>
 <cvename>CVE-2025-1019</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1019</url>
 <cvename>CVE-2025-1020</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1020</url>
 </references>
 <dates>
 <discovery>2025-02-04</discovery>
 <entry>2025-02-07</entry>
 </dates>
 </vuln>

<vuln vid="e54a1413-e539-11ef-a845-b42e991fc52e">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>135.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>115.20,1</lt></range>
	<range><gt>116.0,1</gt><lt>128.6,1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.7</lt></range>
	<range><gt>129</gt><lt>135</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1936601%2C1936844%2C1937694%2C1938469%2C1939583%2C1940994">
	An attacker could have caused a use-after-free via crafted XSLT
	data, leading to a potentially exploitable crash.
	An attacker could have caused a use-after-free via the Custom
	Highlight API, leading to a potentially exploitable crash.
	A race during concurrent delazification could have led to a
	use-after-free.
	Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox
	ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird
	128.6.	Some of these bugs showed evidence of memory corruption and
	we presume that with enough effort some of these could have been
	exploited to run arbitrary code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1009</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1009</url>
 <cvename>CVE-2025-1010</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1010</url>
 <cvename>CVE-2025-1012</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1012</url>
 <cvename>CVE-2025-1016</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1016</url>
 </references>
 <dates>
 <discovery>2025-02-04</discovery>
 <entry>2025-02-07</entry>
 </dates>
 </vuln>

<vuln vid="830381c7-e539-11ef-a845-b42e991fc52e">
 <topic>Thundirbird -- unprivileged JavaScript code execution</topic>
 <affects>
 <package>
	<name>mozilla</name>
	<range><lt>128.7,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1939458">
	 The Thunderbird Address Book URI fields contained unsanitized links.
	This could be used by an attacker to create and export an address
	book containing a malicious payload in a field. For example, in
	the Other field of the Instant Messaging section. If another user
	imported the address book, clicking on the link could result in
	opening a web page inside Thunderbird, and that page could execute
	(unprivileged) JavaScript.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-1015</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1015</url>
 </references>
 <dates>
 <discovery>2025-02-04</discovery>
 <entry>2025-02-07</entry>
 </dates>
 </vuln>

<vuln vid="7bcfca95-e563-11ef-873e-8447094a420f">
 <topic>MariaDB -- DoS vulnerability in InnoDB</topic>
 <affects>
 <package>
	<name>mariadb105-server</name>
	<range><lt>10.5.28</lt></range>
 </package>
 <package>
	<name>mariadb106-server</name>
	<range><lt>10.6.21</lt></range>
 </package>
 <package>
	<name>mariadb1011-server</name>
	<range><lt>10.11.11</lt></range>
 </package>
 <package>
	<name>mariadb114-server</name>
	<range><lt>11.4.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	MariaDB reports:
	<blockquote cite="https://mariadb.com/kb/en/security/">
	 Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-21490</cvename>
 <url>http://mariadb.com/kb/en/security/</url>
 </references>
 <dates>
 <discovery>2025-02-04</discovery>
 <entry>2025-02-07</entry>
 </dates>
 </vuln>

<vuln vid="c10b639c-e51c-11ef-9e76-4ccc6adda413">
 <topic>libcaca -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libcaca</name>
	<range><lt>0.99.b20</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Sam Hocevar reports:
	<blockquote cite="https://github.com/cacalabs/libcaca/releases/tag/v0.99.beta20">
	 Multiple memory leaks and invalid memory accesses:
	 <ul>
	 <li>CVE-2018-20545: Illegal WRITE memory access at common-image.c</li>
	 <li>CVE-2018-20546: Illegal READ memory access at caca/dither.c</li>
	 <li>CVE-2018-20547: Illegal READ memory access at caca/dither.c</li>
	 <li>CVE-2018-20548: Illegal WRITE memory access at common-image.c</li>
	 <li>CVE-2018-20549: Illegal WRITE memory access at caca/file.c</li>
	 <li>CVE-2021-3410:	Buffer overflow in libcaca/caca/canvas.c in function caca_resize</li>
	 <li>CVE-2021-30498: Heap buffer overflow in export.c in function export_tga</li>
	 <li>CVE-2021-30499: Buffer overflow in export.c in function export_troff</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2018-20545</cvename>
 <cvename>CVE-2018-20546</cvename>
 <cvename>CVE-2018-20547</cvename>
 <cvename>CVE-2018-20548</cvename>
 <cvename>CVE-2018-20549</cvename>
 <cvename>CVE-2021-3410</cvename>
 <cvename>CVE-2021-30498</cvename>
 <cvename>CVE-2021-30499</cvename>
 <url>https://github.com/cacalabs/libcaca/releases/tag/v0.99.beta20</url>
 </references>
 <dates>
 <discovery>2021-10-19</discovery>
 <entry>2025-02-07</entry>
 </dates>
 </vuln>

<vuln vid="e7974ca5-e4c8-11ef-aab3-40b034429ecf">
 <topic>cacti -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>1.2.29</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Cacti repo reports:
	<blockquote cite="https://github.com/Cacti/cacti/releases/tag/release%2F1.2.29">
	 <ul>
	 <li>security #GHSA-c5j8-jxj3-hh36: Authenticated RCE via multi-line SNMP responses</li>
	 <li>security #GHSA-f9c7-7rc3-574c: SQL Injection vulnerability when using tree rules through Automation API</li>
	 <li>security #GHSA-fh3x-69rr-qqpp: SQL Injection vulnerability when request automation devices</li>
	 <li>security #GHSA-fxrq-fr7h-9rqq: Arbitrary File Creation leading to RCE</li>
	 <li>security #GHSA-pv2c-97pp-vxwg: Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path</li>
	 <li>security #GHSA-vj9g-p7f2-4wqj: SQL Injection vulnerability when view host template</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-22604</cvename>
 <cvename>CVE-2025-24368</cvename>
 <cvename>CVE-2024-54145</cvename>
 <cvename>CVE-2025-24367</cvename>
 <cvename>CVE-2024-45598</cvename>
 <cvename>CVE-2024-54146</cvename>
 </references>
 <dates>
 <discovery>2025-02-02</discovery>
 <entry>2025-02-05</entry>
 </dates>
 </vuln>

<vuln vid="9761af78-e3e4-11ef-9f4a-589cfc10a551">
 <topic>nginx-devel -- SSL session reuse vulnerability</topic>
 <affects>
 <package>
	<name>nginx-devel</name>
	<range><lt>1.27.4</lt></range>
 </package>
 <package>
	<name>nginx</name>
	<range><lt>1.26.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The nginx development team reports:
	<blockquote cite="http://nginx.org/en/security_advisories.html">
	 This update fixes the SSL session reuse vulnerability.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-23419</cvename>
 </references>
 <dates>
 <discovery>2025-02-05</discovery>
 <entry>2025-02-05</entry>
 </dates>
 </vuln>

<vuln vid="72b8729e-e134-11ef-9e76-4ccc6adda413">
 <topic>qt6-webengine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>qt6-webengine</name>
	<range><lt>6.8.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Qt qtwebengine-chromium repo reports:
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=122-based">
	 Backports for 9 security bugs in Chromium:
	 <ul>
	 <li>CVE-2024-12693: Out of bounds memory access in V8</li>
	 <li>CVE-2024-12694: Use after free in Compositing</li>
	 <li>CVE-2025-0436: Integer overflow in Skia</li>
	 <li>CVE-2025-0437: Out of bounds read in Metrics</li>
	 <li>CVE-2025-0438: Stack buffer overflow in Tracing</li>
	 <li>CVE-2025-0441: Inappropriate implementation in Fenced Frames</li>
	 <li>CVE-2025-0443: Insufficient data validation in Extensions</li>
	 <li>CVE-2025-0447: Inappropriate implementation in Navigation</li>
	 <li>CVE-2025-0611: Object corruption in V8</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-12693</cvename>
 <cvename>CVE-2024-12694</cvename>
 <cvename>CVE-2025-0436</cvename>
 <cvename>CVE-2025-0437</cvename>
 <cvename>CVE-2025-0438</cvename>
 <cvename>CVE-2025-0441</cvename>
 <cvename>CVE-2025-0443</cvename>
 <cvename>CVE-2025-0447</cvename>
 <cvename>CVE-2025-0611</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=122-based</url>
 </references>
 <dates>
 <discovery>2025-01-09</discovery>
 <entry>2025-02-02</entry>
 </dates>
 </vuln>

<vuln vid="186101b4-dfa6-11ef-8c1c-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>132.0.6834.159</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>132.0.6834.159</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_28.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[384844003] Medium CVE-2025-0762: Use after free in DevTools. Reported by Sakana.S on 2024-12-18</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-0762</cvename>
 <url>https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_28.html</url>
 </references>
 <dates>
 <discovery>2025-01-18</discovery>
 <entry>2025-01-31</entry>
 </dates>
 </vuln>

<vuln vid="cd2ace09-df23-11ef-a205-901b0e9408dc">
 <topic>dendrite -- Server-side request forgery vulnerability</topic>
 <affects>
 <package>
	<name>dendrite</name>
	<range><lt>0.14.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Dendrite team reports:
	<blockquote cite="https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-4ff6-858j-r822">
	 This is a security release, gomatrixserverlib was vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-52594</cvename>
 <url>https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-4ff6-858j-r822</url>
 </references>
 <dates>
 <discovery>2025-01-16</discovery>
 <entry>2025-01-30</entry>
 </dates>
 </vuln>

<vuln vid="2830b374-debd-11ef-87ba-002590c1f29c">
 <topic>FreeBSD -- Uninitialized kernel memory disclosure via ktrace(2)</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.2</ge><lt>14.2_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	In some cases, the ktrace facility will log the contents of
	kernel structures to userspace. In one such case, ktrace dumps a
	variable-sized sockaddr to userspace. There, the full sockaddr is
	copied, even when it is shorter than the full size. This can result
	in up to 14 uninitialized bytes of kernel memory being copied out
	to userspace.
	<h1>Impact:</h1>
	It is possible for an unprivileged userspace program to leak
	14 bytes of a kernel heap allocation to userspace.
 </body>
 </description>
 <references>
 <cvename>CVE-2025-0662</cvename>
 <freebsdsa>SA-25:04.ktrace</freebsdsa>
 </references>
 <dates>
 <discovery>2025-01-29</discovery>
 <entry>2025-01-30</entry>
 </dates>
 </vuln>

<vuln vid="fa9ae646-debc-11ef-87ba-002590c1f29c">
 <topic>FreeBSD -- Unprivileged access to system files</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.2</ge><lt>14.2_1</lt></range>
	<range><ge>14.1</ge><lt>14.1_7</lt></range>
	<range><ge>13.4</ge><lt>13.4_3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When etcupdate encounters conflicts while merging files, it
	saves a version containing conflict markers in /var/db/etcupdate/conflicts.
	This version does not preserve the mode of the input file, and is
	world-readable. This applies to files that would normally have
	restricted visibility, such as /etc/master.passwd.
	<h1>Impact:</h1>
	An unprivileged local user may be able to read encrypted root
	and user passwords from the temporary master.passwd file created
	in /var/db/etcupdate/conflicts. This is possible only when conflicts
	within the password file arise during an update, and the unprotected
	file is deleted when conflicts are resolved.
 </body>
 </description>
 <references>
 <cvename>CVE-2025-0374</cvename>
 <freebsdsa>SA-25:03.etcupdate</freebsdsa>
 </references>
 <dates>
 <discovery>2025-01-29</discovery>
 <entry>2025-01-30</entry>
 </dates>
 </vuln>

<vuln vid="ab0cbe3f-debc-11ef-87ba-002590c1f29c">
 <topic>FreeBSD -- Buffer overflow in some filesystems via NFS</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.2</ge><lt>14.2_1</lt></range>
	<range><ge>14.1</ge><lt>14.1_7</lt></range>
	<range><ge>13.4</ge><lt>13.4_3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	In order to export a file system via NFS, the file system must
	define a file system identifier (FID) for all exported files. Each
	FreeBSD file system implements operations to translate between FIDs
	and vnodes, the kernel's in-memory representation of files. These
	operations are VOP_VPTOFH(9) and VFS_FHTOVP(9).
	On 64-bit systems, the implementation of VOP_VPTOFH() in the
	cd9660, tarfs and ext2fs filesystems overflows the destination FID
	buffer by 4 bytes, a stack buffer overflow.
	<h1>Impact:</h1>
	A NFS server that exports a cd9660, tarfs, or ext2fs file system
	can be made to panic by mounting and accessing the export with an
	NFS client. Further exploitation (e.g., bypassing file permission
	checking or remote kernel code execution) is potentially possible,
	though this has not been demonstrated.	In particular, release
	kernels are compiled with stack protection enabled, and some instances
	of the overflow are caught by this mechanism, causing a panic.
 </body>
 </description>
 <references>
 <cvename>CVE-2025-0373</cvename>
 <freebsdsa>SA-25:02.fs</freebsdsa>
 </references>
 <dates>
 <discovery>2025-01-29</discovery>
 <entry>2025-01-30</entry>
 </dates>
 </vuln>

<vuln vid="69e19c0b-debc-11ef-87ba-002590c1f29c">
 <topic>FreeBSD -- OpenSSH Keystroke Obfuscation Bypass</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.1</ge><lt>14.1_7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A logic error in the ssh(1) ObscureKeystrokeTiming feature (on
	by default) rendered this feature ineffective.
	<h1>Impact:</h1>
	A passive observer could detect which network packets contain
	real keystrokes, and infer the specific characters being transmitted
	from packet timing.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-39894</cvename>
 <freebsdsa>SA-25:01.openssh</freebsdsa>
 </references>
 <dates>
 <discovery>2025-01-29</discovery>
 <entry>2025-01-30</entry>
 </dates>
 </vuln>

<vuln vid="258a58a9-6583-4808-986b-e785c27b0a18">
 <topic>oauth2-proxy -- Non-linear parsing of case-insensitive content</topic>
 <affects>
 <package>
	<name>oauth2-proxy</name>
	<range><lt>7.8.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Golang reports:
	<blockquote cite="https://github.com/advisories/GHSA-w32m-9786-jp63">
	 This update include security fixes:
	 <ul>
	 <li>CVE-2024-45338: Non-linear parsing of case-insensitive content</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-45338</cvename>
 </references>
 <dates>
 <discovery>2025-01-14</discovery>
 <entry>2025-01-30</entry>
 </dates>
 </vuln>

<vuln vid="41711c0d-db27-11ef-873e-8447094a420f">
 <topic>Vaultwarden -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>vaultwarden</name>
	<range><lt>1.33.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Vaultwarden project reports:
	<blockquote cite="https://github.com/dani-garcia/vaultwarden/releases/tag/1.33.0">
	 RCE in the admin panel.
	 Getting access to the Admin Panel via CSRF.
	 Escalation of privilege via variable confusion in OrgHeaders trait.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-24364</cvename>
 <url>https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-j4h8-vch3-f797</url>
 <cvename>CVE-2025-24365</cvename>
 <url>https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h6cc-rc6q-23j4</url>
 </references>
 <dates>
 <discovery>2025-01-25</discovery>
 <entry>2025-01-25</entry>
 </dates>
 </vuln>

<vuln vid="c53cd328-8131-4fc2-a083-a9e9d45e3028">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>132.0.6834.110</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>132.0.6834.110</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_22.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[386143468] High CVE-2025-0611: Object corruption in V8. Reported by 303f06e3 on 2024-12-26</li>
	 <li>[385155406] High CVE-2025-0612: Out of bounds memory access in V8. Reported by Alan Goodman on 2024-12-20</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-0611</cvename>
 <cvename>CVE-2025-0612</cvename>
 <url>https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_22.html</url>
 </references>
 <dates>
 <discovery>2025-01-22</discovery>
 <entry>2025-01-25</entry>
 </dates>
 </vuln>

<vuln vid="756839e1-cd78-4082-9f9e-d0da616ca8dd">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>132.0.6834.83</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>132.0.6834.83</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_14.html">
	 This update includes 16 security fixes:
	 <ul>
	 <li>[374627491] High CVE-2025-0434: Out of bounds memory access in V8. Reported by ddme on 2024-10-21</li>
	 <li>[379652406] High CVE-2025-0435: Inappropriate implementation in Navigation. Reported by Alesandro Ortiz on 2024-11-18</li>
	 <li>[382786791] High CVE-2025-0436: Integer overflow in Skia. Reported by Han Zheng (HexHive) on 2024-12-08</li>
	 <li>[378623799] High CVE-2025-0437: Out of bounds read in Metrics. Reported by Xiantong Hou of Wuheng Lab and Pisanbao on 2024-11-12</li>
	 <li>[384186539] High CVE-2025-0438: Stack buffer overflow in Tracing. Reported by Han Zheng (HexHive) on 2024-12-15</li>
	 <li>[371247941] Medium CVE-2025-0439: Race in Frames. Reported by Hafiizh on 2024-10-03</li>
	 <li>[40067914] Medium CVE-2025-0440: Inappropriate implementation in Fullscreen. Reported by Umar Farooq on 2023-07-22</li>
	 <li>[368628042] Medium CVE-2025-0441: Inappropriate implementation in Fenced Frames. Reported by someoneverycurious on 2024-09-21</li>
	 <li>[40940854] Medium CVE-2025-0442: Inappropriate implementation in Payments. Reported by Ahmed ElMasry on 2023-11-08</li>
	 <li>[376625003] Medium CVE-2025-0443: Insufficient data validation in Extensions. Reported by Anonymous on 2024-10-31</li>
	 <li>[359949844] Low CVE-2025-0446: Inappropriate implementation in Extensions. Reported by Hafiizh on 2024-08-15</li>
	 <li>[375550814] Low CVE-2025-0447: Inappropriate implementation in Navigation. Reported by Khiem Tran (@duckhiem) on 2024-10-25</li>
	 <li>[377948403] Low CVE-2025-0448: Inappropriate implementation in Compositing. Reported by Dahyeon Park on 2024-11-08</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2025-0434</cvename>
 <cvename>CVE-2025-0435</cvename>
 <cvename>CVE-2025-0436</cvename>
 <cvename>CVE-2025-0437</cvename>
 <cvename>CVE-2025-0438</cvename>
 <cvename>CVE-2025-0439</cvename>
 <cvename>CVE-2025-0440</cvename>
 <cvename>CVE-2025-0441</cvename>
 <cvename>CVE-2025-0442</cvename>
 <cvename>CVE-2025-0443</cvename>
 <cvename>CVE-2025-0446</cvename>
 <cvename>CVE-2025-0447</cvename>
 <cvename>CVE-2025-0448</cvename>
 <url>https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_14.html</url>
 </references>
 <dates>
 <discovery>2025-01-14</discovery>
 <entry>2025-01-25</entry>
 </dates>
 </vuln>

<vuln vid="ef303b6a-7d9e-4e28-b92e-21f39d519d9e">
 <topic>electron32 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron32</name>
	<range><lt>32.3.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v32.3.0">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-12693.</li>
	 <li>Security: backported fix for CVE-2024-12694.</li>
	 <li>Security: backported fix for CVE-2024-12695.</li>
	 <li>Security: backported fix for CVE-2025-0434.</li>
	 <li>Security: backported fix for CVE-2025-0436.</li>
	 <li>Security: backported fix for CVE-2025-0437.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-12693</cvename>
 <url>https://github.com/advisories/GHSA-m84q-p89f-6cc5</url>
 <cvename>CVE-2024-12694</cvename>
 <url>https://github.com/advisories/GHSA-cgc6-4xgf-5q5x</url>
 <cvename>CVE-2024-12695</cvename>
 <url>https://github.com/advisories/GHSA-6895-2frg-pq5j</url>
 <cvename>CVE-2025-0434</cvename>
 <url>https://github.com/advisories/GHSA-fpmx-pfpg-92xg</url>
 <cvename>CVE-2025-0436</cvename>
 <url>https://github.com/advisories/GHSA-ww3g-8h77-wr7v</url>
 <cvename>CVE-2025-0437</cvename>
 <url>https://github.com/advisories/GHSA-4353-vp82-4qq4</url>
 </references>
 <dates>
 <discovery>2025-01-23</discovery>
 <entry>2025-01-25</entry>
 </dates>
 </vuln>

<vuln vid="2def27c7-7dd0-42cb-adf6-8e5a7afe4db3">
 <topic>electron33 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron33</name>
	<range><lt>33.3.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v33.3.2">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2025-0434.</li>
	 <li>Security: backported fix for CVE-2025-0436.</li>
	 <li>Security: backported fix for CVE-2025-0437.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0434</cvename>
 <url>https://github.com/advisories/GHSA-fpmx-pfpg-92xg</url>
 <cvename>CVE-2025-0436</cvename>
 <url>https://github.com/advisories/GHSA-ww3g-8h77-wr7v</url>
 <cvename>CVE-2025-0437</cvename>
 <url>https://github.com/advisories/GHSA-4353-vp82-4qq4</url>
 </references>
 <dates>
 <discovery>2025-01-22</discovery>
 <entry>2025-01-23</entry>
 </dates>
 </vuln>

<vuln vid="24c93a28-d95b-11ef-b6b2-2cf05da270f3">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.8.0</ge><lt>17.8.1</lt></range>
	<range><ge>17.7.0</ge><lt>17.7.3</lt></range>
	<range><ge>15.7.0</ge><lt>17.6.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/01/22/patch-release-gitlab-17-8-1-released/">
	 Stored XSS via Asciidoctor render
	 Developer could exfiltrate protected CI/CD variables via CI lint
	 Cyclic reference of epics leads resource exhaustion
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0314</cvename>
 <cvename>CVE-2024-11931</cvename>
 <cvename>CVE-2024-6324</cvename>
 <url>https://about.gitlab.com/releases/2025/01/22/patch-release-gitlab-17-8-1-released/</url>
 </references>
 <dates>
 <discovery>2025-01-22</discovery>
 <entry>2025-01-23</entry>
 </dates>
 </vuln>

<vuln vid="1e109b60-d92e-11ef-a661-08002784c58d">
 <topic>clamav -- Possbile denial-of-service vulnerability</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><ge>1.0.0,1</ge><lt>1.4.2,1</lt></range>
 </package>
 <package>
	<name>clamav-lts</name>
	<range><ge>1.0.0,1</ge><lt>1.0.8,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The ClamAV project reports:
	<blockquote cite="https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.html">
	 
	 A possible buffer overflow read bug is found in the OLE2
	 file parser that could cause a denial-of-service (DoS)
	 condition.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-20128</cvename>
 <url>https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.html</url>
 </references>
 <dates>
 <discovery>2025-01-22</discovery>
 <entry>2025-01-23</entry>
 </dates>
 </vuln>

<vuln vid="7d17676d-4828-4a43-85d6-1ee14362de6e">
 <topic>electron32 -- Type Confusion in V8</topic>
 <affects>
 <package>
	<name>electron32</name>
	<range><lt>32.2.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v32.2.8">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2024-12053.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-12053</cvename>
 <url>https://github.com/advisories/GHSA-wvx7-72hc-rp32</url>
 </references>
 <dates>
 <discovery>2025-01-06</discovery>
 <entry>2025-01-22</entry>
 </dates>
 </vuln>

<vuln vid="704aa72a-d840-11ef-a205-901b0e9408dc">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go122</name>
	<range><lt>1.22.11</lt></range>
 </package>
 <package>
	<name>go123</name>
	<range><lt>1.23.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/71156">
	 crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints
	 A certificate with a URI which has a IPv6 address with a
	 zone ID may incorrectly satisfy a URI name constraint that
	 applies to the certificate chain.
	</blockquote>
	<blockquote cite="https://go.dev/issue/70530">
	 net/http: sensitive headers incorrectly sent after cross-domain redirect
	 The HTTP client drops sensitive headers after following a
	 cross-domain redirect. For example, a request to a.com/
	 containing an Authorization header which is redirected to
	 b.com/ will not send that header to b.com.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-45341</cvename>
 <cvename>CVE-2024-45336</cvename>
 <url>https://go.dev/issue/71156</url>
 <url>https://go.dev/issue/70530</url>
 </references>
 <dates>
 <discovery>2025-01-07</discovery>
 <entry>2025-01-21</entry>
 </dates>
 </vuln>

<vuln vid="3161429b-3897-4593-84a0-b41ffbbfa36b">
 <topic>electron31 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron31</name>
	<range><lt>31.7.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v31.7.7">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-12053.</li>
	 <li>Security: backported fix for CVE-2024-12693.</li>
	 <li>Security: backported fix for CVE-2024-12694.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-12053</cvename>
 <url>https://github.com/advisories/GHSA-wvx7-72hc-rp32</url>
 <cvename>CVE-2024-12693</cvename>
 <url>https://github.com/advisories/GHSA-m84q-p89f-6cc5</url>
 <cvename>CVE-2024-12694</cvename>
 <url>https://github.com/advisories/GHSA-cgc6-4xgf-5q5x</url>
 </references>
 <dates>
 <discovery>2025-01-14</discovery>
 <entry>2025-01-20</entry>
 </dates>
 </vuln>

<vuln vid="d9b0fea0-d564-11ef-b9bc-d05099c0ae8c">
 <topic>age -- age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution</topic>
 <affects>
 <package>
	<name>age</name>
	<range><lt>1.2.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Filippo Valsorda reports:
	<blockquote cite="https://github.com/advisories/GHSA-32gq-x56h-299c">
	 A plugin name containing a path separator may allow an
	 attacker to execute an arbitrary binary.
	 Such a plugin name can be provided to the age CLI through
	 an attacker-controlled recipient or identity string, or to
	 the plugin.NewIdentity, plugin.NewIdentityWithoutData, or
	 plugin.NewRecipient APIs.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/advisories/GHSA-32gq-x56h-299c</url>
 </references>
 <dates>
 <discovery>2024-12-18</discovery>
 <entry>2025-01-18</entry>
 </dates>
 </vuln>

<vuln vid="47bc292a-d472-11ef-aaab-7d43732cb6f5">
 <topic>openvpn -- too long a username or password from a client can confuse openvpn servers</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><lt>2.6.13</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Frank Lichtenheld reports:
	<blockquote cite="https://github.com/OpenVPN/openvpn/releases/tag/v2.6.13">
	 [OpenVPN v2.6.13 ...] improve server-side handling of clients sending
	 usernames or passwords longer than USER_PASS_LEN - this would not
	 result in a crash, buffer overflow or other security issues, but the
	 server would then misparse incoming IV variables and produce misleading
	 error messages.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/OpenVPN/openvpn/releases/tag/v2.6.13</url>
 </references>
 <dates>
 <discovery>2024-10-28</discovery>
 <entry>2025-01-17</entry>
 </dates>
 </vuln>

<vuln vid="163edccf-d2ba-11ef-b10e-589cfc10a551">
 <topic>rsync -- Multiple security fixes</topic>
 <affects>
 <package>
	<name>rsync</name>
	<range><lt>3.4.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	rsync reports:
	<blockquote cite="https://kb.cert.org/vuls/id/952657">
	 This update includes multiple security fixes:
	 <ul>
	 <li>CVE-2024-12084: Heap Buffer Overflow in Checksum Parsing</li>
	 <li>CVE-2024-12085: Info Leak via uninitialized Stack contents defeats ASLR</li>
	 <li>CVE-2024-12086: Server leaks arbitrary client files</li>
	 <li>CVE-2024-12087: Server can make client write files outside of destination directory using symbolic links</li>
	 <li>CVE-2024-12088: --safe-links Bypass</li>
	 <li>CVE-2024-12747: symlink race condition</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-12084</cvename>
 <cvename>CVE-2024-12085</cvename>
 <cvename>CVE-2024-12086</cvename>
 <cvename>CVE-2024-12087</cvename>
 <cvename>CVE-2024-12088</cvename>
 <cvename>CVE-2024-12747</cvename>
 </references>
 <dates>
 <discovery>2025-01-14</discovery>
 <entry>2025-01-14</entry>
 </dates>
 </vuln>

<vuln vid="3445e4b6-d2b8-11ef-9ff3-43c2b5d6c4c8">
 <topic>git -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>git</name>
	<name>git-cvs</name>
	<name>git-gui</name>
	<name>git-p4</name>
	<name>git-svn</name>
	<range><lt>2.48.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Git development team reports:
	<blockquote cite="https://lore.kernel.org/git/xmqq5xmh46oc.fsf@gitster.g/">
	 CVE-2024-50349: Printing unsanitized URLs when asking for credentials made the
	 user susceptible to crafted URLs (e.g. in recursive clones) that
	 mislead the user into typing in passwords for trusted sites that
	 would then be sent to untrusted sites instead.
	 CVE-2024-52006: Git may pass on Carriage Returns via the credential protocol to
	 credential helpers which use line-reading functions that
	 interpret said Carriage Returns as line endings, even though Git
	 did not intend that.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-50349</cvename>
 <url>https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr</url>
 <cvename>CVE-2024-52006</cvename>
 <url>https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp</url>
 </references>
 <dates>
 <discovery>2024-10-29</discovery>
 <entry>2025-01-14</entry>
 </dates>
 </vuln>

<vuln vid="5e2bd238-d2bb-11ef-bc0e-1c697a616631">
 <topic>keycloak -- Multiple security fixes</topic>
 <affects>
 <package>
	<name>keycloak</name>
	<range><lt>26.0.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Keycloak reports:
	<blockquote cite="https://www.keycloak.org/2024/11/keycloak-2606-released.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>CVE-2024-11734: Unrestricted admin use of system and environment variables</li>
	 <li>CVE-2024-11736: Denial of Service in Keycloak Server via Security Headers</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-11734</cvename>
 <cvename>CVE-2024-11736</cvename>
 </references>
 <dates>
 <discovery>2025-01-13</discovery>
 <entry>2025-01-13</entry>
 </dates>
 </vuln>

<vuln vid="7624c151-d116-11ef-b232-b42e991fc52e">
 <topic>asterisk - path traversal</topic>
 <affects>
 <package>
	<name>asterisk18</name>
	<range><lt>18.26.2</lt></range>
 </package>
 <package>
	<name>asterisk20</name>
	<range><lt>20.11.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://gist.github.com/hyp164D1/e7c0f44ffb38c00320aa1a6d98bee616">
	 An issue in the action_listcategories() function of Sangoma Asterisk
	v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to
	execute a path traversal.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-53566</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-53566</url>
 </references>
 <dates>
 <discovery>2024-12-02</discovery>
 <entry>2025-01-12</entry>
 </dates>
 </vuln>

<vuln vid="4d79fd1a-cc93-11ef-abed-08002784c58d">
 <topic>redis,valkey -- Denial-of-service valnerability due to malformed ACL selectors</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><ge>7.0.0</ge><lt>7.4.2</lt></range>
 </package>
 <package>
	<name>redis72</name>
	<range><lt>7.2.7</lt></range>
 </package>
 <package>
	<name>redis-devel</name>
	<range><lt>7.4.2.20250201</lt></range>
 </package>
 <package>
	<name>valkey</name>
	<range><lt>8.0.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Redis core team reports:
	<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9">
	 
	 An authenticated with sufficient privileges may create a
	 malformed ACL selector which, when accessed, triggers a
	 server panic and subsequent denial of service.The problem
	 exists in Redis 7.0.0 or newer.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-51741</cvename>
 <url>https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9</url>
 </references>
 <dates>
 <discovery>2025-01-06</discovery>
 <entry>2025-01-10</entry>
 </dates>
 </vuln>

<vuln vid="5f19ac58-cc90-11ef-abed-08002784c58d">
 <topic>redis,valkey -- Remote code execution valnerability</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><lt>7.4.2</lt></range>
 </package>
 <package>
	<name>redis72</name>
	<range><lt>7.2.7</lt></range>
 </package>
 <package>
	<name>redis62</name>
	<range><lt>6.2.17</lt></range>
 </package>
 <package>
	<name>redis-devel</name>
	<range><lt>7.4.2.20250201</lt></range>
 </package>
 <package>
	<name>valkey</name>
	<range><lt>8.0.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Redis core team reports:
	<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c">
	 
	 An authenticated user may use a specially crafted Lua
	 script to manipulate the garbage collector and potentially
	 lead to remote code execution. The problem exists in all
	 versions of Redis with Lua scripting.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-46981</cvename>
 <url>https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c</url>
 </references>
 <dates>
 <discovery>2025-01-06</discovery>
 <entry>2025-01-10</entry>
 </dates>
 </vuln>

<vuln vid="2bfde261-cdf2-11ef-b6b2-2cf05da270f3">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.7.0</ge><lt>17.7.1</lt></range>
	<range><ge>17.6.0</ge><lt>17.6.3</lt></range>
	<range><ge>11.0.0</ge><lt>17.5.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/">
	 Possible access token exposure in GitLab logs
	 Cyclic reference of epics leads resource exhaustion
	 Unauthorized user can manipulate status of issues in public projects
	 Instance SAML does not respect external_provider configuration
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2025-0194</cvename>
 <cvename>CVE-2024-6324</cvename>
 <cvename>CVE-2024-12431</cvename>
 <cvename>CVE-2024-13041</cvename>
 <url>https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/</url>
 </references>
 <dates>
 <discovery>2025-01-08</discovery>
 <entry>2025-01-08</entry>
 </dates>
 </vuln>

<vuln vid="a380f43e-19e5-11f0-9568-b42e991fc52e">
 <topic>Perl -- heap buffer overflow when transliterating non-ASCII bytes</topic>
 <affects>
 <package>
	<name>perl5.36</name>
	<range><lt>5.36.3</lt></range>
 </package>
 <package>
	<name>perl5.38</name>
	<range><lt>5.38.4</lt></range>
 </package>
 <package>
	<name>perl5.40</name>
	<range><lt>5.40.2</lt></range>
 </package>
 <package>
	<name>perl5-devel</name>
	<range><lt>5.41.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	9b29abf9-4ab0-4765-b253-1875cd9b441e reports:
	<blockquote cite="https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.patch">
	A heap buffer overflow vulnerability was discovered in Perl.
	When there are non-ASCII bytes in the left-hand-side of the `tr`
	operator, `S_do_trans_invmap` can overflow the destination pointer
	`d`.
	$ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'
	Segmentation fault (core dumped)
	It is believed that this vulnerability can enable Denial of
	Service and possibly Code Execution attacks on platforms that
	lack sufficient defenses.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-56406</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-56406</url>
 </references>
 <dates>
 <discovery>2025-04-13</discovery>
 <entry>2025-04-15</entry>
 </dates>
 </vuln>

<vuln vid="0230343c-1908-11f0-accc-b42e991fc52e">
 <topic>gogs -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gogs</name>
	<range><lt>0.13.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://fysac.github.io/posts/2024/11/unpatched-remote-code-execution-in-gogs/">
	CVE-2024-44625: Directory Traversal via the editFilePost
	function of internal/route/repo/editor.go.
	CVE-2024-39933: Gogs allows argument injection during the
	tagging of a new release.
	CVE-2024-39932: Gogs allows argument injection during the
	previewing of changes.
	CVE-2024-39931: Gogs allows deletion of internal files.
	CVE-2024-39930: The built-in SSH server of Gogs allows
	argument injection in internal/ssh/ssh.go, leading to remote
	code execution. Authenticated attackers can exploit this by
	opening an SSH connection and sending a malicious
	--split-string env request if the built-in SSH server is
	activated.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-44625</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-44625</url>
 <cvename>CVE-2024-39933</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-39933</url>
 <cvename>CVE-2024-39932</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-39932</url>
 <cvename>CVE-2024-39931</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-39931</url>
 <cvename>CVE-2024-39930</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-39930</url>
 </references>
 <dates>
 <discovery>2024-11-15</discovery>
 <entry>2025-04-14</entry>
 </dates>
 </vuln>

<vuln vid="ba6361be-1887-11f0-a8ce-b42e991fc52e">
 <topic>Mozilla -- null pointer dereference</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>133.0,2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>133.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1923767">
	 A null pointer dereference may have inadvertently
	 occurred in `pk12util`, and specifically in the
	 `SEC_ASN1DecodeItem_Util` function, when handling malformed
	 or improperly formatted input files.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-11706</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-11706</url>
 </references>
 <dates>
 <discovery>2024-11-26</discovery>
 <entry>2025-04-13</entry>
 </dates>
 </vuln>

<vuln vid="b65b1217-1887-11f0-a8ce-b42e991fc52e">
 <topic>mozilla -- double free error</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>133.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.7.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>133.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1899402">
	 A double-free issue could have occurred in
	 `sec_pkcs7_decoder_start_decrypt()` when handling an error
	 path. Under specific conditions, the same symmetric key
	 could have been freed twice, potentially leading to memory
	 corruption.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-11704</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-11704</url>
 </references>
 <dates>
 <discovery>2024-11-26</discovery>
 <entry>2025-04-13</entry>
 </dates>
 </vuln>

<vuln vid="ed0a052a-c5e6-11ef-a457-b42e991fc52e">
 <topic>Apache Tomcat -- RCE due to TOCTOU issue in JSP compilation</topic>
 <affects>
 <package>
	<name>tomcat110</name>
	<range>
	 <gt>11.0.0</gt>
	 <lt>11.0.1</lt>
	</range>
 </package>
 <package>
	<name>tomcat101</name>
	<range>
	 <gt>10.1.0</gt>
	 <lt>10.1.33</lt>
	</range>
 </package>
 <package>
	<name>tomcat9</name>
	<range>
	 <gt>9.0.0</gt>
	 <lt>9.0.97</lt>
	</range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@apache.org reports:
	<blockquote cite="https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp">
	 Time-of-check Time-of-use (TOCTOU) Race Condition
	The mitigation for CVE-2024-50379 was incomplete.
	Users running Tomcat on a case insensitive file system with the
	default servlet write enabled (readonly initialisation parameter
	set to the non-default value of false) may need additional configuration
	to fully mitigate CVE-2024-50379 depending on which version of Java
	they are using with Tomcat: - running on Java 8 or Java 11: the
	system propertysun.io.useCanonCaches must be explicitly set to false
	(it defaults to true) - running on Java 17: thesystem property
	sun.io.useCanonCaches, if set, must be set to false(it defaults to
	false) - running on Java 21 onwards: no further configuration is
	required(the system property and the problematic cache have been
	removed)
	Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks
	thatsun.io.useCanonCaches is set appropriately before allowing the
	default servlet to be write enabled on a case insensitive file
	system. Tomcat will also setsun.io.useCanonCaches to false by
	default where it can.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-56337</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-56337</url>
 </references>
 <dates>
 <discovery>2024-12-20</discovery>
 <entry>2024-12-29</entry>
 </dates>
 </vuln>

<vuln vid="94b2d58a-c1e9-11ef-aa3f-dcfe074bd614">
 <topic>kanboard -- Insufficient session invalidation</topic>
 <affects>
 <package>
	<name>kanboard</name>
	<range><lt>1.2.43</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/kanboard/kanboard/blob/main/app/Core/Session/SessionHandler.php#L40">
	 Kanboard is project management software that focuses on the Kanban
	methodology. In affected versions sessions are still usable even
	though their lifetime has exceeded. Kanboard implements a cutom
	session handler (`app/Core/Session/SessionHandler.php`), to store
	the session data in a database. Therefore, when a `session_id` is
	given, kanboard queries the data from the `sessions` sql table. At
	this point, it does not correctly verify, if a given `session_id`
	has already exceeded its lifetime (`expires_at`). Thus, a session
	which's lifetime is already `&gt; time()`, is still queried
	from the database and hence a valid login. The implemented
	**SessionHandlerInterface::gc** function, that does remove invalid
	sessions, is called only **with a certain probability** (_Cleans
	up expired sessions. Called by `session_start()`, based on
	`session.gc_divisor`, `session.gc_probability` and `session.gc_maxlifetime`
	settings_) accordingly to the php documentation. In the official
	Kanboard docker image these values default to: session.gc_probability=1,
	session.gc_divisor=1000. Thus, an expired session is only terminated
	with probability 1/1000. There are no known workarounds for
	this vulnerability.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-55603</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-55603</url>
 </references>
 <dates>
 <discovery>2024-12-19</discovery>
 <entry>2024-12-24</entry>
 </dates>
 </vuln>

<vuln vid="0a8dbc7f-bedc-11ef-b5a1-000ec6d40964">
 <topic>Vaultwarden -- Admin organization permissions</topic>
 <affects>
 <package>
	<name>vaultwarden</name>
	<range><lt>1.32.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Vaultwarden project reports:
	<blockquote cite="https://github.com/dani-garcia/vaultwarden/pull/5291">
	 Admins from any organization were able to modify or delete groups in any other organization if they know the group's uuid.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/dani-garcia/vaultwarden/pull/5291</url>
 </references>
 <dates>
 <discovery>2024-12-20</discovery>
 <entry>2024-12-20</entry>
 </dates>
 </vuln>

<vuln vid="e18c5c8d-be01-11ef-8c1c-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>131.0.6778.204</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>131.0.6778.204</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_18.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[382291459] High CVE-2024-12692: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) on 2024-12-05</li>
	 <li>[382190919] High CVE-2024-12693: Out of bounds memory access in V8. Reported by 303f06e3 on 2024-12-04</li>
	 <li>[368222741] High CVE-2024-12694: Use after free in Compositing. Reported by Anonymous on 2024-09-19</li>
	 <li>[383647255] High CVE-2024-12695: Out of bounds write in V8. Reported by 303f06e3 on 2024-12-12</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-12692</cvename>
 <cvename>CVE-2024-12693</cvename>
 <cvename>CVE-2024-12694</cvename>
 <cvename>CVE-2024-12695</cvename>
 <url>https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_18.html</url>
 </references>
 <dates>
 <discovery>2024-12-18</discovery>
 <entry>2024-12-19</entry>
 </dates>
 </vuln>

<vuln vid="dc087dad-bd71-11ef-b5a1-000ec6d40964">
 <topic>liboqs -- Correctness error in HQC decapsulation</topic>
 <affects>
 <package>
	<name>liboqs</name>
	<range><lt>0.12.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Open Quantum Safe project reports:
	<blockquote cite="https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-gpf4-vrrw-r8v7">
	 A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treated as non-secret data. This results in an incorrect shared secret value being returned when the decapsulation function is called with a malformed ciphertext.
	 No concrete attack exploiting the error has been identified at this point. However, the error involves mishandling of the secret key, and in principle this presents a security vulnerability.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-54137</cvename>
 <url>https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-gpf4-vrrw-r8v7</url>
 </references>
 <dates>
 <discovery>2024-11-29</discovery>
 <entry>2024-12-18</entry>
 </dates>
 </vuln>

<vuln vid="38e6f778-bca3-11ef-8926-9b4f2d14eb53">
 <topic>gitea -- Fix misuse of PublicKeyCallback</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.22.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <h1>Problem Description:</h1>
 <ul>
 <li>Misuse of ServerConfig.PublicKeyCallback may cause authorization
 bypass in golang.org/x/crypto</li>
 </ul>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/pull/32810</url>
 <url>https://github.com/advisories/GHSA-v778-237x-gjrc</url>
 </references>
 <dates>
 <discovery>2024-12-12</discovery>
 <entry>2024-12-17</entry>
 </dates>
 </vuln>

<vuln vid="453cd84e-bca4-11ef-8926-9b4f2d14eb53">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.22.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <h1>Problem Description:</h1>
 <ul>
 <li>Fix delete branch perm checking</li>
 <li>Upgrade crypto library</li>
 </ul>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/pull/32791</url>
 <url>https://github.com/go-gitea/gitea/pull/32654</url>
 </references>
 <dates>
 <discovery>2024-11-27</discovery>
 <entry>2024-12-17</entry>
 </dates>
 </vuln>

<vuln vid="6ea20f0c-bca3-11ef-8926-9b4f2d14eb53">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.22.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <h1>Problem Description:</h1>
 <ul>
 <li>Fix basic auth with webauthn</li>
 <li>Refactor internal routers (partial backport, auth token const time comparing)</li>
 </ul>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/pull/32531</url>
 <url>https://github.com/go-gitea/gitea/pull/32473</url>
 </references>
 <dates>
 <discovery>2024-11-16</discovery>
 <entry>2024-12-17</entry>
 </dates>
 </vuln>

<vuln vid="5ca064a6-bca1-11ef-8926-9b4f2d14eb53">
 <topic>forgejo -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>forgejo</name>
	<range><lt>9.0.2</lt></range>
 </package>
 <package>
	<name>forgejo7</name>
	<range><lt>7.0.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <h1>Problem Description:</h1>
 <ul>
 <li>It was possible to use a token sent via email for secondary email validation to reset the password instead. In other words, a token sent for a given action (registration, password reset or secondary email validation) could be used to perform a different action. It is no longer possible to use a token for an action that is different from its original purpose.</li>
 <li>A fork of a public repository would show in the list of forks, even if its owner was not a public user or organization. Such a fork is now hidden from the list of forks of the public repository.</li>
 <li>The members of an organization team with read access to a repository (e.g. to read issues) but no read access to the code could read the RSS or atom feeds which include the commit activity. Reading the RSS or atom feeds is now denied unless the team has read permissions on the code.</li>
 <li>The tokens used when replying by email to issues or pull requests were weaker than the rfc2104 recommendations. The tokens are now truncated to 128 bits instead of 80 bits. It is no longer possible to reply to emails sent before the upgrade because the weaker tokens are invalid.</li>
 <li>A registered user could modify the update frequency of any push mirror (e.g. every 4h instead of every 8h). They are now only able to do that if they have administrative permissions on the repository.</li>
 <li>It was possible to use basic authorization (i.e. user:password) for requests to the API even when security keys were enrolled for a user. It is no longer possible, an application token must be used instead.</li>
 <li>Some markup sanitation rules were not as strong as they could be (e.g. allowing emoji somethingelse as well as emoji). The rules are now stricter and do not allow for such cases.</li>
 <li>When Forgejo is configured to enable instance wide search (e.g. with bleve), results found in the repositories of private or limited users were displayed to anonymous visitors. The results found in private or limited organizations were not displayed. The search results found in the repositories of private or limited user are no longer displayed to anonymous visitors.</li>
 </ul>
 </body>
 </description>
 <references>
 <url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
 <url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
 <url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
 <url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
 <url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
 <url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
 <url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
 <url>https://codeberg.org/forgejo/forgejo/pulls/5974</url>
 </references>
 <dates>
 <discovery>2024-12-12</discovery>
 <entry>2024-12-17</entry>
 <modified>2024-12-18</modified>
 </dates>
 </vuln>

<vuln vid="25a697de-bca1-11ef-8926-9b4f2d14eb53">
 <topic>forgejo -- unauthorized user impersonation</topic>
 <affects>
 <package>
	<name>forgejo</name>
	<range><lt>7.0.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <h1>Problem Description:</h1>
 <ul>
 <li>When Forgejo is configured to run the internal ssh server with
 [server].START_SSH_SERVER=true, it was possible for a registered user
 to impersonate another user. The rootless container image uses the
 internal ssh server by default and was vulnerable. A Forgejo
 instance running from a binary or from a root container image does
 not use the internal ssh server by default and was not vulnerable.
 The incorrect use of the crypto package is the root cause of the
 vulnerability and was fixed for the internal ssh server.</li>
 <li>Revert "allow synchronizing user status from OAuth2 login
 providers"</li>
 </ul>
 </body>
 </description>
 <references>
 <url>https://codeberg.org/forgejo/forgejo/pulls/6248</url>
 </references>
 <dates>
 <discovery>2024-12-12</discovery>
 <entry>2024-12-17</entry>
 </dates>
 </vuln>

<vuln vid="6dcf6fc6-bca0-11ef-8926-9b4f2d14eb53">
 <topic>forgejo -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>forgejo</name>
	<range><lt>9.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <h1>Problem Description:</h1>
 <ul>
 <li>When Forgejo is configured to run the internal ssh server with
 [server].START_SSH_SERVER=true, it was possible for a registered user
 to impersonate another user. The rootless container image uses the
 internal ssh server by default and was vulnerable. A Forgejo
 instance running from a binary or from a root container image does
 not use the internal ssh server by default and was not vulnerable.
 The incorrect use of the crypto package is the root cause of the
 vulnerability and was fixed for the internal ssh server.</li>
 <li>Revert "allow synchronizing user status from OAuth2 login
 providers"</li>
 </ul>
 </body>
 </description>
 <references>
 <url>https://codeberg.org/forgejo/forgejo/pulls/6248</url>
 <url>https://codeberg.org/forgejo/forgejo/pulls/6249</url>
 </references>
 <dates>
 <discovery>2024-12-12</discovery>
 <entry>2024-12-17</entry>
 </dates>
 </vuln>

<vuln vid="71f3e9f0-bafc-11ef-885d-901b0e934d69">
 <topic>py-matrix-synapse -- multiple vulnerabilities in versions prior to 1.120.1</topic>
 <affects>
 <package>
	<name>py38-matrix-synapse</name>
	<name>py39-matrix-synapse</name>
	<name>py310-matrix-synapse</name>
	<name>py311-matrix-synapse</name>
	<range><lt>1.120.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
		element-hq/synapse developers report:
	<blockquote cite="https://github.com/element-hq/synapse/releases/tag/v1.120.2">
		[The 1.120.1] release fixes multiple security
		vulnerabilities, some affecting all prior versions of
		Synapse. Server administrators are encouraged to
		update Synapse as soon as possible. We are not aware
		of these vulnerabilities being exploited in the
		wild.
		Administrators who are unable to update Synapse may
		use the workarounds described in the linked GitHub
		Security Advisory below.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-52805</cvename>
 <url>https://github.com/element-hq/synapse/security/advisories/GHSA-rfq8-j7rh-8hf2</url>
 <cvename>CVE-2024-52815</cvename>
 <url>https://github.com/element-hq/synapse/security/advisories/GHSA-f3r3-h2mq-hx2h</url>
 <cvename>CVE-2024-53863</cvename>
 <url>https://github.com/element-hq/synapse/security/advisories/GHSA-vp6v-whfm-rv3g</url>
 <cvename>CVE-2024-53867</cvename>
 <url>https://github.com/element-hq/synapse/security/advisories/GHSA-56w4-5538-8v8h</url>
 <cvename>CVE-2024-37302</cvename>
 <url>https://github.com/element-hq/synapse/security/advisories/GHSA-4mhg-xv73-xq2x</url>
 <cvename>CVE-2024-37303</cvename>
 <url>https://github.com/element-hq/synapse/security/advisories/GHSA-gjgr-7834-rhxr</url>
 </references>
 <dates>
 <discovery>2024-12-03</discovery>
 <entry>2024-12-15</entry>
 </dates>
 </vuln>

<vuln vid="ef56065e-81fe-4731-a1e3-606c55925bef">
 <topic>zeek -- potential DoS vulnerability</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>7.0.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v7.0.5">
	 Large QUIC packets can cause Zeek to overflow memory
	 and potentially crash. Due to the possibility of receiving
	 these packets from remote hosts, this is a DoS risk. 
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v7.0.5</url>
 </references>
 <dates>
 <discovery>2024-12-16</discovery>
 <entry>2024-12-16</entry>
 </dates>
 </vuln>

<vuln vid="275ac414-b847-11ef-9877-2cf05da270f3">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.6.0</ge><lt>17.6.2</lt></range>
	<range><ge>17.5.0</ge><lt>17.5.4</lt></range>
	<range><ge>9.4.0</ge><lt>17.4.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/12/11/patch-release-gitlab-17-6-2-released/">
	 Injection of Network Error Logging (NEL) headers in kubernetes proxy response could lead to ATO abusing OAuth flows
	 Denial of Service by repeatedly sending unauthenticated requests for diff-files
	 CI_JOB_TOKEN could be used to obtain GitLab session
	 Open redirect in releases API
	 Client-Side Path Traversal in Harbor artifact links
	 HTML injection in vulnerability details could lead to Cross Site Scripting
	 Leak branch names of projects with confidential repository
	 Non member can view unresolved threads marked as internal notes
	 Uncontrolled Resource Consumption through a maliciously crafted file
	 Certain sensitive information passed as literals inside GraphQL mutations retained in GraphQL logs
	 Information disclosure of confidential incidents details to a group member in Gitlab Wiki
	 Domain Confusion in GitLab Pages Unique Domain Implementation
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-11274</cvename>
 <cvename>CVE-2024-8233</cvename>
 <cvename>CVE-2024-9387</cvename>
 <cvename>CVE-2024-8647</cvename>
 <cvename>CVE-2024-8179</cvename>
 <cvename>CVE-2024-8116</cvename>
 <cvename>CVE-2024-8650</cvename>
 <cvename>CVE-2024-9367</cvename>
 <cvename>CVE-2024-12292</cvename>
 <cvename>CVE-2024-12292</cvename>
 <cvename>CVE-2024-10043</cvename>
 <url>https://about.gitlab.com/releases/2024/12/11/patch-release-gitlab-17-6-2-released/</url>
 </references>
 <dates>
 <discovery>2024-12-11</discovery>
 <entry>2024-12-12</entry>
 </dates>
 </vuln>

<vuln vid="aeee5ebd-356c-49c1-8959-7c88981de5fd">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>131.0.6778.139</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>131.0.6778.139</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_10.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[381696874] High CVE-2024-12381: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) on 2024-12-02</li>
	 <li>[379516109] High CVE-2024-12382: Use after free in Translate. Reported by lime(@limeSec_) from TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-11-18</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-12381</cvename>
 <cvename>CVE-2024-12382</cvename>
 <url>https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_10.html</url>
 </references>
 <dates>
 <discovery>2024-12-10</discovery>
 <entry>2024-12-11</entry>
 </dates>
 </vuln>

<vuln vid="3d5b7860-48ad-48c2-aa36-601b8ab9cc43">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>131.0.6778.108</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>131.0.6778.108</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[379009132] High CVE-2024-12053: Type Confusion in V8. Reported by gal1ium and chluo on 2024-11-14</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-12053</cvename>
 <url>https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2024-12-03</discovery>
 <entry>2024-12-11</entry>
 </dates>
 </vuln>

<vuln vid="0e20e42c-b728-11ef-805a-b42e991fc52e">
 <topic>firefox -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>133.0.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.5,1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.5</lt></range>
	<range><ge>129</ge><lt>133</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1929600">
	<ul>
	<li>CVE-2024-11692: An attacker could cause a select dropdown
	to be shown over another tab; this could have led to user
	confusion and possible spoofing attacks.</li>
	<li>CVE-2024-11696: The application failed to account for
	exceptions thrown by the `loadManifestFromFile` method during
	add-on signature verification. This flaw, triggered by an
	invalid or unsupported extension manifest, could have caused
	runtime errors that disrupted the signature validation process.
	As a result, the enforcement of signature validation for
	unrelated add-ons may have been bypassed. Signature validation
	in this context is used to ensure that third-party
	applications on the user's computer have not tampered
	with the user's extensions, limiting the impact of this
	issue.</li>
	<li>CVE-2024-11697: When handling keypress events, an attacker
	may have been able to trick a user into bypassing the "
	Open Executable File?" confirmation dialog. This could
	have led to malicious code execution.</li>
	<li>CVE-2024-11699: Memory safety bugs present in Firefox 132,
	Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs
	showed evidence of memory corruption and we presume that with
	enough effort some of these could have been exploited to run
	arbitrary code.</li>
	</ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-11692</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-11692</url>
 <cvename>CVE-2024-11696</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-11696</url>
 <cvename>CVE-2024-11697</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-11697</url>
 <cvename>CVE-2024-11699</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-11699</url>
 </references>
 <dates>
 <discovery>2024-11-26</discovery>
 <entry>2024-12-10</entry>
 </dates>
 </vuln>

<vuln vid="c2fd83e4-b450-11ef-b680-4ccc6adda413">
 <topic>qt6-webengine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>qt6-webengine</name>
	<range><lt>6.7.3_3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Qt qtwebengine-chromium repo reports:
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based">
	 Backports for 5 security bugs in Chromium:
	 <ul>
	 <li>CVE-2024-11110: Inappropriate implementation in Blink</li>
	 <li>CVE-2024-11112: Use after free in Media</li>
	 <li>CVE-2024-11114: Inappropriate implementation in Views</li>
	 <li>CVE-2024-11116: Inappropriate implementation in Paint</li>
	 <li>CVE-2024-11117: Inappropriate implementation in FileSystem</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-11110</cvename>
 <cvename>CVE-2024-11112</cvename>
 <cvename>CVE-2024-11114</cvename>
 <cvename>CVE-2024-11116</cvename>
 <cvename>CVE-2024-11117</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based</url>
 </references>
 <dates>
 <discovery>2024-11-29</discovery>
 <entry>2024-12-07</entry>
 </dates>
 </vuln>

<vuln vid="7f3a302b-b3e8-11ef-b680-4ccc6adda413">
 <topic>gstreamer1-plugins-vorbis -- Stack buffer-overflow in Vorbis decoder</topic>
 <affects>
 <package>
	<name>gstreamer1-plugins-vorbis</name>
	<range><lt>1.24.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The GStreamer Security Center reports:
	<blockquote cite="https://gstreamer.freedesktop.org/security/">
	 Stack buffer-overflow in Vorbis decoder that can cause crashes for
	 certain input files.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-47538</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0022.html</url>
 </references>
 <dates>
 <discovery>2024-12-03</discovery>
 <entry>2024-12-06</entry>
 </dates>
 </vuln>

<vuln vid="7d1b4e5d-b3e8-11ef-b680-4ccc6adda413">
 <topic>gstreamer1-plugins-opus -- Stack buffer-overflow in Opus decoder</topic>
 <affects>
 <package>
	<name>gstreamer1-plugins-opus</name>
	<range><lt>1.24.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The GStreamer Security Center reports:
	<blockquote cite="https://gstreamer.freedesktop.org/security/">
	 Stack buffer-overflow in Opus decoder that can cause crashes for
	 certain input files.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-47607</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0024.html</url>
 </references>
 <dates>
 <discovery>2024-12-03</discovery>
 <entry>2024-12-06</entry>
 </dates>
 </vuln>

<vuln vid="7b34ddf7-b3e8-11ef-b680-4ccc6adda413">
 <topic>gstreamer1-plugins-ogg -- Out-of-bounds write in Ogg demuxer</topic>
 <affects>
 <package>
	<name>gstreamer1-plugins-ogg</name>
	<range><lt>1.24.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The GStreamer Security Center reports:
	<blockquote cite="https://gstreamer.freedesktop.org/security/">
	 An out-of-bounds write in the Ogg demuxer that can cause crashes
	 for certain input files.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-47615</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0026.html</url>
 </references>
 <dates>
 <discovery>2024-12-03</discovery>
 <entry>2024-12-06</entry>
 </dates>
 </vuln>

<vuln vid="7945c543-b3e8-11ef-b680-4ccc6adda413">
 <topic>gstreamer1-plugins-jpeg -- NULL-pointer dereferences in JPEG decoder</topic>
 <affects>
 <package>
	<name>gstreamer1-plugins-jpeg</name>
	<range><lt>1.24.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The GStreamer Security Center reports:
	<blockquote cite="https://gstreamer.freedesktop.org/security/">
	 Insufficient error handling in the JPEG decoder that can lead to
	 NULL-pointer dereferences, and that can cause crashes for certain
	 input files.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-47599</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0016.html</url>
 </references>
 <dates>
 <discovery>2024-12-03</discovery>
 <entry>2024-12-06</entry>
 </dates>
 </vuln>

<vuln vid="772d8625-b3e8-11ef-b680-4ccc6adda413">
 <topic>gstreamer1-plugins-gdkpixbuf -- NULL-pointer dereference</topic>
 <affects>
 <package>
	<name>gstreamer1-plugins-gdkpixbuf</name>
	<range><lt>1.24.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The GStreamer Security Center reports:
	<blockquote cite="https://gstreamer.freedesktop.org/security/">
	 A NULL-pointer dereference in the gdk-pixbuf decoder that can
	 cause crashes for certain input files.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-47613</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0025.html</url>
 </references>
 <dates>
 <discovery>2024-12-03</discovery>
 <entry>2024-12-06</entry>
 </dates>
 </vuln>

<vuln vid="750ab972-b3e8-11ef-b680-4ccc6adda413">
 <topic>gstreamer1-plugins-good -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gstreamer1-plugins-good</name>
	<range><lt>1.24.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The GStreamer Security Center reports:
	<blockquote cite="https://gstreamer.freedesktop.org/security/">
	 20 security bugs.
	 <ul>
	 <li>CVE-2024-47537: Integer overflow in MP4/MOV sample table parser leading to out-of-bounds writes</li>
	 <li>CVE-2024-47598: MP4/MOV sample table parser out-of-bounds read</li>
	 <li>CVE-2024-47539: MP4/MOV Closed Caption handling out-of-bounds write</li>
	 <li>CVE-2024-47543: MP4/MOV demuxer out-of-bounds read</li>
	 <li>CVE-2024-47545: Integer overflow in MP4/MOV demuxer that can result in out-of-bounds read</li>
	 <li>CVE-2024-47544: NULL-pointer dereferences in MP4/MOV demuxer CENC handling</li>
	 <li>CVE-2024-47597: Out-of-bounds reads in MP4/MOV demuxer sample table parser</li>
	 <li>CVE-2024-47546: Integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads</li>
	 <li>CVE-2024-47606: Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes</li>
	 <li>CVE-2024-47596: Integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads</li>
	 <li>CVE-2024-47540: Usage of uninitialized stack memory in Matroska/WebM demuxer</li>
	 <li>CVE-2024-47602: NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer</li>
	 <li>CVE-2024-47601: NULL-pointer dereference in Matroska/WebM demuxer</li>
	 <li>CVE-2024-47603: NULL-pointer dereference in Matroska/WebM demuxer</li>
	 <li>CVE-2024-47775: Out-of-bounds read in WAV parser</li>
	 <li>CVE-2024-47776: Out-of-bounds read in WAV parser</li>
	 <li>CVE-2024-47777: Out-of-bounds read in WAV parser</li>
	 <li>CVE-2024-47778: Out-of-bounds read in WAV parser</li>
	 <li>CVE-2024-47774: Integer overflow in AVI subtitle parser that leads to out-of-bounds reads</li>
	 <li>CVE-2024-47834: Use-after-free in Matroska demuxer</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-47537</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0005.html</url>
 <cvename>CVE-2024-47598</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0006.html</url>
 <cvename>CVE-2024-47539</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0007.html</url>
 <cvename>CVE-2024-47543</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0009.html</url>
 <cvename>CVE-2024-47545</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0010.html</url>
 <cvename>CVE-2024-47544</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0011.html</url>
 <cvename>CVE-2024-47597</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0012.html</url>
 <cvename>CVE-2024-47546</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0013.html</url>
 <cvename>CVE-2024-47606</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0014.html</url>
 <cvename>CVE-2024-47596</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0015.html</url>
 <cvename>CVE-2024-47540</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0017.html</url>
 <cvename>CVE-2024-47602</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0019.html</url>
 <cvename>CVE-2024-47601</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0020.html</url>
 <cvename>CVE-2024-47603</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0021.html</url>
 <cvename>CVE-2024-47775</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0027.html</url>
 <cvename>CVE-2024-47776</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0027.html</url>
 <cvename>CVE-2024-47777</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0027.html</url>
 <cvename>CVE-2024-47778</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0027.html</url>
 <cvename>CVE-2024-47835</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0028.html</url>
 <cvename>CVE-2024-47834</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0030.html</url>
 </references>
 <dates>
 <discovery>2024-12-03</discovery>
 <entry>2024-12-06</entry>
 </dates>
 </vuln>

<vuln vid="7256fae8-b3e8-11ef-b680-4ccc6adda413">
 <topic>gstreamer1-plugins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gstreamer1-plugins</name>
	<range><lt>1.24.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The GStreamer Security Center reports:
	<blockquote cite="https://gstreamer.freedesktop.org/security/">
	 3 security bugs.
	 <ul>
	 <li>CVE-2024-47542: ID3v2 parser out-of-bounds read and NULL-pointer dereference</li>
	 <li>CVE-2024-47600: Out-of-bounds read in gst-discoverer-1.0 commandline tool</li>
	 <li>CVE-2024-47541: Out-of-bounds write in SSA subtitle parser</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-47542</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0008.html</url>
 <cvename>CVE-2024-47600</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0018.html</url>
 <cvename>CVE-2024-47541</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0023.html</url>
 </references>
 <dates>
 <discovery>2024-12-03</discovery>
 <entry>2024-12-06</entry>
 </dates>
 </vuln>

<vuln vid="f0d33375-b0e0-11ef-a724-b42e991fc52e">
 <topic>zabbix -- SQL injection in user.get API</topic>
 <affects>
 <package>
	<name>zabbix6-frontend</name>
	<range><lt>6.0.31</lt></range>
 </package>
 <package>
	<name>zabbix64-frontend</name>
	<range><lt>6.4.16</lt></range>
 </package>
 <package>
	<name>zabbix7-frontend</name>
	<range><lt>7.0.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@zabbix.com reports:
	<blockquote cite="https://support.zabbix.com/browse/ZBX-25623">
	 A non-admin user account on the Zabbix frontend with the default
	User role, or with any other role that gives API access can exploit
	this vulnerability. An SQLi exists in the CUser class in the
	addRelatedObjects function, this function is being called from the
	CUser.get function which is available for every user who has API
	access.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-42327</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-42327</url>
 </references>
 <dates>
 <discovery>2024-11-27</discovery>
 <entry>2024-12-02</entry>
 </dates>
 </vuln>

<vuln vid="8b6e97a9-804e-4366-9f75-d102b22a716d">
 <topic>electron33 -- Inappropriate implementation in Extensions</topic>
 <affects>
 <package>
	<name>electron33</name>
	<range><lt>33.2.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v33.2.1">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2024-11110.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-11110</cvename>
 <url>https://github.com/advisories/GHSA-4mww-gp9h-h59m</url>
 </references>
 <dates>
 <discovery>2024-11-27</discovery>
 <entry>2024-12-02</entry>
 </dates>
 </vuln>

<vuln vid="c5dafd73-adfd-11ef-af27-00e081b7aa2d">
 <topic>jenkins -- Denial of service vulnerability in bundled json-lib</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.487</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.479.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2024-11-27/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-3463 / CVE-2024-47855</h5>
	 Denial of service vulnerability in bundled json-lib
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-47855</cvename>
 <url>https://www.jenkins.io/security/advisory/2024-11-27/</url>
 </references>
 <dates>
 <discovery>2024-11-27</discovery>
 <entry>2024-11-29</entry>
 </dates>
 </vuln>

<vuln vid="7d7a28cd-7f5a-450a-852f-c49aaab3fa7e">
 <topic>keycloak -- Multiple security fixes</topic>
 <affects>
 <package>
	<name>keycloak</name>
	<range><lt>26.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Keycloak reports:
	<blockquote cite="https://www.keycloak.org/2024/11/keycloak-2606-released.html">
	 This update includes 5 security fixes:
	 <ul>
	 <li>CVE-2024-10451: Sensitive Data Exposure in Keycloak Build Process</li>
	 <li>CVE-2024-10270: Potential Denial of Service</li>
	 <li>CVE-2024-10492: Keycloak path trasversal</li>
	 <li>CVE-2024-9666: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability</li>
	 <li>CVE-2024-10039: Bypassing mTLS validation</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-9666</cvename>
 <cvename>CVE-2021-10039</cvename>
 <cvename>CVE-2021-10270</cvename>
 <cvename>CVE-2021-10451</cvename>
 <cvename>CVE-2021-10492</cvename>
 </references>
 <dates>
 <discovery>2024-11-22</discovery>
 <entry>2024-11-25</entry>
 </dates>
 </vuln>

<vuln vid="2263ea04-ac81-11ef-998c-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.6.0</ge><lt>17.6.1</lt></range>
	<range><ge>17.5.0</ge><lt>17.5.3</lt></range>
	<range><ge>8.12.0</ge><lt>17.4.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/11/26/patch-release-gitlab-17-6-1-released/">
	 Privilege Escalation via LFS Tokens
	 DoS through uncontrolled resource consumption when viewing a maliciously crafted cargo.toml file
	 Unintended Access to Usage Data via Scoped Tokens
	 Gitlab DOS via Harbor registry integration
	 Resource exhaustion and denial of service with test_report API calls
	 Streaming endpoint did not invalidate tokens after revocation
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-8114</cvename>
 <cvename>CVE-2024-8237</cvename>
 <cvename>CVE-2024-11669</cvename>
 <cvename>CVE-2024-8177</cvename>
 <cvename>CVE-2024-11828</cvename>
 <cvename>CVE-2024-11668</cvename>
 <url>https://about.gitlab.com/releases/2024/11/26/patch-release-gitlab-17-6-1-released/</url>
 </references>
 <dates>
 <discovery>2024-11-26</discovery>
 <entry>2024-11-27</entry>
 </dates>
 </vuln>

<vuln vid="9dfca0cd-ab09-11ef-8c1c-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>131.0.6778.85</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>131.0.6778.85</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_19.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[377384894] High CVE-2024-11395: Type Confusion in V8. Reported by Anonymous on 2024-11-05</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-11395</cvename>
 <url>https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_19.html</url>
 </references>
 <dates>
 <discovery>2024-11-19</discovery>
 <entry>2024-11-25</entry>
 </dates>
 </vuln>

<vuln vid="889eddee-a964-11ef-b680-4ccc6adda413">
 <topic>qt6-webengine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>qt6-webengine</name>
	<range><lt>6.7.3_2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Qt qtwebengine-chromium repo reports:
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based">
	 Backports for 16 security bugs in Chromium:
	 <ul>
	 <li>CVE-2024-9120: Use after free in Dawn</li>
	 <li>CVE-2024-9122: Type Confusion in V8</li>
	 <li>CVE-2024-9123: Integer overflow in Skia</li>
	 <li>CVE-2024-9369: Insufficient data validation in Mojo</li>
	 <li>CVE-2024-9602: Type confusion in V8</li>
	 <li>CVE-2024-9603: Type confusion in V8</li>
	 <li>CVE-2024-9965: Insufficient data validation in DevTools</li>
	 <li>CVE-2024-9966: Inappropriate implementation in Navigations</li>
	 <li>CVE-2024-10229: Inappropriate implementation in Extensions</li>
	 <li>CVE-2024-10230: Type confusion in V8</li>
	 <li>CVE-2024-10231: Type confusion in V8</li>
	 <li>CVE-2024-10487: Out of bounds write in Dawn</li>
	 <li>CVE-2024-10827: Use after free in Serial</li>
	 <li>CVE-2024-45490: Negative length in libexpat</li>
	 <li>CVE-2024-45491: Integer overflow in libexpat</li>
	 <li>CVE-2024-45492: Integer overflow in libexpat</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-9120</cvename>
 <cvename>CVE-2024-9122</cvename>
 <cvename>CVE-2024-9123</cvename>
 <cvename>CVE-2024-9369</cvename>
 <cvename>CVE-2024-9602</cvename>
 <cvename>CVE-2024-9603</cvename>
 <cvename>CVE-2024-9965</cvename>
 <cvename>CVE-2024-9966</cvename>
 <cvename>CVE-2024-10229</cvename>
 <cvename>CVE-2024-10230</cvename>
 <cvename>CVE-2024-10231</cvename>
 <cvename>CVE-2024-10487</cvename>
 <cvename>CVE-2024-10827</cvename>
 <cvename>CVE-2024-45490</cvename>
 <cvename>CVE-2024-45491</cvename>
 <cvename>CVE-2024-45492</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based</url>
 </references>
 <dates>
 <discovery>2024-09-26</discovery>
 <entry>2024-11-23</entry>
 </dates>
 </vuln>

<vuln vid="16e472d5-a8aa-11ef-b680-4ccc6adda413">
 <topic>qt5-webengine -- Use after free in Serial</topic>
 <affects>
 <package>
	<name>qt5-webengine</name>
	<range><lt>5.15.18p5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Qt qtwebengine-chromium repo reports:
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based">
	 Backports for 1 security bug in Chromium:
	 <ul>
	 <li>CVE-2024-10827: Use after free in Serial</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-10827</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based</url>
 </references>
 <dates>
 <discovery>2024-10-24</discovery>
 <entry>2024-11-22</entry>
 </dates>
 </vuln>

<vuln vid="141f2a22-a6a7-11ef-b282-0c9d92850f7a">
 <topic>xorg server -- _XkbSetCompatMap vulnerability</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<range><lt>21.1.14,1</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>24.1.4,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The X.Org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2024-October/003545.html">
	 <ul>
	 <li>
	 CVE-2024-9632: Heap buffer Heap-based buffer overflow
		privilege escalation in _XkbSetCompatMap

The _XkbSetCompatMap() function attempts to resize
		the `sym_interpret` buffer.

However, It didn't update its size properly.
		It updated `num_si` only, without updating `size_si`.

This may lead to local privilege escalation if the
		server is run as root or remote code execution
		(e.g. x11 over ssh).
	 </li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-9632</cvename>
 <url>https://lists.x.org/archives/xorg-announce/2024-October/003545.html</url>
 </references>
 <dates>
 <discovery>2024-10-29</discovery>
 <entry>2024-11-19</entry>
 </dates>
 </vuln>

<vuln vid="28ffa931-a510-11ef-8109-b42e991fc52e">
 <topic>mongodb -- Buffer over-reads in MongoDB Server</topic>
 <affects>
 <package>
	<name>mongodb50</name>
	<range><lt>5.0.30</lt></range>
 </package>
 <package>
	<name>mongodb60</name>
	<range><lt>6.0.19</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.15</lt></range>
 </package>
 <package>
	<name>mongodb80</name>
	<range><lt>8.0.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cna@mongodb.com reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-96419">
	 An authorized user may trigger crashes or receive the contents of
	buffer over-reads of Server memory by issuing specially crafted
	requests that construct malformed BSON in the MongoDB Server.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-10921</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-10921</url>
 </references>
 <dates>
 <discovery>2024-11-14</discovery>
 <entry>2024-11-17</entry>
 </dates>
 </vuln>

<vuln vid="efd4537e-a5e8-11ef-bedb-180373b66b37">
 <topic>Vaultwarden -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>vaultwarden</name>
	<range><lt>1.32.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Vaultwarden project reports:
	<blockquote cite="https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5">
	 This release further fixed some CVE Reports reported by a third
	 party security auditor and we recommend everybody to update to the
	 latest version as soon as possible.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5</url>
 </references>
 <dates>
 <discovery>2024-11-11</discovery>
 <entry>2024-11-18</entry>
 </dates>
 </vuln>

<vuln vid="aba28514-a414-11ef-98e7-84a93843eb75">
 <topic>Vaultwarden -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>vaultwarden</name>
	<range><lt>1.32.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Vaultwarden project reports:
	<blockquote cite="https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4">
	 This release has fixed some CVE Reports reported by a third party
	 security auditor and we recommend everybody to update to the
	 latest version as soon as possible.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4</url>
 </references>
 <dates>
 <discovery>2024-11-10</discovery>
 <entry>2024-11-16</entry>
 </dates>
 </vuln>

<vuln vid="8fe4f296-a3ec-11ef-8c1c-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>131.0.6778.69</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>131.0.6778.69</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html">
	 This update includes 12 security fixes:
	 <ul>
	 <li>[373263969] High CVE-2024-11110: Inappropriate implementation in Blink. Reported by Vsevolod Kokorin (Slonser) of Solidlab on 2024-10-14</li>
	 <li>[360520331] Medium CVE-2024-11111: Inappropriate implementation in Autofill. Reported by Narendra Bhati, Suma Soft Pvt. Ltd - Pune (India) on 2024-08-18</li>
	 <li>[354824998] Medium CVE-2024-11112: Use after free in Media. Reported by Nan Wang(@eternalsakura13) and Zhenghang Xiao(@Kipreyyy) of 360 Vulnerability Research Institute on 2024-07-23</li>
	 <li>[360274917] Medium CVE-2024-11113: Use after free in Accessibility. Reported by Weipeng Jiang (@Krace) of VRI on 2024-08-16</li>
	 <li>[370856871] Medium CVE-2024-11114: Inappropriate implementation in Views. Reported by Micky on 2024-10-02</li>
	 <li>[371929521] Medium CVE-2024-11115: Insufficient policy enforcement in Navigation. Reported by mastersplinter on 2024-10-07</li>
	 <li>[40942531] Medium CVE-2024-11116: Inappropriate implementation in Paint. Reported by Thomas Orlita on 2023-11-14</li>
	 <li>[40062534] Low CVE-2024-11117: Inappropriate implementation in FileSystem. Reported by Ameen Basha M K on 2023-01-06</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-11110</cvename>
 <cvename>CVE-2024-11111</cvename>
 <cvename>CVE-2024-11112</cvename>
 <cvename>CVE-2024-11113</cvename>
 <cvename>CVE-2024-11114</cvename>
 <cvename>CVE-2024-11115</cvename>
 <cvename>CVE-2024-11116</cvename>
 <cvename>CVE-2024-11117</cvename>
 <url>https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html</url>
 </references>
 <dates>
 <discovery>2024-11-12</discovery>
 <entry>2024-11-16</entry>
 </dates>
 </vuln>

<vuln vid="773e7eb2-af19-4fc7-be7f-0f6a2523b98b">
 <topic>electron31 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron31</name>
	<range><lt>31.7.5</lt></range>
 </package>
 <package>
	<name>electron32</name>
	<range><lt>32.2.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v31.7.5">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-10827.</li>
	 <li>Security: backported fix for CVE-2024-11110.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-10827</cvename>
 <url>https://github.com/advisories/GHSA-58wv-w3hc-2c76</url>
 <cvename>CVE-2024-11110</cvename>
 <url>https://github.com/advisories/GHSA-4mww-gp9h-h59m</url>
 </references>
 <dates>
 <discovery>2024-11-15</discovery>
 <entry>2024-11-15</entry>
 <modified>2024-11-16</modified>
 </dates>
 </vuln>

<vuln vid="a03636f4-a29f-11ef-af48-6cc21735f730">
 <topic>PostgreSQL -- PL/Perl environment variable changes execute arbitrary code</topic>
 <affects>
 <package>
	<name>postgresql17-plperl</name>
	<range><lt>17.1</lt></range>
 </package>
 <package>
	<name>postgresql16-plperl</name>
	<range><lt>16.5</lt></range>
 </package>
 <package>
	<name>postgresql15-plperl</name>
	<range><lt>15.9</lt></range>
 </package>
 <package>
	<name>postgresql14-plperl</name>
	<range><lt>14.14</lt></range>
 </package>
 <package>
	<name>postgresql13-plperl</name>
	<range><lt>13.17</lt></range>
 </package>
 <package>
	<name>postgresql12-plperl</name>
	<range><lt>12.21</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2024-10979/">
	
	Incorrect control of environment variables in PostgreSQL
	PL/Perl allows an unprivileged database user to change
	sensitive process environment variables (e.g. PATH).
	That often suffices to enable arbitrary code execution,
	even if the attacker lacks a database server operating
	system user.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-10979</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2024-10979/</url>
 </references>
 <dates>
 <discovery>2024-11-14</discovery>
 <entry>2024-11-14</entry>
 </dates>
 </vuln>

<vuln vid="12e3feab-a29f-11ef-af48-6cc21735f730">
 <topic>PostgreSQL -- SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID</topic>
 <affects>
 <package>
	<name>postgresql17-server</name>
	<range><lt>17.1</lt></range>
 </package>
 <package>
	<name>postgresql16-server</name>
	<range><lt>16.5</lt></range>
 </package>
 <package>
	<name>postgresql15-server</name>
	<range><lt>15.9</lt></range>
 </package>
 <package>
	<name>postgresql14-server</name>
	<range><lt>14.14</lt></range>
 </package>
 <package>
	<name>postgresql13-server</name>
	<range><lt>13.17</lt></range>
 </package>
 <package>
	<name>postgresql12-server</name>
	<range><lt>12.21</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2024-10978/">
	
	Incorrect privilege assignment in PostgreSQL allows a
	less-privileged application user to view or change
	different rows from those intended. An attack requires
	the application to use SET ROLE, SET SESSION
	AUTHORIZATION, or an equivalent feature. The problem
	arises when an application query uses parameters from
	the attacker or conveys query results to the attacker.
	If that query reacts to current_setting('role') or the
	current user ID, it may modify or return data as though
	the session had not used SET ROLE or SET SESSION
	AUTHORIZATION. The attacker does not control which
	incorrect user ID applies. Query text from
	less-privileged sources is not a concern here, because
	SET ROLE and SET SESSION AUTHORIZATION are not sandboxes
	for unvetted queries
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-10978</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2024-10978/</url>
 </references>
 <dates>
 <discovery>2024-11-14</discovery>
 <entry>2024-11-14</entry>
 </dates>
 </vuln>

<vuln vid="a61ef21b-a29e-11ef-af48-6cc21735f730">
 <topic>PostgreSQL -- libpq retains an error message from man-in-the-middle</topic>
 <affects>
 <package>
	<name>postgresql17-client</name>
	<range><lt>17.1</lt></range>
 </package>
 <package>
	<name>postgresql16-client</name>
	<range><lt>16.5</lt></range>
 </package>
 <package>
	<name>postgresql15-client</name>
	<range><lt>15.9</lt></range>
 </package>
 <package>
	<name>postgresql14-client</name>
	<range><lt>14.14</lt></range>
 </package>
 <package>
	<name>postgresql13-client</name>
	<range><lt>13.17</lt></range>
 </package>
 <package>
	<name>postgresql12-client</name>
	<range><lt>12.21</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2024-10977/">
	
	Client use of server error message in PostgreSQL allows
	a server not trusted under current SSL or GSS settings
	to furnish arbitrary non-NUL bytes to the libpq
	application. For example, a man-in-the-middle attacker
	could send a long error message that a human or
	screen-scraper user of psql mistakes for valid query
	results. This is probably not a concern for clients
	where the user interface unambiguously indicates the
	boundary between one error message and other text.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-10977</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2024-10977/</url>
 </references>
 <dates>
 <discovery>2024-11-14</discovery>
 <entry>2024-11-14</entry>
 </dates>
 </vuln>

<vuln vid="3831292b-a29d-11ef-af48-6cc21735f730">
 <topic>PostgreSQL -- PostgreSQL row security below e.g. subqueries disregards user ID changes</topic>
 <affects>
 <package>
	<name>postgresql17-server</name>
	<range><lt>17.1</lt></range>
 </package>
 <package>
	<name>postgresql16-server</name>
	<range><lt>16.5</lt></range>
 </package>
 <package>
	<name>postgresql15-server</name>
	<range><lt>15.9</lt></range>
 </package>
 <package>
	<name>postgresql14-server</name>
	<range><lt>14.14</lt></range>
 </package>
 <package>
	<name>postgresql13-server</name>
	<range><lt>13.17</lt></range>
 </package>
 <package>
	<name>postgresql12-server</name>
	<range><lt>12.21</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2024-10976/">
	
	Incomplete tracking in PostgreSQL of tables with row
	security allows a reused query to view or change
	different rows from those intended. CVE-2023-2455 and
	CVE-2016-2193 fixed most interaction between row
	security and user ID changes. They missed cases where a
	subquery, WITH query, security invoker view, or
	SQL-language function references a table with a
	row-level security policy. This has the same
	consequences as the two earlier CVEs. That is to say, it
	leads to potentially incorrect policies being applied in
	cases where role-specific policies are used and a given
	query is planned under one role and then executed under
	other roles. This scenario can happen under security
	definer functions or when a common user and query is
	planned initially and then re-used across multiple SET
	ROLEs.

Applying an incorrect policy may permit a user to complete
	otherwise-forbidden reads and modifications. This affects only databases
	that have used CREATE POLICY to define a row security policy. An
	attacker must tailor an attack to a particular application's pattern of
	query plan reuse, user ID changes, and role-specific row security
	policies.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-10976</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2024-10976/</url>
 </references>
 <dates>
 <discovery>2024-11-14</discovery>
 <entry>2024-11-14</entry>
 </dates>
 </vuln>

<vuln vid="6b591e05-971c-4077-8ae4-1310554971b7">
 <topic>electron31 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron31</name>
	<range><lt>31.7.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v31.7.4">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-10231.</li>
	 <li>Security: backported fix for CVE-2024-10229.</li>
	 <li>Security: backported fix for CVE-2024-10487.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-10231</cvename>
 <url>https://github.com/advisories/GHSA-3wfx-mj93-vf8v</url>
 <cvename>CVE-2024-10229</cvename>
 <url>https://github.com/advisories/GHSA-3hjp-j522-245f</url>
 <cvename>CVE-2024-10487</cvename>
 <url>https://github.com/advisories/GHSA-h72p-7xmw-gpp8</url>
 </references>
 <dates>
 <discovery>2024-11-12</discovery>
 <entry>2024-11-14</entry>
 </dates>
 </vuln>

<vuln vid="1eb4d32c-a245-11ef-998c-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.5.0</ge><lt>17.5.2</lt></range>
	<range><ge>17.4.0</ge><lt>17.4.4</lt></range>
	<range><ge>16.0.0</ge><lt>17.3.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/">
	 Unauthorized access to Kubernetes cluster agent
	 Device OAuth flow allows for cross window forgery
	 Denial of Service by importing malicious crafted FogBugz import payload
	 Stored XSS through javascript URL in Analytics dashboards
	 HTML injection in vulnerability Code flow could lead to XSS on self hosted instances
	 Information disclosure through an API endpoint
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-9693</cvename>
 <cvename>CVE-2024-7404</cvename>
 <cvename>CVE-2024-8648</cvename>
 <cvename>CVE-2024-8180</cvename>
 <cvename>CVE-2024-10240</cvename>
 <url>https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/</url>
 </references>
 <dates>
 <discovery>2024-11-13</discovery>
 <entry>2024-11-14</entry>
 </dates>
 </vuln>

<vuln vid="ce0f52e1-a174-11ef-9a62-002590c1f29c">
 <topic>FreeBSD -- Certificate revocation list fetch(1) option fails</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.1</ge><lt>14.1_6</lt></range>
	<range><ge>13.4</ge><lt>13.4_2</lt></range>
	<range><ge>13.3</ge><lt>13.3_8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The fetch(3) library uses environment variables for passing
	certain information, including the revocation file pathname. The
	environment variable name used by fetch(1) to pass the filename to
	the library was incorrect, in effect ignoring the option.
	<h1>Impact:</h1>
	Fetch would still connect to a host presenting a certificate
	included in the revocation file passed to the --crl option.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-45289</cvename>
 <freebsdsa>SA-24:19.fetch</freebsdsa>
 </references>
 <dates>
 <discovery>2024-10-29</discovery>
 <entry>2024-11-13</entry>
 </dates>
 </vuln>

<vuln vid="8caa5d60-a174-11ef-9a62-002590c1f29c">
 <topic>FreeBSD -- Unbounded allocation in ctl(4) CAM Target Layer</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.1</ge><lt>14.1_6</lt></range>
	<range><ge>13.4</ge><lt>13.4_2</lt></range>
	<range><ge>13.3</ge><lt>13.3_8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The command ctl_persistent_reserve_out allows the caller to
	specify an arbitrary size which will be passed to the kernel's
	memory allocator.
	<h1>Impact:</h1>
	A malicious guest could cause a Denial of Service (DoS) on the
	host.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-39281</cvename>
 <freebsdsa>SA-24:18.ctl</freebsdsa>
 </references>
 <dates>
 <discovery>2024-10-29</discovery>
 <entry>2024-11-13</entry>
 </dates>
 </vuln>

<vuln vid="eb5c615d-a173-11ef-9a62-002590c1f29c">
 <topic>FreeBSD -- Multiple issues in the bhyve hypervisor</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.1</ge><lt>14.1_6</lt></range>
	<range><ge>13.4</ge><lt>13.4_2</lt></range>
	<range><ge>13.3</ge><lt>13.3_8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Several vulnerabilities were found in the bhyve hypervisor's
	device models.
	The NVMe driver function nvme_opc_get_log_page is vulnerable to a
	buffer over- read from a guest-controlled value. (CVE-2024-51562)
	The virtio_vq_recordon function is subject to a time-of-check to
	time-of-use (TOCTOU) race condition. (CVE-2024-51563)
	A guest can trigger an infinite loop in the hda audio driver.
	(CVE-2024-51564)
	The hda driver is vulnerable to a buffer over-read from a
	guest-controlled value. (CVE-2024-51565)
	The NVMe driver queue processing is vulernable to guest-induced
	infinite loops. (CVE-2024-51566)
	<h1>Impact:</h1>
	Malicious guest virtual machines may be able to perform a denial
	of service (DoS) of the bhyve host, and may read memory within the
	bhyve process that they should not be able to access.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-51562</cvename>
 <cvename>CVE-2024-51563</cvename>
 <cvename>CVE-2024-51564</cvename>
 <cvename>CVE-2024-51565</cvename>
 <cvename>CVE-2024-51566</cvename>
 <freebsdsa>SA-24:17.bhyve</freebsdsa>
 </references>
 <dates>
 <discovery>2024-10-29</discovery>
 <entry>2024-11-13</entry>
 </dates>
 </vuln>

<vuln vid="ab4e6f65-a142-11ef-84e9-901b0e9408dc">
 <topic>element-web -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>element-web</name>
	<range><lt>1.11.85</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Element team reports:
	<blockquote cite="https://github.com/element-hq/element-web/security/advisories/GHSA-5486-384g-mcx2">
	 Versions of Element Web and Desktop earlier than 1.11.85 do
	 not check if thumbnails for attachments, stickers and images
	 are coherent. It is possible to add thumbnails to events
	 trigger a file download once clicked.
	</blockquote>
	<blockquote cite="https://github.com/element-hq/element-web/security/advisories/GHSA-w36j-v56h-q9pc">
	 A malicious homeserver can send invalid messages over
	 federation which can prevent Element Web and Desktop from
	 rendering single messages or the entire room containing
	 them.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-51749</cvename>
 <cvename>CVE-2024-51750</cvename>
 <url>https://github.com/element-hq/element-web/security/advisories/GHSA-5486-384g-mcx2</url>
 <url>https://github.com/element-hq/element-web/security/advisories/GHSA-w36j-v56h-q9pc</url>
 </references>
 <dates>
 <discovery>2024-11-12</discovery>
 <entry>2024-11-12</entry>
 </dates>
 </vuln>

<vuln vid="574f7bc9-a141-11ef-84e9-901b0e9408dc">
 <topic>Matrix clients -- mxc uri validation in js sdk</topic>
 <affects>
 <package>
	<name>cinny</name>
	<range><lt>4.2.3</lt></range>
 </package>
 <package>
	<name>element-web</name>
	<range><lt>1.11.85</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	matrix-js-sdk upstream reports:
	<blockquote cite="https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-xvg8-m4x3-w6xr">
	 matrix-js-sdk before 34.11.0 is vulnerable to client-side
	 path traversal via crafted MXC URIs. A malicious room member
	 can trigger clients based on the matrix-js-sdk to issue
	 arbitrary authenticated GET requests to the client's
	 homeserver.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-50336</cvename>
 <url>https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-xvg8-m4x3-w6xr</url>
 </references>
 <dates>
 <discovery>2024-11-12</discovery>
 <entry>2024-11-12</entry>
 </dates>
 </vuln>

<vuln vid="0a82bc4d-a129-11ef-8351-589cfc0f81b0">
 <topic>icinga2 -- TLS Certificate Validation Bypass</topic>
 <affects>
 <package>
	<name>icinga2</name>
	<range><lt>2.14.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Icinga project reports:
	<blockquote cite="https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c">
	 Icinga is a monitoring system which checks the availability of
	network resources, notifies users of outages, and generates performance
	data for reporting. The TLS certificate validation in all Icinga
	2 versions starting from 2.4.0 was flawed, allowing an attacker to
	impersonate both trusted cluster nodes as well as any API users
	that use TLS client certificates for authentication (ApiUser objects
	with the client_cn attribute set). This vulnerability has been
	fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-49369</cvename>
 <url>https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3/</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-49369</url>
 </references>
 <dates>
 <discovery>2024-11-12</discovery>
 <entry>2024-11-12</entry>
 </dates>
 </vuln>

<vuln vid="33236f80-a11d-11ef-a964-1c697a616631">
 <topic>Intel CPUs -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cpu-microcode-intel</name>
	<range><lt>20241112</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Intel reports:
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01101.html">
	 
	 A potential security vulnerability in some 4th and 5th Generation
	 Intel Xeon Processors may allow denial of service. Intel released
	 microcode updates to mitigate this potential vulnerability.
	 
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01079.html">
	 
	 Potential security vulnerabilities in some Intel Xeon processors using
	 Intel Software Guard Extensions (Intel SGX) may allow escalation of
	 privilege. Intel released firmware updates to mitigate these
	 potential vulnerabilities.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-21853</cvename>
 <cvename>CVE-2024-23918</cvename>
 <cvename>CVE-2024-21820</cvename>
 <url>https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20241112</url>
 </references>
 <dates>
 <discovery>2024-09-10</discovery>
 <entry>2024-09-10</entry>
 </dates>
 </vuln>

<vuln vid="305ceb2c-9df8-11ef-a660-d85ed309193e">
 <topic>x11vnc -- access to shared memory segments</topic>
 <affects>
 <package>
	<name>x11vnc</name>
	<range><lt>0.9.16_8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2020-29074">
	 scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls,
	 which allows access by actors other than the current user.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2020-29074</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-29074</url>
 </references>
 <dates>
 <discovery>2020-11-18</discovery>
 <entry>2024-11-08</entry>
 </dates>
 </vuln>

<vuln vid="adffe51e-9df5-11ef-a660-d85ed309193e">
 <topic>lrzsz -- Integer overflow in zmodem, crash and information leak</topic>
 <affects>
 <package>
	<name>lrzsz</name>
	<range><lt>0.12.20_7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-10195">
	 Lrzsz has an integer overflow vulernability in the
	 src/zm.c:zsdata() function. An attacker could exploit this with
	 the sz command to cause a crash or potentially leak information
	 to the receiving server.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2018-10195</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2018-10195</url>
 </references>
 <dates>
 <discovery>2018-04-26</discovery>
 <entry>2024-11-08</entry>
 </dates>
 </vuln>

<vuln vid="776aaafc-939f-11ef-87ad-a8a15998b5cb">
 <topic>tnef -- An attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message</topic>
 <affects>
 <package>
	<name>tnef</name>
	<range><lt>1.4.18</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://github.com/verdammelt/tnef/compare/1.4.17...1.4.18">
	 In tnef before 1.4.18, an attacker may be able to write to the
	victim's .ssh/authorized_keys file via an e-mail message with
	a crafted winmail.dat application/ms-tnef attachment, because of a
	heap-based buffer over-read involving strdup.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2019-18849</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-18849</url>
 </references>
 <dates>
 <discovery>2019-11-11</discovery>
 <entry>2024-10-26</entry>
 </dates>
 </vuln>

<vuln vid="70cf37c8-939b-11ef-87ad-a8a15998b5cb">
 <topic>tnef -- Invalid read and write operations, controlled by an attacker</topic>
 <affects>
 <package>
	<name>tnef</name>
	<range><le>1.4.12</le></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="http://www.debian.org/security/2017/dsa-3798">
	 CVE-2017-6307: An issue was discovered in tnef before
	 1.4.13. Two OOB Writes have been identified in
	 src/mapi_attr.c:mapi_attr_read(). These might lead to
	 invalid read and write operations, controlled by an
	 attacker.
	</blockquote>
	<blockquote cite="http://www.debian.org/security/2017/dsa-3798">
	 CVE-2017-6308: An issue was discovered in tnef before
	 1.4.13. Several Integer Overflows, which can lead to Heap
	 Overflows, have been identified in the functions that wrap
	 memory allocation.
	</blockquote>
	<blockquote cite="http://www.debian.org/security/2017/dsa-3798">
	 CVE-2017-6309: An issue was discovered in tnef before
	 1.4.13. Two type confusions have been identified in the
	 parse_file() function. These might lead to invalid read and
	 write operations, controlled by an attacker.
	</blockquote>
	<blockquote cite="http://www.debian.org/security/2017/dsa-3798">
	 CVE-2017-6310: An issue was discovered in tnef before
	 1.4.13. Four type confusions have been identified in the
	 file_add_mapi_attrs() function. These might lead to invalid
	 read and write operations, controlled by an attacker.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2017-6307</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-6307</url>
 <cvename>CVE-2017-6308</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-6308</url>
 <cvename>CVE-2017-6309</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-6309</url>
 <cvename>CVE-2017-6310</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-6310</url>
 </references>
 <dates>
 <discovery>2017-02-24</discovery>
 <entry>2024-10-26</entry>
 </dates>
 </vuln>

<vuln vid="96266fc9-1200-43b5-8393-4c51f54bb7bc">
 <topic>electron32 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron32</name>
	<range><lt>32.2.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v32.2.3">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-10230.</li>
	 <li>Security: backported fix for CVE-2024-10231.</li>
	 <li>Security: backported fix for CVE-2024-10229.</li>
	 <li>Security: backported fix for CVE-2024-10487.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-10230</cvename>
 <url>https://github.com/advisories/GHSA-g4gj-m346-585c</url>
 <cvename>CVE-2024-10231</cvename>
 <url>https://github.com/advisories/GHSA-3wfx-mj93-vf8v</url>
 <cvename>CVE-2024-10229</cvename>
 <url>https://github.com/advisories/GHSA-3hjp-j522-245f</url>
 <cvename>CVE-2024-10487</cvename>
 <url>https://github.com/advisories/GHSA-h72p-7xmw-gpp8</url>
 </references>
 <dates>
 <discovery>2024-11-08</discovery>
 <entry>2024-11-08</entry>
 </dates>
 </vuln>

<vuln vid="d48a2224-9b4c-11ef-bdd9-4ccc6adda413">
 <topic>gstreamer1-rtsp-server -- Potential Denial-of-Service (DoS) with specially crafted client requests</topic>
 <affects>
 <package>
	<name>gstreamer1-rtsp-server</name>
	<range><ge>1.18.0</ge><lt>1.24.9</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Qingpeng Du reports:
	<blockquote cite="https://gstreamer.freedesktop.org/security/sa-2024-0004.html">
	 A series of specially crafted client requests during streaming setup
	 (post client authentication, if any) can cause the RTSP server library
	 to abort, if it has been compiled with assertions enabled.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-44331</cvename>
 <url>https://gstreamer.freedesktop.org/security/sa-2024-0004.html</url>
 </references>
 <dates>
 <discovery>2024-10-29</discovery>
 <entry>2024-11-07</entry>
 </dates>
 </vuln>

<vuln vid="ab254c9d-9c36-11ef-8c1c-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>130.0.6723.116</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>130.0.6723.116</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[370217726] High CVE-2024-10826: Use after free in Family Experiences. Reported by Anonymous on 2024-09-29</li>
	 <li>[375065084] High CVE-2024-10827: Use after free in Serial. Reported by Anonymous on 2024-10-23</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-10826</cvename>
 <cvename>CVE-2024-10827</cvename>
 <url>https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2024-11-05</discovery>
 <entry>2024-11-06</entry>
 </dates>
 </vuln>

<vuln vid="ecf9a798-9aa9-11ef-a8f0-a8a15998b5cb">
 <topic>libqb -- Buffer overflow</topic>
 <affects>
 <package>
	<name>libqb</name>
	<range><lt>2.0.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://github.com/ClusterLabs/libqb/commit/1bbaa929b77113532785c408dd1b41cd0521ffc8">
	 log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via
	long log messages because the header size is not considered.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-39976</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-39976</url>
 </references>
 <dates>
 <discovery>2023-08-08</discovery>
 <entry>2024-11-04</entry>
 </dates>
 </vuln>

<vuln vid="e17384ef-c5e8-4b5d-bb62-c13405e7f1f7">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>130.0.6723.91</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>130.0.6723.91</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_29.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[375123371] Critical CVE-2024-10487: Out of bounds write in Dawn. Reported by Apple Security Engineering and Architecture (SEAR) on 2024-10-23</li>
	 <li>[374310077] High CVE-2024-10488: Use after free in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2024-10-18</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-10487</cvename>
 <cvename>CVE-2024-10488</cvename>
 <url>https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_29.html</url>
 </references>
 <dates>
 <discovery>2024-10-29</discovery>
 <entry>2024-11-02</entry>
 </dates>
 </vuln>

<vuln vid="3092668e-97e4-11ef-bdd9-4ccc6adda413">
 <topic>qt5-webengine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>qt5-webengine</name>
	<range><lt>5.15.18p2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based">
	 Backports for 15 security bugs in Chromium:
	 <ul>
	 <li>CVE-2024-4761: Out of bounds write in V8</li>
	 <li>CVE-2024-5158: Type confusion in V8</li>
	 <li>CVE-2024-7532: Out of bounds memory access in ANGLE</li>
	 <li>CVE-2024-7965: Inappropriate implementation in V8</li>
	 <li>CVE-2024-7967: Heap buffer overflow in Fonts</li>
	 <li>CVE-2024-7971: Type confusion in V8</li>
	 <li>CVE-2024-8198: Heap buffer overflow in Skia</li>
	 <li>CVE-2024-8636: Heap buffer overflow in Skia</li>
	 <li>CVE-2024-9123: Integer overflow in Skia</li>
	 <li>CVE-2024-9602: Type confusion in V8</li>
	 <li>CVE-2024-9603: Type confusion in V8</li>
	 <li>CVE-2024-10229: Inappropriate implementation in Extensions</li>
	 <li>CVE-2024-45490: Negative length in libexpat</li>
	 <li>CVE-2024-45491: Integer overflow in libexpat</li>
	 <li>CVE-2024-45492: Integer overflow in libexpat</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-4761</cvename>
 <cvename>CVE-2024-5158</cvename>
 <cvename>CVE-2024-7532</cvename>
 <cvename>CVE-2024-7965</cvename>
 <cvename>CVE-2024-7967</cvename>
 <cvename>CVE-2024-7971</cvename>
 <cvename>CVE-2024-8198</cvename>
 <cvename>CVE-2024-8636</cvename>
 <cvename>CVE-2024-9123</cvename>
 <cvename>CVE-2024-9602</cvename>
 <cvename>CVE-2024-9603</cvename>
 <cvename>CVE-2024-10229</cvename>
 <cvename>CVE-2024-45490</cvename>
 <cvename>CVE-2024-45491</cvename>
 <cvename>CVE-2024-45492</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based</url>
 </references>
 <dates>
 <discovery>2024-09-18</discovery>
 <entry>2024-10-31</entry>
 </dates>
 </vuln>

<vuln vid="fd538d14-5778-4764-b321-2ddd61a8a58f">
 <topic>keycloak -- Missing server identity checks when sending mails via SMTPS</topic>
 <affects>
 <package>
	<name>keycloak</name>
	<range><lt>26.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Red Hat reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=2315808">
	 A vulnerability was found in Apache Sling Commons Messaging
	 Mail(angus-mail), which provides a simple interface for sending
	 emails via SMTPS in OSGi, does not offer an option to enable
	 server identity checks, leaving connections vulnerable to
	 "man-in-the-middle" attacks and can allow insecure email
	 communication.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44549</cvename>
 <url>https://www.cve.org/CVERecord?id=CVE-2021-44549</url>
 </references>
 <dates>
 <discovery>2024-10-01</discovery>
 <entry>2024-10-31</entry>
 </dates>
 </vuln>

<vuln vid="b73d1f2a-96de-11ef-9e71-00d8612f03c8">
 <topic>librewolf -- Undefined behavior in selection node cache</topic>
 <affects>
 <package>
	<name>librewolf</name>
	<range><lt>131.0.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1920381">
	 When manipulating the selection node cache, an attacker may have
	been able to cause unexpected behavior, potentially leading to an
	exploitable crash. This vulnerability affects Firefox &lt; 131.0.3.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-9936</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-9936</url>
 </references>
 <dates>
 <discovery>2024-10-14</discovery>
 <entry>2024-10-30</entry>
 </dates>
 </vuln>

<vuln vid="4b3a8e7d-9372-11ef-87ad-a8a15998b5cb">
 <topic>hwloc2 -- Denial of service or other unspecified impacts</topic>
 <affects>
 <package>
	<name>hwloc2</name>
	<range><ge>2.1.0</ge><le>2.9.2</le></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://github.com/open-mpi/hwloc/issues/544">
	 An issue was discovered in open-mpi hwloc 2.1.0 allows attackers
	to cause a denial of service or other unspecified impacts via
	glibc-cpuset in topology-linux.c.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2022-47022</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-47022</url>
 </references>
 <dates>
 <discovery>2023-08-22</discovery>
 <entry>2024-10-29</entry>
 </dates>
 </vuln>

<vuln vid="f07c8f87-8e65-11ef-81b8-659bf0027d16">
 <topic>forgejo -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>forgejo</name>
	<range><lt>9.0.1</lt></range>
 </package>
 <package>
	<name>forgejo7</name>
	<range><lt>7.0.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <h1>Problem Description:</h1>
 <ul>
 <li>Forgejo generates a token which is used to authenticate web
 endpoints that are only meant to be used internally, for instance
 when the SSH daemon is used to push a commit with Git. The
 verification of this token was not done in constant time and was
 susceptible to timing attacks. A pre-condition for such an attack is
 the precise measurements of the time for each operation. Since it
 requires observing the timing of network operations, the issue is
 mitigated when a Forgejo instance is accessed over the internet
 because the ISP introduce unpredictable random delays.</li>
 <li>Because of a missing permission check, the branch used to propose
 a pull request to a repository can always be deleted by the user
 performing the merge. It was fixed so that such a deletion is only
 allowed if the user performing the merge has write permission to the
 repository from which the pull request was made.</li>
 </ul>
 </body>
 </description>
 <references>
 <url>https://codeberg.org/forgejo/forgejo/milestone/8544</url>
 <url>https://codeberg.org/forgejo/forgejo/pulls/5719</url>
 <url>https://codeberg.org/forgejo/forgejo/pulls/5718</url>
 </references>
 <dates>
 <discovery>2024-10-28</discovery>
 <entry>2024-10-29</entry>
 </dates>
 </vuln>

<vuln vid="fafaef4d-f364-4a07-bbdd-bf53448c593c">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>130.0.6723.69</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>130.0.6723.69</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_22.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[371011220] High CVE-2024-10229: Inappropriate implementation in Extensions. Reported by Vsevolod Kokorin (Slonser) of Solidlab on 2024-10-02</li>
	 <li>[371565065] High CVE-2024-10230: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) on 2024-10-05</li>
	 <li>[372269618] High CVE-2024-10231: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) on 2024-10-09</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-10229</cvename>
 <cvename>CVE-2024-10230</cvename>
 <cvename>CVE-2024-10231</cvename>
 <url>https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_22.html</url>
 </references>
 <dates>
 <discovery>2024-10-22</discovery>
 <entry>2024-10-26</entry>
 </dates>
 </vuln>

<vuln vid="1e71e366-080b-4e8f-a9e6-150bf698186b">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>130.0.6723.58</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>130.0.6723.58</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html">
	 This update includes 17 security fixes:
	 <ul>
	 <li>[367755363] High CVE-2024-9954: Use after free in AI. Reported by DarkNavy on 2024-09-18</li>
	 <li>[370133761] Medium CVE-2024-9955: Use after free in Web Authentication. Reported by anonymous on 2024-09-29</li>
	 <li>[370482421] Medium CVE-2024-9956: Inappropriate implementation in Web Authentication. Reported by mastersplinter on 2024-09-30</li>
	 <li>[358151317] Medium CVE-2024-9957: Use after free in UI. Reported by lime(@limeSec_) and fmyy(@binary_fmyy) From TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-08-08</li>
	 <li>[40076120] Medium CVE-2024-9958: Inappropriate implementation in PictureInPicture. Reported by Lyra Rebane (rebane2001) on 2023-11-02</li>
	 <li>[368672129] Medium CVE-2024-9959: Use after free in DevTools. Reported by Sakana.S on 2024-09-21</li>
	 <li>[354748063] Medium CVE-2024-9960: Use after free in Dawn. Reported by Anonymous on 2024-07-23</li>
	 <li>[357776197] Medium CVE-2024-9961: Use after free in Parcel Tracking. Reported by lime(@limeSec_) and fmyy(@binary_fmyy) From TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-08-06</li>
	 <li>[364508693] Medium CVE-2024-9962: Inappropriate implementation in Permissions. Reported by Shaheen Fazim on 2024-09-04</li>
	 <li>[328278718] Medium CVE-2024-9963: Insufficient data validation in Downloads. Reported by Anonymous on 2024-03-06</li>
	 <li>[361711121] Low CVE-2024-9964: Inappropriate implementation in Payments. Reported by Hafiizh on 2024-08-23</li>
	 <li>[352651673] Low CVE-2024-9965: Insufficient data validation in DevTools. Reported by Shaheen Fazim on 2024-07-12</li>
	 <li>[364773822] Low CVE-2024-9966: Inappropriate implementation in Navigations. Reported by Harry Chen on 2024-09-05</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-9954</cvename>
 <cvename>CVE-2024-9955</cvename>
 <cvename>CVE-2024-9956</cvename>
 <cvename>CVE-2024-9957</cvename>
 <cvename>CVE-2024-9958</cvename>
 <cvename>CVE-2024-9959</cvename>
 <cvename>CVE-2024-9960</cvename>
 <cvename>CVE-2024-9961</cvename>
 <cvename>CVE-2024-9962</cvename>
 <cvename>CVE-2024-9963</cvename>
 <cvename>CVE-2024-9964</cvename>
 <cvename>CVE-2024-9965</cvename>
 <cvename>CVE-2024-9966</cvename>
 <url>https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html</url>
 </references>
 <dates>
 <discovery>2024-10-15</discovery>
 <entry>2024-10-26</entry>
 </dates>
 </vuln>

<vuln vid="3152a474-9390-11ef-87ad-a8a15998b5cb">
 <topic>halibut -- Segmentation fault, denial of service or possibly other unspecified impact via a crafted text document</topic>
 <affects>
 <package>
	<name>halibut</name>
	<range><eq>1.2</eq></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://carteryagemann.com/halibut-case-study.html#poc-halibut-text-uaf">
	 CVE-2021-42612: A use after free in cleanup_index in index.c in Halibut 1.2 allows
	an attacker to cause a segmentation fault or possibly have other
	unspecified impact via a crafted text document.
	</blockquote>
	<blockquote cite="https://carteryagemann.com/halibut-case-study.html#poc-halibut-winhelp-df">
	 CVE-2021-42613: A double free in cleanup_index in index.c in Halibut 1.2 allows an
	attacker to cause a denial of service or possibly have other
	unspecified impact via a crafted text document.
	</blockquote>
	<blockquote cite="https://carteryagemann.com/halibut-case-study.html#poc-halibut-info-uaf">
	 CVE-2021-42614: A use after free in info_width_internal in bk_info.c in Halibut 1.2
	allows an attacker to cause a segmentation fault or possibly have
	unspecified other impact via a crafted text document.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2021-42612</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-42612</url>
 <cvename>CVE-2021-42613</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-42613</url>
 <cvename>CVE-2021-42614</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-42614</url>
 </references>
 <dates>
 <discovery>2022-05-24</discovery>
 <entry>2024-10-26</entry>
 </dates>
 </vuln>

<vuln vid="fcb0e00f-d7d3-49b6-a4a1-852528230912">
 <topic>electron31 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron31</name>
	<range><lt>31.7.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v31.7.2">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-9121.</li>
	 <li>Security: backported fix for CVE-2024-9122.</li>
	 <li>Security: backported fix for CVE-2024-7025.</li>
	 <li>Security: backported fix for CVE-2024-9369.</li>
	 <li>Security: backported fix for CVE-2024-7965.</li>
	 <li>Security: backported fix for CVE-2024-7966.</li>
	 <li>Security: backported fix for CVE-2024-7967.</li>
	 <li>Security: backported fix for CVE-2024-8198.</li>
	 <li>Security: backported fix for CVE-2024-8193.</li>
	 <li>Security: backported fix for CVE-2024-7969.</li>
	 <li>Security: backported fix for CVE-2024-7970.</li>
	 <li>Security: backported fix for CVE-2024-8362.</li>
	 <li>Security: backported fix for CVE-2024-8636.</li>
	 <li>Security: backported fix for CVE-2024-9123.</li>
	 <li>Security: backported fix for CVE-2024-9120.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-9121</cvename>
 <url>https://github.com/advisories/GHSA-qcr8-x9j3-5j62</url>
 <cvename>CVE-2024-9122</cvename>
 <url>https://github.com/advisories/GHSA-4fw3-822r-pqw6</url>
 <cvename>CVE-2024-7025</cvename>
 <cvename>CVE-2024-9369</cvename>
 <cvename>CVE-2024-7965</cvename>
 <url>https://github.com/advisories/GHSA-x38q-hvmx-rwhg</url>
 <cvename>CVE-2024-7966</cvename>
 <url>https://github.com/advisories/GHSA-4pj3-wmgx-2h8r</url>
 <cvename>CVE-2024-7967</cvename>
 <url>https://github.com/advisories/GHSA-57cq-jgq2-x7vg</url>
 <cvename>CVE-2024-8198</cvename>
 <url>https://github.com/advisories/GHSA-76vg-grjj-w595</url>
 <cvename>CVE-2024-8193</cvename>
 <url>https://github.com/advisories/GHSA-5q6v-fp9h-6rjg</url>
 <cvename>CVE-2024-7969</cvename>
 <url>https://github.com/advisories/GHSA-p8h7-64p8-w5pq</url>
 <cvename>CVE-2024-7970</cvename>
 <url>https://github.com/advisories/GHSA-4c4w-77f9-v9mq</url>
 <cvename>CVE-2024-8362</cvename>
 <url>https://github.com/advisories/GHSA-rw7g-4966-p363</url>
 <cvename>CVE-2024-8636</cvename>
 <url>https://github.com/advisories/GHSA-r6cg-gw4p-5gmj</url>
 <cvename>CVE-2024-9123</cvename>
 <url>https://github.com/advisories/GHSA-xwv3-34j2-7jgx</url>
 <cvename>CVE-2024-9120</cvename>
 <url>https://github.com/advisories/GHSA-xh87-v57g-jhpw</url>
 </references>
 <dates>
 <discovery>2024-10-24</discovery>
 <entry>2024-10-24</entry>
 </dates>
 </vuln>

<vuln vid="78e6c113-91c1-11ef-a904-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.5.0</ge><lt>17.5.1</lt></range>
	<range><ge>17.4.0</ge><lt>17.4.3</lt></range>
	<range><ge>11.2.0</ge><lt>17.3.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/10/23/patch-release-gitlab-17-5-1-released/">
	 HTML injection in Global Search may lead to XSS
	 DoS via XML manifest file import
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-8312</cvename>
 <cvename>CVE-2024-6826</cvename>
 <url>https://about.gitlab.com/releases/2024/10/23/patch-release-gitlab-17-5-1-released/</url>
 </references>
 <dates>
 <discovery>2024-10-23</discovery>
 <entry>2024-10-24</entry>
 </dates>
 </vuln>

<vuln vid="cc068959-ce2b-42eb-81ed-055551fe0e51">
 <topic>electron32 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron32</name>
	<range><lt>32.2.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v32.2.2">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-7966.</li>
	 <li>Security: backported fix for CVE-2024-9370.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-7966</cvename>
 <url>https://github.com/advisories/GHSA-4pj3-wmgx-2h8r</url>
 <cvename>CVE-2024-9370</cvename>
 </references>
 <dates>
 <discovery>2024-10-23</discovery>
 <entry>2024-10-23</entry>
 </dates>
 </vuln>

<vuln vid="dbe8c5bd-8d3f-11ef-8d2e-a04a5edf46d9">
 <topic>oauth2-proxy -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>oauth2-proxy</name>
	<range><lt>7.7.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The oauth2-proxy project reports:
	<blockquote cite="https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.7.0">
	 Vulnerabilities have been addressed:
	 <ul>
	 <li>CVE-2024-24786</li>
	 <li>CVE-2024-24791</li>
	 <li>CVE-2024-24790</li>
	 <li>CVE-2024-24784</li>
	 <li>CVE-2024-28180</li>
	 <li>CVE-2023-45288</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-24786</cvename>
 <cvename>CVE-2024-24791</cvename>
 <cvename>CVE-2024-24790</cvename>
 <cvename>CVE-2024-24784</cvename>
 <cvename>CVE-2024-28180</cvename>
 <cvename>CVE-2024-45288</cvename>
 <url>https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.7.0</url>
 </references>
 <dates>
 <discovery>2024-10-02</discovery>
 <entry>2024-10-18</entry>
 </dates>
 </vuln>

<vuln vid="c6f4177c-8e29-11ef-98e7-84a93843eb75">
 <topic>OpenSSL -- OOB memory access vulnerability</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>3.0.15_1,1</lt></range>
 </package>
 <package>
	<name>openssl31</name>
	<range><lt>3.1.7_1</lt></range>
 </package>
 <package>
	<name>openssl32</name>
	<range><lt>3.2.3_1</lt></range>
 </package>
 <package>
	<name>openssl33</name>
	<range><lt>3.3.2_1</lt></range>
 </package>
 <package>
	<name>openssl-quictls</name>
	<range><lt>3.0.15_1,1</lt></range>
 </package>
 <package>
	<name>openssl31-quictls</name>
	<range><lt>3.1.7_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://openssl-library.org/news/secadv/20241016.txt">
	 Low-level invalid GF(2^m) parameters lead to OOB memory access
	 (CVE-2024-9143) (Low)
	 Use of the low-level GF(2^m) elliptic curve APIs with untrusted
	 explicit values for the field polynomial can lead to out-of-bounds
	 memory reads or writes.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-9143</cvename>
 <url>https://openssl-library.org/news/secadv/20241016.txt</url>
 </references>
 <dates>
 <discovery>2024-10-16</discovery>
 <entry>2024-10-19</entry>
 </dates>
 </vuln>

<vuln vid="815bf172-ab9e-4c4b-9662-d18b0054330d">
 <topic>electron{31,32} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron31</name>
	<range><lt>31.7.1</lt></range>
 </package>
 <package>
	<name>electron32</name>
	<range><lt>32.2.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v31.7.1">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-9602.</li>
	 <li>Security: backported fix for CVE-2024-9603.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-9602</cvename>
 <url>https://github.com/advisories/GHSA-4v8q-vp3v-vvxh</url>
 <cvename>CVE-2024-9603</cvename>
 <url>https://github.com/advisories/GHSA-92m3-m5pw-p2x9</url>
 </references>
 <dates>
 <discovery>2024-10-16</discovery>
 <entry>2024-10-18</entry>
 </dates>
 </vuln>

<vuln vid="851ce3e4-8b03-11ef-84e9-901b0e9408dc">
 <topic>element-web -- Potential exposure of access token via authenticated media</topic>
 <affects>
 <package>
	<name>element-web</name>
	<range><ge>1.11.70</ge><lt>1.11.81</lt>
	</range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Element team reports:
	<blockquote cite="https://github.com/element-hq/element-web/security/advisories/GHSA-3jm3-x98c-r34x">
	 Element Web versions 1.11.70 through 1.11.80 contain a
	 vulnerability which can, under specially crafted conditions,
	 lead to the access token becoming exposed to third
	 parties. At least one vector has been identified internally,
	 involving malicious widgets, but other vectors may
	 exist. Users are strongly advised to upgrade to version
	 1.11.81 to remediate the issue.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-47779</cvename>
 <url>https://github.com/element-hq/element-web/security/advisories/GHSA-3jm3-x98c-r34x</url>
 </references>
 <dates>
 <discovery>2024-10-15</discovery>
 <entry>2024-10-15</entry>
 </dates>
 </vuln>

<vuln vid="64e299b6-d12b-4a7a-a94f-ab133703925a">
 <topic>vscode -- Visual Studio Code for Linux Remote Code Execution Vulnerability</topic>
 <affects>
 <package>
	<name>vscode</name>
	<range><lt>1.94.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	VSCode developers report:
	<blockquote cite="https://github.com/microsoft/vscode/security/advisories/GHSA-g56j-w527-8x6f">
	 Visual Studio Code for Linux Remote Code Execution Vulnerability
	 A remote code execution vulnerability exists in VS Code 1.94.0 and earlier versions in the elevated save flow.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-43601</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-43601</url>
 <url>https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43601</url>
 </references>
 <dates>
 <discovery>2024-10-08</discovery>
 <entry>2024-10-11</entry>
 </dates>
 </vuln>

<vuln vid="2fb13238-872d-11ef-bd1e-b42e991fc52e">
 <topic>firefox -- use-after-free code execution</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>131.0.2,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.3.1,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1923344">
	 An attacker was able to achieve code execution in the
	content process by exploiting a use-after-free in Animation
	timelines. We have had reports of this vulnerability being
	exploited in the wild.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-9680</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-9680</url>
 </references>
 <dates>
 <discovery>2024-10-09</discovery>
 <entry>2024-10-10</entry>
 </dates>
 </vuln>

<vuln vid="cc1ac01e-86b0-11ef-9369-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.4.0</ge><lt>17.4.2</lt></range>
	<range><ge>17.3.0</ge><lt>17.3.5</lt></range>
	<range><ge>8.16</ge><lt>17.2.9</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/10/09/patch-release-gitlab-17-4-2-released/">
	 Run pipelines on arbitrary branches
	 An attacker can impersonate arbitrary user
	 SSRF in Analytics Dashboard
	 Viewing diffs of MR with conflicts can be slow
	 HTMLi in OAuth page
	 Deploy Keys can push changes to an archived repository
	 Guests can disclose project templates
	 GitLab instance version disclosed to unauthorized users
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-9164</cvename>
 <cvename>CVE-2024-8970</cvename>
 <cvename>CVE-2024-8977</cvename>
 <cvename>CVE-2024-9631</cvename>
 <cvename>CVE-2024-6530</cvename>
 <cvename>CVE-2024-9623</cvename>
 <cvename>CVE-2024-5005</cvename>
 <cvename>CVE-2024-9596</cvename>
 <url>https://about.gitlab.com/releases/2024/10/09/patch-release-gitlab-17-4-2-released/</url>
 </references>
 <dates>
 <discovery>2024-10-09</discovery>
 <entry>2024-10-10</entry>
 </dates>
 </vuln>

<vuln vid="79b1f4ee-860a-11ef-b2dc-cbccbf25b7ea">
 <topic>gitea -- token missing access control for packages</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.22.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <h1>Problem Description:</h1>
 <ul>
 <li>Fix bug when a token is given public only</li>
 </ul>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/pull/32204</url>
 </references>
 <dates>
 <discovery>2024-10-06</discovery>
 <entry>2024-10-09</entry>
 </dates>
 </vuln>

<vuln vid="8727b513-855b-11ef-9e50-6805ca2fa271">
 <topic>powerdns-recursor -- denial of service</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><lt>5.1.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://blog.powerdns.com/2024/10/03/powerdns-recursor-4-9-9-5-0-9-5-1-2-released">
	 PowerDNS Security Advisory 2024-04: Crafted responses can lead to
	 a denial of service due to cache inefficiencies in the Recursor
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-25590</cvename>
 <url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-04.html</url>
 </references>
 <dates>
 <discovery>2024-10-03</discovery>
 <entry>2024-10-09</entry>
 </dates>
 </vuln>

<vuln vid="7217f6e8-3ff4-4387-845d-d1744bb7f95e">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>129.0.6668.100</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>129.0.6668.100</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_8.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[368241697] High CVE-2024-9602: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) on 2024-09-20</li>
	 <li>[367818758] High CVE-2024-9603: Type Confusion in V8. Reported by @WeShotTheMoon and @Nguyen Hoang Thach of starlabs on 2024-09-18</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-9602</cvename>
 <cvename>CVE-2024-9603</cvename>
 <url>https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_8.html</url>
 </references>
 <dates>
 <discovery>2024-10-08</discovery>
 <entry>2024-10-09</entry>
 </dates>
 </vuln>

<vuln vid="83117378-f773-4617-bf74-477d569dcd74">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>129.0.6668.89</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>129.0.6668.89</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[367764861] High CVE-2024-7025: Integer overflow in Layout. Reported by Tashita Software Security on 2024-09-18</li>
	 <li>[368208152] High CVE-2024-9369: Insufficient data validation in Mojo. Reported by Xiantong Hou and Pisanbao of Wuheng Lab on 2024-09-19</li>
	 <li>[368311899] High CVE-2024-9370: Inappropriate implementation in V8. Reported by Nguyễn Hoàng Thạch, Đỗ Minh Tuấn, and Wu JinLin of STAR Labs SG Pte. Ltd. on 2024-09-19</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-7025</cvename>
 <cvename>CVE-2024-9369</cvename>
 <cvename>CVE-2024-9370</cvename>
 <url>https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2024-10-01</discovery>
 <entry>2024-10-09</entry>
 </dates>
 </vuln>

<vuln vid="2368755b-83f6-11ef-8d2e-a04a5edf46d9">
 <topic>Unbound -- Denial of service attack</topic>
 <affects>
 <package>
	<name>unbound</name>
	<range><lt>1.21.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	NLnet labs report:
	<blockquote cite="https://nlnetlabs.nl/news/2024/Oct/03/unbound-1.21.1-released/">
	 A vulnerability has been discovered in Unbound when handling
	 replies with very large RRsets that Unbound needs to perform name
	 compression for.
	 Malicious upstreams responses with very large RRsets can cause
	 Unbound to spend a considerable time applying name compression to
	 downstream replies. This can lead to degraded performance and
	 eventually denial of service in well orchestrated attacks.
	 Unbound version 1.21.1 introduces a hard limit on the number of
	 name compression calculations it is willing to do per packet.
	 Packets that need more compression will result in semi-compressed
	 packets or truncated packets, even on TCP for huge messages, to
	 avoid locking the CPU for long.
	 This change should not affect normal DNS traffic.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-8508</cvename>
 <url>https://nlnetlabs.nl/news/2024/Oct/03/unbound-1.21.1-released/</url>
 </references>
 <dates>
 <discovery>2024-10-03</discovery>
 <entry>2024-10-06</entry>
 </dates>
 </vuln>

<vuln vid="fe7031d3-3000-4b43-9fa6-52c2b624b8f9">
 <topic>zeek -- potential DoS vulnerability</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>7.0.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v7.0.3">
	 Adding to the POP3 hardening in 7.0.2, the parser now
	 simply discards too many pending commands, rather than
	 any attempting to process them. Further, invalid server
	 responses do not result in command completion anymore.
	 Processing out-of-order commands or finishing commands
	 based on invalid server responses could result in
	 inconsistent analyzer state, potentially triggering null
	 pointer references for crafted traffic. 
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v7.0.3</url>
 </references>
 <dates>
 <discovery>2024-10-05</discovery>
 <entry>2024-10-05</entry>
 </dates>
 </vuln>

<vuln vid="0417d41a-8175-11ef-a5dc-b42e991fc52e">
 <topic>firefox -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>131.0,2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>128.3.0,1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>128.3.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1913445%2C1914106%2C1914475%2C1914963%2C1915008%2C1916476">
	<ul>
	<li>CVE-2024-9392: A compromised content process could have
	allowed for the arbitrary loading of cross-origin pages.</li>
	<li>CVE-2024-9396: It is currently unknown if this issue is
	exploitable but a condition may arise where the structured
	clone of certain objects could lead to memory corruption.</li>
	<li>CVE-2024-9400: A potential memory corruption vulnerability
	could be triggered if an attacker had the ability to trigger
	an OOM at a specific moment during JIT compilation.</li>
	<li>CVE-2024-9401: Memory safety bugs present in Firefox 130,
	Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2.
	Some of these bugs showed evidence of memory corruption and we
	presume that with enough effort some of these could have been
	exploited to run arbitrary code.</li>
	<li>CVE-2024-9402: Memory safety bugs present in Firefox 130,
	Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs
	showed evidence of memory corruption and we presume that with
	enough effort some of these could have been exploited to run
	arbitrary code.</li>
	<li>CVE-2024-9403: Memory safety bugs present in Firefox 130.
	Some of these bugs showed evidence of memory corruption and we
	presume that with enough effort some of these could have been
	exploited to run arbitrary code.</li>
	</ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-9392</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-9392</url>
 <cvename>CVE-2024-9396</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-9396</url>
 <cvename>CVE-2024-9400</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-9400</url>
 <cvename>CVE-2024-9401</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-9401</url>
 <cvename>CVE-2024-9402</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-9402</url>
 <cvename>CVE-2024-9403</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-9403</url>
 </references>
 <dates>
 <discovery>2024-10-01</discovery>
 <entry>2024-10-03</entry>
 </dates>
 </vuln>

<vuln vid="3c6f8270-3210-4e2f-ba72-a9cdca7417a0">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.479</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.462.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2024-10-02/">
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-3451 / CVE-2024-47803</h5>
	 Exposure of multi-line secrets through error messages in Jenkins
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-3448 / CVE-2024-47804</h5>
	 Item creation restriction bypass vulnerability in Jenkins
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-47803</cvename>
 <cvename>CVE-2024-47804</cvename>
 <url>https://www.jenkins.io/security/advisory/2024-10-02/</url>
 </references>
 <dates>
 <discovery>2024-10-02</discovery>
 <entry>2024-10-03</entry>
 </dates>
 </vuln>

<vuln vid="8b20f21a-8113-11ef-b988-08002784c58d">
 <topic>redis,valkey -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><ge>7.4.0</ge><lt>7.4.1</lt></range>
	<range><ge>7.2.0</ge><lt>7.2.6</lt></range>
 </package>
 <package>
	<name>redis72</name>
	<range><ge>7.2.0</ge><lt>7.2.6</lt></range>
 </package>
 <package>
	<name>redis62</name>
	<range><ge>6.2.0</ge><lt>6.2.16</lt></range>
 </package>
 <package>
	<name>valkey</name>
	<range><ge>8,0,0</ge><lt>8.0.1</lt></range>
	<range><ge>7.2.0</ge><lt>7.2.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Redis core team reports:
	<blockquote cite="https://github.com/redis/redis/releases/tag/7.4.1">
	 <dl>
	 <dt>CVE-2024-31449</dt>
	 <dd>Lua library commands may lead to stack overflow and potential RCE.</dd>
	 <dt>CVE-2024-31227</dt>
	 <dd>Potential Denial-of-service due to malformed ACL selectors.</dd>
	 <dt>CVE-2024-31228</dt>
	 <dd>Potential Denial-of-service due to unbounded pattern matching.</dd>
	 </dl>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-31449</cvename>
 <cvename>CVE-2024-31227</cvename>
 <cvename>CVE-2024-31228</cvename>
 <url>https://github.com/redis/redis/releases/tag/7.4.1</url>
 </references>
 <dates>
 <discovery>2024-10-02</discovery>
 <entry>2024-10-02</entry>
 </dates>
 </vuln>

<vuln vid="fe5c1e7a-7eed-11ef-9533-f875a43e1796">
 <topic>php -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	 <name>php81</name>
	 <range><lt>8.1.30</lt></range>
 </package>
 <package>
	 <name>php82</name>
	 <range><lt>8.2.24</lt></range>
 </package>
 <package>
	 <name>php83</name>
	 <range><lt>8.3.12</lt></range>
 </package>
 </affects>
 <description>
	 <body xmlns="http://www.w3.org/1999/xhtml">
	 php.net reports:
	 <blockquote cite="https://www.php.net/ChangeLog-8.php">
					<ul>
						<li>CVE-2024-8926: CGI: Fixed bug GHSA-9pqp-7h25-4f32 (Bypass of CVE-2024-4577, Parameter Injection Vulnerability).</li>
						<li>CVE-2024-8927: CGI: Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision).</li>
						<li>CVE-2024-9026: FPM: Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered).</li>
						<li>CVE-2024-8925: SAPI: Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data).</li>
					</ul>
	 </blockquote>
	 </body>
 </description>
 <references>
 <cvename>CVE-2024-8926</cvename>
 <cvename>CVE-2024-8927</cvename>
 <cvename>CVE-2024-9026</cvename>
 <cvename>CVE-2024-8925</cvename>
 <url>https://www.php.net/ChangeLog-8.php</url>
 </references>
 <dates>
 <discovery>2024-09-26</discovery>
 <entry>2024-09-30</entry>
 </dates>
 </vuln>

<vuln vid="f9cfdb00-7f43-11ef-9b27-592d55dd336d">
 <topic>Slixmpp -- Lack of SSL Certificate hostname validation in XMLStream</topic>
 <affects>
 <package>
	<name>py38-slixmpp</name>
	<name>py39-slixmpp</name>
	<name>py310-slixmpp</name>
	<name>py311-slixmpp</name>
	<range><lt>1.8.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	NIST reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2022-45197">
	 Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream,
	allowing an attacker to pose as any server in the eyes of Slixmpp.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2022-45197</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-45197</url>
 </references>
 <dates>
 <discovery>2022-12-25</discovery>
 <entry>2024-09-30</entry>
 </dates>
 </vuln>

<vuln vid="2f82696c-adad-447b-9938-c99441805fa3">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>129.0.6668.70</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>129.0.6668.70</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_24.html">
	 This update includes 5 security fixes:
	 <ul>
	 <li>[365254285] High CVE-2024-9120: Use after free in Dawn. Reported by Anonymous on 2024-09-08</li>
	 <li>[363538434] High CVE-2024-9121: Inappropriate implementation in V8. Reported by Tashita Software Security on 2024-09-01</li>
	 <li>[365802567] High CVE-2024-9122: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) on 2024-09-10</li>
	 <li>[365884464] High CVE-2024-9123: Integer overflow in Skia. Reported by raven at KunLun lab on 2024-09-11</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-9120</cvename>
 <cvename>CVE-2024-9121</cvename>
 <cvename>CVE-2024-9122</cvename>
 <cvename>CVE-2024-9123</cvename>
 <url>https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_24.html</url>
 </references>
 <dates>
 <discovery>2024-09-24</discovery>
 <entry>2024-09-30</entry>
 </dates>
 </vuln>

<vuln vid="42ec2207-7e85-11ef-89a4-b42e991fc52e">
 <topic>sqlite -- use-after-free bug in jsonparseaddnodearray</topic>
 <affects>
 <package>
	<name>sqlite3</name>
	<range><ge>3.43.0,1</ge><lt>3.43.2,1</lt></range>
 </package>
 <package>
	<name>linux-rl9-sqlite</name>
	<range><ge>3.43.0,1</ge><lt>3.43.2,1</lt></range>
 </package>
 <package>
	<name>linux-c7-sqlite</name>
	<range><ge>3.43.0,1</ge><lt>3.43.2,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	secalert@redhat.com reports:
	<blockquote cite="https://access.redhat.com/security/cve/CVE-2024-0232">
	 A heap use-after-free issue has been identified in SQLite in the
	jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a
	local attacker to leverage a victim to pass specially crafted
	malicious input to the application, potentially causing a crash and
	leading to a denial of service.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-0232</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-0232</url>
 </references>
 <dates>
 <discovery>2024-01-16</discovery>
 <entry>2024-09-29</entry>
 <modified>2025-08-01</modified>
 </dates>
 </vuln>

<vuln vid="24375796-7cbc-11ef-a3a9-001cc0382b2f">
 <topic>cups-filters -- remote code execution</topic>
 <affects>
 <package>
	<name>cups-filters</name>
	<range><lt>1.28.17_6</lt></range>
 </package>
 <package>
	<name>cups</name>
	<range><lt>2.4.11</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	OpenPrinting reports:
	<blockquote cite="https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8">
	 Due to the service binding to *:631 ( INADDR_ANY ), multiple bugs
	 in cups-browsed can be exploited in sequence to introduce a
	 malicious printer to the system. This chain of exploits ultimately
	 enables an attacker to execute arbitrary commands remotely on the
	 target machine without authentication when a print job is started.
	 Posing a significant security risk over the network. Notably, this
	 vulnerability is particularly concerning as it can be exploited
	 from the public internet, potentially exposing a vast number of
	 systems to remote attacks if their CUPS services are enabled.
	</blockquote>
	The vulnerability allows an attacker on the internet to create a
	 new printer device with arbitrary commands in the PPD file of the
	 printer. Attacks using mDNS on the local network can also replace an
	 existing printer. The commands are executed when a user attempts to
	 print on the malicious device. They run with the privileges of the
	 user "cups".
	It is recommended to disable the cups_browsed service until patches
	 become available. On FreeBSD this is the default. You can check the
	 status and disable the service with the following commands:
	<code># service cups_browsed status 
	 # service cups_browsed stop 
	 # service cups_browsed disable</code>
	If you choose to leave the service enabled, attacks from the
	 internet can be blocked by removing the "cups" protocol from the
	 BrowseRemoteProtocols and BrowseProtocols directives in
	 /usr/local/etc/cups/cups-browsed.conf. Attacks using mDNS can be
	 blocked by removing the "dnssd" protocol as well. Access can be
	 limited to specific IP addresses using BrowseAllow, BrowseDeny, and
	 BrowseOrder directives as documented in cups-browsed.conf(5). Then
	 restart the service with the following command:
	<code># service cups_browsed restart</code>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-47076</cvename>
 <cvename>CVE-2024-47175</cvename>
 <cvename>CVE-2024-47176</cvename>
 <url>https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8</url>
 </references>
 <dates>
 <discovery>2024-09-26</discovery>
 <entry>2024-09-27</entry>
 <modified>2024-10-02</modified>
 </dates>
 </vuln>

<vuln vid="ca5f3bbc-7a62-11ef-9533-f875a43e1796">
 <topic>expat -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>expat</name>
	<range><lt>2.6.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	libexpat reports:
	<blockquote cite="https://github.com/libexpat/libexpat/blob/master/expat/Changes">
	<ul>
	<li>CVE-2024-45490: Calling function XML_ParseBuffer with
	len &lt; 0 without noticing and then calling XML_GetBuffer
	will have XML_ParseBuffer fail to recognize the problem
	and XML_GetBuffer corrupt memory.
	With the fix, XML_ParseBuffer now complains with error
	XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
	has been doing since Expat 2.2.1, and now documented.
	Impact is denial of service to potentially artitrary code
	execution.</li>
	<li>CVE-2024-45491: Internal function dtdCopy can have an
	integer overflow for nDefaultAtts on 32-bit platforms
	(where UINT_MAX equals SIZE_MAX).
	Impact is denial of service to potentially artitrary code
	execution.</li>
	<li>CVE-2024-45492: Internal function nextScaffoldPart can
	have an integer overflow for m_groupSize on 32-bit
	platforms (where UINT_MAX equals SIZE_MAX).
	Impact is denial of service to potentially artitrary code
	execution.</li>
	</ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-45490</cvename>
 <cvename>CVE-2024-45491</cvename>
 <cvename>CVE-2024-45492</cvename>
 <url>https://github.com/libexpat/libexpat/blob/master/expat/Changes</url>
 </references>
 <dates>
 <discovery>2024-09-24</discovery>
 <entry>2024-09-24</entry>
 </dates>
 </vuln>

<vuln vid="4b7ed61f-7bbf-11ef-9369-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.4.0</ge><lt>17.4.1</lt></range>
	<range><ge>17.3.0</ge><lt>17.3.4</lt></range>
	<range><ge>15.6.0</ge><lt>17.2.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/09/25/patch-release-gitlab-17-4-1-released/">
	 Maintainer can leak Dependency Proxy password by changing Dependency Proxy URL via crafted POST request
	 AI feature reads unsanitized content, allowing for attacker to hide prompt injection
	 Project reference can be exposed in system notes
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-4278</cvename>
 <cvename>CVE-2024-4099</cvename>
 <cvename>CVE-2024-8974</cvename>
 <url>https://about.gitlab.com/releases/2024/09/25/patch-release-gitlab-17-4-1-released/</url>
 </references>
 <dates>
 <discovery>2024-09-25</discovery>
 <entry>2024-09-26</entry>
 </dates>
 </vuln>

<vuln vid="802961eb-7a89-11ef-bdd7-a0423f48a938">
 <topic>frr - BGP</topic>
 <affects>
 <package>
	<name>frr9</name>
	<range><lt>9.1.2</lt></range>
 </package>
 <package>
	<name>frr8</name>
	<range><lt>8.5.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://github.com/FRRouting/frr/pull/16497">
	 An issue was discovered in FRRouting (FRR). bgp_attr_encap
	in bgpd/bgp_attr.c does not check the actual remaining stream length
	before taking the TLV value.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-44070</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-44070</url>
 </references>
 <dates>
 <discovery>2024-08-19</discovery>
 <entry>2024-09-24</entry>
 </dates>
 </vuln>

<vuln vid="d47b7ae7-fe1d-4f7f-919a-480ca8035f00">
 <topic>zeek -- potential DoS vulnerability</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>7.0.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v7.0.2">
	 The POP3 parser has been hardened to avoid unbounded
	 state growth in the face of one-sided traffic capture or
	 when enabled for non-POP3 traffic. 
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v7.0.2</url>
 </references>
 <dates>
 <discovery>2024-09-24</discovery>
 <entry>2024-09-24</entry>
 </dates>
 </vuln>

<vuln vid="c02b8db5-771b-11ef-9a62-002590c1f29c">
 <topic>FreeBSD -- NFS client accepts file names containing path separators</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.1</ge><lt>14.1_3</lt></range>
	<range><ge>14.0</ge><lt>14.0_9</lt></range>
	<range><ge>13.3</ge><lt>13.3_5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When mounting a remote filesystem using NFS, the kernel did not
	sanitize remotely provided filenames for the path separator character,
	"/". This allows readdir(3) and related functions to return
	filesystem entries with names containing additional path components.
	<h1>Impact:</h1>
	The lack of validation described above gives rise to a confused
	deputy problem. For example, a program copying files from an NFS
	mount could be tricked into copying from outside the intended source
	directory, and/or to a location outside the intended destination
	directory.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-6759</cvename>
 <freebsdsa>SA-24:07.nfsclient</freebsdsa>
 </references>
 <dates>
 <discovery>2024-08-07</discovery>
 <entry>2024-09-20</entry>
 </dates>
 </vuln>

<vuln vid="8fb61d94-771b-11ef-9a62-002590c1f29c">
 <topic>FreeBSD -- ktrace(2) fails to detach when executing a setuid binary</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.1</ge><lt>14.1_3</lt></range>
	<range><ge>14.0</ge><lt>14.0_9</lt></range>
	<range><ge>13.3</ge><lt>13.3_5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A logic bug in the code which disables kernel tracing for setuid
	programs meant that tracing was not disabled when it should have,
	allowing unprivileged users to trace and inspect the behavior of
	setuid programs.
	<h1>Impact:</h1>
	The bug may be used by an unprivileged user to read the contents
	of files to which they would not otherwise have access, such as the
	local password database.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-6760</cvename>
 <freebsdsa>SA-24:06.ktrace</freebsdsa>
 </references>
 <dates>
 <discovery>2024-08-07</discovery>
 <entry>2024-09-20</entry>
 </dates>
 </vuln>

<vuln vid="f140cff0-771a-11ef-9a62-002590c1f29c">
 <topic>FreeBSD -- pf incorrectly matches different ICMPv6 states in the state table</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.1</ge><lt>14.1_3</lt></range>
	<range><ge>14.0</ge><lt>14.0_9</lt></range>
	<range><ge>13.3</ge><lt>13.3_5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	In ICMPv6 Neighbor Discovery (ND), the ID is always 0. When
	pf is configured to allow ND and block incoming Echo Requests, a
	crafted Echo Request packet after a Neighbor Solicitation (NS) can
	trigger an Echo Reply. The packet has to come from the same host
	as the NS and have a zero as identifier to match the state created
	by the Neighbor Discovery and allow replies to be generated.
	<h1>Impact:</h1>
	ICMPv6 packets with identifier value of zero bypass firewall
	rules written on the assumption that the incoming packets are going
	to create a state in the state table.
	<h1>Note:</h1>
	This advisory introduced additional issues that were addressed by
	FreeBSD-EN-24:16.pf. Please refer to that erratum for additional
	fixes.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-6640</cvename>
 <freebsdsa>SA-24:05.pf</freebsdsa>
 <url>https://www.freebsd.org/security/advisories/FreeBSD-EN-24:16.pf.asc</url>
 </references>
 <dates>
 <discovery>2024-08-07</discovery>
 <entry>2024-09-20</entry>
 </dates>
 </vuln>

<vuln vid="93c12fe5-7716-11ef-9a62-002590c1f29c">
 <topic>FreeBSD -- Integer overflow in libnv</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.1</ge><lt>14.1_5</lt></range>
	<range><ge>14.0</ge><lt>14.0_11</lt></range>
	<range><ge>13.4</ge><lt>13.4_1</lt></range>
	<range><ge>13.3</ge><lt>13.3_7</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.1</ge><lt>14.1_5</lt></range>
	<range><ge>14.0</ge><lt>14.0_11</lt></range>
	<range><ge>13.4</ge><lt>13.4_1</lt></range>
	<range><ge>13.3</ge><lt>13.3_7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A malicious value of size in a structure of packed libnv can
	cause an integer overflow, leading to the allocation of a smaller
	buffer than required for the parsed data. The introduced check was
	incorrect, as it took into account the size of the pointer, not the
	structure. This vulnerability affects both kernel and userland.
	This issue was originally intended to be addressed as part of
	FreeBSD-SA-24:09.libnv, but due to a logic issue, this issue was
	not properly addressed.
	<h1>Impact:</h1>
	It is possible for an attacker to overwrite portions of memory
	(in userland or the kernel) as the allocated buffer might be smaller
	than the data received from a malicious process. This vulnerability
	could result in privilege escalation or cause a system panic.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-45287</cvename>
 <freebsdsa>SA-24:16.libnv</freebsdsa>
 </references>
 <dates>
 <discovery>2024-09-19</discovery>
 <entry>2024-09-20</entry>
 </dates>
 </vuln>

<vuln vid="1febd09b-7716-11ef-9a62-002590c1f29c">
 <topic>FreeBSD -- bhyve(8) out-of-bounds read access via XHCI emulation</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.1</ge><lt>14.1_5</lt></range>
	<range><ge>14.0</ge><lt>14.0_11</lt></range>
	<range><ge>13.4</ge><lt>13.4_1</lt></range>
	<range><ge>13.3</ge><lt>13.3_7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	bhyve can be configured to emulate devices on a virtual USB
	controller (XHCI), such as USB tablet devices. An insufficient
	boundary validation in the USB code could lead to an out-of-bounds read
	on the heap, which could potentially lead to an arbitrary write and
	remote code execution.
	<h1>Impact:</h1>
	A malicious, privileged software running in a guest VM can exploit
	the vulnerability to crash the hypervisor process or potentially achieve
	code execution on the host in the bhyve userspace process, which
	typically runs as root. Note that bhyve runs in a Capsicum sandbox, so
	malicious code is constrained by the capabilities available to the bhyve
	process.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-41721</cvename>
 <freebsdsa>SA-24:15.bhyve</freebsdsa>
 </references>
 <dates>
 <discovery>2024-09-19</discovery>
 <entry>2024-09-20</entry>
 </dates>
 </vuln>

<vuln vid="3e738678-7582-11ef-bece-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.3.0</ge><lt>17.3.3</lt></range>
	<range><ge>17.2.0</ge><lt>17.2.7</lt></range>
	<range><ge>0</ge><lt>17.1.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/09/17/patch-release-gitlab-17-3-3-released/">
	 SAML authentication bypass
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-45409</cvename>
 <url>https://about.gitlab.com/releases/2024/09/17/patch-release-gitlab-17-3-3-released/</url>
 </references>
 <dates>
 <discovery>2024-09-17</discovery>
 <entry>2024-09-18</entry>
 </dates>
 </vuln>

<vuln vid="58750d49-7302-11ef-8c95-195d300202b3">
 <topic>OpenSSH -- Pre-authentication async signal safety issue</topic>
 <affects>
 <package>
	<name>openssh-portable</name>
	<range><lt>9.8.p1_1,1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.1</ge><lt>14.1_3</lt></range>
	<range><ge>14.0</ge><lt>14.0_9</lt></range>
	<range><ge>13.3</ge><lt>13.3_5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The FreeBSD Project reports:
	<blockquote cite="https://www.freebsd.org/security/advisories/FreeBSD-SA-24:08.openssh.asc">
	 
	 A signal handler in sshd(8) may call a logging function that is not async-
	 signal-safe. The signal handler is invoked when a client does not
	 authenticate within the LoginGraceTime seconds (120 by default).
	 This signal handler executes in the context of the sshd(8)'s privileged
	 code, which is not sandboxed and runs with full root privileges.
	 This issue is another instance of the problem in CVE-2024-6387 addressed by
	 FreeBSD-SA-24:04.openssh. The faulty code in this case is from the
	 integration of blacklistd in OpenSSH in FreeBSD.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-7589</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-7589</url>
 <freebsdsa>SA-24:08.openssh</freebsdsa>
 </references>
 <dates>
 <discovery>2024-08-06</discovery>
 <entry>2024-09-15</entry>
 <modified>2024-09-20</modified>
 </dates>
 </vuln>

<vuln vid="bd940aba-7467-11ef-a5c4-08002784c58d">
 <topic>SnappyMail -- multiple mXSS in HTML sanitizer</topic>
 <affects>
 <package>
	<name>snappymail-php81</name>
	<name>snappymail-php82</name>
	<name>snappymail-php83</name>
	<name>snappymail-php84</name>
	<range><lt>2.38.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Oskar reports:
	<blockquote cite="https://github.com/the-djmaze/snappymail/security/advisories/GHSA-2rq7-79vp-ffxm">
	 
	 SnappyMail uses the `cleanHtml()` function to cleanup HTML
	 and CSS in emails. Research discovered that the function
	 has a few bugs which cause an mXSS exploit. Because the
	 function allowed too many (invalid) HTML elements, it was
	 possible (with incorrect markup) to trick the browser to
	 "fix" the broken markup into valid markup. As a result a
	 motivated attacker may be able to inject javascript.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-45800</cvename>
 <url>https://github.com/the-djmaze/snappymail/security/advisories/GHSA-2rq7-79vp-ffxm</url>
 </references>
 <dates>
 <discovery>2024-09-16</discovery>
 <entry>2024-09-16</entry>
 </dates>
 </vuln>

<vuln vid="e464f777-719e-11ef-8a0f-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>128.0.6613.137</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>128.0.6613.137</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[361461526] High CVE-2024-8636: Heap buffer overflow in Skia. Reported by Renan Rios (@hyhy_100) on 2024-08-22</li>
	 <li>[361784548] High CVE-2024-8637: Use after free in Media Router. Reported by lime(@limeSec_) from TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-08-23</li>
	 <li>[362539773] High CVE-2024-8638: Type Confusion in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2024-08-28</li>
	 <li>[362658609] High CVE-2024-8639: Use after free in Autofill. Reported by lime(@limeSec_) from TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-08-28</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-8636</cvename>
 <cvename>CVE-2024-8637</cvename>
 <cvename>CVE-2024-8638</cvename>
 <cvename>CVE-2024-8639</cvename>
 <url>https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html</url>
 </references>
 <dates>
 <discovery>2024-09-10</discovery>
 <entry>2024-09-13</entry>
 </dates>
 </vuln>

<vuln vid="bcc8b21e-7122-11ef-bece-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.3.0</ge><lt>17.3.2</lt></range>
	<range><ge>17.2.0</ge><lt>17.2.5</lt></range>
	<range><ge>8.14.0</ge><lt>17.1.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/">
	 Execute environment stop actions as the owner of the stop action job
	 Prevent code injection in Product Analytics funnels YAML
	 SSRF via Dependency Proxy
	 Denial of Service via sending a large glm_source parameter
	 CI_JOB_TOKEN can be used to obtain GitLab session token
	 Variables from settings are not overwritten by PEP if a template is included
	 Guests can disclose the full source code of projects using custom group-level templates
	 IdentitiesController allows linking of arbitrary unclaimed provider identities
	 Open redirect in repo/tree/:id endpoint can lead to account takeover through broken OAuth flow
	 Open redirect in release permanent links can lead to account takeover through broken OAuth flow
	 Guest user with Admin group member permission can edit custom role to gain other permissions
	 Exposure of protected and masked CI/CD variables by abusing on-demand DAST
	 Credentials disclosed when repository mirroring fails
	 Commit information visible through release atom endpoint for guest users
	 Dependency Proxy Credentials are Logged in Plaintext in graphql Logs
	 User Application can spoof the redirect url
	 Group Developers can view group runners information
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-6678</cvename>
 <cvename>CVE-2024-8640</cvename>
 <cvename>CVE-2024-8635</cvename>
 <cvename>CVE-2024-8124</cvename>
 <cvename>CVE-2024-8641</cvename>
 <cvename>CVE-2024-8311</cvename>
 <cvename>CVE-2024-4660</cvename>
 <cvename>CVE-2024-4283</cvename>
 <cvename>CVE-2024-4612</cvename>
 <cvename>CVE-2024-8631</cvename>
 <cvename>CVE-2024-2743</cvename>
 <cvename>CVE-2024-5435</cvename>
 <cvename>CVE-2024-6389</cvename>
 <cvename>CVE-2024-4472</cvename>
 <cvename>CVE-2024-6446</cvename>
 <cvename>CVE-2024-6685</cvename>
 <url>https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/</url>
 </references>
 <dates>
 <discovery>2024-09-11</discovery>
 <entry>2024-09-12</entry>
 </dates>
 </vuln>

<vuln vid="d5026193-6fa2-11ef-99bc-1c697a616631">
 <topic>Intel CPUs -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cpu-microcode-intel</name>
	<range><lt>20241112</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Intel reports:
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01103.html">
	 
	 A potential security vulnerability in the Running Average Power Limit
	 (RAPL) interface for some Intel Processors may allow information
	 disclosure. Intel has released firmware updates to mitigate this
	 potential vulnerability.
	 
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01097.html">
	 
	 A potential security vulnerability in some Intel Processors may allow
	 denial of service. Intel has released firmware updates to mitigate
	 this potential vulnerability.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-23984</cvename>
 <cvename>CVE-2024-24968</cvename>
 <url>https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20240910</url>
 </references>
 <dates>
 <discovery>2024-09-10</discovery>
 <entry>2024-09-10</entry>
 <modified>2024-11-12</modified>
 </dates>
 </vuln>

<vuln vid="996518f3-6ef9-11ef-b01b-08002784c58d">
 <topic>clamav -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><ge>1.3.0,1</ge><lt>1.3.2,1</lt></range>
	<range><ge>1.4.0,1</ge><lt>1.4.1,1</lt></range>
 </package>
 <package>
	<name>clamav-lts</name>
	<range><ge>1.0.0,1</ge><lt>1.0.6,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The ClamAV project reports:
	<blockquote cite="https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html">
	 <dl>
	 <dt>CVE-2024-20505</dt>
	 <dd>
	 A vulnerability in the PDF parsing module of Clam
	 AntiVirus (ClamAV) could allow an unauthenticated,
	 remote attacker to cause a denial of service (DoS)
	 condition on an affected device. The vulnerability is
	 due to an out of bounds read. An attacker could exploit
	 this vulnerability by submitting a crafted PDF file to
	 be scanned by ClamAV on an affected device. An exploit
	 could allow the attacker to terminate the scanning
	 process.
	 </dd>
	 <dt>CVE-2024-20506</dt>
	 <dd>
	 A vulnerability in the ClamD service module of Clam
	 AntiVirus (ClamAV) could allow an authenticated, local
	 attacker to corrupt critical system files. The
	 vulnerability is due to allowing the ClamD process to
	 write to its log file while privileged without checking
	 if the logfile has been replaced with a symbolic
	 link. An attacker could exploit this vulnerability if
	 they replace the ClamD log file with a symlink to a
	 critical system file and then find a way to restart the
	 ClamD process. An exploit could allow the attacker to
	 corrupt a critical system file by appending ClamD log
	 messages after restart.
	 </dd>
	 </dl>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-20505</cvename>
 <cvename>CVE-2024-20506</cvename>
 <url>https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html</url>
 </references>
 <dates>
 <discovery>2024-09-04</discovery>
 <entry>2024-09-09</entry>
 </dates>
 </vuln>

<vuln vid="8fbe81f7-6eb5-11ef-b7bd-00505632d232">
 <topic>netatalk3 -- multiple WolfSSL vulnerabilities</topic>
 <affects>
 <package>
	<name>netatalk3</name>
	<range><lt>3.2.8,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Netatalk release reports:
	<blockquote cite="https://github.com/Netatalk/netatalk/releases/tag/netatalk-3-2-8">
	 WolfSSL 5.7.0 (included in netatalk) includes multiple security vulnerabilities.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-1544</cvename>
 <cvename>CVE-2024-5288</cvename>
 <cvename>CVE-2024-5991</cvename>
 <cvename>CVE-2024-5814</cvename>
 </references>
 <dates>
 <discovery>2024-09-08</discovery>
 <entry>2024-09-09</entry>
 </dates>
 </vuln>

<vuln vid="80fbe184-2358-11ef-996e-40b034455553">
 <topic>minio -- unintentional information disclosure</topic>
 <affects>
 <package>
	<name>minio</name>
	<range><lt>2024.05.27.19.17.46</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Minio security advisory GHSA-95fr-cm4m-q5p9 reports:
	<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-95fr-cm4m-q5p9">
	 when used with anonymous requests by sending a random
	 object name requests you can figure out if the object
	 exists or not on the server on a specific bucket and also
	 gain access to some amount of information.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-36107</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36107</url>
 </references>
 <dates>
 <discovery>2024-05-28</discovery>
 <entry>2024-06-05</entry>
 </dates>
 </vuln>

<vuln vid="144836e3-2358-11ef-996e-40b034455553">
 <topic>minio -- privilege escalation via permissions inheritance</topic>
 <affects>
 <package>
	<name>minio</name>
	<range><lt>2024.01.31.20.20.33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Minio security advisory GHSA-xx8w-mq23-29g4 ports:
	<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-xx8w-mq23-29g4">
	
	 When someone creates an access key, it inherits the
	 permissions of the parent key. Not only for s3:* actions,
	 but also admin:* actions. Which means unless somewhere
	 above in the access-key hierarchy, the admin rights are
	 denied, access keys will be able to simply override their
	 own s3 permissions to something more permissive.
	
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-24747</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24747</url>
 </references>
 <dates>
 <discovery>2024-01-31</discovery>
 <entry>2024-06-05</entry>
 </dates>
 </vuln>

<vuln vid="7ade3c38-6d1f-11ef-ae11-b42e991fc52e">
 <topic>firefox -- Potential memory corruption and exploitable crash</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>128.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1901411">
	 An error in the ECMA-262 specification relating to Async Generators
	could have resulted in a type confusion, potentially leading to
	memory corruption and an exploitable crash.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-7652</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-7652</url>
 </references>
 <dates>
 <discovery>2024-09-06</discovery>
 <entry>2024-09-07</entry>
 </dates>
 </vuln>

<vuln vid="3e44c35f-6cf4-11ef-b813-4ccc6adda413">
 <topic>exiv2 -- Out-of-bounds read in AsfVideo::streamProperties</topic>
 <affects>
 <package>
	<name>exiv2</name>
	<range><ge>0.28.0,1</ge><lt>0.28.3,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Kevin Backhouse reports:
	<blockquote cite="https://github.com/Exiv2/exiv2/security/advisories/GHSA-38rv-8x93-pvrh">
	 An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability
	 is in the parser for the ASF video format, which was a new feature in v0.28.0,
	 so Exiv2 versions before v0.28 are not affected. The out-of-bounds read is
	 triggered when Exiv2 is used to read the metadata of a crafted video file.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-39695</cvename>
 <url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-38rv-8x93-pvrh</url>
 </references>
 <dates>
 <discovery>2024-04-21</discovery>
 <entry>2024-09-07</entry>
 </dates>
 </vuln>

<vuln vid="a5e13973-6c75-11ef-858b-23eeba13701a">
 <topic>forgejo -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>forgejo</name>
	<range><lt>8.0.3</lt></range>
 </package>
 <package>
	<name>forgejo7</name>
	<range><lt>7.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <h1>Problem Description:</h1>
 <ul>
 <li>Replace v-html with v-text in search inputbox</li>
 <li>Upgrade webpack to v5.94.0 as a precaution to mitigate
 CVE-2024-43788, although we were not yet able to confirm that this
 can be exploited in Forgejo.</li>
 </ul>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-43788</cvename>
 <url>https://codeberg.org/forgejo/forgejo/milestone/8231</url>
 </references>
 <dates>
 <discovery>2024-09-03</discovery>
 <entry>2024-09-06</entry>
 </dates>
 </vuln>

<vuln vid="943f8915-6c5d-11ef-810a-f8b46a88f42c">
 <topic>binutils -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>binutils</name>
	<range><lt>2.43,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	alster@vinterdalen.se reports PR/281070:
	<blockquote cite="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281070">
	 A new version of devel/binutils has been released fixing
	 CVE-2023-1972, CVE-2023-25585, CVE-2023-25586, and
	 CVE-2023-25588.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-1972</cvename>
 <cvename>CVE-2023-25585</cvename>
 <cvename>CVE-2023-25586</cvename>
 <cvename>CVE-2023-25588</cvename>
 </references>
 <dates>
 <discovery>2024-08-25</discovery>
 <entry>2024-09-06</entry>
 </dates>
 </vuln>

<vuln vid="f5d0cfe7-6ba6-11ef-858b-23eeba13701a">
 <topic>gitea -- multiple issues</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.22.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <h1>Problem Description:</h1>
 <ul>
 <li>Replace v-html with v-text in search inputbox</li>
 <li>Fix nuget/conan/container packages upload bugs</li>
 </ul>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.22.2</url>
 </references>
 <dates>
 <discovery>2024-09-03</discovery>
 <entry>2024-09-05</entry>
 </dates>
 </vuln>

<vuln vid="66907dab-6bb2-11ef-b813-4ccc6adda413">
 <topic>qt5-webengine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>qt5-webengine</name>
	<range><lt>5.15.17.p3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based">
	 Backports for 6 security bugs in Chromium:
	 <ul>
	 <li>CVE-2024-5496: Use after free in Media Session</li>
	 <li>CVE-2024-5846: Use after free in PDFium</li>
	 <li>CVE-2024-6291: Use after free in Swiftshader</li>
	 <li>CVE-2024-6989: Use after free in Loader</li>
	 <li>CVE-2024-6996: Race in Frames</li>
	 <li>CVE-2024-7536: Use after free in WebAudio</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-5496</cvename>
 <cvename>CVE-2024-5846</cvename>
 <cvename>CVE-2024-6291</cvename>
 <cvename>CVE-2024-6989</cvename>
 <cvename>CVE-2024-6996</cvename>
 <cvename>CVE-2024-7536</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based</url>
 </references>
 <dates>
 <discovery>2024-08-05</discovery>
 <entry>2024-09-05</entry>
 </dates>
 </vuln>

<vuln vid="a3a1caf5-6ba1-11ef-b9e8-b42e991fc52e">
 <topic>firefox -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>130.0_1,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1908496">
	This entry contains 8 vulnerabilities:
	<ul>
	<li>CVE-2024-8381: A potentially exploitable type
	confusion could be triggered when looking up a property
	name on an object being used as the `with` environment.</li>
	<li>CVE-2024-8382: Internal browser event interfaces were
	exposed to web content when privileged EventHandler listener
	callbacks ran for those events. Web content that tried to
	use those interfaces would not be able to use them with
	elevated privileges, but their presence would indicate
	certain browser features had been used, such as when a user
	opened the Dev Tools console.</li>
	<li>CVE-2024-8383: Firefox normally asks for confirmation
	before asking the operating system to find an application to
	handle a scheme that the browser does not support. It did not
	ask before doing so for the Usenet-related schemes news: and
	snews:. Since most operating systems don't have a
	trusted newsreader installed by default, an unscrupulous
	program that the user downloaded could register itself as a
	handler. The website that served the application download
	could then launch that application at will.</li>
	<li>CVE-2024-8384: The JavaScript garbage collector could
	mis-color cross-compartment objects if OOM conditions were
	detected at the right point between two passes. This could have
	led to memory corruption.</li>
	<li>CVE-2024-8385: A difference in the handling of
	StructFields and ArrayTypes in WASM could be used to trigger
	an exploitable type confusion vulnerability.</li>
	<li>CVE-2024-8386: If a site had been granted the permission
	to open popup windows, it could cause Select elements to
	appear on top of another site to perform a spoofing attack.</li>
	<li>CVE-2024-8387: Memory safety bugs present in Firefox 129,
	Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs
	showed evidence of memory corruption and we presume that with
	enough effort some of these could have been exploited to run
	arbitrary code.</li>
	<li>CVE-2024-8389: Memory safety bugs present in Firefox 129.
	Some of these bugs showed evidence of memory corruption and we
	presume that with enough effort some of these could have been
	exploited to run arbitrary code.</li>
 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-8381</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-8381</url>
 <cvename>CVE-2024-8382</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-8382</url>
 <cvename>CVE-2024-8383</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-8383</url>
 <cvename>CVE-2024-8384</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-8384</url>
 <cvename>CVE-2024-8385</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-8385</url>
 <cvename>CVE-2024-8386</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-8386</url>
 <cvename>CVE-2024-8387</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-8387</url>
 <cvename>CVE-2024-8389</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-8389</url>
 </references>
 <dates>
 <discovery>2024-09-03</discovery>
 <entry>2024-09-05</entry>
 </dates>
 </vuln>

<vuln vid="7e079ce2-6b51-11ef-9a62-002590c1f29c">
 <topic>FreeBSD -- umtx Kernel panic or Use-After-Free</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.1</ge><lt>14.1_4</lt></range>
	<range><ge>14.0</ge><lt>14.0_10</lt></range>
	<range><ge>13.3</ge><lt>13.3_6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Concurrent removals of such a mapping by using the UMTX_SHM_DESTROY
	sub-request of UMTX_OP_SHM can lead to decreasing the reference
	count of the object representing the mapping too many times, causing
	it to be freed too early.
	<h1>Impact:</h1>
	A malicious code exercizing the UMTX_SHM_DESTROY sub-request
	in parallel can panic the kernel or enable further Use-After-Free
	attacks, potentially including code execution or Capsicum sandbox
	escape.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-43102</cvename>
 <freebsdsa>SA-24:14.umtx</freebsdsa>
 </references>
 <dates>
 <discovery>2024-09-04</discovery>
 <entry>2024-09-05</entry>
 </dates>
 </vuln>

<vuln vid="4edaa9f4-6b51-11ef-9a62-002590c1f29c">
 <topic>FreeBSD -- bhyve(8) privileged guest escape via USB controller</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.1</ge><lt>14.1_4</lt></range>
	<range><ge>14.0</ge><lt>14.0_10</lt></range>
	<range><ge>13.3</ge><lt>13.3_6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	bhyve can be configured to emulate devices on a virtual USB
	controller (XHCI), such as USB tablet devices. An insufficient
	boundary validation in the USB code could lead to an out-of-bounds
	write on the heap, with data controlled by the caller.
	<h1>Impact:</h1>
	A malicious, privileged software running in a guest VM can
	exploit the vulnerability to achieve code execution on the host in
	the bhyve userspace process, which typically runs as root. Note
	that bhyve runs in a Capsicum sandbox, so malicious code is constrained
	by the capabilities available to the bhyve process.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-32668</cvename>
 <freebsdsa>SA-24:12.bhyve</freebsdsa>
 </references>
 <dates>
 <discovery>2024-09-04</discovery>
 <entry>2024-09-05</entry>
 </dates>
 </vuln>

<vuln vid="9bd5e47b-6b50-11ef-9a62-002590c1f29c">
 <topic>FreeBSD -- Multiple issues in ctl(4) CAM Target Layer</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.1</ge><lt>14.1_4</lt></range>
	<range><ge>14.0</ge><lt>14.0_10</lt></range>
	<range><ge>13.3</ge><lt>13.3_6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Several vulnerabilities were found in the ctl subsystem.
	The function ctl_write_buffer incorrectly set a flag which resulted
	in a kernel Use-After-Free when a command finished processing
	(CVE-2024-45063). The ctl_write_buffer and ctl_read_buffer functions
	allocated memory to be returned to userspace, without initializing
	it (CVE-2024-8178). The ctl_report_supported_opcodes function did
	not sufficiently validate a field provided by userspace, allowing
	an arbitrary write to a limited amount of kernel help memory
	(CVE-2024-42416). The ctl_request_sense function could expose up
	to three bytes of the kernel heap to userspace (CVE-2024-43110).
	Guest virtual machines in the bhyve hypervisor can send SCSI commands
	to the corresponding kernel driver via the virtio_scsi interface.
	This provides guests with direct access to the vulnerabilities
	covered by this advisory.
	The CAM Target Layer iSCSI target daemon ctld(8) accepts incoming
	iSCSI connections, performs authentication and passes connections
	to the kernel ctl(4) target layer.
	<h1>Impact:</h1>
	Malicious software running in a guest VM that exposes virtio_scsi
	can exploit the vulnerabilities to achieve code execution on the
	host in the bhyve userspace process, which typically runs as root.
	Note that bhyve runs in a Capsicum sandbox, so malicious code is
	constrained by the capabilities available to the bhyve process.
	A malicious iSCSI initiator could achieve remote code execution on
	the iSCSI target host.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-8178</cvename>
 <cvename>CVE-2024-42416</cvename>
 <cvename>CVE-2024-43110</cvename>
 <freebsdsa>SA-24:11.ctl</freebsdsa>
 </references>
 <dates>
 <discovery>2024-09-04</discovery>
 <entry>2024-09-05</entry>
 </dates>
 </vuln>

<vuln vid="56d76414-6b50-11ef-9a62-002590c1f29c">
 <topic>FreeBSD -- bhyve(8) privileged guest escape via TPM device passthrough</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.1</ge><lt>14.1_4</lt></range>
	<range><ge>14.0</ge><lt>14.0_10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	bhyve can be configured to provide access to the host's TPM
	device, where it passes the communication through an emulated device
	provided to the guest. This may be performed on the command-line
	by starting bhyve with the `-l tpm,passthru,/dev/tpmX` parameters.
	The MMIO handler for the emulated device did not validate the offset
	and size of the memory access correctly, allowing guests to read
	and write memory contents outside of the memory area effectively
	allocated.
	<h1>Impact:</h1>
	Malicious software running in a guest VM can exploit the buffer
	overflow to achieve code execution on the host in the bhyve userspace
	process, which typically runs as root. Note that bhyve runs in a
	Capsicum sandbox, so malicious code is constrained by the capabilities
	available to the bhyve process.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-41928</cvename>
 <freebsdsa>SA-24:10.bhyve</freebsdsa>
 </references>
 <dates>
 <discovery>2024-09-04</discovery>
 <entry>2024-09-05</entry>
 </dates>
 </vuln>

<vuln vid="8d1f9adf-6b4f-11ef-9a62-002590c1f29c">
 <topic>FreeBSD -- Multiple vulnerabilities in libnv</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.1</ge><lt>14.1_4</lt></range>
	<range><ge>14.0</ge><lt>14.0_10</lt></range>
	<range><ge>13.3</ge><lt>13.3_6</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.1</ge><lt>14.1_4</lt></range>
	<range><ge>14.0</ge><lt>14.0_10</lt></range>
	<range><ge>13.3</ge><lt>13.3_6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	CVE-2024-45287 is a vulnerability that affects both the kernel
	and userland. A malicious value of size in a structure of packed
	libnv can cause an integer overflow, leading to the allocation of
	a smaller buffer than required for the parsed data.
	CVE-2024-45288 is a vulnerability that affects both the kernel and
	userland. A missing null-termination character in the last element
	of an nvlist array string can lead to writing outside the allocated
	buffer.
	<h1>Impact:</h1>
	It is possible for an attacker to overwrite portions of memory
	(in userland or the kernel) as the allocated buffer might be smaller
	than the data received from a malicious process. This vulnerability
	could result in privilege escalation or cause a system panic.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-45287</cvename>
 <cvename>CVE-2024-45288</cvename>
 <freebsdsa>SA-24:09.libnv</freebsdsa>
 </references>
 <dates>
 <discovery>2024-09-04</discovery>
 <entry>2024-09-05</entry>
 </dates>
 </vuln>

<vuln vid="21f505f4-6a1c-11ef-b611-84a93843eb75">
 <topic>OpenSSL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>3.0.15,1</lt></range>
 </package>
 <package>
	<name>openssl31</name>
	<range><lt>3.1.7</lt></range>
 </package>
 <package>
	<name>openssl32</name>
	<range><lt>3.2.3</lt></range>
 </package>
 <package>
	<name>openssl33</name>
	<range><lt>3.3.2</lt></range>
 </package>
 <package>
	<name>openssl-quictls</name>
	<range><lt>3.0.15</lt></range>
 </package>
 <package>
	<name>openssl31-quictls</name>
	<range><lt>3.1.7</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.1</ge><lt>14.1_4</lt></range>
	<range><ge>14.0</ge><lt>14.0_10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://openssl-library.org/news/secadv/20240903.txt">
	 Possible denial of service in X.509 name checks [Moderate severity]
	 Applications performing certificate name checks (e.g., TLS clients
	 checking server certificates) may attempt to read an invalid
	 memory address resulting in abnormal termination of the application
	 process.
	 SSL_select_next_proto buffer overread [Low severity]
	 Calling the OpenSSL API function SSL_select_next_proto with an empty
	 supported client protocols buffer may cause a crash or memory
	 contents to be sent to the peer.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-5535</cvename>
 <cvename>CVE-2024-6119</cvename>
 <url>https://openssl-library.org/news/secadv/20240627.txt</url>
 <url>https://openssl-library.org/news/secadv/20240903.txt</url>
 <freebsdsa>SA-24:13.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2024-09-03</discovery>
 <entry>2024-09-03</entry>
 <modified>2024-09-05</modified>
 </dates>
 </vuln>

<vuln vid="26125e09-69ca-11ef-8a0f-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>128.0.6613.119</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>128.0.6613.119</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[357391257] High CVE-2024-8362: Use after free in WebAudio. Reported by Cassidy Kim(@cassidy6564) on 2024-08-05</li>
	 <li>[358485426] High CVE-2024-7970: Out of bounds write in V8. Reported by Cassidy Kim(@cassidy6564) on 2024-08-09</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-8362</cvename>
 <cvename>CVE-2024-7970</cvename>
 <url>https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2024-09-02</discovery>
 <entry>2024-09-03</entry>
 </dates>
 </vuln>

<vuln vid="eb437e17-66a1-11ef-ac08-75165d18d8d2">
 <topic>forgejo -- The scope of application tokens was not verified when writing containers or Conan packages.</topic>
 <affects>
 <package>
	<name>forgejo</name>
	<range><lt>8.0.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The forgejo team reports:
	<blockquote cite="https://codeberg.org/forgejo/forgejo/milestone/7728">
	The scope of application tokens was not verified when writing
	containers or Conan packages. This is of no consequence when the
	user associated with the application token does not have write
	access to packages. If the user has write access to packages, such
	a token can be used to write containers and Conan packages. An
	application token that was used to write containers or Conan
	packages without the package:write scope will now fail with an
	unauthorized error. It must be re-created to include the
	package:write scope.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://codeberg.org/forgejo/forgejo/pulls/5149</url>
 </references>
 <dates>
 <discovery>2024-08-26</discovery>
 <entry>2024-08-30</entry>
 </dates>
 </vuln>

<vuln vid="7e9cc7fd-6b3e-46c5-ad6d-409d90d41bbf">
 <topic>RabbitMQ-C -- auth credentials visible in commandline tool options</topic>
 <affects>
 <package>
	<name>rabbitmq-c</name>
	<range><lt>0.14.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	hadmut reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2023-35789">
		This C library includes 2 command-line tools that can take
		credentials as command-line options. The credentials are exposed
		as plain-text in the process list. This could allow an attacker
		with access to the process list to see the credentials.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-35789</cvename>
	 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-35789</url>
 </references>
 <dates>
 <discovery>2019-09-19</discovery>
 <entry>2024-08-30</entry>
 </dates>
 </vuln>

<vuln vid="5e4d7172-66b8-11ef-b104-b42e991fc52e">
 <topic>firefox -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>129.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1909241">
	 <ul>
	 <li>Firefox adds web-compatibility shims in place of some
	 tracking scripts blocked by Enhanced Tracking Protection.
	 On a site protected by Content Security Policy in
	 "strict-dynamic" mode, an attacker able to
	 inject an HTML element could have used a DOM
	 Clobbering attack on some of the shims and achieved XSS,
	 bypassing the CSP strict-dynamic protection.</li>
	 <li>Form validation popups could capture escape key presses.
	 Therefore, spamming form validation messages could be used
	 to prevent users from exiting full-screen mode.</li>
	 <li>When almost out-of-memory an elliptic curve key which
	 was never allocated could have been freed again. </li>
	 <li>It was possible to move the cursor using pointerlock
	 from an iframe. This allowed moving the cursor outside
	 of the viewport and the Firefox window.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-7524</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-7524</url>
 <cvename>CVE-2024-6610</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-6610</url>
 <cvename>CVE-2024-6609</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-6609</url>
 <cvename>CVE-2024-6608</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-6608</url>
 </references>
 <dates>
 <discovery>2024-08-06</discovery>
 <entry>2024-08-30</entry>
 </dates>
 </vuln>

<vuln vid="6f2545bb-65e8-11ef-8a0f-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>128.0.6613.113</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>128.0.6613.113</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_28.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[351865302] High CVE-2024-7969: Type Confusion in V8. Reported by CFF of Topsec Alpha Team on 2024-07-09</li>
	 <li>[360265320] High CVE-2024-8193: Heap buffer overflow in Skia. Reported by Renan Rios (@hyhy_100) on 2024-08-16</li>
	 <li>[360533914] High CVE-2024-8194: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) on 2024-08-18</li>
	 <li>[360758697] High CVE-2024-8198: Heap buffer overflow in Skia. Reported by Renan Rios (@hyhy_100) on 2024-08-19</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-7969</cvename>
 <cvename>CVE-2024-8193</cvename>
 <cvename>CVE-2024-8194</cvename>
 <cvename>CVE-2024-8198</cvename>
 <url>https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_28.html</url>
 </references>
 <dates>
 <discovery>2024-08-28</discovery>
 <entry>2024-08-29</entry>
 </dates>
 </vuln>

<vuln vid="46419e8c-65d9-11ef-ac06-b0416f0c4c67">
 <topic>Configobj -- Regular Expression Denial of Service attack</topic>
 <affects>
 <package>
	<name>py38-configobj</name>
	<name>py39-configobj</name>
	<name>py310-configobj</name>
	<name>py311-configobj</name>
	<range><le>5.0.8</le></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	report@snyk.io reports:
	<blockquote cite="https://github.com/DiffSK/configobj/issues/232">
	 All versions of the package configobj are vulnerable to Regular
	Expression Denial of Service (ReDoS) via the validate function,
	using (.+?)$(.*)$.**Note:** This is only exploitable in the case
	of a developer putting the offending value in a server side
	configuration file.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-26112</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-26112</url>
 </references>
 <dates>
 <discovery>2023-04-03</discovery>
 <entry>2024-08-29</entry>
 </dates>
 </vuln>

<vuln vid="49ef501c-62b6-11ef-bba5-2cf05da270f3">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.3.0</ge><lt>17.3.1</lt></range>
	<range><ge>17.2.0</ge><lt>17.2.4</lt></range>
	<range><ge>8.2.0</ge><lt>17.1.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/08/21/patch-release-gitlab-17-3-1-released/">
	 The GitLab Web Interface Does Not Guarantee Information Integrity When Downloading Source Code from Releases
	 Denial of Service by importing maliciously crafted GitHub repository
	 Prompt injection in "Resolve Vulnerabilty" results in arbitrary command execution in victim's pipeline
	 An unauthorized user can perform certain actions through GraphQL after a group owner enables IP restrictions
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-6502</cvename>
 <cvename>CVE-2024-8041</cvename>
 <cvename>CVE-2024-7110</cvename>
 <cvename>CVE-2024-3127</cvename>
 <url>https://about.gitlab.com/releases/2024/08/21/patch-release-gitlab-17-3-1-released/</url>
 </references>
 <dates>
 <discovery>2024-08-21</discovery>
 <entry>2024-08-25</entry>
 </dates>
 </vuln>

<vuln vid="7e6e932f-617b-11ef-8a7d-b42e991fc52e">
 <topic>firefox -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>127,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1414937">
	 <ul>
	 <li>CVE-2024-5697: A website was able to detect when a
	 user took a screenshot of a page using the built-in
	 Screenshot functionality in Firefox.</li>
	 <li>CVE-2024-5698: By manipulating the fullscreen
	 feature while opening a data-list, an attacker could
	 have overlaid a text box over the address bar. This
	 could have led to user confusion and possible spoofing
	 attacks.
	 </li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-5697</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-5697</url>
 <cvename>CVE-2024-5698</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-5698</url>
 </references>
 <dates>
 <discovery>2024-06-11</discovery>
 <entry>2024-08-23</entry>
 </dates>
 </vuln>

<vuln vid="6e8b9c75-6179-11ef-8a7d-b42e991fc52e">
 <topic>mcpp -- Heap-based buffer overflow</topic>
 <affects>
 <package>
	<name>mcpp</name>
	<range><lt>2.7.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00032.html">
	 MCPP 2.7.2 has a heap-based buffer overflow in the do_msg() function
	in support.c.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2019-14274</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-14274</url>
 </references>
 <dates>
 <discovery>2019-07-26</discovery>
 <entry>2024-08-23</entry>
 </dates>
 </vuln>

<vuln vid="f2b1da2e-6178-11ef-8a7d-b42e991fc52e">
 <topic>md4c -- DoS attack</topic>
 <affects>
 <package>
	<name>md4c</name>
	<range><lt>0.4.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://github.com/mity/md4c/commit/4fc808d8fe8d8904f8525bb4231d854f45e23a19">
	 md_analyze_line in md4c.c in md4c 0.4.7 allows attackers
	 to trigger use of uninitialized memory, and cause a denial
	 of service via a malformed Markdown document.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2021-30027</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-30027</url>
 </references>
 <dates>
 <discovery>2021-04-29</discovery>
 <entry>2024-08-23</entry>
 </dates>
 </vuln>

<vuln vid="b339992e-6059-11ef-8a0f-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>128.0.6613.84</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>128.0.6613.84</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html">
	 This update includes 38 security fixes:
	 <ul>
	 <li>[358296941] High CVE-2024-7964: Use after free in Passwords. Reported by Anonymous on 2024-08-08</li>
	 <li>[356196918] High CVE-2024-7965: Inappropriate implementation in V8. Reported by TheDog on 2024-07-30</li>
	 <li>[355465305] High CVE-2024-7966: Out of bounds memory access in Skia. Reported by Renan Rios (@HyHy100) on 2024-07-25</li>
	 <li>[355731798] High CVE-2024-7967: Heap buffer overflow in Fonts. Reported by Tashita Software Security on 2024-07-27</li>
	 <li>[349253666] High CVE-2024-7968: Use after free in Autofill. Reported by Han Zheng (HexHive) on 2024-06-25</li>
	 <li>[351865302] High CVE-2024-7969: Type Confusion in V8. Reported by CFF of Topsec Alpha Team on 2024-07-09</li>
	 <li>[360700873] High CVE-2024-7971: Type confusion in V8. Reported by Microsoft Threat Intelligence Center (MSTIC), Microsoft Security Response Center (MSRC) on 2024-08-19</li>
	 <li>[345960102] Medium CVE-2024-7972: Inappropriate implementation in V8. Reported by Simon Gerst (intrigus-lgtm) on 2024-06-10</li>
	 <li>[345518608] Medium CVE-2024-7973: Heap buffer overflow in PDFium. Reported by soiax on 2024-06-06</li>
	 <li>[339141099] Medium CVE-2024-7974: Insufficient data validation in V8 API. Reported by bowu(@gocrashed) on 2024-05-07</li>
	 <li>[347588491] Medium CVE-2024-7975: Inappropriate implementation in Permissions. Reported by Thomas Orlita on 2024-06-16</li>
	 <li>[339654392] Medium CVE-2024-7976: Inappropriate implementation in FedCM. Reported by Alesandro Ortiz on 2024-05-10</li>
	 <li>[324770940] Medium CVE-2024-7977: Insufficient data validation in Installer. Reported by Kim Dong-uk (@justlikebono) on 2024-02-11</li>
	 <li>[40060358] Medium CVE-2024-7978: Insufficient policy enforcement in Data Transfer. Reported by NDevTK on 2022-07-21</li>
	 <li>[356064205] Medium CVE-2024-7979: Insufficient data validation in Installer. Reported by VulnNoob on 2024-07-29</li>
	 <li>[356328460] Medium CVE-2024-7980: Insufficient data validation in Installer. Reported by VulnNoob on 2024-07-30</li>
	 <li>[40067456] Low CVE-2024-7981: Inappropriate implementation in Views. Reported by Thomas Orlita on 2023-07-14</li>
	 <li>[350256139] Low CVE-2024-8033: Inappropriate implementation in WebApp Installs. Reported by Lijo A.T on 2024-06-30</li>
	 <li>[353858776] Low CVE-2024-8034: Inappropriate implementation in Custom Tabs. Reported by Bharat (mrnoob) on 2024-07-18</li>
	 <li>[40059470] Low CVE-2024-8035: Inappropriate implementation in Extensions. Reported by Microsoft on 2022-04-26</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-7964</cvename>
 <cvename>CVE-2024-7965</cvename>
 <cvename>CVE-2024-7966</cvename>
 <cvename>CVE-2024-7967</cvename>
 <cvename>CVE-2024-7968</cvename>
 <cvename>CVE-2024-7969</cvename>
 <cvename>CVE-2024-7971</cvename>
 <cvename>CVE-2024-7972</cvename>
 <cvename>CVE-2024-7973</cvename>
 <cvename>CVE-2024-7974</cvename>
 <cvename>CVE-2024-7975</cvename>
 <cvename>CVE-2024-7976</cvename>
 <cvename>CVE-2024-7977</cvename>
 <cvename>CVE-2024-7978</cvename>
 <cvename>CVE-2024-7979</cvename>
 <cvename>CVE-2024-7980</cvename>
 <cvename>CVE-2024-7981</cvename>
 <cvename>CVE-2024-8033</cvename>
 <cvename>CVE-2024-8034</cvename>
 <cvename>CVE-2024-8035</cvename>
 <url>https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html</url>
 </references>
 <dates>
 <discovery>2024-08-21</discovery>
 <entry>2024-08-22</entry>
 </dates>
 </vuln>

<vuln vid="addc71b8-6024-11ef-86a1-8c164567ca3c">
 <topic>nginx -- Vulnerability in the ngx_http_mp4_module</topic>
 <affects>
 <package>
	<name>nginx-devel</name>
	<range><ge>1.5.13,3</ge><lt>1.27.1,3</lt></range>
 </package>
 <package>
	<name>nginx</name>
	<range><ge>1.6.0,3</ge><lt>1.26.2,3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The nginx development team reports:
	<blockquote cite="http://nginx.org/en/security_advisories.html">
	 This update fixes the buffer overread vulnerability in the
	ngx_http_mp4_module.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-7347</cvename>
 </references>
 <dates>
 <discovery>2024-08-14</discovery>
 <entry>2024-08-22</entry>
 </dates>
 </vuln>

<vuln vid="04c9c3f8-5ed3-11ef-8262-b0416f0c4c67">
 <topic>Jinja2 -- Vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter</topic>
 <affects>
 <package>
	<name>py38-Jinja2</name>
	<name>py39-Jinja2</name>
	<name>py310-Jinja2</name>
	<name>py311-Jinja2</name>
	<range><lt>3.1.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb">
	 Jinja is an extensible templating engine. The `xmlattr` filter in
	affected versions of Jinja accepts keys containing non-attribute
	characters. XML/HTML attributes cannot contain spaces, `/`, `&gt;`,
	or `=`, as each would then be interpreted as starting a separate
	attribute. If an application accepts keys (as opposed to only
	values) as user input, and renders these in pages that other users
	see as well, an attacker could use this to inject other attributes
	and perform XSS. The fix for CVE-2024-22195 only addressed spaces
	but not other characters. Accepting keys as user input is now
	explicitly considered an unintended use case of the `xmlattr` filter,
	and code that does so without otherwise validating the input should
	be flagged as insecure, regardless of Jinja version. Accepting
	_values_ as user input continues to be safe. This vulnerability
	is fixed in 3.1.4.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-34064</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-34064</url>
 </references>
 <dates>
 <discovery>2024-05-06</discovery>
 <entry>2024-08-20</entry>
 </dates>
 </vuln>

<vuln vid="d0ac9a17-5e68-11ef-b8cc-b42e991fc52e">
 <topic>mozilla products -- spoofing attack</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>129,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1875354">
	 Select options could obscure the fullscreen notification dialog.
	This could be used by a malicious site to perform a spoofing attack.
	This vulnerability affects Firefox &lt; 129, Firefox ESR &lt; 128.1,
	and Thunderbird &lt; 128.1.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-7518</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-7518</url>
 </references>
 <dates>
 <discovery>2024-08-06</discovery>
 <entry>2024-08-19</entry>
 </dates>
 </vuln>

<vuln vid="e61af8f4-455d-4f99-8d81-fbb004929dab">
 <topic>electron31 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron31</name>
	<range><lt>31.4.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v31.4.0">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-6989.</li>
	 <li>Security: backported fix for CVE-2024-6991.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-6989</cvename>
 <url>https://github.com/advisories/GHSA-32j6-235r-7fmm</url>
 <cvename>CVE-2024-6991</cvename>
 <url>https://github.com/advisories/GHSA-3v8g-fm64-g4mc</url>
 </references>
 <dates>
 <discovery>2024-08-15</discovery>
 <entry>2024-08-18</entry>
 </dates>
 </vuln>

<vuln vid="ac025402-4cbc-4177-bd99-c20c03a07f23">
 <topic>electron{29,30} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron29</name>
	<range><lt>29.4.6</lt></range>
 </package>
 <package>
	<name>electron30</name>
	<range><lt>30.4.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v29.4.6">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-6776.</li>
	 <li>Security: backported fix for CVE-2024-6778.</li>
	 <li>Security: backported fix for CVE-2024-6777.</li>
	 <li>Security: backported fix for CVE-2024-6773.</li>
	 <li>Security: backported fix for CVE-2024-6774.</li>
	 <li>Security: backported fix for CVE-2024-6772.</li>
	 <li>Security: backported fix for CVE-2024-6775.</li>
	 <li>Security: backported fix for CVE-2024-6779.</li>
	 <li>Security: backported fix for CVE-2024-6989.</li>
	 <li>Security: backported fix for CVE-2024-6991.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-6776</cvename>
 <url>https://github.com/advisories/GHSA-7hjm-9cg2-rcg6</url>
 <cvename>CVE-2024-6778</cvename>
 <url>https://github.com/advisories/GHSA-9m98-937v-r97x</url>
 <cvename>CVE-2024-6777</cvename>
 <url>https://github.com/advisories/GHSA-w2v8-c457-cjvf</url>
 <cvename>CVE-2024-6773</cvename>
 <url>https://github.com/advisories/GHSA-7gj8-545r-5295</url>
 <cvename>CVE-2024-6774</cvename>
 <url>https://github.com/advisories/GHSA-cgm7-mqr6-f7vg</url>
 <cvename>CVE-2024-6772</cvename>
 <url>https://github.com/advisories/GHSA-cc8c-62x7-qwjr</url>
 <cvename>CVE-2024-6775</cvename>
 <url>https://github.com/advisories/GHSA-mxwm-jm3p-mh5m</url>
 <cvename>CVE-2024-6779</cvename>
 <url>https://github.com/advisories/GHSA-v4v9-v4wf-9c86</url>
 <cvename>CVE-2024-6989</cvename>
 <url>https://github.com/advisories/GHSA-32j6-235r-7fmm</url>
 <cvename>CVE-2024-6991</cvename>
 <url>https://github.com/advisories/GHSA-3v8g-fm64-g4mc</url>
 </references>
 <dates>
 <discovery>2024-08-16</discovery>
 <entry>2024-08-18</entry>
 </dates>
 </vuln>

<vuln vid="6a6ad6cb-5c6c-11ef-b456-001e676bf734">
 <topic>Dovecot -- DoS</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><lt>2.3.21.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Dovecot reports:
	<blockquote cite="https://dovecot.org/mailman3/hyperkitty/list/dovecot-news@dovecot.org/thread/2CSVL56LFPAXVLWMGXEIWZL736PSYHP5/">
	 A DoS is possible with a large number of address headers or abnormally large email headers.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-23184</cvename>
 <cvename>CVE-2024-23185</cvename>
 <url>https://dovecot.org/mailman3/hyperkitty/list/dovecot-news@dovecot.org/thread/2CSVL56LFPAXVLWMGXEIWZL736PSYHP5/</url>
 </references>
 <dates>
 <discovery>2024-08-14</discovery>
 <entry>2024-08-16</entry>
 </dates>
 </vuln>

<vuln vid="9d8e9952-5a42-11ef-a219-1c697a616631">
 <topic>Intel CPUs -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cpu-microcode-intel</name>
	<range><lt>20240813</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Intel reports:
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01083.html">
	 
	 A potential security vulnerability in SMI Transfer monitor (STM) may
	 allow escalation of privilege. Intel has released microcode updates
	 to mitigate this potential vulnerability.
	 
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01118.html">
	 
	 A potential security vulnerability in some 3rd Generation Intel Xeon
	 Scalable Processors may allow denial of service. Intel has released
	 microcode updates to mitigate this potential vulnerability.
	 
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01100.html">
	 
	 A potential security vulnerability in some 3rd, 4th, and 5th
	 Generation Intel Xeon Processors may allow escalation of privilege.
	 Intel has released firmware updates to mitigate this potential
	 vulnerability.
	 
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01038.html">
	 
	 A potential security vulnerability in the Intel Core Ultra Processor
	 stream cache mechanism may allow escalation of privilege. Intel has
	 released microcode updates to mitigate this potential vulnerability.
	 
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01046.html">
	 
	 A potential security vulnerability in some Intel Processor stream
	 cache mechanisms may allow escalation of privilege. Intel has
	 released microcode updates to mitigate this potential vulnerability.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-24853</cvename>
 <cvename>CVE-2024-25939</cvename>
 <cvename>CVE-2024-24980</cvename>
 <cvename>CVE-2023-42667</cvename>
 <cvename>CVE-2023-49141</cvename>
 <url>https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20240813</url>
 </references>
 <dates>
 <discovery>2024-08-13</discovery>
 <entry>2024-08-14</entry>
 </dates>
 </vuln>

<vuln vid="5d7939f6-5989-11ef-9793-b42e991fc52e">
 <topic>firefox -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>129.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1905691">
	<ul>
	<li>
	 CVE-2024-7531: Calling `PK11_Encrypt()` in NSS using
	 CKM_CHACHA20 and the same buffer for input and output can
	 result in plaintext on an Intel Sandy Bridge processor. In
	 Firefox this only affects the QUIC header protection
	 feature when the connection is using the ChaCha20-Poly1305
	 cipher suite. The most likely outcome is connection
	 failure, but if the connection persists despite the high
	 packet loss it could be possible for a network observer to
	 identify packets as coming from the same source despite a
	 network path change. This vulnerability affects Firefox
	 &lt; 129, Firefox ESR &lt; 115.14, and Firefox ESR &lt;
	 128.1.
	</li>
	<li>
	 CVE-2024-7529: The date picker could partially obscure
	 security prompts. This could be used by a malicious site
	 to trick a user into granting permissions. This
	 vulnerability affects Firefox &lt; 129, Firefox ESR &lt;
	 115.14, Firefox ESR &lt; 128.1, Thunderbird &lt; 128.1,
	 and Thunderbird &lt; 115.14.
	</li>
	<li>
	 CVE-2024-7525: It was possible for a web extension with
	 minimal permissions to create a `StreamFilter` which could
	 be used to read and modify the response body of requests
	 on any site. This vulnerability affects Firefox &lt; 129,
	 Firefox ESR &lt; 115.14, Firefox ESR &lt; 128.1,
	 Thunderbird &lt; 128.1, and Thunderbird &lt; 115.14.
	</li>
	<li>
	 CVE-2024-7522: Editor code failed to check an attribute
	 value. This could have led to an out-of-bounds read. This
	 vulnerability affects Firefox &lt; 129, Firefox ESR &lt;
	 115.14, Firefox ESR &lt; 128.1, Thunderbird &lt; 128.1, and
	 Thunderbird &lt; 115.14.
	</li>
	<li>
	 CVE-2024-7520: A type confusion bug in WebAssembly could
	 be leveraged by an attacker to potentially achieve code
	 execution. This vulnerability affects Firefox &lt; 129,
	 Firefox ESR &lt; 128.1, and Thunderbird &lt; 128.1.
	</li>
	<li>
	 CVE-2024-7521: Incomplete WebAssembly exception handing
	 could have led to a use-after-free. This vulnerability
	 affects Firefox &lt; 129, Firefox ESR &lt; 115.14,
	 Firefox ESR &lt; 128.1, Thunderbird &lt; 128.1, and
	 Thunderbird &lt; 115.14.
	</li>
	<li>
	 CVE-2024-7530: Incorrect garbage collection interaction
	 could have led to a use-after-free. This vulnerability
	 affects Firefox &lt; 129.
	</li>
	<li>
	 CVE-2024-7528: Incorrect garbage collection interaction in
	 IndexedDB could have led to a use-after-free. This
	 vulnerability affects Firefox &lt; 129,
	 Firefox ESR &lt; 128.1, and Thunderbird &lt; 128.1.
	</li>
	<li>
	 CVE-2024-7527: Unexpected marking work at the start of
	 sweeping could have led to a use-after-free. This
	 vulnerability affects Firefox &lt; 129,
	 Firefox ESR &lt; 115.14, Firefox ESR &lt; 128.1,
	 Thunderbird &lt; 128.1, and Thunderbird &lt; 115.14.
	</li>
	</ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-7531</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-7531</url>
 <cvename>CVE-2024-7529</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-7529</url>
 <cvename>CVE-2024-7525</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-7525</url>
 <cvename>CVE-2024-7522</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-7522</url>
 <cvename>CVE-2024-7520</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-7520</url>
 <cvename>CVE-2024-7521</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-7521</url>
 <cvename>CVE-2024-7530</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-7530</url>
 <cvename>CVE-2024-7528</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-7528</url>
 <cvename>CVE-2024-7527</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-7527</url>
 </references>
 <dates>
 <discovery>2024-08-06</discovery>
 <entry>2024-08-13</entry>
 </dates>
 </vuln>

<vuln vid="587ed8ac-5957-11ef-854a-001e676bf734">
 <topic>OpenHAB CometVisu addon -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openhab-addons</name>
	<range><lt>4.2.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	OpenHAB reports:
	<blockquote cite="https://github.com/openhab/openhab-distro/releases/tag/4.2.1">
	 This patch release addresses the following security advisories:
<ul>
<li>SSRF/XSS (CometVisu) - <a href="https://github.com/openhab/openhab-webui/security/advisories/GHSA-v7gr-mqpj-wwh3">GHSA-v7gr-mqpj-wwh3</a></li>
<li>Sensitive information disclosure (CometVisu) - <a href="https://github.com/openhab/openhab-webui/security/advisories/GHSA-3g4c-hjhr-73rj">GHSA-3g4c-hjhr-73rj</a></li>
<li>RCE through path traversal (CometVisu) - <a href="https://github.com/openhab/openhab-webui/sec urity/advisories/GHSA-f729-58x4-gqgf">GHSA-f729-58x4-gqgf</a></li>
<li>Path traversal (CometVisu) - <a href="https://github.com/openhab/openhab-webui/security/advisories/GHSA-pcwp-26pw-j98w">GHSA-pcwp-26pw-j98w</a></li>
</ul>

All of these are related to the CometVisu add-on for openHAB - if you are a user of CometVisu, we strongly recommend to upgrade your system to openHAB 4.2.1 in order to fix those vulnerabilities.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/openhab/openhab-distro/releases/tag/4.2.1</url>
 <url>https://github.com/openhab/openhab-webui/security/advisories/GHSA-v7gr-mqpj-wwh3</url>
 <url>https://github.com/openhab/openhab-webui/security/advisories/GHSA-3g4c-hjhr-73rj</url>
 <url>https://github.com/openhab/openhab-webui/security/advisories/GHSA-f729-58x4-gqgf</url>
 <url>https://github.com/openhab/openhab-webui/security/advisories/GHSA-pcwp-26pw-j98w</url>
 </references>
 <dates>
 <discovery>2024-08-09</discovery>
 <entry>2024-08-09</entry>
 </dates>
 </vuln>

<vuln vid="d2723b0f-58d9-11ef-b611-84a93843eb75">
 <topic>Vaultwarden -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>vaultwarden</name>
	<range><lt>1.32.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Vaultwarden Team reports:
	<blockquote cite="https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.0">
	 This release has several CVE Reports fixed and we recommend
	 everybody to update to the latest version as soon as possible.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-39924</cvename>
 <cvename>CVE-2024-39925</cvename>
 <cvename>CVE-2024-39926</cvename>
 <url>https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.0</url>
 </references>
 <dates>
 <discovery>2024-08-11</discovery>
 <entry>2024-08-12</entry>
 </dates>
 </vuln>

<vuln vid="7d631146-5769-11ef-b618-1c697a616631">
 <topic>AMD CPUs -- Guest Memory Vulnerabilities</topic>
 <affects>
 <package>
	<name>cpu-microcode-amd</name>
	<range><lt>20240810</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	AMD reports:
	<blockquote cite="https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7014.html">
	 
	 Researchers from IOActive have reported that it may be possible for
	 an attacker with ring 0 access to modify the configuration of System
	 Management Mode (SMM) even when SMM Lock is enabled. Improper
	 validation in a model specific register (MSR) could allow a malicious
	 program with ring0 access to modify SMM configuration while SMI lock
	 is enabled, potentially leading to arbitrary code execution.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-31315</cvename>
 <url>https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7014.html</url>
 </references>
 <dates>
 <discovery>2024-08-09</discovery>
 <entry>2024-08-10</entry>
 </dates>
 </vuln>

<vuln vid="5776cc4f-5717-11ef-b611-84a93843eb75">
 <topic>Roundcube -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><lt>1.6.8,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Roundcube project reports:
	<blockquote cite="https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8">
	 XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
	 XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
	 information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-42009</cvename>
 <cvename>CVE-2024-42008</cvename>
 <cvename>CVE-2024-42010</cvename>
 <url>https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8</url>
 </references>
 <dates>
 <discovery>2024-08-04</discovery>
 <entry>2024-08-10</entry>
 </dates>
 </vuln>

<vuln vid="aa1c7af9-570e-11ef-a43e-b42e991fc52e">
 <topic>mozilla firefox -- protocol information guessing</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>127.0,2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@mozilla.org reports:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1883693">
	 By monitoring the time certain operations take, an attacker could
	have guessed which external protocol handlers were functional on a
	user's system. This vulnerability affects Firefox &lt; 127,
	Firefox ESR &lt; 115.12, and Thunderbird &lt; 115.12.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-5690</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-5690</url>
 </references>
 <dates>
 <discovery>2024-06-11</discovery>
 <entry>2024-08-10</entry>
 </dates>
 </vuln>

<vuln vid="8c342a6c-563f-11ef-a77e-901b0e9408dc">
 <topic>soft-serve -- Remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>soft-serve</name>
	<range><lt>0.7.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	soft-serve team reports:
	<blockquote cite="https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-m445-w3xr-vp2f">
	 Arbitrary code execution by crafting git ssh requests
	 It is possible for a user who can commit files to a
	 repository hosted by Soft Serve to execute arbitrary code
	 via environment manipulation and Git.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-41956</cvename>
 <url>https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-m445-w3xr-vp2f</url>
 </references>
 <dates>
 <discovery>2024-08-01</discovery>
 <entry>2024-08-09</entry>
 </dates>
 </vuln>

<vuln vid="48e6d514-5568-11ef-af48-6cc21735f730">
 <topic>PostgreSQL -- Prevent unauthorized code execution during pg_dump</topic>
 <affects>
 <package>
	<name>postgresql12-client</name>
	<range><lt>12.20</lt></range>
 </package>
 <package>
	<name>postgresql13-client</name>
	<range><lt>13.16</lt></range>
 </package>
 <package>
	<name>postgresql14-client</name>
	<range><lt>14.13</lt></range>
 </package>
 <package>
	<name>postgresql15-client</name>
	<range><lt>15.8</lt></range>
 </package>
 <package>
	<name>postgresql16-client</name>
	<range><lt>16.4</lt></range>
 </package>
 <package>
	<name>postgresql12-server</name>
	<range><lt>12.20</lt></range>
 </package>
 <package>
	<name>postgresql13-server</name>
	<range><lt>13.16</lt></range>
 </package>
 <package>
	<name>postgresql14-server</name>
	<range><lt>14.13</lt></range>
 </package>
 <package>
	<name>postgresql15-server</name>
	<range><lt>15.8</lt></range>
 </package>
 <package>
	<name>postgresql16-server</name>
	<range><lt>16.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2024-7348/">
	 
	 An attacker able to create and drop non-temporary objects could
	 inject SQL code that would be executed by a concurrent pg_dump
	 session with the privileges of the role running pg_dump
	 (which is often a superuser). The attack involves replacing a
	 sequence or similar object with a view or foreign table that will
	 execute malicious code. To prevent this, introduce a new server
	 parameter restrict_nonsystem_relation_kind that can disable
	 expansion of non-builtin views as well as access to foreign
	 tables, and teach pg_dump to set it when available. Note that the
	 attack is prevented only if both pg_dump and the server it is
	 dumping from are new enough to have this fix.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-7348</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2024-7348/</url>
 </references>
 <dates>
 <discovery>2024-08-08</discovery>
 <entry>2024-08-08</entry>
 </dates>
 </vuln>

<vuln vid="db8fa362-0ccb-4aa8-9220-72b7763e9a4a">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.471</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.462.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2024-08-07/">
	 <h1>Description</h1>
	 <h5>(Critical) SECURITY-3430 / CVE-2024-43044</h5>
	 Arbitrary file read vulnerability through agent connections can lead to RCE
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-3349 / CVE-2024-43045</h5>
	 Missing permission check allows accessing other users' "My Views"
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-43044</cvename>
 <cvename>CVE-2024-43045</cvename>
 <url>https://www.jenkins.io/security/advisory/2024-08-07/</url>
 </references>
 <dates>
 <discovery>2024-08-07</discovery>
 <entry>2024-08-07</entry>
 </dates>
 </vuln>

<vuln vid="729008b9-54bf-11ef-a61b-2cf05da270f3">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.2.0</ge><lt>17.2.2</lt></range>
	<range><ge>17.1.0</ge><lt>17.1.4</lt></range>
	<range><ge>12.0.0</ge><lt>17.0.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/08/07/patch-release-gitlab-17-2-2-released/">
	 Privilege Escalation via LFS Tokens Granting Unrestricted Repository Access
	 Cross project access of Security policy bot
	 Advanced search ReDOS in highlight for code results
	 Denial of Service via banzai pipeline
	 Denial of service using adoc files
	 ReDoS in RefMatcher when matching branch names using wildcards
	 Path encoding can cause the Web interface to not render diffs correctly
	 XSS while viewing raw XHTML files through API
	 Ambiguous tag name exploitation
	 Logs disclosings potentially sensitive data in query params
	 Password bypass on approvals using policy projects
	 ReDoS when parsing git push
	 Webhook deletion audit log can preserve auth credentials
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-3035</cvename>
 <cvename>CVE-2024-6356</cvename>
 <cvename>CVE-2024-5423</cvename>
 <cvename>CVE-2024-4210</cvename>
 <cvename>CVE-2024-2800</cvename>
 <cvename>CVE-2024-6329</cvename>
 <cvename>CVE-2024-4207</cvename>
 <cvename>CVE-2024-3958</cvename>
 <cvename>CVE-2024-4784</cvename>
 <cvename>CVE-2024-3114</cvename>
 <cvename>CVE-2024-7586</cvename>
 <url>https://about.gitlab.com/releases/2024/08/07/patch-release-gitlab-17-2-2-released/</url>
 </references>
 <dates>
 <discovery>2024-08-07</discovery>
 <entry>2024-08-07</entry>
 </dates>
 </vuln>

<vuln vid="94d441d2-5497-11ef-9d2f-080027836e8b">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py39-django42</name>
	<name>py310-django42</name>
	<name>py311-django42</name>
	<range><lt>4.2.15</lt></range>
 </package>
 <package>
	<name>py310-django50</name>
	<name>py311-django50</name>
	<range><lt>5.0.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Django reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2024/aug/06/security-releases/">
	 CVE-2024-41989: Memory exhaustion in django.utils.numberformat.floatformat().
	 CVE-2024-41990: Potential denial-of-service in django.utils.html.urlize().
	 CVE-2024-41991: Potential denial-of-service vulnerability in
	 django.utils.html.urlize() and AdminURLFieldWidget.
	 CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list().
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-41989</cvename>
 <cvename>CVE-2024-41990</cvename>
 <cvename>CVE-2024-41991</cvename>
 <cvename>CVE-2024-42005</cvename>
 <url>https://www.djangoproject.com/weblog/2024/aug/06/security-releases/</url>
 </references>
 <dates>
 <discovery>2024-08-01</discovery>
 <entry>2024-08-07</entry>
 </dates>
 </vuln>

<vuln vid="05cd9f82-5426-11ef-8a0f-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>127.0.6533.99</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>127.0.6533.99</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop.html">
	 This update includes 5 security fixes:
	 <ul>
	 <li>[350528343] Critical CVE-2024-7532: Out of bounds memory access in ANGLE. Reported by wgslfuzz on 2024-07-02</li>
	 <li>[353552540] High CVE-2024-7533: Use after free in Sharing. Reported by lime(@limeSec_) from TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-07-17</li>
	 <li>[355256380] High CVE-2024-7550: Type Confusion in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2024-07-25</li>
	 <li>[352467338] High CVE-2024-7534: Heap buffer overflow in Layout. Reported by Tashita Software Security on 2024-07-11</li>
	 <li>[352690885] High CVE-2024-7535: Inappropriate implementation in V8. Reported by Tashita Software Security on 2024-07-12</li>
	 <li>[354847246] High CVE-2024-7536: Use after free in WebAudio. Reported by Cassidy Kim(@cassidy6564) on 2024-07-23</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-7532</cvename>
 <cvename>CVE-2024-7550</cvename>
 <cvename>CVE-2024-7534</cvename>
 <cvename>CVE-2024-7535</cvename>
 <cvename>CVE-2024-7536</cvename>
 <url>https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2024-08-06</discovery>
 <entry>2024-08-06</entry>
 </dates>
 </vuln>

<vuln vid="15d398ea-4f73-11ef-8a0f-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>127.0.6533.88</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>127.0.6533.88</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_30.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[353034820] Critical CVE-2024-6990: Uninitialized Use in Dawn. Reported by gelatin dessert on 2024-07-15</li>
	 <li>[352872238] High CVE-2024-7255: Out of bounds read in WebTransport. Reported by Marten Richter on 2024-07-13</li>
	 <li>[354748060] High CVE-2024-7256: Insufficient data validation in Dawn. Reported by gelatin dessert on 2024-07-23</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-6990</cvename>
 <cvename>CVE-2024-7255</cvename>
 <cvename>CVE-2024-7256</cvename>
 <url>https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_30.html</url>
 </references>
 <dates>
 <discovery>2024-07-30</discovery>
 <entry>2024-07-31</entry>
 </dates>
 </vuln>

<vuln vid="fb0b5574-4e64-11ef-8a0f-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>127.0.6533.72</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>127.0.6533.72</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html">
	 This update includes 22 security fixes:
	 <ul>
	 <li>[349198731] High CVE-2024-6988: Use after free in Downloads. Reported by lime(@limeSec_) from TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-06-25</li>
	 <li>[349342289] High CVE-2024-6989: Use after free in Loader. Reported by Anonymous on 2024-06-25</li>
	 <li>[346618785] High CVE-2024-6991: Use after free in Dawn. Reported by wgslfuzz on 2024-06-12</li>
	 <li>[339686368] Medium CVE-2024-6994: Heap buffer overflow in Layout. Reported by Huang Xilin of Ant Group Light-Year Security Lab on 2024-05-10</li>
	 <li>[343938078] Medium CVE-2024-6995: Inappropriate implementation in Fullscreen. Reported by Alesandro Ortiz on 2024-06-01</li>
	 <li>[333708039] Medium CVE-2024-6996: Race in Frames. Reported by Louis Jannett (Ruhr University Bochum) on 2024-04-10</li>
	 <li>[325293263] Medium CVE-2024-6997: Use after free in Tabs. Reported by Sven Dysthe (@svn-dys) on 2024-02-15</li>
	 <li>[340098902] Medium CVE-2024-6998: Use after free in User Education. Reported by Sven Dysthe (@svn-dys) on 2024-05-13</li>
	 <li>[340893685] Medium CVE-2024-6999: Inappropriate implementation in FedCM. Reported by Alesandro Ortiz on 2024-05-15</li>
	 <li>[339877158] Medium CVE-2024-7000: Use after free in CSS. Reported by Anonymous on 2024-05-11</li>
	 <li>[347509736] Medium CVE-2024-7001: Inappropriate implementation in HTML. Reported by Jake Archibald on 2024-06-17</li>
	 <li>[338233148] Low CVE-2024-7003: Inappropriate implementation in FedCM. Reported by Alesandro Ortiz on 2024-05-01</li>
	 <li>[40063014] Low CVE-2024-7004: Insufficient validation of untrusted input in Safe Browsing. Reported by Anonymous on 2023-02-10</li>
	 <li>[40068800] Low CVE-2024-7005: Insufficient validation of untrusted input in Safe Browsing. Reported by Umar Farooq on 2023-08-04</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-6988</cvename>
 <cvename>CVE-2024-6989</cvename>
 <cvename>CVE-2024-6991</cvename>
 <cvename>CVE-2024-6994</cvename>
 <cvename>CVE-2024-6995</cvename>
 <cvename>CVE-2024-6996</cvename>
 <cvename>CVE-2024-6997</cvename>
 <cvename>CVE-2024-6998</cvename>
 <cvename>CVE-2024-6999</cvename>
 <cvename>CVE-2024-7000</cvename>
 <cvename>CVE-2024-7001</cvename>
 <cvename>CVE-2024-7003</cvename>
 <cvename>CVE-2024-7004</cvename>
 <cvename>CVE-2024-7005</cvename>
 <url>https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html</url>
 </references>
 <dates>
 <discovery>2024-07-23</discovery>
 <entry>2024-07-30</entry>
 </dates>
 </vuln>

<vuln vid="8057d198-4d26-11ef-8e64-641c67a117d8">
 <topic>znc -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>znc</name>
	<range><lt>1.9.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39844">
	 In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-39844</cvename>
 <url>https://wiki.znc.in/ChangeLog/1.9.1</url>
 <url>https://www.openwall.com/lists/oss-security/2024/07/03/9</url>
 </references>
 <dates>
 <discovery>2024-07-03</discovery>
 <entry>2024-07-28</entry>
 </dates>
 </vuln>

<vuln vid="3e917407-4b3f-11ef-8e49-001999f8d30b">
 <topic>Mailpit -- Content Security Policy XSS</topic>
 <affects>
 <package>
	<name>mailpit</name>
	<range><lt>1.19.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Mailpit developer reports:
	<blockquote cite="https://github.com/axllent/mailpit/releases/tag/v1.19.3">
	 A vulnerability was discovered which allowed a bad
	 actor with SMTP access to Mailpit to bypass the Content
	 Security Policy headers using a series of crafted HTML
	 messages which could result in a stored XSS attack via
	 the web UI.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/axllent/mailpit/releases/tag/v1.19.3</url>
 </references>
 <dates>
 <discovery>2024-07-26</discovery>
 <entry>2024-07-26</entry>
 </dates>
 </vuln>

<vuln vid="24c88add-4a3e-11ef-86d7-001b217b3468">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.2.0</ge><lt>17.2.1</lt></range>
	<range><ge>17.1.0</ge><lt>17.1.3</lt></range>
	<range><ge>12.0.0</ge><lt>17.0.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/07/24/patch-release-gitlab-17-2-1-released/">
	 XSS via the Maven Dependency Proxy
	 Project level analytics settings leaked in DOM
	 Reports can access and download job artifacts despite use of settings to prevent it
	 Direct Transfer - Authorised project/group exports are accessible to other users
	 Bypassing tag check and branch check through imports
	 Project Import/Export - Make project/group export files hidden to everyone except user who initiated it
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-5067</cvename>
 <cvename>CVE-2024-7057</cvename>
 <cvename>CVE-2024-0231</cvename>
 <url>https://about.gitlab.com/releases/2024/07/24/patch-release-gitlab-17-2-1-released/</url>
 </references>
 <dates>
 <discovery>2024-07-24</discovery>
 <entry>2024-07-25</entry>
 </dates>
 </vuln>

<vuln vid="574028b4-a181-455b-a78b-ec5c62781235">
 <topic>electron29 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron29</name>
	<range><lt>29.4.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v29.4.5">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-6291.</li>
	 <li>Security: backported fix for CVE-2024-6293.</li>
	 <li>Security: backported fix for CVE-2024-6290.</li>
	 <li>Security: backported fix for CVE-2024-6292.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-6291</cvename>
 <url>https://github.com/advisories/GHSA-rpvg-h6p6-42qj</url>
 <cvename>CVE-2024-6293</cvename>
 <url>https://github.com/advisories/GHSA-9f8f-453p-rg87</url>
 <cvename>CVE-2024-6290</cvename>
 <url>https://github.com/advisories/GHSA-r5mh-qgc2-26p2</url>
 <cvename>CVE-2024-6292</cvename>
 <url>https://github.com/advisories/GHSA-m848-8f5r-6j4g</url>
 </references>
 <dates>
 <discovery>2024-07-17</discovery>
 <entry>2024-07-19</entry>
 </dates>
 </vuln>

<vuln vid="088b8b7d-446c-11ef-b611-84a93843eb75">
 <topic>Apache httpd -- Source code disclosure with handlers configured via AddType</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><ge>2.4.60</ge><lt>2.4.62</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
	 source code disclosure with handlers configured via AddType
	 (CVE-2024-40725) (Important): A partial fix for CVE-2024-39884
	 in the core of Apache HTTP Server 2.4.61 ignores some use of the
	 legacy content-type based configuration of handlers. "AddType"
	 and similar configuration, under some circumstances where files
	 are requested indirectly, result in source code disclosure of
	 local content. For example, PHP scripts may be served instead
	 of interpreted.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-40725</cvename>
 <url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
 </references>
 <dates>
 <discovery>2024-07-17</discovery>
 <entry>2024-07-17</entry>
 </dates>
 </vuln>

<vuln vid="3b018063-4358-11ef-b611-84a93843eb75">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql80-client</name>
	<range><lt>8.0.38</lt></range>
 </package>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.38</lt></range>
 </package>
 <package>
	<name>mysql81-client</name>
	<range><lt>8.1.1</lt></range>
 </package>
 <package>
	<name>mysql81-server</name>
	<range><lt>8.1.1</lt></range>
 </package>
 <package>
	<name>mysql84-client</name>
	<range><lt>8.4.1</lt></range>
 </package>
 <package>
	<name>mysql84-server</name>
	<range><lt>8.4.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujul2024.html#MySQL">
	 36 new security patches for Oracle MySQL. 11 of these vulnerabilities
	 may be remotely exploitable without authentication, i.e., may be
	 exploited over a network without requiring user credentials.
	 The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
	 MySQL is 9.8.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://www.oracle.com/security-alerts/cpujul2024.html#MySQL</url>
 </references>
 <dates>
 <discovery>2024-07-16</discovery>
 <entry>2024-07-16</entry>
 </dates>
 </vuln>

<vuln vid="6091d1d8-4347-11ef-a4d4-080027957747">
 <topic>GLPI -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>10.0.16,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	GLPI team reports:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.16">
	 GLPI 10.0.16 Changelog
	 <ul>
	 <li>[SECURITY - high] Account takeover via SQL Injection in AJAX scripts (CVE-2024-37148)</li>
	 <li>[SECURITY - high] Remote code execution through the plugin loader (CVE-2024-37149)</li>
	 <li>[SECURITY - moderate] Authenticated file upload to restricted tickets (CVE-2024-37147)</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-37148</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37148</url>
 <cvename>CVE-2024-37149</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37149</url>
 <cvename>CVE-2024-37147</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37147</url>
 <url>https://github.com/glpi-project/glpi/releases/tag/10.0.16</url>
 </references>
 <dates>
 <discovery>2024-06-03</discovery>
 <entry>2024-07-16</entry>
 </dates>
 </vuln>

<vuln vid="6410f91d-1214-4f92-b7e0-852e39e265f9">
 <topic>electron30 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron30</name>
	<range><lt>30.2.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v30.2.0">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-5493.</li>
	 <li>Security: backported fix for CVE-2024-5831.</li>
	 <li>Security: backported fix for CVE-2024-5832.</li>
	 <li>Security: backported fix for CVE-2024-6100.</li>
	 <li>Security: backported fix for CVE-2024-6101.</li>
	 <li>Security: backported fix for CVE-2024-6103.</li>
	 <li>Security: backported fix for CVE-2024-6291.</li>
	 <li>Security: backported fix for CVE-2024-6293.</li>
	 <li>Security: backported fix for CVE-2024-6290.</li>
	 <li>Security: backported fix for CVE-2024-6292.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-5493</cvename>
 <url>https://github.com/advisories/GHSA-f6rr-qfxh-hcf9</url>
 <cvename>CVE-2024-5831</cvename>
 <url>https://github.com/advisories/GHSA-9pmm-wf44-xjqc</url>
 <cvename>CVE-2024-5832</cvename>
 <url>https://github.com/advisories/GHSA-rw9q-cwc5-qqp5</url>
 <cvename>CVE-2024-6100</cvename>
 <url>https://github.com/advisories/GHSA-g779-vpj7-v6c4</url>
 <cvename>CVE-2024-6101</cvename>
 <url>https://github.com/advisories/GHSA-rg42-f9ww-x3w7</url>
 <cvename>CVE-2024-6103</cvename>
 <url>https://github.com/advisories/GHSA-ph5m-227m-fc5g</url>
 <cvename>CVE-2024-6291</cvename>
 <url>https://github.com/advisories/GHSA-rpvg-h6p6-42qj</url>
 <cvename>CVE-2024-6293</cvename>
 <url>https://github.com/advisories/GHSA-9f8f-453p-rg87</url>
 <cvename>CVE-2024-6290</cvename>
 <url>https://github.com/advisories/GHSA-r5mh-qgc2-26p2</url>
 <cvename>CVE-2024-6292</cvename>
 <url>https://github.com/advisories/GHSA-m848-8f5r-6j4g</url>
 </references>
 <dates>
 <discovery>2024-07-10</discovery>
 <entry>2024-07-13</entry>
 </dates>
 </vuln>

<vuln vid="55d4a92f-c75f-43e8-ab1f-4a0efc9795c4">
 <topic>electron29 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron29</name>
	<range><lt>29.4.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v29.4.4">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-6291.</li>
	 <li>Security: backported fix for CVE-2024-6293.</li>
	 <li>Security: backported fix for CVE-2024-6290.</li>
	 <li>Security: backported fix for CVE-2024-6292.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-6291</cvename>
 <url>https://github.com/advisories/GHSA-rpvg-h6p6-42qj</url>
 <cvename>CVE-2024-6293</cvename>
 <url>https://github.com/advisories/GHSA-9f8f-453p-rg87</url>
 <cvename>CVE-2024-6290</cvename>
 <url>https://github.com/advisories/GHSA-r5mh-qgc2-26p2</url>
 <cvename>CVE-2024-6292</cvename>
 <url>https://github.com/advisories/GHSA-m848-8f5r-6j4g</url>
 </references>
 <dates>
 <discovery>2024-07-11</discovery>
 <entry>2024-07-13</entry>
 </dates>
 </vuln>

<vuln vid="acb4eab6-3f6d-11ef-8657-001b217b3468">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.1.0</ge><lt>17.1.2</lt></range>
	<range><ge>17.0.0</ge><lt>17.0.4</lt></range>
	<range><ge>11.8.0</ge><lt>16.11.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/07/10/patch-release-gitlab-17-1-2-released/">
	 An attacker can run pipeline jobs as an arbitrary user
	 Developer user with admin_compliance_framework permission can change group URL
	 Admin push rules custom role allows creation of project level deploy token
	 Package registry vulnerable to manifest confusion
	 User with admin_group_member permission can ban group members
	 Subdomain takeover in GitLab Pages
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-6385</cvename>
 <cvename>CVE-2024-5257</cvename>
 <cvename>CVE-2024-5470</cvename>
 <cvename>CVE-2024-6595</cvename>
 <cvename>CVE-2024-2880</cvename>
 <cvename>CVE-2024-5528</cvename>
 <url>https://about.gitlab.com/releases/2024/07/10/patch-release-gitlab-17-1-2-released/</url>
 </references>
 <dates>
 <discovery>2024-07-10</discovery>
 <entry>2024-07-11</entry>
 </dates>
 </vuln>

<vuln vid="171afa61-3eba-11ef-a58f-080027836e8b">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py39-django42</name>
	<name>py310-django42</name>
	<name>py311-django42</name>
	<range><lt>4.2.14</lt></range>
 </package>
 <package>
	<name>py310-django50</name>
	<name>py311-django50</name>
	<range><lt>5.0.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Django reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2024/jul/09/security-releases/">
	 CVE-2024-38875: Potential denial-of-service in django.utils.html.urlize().
	 CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords.
	 CVE-2024-39330: Potential directory-traversal in django.core.files.storage.Storage.save().
	 CVE-2024-39614: Potential denial-of-service in django.utils.translation.get_supported_language_variant().
	</blockquote>
	</body>
 </description>
 <references>
	<cvename>CVE-2024-38875</cvename>
	<cvename>CVE-2024-39329</cvename>
	<cvename>CVE-2024-39330</cvename>
	<cvename>CVE-2024-39614</cvename>
	<url>https://www.djangoproject.com/weblog/2024/jul/09/security-releases/</url>
 </references>
 <dates>
	<discovery>2024-07-01</discovery>
	<entry>2024-07-10</entry>
 </dates>
 </vuln>

<vuln vid="767dfb2d-3c9e-11ef-a829-5404a68ad561">
 <topic>traefik -- Bypassing IP allow-lists via HTTP/3 early data requests</topic>
 <affects>
 <package>
	<name>traefik</name>
	<range><lt>2.11.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The traefik authors report:
	<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-gxrv-wf35-62w9">
		There is a vulnerability in Traefik that allows bypassing IP allow-lists via HTTP/3 early
		 data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-39321</cvename>
 <url>https://github.com/traefik/traefik/security/advisories/GHSA-gxrv-wf35-62w9</url>
 </references>
 <dates>
 <discovery>2024-07-02</discovery>
 <entry>2024-07-07</entry>
 </dates>
 </vuln>

<vuln vid="5d921a8c-3a43-11ef-b611-84a93843eb75">
 <topic>Apache httpd -- source code disclosure</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><ge>2.4.60</ge><lt>2.4.61</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
	 isource code disclosure with handlers configured via AddType
	 (CVE-2024-39884) (Important). A regression in the core of Apache HTTP
	 Server 2.4.60 ignores some use of the legacy content-type based
	 configuration of handlers. "AddType" and similar configuration,
	 under some circumstances where files are requested indirectly, result
	 in source code disclosure of local content. For example, PHP scripts
	 may be served instead of interpreted.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-39884</cvename>
 <url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
 </references>
 <dates>
 <discovery>2024-07-04</discovery>
 <entry>2024-07-04</entry>
 </dates>
 </vuln>

<vuln vid="51498ee4-39a1-11ef-b609-002590c1f29c">
 <topic>Request Tracker -- information exposure vulnerability</topic>
 <affects>
 <package>
 <name>rt50</name>
 <range><lt>5.0.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Request Tracker reports:
	CVE-2024-3262 describes previously viewed pages being stored in the
	browser cache, which is the typical default behavior of most browsers to
	enable the "back" button. Someone who gains access to a host computer could
	potentially view ticket data using the back button, even after logging out
	of RT. The CVE specifically references RT version 4.4.1, but this behavior
	is present in most browsers viewing all versions of RT before 5.0.6.
	</body>
 </description>
 <references>
 <cvename>CVE-2024-3262</cvename>
 <url>https://github.com/advisories/GHSA-6426-p644-ffcf</url>
 </references>
 <dates>
 <discovery>2024-04-04</discovery>
 <entry>2024-07-04</entry>
 </dates>
 </vuln>

<vuln vid="b0374722-3912-11ef-a77e-901b0e9408dc">
 <topic>go -- net/http: denial of service due to improper 100-continue handling</topic>
 <affects>
 <package>
	<name>go122</name>
	<range><lt>1.22.5</lt></range>
 </package>
 <package>
	<name>go121</name>
	<range><lt>1.21.12</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/67555">
	 net/http: denial of service due to improper 100-continue handling
	 The net/http HTTP/1.1 client mishandled the case where a
	 server responds to a request with an "Expect: 100-continue"
	 header with a non-informational (200 or higher) status. This
	 mishandling could leave a client connection in an invalid
	 state, where the next request sent on the connection will
	 fail.
	 An attacker sending a request to a
	 net/http/httputil.ReverseProxy proxy can exploit this
	 mishandling to cause a denial of service by sending "Expect:
	 100-continue" requests which elicit a non-informational
	 response from the backend. Each such request leaves the
	 proxy with an invalid connection, and causes one subsequent
	 request using that connection to fail.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-24791</cvename>
 <url>https://go.dev/issue/67555</url>
 </references>
 <dates>
 <discovery>2024-07-02</discovery>
 <entry>2024-07-03</entry>
 </dates>
 </vuln>

<vuln vid="d7efc2ad-37af-11ef-b611-84a93843eb75">
 <topic>Apache httpd -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.60</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
	 DoS by Null pointer in websocket over HTTP/2 (CVE-2024-36387) (Low).
	 Serving WebSocket protocol upgrades over a HTTP/2 connection could
	 result in a Null Pointer dereference, leading to a crash of the server
	 process, degrading performance.
	 Proxy encoding problem (CVE-2024-38473) (Moderate).
	 Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier
	 allows request URLs with incorrect encoding to be sent to backend
	 services, potentially bypassing authentication via crafted requests.
	 Weakness with encoded question marks in backreferences
	 (CVE-2024-38474) (Important). Substitution encoding issue in
	 mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker
	 to execute scripts in directories permitted by the configuration but
	 not directly reachable by any URL or source disclosure of scripts
	 meant to only to be executed as CGI.
	 Weakness in mod_rewrite when first segment of substitution matches
	 filesystem path (CVE-2024-38475) (Important). Improper escaping of
	 output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows
	 an attacker to map URLs to filesystem locations that are permitted to
	 be served by the server but are not intentionally/directly reachable
	 by any URL, resulting in code execution or source code disclosure.
	 Substitutions in server context that use a backreferences or variables
	 as the first segment of the substitution are affected. Some unsafe
	 RewiteRules will be broken by this change and the rewrite flag
	 "UnsafePrefixStat" can be used to opt back in once ensuring the
	 substitution is appropriately constrained.
	 may use exploitable/malicious backend application output to run local
	 handlers via internal redirect (CVE-2024-38476) (Important).
	 Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are
	 vulnerable to information disclosure, SSRF or local script execution
	 via backend applications whose response headers are malicious or
	 exploitable.
	 Crash resulting in Denial of Service in mod_proxy via a malicious
	 request (CVE-2024-38477) (Important). Null pointer dereference in
	 mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker
	 to crash the server via a malicious request.
	 mod_rewrite proxy handler substitution (CVE-2024-39573) (Moderate).
	 Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier
	 allows an attacker to cause unsafe RewriteRules to unexpectedly setup
	 URL's to be handled by mod_proxy.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-36387</cvename>
 <cvename>CVE-2024-38473</cvename>
 <cvename>CVE-2024-38474</cvename>
 <cvename>CVE-2024-38475</cvename>
 <cvename>CVE-2024-38476</cvename>
 <cvename>CVE-2024-38477</cvename>
 <cvename>CVE-2024-39573</cvename>
 <url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
 </references>
 <dates>
 <discovery>2024-07-01</discovery>
 <entry>2024-07-01</entry>
 </dates>
 </vuln>

<vuln vid="f1a00122-3797-11ef-b611-84a93843eb75">
 <topic>OpenSSH -- Race condition resulting in potential remote code execution</topic>
 <affects>
 <package>
	<name>openssh-portable</name>
	<range><lt>9.7.p1_2,1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.1</ge><lt>14.1_2</lt></range>
	<range><ge>14.0</ge><lt>14.0_8</lt></range>
	<range><ge>13.3</ge><lt>13.3_4</lt></range>
	<range><ge>13.2</ge><lt>13.2_12</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSH project reports:
	<blockquote cite="https://www.openssh.com/security.html">
	 A race condition in sshd(8) could allow remote code execution as root on non-OpenBSD systems.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-6387</cvename>
 <url>https://www.openssh.com/security.html</url>
 <freebsdsa>SA-24:04.openssh</freebsdsa>
 </references>
 <dates>
 <discovery>2024-07-01</discovery>
 <entry>2024-07-01</entry>
 <modified>2024-09-20</modified>
 </dates>
 </vuln>

<vuln vid="c742dbe8-3704-11ef-9e6e-b42e991fc52e">
 <topic>netatalk3 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>netatalk3</name>
	<range><lt>3.2.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://github.com/Netatalk/netatalk/blob/90d91a9ac9a7d6132ab7620d31c8c23400949206/etc/afpd/directory.c#L2333">
	 This entry documents the following three vulnerabilities:
	 <ul>
	 <li>Netatalk before 3.2.1 has an off-by-one error and resultant heap-based
	buffer overflow because of setting ibuf[len] to '\0' in
	FPMapName in afp_mapname in etc/afpd/directory.c. 2.4.1 and 3.1.19
	are also fixed versions.</li>
	 <li>Netatalk before 3.2.1 has an off-by-one error, and resultant
	heap-based buffer overflow and segmentation violation, because of
	incorrectly using FPLoginExt in BN_bin2bn in etc/uams/uams_dhx_pam.c.
	The original issue 1097 report stated: 'The latest version of
	Netatalk (v3.2.0) contains a security vulnerability. This vulnerability
	arises due to a lack of validation for the length field after parsing
	user-provided data, leading to an out-of-bounds heap write of one
	byte (\0). Under specific configurations, this can result in reading
	metadata of the next heap block, potentially causing a Denial of
	Service (DoS) under certain heap layouts or with ASAN enabled. ...
	 </li>
	 <li>Netatalk before 3.2.1 has an off-by-one error and resultant heap-based
	buffer overflow because of setting ibuf[PASSWDLEN] to '\0'
	in FPLoginExt in login in etc/uams/uams_pam.c. 2.4.1 and 3.1.19
	are also fixed versions.
	 </li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-38440</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-38440</url>
 <cvename>CVE-2024-38441</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-38441</url>
 <cvename>CVE-2024-38439</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-38439</url>
 </references>
 <dates>
 <discovery>2024-06-16</discovery>
 <entry>2024-06-30</entry>
 </dates>
 </vuln>

<vuln vid="0e73964d-053a-481a-bf1c-202948d68484">
 <topic>electron29 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron29</name>
	<range><lt>29.4.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v29.4.3">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-5499.</li>
	 <li>Security: backported fix for CVE-2024-5493.</li>
	 <li>Security: backported fix for CVE-2024-5494.</li>
	 <li>Security: backported fix for CVE-2024-5495.</li>
	 <li>Security: backported fix for CVE-2024-5496.</li>
	 <li>Security: backported fix for CVE-2024-5158.</li>
	 <li>Security: backported fix for CVE-2024-5160.</li>
	 <li>Security: backported fix for CVE-2024-5157.</li>
	 <li>Security: backported fix for CVE-2024-5159.</li>
	 <li>Security: backported fix for CVE-2024-5831.</li>
	 <li>Security: backported fix for CVE-2024-5832.</li>
	 <li>Security: backported fix for CVE-2024-6100.</li>
	 <li>Security: backported fix for CVE-2024-6101.</li>
	 <li>Security: backported fix for CVE-2024-6103.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-5499</cvename>
 <url>https://github.com/advisories/GHSA-hqfv-mf6j-g3j6</url>
 <cvename>CVE-2024-5493</cvename>
 <url>https://github.com/advisories/GHSA-f6rr-qfxh-hcf9</url>
 <cvename>CVE-2024-5494</cvename>
 <url>https://github.com/advisories/GHSA-fv2x-w8xf-gxpq</url>
 <cvename>CVE-2024-5495</cvename>
 <url>https://github.com/advisories/GHSA-wrxh-8wc3-33rm</url>
 <cvename>CVE-2024-5496</cvename>
 <url>https://github.com/advisories/GHSA-8xgv-q88p-ghq4</url>
 <cvename>CVE-2024-5158</cvename>
 <url>https://github.com/advisories/GHSA-4433-jwm9-48r5</url>
 <cvename>CVE-2024-5160</cvename>
 <url>https://github.com/advisories/GHSA-c24q-2hx9-mjpc</url>
 <cvename>CVE-2024-5157</cvename>
 <url>https://github.com/advisories/GHSA-w7g4-69hj-jcrq</url>
 <cvename>CVE-2024-5159</cvename>
 <url>https://github.com/advisories/GHSA-qmp7-vwf7-6g2g</url>
 <cvename>CVE-2024-5831</cvename>
 <url>https://github.com/advisories/GHSA-9pmm-wf44-xjqc</url>
 <cvename>CVE-2024-5832</cvename>
 <url>https://github.com/advisories/GHSA-rw9q-cwc5-qqp5</url>
 <cvename>CVE-2024-6100</cvename>
 <url>https://github.com/advisories/GHSA-g779-vpj7-v6c4</url>
 <cvename>CVE-2024-6101</cvename>
 <url>https://github.com/advisories/GHSA-rg42-f9ww-x3w7</url>
 <cvename>CVE-2024-6103</cvename>
 <url>https://github.com/advisories/GHSA-ph5m-227m-fc5g</url>
 </references>
 <dates>
 <discovery>2024-06-27</discovery>
 <entry>2024-06-28</entry>
 </dates>
 </vuln>

<vuln vid="07f0ea8c-356a-11ef-ac6d-a0423f48a938">
 <topic>frr - Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>frr9</name>
	<range><lt>9.1.1</lt></range>
 </package>
 <package>
 <name>frr8</name>
 <range><lt>8.5.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://frrouting.org/release/9.1.1/">
	 In FRRouting (FRR) through 9.1, there are multiples vulnerabilities.
	<ul>
	 <li>CVE-2024-31950: buffer overflow and daemon crash in ospf_te_parse_ri for OSPF LSA packets</li>
	 <li>CVE-2024-31951: buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets</li>
	</ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-31950</cvename>
 <cvename>CVE-2024-31951</cvename>
 <url>https://frrouting.org/release/9.1.1/</url>
 </references>
 <dates>
 <discovery>2024-04-07</discovery>
 <entry>2024-06-28</entry>
 </dates>
 </vuln>

<vuln vid="589de937-343f-11ef-8a7b-001b217b3468">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.1.0</ge><lt>17.1.1</lt></range>
	<range><ge>17.0.0</ge><lt>17.0.3</lt></range>
	<range><ge>1.0.0</ge><lt>16.11.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/06/26/patch-release-gitlab-17-1-1-released/">
	 Run pipelines as any user
	 Stored XSS injected in imported project's commit notes
	 CSRF on GraphQL API IntrospectionQuery
	 Remove search results from public projects with unauthorized repos
	 Cross window forgery in user application OAuth flow
	 Project maintainers can bypass group's merge request approval policy
	 ReDoS via custom built markdown page
	 Private job artifacts can be accessed by any user
	 Security fixes for banzai pipeline
	 ReDoS in dependency linker
	 Denial of service using a crafted OpenAPI file
	 Merge request title disclosure
	 Access issues and epics without having an SSO session
	 Non project member can promote key results to objectives
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-5655</cvename>
 <cvename>CVE-2024-4901</cvename>
 <cvename>CVE-2024-4994</cvename>
 <cvename>CVE-2024-6323</cvename>
 <cvename>CVE-2024-2177</cvename>
 <cvename>CVE-2024-5430</cvename>
 <cvename>CVE-2024-4025</cvename>
 <cvename>CVE-2024-3959</cvename>
 <cvename>CVE-2024-4557</cvename>
 <cvename>CVE-2024-1493</cvename>
 <cvename>CVE-2024-1816</cvename>
 <cvename>CVE-2024-2191</cvename>
 <cvename>CVE-2024-3115</cvename>
 <cvename>CVE-2024-4011</cvename>
 <url>https://about.gitlab.com/releases/2024/06/26/patch-release-gitlab-17-1-1-released/</url>
 </references>
 <dates>
 <discovery>2024-06-26</discovery>
 <entry>2024-06-27</entry>
 </dates>
 </vuln>

<vuln vid="2b68c86a-32d5-11ef-8a0f-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>126.0.6478.126</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>126.0.6478.126</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_24.html">
	 This update includes 5 security fixes:
	 <ul>
	 <li>[342428008] High CVE-2024-6290: Use after free in Dawn. Reported by wgslfuzz on 2024-05-23</li>
	 <li>[40942995] High CVE-2024-6291: Use after free in Swiftshader. Reported by Cassidy Kim(@cassidy6564) on 2023-11-15</li>
	 <li>[342545100] High CVE-2024-6292: Use after free in Dawn. Reported by wgslfuzz on 2024-05-24</li>
	 <li>[345993680] High CVE-2024-6293: Use after free in Dawn. Reported by wgslfuzz on 2024-06-09</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-6290</cvename>
 <cvename>CVE-2024-6291</cvename>
 <cvename>CVE-2024-6292</cvename>
 <cvename>CVE-2024-6293</cvename>
 <url>https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_24.html</url>
 </references>
 <dates>
 <discovery>2024-06-24</discovery>
 <entry>2024-06-25</entry>
 </dates>
 </vuln>

<vuln vid="4f6c4c07-3179-11ef-9da5-1c697a616631">
 <topic>emacs -- Arbitrary shell code evaluation vulnerability</topic>
 <affects>
 <package>
 <name>emacs</name>
 <name>emacs-canna</name>
 <name>emacs-nox</name>
 <name>emacs-wayland</name>
 <range><lt>29.3_3,3</lt></range>
 </package>
 <package>
 <name>emacs-devel</name>
 <name>emacs-devel-nox</name>
 <range><lt>30.0.50.20240615_1,3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	GNU Emacs developers report:
	<blockquote cite="https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.html">
	 Emacs 29.4 is an emergency bugfix release intended to fix a security vulnerability. Arbitrary shell commands are no longer run when turning on Org mode in order to avoid running malicious code.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://seclists.org/oss-sec/2024/q2/296</url>
 </references>
 <dates>
 <discovery>2024-06-22</discovery>
 <entry>2024-06-23</entry>
 </dates>
 </vuln>

<vuln vid="82830965-3073-11ef-a17d-5404a68ad561">
 <topic>traefik -- Azure Identity Libraries Elevation of Privilege Vulnerability</topic>
 <affects>
 <package>
	<name>traefik</name>
	<range><lt>2.11.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The traefik authors report:
	<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-rvj4-q8q5-8grf">
		There is a vulnerability in Azure Identity Libraries and
		 Microsoft Authentication Library Elevation of Privilege Vulnerability.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-35255</cvename>
 <url>https://github.com/traefik/traefik/security/advisories/GHSA-rvj4-q8q5-8grf</url>
 </references>
 <dates>
 <discovery>2024-06-11</discovery>
 <entry>2024-06-22</entry>
 </dates>
 </vuln>

<vuln vid="aa2b65e4-2f63-11ef-9cab-4ccc6adda413">
 <topic>qt5-webengine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>qt5-webengine</name>
	<range><lt>5.15.17.p2_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based">
	 Backports for 5 security bugs in Chromium:
	 <ul>
	 <li>CVE-2024-3837: Use after free in QUIC</li>
	 <li>CVE-2024-3839: Out of bounds read in Fonts</li>
	 <li>CVE-2024-3914: Use after free in V8</li>
	 <li>CVE-2024-4058: Type confusion in ANGLE</li>
	 <li>CVE-2024-4558: Use after free in ANGLE</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-3837</cvename>
 <cvename>CVE-2024-3839</cvename>
 <cvename>CVE-2024-3914</cvename>
 <cvename>CVE-2024-4058</cvename>
 <cvename>CVE-2024-4558</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based</url>
 </references>
 <dates>
 <discovery>2024-05-31</discovery>
 <entry>2024-06-20</entry>
 </dates>
 </vuln>

<vuln vid="c5415838-2f52-11ef-9cab-4ccc6adda413">
 <topic>qt6-webengine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>qt6-webengine</name>
	<range><lt>6.7.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Qt qtwebengine-chromium repo reports:
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based">
	 Backports for 7 security bugs in Chromium:
	 <ul>
	 <li>CVE-2024-4948: Use after free in Dawn</li>
	 <li>CVE-2024-5274: Type Confusion in V8</li>
	 <li>CVE-2024-5493: Heap buffer overflow in WebRTC</li>
	 <li>CVE-2024-5494: Use after free in Dawn</li>
	 <li>CVE-2024-5495: Use after free in Dawn</li>
	 <li>CVE-2024-5496: Use after free in Media Session</li>
	 <li>CVE-2024-5499: Out of bounds write in Streams API</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-4948</cvename>
 <cvename>CVE-2024-5274</cvename>
 <cvename>CVE-2024-5493</cvename>
 <cvename>CVE-2024-5494</cvename>
 <cvename>CVE-2024-5495</cvename>
 <cvename>CVE-2024-5496</cvename>
 <cvename>CVE-2024-5499</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based</url>
 </references>
 <dates>
 <discovery>2024-05-31</discovery>
 <entry>2024-06-20</entry>
 </dates>
 </vuln>

<vuln vid="142c538e-b18f-40a1-afac-c479effadd5c">
 <topic>openvpn -- two security fixes</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><lt>2.6.11</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gert Doering reports that OpenVPN 2.6.11 fixes two security bugs (three on Windows):
	<blockquote cite="https://github.com/OpenVPN/openvpn/blob/v2.6.11/Changes.rst#security-fixes">
	 CVE-2024-5594: control channel: refuse control channel messages with nonprintable characters in them. Security scope: a malicious openvpn peer can send garbage to openvpn log, or cause high CPU load. (Reynir Björnsson)
	 CVE-2024-28882: only call schedule_exit() once (on a given peer). Security scope: an authenticated client can make the server "keep the session" even when the server has been told to disconnect this client. (Reynir Björnsson)
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-5594</cvename>
 <cvename>CVE-2024-28882</cvename>
 <url>https://github.com/OpenVPN/openvpn/blob/v2.6.11/Changes.rst#security-fixes</url>
 </references>
 <dates>
 <discovery>2024-05-16</discovery>
 <entry>2024-06-20</entry>
 </dates>
 </vuln>

<vuln vid="007e7e77-2f06-11ef-8a0f-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>126.0.6478.114</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>126.0.6478.114</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html">
	 This update includes 6 security fixes:
	 <ul>
	 <li>[344608204] High CVE-2024-6100: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) participating in SSD Secure Disclosure's TyphoonPWN 2024 on 2024-06-04</li>
	 <li>[343748812] High CVE-2024-6101: Inappropriate implementation in WebAssembly. Reported by @ginggilBesel on 2024-05-31</li>
	 <li>[339169163] High CVE-2024-6102: Out of bounds memory access in Dawn. Reported by wgslfuzz on 2024-05-07</li>
	 <li>[344639860] High CVE-2024-6103: Use after free in Dawn. Reported by wgslfuzz on 2024-06-04</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-6100</cvename>
 <cvename>CVE-2024-6101</cvename>
 <cvename>CVE-2024-6102</cvename>
 <cvename>CVE-2024-6103</cvename>
 <url>https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html</url>
 </references>
 <dates>
 <discovery>2024-06-18</discovery>
 <entry>2024-06-20</entry>
 </dates>
 </vuln>

<vuln vid="453aa0fc-2d91-11ef-8a0f-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>126.0.6478.54</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>126.0.6478.54</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html">
	 This update includes 21 security fixes:
	 <ul>
	 <li>[342456991] High CVE-2024-5830: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2024-05-24</li>
	 <li>[339171223] High CVE-2024-5831: Use after free in Dawn. Reported by wgslfuzz on 2024-05-07</li>
	 <li>[340196361] High CVE-2024-5832: Use after free in Dawn. Reported by wgslfuzz on 2024-05-13</li>
	 <li>[342602616] High CVE-2024-5833: Type Confusion in V8. Reported by @ginggilBesel on 2024-05-24</li>
	 <li>[342840932] High CVE-2024-5834: Inappropriate implementation in Dawn. Reported by gelatin dessert on 2024-05-26</li>
	 <li>[341991535] High CVE-2024-5835: Heap buffer overflow in Tab Groups. Reported by Weipeng Jiang (@Krace) of VRI on 2024-05-22</li>
	 <li>[341875171] High CVE-2024-5836: Inappropriate Implementation in DevTools. Reported by Allen Ding on 2024-05-21</li>
	 <li>[342415789] High CVE-2024-5837: Type Confusion in V8. Reported by Anonymous on 2024-05-23</li>
	 <li>[342522151] High CVE-2024-5838: Type Confusion in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2024-05-24</li>
	 <li>[340122160] Medium CVE-2024-5839: Inappropriate Implementation in Memory Allocator. Reported by Micky on 2024-05-13</li>
	 <li>[41492103] Medium CVE-2024-5840: Policy Bypass in CORS. Reported by Matt Howard on 2024-01-17</li>
	 <li>[326765855] Medium CVE-2024-5841: Use after free in V8. Reported by Cassidy Kim(@cassidy6564) on 2024-02-26</li>
	 <li>[40062622] Medium CVE-2024-5842: Use after free in Browser UI. Reported by Sven Dysthe (@svn_dy) on 2023-01-12</li>
	 <li>[333940412] Medium CVE-2024-5843: Inappropriate implementation in Downloads. Reported by hjy79425575 on 2024-04-12</li>
	 <li>[331960660] Medium CVE-2024-5844: Heap buffer overflow in Tab Strip. Reported by Sri on 2024-04-01</li>
	 <li>[340178596] Medium CVE-2024-5845: Use after free in Audio. Reported by anonymous on 2024-05-13</li>
	 <li>[341095523] Medium CVE-2024-5846: Use after free in PDFium. Reported by Han Zheng (HexHive) on 2024-05-16</li>
	 <li>[341313077] Medium CVE-2024-5847: Use after free in PDFium. Reported by Han Zheng (HexHive) on 2024-05-18</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-5830</cvename>
 <cvename>CVE-2024-5831</cvename>
 <cvename>CVE-2024-5832</cvename>
 <cvename>CVE-2024-5833</cvename>
 <cvename>CVE-2024-5834</cvename>
 <cvename>CVE-2024-5835</cvename>
 <cvename>CVE-2024-5836</cvename>
 <cvename>CVE-2024-5837</cvename>
 <cvename>CVE-2024-5838</cvename>
 <cvename>CVE-2024-5839</cvename>
 <cvename>CVE-2024-5840</cvename>
 <cvename>CVE-2024-5841</cvename>
 <cvename>CVE-2024-5842</cvename>
 <cvename>CVE-2024-5843</cvename>
 <cvename>CVE-2024-5844</cvename>
 <cvename>CVE-2024-5845</cvename>
 <cvename>CVE-2024-5846</cvename>
 <cvename>CVE-2024-5847</cvename>
 <url>https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2024-06-11</discovery>
 <entry>2024-06-18</entry>
 </dates>
 </vuln>

<vuln vid="f0ba7008-2bbd-11ef-b4ca-814a3d504243">
 <topic>forgejo -- multiple issues</topic>
 <affects>
 <package>
	<name>forgejo</name>
	<range><lt>7.0.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The forgejo team reports:
	<blockquote cite="https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-4">
	<a href="https://pkg.go.dev/vuln/GO-2024-2888">CVE-2024-24789</a>:
	The archive/zip package's handling of certain types of invalid
	zip files differs from the behavior of most zip implementations.
	This misalignment could be exploited to create an zip file with
	contents that vary depending on the implementation reading the
	file.
	The OAuth2 implementation does not always require authentication
	for public clients, a requirement of RFC 6749 Section 10.2. A
	malicious client can impersonate another client and obtain access
	to protected resources if the impersonated client fails to, or is
	unable to, keep its client credentials confidential.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-24789</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-24789</url>
 </references>
 <dates>
 <discovery>2024-04-04</discovery>
 <entry>2024-04-11</entry>
 </dates>
 </vuln>

<vuln vid="219aaa1e-2aff-11ef-ab37-5404a68ad561">
 <topic>traefik -- Unexpected behavior with IPv4-mapped IPv6 addresses</topic>
 <affects>
 <package>
	<name>traefik</name>
	<range><lt>2.11.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The traefik authors report:
	<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-7jmw-8259-q9jx">
	 There is a vulnerability in Go managing various Is methods
	 (IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses.
	 They didn't work as expected returning false for addresses
	 which would return true in their traditional IPv4 forms.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-24790</cvename>
 <url>https://github.com/traefik/traefik/security/advisories/GHSA-7jmw-8259-q9jx</url>
 </references>
 <dates>
 <discovery>2024-06-05</discovery>
 <entry>2024-06-15</entry>
 </dates>
 </vuln>

<vuln vid="a5c64f6f-2af3-11ef-a77e-901b0e9408dc">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go122</name>
	<range><lt>1.22.4</lt></range>
 </package>
 <package>
	<name>go121</name>
	<range><lt>1.21.11</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/66869">
	 archive/zip: mishandling of corrupt central directory record
	 The archive/zip package's handling of certain types of
	 invalid zip files differed from the behavior of most zip
	 implementations. This misalignment could be exploited to
	 create an zip file with contents that vary depending on the
	 implementation reading the file. The archive/zip package now
	 rejects files containing these errors.
	</blockquote>
	<blockquote cite="https://go.dev/issue/67680">
	 net/netip: unexpected behavior from Is methods for
	 IPv4-mapped IPv6 addresses
	 The various Is methods (IsPrivate, IsLoopback, etc) did
	 not work as expected for IPv4-mapped IPv6 addresses,
	 returning false for addresses which would return true in
	 their traditional IPv4 forms.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-24789</cvename>
 <cvename>CVE-2024-24790</cvename>
 <url>https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ</url>
 </references>
 <dates>
 <discovery>2024-06-04</discovery>
 <entry>2024-06-15</entry>
 </dates>
 </vuln>

<vuln vid="92cd1c03-2940-11ef-bc02-001b217b3468">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.0.0</ge><lt>17.0.2</lt></range>
	<range><ge>16.11.0</ge><lt>16.11.4</lt></range>
	<range><ge>5.1</ge><lt>16.10.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/">
	 ReDoS in gomod dependency linker
	 ReDoS in CI interpolation (fix bypass)
	 ReDoS in Asana integration issue mapping when webhook is called
	 XSS and content injection when viewing raw XHTML files on iOS devices
	 Missing agentk request validation could cause KAS to panic
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-1495</cvename>
 <cvename>CVE-2024-1736</cvename>
 <cvename>CVE-2024-1963</cvename>
 <cvename>CVE-2024-4201</cvename>
 <cvename>CVE-2024-5469</cvename>
 <url>https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/</url>
 </references>
 <dates>
 <discovery>2024-06-12</discovery>
 <entry>2024-06-13</entry>
 </dates>
 </vuln>

<vuln vid="479df73e-2838-11ef-9cab-4ccc6adda413">
 <topic>plasma[56]-plasma-workspace -- Unauthorized users can access session manager</topic>
 <affects>
 <package>
	<name>plasma5-plasma-workspace</name>
	<range><lt>5.27.11.1</lt></range>
 </package>
 <package>
	<name>plasma6-plasma-workspace</name>
	<range><lt>6.0.4_2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	David Edmundson reports:
	<blockquote cite="https://kde.org/info/security/advisory-20240531-1.txt">
	 KSmserver, KDE's XSMP manager, incorrectly allows connections via ICE
	 based purely on the host, allowing all local connections. This allows
	 another user on the same machine to gain access to the session
	 manager.
	 A well crafted client could use the session restore feature to execute
	 arbitrary code as the user on the next boot.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-36041</cvename>
 <url>https://kde.org/info/security/advisory-20240531-1.txt</url>
 </references>
 <dates>
 <discovery>2024-05-31</discovery>
 <entry>2024-06-11</entry>
 </dates>
 </vuln>

<vuln vid="5f608c68-276c-11ef-8caa-0897988a1c07">
 <topic>Composer -- Multiple command injections via malicious git/hg branch names</topic>
 <affects>
 <package>
	<name>php81-composer</name>
	<range><lt>2.7.7</lt></range>
 </package>
 <package>
	<name>php82-composer</name>
	<range><lt>2.7.7</lt></range>
 </package>
 <package>
	<name>php83-composer</name>
	<range><lt>2.7.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Composer project reports:
	<blockquote cite="https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c">
	 The status, reinstall and remove commands with packages
	 installed from source via git containing specially crafted
	 branch names in the repository can be used to execute
	 code.
	</blockquote>
	<blockquote cite="https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf">
	 The composer install command running inside a git/hg
	 repository which has specially crafted branch names can
	 lead to command injection. So this requires cloning
	 untrusted repositories.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-35241</cvename>
 <url>https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c</url>
 <cvename>CVE-2024-35242</cvename>
 <url>https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf</url>
 </references>
 <dates>
 <discovery>2024-06-10</discovery>
 <entry>2024-06-10</entry>
 </dates>
 </vuln>

<vuln vid="91929399-249e-11ef-9296-b42e991fc52e">
 <topic>kanboard -- Project Takeover via IDOR in ProjectPermissionController</topic>
 <affects>
 <package>
	<name>kanboard</name>
	<range><lt>1.2.37</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/kanboard/kanboard/commit/b6703688aac8187f5ea4d4d704fc7afeeffeafa7">
	 Kanboard is project management software that focuses on the Kanban
	methodology. The vuln is in app/Controller/ProjectPermissionController.php
	function addUser(). The users permission to add users to a project
	only get checked on the URL parameter project_id. If the user is
	authorized to add users to this project the request gets processed.
	The users permission for the POST BODY parameter project_id does
	not get checked again while processing. An attacker with the
	'Project Manager' on a single project may take over any
	other project. The vulnerability is fixed in 1.2.37.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-36399</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-36399</url>
 </references>
 <dates>
 <discovery>2024-06-06</discovery>
 <entry>2024-06-07</entry>
 </dates>
 </vuln>

<vuln vid="14908bda-232b-11ef-b621-00155d645102">
 <topic>cyrus-imapd -- unbounded memory allocation</topic>
 <affects>
 <package>
	<name>cyrus-imapd38</name>
	<range><lt>3.8.2_1</lt></range>
 </package>
 <package>
	<name>cyrus-imapd36</name>
	<range><lt>3.6.4_1</lt></range>
 </package>
 <package>
	<name>cyrus-imapd34</name>
	<range><lt>3.4.7_1</lt></range>
 </package>
 <package>
	<name>cyrus-imapd32</name>
	<name>cyrus-imapd30</name>
	<name>cyrus-imapd25</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cyrus IMAP 3.8.3 Release Notes states:
	<blockquote cite="https://www.cyrusimap.org/3.8/imap/download/release-notes/3.8/x/3.8.3.html">
	 Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.
	 The IMAP protocol allows for command arguments to be LITERALs of negotiated length, and for these the server allocates memory to receive the content before instructing the client to proceed. The allocated memory is released when the whole command has been received and processed.
	 The IMAP protocol has a number commands that specify an unlimited number of arguments, for example SEARCH. Each of these arguments can be a LITERAL, for which memory will be allocated and not released until the entire command has been received and processed. This can run a server out of memory, with varying consequences depending on the server's OOM policy.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-34055</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34055</url>
 </references>
 <dates>
 <discovery>2024-04-30</discovery>
 <entry>2024-06-05</entry>
 </dates>
 </vuln>

<vuln vid="b058380e-21a4-11ef-8a0f-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>125.0.6422.141</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>125.0.6422.141</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_30.html">
	 This update includes 11 security fixes:
	 <ul>
	 <li>[339877165] High CVE-2024-5493: Heap buffer overflow in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2024-05-11</li>
	 <li>[338071106] High CVE-2024-5494: Use after free in Dawn. Reported by wgslfuzz on 2024-05-01</li>
	 <li>[338103465] High CVE-2024-5495: Use after free in Dawn. Reported by wgslfuzz on 2024-05-01</li>
	 <li>[338929744] High CVE-2024-5496: Use after free in Media Session. Reported by Cassidy Kim(@cassidy6564) on 2024-05-06</li>
	 <li>[339061099] High CVE-2024-5497: Out of bounds memory access in Keyboard Inputs. Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab on 2024-05-07</li>
	 <li>[339588211] High CVE-2024-5498: Use after free in Presentation API. Reported by anymous on 2024-05-09</li>
	 <li>[339877167] High CVE-2024-5499: Out of bounds write in Streams API. Reported by anonymous on 2024-05-11</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-5493</cvename>
 <cvename>CVE-2024-5494</cvename>
 <cvename>CVE-2024-5495</cvename>
 <cvename>CVE-2024-5496</cvename>
 <cvename>CVE-2024-5497</cvename>
 <cvename>CVE-2024-5498</cvename>
 <cvename>CVE-2024-5499</cvename>
 <url>https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_30.html</url>
 </references>
 <dates>
 <discovery>2024-05-30</discovery>
 <entry>2024-06-03</entry>
 </dates>
 </vuln>

<vuln vid="320a19f7-1ddd-11ef-a2ae-8c164567ca3c">
 <topic>nginx -- Multiple Vulnerabilities in HTTP/3</topic>
 <affects>
 <package>
	<name>nginx-devel</name>
	<range><ge>1.25.0</ge><lt>1.27.0</lt></range>
 </package>
 <package>
	<name>nginx</name>
	<range><ge>1.26.0</ge><lt>1.26.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The nginx development team reports:
	<blockquote cite="http://nginx.org/en/security_advisories.html">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Stack overflow and use-after-free in HTTP/3</li>
	 <li>Buffer overwrite in HTTP/3</li>
	 <li>Memory disclosure in HTTP/3</li>
	 <li>NULL pointer dereference in HTTP/3</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-31079</cvename>
 <cvename>CVE-2024-32760</cvename>
 <cvename>CVE-2024-34161</cvename>
 <cvename>CVE-2024-35200</cvename>
 </references>
 <dates>
 <discovery>2024-05-29</discovery>
 <entry>2024-05-29</entry>
 </dates>
 </vuln>

<vuln vid="6926d038-1db4-11ef-9f97-a8a1599412c6">
 <topic>chromium -- security fix</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>125.0.6422.112</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>125.0.6422.112</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_23.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[341663589] High CVE-2024-5274: Type Confusion in V8. Reported by Clément Lecigne of Google's Threat Analysis Group and Brendon Tiszka of Chrome Security on 2024-05-20</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-5274</cvename>
 <url>https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_23.html</url>
 </references>
 <dates>
 <discovery>2024-05-23</discovery>
 <entry>2024-05-29</entry>
 </dates>
 </vuln>

<vuln vid="73a697d7-1d0f-11ef-a490-84a93843eb75">
 <topic>OpenSSL -- Use after free vulnerability</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>3.0.13_5,1</lt></range>
 </package>
 <package>
	<name>openssl31</name>
	<range><lt>3.1.5_5</lt></range>
 </package>
 <package>
	<name>openssl32</name>
	<range><lt>3.2.1_5</lt></range>
 </package>
 <package>
	<name>openssl33</name>
	<range><lt>3.3.0_2</lt></range>
 </package>
 <package>
	<name>openssl-quictls</name>
	<range><lt>3.0.13_5</lt></range>
 </package>
 <package>
	<name>openssl31-quictls</name>
	<range><lt>3.1.5_5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20240528.txt">
	 Use After Free with SSL_free_buffers (low).
	 Calling the OpenSSL API function SSL_free_buffers may cause
	 memory to be accessed that was previously freed in some situations
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-4741</cvename>
 <url>https://www.openssl.org/news/secadv/20240528.txt</url>
 </references>
 <dates>
 <discovery>2024-05-28</discovery>
 <entry>2024-05-28</entry>
 </dates>
 </vuln>

<vuln vid="04e78f32-04b2-4c23-bfae-72600842d317">
 <topic>electron29 -- use after free in Dawn</topic>
 <affects>
 <package>
	<name>electron29</name>
	<range><lt>29.4.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v29.4.1">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2024-4948.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-4948</cvename>
 <url>https://github.com/advisories/GHSA-xvp9-87cv-m4fv</url>
 </references>
 <dates>
 <discovery>2024-05-22</discovery>
 <entry>2024-05-25</entry>
 </dates>
 </vuln>

<vuln vid="43d1c381-a3e5-4a1d-b3ed-f37b61a451af">
 <topic>electron28 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron28</name>
	<range><lt>28.3.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v28.3.2">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-4948.</li>
	 <li>Security: backported fix for CVE-2024-3914.</li>
	 <li>Security: backported fix for CVE-2024-4060.</li>
	 <li>Security: backported fix for CVE-2024-4058.</li>
	 <li>Security: backported fix for CVE-2024-4558.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-4948</cvename>
 <url>https://github.com/advisories/GHSA-xvp9-87cv-m4fv</url>
 <cvename>CVE-2024-3914</cvename>
 <url>https://github.com/advisories/GHSA-jv87-hfr8-8j2r</url>
 <cvename>CVE-2024-4060</cvename>
 <url>https://github.com/advisories/GHSA-4qw6-vwc8-mh38</url>
 <cvename>CVE-2024-4058</cvename>
 <url>https://github.com/advisories/GHSA-23rw-79p3-xgcm</url>
 <cvename>CVE-2024-4558</cvename>
 <url>https://github.com/advisories/GHSA-r4j8-j63p-24j8</url>
 </references>
 <dates>
 <discovery>2024-05-22</discovery>
 <entry>2024-05-25</entry>
 </dates>
 </vuln>

<vuln vid="f5fa174d-19de-11ef-83d8-4ccc6adda413">
 <topic>QtNetworkAuth -- predictable seeding of PRNG in QAbstractOAuth</topic>
 <affects>
 <package>
	<name>qt5-networkauth</name>
	<range><lt>5.15.13_1</lt></range>
 </package>
 <package>
	<name>qt6-networkauth</name>
	<range><lt>6.7.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Andy Shaw reports:
	<blockquote cite="https://www.qt.io/blog/security-advisory-qstringconverter-0">
	 The OAuth1 implementation in QtNetworkAuth created nonces using
	 a PRNG that was seeded with a predictable seed.
	 This means that an attacker that can somehow control the time of
	 the first OAuth1 flow of the process has a high chance of predicting
	 the nonce used in said OAuth flow.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-36048</cvename>
 <url>https://www.qt.io/blog/security-advisory-qstringconverter-0</url>
 <url>https://codereview.qt-project.org/c/qt/qtnetworkauth/+/560317</url>
 </references>
 <dates>
 <discovery>2024-05-08</discovery>
 <entry>2024-05-24</entry>
 </dates>
 </vuln>

<vuln vid="f848ef90-1848-11ef-9850-001b217b3468">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>17.0.0</ge><lt>17.0.1</lt></range>
	<range><ge>16.11.0</ge><lt>16.11.3</lt></range>
	<range><ge>11.11</ge><lt>16.10.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/05/22/patch-release-gitlab-17-0-1-released/">
	 1-click account takeover via XSS in the code editor in gitlab.com
	 A DOS vulnerability in the 'description' field of the runner
	 CSRF via K8s cluster-integration
	 Using Set Pipeline Status of a Commit API incorrectly create a new pipeline when SHA and pipeline_id did not match
	 Redos on wiki render API/Page
	 Resource exhaustion and denial of service with test_report API calls
	 Guest user can view dependency lists of private projects through job artifacts
	 Stored XSS via PDFjs
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-4835</cvename>
 <cvename>CVE-2024-2874</cvename>
 <cvename>CVE-2023-7045</cvename>
 <cvename>CVE-2023-6502</cvename>
 <cvename>CVE-2024-1947</cvename>
 <cvename>CVE-2024-4367</cvename>
 <url>https://about.gitlab.com/releases/2024/05/22/patch-release-gitlab-17-0-1-released/</url>
 </references>
 <dates>
 <discovery>2024-05-22</discovery>
 <entry>2024-05-22</entry>
 </dates>
 </vuln>

<vuln vid="8247af0d-183b-11ef-9f97-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>125.0.6422.76</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>125.0.6422.76</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_21.html">
	 This update includes 15 security fixes:
	 <ul>
	 <li>[336012573] High CVE-2024-5157: Use after free in Scheduling. Reported by Looben Yang on 2024-04-21</li>
	 <li>[338908243] High CVE-2024-5158: Type Confusion in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2024-05-06</li>
	 <li>[335613092] High CVE-2024-5159: Heap buffer overflow in ANGLE. Reported by David Sievers (@loknop) on 2024-04-18</li>
	 <li>[338161969] High CVE-2024-5160: Heap buffer overflow in Dawn. Reported by wgslfuzz on 2024-05-01</li>
	 <li>[340221135] High CVE-2024-4947: Type Confusion in V8. Reported by Vasily Berdnikov (@vaber_b) and Boris Larin (@oct0xor) of Kaspersky on 2024-05-13</li>
	 <li>[333414294] High CVE-2024-4948: Use after free in Dawn. Reported by wgslfuzz on 2024-04-09</li>
	 <li>[326607001] Medium CVE-2024-4949: Use after free in V8. Reported by Ganjiang Zhou(@refrain_areu) of ChaMd5-H1 team on 2024-02-24</li>
	 <li>[40065403] Low CVE-2024-4950: Inappropriate implementation in Downloads. Reported by Shaheen Fazim on 2023-06-06</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-5157</cvename>
 <cvename>CVE-2024-5158</cvename>
 <cvename>CVE-2024-5159</cvename>
 <cvename>CVE-2024-5160</cvename>
 <cvename>CVE-2024-4947</cvename>
 <cvename>CVE-2024-4948</cvename>
 <cvename>CVE-2024-4949</cvename>
 <cvename>CVE-2024-4950</cvename>
 <url>https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_21.html</url>
 </references>
 <dates>
 <discovery>2024-05-21</discovery>
 <entry>2024-05-22</entry>
 </dates>
 </vuln>

<vuln vid="9bcff2c4-1779-11ef-b489-b42e991fc52e">
 <topic>Openfire administration console authentication bypass</topic>
 <affects>
 <package>
	<name>openfire</name>
	<range><lt>4.6.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="http://packetstormsecurity.com/files/173607/Openfire-Authentication-Bypass-Remote-Code-Execution.html">
	 Openfire's administrative console, a web-based
	application, was found to be vulnerable to a path traversal attack
	via the setup environment. This permitted an unauthenticated user
	to use the unauthenticated Openfire Setup Environment in an already
	configured Openfire environment to access restricted pages in the
	Openfire Admin Console reserved for administrative users. This
	vulnerability affects all versions of Openfire that have been
	released since April 2015, starting with version 3.10.0. The problem
	has been patched in Openfire release 4.7.5 and 4.6.8, and further
	improvements will be included in the yet-to-be released first version
	on the 4.8 branch (which is expected to be version 4.8.0). Users
	are advised to upgrade. If an Openfire upgrade isnt available for
	a specific release, or isnt quickly actionable, users may see the
	linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-32315</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-32315</url>
 </references>
 <dates>
 <discovery>2023-05-26</discovery>
 <entry>2024-05-21</entry>
 </dates>
 </vuln>

<vuln vid="e020b0fd-1751-11ef-a490-84a93843eb75">
 <topic>Roundcube -- Cross-site scripting vulnerabilities</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><lt>1.6.7,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Roundcube project reports:
	<blockquote cite="https://roundcube.net/news/2024/05/19/security-updates-1.6.7-and-1.5.7">
	 cross-site scripting (XSS) vulnerability in handling SVG
	 animate attributes.
	 cross-site scripting (XSS) vulnerability in handling list
	 columns from user preferences.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://roundcube.net/news/2024/05/19/security-updates-1.6.7-and-1.5.7</url>
 </references>
 <dates>
 <discovery>2024-05-19</discovery>
 <entry>2024-05-21</entry>
 </dates>
 </vuln>

<vuln vid="d58455cc-159e-11ef-83d8-4ccc6adda413">
 <topic>qt5-webengine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>qt5-webengine</name>
	<range><lt>5.15.16.p9_2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based">
	 Backports for 2 security bugs in Chromium:
	 <ul>
	 <li>CVE-2024-3157: Out of bounds write in Compositing</li>
	 <li>CVE-2024-3516: Heap buffer overflow in ANGLE</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-3157</cvename>
 <cvename>CVE-2024-3516</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based</url>
 </references>
 <dates>
 <discovery>2024-04-16</discovery>
 <entry>2024-05-19</entry>
 </dates>
 </vuln>

<vuln vid="f393b5a7-1535-11ef-8064-c5610a6efffb">
 <topic>Arti -- Security issues related to circuit construction</topic>
 <affects>
 <package>
	<name>arti</name>
	<range><lt>1.2.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Tor Project reports:
	<blockquote cite="https://blog.torproject.org/arti_1_2_3_released/">
		
			When building anonymizing circuits to or from an onion
			service with 'lite' vanguards (the default) enabled, the
			circuit manager code would build the circuits with one
			hop too few.
		
		
			When 'full' vanguards are enabled, some circuits are
			supposed to be built with an extra hop to minimize the
			linkability of the guard nodes. In some circumstances,
			the circuit manager would build circuits with one hop
			too few, making it easier for an adversary to discover
			the L2 and L3 guards of the affected clients and
			services.
		
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-35313</cvename>
 <url>https://gitlab.torproject.org/tpo/core/arti/-/issues/1400</url>
 <cvename>CVE-2024-35312</cvename>
 <url>https://gitlab.torproject.org/tpo/core/arti/-/issues/1409</url>
 </references>
 <dates>
 <discovery>2024-05-14</discovery>
 <entry>2024-05-18</entry>
 </dates>
 </vuln>

<vuln vid="b88aa380-1442-11ef-a490-84a93843eb75">
 <topic>OpenSSL -- Denial of Service vulnerability</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>3.0.13_4,1</lt></range>
 </package>
 <package>
	<name>openssl31</name>
	<range><lt>3.1.5_4</lt></range>
 </package>
 <package>
	<name>openssl32</name>
	<range><lt>3.2.1_4</lt></range>
 </package>
 <package>
	<name>openssl33</name>
	<range><lt>3.3.0_1</lt></range>
 </package>
 <package>
	<name>openssl-quictls</name>
	<range><lt>3.0.13_4</lt></range>
 </package>
 <package>
	<name>openssl31-quictls</name>
	<range><lt>3.1.5_4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20240516.txt">
	 Excessive time spent checking DSA keys and parameters (Low)
	 Checking excessively long DSA keys or parameters may be very
	 slow.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-4603</cvename>
 <url>https://www.openssl.org/news/secadv/20240516.txt</url>
 </references>
 <dates>
 <discovery>2024-05-16</discovery>
 <entry>2024-05-17</entry>
 </dates>
 </vuln>

<vuln vid="a431676c-f86c-4371-b48a-b7d2b0bec3a3">
 <topic>electron29 -- setuid() does not affect libuv's internal io_uring</topic>
 <affects>
 <package>
	<name>electron29</name>
	<range><lt>29.4.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v29.4.0">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Backported fix for CVE-2024-22017.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-22017</cvename>
 <url>https://github.com/advisories/GHSA-vr4q-vx84-9g5x</url>
 </references>
 <dates>
 <discovery>2024-05-15</discovery>
 <entry>2024-05-17</entry>
 </dates>
 </vuln>

<vuln vid="c6f03ea6-12de-11ef-83d8-4ccc6adda413">
 <topic>qt6-webengine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>qt6-webengine</name>
	<range><lt>6.7.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Qt qtwebengine-chromium repo reports:
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based">
	 Backports for 16 security bugs in Chromium:
	 <ul>
	 <li>CVE-2024-2625: Object lifecycle issue in V8</li>
	 <li>CVE-2024-2626: Out of bounds read in Swiftshader</li>
	 <li>CVE-2024-2885: Use after free in Dawn</li>
	 <li>CVE-2024-2887: Type Confusion in WebAssembly</li>
	 <li>CVE-2024-3157: Out of bounds write in Compositing</li>
	 <li>CVE-2024-3159: Out of bounds memory access in V8</li>
	 <li>CVE-2024-3516: Heap buffer overflow in ANGLE</li>
	 <li>CVE-2024-3837: Use after free in QUIC</li>
	 <li>CVE-2024-3839: Out of bounds read in Fonts</li>
	 <li>CVE-2024-3914: Use after free in V8</li>
	 <li>CVE-2024-3840: Insufficient policy enforcement in Site Isolation</li>
	 <li>CVE-2024-4058: Type Confusion in ANGLE</li>
	 <li>CVE-2024-4060: Use after free in Dawn</li>
	 <li>CVE-2024-4331: Use after free in Picture In Picture</li>
	 <li>CVE-2024-4368: Use after free in Dawn</li>
	 <li>CVE-2024-4671: Use after free in Visuals</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-2625</cvename>
 <cvename>CVE-2024-2626</cvename>
 <cvename>CVE-2024-2885</cvename>
 <cvename>CVE-2024-2887</cvename>
 <cvename>CVE-2024-3157</cvename>
 <cvename>CVE-2024-3159</cvename>
 <cvename>CVE-2024-3516</cvename>
 <cvename>CVE-2024-3837</cvename>
 <cvename>CVE-2024-3839</cvename>
 <cvename>CVE-2024-3914</cvename>
 <cvename>CVE-2024-3840</cvename>
 <cvename>CVE-2024-4058</cvename>
 <cvename>CVE-2024-4060</cvename>
 <cvename>CVE-2024-4331</cvename>
 <cvename>CVE-2024-4368</cvename>
 <cvename>CVE-2024-4671</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based</url>
 </references>
 <dates>
 <discovery>2024-04-03</discovery>
 <entry>2024-05-15</entry>
 </dates>
 </vuln>

<vuln vid="e79cc4e2-12d7-11ef-83d8-4ccc6adda413">
 <topic>qt6-base (core module) -- Invalid pointer in QStringConverter</topic>
 <affects>
 <package>
	<name>qt6-base</name>
	<range><ge>6.5.0</ge><le>6.5.5</le></range>
	<range><ge>6.6.0</ge><lt>6.7.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Andy Shaw reports:
	<blockquote cite="https://www.qt.io/blog/security-advisory-qstringconverter">
	 QStringConverter has an invalid pointer being passed as a callback
	 which can allow modification of the stack. Qt itself is not vulnerable
	 to remote attack however an application using QStringDecoder either
	 directly or indirectly can be vulnerable.
	 This requires:
	 <ol>
	 <li>the attacker be able to tell the application a specific codec to use</li>
	 <li>the attacker be able to feed the application data in a specific way to cause the desired modification</li>
	 <li>the attacker what in the stack will get modified, which requires knowing the build of the application (and not all builds will be vulnerable)</li>
	 <li>the modification do anything in particular that is useful to the attacker, besides maybe crashing the application</li>
	 </ol>
	 Qt does not automatically use any of those codecs, so this needs the application
	 to implement something using QStringDecoder to be vulnerable.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-33861</cvename>
 <url>https://www.qt.io/blog/security-advisory-qstringconverter</url>
 </references>
 <dates>
 <discovery>2024-05-02</discovery>
 <entry>2024-05-15</entry>
 </dates>
 </vuln>

<vuln vid="f2d8342f-1134-11ef-8791-6805ca2fa271">
 <topic>dnsdist -- Transfer requests received over DoH can lead to a denial of service</topic>
 <affects>
 <package>
	<name>dnsdist</name>
	<range><lt>1.9.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Security Advisory reports:
	<blockquote cite="https://dnsdist.org/security-advisories/index.html">
	 When incoming DNS over HTTPS support is enabled using the nghttp2 provider,
	 and queries are routed to a tcp-only or DNS over TLS backend, an attacker can
	 trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXFR
	 or IXFR) over DNS over HTTPS, causing the process to stop and thus leading to a
	 Denial of Service. DNS over HTTPS is not enabled by default, and backends are using
	 plain DNS (Do53) by default.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-25581</cvename>
 <url>https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2024-03.html</url>
 </references>
 <dates>
 <discovery>2024-05-13</discovery>
 <entry>2024-05-13</entry>
 </dates>
 </vuln>

<vuln vid="5afd64ae-122a-11ef-8eed-1c697a616631">
 <topic>Intel CPUs -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cpu-microcode-intel</name>
	<range><lt>20240514</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Intel reports:
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01036.html">
	 
	 Potential security vulnerabilities in some Intel Trust Domain
	 Extensions (TDX) module software may allow escalation of
	 privilege. Improper input validation in some Intel TDX module
	 software before version 1.5.05.46.698 may allow a privileged user to
	 potentially enable escalation of privilege via local access. Intel
	 is releasing firmware updates to mitigate these potential
	 vulnerabilities.
	 
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01051.html">
	 
	 A potential security vulnerability in some Intel Processors may
	 allow information disclosure. Hardware logic contains race
	 conditions in some Intel Processors that may allow an authenticated
	 user to potentially enable partial information disclosure via local
	 access. Intel is releasing microcode updates to mitigate this
	 potential vulnerability.
	 
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01052.html">
	 
	 A potential security vulnerability in Intel Core Ultra Processors
	 may allow denial of service. Sequence of processor instructions
	 leads to unexpected behavior in Intel Core Ultra Processors may
	 allow an authenticated user to potentially enable denial of service
	 via local access. Intel is releasing microcode updates to mitigate
	 this potential vulnerability.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-45745</cvename>
 <cvename>CVE-2023-45733</cvename>
 <cvename>CVE-2023-46103</cvename>
 <url>https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20240514</url>
 </references>
 <dates>
 <discovery>2024-05-14</discovery>
 <entry>2024-05-14</entry>
 </dates>
 </vuln>

<vuln vid="8e0e8b56-11c6-11ef-9f97-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>124.0.6367.207</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>124.0.6367.207</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[339458194] High CVE-2024-4761: Out of bounds write in V8. Reported by Anonymous on 2024-05-09</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-4761</cvename>
 <url>https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html</url>
 </references>
 <dates>
 <discovery>2024-05-13</discovery>
 <entry>2024-05-14</entry>
 </dates>
 </vuln>

<vuln vid="d3847eba-114b-11ef-9c21-901b0e9408dc">
 <topic>go -- net: malformed DNS message can cause infinite loop</topic>
 <affects>
 <package>
	<name>go122</name>
	<range><lt>1.22.3</lt></range>
 </package>
 <package>
	<name>go121</name>
	<range><lt>1.21.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/66754">
	 net: malformed DNS message can cause infinite loop
	 A malformed DNS message in response to a query can cause
	 the Lookup functions to get stuck in an infinite loop.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-24788</cvename>
 <url>https://go.dev/issue/66754</url>
 </references>
 <dates>
 <discovery>2024-04-25</discovery>
 <entry>2024-05-13</entry>
 </dates>
 </vuln>

<vuln vid="3cf8ea44-1029-11ef-9f97-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>124.0.6367.201</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>124.0.6367.201</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[339266700] High CVE-2024-4671: Use after free in Visuals. Reported by Anonymous on 2024-05-07</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-4671</cvename>
 <url>https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.html</url>
 </references>
 <dates>
 <discovery>2024-05-09</discovery>
 <entry>2024-05-12</entry>
 </dates>
 </vuln>

<vuln vid="d53c30c1-0d7b-11ef-ba02-6cc21735f730">
 <topic>PostgreSQL server -- Potentially allowing authenicated database users to see data that they shouldn't.</topic>
 <affects>
 <package>
	<name>postgresql-server</name>
	<range><lt>16.3</lt></range>
	<range><lt>15.7</lt></range>
	<range><lt>14.12</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2024-4317/">
	 
	 A security vulnerability was found in the system views pg_stats_ext
	 and pg_stats_ext_exprs, potentially allowing authenticated database
	 users to see data they shouldn't. If this is of concern in your
	 installation, run the SQL script /usr/local/share/postgresql/fix-CVE-2024-4317.sql
	 for each of your databases. See the link for details.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-4317</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2024-4317/</url>
 </references>
 <dates>
 <discovery>2024-05-09</discovery>
 <entry>2024-05-09</entry>
 </dates>
 </vuln>

<vuln vid="ee6936da-0ddd-11ef-9c21-901b0e9408dc">
 <topic>tailscale -- Insufficient inbound packet filtering in subnet routers and exit nodes</topic>
 <affects>
 <package>
	<name>tailscale</name>
	<range><lt>1.66.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Tailscale team reports:
	<blockquote cite="https://tailscale.com/security-bulletins#ts-2024-005">
	 In Tailscale versions earlier than 1.66.0, exit nodes,
	 subnet routers, and app connectors, could allow inbound
	 connections to other tailnet nodes from their local area
	 network (LAN). This vulnerability only affects Linux exit
	 nodes, subnet routers, and app connectors in tailnets where
	 ACLs allow "src": "*", such as with default ACLs.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://tailscale.com/security-bulletins#ts-2024-005</url>
 </references>
 <dates>
 <discovery>2024-05-08</discovery>
 <entry>2024-05-09</entry>
 </dates>
 </vuln>

<vuln vid="ec994672-5284-49a5-a7fc-93c02126e5fb">
 <topic>electron29 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron29</name>
	<range><lt>29.3.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v29.3.3">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-3914.</li>
	 <li>Security: backported fix for CVE-2024-4558.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-3914</cvename>
 <url>https://github.com/advisories/GHSA-jv87-hfr8-8j2r</url>
 <cvename>CVE-2024-4558</cvename>
 <url>https://github.com/advisories/GHSA-r4j8-j63p-24j8</url>
 </references>
 <dates>
 <discovery>2024-05-09</discovery>
 <entry>2024-05-09</entry>
 </dates>
 </vuln>

<vuln vid="fbc2c629-0dc5-11ef-9850-001b217b3468">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>16.11.0</ge><lt>16.11.2</lt></range>
	<range><ge>16.10.0</ge><lt>16.10.5</lt></range>
	<range><ge>10.6.0</ge><lt>16.9.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/05/08/patch-release-gitlab-16-11-2-released/">
	 ReDoS in branch search when using wildcards
	 ReDoS in markdown render pipeline
	 Redos on Discord integrations
	 Redos on Google Chat Integration
	 Denial of Service Attack via Pin Menu
	 DoS by filtering tags and branches via the API
	 MR approval via CSRF in SAML SSO
	 Banned user from groups can read issues updates via the api
	 Require confirmation before linking JWT identity
	 View confidential issues title and description of any public project via export
	 SSRF via Github importer
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-2878</cvename>
 <cvename>CVE-2024-2651</cvename>
 <cvename>CVE-2023-6682</cvename>
 <cvename>CVE-2023-6688</cvename>
 <cvename>CVE-2024-2454</cvename>
 <cvename>CVE-2024-4539</cvename>
 <cvename>CVE-2024-4597</cvename>
 <cvename>CVE-2024-1539</cvename>
 <cvename>CVE-2024-1211</cvename>
 <cvename>CVE-2024-3976</cvename>
 <cvename>CVE-2023-6195</cvename>
 <url>https://about.gitlab.com/releases/2024/05/08/patch-release-gitlab-16-11-2-released/</url>
 </references>
 <dates>
 <discovery>2024-05-08</discovery>
 <entry>2024-05-09</entry>
 </dates>
 </vuln>

<vuln vid="059a99a9-45e0-492b-b9f9-5a79573c8eb6">
 <topic>electron29 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron29</name>
	<range><lt>29.3.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v29.3.2">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-4060.</li>
	 <li>Security: backported fix for CVE-2024-4058.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-4060</cvename>
 <url>https://github.com/advisories/GHSA-4qw6-vwc8-mh38</url>
 <cvename>CVE-2024-4058</cvename>
 <url>https://github.com/advisories/GHSA-23rw-79p3-xgcm</url>
 </references>
 <dates>
 <discovery>2024-05-03</discovery>
 <entry>2024-05-08</entry>
 </dates>
 </vuln>

<vuln vid="f69415aa-086e-11ef-9f97-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>124.0.6367.118</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>124.0.6367.118</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_30.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[335003891] High CVE-2024-4331: Use after free in Picture In Picture. Reported by Zhenghang Xiao (@Kipreyyy) on 2024-04-16</li>
	 <li>[333508731] High CVE-2024-4368: Use after free in Dawn. Reported by wgslfuzz on 2024-04-09</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-4058</cvename>
 <cvename>CVE-2024-4059</cvename>
 <cvename>CVE-2024-4060</cvename>
 <url>https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_30.html</url>
 </references>
 <dates>
 <discovery>2024-04-30</discovery>
 <entry>2024-05-02</entry>
 </dates>
 </vuln>

<vuln vid="4a1e2bad-0836-11ef-9fd2-1c697a616631">
 <topic>R -- arbitrary code execution vulnerability</topic>
 <affects>
 <package>
	<name>R</name>
	<range><lt>4.4.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	HiddenLayer Research reports:
	<blockquote cite="https://hiddenlayer.com/research/r-bitrary-code-execution/">
	 Deserialization of untrusted data can occur in the R statistical programming language, enabling a maliciously crafted RDS (R Data Serialization) formatted file or R package to run arbitrary code on an end user's system.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-27322</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-27322</url>
 </references>
 <dates>
 <discovery>2024-04-29</discovery>
 <entry>2024-05-02</entry>
 </dates>
 </vuln>

<vuln vid="da4adc02-07f4-11ef-960d-5404a68ad561">
 <topic>hcode -- buffer overflow in mail.c</topic>
 <affects>
 <package>
	<name>ko-hcode</name>
	<range><lt>2.1.3_2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The openSUSE project reports:
	<blockquote cite="https://bugzilla.suse.com/show_bug.cgi?id=1223534">
	 The problematic function in question is putSDN() in mail.c. The static variable `cp` is used as an index for a fixed-sized buffer `ibuf`. There is a range check: `if ( cp &gt;= HDR_BUF_LEN ) ...` but under certain circumstances, cp can be incremented beyond the buffer size, leading to a buffer overwrite
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-34020</cvename>
 <url>https://bugzilla.suse.com/show_bug.cgi?id=1223534</url>
 </references>
 <dates>
 <discovery>2024-04-29</discovery>
 <entry>2024-05-01</entry>
 </dates>
 </vuln>

<vuln vid="5da8b1e6-0591-11ef-9e00-080027957747">
 <topic>GLPI -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>10.0.15,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	GLPI team reports:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.15">
	 GLPI 10.0.15 Changelog
	 <ul>
	 <li>[SECURITY - high] Authenticated SQL injection from map search (CVE-2024-31456)</li>
	 <li>[SECURITY - high] Account takeover via SQL Injection in saved searches feature (CVE-2024-29889)</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-31456</cvename>
 <cvename>CVE-2024-29889</cvename>
 <url>https://github.com/glpi-project/glpi/releases/tag/10.0.15</url>
 </references>
 <dates>
 <discovery>2024-04-03</discovery>
 <entry>2024-04-28</entry>
 </dates>
 </vuln>

<vuln vid="b3affee8-04d1-11ef-8928-901b0ef714d4">
 <topic>py-social-auth-app-django -- Improper Handling of Case Sensitivity</topic>
 <affects>
 <package>
	<name>py38-social-auth-app-django</name>
	<name>py39-social-auth-app-django</name>
	<name>py310-social-auth-app-django</name>
	<name>py311-social-auth-app-django</name>
	<range><lt>5.4.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	GitHub Advisory Database:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2024-32879">
	 Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected field.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-32879</cvename>
 <url>https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-2gr8-3wc7-xhj3</url>
 </references>
 <dates>
 <discovery>2024-04-24</discovery>
 <entry>2024-04-28</entry>
 </dates>
 </vuln>

<vuln vid="7a42852d-0347-11ef-9f97-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>124.0.6367.78</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>124.0.6367.78</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_24.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[332546345] Critical CVE-2024-4058: Type Confusion in ANGLE. Reported by Toan (suto) Pham and Bao (zx) Pham of Qrious Secure on 2024-04-02</li>
	 <li>[333182464] High CVE-2024-4059: Out of bounds read in V8 API. Reported by Eirik on 2024-04-08</li>
	 <li>[333420620] High CVE-2024-4060: Use after free in Dawn. Reported by wgslfuzz on 2024-04-09</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-4058</cvename>
 <cvename>CVE-2024-4059</cvename>
 <cvename>CVE-2024-4060</cvename>
 <url>https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_24.html</url>
 </references>
 <dates>
 <discovery>2024-04-24</discovery>
 <entry>2024-04-25</entry>
 </dates>
 </vuln>

<vuln vid="10e86b16-6836-11ee-b06f-0050569ceb3a">
 <topic>Unallowed PHP script execution in GLPI</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>10.0.10,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	From the GLPI 10.0.10 Changelog:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.10">
	You will find below security issues fixed in this bugfixes version:
	[SECURITY - Critical] Unallowed PHP script execution (CVE-2023-42802).
	</blockquote>
	The mentioned CVE is invalid
	</body>
 </description>
 <references>
 <cvename>CVE-2023-42802</cvename>
 <url>https://github.com/glpi-project/glpi/releases/tag/10.0.10</url>
 </references>
 <dates>
 <discovery>2023-09-27</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="894f2491-6834-11ee-b06f-0050569ceb3a">
 <topic>glpi-project -- SQL injection in ITIL actors in GLPI</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>10.0.8,1</ge><lt>10.0.10,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-x3jp-69f2-p84w">
	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
	Asset and IT Management Software package, that provides ITIL Service
	Desk features, licenses tracking and software auditing. The ITIL
	actors input field from the Ticket form can be used to perform a
	SQL injection. Users are advised to upgrade to version 10.0.10.
	There are no known workarounds for this vulnerability.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-42461</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-42461</url>
 </references>
 <dates>
 <discovery>2023-09-27</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="54e5573a-6834-11ee-b06f-0050569ceb3a">
 <topic>Phishing through a login page malicious URL in GLPI</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>10.0.8,1</ge><lt>10.0.10,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-2hcg-75jj-hghp">
	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
	Asset and IT Management Software package, that provides ITIL Service
	Desk features, licenses tracking and software auditing. The lack
	of path filtering on the GLPI URL may allow an attacker to transmit
	a malicious URL of login page that can be used to attempt a phishing
	attack on user credentials. Users are advised to upgrade to version
	10.0.10. There are no known workarounds for this vulnerability.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-41888</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-41888</url>
 </references>
 <dates>
 <discovery>2023-09-27</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="20302cbc-6834-11ee-b06f-0050569ceb3a">
 <topic>Users login enumeration by unauthenticated user in GLPI</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>10.0.10,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-5cf4-6q6r-49x9">
	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
	Asset and IT Management Software package, that provides ITIL Service
	Desk features, licenses tracking and software auditing. An
	unauthenticated user can enumerate users logins. Users are advised
	to upgrade to version 10.0.10. There are no known workarounds for
	this vulnerability.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-41323</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-41323</url>
 </references>
 <dates>
 <discovery>2023-09-27</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="ae8b1445-6833-11ee-b06f-0050569ceb3a">
 <topic>Privilege Escalation from technician to super-admin in GLPI</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>9.1.0,1</ge><lt>10.0.10,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-9j8m-7563-8xvr">
	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
	Asset and IT Management Software package, that provides ITIL Service
	Desk features, licenses tracking and software auditing. A user
	with write access to another user can make requests to change the
	latter's password and then take control of their account.
	Users are advised to upgrade to version 10.0.10. There are no known
	work around for this vulnerability.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-41322</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-41322</url>
 </references>
 <dates>
 <discovery>2023-09-27</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="6851f3bb-6833-11ee-b06f-0050569ceb3a">
 <topic>Sensitive fields enumeration through API in GLPI</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>9.1.1,1</ge><lt>10.0.10,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-3fxw-j5rj-w836">
	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
	Asset and IT Management Software package, that provides ITIL Service
	Desk features, licenses tracking and software auditing. An API
	user can enumerate sensitive fields values on resources on which
	he has read access. Users are advised to upgrade to version 10.0.10.
	There are no known workarounds for this vulnerability.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-41321</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-41321</url>
 </references>
 <dates>
 <discovery>2023-09-27</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="df71f5aa-6831-11ee-b06f-0050569ceb3a">
 <topic>File deletion through document upload process in GLPI</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>10.0.0,1</ge><lt>10.0.10,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-hm76-jh96-7j75">
	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
	Asset and IT Management Software package, that provides ITIL Service
	Desk features, licenses tracking and software auditing. The document
	upload process can be diverted to delete some files. Users are
	advised to upgrade to version 10.0.10. There are no known workarounds
	for this vulnerability.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-42462</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-42462</url>
 </references>
 <dates>
 <discovery>2023-09-27</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="95c4ec45-6831-11ee-b06f-0050569ceb3a">
 <topic>Account takeover through API in GLPI</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>9.3.0,1</ge><lt>10.0.10,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-58wj-8jhx-jpm3">
	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
	Asset and IT Management Software package, that provides ITIL Service
	Desk features, licenses tracking and software auditing. An API
	user that have read access on users resource can steal accounts of
	other users. Users are advised to upgrade to version 10.0.10.
	There are no known workarounds for this vulnerability.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-41324</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-41324</url>
 </references>
 <dates>
 <discovery>2023-09-27</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="040e69f1-6831-11ee-b06f-0050569ceb3a">
 <topic>Account takeover via Kanban feature in GLPI</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>9.5.0,1</ge><lt>10.0.10,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-5wj6-hp4c-j5q9">
	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
	Asset and IT Management Software package, that provides ITIL Service
	Desk features, licenses tracking and software auditing. A logged
	user from any profile can hijack the Kanban feature to alter any
	user field, and end-up with stealing its account. Users are advised
	to upgrade to version 10.0.10. There are no known workarounds for
	this vulnerability.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-41326</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-41326</url>
 </references>
 <dates>
 <discovery>2023-09-27</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="6f6518ab-6830-11ee-b06f-0050569ceb3a">
 <topic>Account takeover via SQL Injection in UI layout preferences in GLPI</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>10.0.0,1</ge><lt>10.0.10,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-mv2r-gpw3-g476">
	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
	Asset and IT Management Software package, that provides ITIL Service
	Desk features, licenses tracking and software auditing. UI layout
	preferences management can be hijacked to lead to SQL injection.
	This injection can be use to takeover an administrator account.
	Users are advised to upgrade to version 10.0.10. There are no known
	workarounds for this vulnerability.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-41320</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-41320</url>
 </references>
 <dates>
 <discovery>2023-09-27</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="257e1bf0-682f-11ee-b06f-0050569ceb3a">
 <topic>GLPI vulnerable to SQL injection via dashboard administration</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>9.5.0,1</ge><lt>10.0.9,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.9">
	 GLPI is a Free Asset and IT Management Software package, Data center
	management, ITIL Service Desk, licenses tracking and software
	auditing. An administrator can trigger SQL injection via dashboards
	administration. This vulnerability has been patched in version
	10.0.9.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-37278</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-37278</url>
 </references>
 <dates>
 <discovery>2023-07-13</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="40173815-6827-11ee-b06f-0050569ceb3a">
 <topic>GLPI vulnerable to unauthorized access to User data</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>10.0.8,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
	 GLPI is a free asset and IT management software package. Versions
	of the software starting with 0.68 and prior to 10.0.8 have an
	incorrect rights check on a on a file accessible by an authenticated
	user. This allows access to the list of all users and their personal
	information. Users should upgrade to version 10.0.8 to receive a
	patch.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-34106</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-34106</url>
 </references>
 <dates>
 <discovery>2023-07-05</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="1fe40200-6823-11ee-b06f-0050569ceb3a">
 <topic>GLPI vulnerable to unauthorized access to KnowbaseItem data</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>9.2.0,1</ge><lt>10.0.8,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
	 GLPI is a free asset and IT management software package. Versions
	of the software starting with 9.2.0 and prior to 10.0.8 have an
	incorrect rights check on a on a file accessible by an authenticated
	user, allows access to the view all KnowbaseItems. Version 10.0.8
	has a patch for this issue.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-34107</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-34107</url>
 </references>
 <dates>
 <discovery>2023-07-05</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="b14a6ddc-6821-11ee-b06f-0050569ceb3a">
 <topic>GLPI vulnerable to reflected XSS in search pages</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>9.4.0,1</ge><lt>10.0.8,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
	 GLPI is a free asset and IT management software package. Starting
	in version 9.4.0 and prior to version 10.0.8, a malicious link can
	be crafted by an unauthenticated user that can exploit a reflected
	XSS in case any authenticated user opens the crafted link. Users
	should upgrade to version 10.0.8 to receive a patch.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-34244</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-34244</url>
 </references>
 <dates>
 <discovery>2023-07-05</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="95fde6bc-6821-11ee-b06f-0050569ceb3a">
 <topic>GLPI vulnerable to unauthenticated access to Dashboard data</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>9.5.0,1</ge><lt>10.0.8,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
	 GLPI is a free asset and IT management software package. Starting
	in version 9.5.0 and prior to version 10.0.8, an incorrect rights
	check on a file allows an unauthenticated user to be able to access
	dashboards data. Version 10.0.8 contains a patch for this issue.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-35940</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-35940</url>
 </references>
 <dates>
 <discovery>2023-07-05</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="717efd8a-6821-11ee-b06f-0050569ceb3a">
 <topic>GLPI vulnerable to unauthorized access to Dashboard data</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>9.5.0,1</ge><lt>10.0.8,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
	 GLPI is a free asset and IT management software package. Starting
	in version 9.5.0 and prior to version 10.0.8, an incorrect rights
	check on a on a file accessible by an authenticated user (or not
	for certain actions), allows a threat actor to interact, modify,
	or see Dashboard data. Version 10.0.8 contains a patch for this
	issue.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-35939</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-35939</url>
 </references>
 <dates>
 <discovery>2023-07-05</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="548a4163-6821-11ee-b06f-0050569ceb3a">
 <topic>GLPI vulnerable to SQL injection through Computer Virtual Machine information</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>10.0.8,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
	 GLPI is a free asset and IT management software package. Starting
	in version 0.80 and prior to version 10.0.8, Computer Virtual Machine
	form and GLPI inventory request can be used to perform a SQL injection
	attack. Version 10.0.8 has a patch for this issue. As a workaround,
	one may disable native inventory.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-36808</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-36808</url>
 </references>
 <dates>
 <discovery>2023-07-05</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="e44e5ace-6820-11ee-b06f-0050569ceb3a">
 <topic>GLPI vulnerable to SQL injection via inventory agent request</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>10.0.0,1</ge><lt>10.0.8,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
	 GLPI is a free asset and IT management software package. Starting
	in version 10.0.0 and prior to version 10.0.8, GLPI inventory
	endpoint can be used to drive a SQL injection attack. By default,
	GLPI inventory endpoint requires no authentication. Version 10.0.8
	has a patch for this issue. As a workaround, one may disable native
	inventory.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-35924</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-35924</url>
 </references>
 <dates>
 <discovery>2023-07-05</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="bdfa6c04-027a-11ef-9c21-901b0e9408dc">
 <topic>py-matrix-synapse -- weakness in auth chain indexing allows DoS</topic>
 <affects>
 <package>
	<name>py38-matrix-synapse</name>
	<name>py39-matrix-synapse</name>
	<name>py310-matrix-synapse</name>
	<name>py311-matrix-synapse</name>
	<range><lt>1.105.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://element.io/blog/security-release-synapse-1-105-1/">
	 Weakness in auth chain indexing allows DoS from remote
	 room members through disk fill and high CPU usage. (High severity)
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-31208</cvename>
 <url>https://element.io/blog/security-release-synapse-1-105-1/</url>
 <url>https://github.com/element-hq/synapse/security/advisories/GHSA-3h7q-rfh9-xm4v</url>
 </references>
 <dates>
 <discovery>2024-04-23</discovery>
 <entry>2024-04-24</entry>
 </dates>
 </vuln>

<vuln vid="b857606c-0266-11ef-8681-001b217b3468">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>16.11.0</ge><lt>16.11.1</lt></range>
	<range><ge>16.10.0</ge><lt>16.10.4</lt></range>
	<range><ge>7.8.0</ge><lt>16.9.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/04/24/patch-release-gitlab-16-11-1-released/">
	 GitLab account takeover, under certain conditions, when using Bitbucket as an OAuth provider
	 Path Traversal leads to DoS and Restricted File Read
	 Unauthenticated ReDoS in FileFinder when using wildcard filters in project file search
	 Personal Access Token scopes not honoured by GraphQL subscriptions
	 Domain based restrictions bypass using a crafted email address
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-4024</cvename>
 <cvename>CVE-2024-2434</cvename>
 <cvename>CVE-2024-2829</cvename>
 <cvename>CVE-2024-4006</cvename>
 <cvename>CVE-2024-1347</cvename>
 <url>https://about.gitlab.com/releases/2024/04/24/patch-release-gitlab-16-11-1-released/</url>
 </references>
 <dates>
 <discovery>2024-04-24</discovery>
 <entry>2024-04-24</entry>
 </dates>
 </vuln>

<vuln vid="1af16f2b-023c-11ef-8791-6805ca2fa271">
 <topic>powerdns-recursor -- denial of service</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><lt>5.0.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://blog.powerdns.com/2024/04/24/powerdns-recursor-4-8-8-4-9-5-5-0-4-released">
	 PowerDNS Security Advisory 2024-02: if recursive forwarding is configured,
	 crafted responses can lead to a denial of service in Recursor
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-25583</cvename>
 <url>https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-02.html</url>
 </references>
 <dates>
 <discovery>2024-04-24</discovery>
 <entry>2024-04-24</entry>
 </dates>
 </vuln>

<vuln vid="bb49f1fa-00da-11ef-92b7-589cfc023192">
 <topic>GLPI -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>10.0.13,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	GLPI team reports:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.13">
	 GLPI 10.0.13 Changelog
	 <ul>
	 <li>[SECURITY - high] SQL Injection in through the search engine (CVE-2024-27096)</li>
	 <li>[SECURITY - moderate] Blind SSRF using Arbitrary Object Instantiation (CVE-2024-27098)</li>
	 <li>[SECURITY - moderate] Stored XSS in dashboards (CVE-2024-27104)</li>
	 <li>[SECURITY - moderate] Reflected XSS in debug mode (CVE-2024-27914)</li>
	 <li>[SECURITY - moderate] Sensitive fields access through dropdowns (CVE-2024-27930)</li>
	 <li>[SECURITY - moderate] Users emails enumeration (CVE-2024-27937)</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-27096</cvename>
 <cvename>CVE-2024-27098</cvename>
 <cvename>CVE-2024-27104</cvename>
 <cvename>CVE-2024-27914</cvename>
 <cvename>CVE-2024-27930</cvename>
 <cvename>CVE-2024-27937</cvename>
 <url>https://github.com/glpi-project/glpi/releases/tag/10.0.13</url>
 </references>
 <dates>
 <discovery>2024-03-13</discovery>
 <entry>2024-04-22</entry>
 </dates>
 </vuln>

<vuln vid="faccf131-00d9-11ef-92b7-589cfc023192">
 <topic>GLPI -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>10.0.12,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	GLPI team reports:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.12">
	 GLPI 10.0.12 Changelog
	 <ul>
	 <li>[SECURITY - moderate] Reflected XSS in reports pages (CVE-2024-23645)</li>
	 <li>[SECURITY - moderate] LDAP Injection during authentication (CVE-2023-51446)</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-23645</cvename>
 <cvename>CVE-2023-51446</cvename>
 <url>https://github.com/glpi-project/glpi/releases/tag/10.0.12</url>
 </references>
 <dates>
 <discovery>2024-02-01</discovery>
 <entry>2024-04-22</entry>
 </dates>
 </vuln>

<vuln vid="ed688880-00c4-11ef-92b7-589cfc023192">
 <topic>GLPI -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>10.0.11,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	GLPI team reports:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.11">
	 GLPI 10.0.11 Changelog
	 <ul>
	 <li>[SECURITY - moderate] Authenticated SQL Injection (CVE-2023-43813)</li>
	 <li>[SECURITY - high] SQL injection through inventory agent request (CVE-2023-46727)</li>
	 <li>[SECURITY - high] Remote code execution from LDAP server configuration form on PHP 7.4 (CVE-2023-46726)</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-43813</cvename>
 <cvename>CVE-2023-46727</cvename>
 <cvename>CVE-2023-46726</cvename>
 <url>https://github.com/glpi-project/glpi/releases/tag/10.0.11</url>
 </references>
 <dates>
 <discovery>2023-12-13</discovery>
 <entry>2024-04-22</entry>
 </dates>
 </vuln>

<vuln vid="2ce1a2f1-0177-11ef-a45e-08002784c58d">
 <topic>ruby -- Arbitrary memory address read vulnerability with Regex search</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>3.1.0,1</ge><lt>3.1.5,1</lt></range>
	<range><ge>3.2.0,1</ge><lt>3.2.4,1</lt></range>
	<range><ge>3.3.0,1</ge><lt>3.3.1,1</lt></range>
 </package>
 <package>
	<name>ruby31</name>
	<range><ge>3.1.0,1</ge><lt>3.1.5,1</lt></range>
 </package>
 <package>
	<name>ruby32</name>
	<range><ge>3.2.0,1</ge><lt>3.2.4,1</lt></range>
 </package>
 <package>
	<name>ruby33</name>
	<range><ge>3.3.0,1</ge><lt>3.3.1,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	sp2ip reports:
	<blockquote cite="https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/">
	 
	 If attacker-supplied data is provided to the Ruby regex
	 compiler, it is possible to extract arbitrary heap data
	 relative to the start of the text, including pointers and
	 sensitive strings.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-27282</cvename>
 <url>https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/</url>
 </references>
 <dates>
 <discovery>2024-04-23</discovery>
 <entry>2024-04-23</entry>
 </dates>
 </vuln>

<vuln vid="304d92c3-00c5-11ef-bd52-080027bff743">
	<topic>sdl2_sound -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>sdl2_sound</name>
	<range><lt>2.0.2_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	GitHub Security Lab reports:
	<blockquote cite="https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/">
	 stb_image.h and stb_vorbis libraries contain several memory access violations of different severity
	 <ol>
		<li>Wild address read in stbi__gif_load_next (GHSL-2023-145).</li>
		<li>Multi-byte read heap buffer overflow in stbi__vertical_flip (GHSL-2023-146).</li>
		<li>Disclosure of uninitialized memory in stbi__tga_load (GHSL-2023-147).</li>
		<li>Double-free in stbi__load_gif_main_outofmem (GHSL-2023-148).</li>
		<li>Null pointer dereference in stbi__convert_format (GHSL-2023-149).</li>
		<li>Possible double-free or memory leak in stbi__load_gif_main (GHSL-2023-150).</li>
		<li>Null pointer dereference because of an uninitialized variable (GHSL-2023-151).</li>
		<li>0 byte write heap buffer overflow in start_decoder (GHSL-2023-165)</li>
		<li>Multi-byte write heap buffer overflow in start_decoder (GHSL-2023-166)</li>
		<li>Heap buffer out of bounds write in start_decoder (GHSL-2023-167)</li>
		<li>Off-by-one heap buffer write in start_decoder (GHSL-2023-168)</li>
		<li>Attempt to free an uninitialized memory pointer in vorbis_deinit (GHSL-2023-169)</li>
		<li>Null pointer dereference in vorbis_deinit (GHSL-2023-170)</li>
		<li>Out of bounds heap buffer write (GHSL-2023-171)</li>
		<li>Wild address read in vorbis_decode_packet_rest (GHSL-2023-172)</li>
	 </ol>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-45676</cvename>
 <cvename>CVE-2023-45677</cvename>
 <cvename>CVE-2023-45680</cvename>
 <cvename>CVE-2023-45681</cvename>
 <cvename>CVE-2023-45682</cvename>
	 <url>https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/</url>
 </references>
 <dates>
 <discovery>2023-10-20</discovery>
 <entry>2024-04-22</entry>
 </dates>
 </vuln>

<vuln vid="9bed230f-ffc8-11ee-8e76-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>124.0.6367.60</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>124.0.6367.60</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html">
	 This update includes 23 security fixes:
	 <ul>
	 <li>[331358160] High CVE-2024-3832: Object corruption in V8. Reported by Man Yue Mo of GitHub Security Lab on 2024-03-27</li>
	 <li>[331383939] High CVE-2024-3833: Object corruption in WebAssembly. Reported by Man Yue Mo of GitHub Security Lab on 2024-03-27</li>
	 <li>[330759272] High CVE-2024-3914: Use after free in V8. Reported by Seunghyun Lee (@0x10n) of KAIST Hacking Lab, via Pwn2Own 2024 on 2024-03-21</li>
	 <li>[326607008] High CVE-2024-3834: Use after free in Downloads. Reported by ChaobinZhang on 2024-02-24</li>
	 <li>[41491379] Medium CVE-2024-3837: Use after free in QUIC. Reported by {rotiple, dch3ck} of CW Research Inc. on 2024-01-15</li>
	 <li>[328278717] Medium CVE-2024-3838: Inappropriate implementation in Autofill. Reported by Ardyan Vicky Ramadhan on 2024-03-06</li>
	 <li>[41491859] Medium CVE-2024-3839: Out of bounds read in Fonts. Reported by Ronald Crane (Zippenhop LLC) on 2024-01-16</li>
	 <li>[41493458] Medium CVE-2024-3840: Insufficient policy enforcement in Site Isolation. Reported by Ahmed ElMasry on 2024-01-22</li>
	 <li>[330376742] Medium CVE-2024-3841: Insufficient data validation in Browser Switcher. Reported by Oleg on 2024-03-19</li>
	 <li>[41486690] Medium CVE-2024-3843: Insufficient data validation in Downloads. Reported by Azur on 2023-12-24</li>
	 <li>[40058873] Low CVE-2024-3844: Inappropriate implementation in Extensions. Reported by Alesandro Ortiz on 2022-02-23</li>
	 <li>[323583084] Low CVE-2024-3845: Inappropriate implementation in Network. Reported by Daniel Baulig on 2024-02-03</li>
	 <li>[40064754] Low CVE-2024-3846: Inappropriate implementation in Prompts. Reported by Ahmed ElMasry on 2023-05-23</li>
	 <li>[328690293] Low CVE-2024-3847: Insufficient policy enforcement in WebUI. Reported by Yan Zhu on 2024-03-08</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-3832</cvename>
 <cvename>CVE-2024-3833</cvename>
 <cvename>CVE-2024-3914</cvename>
 <cvename>CVE-2024-3834</cvename>
 <cvename>CVE-2024-3837</cvename>
 <cvename>CVE-2024-3838</cvename>
 <cvename>CVE-2024-3839</cvename>
 <cvename>CVE-2024-3840</cvename>
 <cvename>CVE-2024-3841</cvename>
 <cvename>CVE-2024-3843</cvename>
 <cvename>CVE-2024-3844</cvename>
 <cvename>CVE-2024-3845</cvename>
 <cvename>CVE-2024-3846</cvename>
 <cvename>CVE-2024-3847</cvename>
 <url>https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html</url>
 </references>
 <dates>
 <discovery>2024-04-16</discovery>
 <entry>2024-04-21</entry>
 </dates>
 </vuln>

<vuln vid="ecafc4af-fe8a-11ee-890c-08002784c58d">
 <topic>clamav -- Possible crash in the HTML file parser that could cause a denial-of-service (DoS) condition</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><ge>1.3.0,1</ge><lt>1.3.1,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Błażej Pawłowski reports:
	<blockquote cite="https://blog.clamav.net/2024/04/clamav-131-123-106-patch-versions.html">
	 
	 A vulnerability in the HTML parser of ClamAV could allow
	 an unauthenticated, remote attacker to cause a denial of
	 service (DoS) condition on an affected device. The
	 vulnerability is due to an issue in the C to Rust foreign
	 function interface. An attacker could exploit this
	 vulnerability by submitting a crafted file containing HTML
	 content to be scanned by ClamAV on an affected device. An
	 exploit could allow the attacker to cause the ClamAV
	 scanning process to terminate, resulting in a DoS
	 condition on the affected software.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-20380</cvename>
 <url>https://blog.clamav.net/2024/04/clamav-131-123-106-patch-versions.html</url>
 </references>
 <dates>
 <discovery>2024-04-17</discovery>
 <entry>2024-04-19</entry>
 </dates>
 </vuln>

<vuln vid="4ebdd56b-fe72-11ee-bc57-00e081b7aa2d">
 <topic>jenkins -- Terrapin SSH vulnerability in Jenkins CLI client</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.452</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.440.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2024-04-17/">
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-3386 / CVE-2023-48795</h5>
	 Terrapin SSH vulnerability in Jenkins CLI client
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-48795</cvename>
 <url>https://www.jenkins.io/security/advisory/2024-04-17/</url>
 </references>
 <dates>
 <discovery>2024-04-17</discovery>
 <entry>2024-04-19</entry>
 </dates>
 </vuln>

<vuln vid="f90bf863-e43c-4db3-b5a8-d9603684657a">
 <topic>electron{27,28,29} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron27</name>
	<range><lt>27.3.11</lt></range>
 </package>
 <package>
	<name>electron28</name>
	<range><lt>28.3.1</lt></range>
 </package>
 <package>
	<name>electron29</name>
	<range><lt>29.3.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron develpers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.11">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-3515.</li>
	 <li>Security: backported fix for CVE-2024-3516.</li>
	 <li>Security: backported fix for CVE-2024-3157.</li>
	 <li>Security: backported fix for CVE-2024-1580.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-3515</cvename>
 <url>https://github.com/advisories/GHSA-x6cj-gx36-vcxv</url>
 <cvename>CVE-2024-3516</cvename>
 <url>https://github.com/advisories/GHSA-jf9g-42gm-v87w</url>
 <cvename>CVE-2024-3157</cvename>
 <url>https://github.com/advisories/GHSA-4m4g-p795-cmq7</url>
 <cvename>CVE-2024-1580</cvename>
 <url>https://github.com/advisories/GHSA-3p7f-4r2q-wxmm</url>
 </references>
 <dates>
 <discovery>2024-04-16</discovery>
 <entry>2024-04-18</entry>
 </dates>
 </vuln>

<vuln vid="6d82c5e9-fc24-11ee-a689-04421a1baf97">
 <topic>php -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php81</name>
	<range><lt>8.1.28</lt></range>
 </package>
 <package>
	<name>php82</name>
	<range><lt>8.2.18</lt></range>
 </package>
 <package>
	<name>php83</name>
	<range><lt>8.3.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	This update includes 3 security fixes:
 <blockquote cite="https://seclists.org/oss-sec/2024/q2/113/">
	 <ul>
	 <li>High CVE-2024-1874: Command injection via array-ish $command parameter of proc_open even if bypass_shell option enabled on Windows</li>
	 <li>High CVE-2024-1874: Command injection via array-ish $command parameter of proc_open even if bypass_shell option enabled on Windows</li>
 <li>Medium CVE-2024-2756: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix</li>
 <li>High CVE-2024-2757: mb_encode_mimeheader runs endlessly for some inputs</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-1874</cvename>
 <url>https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7</url>
 <cvename>CVE-2024-2756</cvename>
 <url>https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4</url>
 <cvename>CVE-2024-3096</cvename>
 <url>https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr</url>
 <cvename>CVE-2024-2757</cvename>
 <url>https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq</url>
 </references>
 <dates>
 <discovery>2024-04-11</discovery>
 <entry>2024-04-16</entry>
 </dates>
 </vuln>

<vuln vid="cdb5e0e3-fafc-11ee-9c21-901b0e9408dc">
 <topic>go -- http2: close connections when receiving too many headers</topic>
 <affects>
 <package>
	<name>go122</name>
	<range><lt>1.22.2</lt></range>
 </package>
 <package>
	<name>go121</name>
	<range><lt>1.21.9</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/65051">
	 http2: close connections when receiving too many headers
	 Maintaining HPACK state requires that we parse and
	 process all HEADERS and CONTINUATION frames on a
	 connection. When a request's headers exceed MaxHeaderBytes,
	 we don't allocate memory to store the excess headers but we
	 do parse them. This permits an attacker to cause an HTTP/2
	 endpoint to read arbitrary amounts of header data, all
	 associated with a request which is going to be
	 rejected. These headers can include Huffman-encoded data
	 which is significantly more expensive for the receiver to
	 decode than for an attacker to send.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-45288</cvename>
 <url>https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M/m/khALNYGdAAAJ</url>
 </references>
 <dates>
 <discovery>2024-04-03</discovery>
 <entry>2024-04-15</entry>
 </dates>
 </vuln>

<vuln vid="7314942b-0889-46f0-b02b-2c60aabe4a82">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>123.0.6312.122</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>123.0.6312.122</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_10.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[331237485] High CVE-2024-3157: Out of bounds write in Compositing. Reported by DarkNavy on 2024-03-26</li>
	 <li>[328859176] High CVE-2024-3516: Heap buffer overflow in ANGLE. Reported by Bao (zx) Pham and Toan (suto) Pham of Qrious Secure on 2024-03-09</li>
	 <li>[331123811] High CVE-2024-3515: Use after free in Dawn. Reported by wgslfuzz on 2024-03-25</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-3157</cvename>
 <cvename>CVE-2024-3516</cvename>
 <cvename>CVE-2024-3515</cvename>
 <url>https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_10.html</url>
 </references>
 <dates>
 <discovery>2024-04-10</discovery>
 <entry>2024-04-12</entry>
 </dates>
 </vuln>

<vuln vid="080936ba-fbb7-11ee-abc8-6960f2492b1d">
 <topic>PuTTY and embedders (f.i., filezilla) -- biased RNG with NIST P521/ecdsa-sha2-nistp521 signatures permits recovering private key</topic>
 <affects>
 <package>
	<name>putty</name>
	<range><ge>0.68</ge><lt>0.81</lt></range>
 </package>
 <package>
	<name>putty-nogtk</name>
	<range><ge>0.68</ge><lt>0.81</lt></range>
 </package>
 <package>
	<name>filezilla</name>
	<range><lt>3.67.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Simon Tatham reports:
	<blockquote cite="https://lists.tartarus.org/pipermail/putty-announce/2024/000038.html">
	 ECDSA signatures using 521-bit keys (the NIST P521 curve,
	 otherwise known as ecdsa-sha2-nistp521) were generated with biased
	 random numbers. This permits an attacker in possession of a few
	 dozen signatures to RECOVER THE PRIVATE KEY.
	 Any 521-bit ECDSA private key that PuTTY or Pageant has used to
	 sign anything should be considered compromised.
	 Additionally, if you have any 521-bit ECDSA private keys that
	 you've used with PuTTY, you should consider them to be
	 compromised: generate new keys, and remove the old public keys
	 from any authorized_keys files.
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2024-31497">
	 
	 A second, independent scenario is that the adversary is an operator
	 of an SSH server to which the victim authenticates (for remote login
	 or file copy), [...] and the victim uses the same private key for
	 SSH connections to other services operated by other entities. Here,
	 the rogue server operator (who would otherwise have no way to
	 determine the victim's private key) can derive the victim's private
	 key, and then use it for unauthorized access to those other
	 services. If the other services include Git services, then again it
	 may be possible to conduct supply-chain attacks on software
	 maintained in Git. This also affects, for example, FileZilla before
	 3.67.0, WinSCP before 6.3.3, TortoiseGit before 2.15.0.1, and
	 TortoiseSVN through 1.14.6.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-31497</cvename>
 <url>https://lists.tartarus.org/pipermail/putty-announce/2024/000038.html</url>
 <url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-p521-bias.html</url>
 <url>https://git.tartarus.org/?h=c193fe9848f50a88a4089aac647fecc31ae96d27&amp;p=simon/putty.git</url>
 <url>https://filezilla-project.org/versions.php</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-31497</url>
 </references>
 <dates>
 <discovery>2024-04-01</discovery> 
 <entry>2024-04-16</entry>
 </dates>
 </vuln>

<vuln vid="31617e47-7eec-4c60-9fdf-8aee61622bab">
 <topic>electron{27,28} -- Out of bounds memory access in V8</topic>
 <affects>
 <package>
	<name>electron27</name>
	<range><lt>27.3.10</lt></range>
 </package>
 <package>
	<name>electron28</name>
	<range><lt>28.3.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.10">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2024-3159.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-3159</cvename>
 <url>https://github.com/advisories/GHSA-mh2p-2x66-3hr4</url>
 </references>
 <dates>
 <discovery>2024-04-10</discovery>
 <entry>2024-04-11</entry>
 </dates>
 </vuln>

<vuln vid="7c217849-f7d7-11ee-a490-84a93843eb75">
 <topic>OpenSSL -- Unbounded memory growth with session handling in TLSv1.3</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>3.0.13_3,1</lt></range>
 </package>
 <package>
	<name>openssl31</name>
	<range><lt>3.1.5_3</lt></range>
 </package>
 <package>
	<name>openssl32</name>
	<range><lt>3.2.1_2</lt></range>
 </package>
 <package>
	<name>openssl-quictls</name>
	<range><lt>3.0.13_3</lt></range>
 </package>
 <package>
	<name>openssl31-quictls</name>
	<range><lt>3.1.5_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20240408.txt">
	 Some non-default TLS server configurations can cause unbounded
	 memory growth when processing TLSv1.3 sessions
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-2511</cvename>
 <url>https://www.openssl.org/news/secadv/20240408.txt</url>
 </references>
 <dates>
 <discovery>2024-04-08</discovery>
 <entry>2024-04-11</entry>
 </dates>
 </vuln>

<vuln vid="c092be0e-f7cc-11ee-aa6b-b42e991fc52e">
 <topic>forgejo -- HTTP/2 CONTINUATION flood in net/http</topic>
 <affects>
 <package>
	<name>forgejo</name>
	<range><lt>1.21.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@golang.org reports:
	<blockquote cite="https://go.dev/cl/576155">
	 An attacker may cause an HTTP/2 endpoint to read arbitrary amounts
	of header data by sending an excessive number of CONTINUATION frames.
	Maintaining HPACK state requires parsing and processing all HEADERS
	and CONTINUATION frames on a connection. When a request's
	headers exceed MaxHeaderBytes, no memory is allocated to store the
	excess headers, but they are still parsed. This permits an attacker
	to cause an HTTP/2 endpoint to read arbitrary amounts of header
	data, all associated with a request which is going to be rejected.
	These headers can include Huffman-encoded data which is significantly
	more expensive for the receiver to decode than for an attacker to
	send. The fix sets a limit on the amount of excess header frames
	we will process before closing a connection.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-45288</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-45288</url>
 </references>
 <dates>
 <discovery>2024-04-04</discovery>
 <entry>2024-04-11</entry>
 </dates>
 </vuln>

<vuln vid="02be46c1-f7cc-11ee-aa6b-b42e991fc52e">
 <topic>jose -- DoS vulnerability</topic>
 <affects>
 <package>
	<name>jose</name>
	<range><lt>13</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://github.com/P3ngu1nW/CVE_Request/blob/main/latch-jose.md">
	
	 latchset jose through version 11 allows attackers to cause
	 a denial of service (CPU consumption) via a large p2c (aka
	 PBES2 Count) value.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-50967</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-50967</url>
 </references>
 <dates>
 <discovery>2024-03-20</discovery>
 <entry>2024-04-11</entry>
 </dates>
 </vuln>

<vuln vid="dad6294c-f7c1-11ee-bb77-001b217b3468">
 <topic>Gitlab -- Patch Release: 16.10.2, 16.9.4, 16.8.6</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.10.0</ge><lt>16.10.2</lt></range>
	<range><ge>16.9.0</ge><lt>16.9.4</lt></range>
	<range><lt>16.8.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/04/10/patch-release-gitlab-16-10-2-released/">
	 Stored XSS injected in diff viewer
	 Stored XSS via autocomplete results
	 Redos on Integrations Chat Messages
	 Redos During Parse Junit Test Report
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-3092</cvename>
 <cvename>CVE-2024-2279</cvename>
 <cvename>CVE-2023-6489</cvename>
 <cvename>CVE-2023-6678</cvename>
 <url>https://about.gitlab.com/releases/2024/04/10/patch-release-gitlab-16-10-2-released/</url>
 </references>
 <dates>
 <discovery>2024-04-10</discovery>
 <entry>2024-04-11</entry>
 </dates>
 </vuln>

<vuln vid="ea4a2dfc-f761-11ee-af2c-589cfc0f81b0">
 <topic>wordpress -- XSS</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>fr-wordpress-fr_FR</name>
	<range><ge>6.5.0,1</ge><lt>6.5.1,1</lt></range>
	<range><lt>6.4.4,1</lt></range>
 </package>
 <package>
	<name>ru-wordpress-ru_RU</name>
	<name>ja-wordpress-ja</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<name>de-wordpress-de_DE</name>
	<range><ge>6.5.0</ge><lt>6.5.1</lt></range>
	<range><lt>6.4.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Wordpress team reports:
	<blockquote cite="https://wordpress.org/documentation/wordpress-version/version-6-4-4/">
	 A cross-site scripting (XSS) vulnerability affecting the Avatar block type
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://wordpress.org/documentation/wordpress-version/version-6-4-4/</url>
 </references>
 <dates>
 <discovery>2024-04-09</discovery>
 <entry>2024-04-10</entry>
 </dates>
 </vuln>

<vuln vid="8e6f684b-f333-11ee-a573-84a93843eb75">
 <topic>Apache httpd -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.59</lt></range>
 </package>
 <package>
	<name>mod_http2</name>
	<range><lt>2.0.27</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="https://downloads.apache.org/httpd/CHANGES_2.4.59">
	 HTTP/2 DoS by memory exhaustion on endless continuation frames
	 HTTP Response Splitting in multiple modules
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-27316</cvename>
 <cvename>CVE-2024-24795</cvename>
 <cvename>CVE-2024-38709</cvename>
 <url>https://downloads.apache.org/httpd/CHANGES_2.4.59</url>
 </references>
 <dates>
 <discovery>2024-04-04</discovery>
 <entry>2024-04-05</entry>
 </dates>
 </vuln>

<vuln vid="c2431c4e-622c-4d92-996d-d8b5258ae8c9">
 <topic>electron{27,28} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron27</name>
	<range><lt>27.3.9</lt></range>
 </package>
 <package>
	<name>electron28</name>
	<range><lt>28.2.10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.9">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-2885.</li>
	 <li>Security: backported fix for CVE-2024-2883.</li>
	 <li>Security: backported fix for CVE-2024-2887.</li>
	 <li>Security: backported fix for CVE-2024-2886.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-2885</cvename>
 <url>https://github.com/advisories/GHSA-qccw-wmvp-8pv9</url>
 <cvename>CVE-2024-2883</cvename>
 <url>https://github.com/advisories/GHSA-gg9c-7j6m-3qq2</url>
 <cvename>CVE-2024-2887</cvename>
 <url>https://github.com/advisories/GHSA-q75f-2pp5-9phj</url>
 <cvename>CVE-2024-2886</cvename>
 <url>https://github.com/advisories/GHSA-5pj4-f8gh-j3mr</url>
 </references>
 <dates>
 <discovery>2024-04-03</discovery>
 <entry>2024-04-05</entry>
 </dates>
 </vuln>

<vuln vid="4a026b6c-f2b8-11ee-8e76-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>123.0.6312.105</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>123.0.6312.105</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[329130358] High CVE-2024-3156: Inappropriate implementation in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2024-03-12</li>
	 <li>[329965696] High CVE-2024-3158: Use after free in Bookmarks. Reported by undoingfish on 2024-03-17</li>
	 <li>[330760873] High CVE-2024-3159: Out of bounds memory access in V8. Reported by Edouard Bochin (@le_douds) and Tao Yan (@Ga1ois) of Palo Alto Networks, via Pwn2Own 2024 on 2024-03-22</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-3156</cvename>
 <cvename>CVE-2024-3158</cvename>
 <cvename>CVE-2024-3159</cvename>
 <url>https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2024-04-02</discovery>
 <entry>2024-04-04</entry>
 </dates>
 </vuln>

<vuln vid="57561cfc-f24b-11ee-9730-001fc69cd6dc">
 <topic>xorg server -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<name>xephyr</name>
	<name>xorg-vfbserver</name>
	<range><lt>21.1.12,1</lt></range>
 </package>
 <package>
	<name>xorg-nextserver</name>
	<range><lt>21.1.12,2</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>23.2.5</lt></range>
 </package>
 <package>
	<name>xwayland-devel</name>
	<range><ge>21.0.99.1.672</ge><lt>21.0.99.1.841_1</lt></range>
	<range><lt>21.0.99.1.671_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The X.Org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2024-April/003497.html">
	 <ul>
	 <li>
	 CVE-2024-31080: Heap buffer overread/data leakage in
	 ProcXIGetSelectedEvents

The ProcXIGetSelectedEvents() function uses the byte-swapped
	 length of the return data for the amount of data to return to
	 the client, if the client has a different endianness than
	 the X server.
	 </li>
	 <li>CVE-2024-31081: Heap buffer overread/data leakage in
	 ProcXIPassiveGrabDevice

The ProcXIPassiveGrabDevice() function uses the byte-swapped
	 length of the return data for the amount of data to return to
	 the client, if the client has a different endianness than
	 the X server.
	 </li>

<li>CVE-2024-31083: User-after-free in ProcRenderAddGlyphs

The ProcRenderAddGlyphs() function calls the AllocateGlyph()
	 function to store new glyphs sent by the client to the X server.
	 AllocateGlyph() would return a new glyph with refcount=0 and
	 a re-used glyph would end up not changing the refcount at all.
	 The resulting glyph_new array would thus have multiple entries
	 pointing to the same non-refcounted glyphs.

ProcRenderAddGlyphs() may free a glyph, resulting in a
	 use-after-free when the same glyph pointer is then later used.
	 </li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-31080</cvename>
 <cvename>CVE-2024-31081</cvename>
 <cvename>CVE-2024-31083</cvename>
 <url>https://lists.x.org/archives/xorg-announce/2024-April/003497.html</url>
 </references>
 <dates>
 <discovery>2024-04-03</discovery>
 <entry>2024-04-04</entry>
 </dates>
 </vuln>

<vuln vid="2e3bea0c-f110-11ee-bc57-00e081b7aa2d">
 <topic>jenkins -- HTTP/2 denial of service vulnerability in bundled Jetty</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.444</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.440.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2024-03-20/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-3379 / CVE-2024-22201</h5>
	 HTTP/2 denial of service vulnerability in bundled Jetty
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-22201</cvename>
 <url>https://www.jenkins.io/security/advisory/2024-03-20/</url>
 </references>
 <dates>
 <discovery>2024-03-20</discovery>
 <entry>2024-04-02</entry>
 </dates>
 </vuln>

<vuln vid="d58726ff-ef5e-11ee-8d8e-080027a5b8e9">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki139</name>
	<range><lt>1.39.7</lt></range>
 </package>
 <package>
	<name>mediawiki140</name>
	<range><lt>1.40.3</lt></range>
 </package>
 <package>
	<name>mediawiki141</name>
	<range><lt>1.41.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Mediawiki reports:
	<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/V3WXEPXV2DU6WTVEKK4XHW4QXD5OFKD7/">
	 (T355538, CVE-2024-PENDING) SECURITY: XSS in edit summary parser.
	 (T357760, CVE-2024-PENDING) SECURITY: Denial of service vector via GET
	 request to Special:MovePage on pages with thousands of subpages.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/V3WXEPXV2DU6WTVEKK4XHW4QXD5OFKD7/</url>
 </references>
 <dates>
 <discovery>2024-03-15</discovery>
 <entry>2024-03-31</entry>
 </dates>
 </vuln>

<vuln vid="bdcd041e-5811-4da3-9243-573a9890fdb1">
 <topic>electron{27,28} -- Object lifecycle issue in V8</topic>
 <affects>
 <package>
	<name>electron27</name>
	<range><lt>27.3.8</lt></range>
 </package>
 <package>
	<name>electron28</name>
	<range><lt>28.2.9</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.8">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2024-2625.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-2625</cvename>
 <url>https://github.com/advisories/GHSA-j7h3-fcrw-g6j8</url>
 </references>
 <dates>
 <discovery>2024-03-28</discovery>
 <entry>2024-03-29</entry>
 </dates>
 </vuln>

<vuln vid="d2992bc2-ed18-11ee-96dc-001b217b3468">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.10.0</ge><lt>16.10.1</lt></range>
	<range><ge>16.9.0</ge><lt>16.9.3</lt></range>
	<range><lt>16.8.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/03/27/security-release-gitlab-16-10-1-released/">
	 Stored-XSS injected in Wiki page via Banzai pipeline
	 DOS using crafted emojis
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-6371</cvename>
 <cvename>CVE-2024-2818</cvename>
 <url>https://about.gitlab.com/releases/2024/03/27/security-release-gitlab-16-10-1-released/</url>
 </references>
 <dates>
 <discovery>2024-03-27</discovery>
 <entry>2024-03-28</entry>
 </dates>
 </vuln>

<vuln vid="814af1be-ec63-11ee-8e76-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>123.0.6312.86</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>123.0.6312.86</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_26.html">
	 This update includes 7 security fixes:
	 <ul>
	 <li>[327807820] Critical CVE-2024-2883: Use after free in ANGLE. Reported by Cassidy Kim(@cassidy6564) on 2024-03-03</li>
	 <li>[328958020] High CVE-2024-2885: Use after free in Dawn. Reported by wgslfuzz on 2024-03-11</li>
	 <li>[330575496] High CVE-2024-2886: Use after free in WebCodecs. Reported by Seunghyun Lee (@0x10n) of KAIST Hacking Lab, via Pwn2Own 2024 on 2024-03-21</li>
	 <li>[330588502] High CVE-2024-2887: Type Confusion in WebAssembly. Reported by Manfred Paul, via Pwn2Own 2024 on 2024-03-21</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-2883</cvename>
 <cvename>CVE-2024-2885</cvename>
 <cvename>CVE-2024-2886</cvename>
 <cvename>CVE-2024-2887</cvename>
 <url>https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_26.html</url>
 </references>
 <dates>
 <discovery>2024-03-26</discovery>
 <entry>2024-03-27</entry>
 </dates>
 </vuln>

<vuln vid="8b3be705-eba7-11ee-99b3-589cfc0f81b0">
 <topic>phpmyfaq -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyfaq-php81</name>
	<name>phpmyfaq-php82</name>
	<name>phpmyfaq-php83</name>
	<range><lt>3.2.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	phpMyFAQ team reports:
	<blockquote cite="https://www.phpmyfaq.de/security/advisory-2024-03-25">
	 The phpMyFAQ Team has learned of multiple security issues that'd
	 been discovered in phpMyFAQ 3.2.5 and earlier. phpMyFAQ contains
	 cross-site scripting (XSS), SQL injection and bypass
	 vulnerabilities.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-mmh6-5cpf-2c72</url>
 <url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hm8r-95g3-5hj9</url>
 <url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-48vw-jpf8-hwqh</url>
 <url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-2grw-mc9r-822r</url>
 <url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6p68-36m6-392r</url>
 <url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pwh2-fpfr-x5gf</url>
 <url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-q7g6-xfh2-vhpx</url>
 <url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-qgxx-4xv5-6hcw</url>
 </references>
 <dates>
 <discovery>2024-03-25</discovery>
 <entry>2024-03-26</entry>
 </dates>
 </vuln>

<vuln vid="f661184a-eb90-11ee-92fc-1c697a616631">
 <topic>emacs -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>emacs</name>
 <name>emacs-canna</name>
 <name>emacs-nox</name>
 <range><lt>29.3,3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	GNU Emacs developers report:
	<blockquote cite="https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29.3">
	 Emacs 29.3 is an emergency bugfix release intended to fix several security vulnerabilities.
	<ul>
	 <li>Arbitrary Lisp code is no longer evaluated as part of turning on Org mode. This is for security reasons, to avoid evaluating malicious Lisp code.</li>
	 <li>New buffer-local variable 'untrusted-content'. When this is non-nil, Lisp programs should treat buffer contents with extra caution.</li>
	 <li>Gnus now treats inline MIME contents as untrusted. To get back previous insecure behavior, 'untrusted-content' should be reset to nil in the buffer.</li>
	 <li>LaTeX preview is now by default disabled for email attachments. To get back previous insecure behavior, set the variable 'org--latex-preview-when-risky' to a non-nil value.</li>
	 <li>Org mode now considers contents of remote files to be untrusted. Remote files are recognized by calling 'file-remote-p'.</li>
	</ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-30202</cvename>
 <cvename>CVE-2024-30203</cvename>
 <cvename>CVE-2024-30204</cvename>
 <cvename>CVE-2024-30205</cvename>
 <url>https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29.3</url>
 </references>
 <dates>
 <discovery>2024-03-24</discovery>
 <entry>2024-03-26</entry>
 </dates>
 </vuln>

<vuln vid="34f98d06-eb56-11ee-8007-6805ca2fa271">
 <topic>quiche -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
 <name>quiche</name>
 <range><lt>0.20.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Quiche Releases reports:
	<blockquote cite="https://github.com/cloudflare/quiche/releases/tag/0.20.1">
	 This release includes 2 security fixes:
	 <ul>
	 <li>
		CVE-2024-1410: Unbounded storage of information related to
		connection ID retirement, in quiche. Reported by Marten
		Seeman (@marten-seeman)
	 </li>
	 <li>
		CVE-2024-1765: Unlimited resource allocation by QUIC
		CRYPTO frames flooding in quiche. Reported by Marten
		Seeman (@marten-seeman)
	 </li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-1410</cvename>
 <cvename>CVE-2024-1765</cvename>
 <url>https://github.com/cloudflare/quiche/releases/tag/0.20.1</url>
 </references>
 <dates>
 <discovery>2024-03-12</discovery>
 <entry>2024-03-26</entry>
 </dates>
 </vuln>

<vuln vid="80815c47-e84f-11ee-8e76-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>123.0.6312.58</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>123.0.6312.58</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_19.html">
	 This update includes 12 security fixes:
	 <ul>
	 <li>[327740539] High CVE-2024-2625: Object lifecycle issue in V8. Reported by Ganjiang Zhou(@refrain_areu) of ChaMd5-H1 team on 2024-03-01</li>
	 <li>[40945098] Medium CVE-2024-2626: Out of bounds read in Swiftshader. Reported by Cassidy Kim(@cassidy6564) on 2023-11-22</li>
	 <li>[41493290] Medium CVE-2024-2627: Use after free in Canvas. Reported by Anonymous on 2024-01-21</li>
	 <li>[41487774] Medium CVE-2024-2628: Inappropriate implementation in Downloads. Reported by Ath3r1s on 2024-01-03</li>
	 <li>[41487721] Medium CVE-2024-2629: Incorrect security UI in iOS. Reported by Muneaki Nishimura (nishimunea) on 2024-01-02</li>
	 <li>[41481877] Medium CVE-2024-2630: Inappropriate implementation in iOS. Reported by James Lee (@Windowsrcer) on 2023-12-07</li>
	 <li>[41495878] Low CVE-2024-2631: Inappropriate implementation in iOS. Reported by Ramit Gangwar on 2024-01-29</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-2625</cvename>
 <cvename>CVE-2024-2626</cvename>
 <cvename>CVE-2024-2627</cvename>
 <cvename>CVE-2024-2628</cvename>
 <cvename>CVE-2024-2629</cvename>
 <cvename>CVE-2024-2630</cvename>
 <cvename>CVE-2024-2631</cvename>
 <url>https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_19.html</url>
 </references>
 <dates>
 <discovery>2024-03-19</discovery>
 <entry>2024-03-22</entry>
 </dates>
 </vuln>

<vuln vid="7a7129ef-e790-11ee-a1c0-0050569f0b83">
 <topic>security/shibboleth-idp -- CAS service SSRF</topic>
 <affects>
 <package>
	<name>shibboleth-idp</name>
	<range><ge>4.3.0</ge><lt>4.3.2</lt></range>
	<range><ge>5.0.0</ge><lt>5.1.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Shibboleth Developers report:
	<blockquote cite="https://shibboleth.net/community/advisories/secadv_20240320.txt">
	 The Identity Provider's CAS support relies on a function in the
	 Spring Framework to parse CAS service URLs and append the ticket
	 parameter.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://shibboleth.net/community/advisories/secadv_20240320.txt</url>
 </references>
 <dates>
 <discovery>2024-03-20</discovery>
 <entry>2024-03-21</entry>
 </dates>
 </vuln>

<vuln vid="a8448963-e6f5-11ee-a784-dca632daf43b">
 <topic>databases/mongodb* -- Improper Certificate Validation</topic>
 <affects>
 <package>
	<name>mongodb44</name>
	<range><lt>4.4.29</lt></range>
 </package>
 <package>
	<name>mongodb50</name>
	<range><lt>5.0.25</lt></range>
 </package>
 <package>
	<name>mongodb60</name>
	<range><lt>6.0.14</lt></range>
 </package>
 <package>
	<name>mongodb70</name>
	<range><lt>7.0.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	MongoDB, Inc. reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-72839">
	 A security vulnerability was found where a server process
	 running MongoDB 3.2.6 or later will allow incoming connections
	 to skip peer certificate validation if the server process was
	 started with TLS enabled (net.tls.mode set to allowTLS,
	 preferTLS, or requireTLS) and without a net.tls.CAFile
	 configured (CVE-2024-1351).
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-1351</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-1351</url>
 </references>
 <dates>
 <discovery>2024-03-07</discovery>
 <entry>2024-03-20</entry>
 </dates>
 </vuln>

<vuln vid="05b7180b-e571-11ee-a1c0-0050569f0b83">
 <topic>www/varnish7 -- Denial of Service</topic>
 <affects>
 <package>
	<name>varnish7</name>
	<range><lt>7.4.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Varnish Development Team reports:
	<blockquote cite="https://varnish-cache.org/security/VSV00014.html#vsv00014">
	A denial of service attack can be performed on Varnish Cacher servers
	 that have the HTTP/2 protocol turned on. An attacker can let the
	 servers HTTP/2 connection control flow window run out of credits
	 indefinitely and prevent progress in the processing of streams,
	 retaining the associated resources.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-43622</cvename>
 <url>https://varnish-cache.org/security/VSV00014.html#vsv00014</url>
 </references>
 <dates>
 <discovery>2019-04-19</discovery>
 <entry>2024-03-18</entry>
 </dates>
 </vuln>

<vuln vid="0a48e552-e470-11ee-99b3-589cfc0f81b0">
 <topic>amavisd-new -- multipart boundary confusion</topic>
 <affects>
 <package>
	<name>amavisd-new</name>
	<range><lt>2.12.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Amavis project reports:
	<blockquote cite="https://gitlab.com/amavis/amavis/-/raw/v2.12.3/README_FILES/README.CVE-2024-28054">
	 Emails which consist of multiple parts (`Content-Type: multipart/*`)
	 incorporate boundary information stating at which point one part ends and the
	 next part begins.
	 A boundary is announced by an Content-Type header's `boundary` parameter. To
	 our current knowledge, RFC2046 and RFC2045 do not explicitly specify how a
	 parser should handle multiple boundary parameters that contain conflicting
	 values. As a result, there is no canonical choice which of the values should or
	 should not be used for mime part decomposition.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-28054</cvename>
 <url>https://gitlab.com/amavis/amavis/-/raw/v2.12.3/README_FILES/README.CVE-2024-28054</url>
 </references>
 <dates>
 <discovery>2024-03-14</discovery>
 <entry>2024-03-17</entry>
 </dates>
 </vuln>

<vuln vid="1ad3d264-e36b-11ee-9c27-40b034429ecf">
 <topic>typo3-{11,12} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>typo3-11</name>
	<range><lt>11.5.35</lt></range>
 </package>
 <package>
	<name>typo3-12</name>
	<range><lt>12.4.11</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Typo3 developers reports:
	<blockquote cite="https://typo3.org/article/typo3-1301-12411-and-11535-security-releases-published">
	 All versions are security releases and contain important security fixes - read the corresponding security advisories here:
	<ul>
	 <li>Path Traversal in TYPO3 File Abstraction Layer Storages CVE-2023-30451</li>
	 <li>Code Execution in TYPO3 Install Tool CVE-2024-22188</li>
	 <li>Information Disclosure of Hashed Passwords in TYPO3 Backend Forms CVE-2024-25118</li>
	 <li>Information Disclosure of Encryption Key in TYPO3 Install Tool CVE-2024-25119</li>
	 <li>Improper Access Control of Resources Referenced by t3:// URI Scheme CVE-2024-25120</li>
	 <li>Improper Access Control Persisting File Abstraction Layer Entities via Data Handler CVE-2024-25121</li>
	</ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-30451</cvename>
 <cvename>CVE-2024-22188</cvename>
 <cvename>CVE-2024-25118</cvename>
 <cvename>CVE-2024-25119</cvename>
 <cvename>CVE-2024-25120</cvename>
 <cvename>CVE-2024-25121</cvename>
 <url>https://typo3.org/article/typo3-1301-12411-and-11535-security-releases-published</url>
 </references>
 <dates>
 <discovery>2024-02-13</discovery>
 <entry>2024-03-16</entry>
 </dates>
 </vuln>

<vuln vid="49dd9362-4473-48ae-8fac-e1b69db2dedf">
 <topic>electron{27,28} -- Out of bounds memory access in V8</topic>
 <affects>
 <package>
	<name>electron27</name>
	<range><lt>27.3.6</lt></range>
 </package>
 <package>
	<name>electron28</name>
	<range><lt>28.2.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.6">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2024-2173.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-2173</cvename>
 <url>https://github.com/advisories/GHSA-6hhg-hj7x-7qv8</url>
 </references>
 <dates>
 <discovery>2024-03-13</discovery>
 <entry>2024-03-14</entry>
 </dates>
 </vuln>

<vuln vid="b6dd9d93-e09b-11ee-92fc-1c697a616631">
 <topic>Intel CPUs -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cpu-microcode-intel</name>
	<range><lt>20240312</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Intel reports:
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00972.html">
	 2024.1 IPU - Intel Processor Bus Lock Advisory

A potential security vulnerability in the bus lock regulator
	 mechanism for some Intel Processors may allow denial of service. Intel
	 is releasing firmware updates to mitigate this potential
	 vulnerability.
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00982.html">
	 2024.1 IPU - Intel Processor Return Predictions Advisory

A potential security vulnerability in some Intel Processors may
	 allow information disclosure.
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00898.html">
	 2024.1 IPU - Intel Atom Processor Advisory

A potential security vulnerability in some Intel Atom Processors
	 may allow information disclosure.
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html">
	 2024.1 IPU - Intel Xeon Processor Advisory

A potential security vulnerability in some 3rd and 4th Generation
	 Intel Xeon Processors when using Intel Software Guard Extensions (SGX)
	 or Intel Trust Domain Extensions (TDX) may allow escalation of
	 privilege.
	</blockquote>
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html">
	 2024.1 IPU OOB - Intel Xeon D Processor Advisory

A potential security vulnerability in some Intel Xeon D Processors
	 with Intel Software Guard Extensions (SGX) may allow information
	 disclosure.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-39368</cvename>
 <cvename>CVE-2023-38575</cvename>
 <cvename>CVE-2023-28746</cvename>
 <cvename>CVE-2023-22655</cvename>
 <cvename>CVE-2023-43490</cvename>
 <url>https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20240312</url>
 </references>
 <dates>
 <discovery>2023-03-12</discovery>
 <entry>2024-03-12</entry>
 </dates>
 </vuln>

<vuln vid="6d31ef38-df85-11ee-abf1-6c3be5272acd">
 <topic>Grafana -- Data source permission escalation</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>8.5.0</ge><lt>9.5.17</lt></range>
	<range><ge>10.0.0</ge><lt>10.0.12</lt></range>
	<range><ge>10.1.0</ge><lt>10.1.8</lt></range>
	<range><ge>10.2.0</ge><lt>10.2.5</lt></range>
	<range><ge>10.3.0</ge><lt>10.3.4</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><lt>9.5.17</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2024/03/07/grafana-security-release-medium-severity-security-fix-for-cve-2024-1442/">
	 The vulnerability impacts Grafana Cloud and Grafana Enterprise instances,
	 and it is exploitable if a user who should not be able to access all data
	 sources is granted permissions to create a data source.
	 By default, only organization Administrators are allowed to create a data
	 source and have full access to all data sources. All other users need to be
	 explicitly granted permission to create a data source, which then means they
	 could exploit this vulnerability.
	 When a user creates a data source via the
	 <a href="https://grafana.com/docs/grafana/latest/developers/http_api/data_source/#create-a-data-source">API</a>,
	 they can specify data source UID. If the UID is set to an asterisk (*),
	 the user gains permissions to query, update, and delete all data sources
	 in the organization. The exploit, however, does not stretch across
	 organizations — to exploit the vulnerability in several organizations, a user
	 would need permissions to create data sources in each organization.
	 The vulnerability comes from a lack of UID validation. When evaluating
	 permissions, we interpret an asterisk (*) as a wild card for all resources.
	 Therefore, we should treat it as a reserved value, and not allow the creation
	 of a resource with the UID set to an asterisk.
	 The CVSS score for this vulnerability is
	 <a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L&amp;version=3.1">6 Medium</a>.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-1442</cvename>
 <url>https://grafana.com/security/security-advisories/cve-2024-1442/</url>
 </references>
 <dates>
 <discovery>2024-02-12</discovery>
 <entry>2024-03-11</entry>
 <modified>2024-03-26</modified>
 </dates>
 </vuln>

<vuln vid="c2ad8700-de25-11ee-9190-84a93843eb75">
 <topic>Unbound -- Denial-of-Service vulnerability</topic>
 <affects>
 <package>
	<name>unbound</name>
	<range><gt>1.18.0</gt><lt>1.19.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	NLNet Labs reports:
	<blockquote cite="https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-1931.txt">
	 Unbound 1.18.0 introduced a feature that removes EDE records from
	 responses with size higher than the client's advertised buffer size.
	 Before removing all the EDE records however, it would try to see if
	 trimming the extra text fields on those records would result in an
	 acceptable size while still retaining the EDE codes. Due to an
	 unchecked condition, the code that trims the text of the EDE records
	 could loop indefinitely. This happens when Unbound would reply with
	 attached EDE information on a positive reply and the client's buffer
	 size is smaller than the needed space to include EDE records.

The vulnerability can only be triggered when the 'ede: yes' option
	 is used; non default configuration.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-1931</cvename>
 <url>https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-1931.txt</url>
 </references>
 <dates>
 <discovery>2024-03-07</discovery>
 <entry>2024-03-09</entry>
 </dates>
 </vuln>

<vuln vid="e74da31b-276a-4a22-9772-17dd42b97559">
 <topic>electron{27,28} -- vulnerability in libxml2</topic>
 <affects>
 <package>
	<name>electron27</name>
	<range><lt>27.3.5</lt></range>
 </package>
 <package>
	<name>electron28</name>
	<range><lt>28.2.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.5">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2024-25062.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-25062</cvename>
 <url>https://github.com/advisories/GHSA-x77r-6xxm-wjmx</url>
 </references>
 <dates>
 <discovery>2024-03-06</discovery>
 <entry>2024-03-07</entry>
 </dates>
 </vuln>

<vuln vid="b2caae55-dc38-11ee-96dc-001b217b3468">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.9.0</ge><lt>16.9.2</lt></range>
	<range><ge>16.8.0</ge><lt>16.8.4</lt></range>
	<range><ge>11.3.0</ge><lt>16.7.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/03/06/security-release-gitlab-16-9-2-released/">
	 Bypassing CODEOWNERS approval allowing to steal protected variables
	 Guest with manage group access tokens can rotate and see group access token with owner permissions
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-0199</cvename>
 <cvename>CVE-2024-1299</cvename>
 <url>https://about.gitlab.com/releases/2024/03/06/security-release-gitlab-16-9-2-released/</url>
 </references>
 <dates>
 <discovery>2024-03-06</discovery>
 <entry>2024-03-07</entry>
 </dates>
 </vuln>

<vuln vid="b1b039ec-dbfc-11ee-9165-901b0e9408dc">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go122</name>
	<range><lt>1.22.1</lt></range>
 </package>
 <package>
	<name>go121</name>
	<range><lt>1.21.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports reports:
	<blockquote cite="https://go.dev/issue/65390">
	 crypto/x509: Verify panics on certificates with an
	 unknown public key algorithm
	 Verifying a certificate chain which contains a
	 certificate with an unknown public key algorithm will
	 cause Certificate.Verify to panic.
	</blockquote>
	<blockquote cite="https://go.dev/issue/65383">
	 net/http: memory exhaustion in Request.ParseMultipartForm
	 When parsing a multipart form (either explicitly with
	 Request.ParseMultipartForm or implicitly with Request.FormValue,
	 Request.PostFormValue, or Request.FormFile), limits on the total
	 size of the parsed form were not applied to the memory consumed
	 while reading a single form line. This permitted a maliciously
	 crafted input containing very long lines to cause allocation of
	 arbitrarily large amounts of memory, potentially leading to memory
	 exhaustion.
	</blockquote>
	<blockquote cite="https://go.dev/issue/65065">
	 net/http, net/http/cookiejar: incorrect forwarding
	 of sensitive headers and cookies on HTTP redirect
	 When following an HTTP redirect to a domain which
	 is not a subdomain match or exact match of the initial
	 domain, an http.Client does not forward sensitive headers
	 such as "Authorization" or "Cookie". For example, a
	 redirect from foo.com to www.foo.com will forward the
	 Authorization header, but a redirect to bar.com will not.
	</blockquote>
	<blockquote cite="https://go.dev/issue/65697">
	 html/template: errors returned from MarshalJSON methods
	 may break template escaping
	 If errors returned from MarshalJSON methods contain user
	 controlled data, they may be used to break the contextual
	 auto-escaping behavior of the html/template package, allowing
	 for subsequent actions to inject unexpected content into
	 templates.
	</blockquote>
	<blockquote cite="https://go.dev/issue/65083">
	 net/mail: comments in display names are incorrectly handled
	 The ParseAddressList function incorrectly handles comments
	 (text within parentheses) within display names. Since this is a
	 misalignment with conforming address parsers, it can result in
	 different trust decisions being made by programs using different
	 parsers.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-45289</cvename>
 <cvename>CVE-2023-45290</cvename>
 <cvename>CVE-2024-24783</cvename>
 <cvename>CVE-2024-24784</cvename>
 <cvename>CVE-2024-24785</cvename>
 <url>https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg/m/46oA5yPABQAJ</url>
 </references>
 <dates>
 <discovery>2024-03-05</discovery>
 <entry>2024-03-06</entry>
 </dates>
 </vuln>

<vuln vid="fd3401a1-b6df-4577-917a-2c22fee99d34">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>122.0.6261.111</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>122.0.6261.111</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[325893559] High CVE-2024-2173: Out of bounds memory access in V8. Reported by 5fceb6172bbf7e2c5a948183b53565b9 on 2024-02-19</li>
	 <li>[325866363] High CVE-2024-2174: Inappropriate implementation in V8. Reported by 5f46f4ee2e17957ba7b39897fb376be8 on 2024-02-19</li>
	 <li>[325936438] High CVE-2024-2176: Use after free in FedCM. Reported by Anonymous on 2024-02-20</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-2173</cvename>
 <cvename>CVE-2024-2174</cvename>
 <cvename>CVE-2024-2176</cvename>
 <url>https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2024-03-05</discovery>
 <entry>2024-03-06</entry>
 </dates>
 </vuln>

<vuln vid="0ef3398e-da21-11ee-b23a-080027a5b8e9">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py39-django32</name>
	<name>py310-django32</name>
	<name>py311-django32</name>
	<range><lt>3.2.25</lt></range>
 </package>
 <package>
	<name>py39-django42</name>
	<name>py310-django42</name>
	<name>py311-django42</name>
	<range><lt>4.2.11</lt></range>
 </package>
 <package>
	<name>py310-django50</name>
	<name>py311-django50</name>
	<range><lt>5.0.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Django reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2024/mar/04/security-releases/">
	 CVE-2024-27351: Potential regular expression denial-of-service in
	 django.utils.text.Truncator.words().
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-27351</cvename>
 <url>https://www.djangoproject.com/weblog/2024/mar/04/security-releases/</url>
 </references>
 <dates>
 <discovery>2024-02-25</discovery>
 <entry>2024-03-04</entry>
 </dates>
 </vuln>

<vuln vid="77a6f1c9-d7d2-11ee-bb12-001b217b3468">
 <topic>NodeJS -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>node</name>
	<range><ge>21.0.0</ge><lt>21.6.2</lt></range>
	<range><ge>20.0.0</ge><lt>20.11.1</lt></range>
	<range><ge>18.0.0</ge><lt>18.19.1</lt></range>
	<range><ge>16.0.0</ge><lt>16.20.3</lt></range>
 </package>
 <package>
	<name>node16</name>
	<range><ge>16.0.0</ge><lt>16.20.3</lt></range>
 </package>
 <package>
	<name>node18</name>
	<range><ge>18.0.0</ge><lt>18.19.1</lt></range>
 </package>
 <package>
	<name>node20</name>
	<range><ge>20.0.0</ge><lt>20.11.1</lt></range>
 </package>
 <package>
	<name>node21</name>
	<range><ge>21.0.0</ge><lt>21.6.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#2024-02-14-version-20111-iron-lts-rafaelgss-prepared-by-marco-ippolito">
	 Code injection and privilege escalation through Linux capabilities- (High)
	 http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
	 Path traversal by monkey-patching Buffer internals- (High)
	 setuid() does not drop all privileges due to io_uring - (High)
	 Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
	 Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
	 Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
	 Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-21892</cvename>
 <cvename>CVE-2024-22019</cvename>
 <cvename>CVE-2024-21896</cvename>
 <cvename>CVE-2024-22017</cvename>
 <cvename>CVE-2023-46809</cvename>
 <cvename>CVE-2024-21891</cvename>
 <cvename>CVE-2024-21890</cvename>
 <cvename>CVE-2024-22025</cvename>
 <url>https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#2024-02-14-version-20111-iron-lts-rafaelgss-prepared-by-marco-ippolito</url>
 </references>
 <dates>
 <discovery>2024-02-14</discovery>
 <entry>2024-03-01</entry>
 </dates>
 </vuln>

<vuln vid="3567456a-6b17-41f7-ba7f-5cd3efb2b7c9">
 <topic>electron{27,28} -- Use after free in Mojo</topic>
 <affects>
 <package>
	<name>electron27</name>
	<range><lt>27.3.4</lt></range>
 </package>
 <package>
	<name>electron28</name>
	<range><lt>28.2.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.4">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2024-1670.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-1670</cvename>
 <url>https://github.com/advisories/GHSA-wjv4-j3hc-gxvv</url>
 </references>
 <dates>
 <discovery>2024-02-28</discovery>
 <entry>2024-02-29</entry>
 </dates>
 </vuln>

<vuln vid="31bb1b8d-d6dc-11ee-86bb-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>122.0.6261.94</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>122.0.6261.94</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_27.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[324596281] High CVE-2024-1938: Type Confusion in V8. Reported by 5f46f4ee2e17957ba7b39897fb376be8 on 2024-02-11</li>
	 <li>[323694592] High CVE-2024-1939: Type Confusion in V8. Reported by Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu Lab on 2024-02-05</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-1938</cvename>
 <cvename>CVE-2024-1939</cvename>
 <url>https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_27.html</url>
 </references>
 <dates>
 <discovery>2024-02-27</discovery>
 <entry>2024-02-29</entry>
 </dates>
 </vuln>

<vuln vid="3dada2d5-4e17-4e39-97dd-14fdbd4356fb">
 <topic>null -- Routinator terminates when RTR connection is reset too quickly after opening</topic>
 <affects>
 <package>
 <name>null</name>
 <range><lt>null</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 sep@nlnetlabs.nl reports:
 <blockquote cite="https://www.nlnetlabs.nl/downloads/routinator/CVE-2024-1622.txt">
 Due to a mistake in error checking, Routinator will terminate when
 an incoming RTR connection is reset by the peer too quickly after
 opening.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-1622</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2024-1622</url>
 </references>
 <dates>
 <discovery>2024-02-26</discovery>
 <entry>2024-02-28</entry>
 </dates>
 </vuln>

<vuln vid="02e33cd1-c655-11ee-8613-08002784c58d">
 <topic>curl -- OCSP verification bypass with TLS session reuse</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>8.6.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Hiroki Kurosawa reports:
	<blockquote cite="https://curl.se/docs/CVE-2024-0853.html">
	 
	 curl inadvertently kept the SSL session ID for connections
	 in its cache even when the verify status (OCSP stapling)
	 test failed. A subsequent transfer to the same hostname
	 could then succeed if the session ID cache was still
	 fresh, which then skipped the verify status check.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-0853</cvename>
 <url>https://curl.se/docs/CVE-2024-0853.html</url>
 </references>
 <dates>
 <discovery>2024-01-31</discovery>
 <entry>2024-02-28</entry>
 </dates>
 </vuln>

<vuln vid="5ecfb588-d2f4-11ee-ad82-dbdfaa8acfc2">
 <topic>gitea -- Fix XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.21.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <h1>Problem Description:</h1>
 <ul>
 <li>The Wiki page did not sanitize author name</li>
 <li>the reviewer name on a "dismiss review" comment is also affected</li>
 <li>the migration page has some spots</li>
 </ul>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.com/release-of-1.21.6/</url>
 </references>
 <dates>
 <discovery>2024-02-23</discovery>
 <entry>2024-02-24</entry>
 </dates>
 </vuln>

<vuln vid="2a470712-d351-11ee-86bb-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>122.0.6261.57</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>122.0.6261.57</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html">
	 This update includes 12 security fixes:
	 <ul>
	 <li>[41495060] High CVE-2024-1669: Out of bounds memory access in Blink. Reported by Anonymous on 2024-01-26</li>
	 <li>[41481374] High CVE-2024-1670: Use after free in Mojo. Reported by Cassidy Kim(@cassidy6564) on 2023-12-06</li>
	 <li>[41487933] Medium CVE-2024-1671: Inappropriate implementation in Site Isolation. Reported by Harry Chen on 2024-01-03</li>
	 <li>[41485789] Medium CVE-2024-1672: Inappropriate implementation in Content Security Policy. Reported by Georg Felber (TU Wien) &amp; Marco Squarcina (TU Wien) on 2023-12-19</li>
	 <li>[41490491] Medium CVE-2024-1673: Use after free in Accessibility. Reported by Weipeng Jiang (@Krace) of VRI on 2024-01-11</li>
	 <li>[40095183] Medium CVE-2024-1674: Inappropriate implementation in Navigation. Reported by David Erceg on 2019-05-27</li>
	 <li>[41486208] Medium CVE-2024-1675: Insufficient policy enforcement in Download. Reported by Bartłomiej Wacko on 2023-12-21</li>
	 <li>[40944847] Low CVE-2024-1676: Inappropriate implementation in Navigation. Reported by Khalil Zhani on 2023-11-21</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html</url>
 </references>
 <dates>
 <discovery>2024-02-20</discovery>
 <entry>2024-02-24</entry>
 </dates>
 </vuln>

<vuln vid="6a851dc0-cfd2-11ee-ac09-6c3be5272acd">
 <topic>Grafana -- Email verification is not required after email change</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><lt>9.5.16</lt></range>
	<range><ge>10.0.0</ge><lt>10.0.11</lt></range>
	<range><ge>10.1.0</ge><lt>10.1.7</lt></range>
	<range><ge>10.2.0</ge><lt>10.2.4</lt></range>
	<range><ge>10.3.0</ge><lt>10.3.3</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><lt>9.5.16</lt></range>
 </package>
 <package>
	<name>grafana10</name>
	<range><lt>10.0.11</lt></range>
	<range><ge>10.1.0</ge><lt>10.1.7</lt></range>
	<range><ge>10.2.0</ge><lt>10.2.4</lt></range>
	<range><ge>10.3.0</ge><lt>10.3.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2024/02/14/grafana-security-release-medium-severity-security-fix-for-cve-2023-6152/">
	 The vulnerability impacts instances where
	 <a href="https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/grafana/">
	 Grafana basic authentication</a> is enabled.
	 Grafana has a
	 <a href="https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#verify_email_enabled">
	 verify_email_enabled</a> configuration option. When this option is enabled,
	 users are required to confirm their email addresses before the sign-up process
	 is complete. However, the email is only checked at the time of the sign-up.
	 No further verification is carried out if a user’s email address is updated
	 after the initial sign-up. Moreover, Grafana allows using an email address
	 as the user’s login name, and no verification is ever carried out for this email
	 address.
	 This means that even if the
	 <a href="https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#verify_email_enabled">
	 verify_email_enabled</a> configuration option is enabled, users can use
	 unverified email addresses to log into Grafana if the email address
	 has been changed after the sign up, or if an email address is set as the login
	 name.
	 The CVSS score for this vulnerability is [5.4 Medium] (CVSS).
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-6152</cvename>
 <url>https://grafana.com/security/security-advisories/cve-2023-6152/</url>
 </references>
 <dates>
 <discovery>2023-11-10</discovery>
 <entry>2024-02-20</entry>
 </dates>
 </vuln>

<vuln vid="255bf44c-d298-11ee-9c27-40b034429ecf">
 <topic>dns/c-ares -- malformatted file causes application crash</topic>
 <affects>
 <package>
	<name>c-ares</name>
	<range><lt>1.27.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	c-ares project reports:
	<blockquote cite="https://c-ares.org/changelog.html">
	 Reading malformatted /etc/resolv.conf, /etc/nsswitch.conf or the HOSTALIASES file could result in a crash.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-25629</cvename>
 <url>https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q</url>
 </references>
 <dates>
 <discovery>2024-02-23</discovery>
 <entry>2024-02-23</entry>
 </dates>
 </vuln>

<vuln vid="979dc373-d27d-11ee-8b84-b42e991fc52e">
 <topic>suricata -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>suricata</name>
	<range><lt>7.0.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Suricata team reports:
	<blockquote cite="https://suricata.io/2024/02/08/suricata-7-0-3-and-6-0-16-released/">
	 Multiple vulnerabilities fixed in the last release of suricata.
	</blockquote>
	No details have been disclosed yet
	</body>
 </description>
 <references>
 <cvename>CVE-2024-23839</cvename>
 <cvename>CVE-2024-23836</cvename>
 <cvename>CVE-2024-23835</cvename>
 <cvename>CVE-2024-24568</cvename>
 <cvename>CVE-2024-23837</cvename>
 </references>
 <dates>
 <discovery>2024-01-22</discovery>
 <entry>2024-02-23</entry>
 </dates>
 </vuln>

<vuln vid="80ad6d6c-b398-457f-b88f-bf6be0bbad44">
 <topic>electron27 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron27</name>
	<range><lt>27.3.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v27.3.3">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2024-1283.</li>
	 <li>Security: backported fix for CVE-2024-1284.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-1283</cvename>
 <url>https://github.com/advisories/GHSA-7mgj-p9v3-3vxr</url>
 <cvename>CVE-2024-1284</cvename>
 <url>https://github.com/advisories/GHSA-pf89-rhhw-xmhp</url>
 </references>
 <dates>
 <discovery>2024-02-21</discovery>
 <entry>2024-02-23</entry>
 </dates>
 </vuln>

<vuln vid="03bf5157-d145-11ee-acee-001b217b3468">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.9.0</ge><lt>16.9.1</lt></range>
	<range><ge>16.8.0</ge><lt>16.8.3</lt></range>
	<range><ge>11.3.0</ge><lt>16.7.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/02/21/security-release-gitlab-16-9-1-released/">
	 Stored-XSS in user's profile page
	 User with "admin_group_members" permission can invite other groups to gain owner access
	 ReDoS issue in the Codeowners reference extractor
	 LDAP user can reset password using secondary email and login using direct authentication
	 Bypassing group ip restriction settings to access environment details of projects through Environments/Operations Dashboard
	 Users with the Guest role can change Custom dashboard projects settings for projects in the victim group
	 Group member with sub-maintainer role can change title of shared private deploy keys
	 Bypassing approvals of CODEOWNERS
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-1451</cvename>
 <cvename>CVE-2023-6477</cvename>
 <cvename>CVE-2023-6736</cvename>
 <cvename>CVE-2024-1525</cvename>
 <cvename>CVE-2023-4895</cvename>
 <cvename>CVE-2024-0861</cvename>
 <cvename>CVE-2023-3509</cvename>
 <cvename>CVE-2024-0410</cvename>
 <url>https://about.gitlab.com/releases/2024/02/21/security-release-gitlab-16-9-1-released/</url>
 </references>
 <dates>
 <discovery>2024-02-21</discovery>
 <entry>2024-02-22</entry>
 </dates>
 </vuln>

<vuln vid="e15ba624-cca8-11ee-84ca-b42e991fc52e">
 <topic>powerdns-recursor -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><lt>5.0.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://access.redhat.com/security/cve/CVE-2023-50868">
	 CVE-2023-50868: The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155
	 when RFC 9276 guidance is skipped) allows remote attackers to cause
	 a denial of service (CPU consumption for SHA-1 computations) via
	 DNSSEC responses in a random subdomain attack, aka the "NSEC3"
	 issue. The RFC 5155 specification implies that an algorithm must
	 perform thousands of iterations of a hash function in certain
	situations.
 CVE-2023-50387: Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035,
 6840, and related RFCs) allow remote attackers to cause a denial
 of service (CPU consumption) via one or more DNSSEC responses, aka
 the "KeyTrap" issue. One of the concerns is that, when
 there is a zone with many DNSKEY and RRSIG records, the protocol
 specification implies that an algorithm must evaluate all combinations
	of DNSKEY and RRSIG records.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-50868</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-50868</url>
 <cvename>CVE-2023-50387</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-50387</url>
 </references>
 <dates>
 <discovery>2024-02-14</discovery>
 <entry>2024-02-16</entry>
 </dates>
 </vuln>

<vuln vid="c97a4ecf-cc25-11ee-b0ee-0050569f0b83">
 <topic>nginx-devel -- Multiple Vulnerabilities in HTTP/3</topic>
 <affects>
 <package>
	<name>nginx-devel</name>
	<range><ge>1.25.0</ge><lt>1.25.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The nginx development team reports:
	<blockquote cite="http://nginx.org/en/security_advisories.html">
	 When using HTTP/3 a segmentation fault might occur in a
	 worker process while processing a specially crafted QUIC session.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-24989</cvename>
 <cvename>CVE-2024-24990</cvename>
 </references>
 <dates>
 <discovery>2024-02-14</discovery>
 <entry>2024-02-15</entry>
 </dates>
 </vuln>

<vuln vid="46a29f83-cb47-11ee-b609-002590c1f29c">
 <topic>FreeBSD -- jail(2) information leak</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.0</ge><lt>14.0_5</lt></range>
	<range><ge>13.2</ge><lt>13.2_10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The jail(2) system call has not limited a visiblity of allocated
	TTYs (the kern.ttys sysctl). This gives rise to an information
	leak about processes outside the current jail.
	<h1>Impact:</h1>
	Attacker can get information about TTYs allocated on the host
	or in other jails. Effectively, the information printed by "pstat
	-t" may be leaked.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-25941</cvename>
 <freebsdsa>SA-24:02.tty</freebsdsa>
 </references>
 <dates>
 <discovery>2024-02-14</discovery>
 <entry>2024-02-14</entry>
 </dates>
 </vuln>

<vuln vid="c62285cb-cb46-11ee-b609-002590c1f29c">
 <topic>FreeBSD -- bhyveload(8) host file access</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.0</ge><lt>14.0_5</lt></range>
	<range><ge>13.2</ge><lt>13.2_10</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	`bhyveload -h &lt;host-path&gt;` may be used to grant loader access
	to the &lt;host-path&gt; directory tree on the host. Affected versions
	of bhyveload(8) do not make any attempt to restrict loader's access
	to &lt;host-path&gt;, allowing the loader to read any file the host user
	has access to.
	<h1>Impact:</h1>
	In the bhyveload(8) model, the host supplies a userboot.so to
	boot with, but the loader scripts generally come from the guest
	image. A maliciously crafted script could be used to exfiltrate
	sensitive data from the host accessible to the user running
	bhyhveload(8), which is often the system root.
 </body>
 </description>
 <references>
 <cvename>CVE-2024-25940</cvename>
 <freebsdsa>SA-24:01.bhyveload</freebsdsa>
 </references>
 <dates>
 <discovery>2024-02-14</discovery>
 <entry>2024-02-14</entry>
 </dates>
 </vuln>

<vuln vid="4edbea45-cb0c-11ee-86bb-a8a1599412c6">
 <topic>chromium -- security fix</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>121.0.6167.184</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>121.0.6167.184</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_13.html">
	 This update includes 1 security fix.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_13.html</url>
 </references>
 <dates>
 <discovery>2024-02-13</discovery>
 <entry>2024-02-14</entry>
 </dates>
 </vuln>

<vuln vid="21a854cc-cac1-11ee-b7a7-353f1e043d9a">
 <topic>DNSSEC validators -- denial-of-service/CPU exhaustion from KeyTrap and NSEC3 vulnerabilities</topic>
 <affects>
 <package>
	<name>bind916</name>
	<range><lt>9.16.48</lt></range>
 </package>
 <package>
	<name>bind918</name>
	<range><lt>9.18.24</lt></range>
 </package>
 <package>
	<name>bind9-devel</name>
	<range><lt>9.19.21</lt></range>
 </package>
 <package>
	<name>dnsmasq</name>
	<range><lt>2.90</lt></range>
 </package>
 <package>
	<name>dnsmasq-devel</name>
	<range><lt>2.90</lt></range>
 </package>
 <package>
	<name>powerdns-recursor</name>
	<range><lt>5.0.2</lt></range>
 </package>
 <package>
	<name>unbound</name>
	<range><lt>1.19.1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.0</ge><lt>14.0_6</lt></range>
	<range><ge>13.2</ge><lt>13.2_11</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Simon Kelley reports:
	<blockquote cite="https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html">
	 If DNSSEC validation is enabled, then an attacker who can force a
	 DNS server to validate a specially crafted signed domain can use a
	 lot of CPU in the validator. This only affects dnsmasq installations
	 with DNSSEC enabled.
	</blockquote>
	Stichting NLnet Labs reports:
	<blockquote cite="https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/">
	 
	 The KeyTrap [CVE-2023-50387] vulnerability works by using a
	 combination of Keys (also colliding Keys), Signatures and number of
	 RRSETs on a malicious zone. Answers from that zone can force a
	 DNSSEC validator down a very CPU intensive and time costly
	 validation path.
	 
	 
	 The NSEC3 [CVE-2023-50868] vulnerability uses specially crafted responses on a
	 malicious zone with multiple NSEC3 RRSETs to force a DNSSEC
	 validator down a very CPU intensive and time costly NSEC3 hash
	 calculation path.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-50387</cvename>
 <cvename>CVE-2023-50868</cvename>
 <url>https://kb.isc.org/docs/cve-2023-50387</url>
 <url>https://kb.isc.org/docs/cve-2023-50868</url>
 <url>https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html</url>
 <url>https://blog.powerdns.com/2024/02/13/powerdns-recursor-4-8-6-4-9-3-5-0-2-released</url>
 <url>https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/</url>
 <freebsdsa>SA-24:03.unbound</freebsdsa>
 </references>
 <dates>
 <discovery>2024-02-06</discovery>
 <entry>2024-02-13</entry>
 <modified>2024-04-01</modified>
 </dates>
 </vuln>

<vuln vid="cbfc1591-c8c0-11ee-b45a-589cfc0f81b0">
 <topic>phpmyfaq -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyfaq-php81</name>
	<name>phpmyfaq-php82</name>
	<name>phpmyfaq-php83</name>
	<range><lt>3.2.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	phpMyFAQ team reports:
	<blockquote cite="https://www.phpmyfaq.de/security/advisory-2024-02-05">
	 phpMyFAQ doesn't implement sufficient checks to avoid XSS when
	 storing on attachments filenames. The 'sharing FAQ' functionality
	 allows any unauthenticated actor to misuse the phpMyFAQ application
	 to send arbitrary emails to a large range of targets. phpMyFAQ's
	 user removal page allows an attacker to spoof another user's
	 detail, and in turn make a compelling phishing case for removing
	 another user's account.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx</url>
 <url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9hhf-xmcw-r3xg</url>
 <url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6648-6g96-mg35</url>
 </references>
 <dates>
 <discovery>2024-02-05</discovery>
 <entry>2024-02-11</entry>
 </dates>
 </vuln>

<vuln vid="f161a5ad-c9bd-11ee-b7a7-353f1e043d9a">
 <topic>openexr -- Heap Overflow in Scanline Deep Data Parsing</topic>
 <affects>
 <package>
	<name>openexr</name>
	<range><lt>3.1.12</lt></range>
	<range><ge>3.2.0</ge><lt>3.2.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Austin Hackers Anonymous report:
	<blockquote cite="https://takeonme.org/cves/CVE-2023-5841.html">
	 Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEXR image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability.
	</blockquote>
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.2">
	 [...] it is in a routine that is predominantly used for development and
	 testing. It is not likely to appear in production code.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-5841</cvename>
 <url>https://takeonme.org/cves/CVE-2023-5841.html</url>
 <url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.2</url>
 </references>
 <dates>
 <discovery>2023-10-26</discovery>
 <entry>2024-02-12</entry>
 </dates>
 </vuln>

<vuln vid="388eefc0-c93f-11ee-92ce-4ccc6adda413">
 <topic>readstat -- Heap buffer overflow in readstat_convert</topic>
 <affects>
 <package>
	<name>readstat</name>
	<range><lt>1.1.9</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Google reports:
	<blockquote cite="https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33991">
	 A heap buffer overflow exists in readstat_convert.
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33991</url>
 <url>https://osv.dev/vulnerability/OSV-2021-732</url>
 <url>https://github.com/WizardMac/ReadStat/issues/285</url>
 </references>
 <dates>
 <discovery>2021-05-05</discovery>
 <entry>2024-02-12</entry>
 </dates>
 </vuln>

<vuln vid="cb22a9a6-c907-11ee-8d1c-40b034429ecf">
 <topic>p5-Spreadsheet-ParseExcel -- Remote Code Execution Vulnerability</topic>
 <affects>
 <package>
	<name>p5-Spreadsheet-ParseExcel</name>
	<range><lt>0.66</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Spreadsheet-ParseExcel reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2023-7101">
	 
	 Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files.
	 Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability
	 due to passing unvalidated input from a file into a string-type eval "eval".
	 Specifically, the issue stems from the evaluation of Number format strings
	 (not to be confused with printf-style format strings) within the Excel parsing logic.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-7101</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-7101</url>
 </references>
 <dates>
 <discovery>2023-12-29</discovery>
 <entry>2024-02-11</entry>
 </dates>
 </vuln>

<vuln vid="19e6dd1b-c6a5-11ee-9cd0-6cc21735f730">
 <topic>postgresql-server -- non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL</topic>
 <affects>
 <package>
	<name>postgresql-server</name>
	<range><lt>15.6</lt></range>
	<range><lt>14.11</lt></range>
	<range><lt>13.14</lt></range>
	<range><lt>12.18</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL Project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2024-0985/">
	 
	 One step of a concurrent refresh command was run under
	 weak security restrictions. If a materialized view's
	 owner could persuade a superuser or other
	 high-privileged user to perform a concurrent refresh on
	 that view, the view's owner could control code executed
	 with the privileges of the user running REFRESH. The fix
	 for the vulnerability makes is so that all
	 user-determined code is run as the view's owner, as
	 expected.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-0985</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2024-0985/</url>
 </references>
 <dates>
 <discovery>2024-02-08</discovery>
 <entry>2024-02-08</entry>
 </dates>
 </vuln>

<vuln vid="6b2cba6a-c6a5-11ee-97d0-001b217b3468">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.8.0</ge><lt>16.8.2</lt></range>
	<range><ge>16.7.0</ge><lt>16.7.5</lt></range>
	<range><ge>13.3.0</ge><lt>16.6.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/02/07/security-release-gitlab-16-8-2-released/">
	 Restrict group access token creation for custom roles
	 Project maintainers can bypass group's scan result policy block_branch_modification setting
	 ReDoS in CI/CD Pipeline Editor while verifying Pipeline syntax
	 Resource exhaustion using GraphQL vulnerabilitiesCountByDay
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-1250</cvename>
 <cvename>CVE-2023-6840</cvename>
 <cvename>CVE-2023-6386</cvename>
 <cvename>CVE-2024-1066</cvename>
 <url>https://about.gitlab.com/releases/2024/02/07/security-release-gitlab-16-8-2-released/</url>
 </references>
 <dates>
 <discovery>2024-02-07</discovery>
 <entry>2024-02-08</entry>
 </dates>
 </vuln>

<vuln vid="33ba2241-c68e-11ee-9ef3-001999f8d30b">
 <topic>Composer -- Code execution and possible privilege escalation</topic>
 <affects>
 <package>
	<name>php81-composer</name>
	<range><lt>2.7.0</lt></range>
 </package>
 <package>
	<name>php82-composer</name>
	<range><lt>2.7.0</lt></range>
 </package>
 <package>
	<name>php83-composer</name>
	<range><lt>2.7.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Copmposer reports:
	<blockquote cite="https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h">
	 Code execution and possible privilege escalation via
	 compromised InstalledVersions.php or installed.php.
	 Several files within the local working directory are
	 included during the invocation of Composer and in the
	 context of the executing user.
	 As such, under certain conditions arbitrary code
	 execution may lead to local privilege escalation, provide
	 lateral user movement or malicious code execution when
	 Composer is invoked within a directory with tampered
	 files.
	 All Composer CLI commands are affected, including
	 composer.phar's self-update.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-24821</cvename>
 <url>https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h</url>
 </references>
 <dates>
 <discovery>2024-02-08</discovery>
 <entry>2024-02-08</entry>
 </dates>
 </vuln>

<vuln vid="43768ff3-c683-11ee-97d0-001b217b3468">
 <topic>Libgit2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>eza</name>
	<range><lt>0.18.2</lt></range>
 </package>
 <package>
	<name>libgit2</name>
	<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
	<range><lt>1.6.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Git community reports:
	<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v1.7.2">
	 A bug in git_revparse_single is fixed that could have caused the function to enter an infinite loop given well-crafted inputs, potentially causing a Denial of Service attack in the calling application
	 A bug in git_revparse_single is fixed that could have caused the function to enter an infinite loop given well-crafted inputs, potentially causing a Denial of Service attack in the calling application
	 A bug in the smart transport negotiation could have caused an out-of-bounds read when a remote server did not advertise capabilities
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-24577</cvename>
 <url>https://github.com/libgit2/libgit2/releases/tag/v1.7.2</url>
 </references>
 <dates>
 <discovery>2024-02-06</discovery>
 <entry>2024-02-08</entry>
 <modified>2024-02-14</modified>
 </dates>
 </vuln>

<vuln vid="19047673-c680-11ee-86bb-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>121.0.6167.160</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>121.0.6167.160</lt></range>
 </package>
 <package>
 <name>qt5-webengine</name>
 <range><lt>5.15.16.p5_5</lt></range>
 </package>
 <package>
 <name>qt6-webengine</name>
 <range><lt>6.6.1_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop.html">
	 This update includes 3 security fixes:
	 <ul>
	 <li>[41494539] High CVE-2024-1284: Use after free in Mojo. Reported by Anonymous on 2024-01-25</li>
	 <li>[41494860] High CVE-2024-1283: Heap buffer overflow in Skia. Reported by Jorge Buzeti (@r3tr074) on 2024-01-25</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-1284</cvename>
 <cvename>CVE-2024-1283</cvename>
 <url>https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2024-02-06</discovery>
 <entry>2024-02-08</entry>
 </dates>
 </vuln>

<vuln vid="68ae70c5-c5e5-11ee-9768-08002784c58d">
 <topic>clamav -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>1.2.2,1</lt></range>
 </package>
 <package>
	<name>clamav-lts</name>
	<range><lt>1.0.5,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The ClamAV project reports:
	<blockquote cite="https://blog.clamav.net/2023/11/clamav-130-122-105-released.html">
	 <dl>
	 <dt>CVE-2024-20290</dt>
	 <dd>
	 A vulnerability in the OLE2 file format parser of ClamAV
	 could allow an unauthenticated, remote attacker to cause
	 a denial of service (DoS) condition on an affected
	 device. This vulnerability is due to an incorrect check
	 for end-of-string values during scanning, which may
	 result in a heap buffer over-read. An attacker could
	 exploit this vulnerability by submitting a crafted file
	 containing OLE2 content to be scanned by ClamAV on an
	 affected device. A successful exploit could allow the
	 attacker to cause the ClamAV scanning process to
	 terminate, resulting in a DoS condition on the affected
	 software and consuming available system resources.
	 </dd>
	 <dt>CVE-2024-20328</dt>
	 <dd>
	 Fixed a possible command injection vulnerability in the
	 "VirusEvent" feature of ClamAV's ClamD
	 service. To fix this issue, we disabled the '%f' format
	 string parameter.	 ClamD administrators may continue to
	 use the `CLAM_VIRUSEVENT_FILENAME` environment variable,
	 instead of '%f'. But you should do so only from within
	 an executable, such as a Python script, and not directly
	 in the clamd.conf "VirusEvent" command.
	 </dd>
	 </dl>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-20290</cvename>
 <cvename>CVE-2024-20328</cvename>
 <url>https://blog.clamav.net/2023/11/clamav-130-122-105-released.html</url>
 </references>
 <dates>
 <discovery>2024-02-07</discovery>
 <entry>2024-02-07</entry>
 </dates>
 </vuln>

<vuln vid="e0f6215b-c59e-11ee-a6db-080027a5b8e9">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py39-django32</name>
	<name>py310-django32</name>
	<name>py311-django32</name>
	<range><lt>3.2.24</lt></range>
 </package>
 <package>
	<name>py39-django42</name>
	<name>py310-django42</name>
	<name>py311-django42</name>
	<range><lt>4.2.8</lt></range>
 </package>
 <package>
	<name>py311-django50</name>
	<range><lt>5.0.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Django reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2024/feb/06/security-releases/">
	 CVE-2024-24680:Potential denial-of-service in intcomma template filter.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-24680</cvename>
 <url>https://www.djangoproject.com/weblog/2024/feb/06/security-releases/</url>
 </references>
 <dates>
 <discovery>2024-01-09</discovery>
 <entry>2024-02-07</entry>
 </dates>
 </vuln>

<vuln vid="dc9e5237-c197-11ee-86bb-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>121.0.6167.139</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>121.0.6167.139</lt></range>
 </package>
 <package>
 <name>qt5-webengine</name>
 <range><lt>5.15.16.p5_5</lt></range>
 </package>
 <package>
 <name>qt6-webengine</name>
 <range><lt>6.6.1_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_30.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[1511567] High CVE-2024-1060: Use after free in Canvas. Reported by Anonymous on 2023-12-14</li>
	 <li>[1514777] High CVE-2024-1059: Use after free in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2023-12-29</li>
	 <li>[1511085] High CVE-2024-1077: Use after free in Network. Reported by Microsoft Security Research Center on 2023-12-13</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-1060</cvename>
 <cvename>CVE-2024-1059</cvename>
 <cvename>CVE-2024-1077</cvename>
 <url>https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_30.html</url>
 </references>
 <dates>
 <discovery>2024-01-30</discovery>
 <entry>2024-02-02</entry>
 </dates>
 </vuln>

<vuln vid="72d6d757-c197-11ee-86bb-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>121.0.6167.85</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>121.0.6167.85</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_23.html">
	 This update includes 17 security fixes:
	 <ul>
	 <li>[1484394] High CVE-2024-0812: Inappropriate implementation in Accessibility. Reported by Anonymous on 2023-09-19</li>
	 <li>[1504936] High CVE-2024-0808: Integer underflow in WebUI. Reported by Lyra Rebane (rebane2001) on 2023-11-24</li>
	 <li>[1496250] Medium CVE-2024-0810: Insufficient policy enforcement in DevTools. Reported by Shaheen Fazim on 2023-10-26</li>
	 <li>[1463935] Medium CVE-2024-0814: Incorrect security UI in Payments. Reported by Muneaki Nishimura (nishimunea) on 2023-07-11</li>
	 <li>[1477151] Medium CVE-2024-0813: Use after free in Reading Mode. Reported by @retsew0x01 on 2023-08-30</li>
	 <li>[1505176] Medium CVE-2024-0806: Use after free in Passwords. Reported by 18楼梦想改造家 on 2023-11-25</li>
	 <li>[1514925] Medium CVE-2024-0805: Inappropriate implementation in Downloads. Reported by Om Apip on 2024-01-01</li>
	 <li>[1515137] Medium CVE-2024-0804: Insufficient policy enforcement in iOS Security UI. Reported by Narendra Bhati of Suma Soft Pvt. Ltd. Pune (India) on 2024-01-03</li>
	 <li>[1494490] Low CVE-2024-0811: Inappropriate implementation in Extensions API. Reported by Jann Horn of Google Project Zero on 2023-10-21</li>
	 <li>[1497985] Low CVE-2024-0809: Inappropriate implementation in Autofill. Reported by Ahmed ElMasry on 2023-10-31</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-0812</cvename>
 <cvename>CVE-2024-0808</cvename>
 <cvename>CVE-2024-0810</cvename>
 <cvename>CVE-2024-0814</cvename>
 <cvename>CVE-2024-0813</cvename>
 <cvename>CVE-2024-0806</cvename>
 <cvename>CVE-2024-0805</cvename>
 <cvename>CVE-2024-0804</cvename>
 <cvename>CVE-2024-0811</cvename>
 <cvename>CVE-2024-0809</cvename>
 <url>https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_23.html</url>
 </references>
 <dates>
 <discovery>2024-01-23</discovery>
 <entry>2024-02-02</entry>
 </dates>
 </vuln>

<vuln vid="13a8c4bf-cb2b-48ec-b49c-a3875c72b3e8">
 <topic>electron{26,27,28} -- Use after free in Web Audio</topic>
 <affects>
 <package>
	<name>electron26</name>
	<range><lt>26.6.8</lt></range>
 </package>
 <package>
	<name>electron27</name>
	<range><lt>27.3.1</lt></range>
 </package>
 <package>
	<name>electron28</name>
	<range><lt>28.2.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers reports:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v26.6.8">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2024-0807.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-0807</cvename>
 <url>https://github.com/advisories/GHSA-hjm7-v5pw-x89r</url>
 </references>
 <dates>
 <discovery>2024-01-31</discovery>
 <entry>2024-02-01</entry>
 </dates>
 </vuln>

<vuln vid="bbcb1584-c068-11ee-bdd6-4ccc6adda413">
 <topic>qt6-webengine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>qt5-webengine</name>
	<range><lt>5.15.16.p5_5</lt></range>
 </package>
 <package>
	<name>qt6-webengine</name>
	<range><lt>6.6.1_4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Qt qtwebengine-chromium repo reports:
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=112-based">
	 Backports for 3 security bugs in Chromium:
	 <ul>
	 <li>[1505080] High CVE-2024-0807: Use after free in WebAudio</li>
	 <li>[1504936] Critical CVE-2024-0808: Integer underflow in WebUI</li>
	 <li>[1496250] Medium CVE-2024-0810: Insufficient policy enforcement in DevTools</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-0807</cvename>
 <cvename>CVE-2024-0808</cvename>
 <cvename>CVE-2024-0810</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=112-based</url>
 </references>
 <dates>
 <discovery>2024-01-30</discovery>
 <entry>2024-01-31</entry>
 </dates>
 </vuln>

<vuln vid="10dee731-c069-11ee-9190-84a93843eb75">
 <topic>OpenSSL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>3.0.13,1</lt></range>
 </package>
 <package>
	<name>openssl-quictls</name>
	<range><lt>3.0.13</lt></range>
 </package>
 <package>
	<name>openssl31</name>
	<range><lt>3.1.5</lt></range>
 </package>
 <package>
	<name>openssl31-quictls</name>
	<range><lt>3.1.5</lt></range>
 </package>
 <package>
	<name>openssl32</name>
	<range><lt>3.2.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20240125.txt">
	 Excessive time spent checking invalid RSA public keys (CVE-2023-6237)
	 PKCS12 Decoding crashes (CVE-2024-0727)
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-0727</cvename>
 <cvename>CVE-2023-6237</cvename>
 <url>https://www.openssl.org/news/secadv/20240125.txt</url>
 <url>https://www.openssl.org/news/secadv/20240115.txt</url>
 <url>https://www.openssl.org/news/openssl-3.0-notes.html</url>
 <url>https://www.openssl.org/news/openssl-3.1-notes.html</url>
 <url>https://www.openssl.org/news/openssl-3.2-notes.html</url>
 </references>
 <dates>
 <discovery>2024-01-30</discovery>
 <entry>2024-01-31</entry>
 </dates>
 </vuln>

<vuln vid="67c2eb06-5579-4595-801b-30355be24654">
 <topic>lizard -- Negative size passed to memcpy resulting in memory corruption</topic>
 <affects>
 <package>
	<name>lizard</name>
	<range><lt>1.0_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://github.com/inikep/lizard/issues/16">
	 In Lizard v1.0 and LZ5 v2.0 (the prior release, before the product
	was renamed), there is an unchecked buffer size during a memcpy in
	the Lizard_decompress_LIZv1 function (lib/lizard_decompress_liz.h).
	Remote attackers can leverage this vulnerability to cause a denial
	of service via a crafted input file, as well as achieve remote code
	execution.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2018-11498</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2018-11498</url>
 </references>
 <dates>
 <discovery>2018-05-26</discovery>
 <entry>2024-01-31</entry>
 </dates>
 </vuln>

<vuln vid="a25b323a-bed9-11ee-bdd6-4ccc6adda413">
 <topic>qt6-webengine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>qt6-webengine</name>
	<range><lt>6.6.1_3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Qt qtwebengine-chromium repo reports:
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=112-based">
	 Backports for 15 security bugs in Chromium:
	 <ul>
	 <li>[1505053] High CVE-2023-6345: Integer overflow in Skia</li>
	 <li>[1500856] High CVE-2023-6346: Use after free in WebAudio</li>
	 <li>[1494461] High CVE-2023-6347: Use after free in Mojo</li>
	 <li>[1501326] High CVE-2023-6702: Type Confusion in V8</li>
	 <li>[1502102] High CVE-2023-6703: Use after free in Blink</li>
	 <li>[1505708] High CVE-2023-6705: Use after free in WebRTC</li>
	 <li>[1500921] High CVE-2023-6706: Use after free in FedCM</li>
	 <li>[1513170] High CVE-2023-7024: Heap buffer overflow in WebRTC</li>
	 <li>[1501798] High CVE-2024-0222: Use after free in ANGLE</li>
	 <li>[1505009] High CVE-2024-0223: Heap buffer overflow in ANGLE</li>
	 <li>[1505086] High CVE-2024-0224: Use after free in WebAudio</li>
	 <li>[1506923] High CVE-2024-0225: Use after free in WebGPU</li>
	 <li>[1513379] High CVE-2024-0333: Insufficient data validation in Extensions</li>
	 <li>[1507412] High CVE-2024-0518: Type Confusion in V8</li>
	 <li>[1517354] High CVE-2024-0519: Out of bounds memory access in V8</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-6345</cvename>
 <cvename>CVE-2023-6346</cvename>
 <cvename>CVE-2023-6347</cvename>
 <cvename>CVE-2023-6702</cvename>
 <cvename>CVE-2023-6703</cvename>
 <cvename>CVE-2023-6705</cvename>
 <cvename>CVE-2023-6706</cvename>
 <cvename>CVE-2023-7024</cvename>
 <cvename>CVE-2024-0222</cvename>
 <cvename>CVE-2024-0223</cvename>
 <cvename>CVE-2024-0224</cvename>
 <cvename>CVE-2024-0225</cvename>
 <cvename>CVE-2024-0333</cvename>
 <cvename>CVE-2024-0518</cvename>
 <cvename>CVE-2024-0519</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=112-based</url>
 </references>
 <dates>
 <discovery>2024-01-08</discovery>
 <entry>2024-01-29</entry>
 </dates>
 </vuln>

<vuln vid="a11e7dd1-bed4-11ee-bdd6-4ccc6adda413">
 <topic>qt5-webengine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>qt5-webengine</name>
	<range><lt>5.15.16.p5_4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Qt qtwebengine-chromium repo reports:
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based">
	 Backports for 8 security bugs in Chromium:
	 <ul>
	 <li>[1505053] High CVE-2023-6345: Integer overflow in Skia</li>
	 <li>[1501326] High CVE-2023-6702: Type Confusion in V8</li>
	 <li>[1513170] High CVE-2023-7024: Heap buffer overflow in WebRTC</li>
	 <li>[1501798] High CVE-2024-0222: Use after free in ANGLE</li>
	 <li>[1505086] High CVE-2024-0224: Use after free in WebAudio</li>
	 <li>[1513379] High CVE-2024-0333: Insufficient data validation in Extensions</li>
	 <li>[1507412] High CVE-2024-0518: Type Confusion in V8</li>
	 <li>[1517354] High CVE-2024-0519: Out of bounds memory access in V8</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-6345</cvename>
 <cvename>CVE-2023-6702</cvename>
 <cvename>CVE-2023-7024</cvename>
 <cvename>CVE-2024-0222</cvename>
 <cvename>CVE-2024-0224</cvename>
 <cvename>CVE-2024-0333</cvename>
 <cvename>CVE-2024-0518</cvename>
 <cvename>CVE-2024-0519</cvename>
 <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based</url>
 </references>
 <dates>
 <discovery>2024-01-08</discovery>
 <entry>2024-01-29</entry>
 </dates>
 </vuln>

<vuln vid="b5e22ec5-bc4b-11ee-b0b5-b42e991fc52e">
 <topic>rclone -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rclone</name>
	<range><lt>1.65.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Multiple vulnerabilities in ssh and golang
	<blockquote cite="https://github.com/go-resty/resty/commit/577fed8730d79f583eb48dfc81674164e1fc471e">
	 <ul>
	 <li>
	 CVE-2023-45286: HTTP request body disclosure in go-resty
	 disclosure across requests.
	 </li>
	 <li>
	 CVE-2023-48795: The SSH transport protocol with certain
	 OpenSSH extensions, found in OpenSSH before 9.6 and
	 other products, allows remote attackers to bypass
	 integrity checks.
	 </li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-45286</cvename>
 <cvename>CVE-2023-48795</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-45286</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-48795</url>
 </references>
 <dates>
 <discovery>2023-11-28</discovery>
 <entry>2024-01-26</entry>
 </dates>
 </vuln>

<vuln vid="61fe903b-bc2e-11ee-b06e-001b217b3468">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.8.0</ge><lt>16.8.1</lt></range>
	<range><ge>16.7.0</ge><lt>16.7.4</lt></range>
	<range><ge>16.6.0</ge><lt>16.6.6</lt></range>
	<range><ge>12.7.0</ge><lt>16.5.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/">
	 Arbitrary file write while creating workspace
	 ReDoS in Cargo.toml blob viewer
	 Arbitrary API PUT requests via HTML injection in user's name
	 Disclosure of the public email in Tags RSS Feed
	 Non-Member can update MR Assignees of owned MRs
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-0402</cvename>
 <cvename>CVE-2023-6159</cvename>
 <cvename>CVE-2023-5933</cvename>
 <cvename>CVE-2023-5612</cvename>
 <cvename>CVE-2024-0456</cvename>
 <url>https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/</url>
 </references>
 <dates>
 <discovery>2024-01-25</discovery>
 <entry>2024-01-26</entry>
 </dates>
 </vuln>

<vuln vid="8b03d274-56ca-489e-821a-cf32f07643f0">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.422</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.426.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2024-01-24/">
	 <h1>Description</h1>
	 <h5>(Critical) SECURITY-3314 / CVE-2024-23897</h5>
	 Arbitrary file read vulnerability through the CLI can lead to RCE
	 <h1>Description</h1>
	 <h5>(High) SECURITY-3315 / CVE-2024-23898</h5>
	 Cross-site WebSocket hijacking vulnerability in the CLI
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-23897</cvename>
 <cvename>CVE-2024-23898</cvename>
 <url>https://www.jenkins.io/security/advisory/2024-01-24/</url>
 </references>
 <dates>
 <discovery>2024-01-24</discovery>
 <entry>2024-01-24</entry>
 </dates>
 </vuln>

<vuln vid="9532a361-b84d-11ee-b0d7-84a93843eb75">
 <topic>TinyMCE -- mXSS in multiple plugins</topic>
 <affects>
 <package>
	<name>tinymce</name>
	<range><lt>6.7.3</lt></range>
 </package>
 <package>
	<name>roundcube</name>
	<range><lt>1.6.6,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	TinyMCE reports:
	<blockquote cite="https://github.com/tinymce/tinymce/security/advisories/GHSA-v626-r774-j7f8">
	 Special characters in unescaped text nodes can trigger mXSS
	 when using TinyMCE undo/redo, getContentAPI, resetContentAPI,
	 and Autosave plugin
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-48219</cvename>
 <url>https://github.com/tinymce/tinymce/security/advisories/GHSA-v626-r774-j7f8</url>
 <url>https://github.com/roundcube/roundcubemail/releases/tag/1.6.6</url>
 </references>
 <dates>
 <discovery>2023-11-15</discovery>
 <entry>2024-01-23</entry>
 </dates>
 </vuln>

<vuln vid="fedf7e71-61bd-49ec-aaf0-6da14bdbb319">
 <topic>zeek -- potential DoS vulnerability</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>6.0.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v6.0.3">
	 A specially-crafted series of packets containing nested
	 MIME entities can cause Zeek to spend large amounts of
	 time parsing the entities. 
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v6.0.3</url>
 </references>
 <dates>
 <discovery>2024-01-22</discovery>
 <entry>2024-01-22</entry>
 </dates>
 </vuln>

<vuln vid="2264566a-a890-46eb-a895-7881dd220bd0">
 <topic>electron26 -- Out of bounds memory access in V8</topic>
 <affects>
 <package>
	<name>electron26</name>
	<range><lt>26.6.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v26.6.7">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2024-0519.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-0519</cvename>
 <url>https://github.com/advisories/GHSA-vg6w-jr5m-86c8</url>
 </references>
 <dates>
 <discovery>2024-01-18</discovery>
 <entry>2024-01-19</entry>
 </dates>
 </vuln>

<vuln vid="a8326b61-eda0-4c03-9a5b-49ebd8f41c1a">
 <topic>electron{26,27} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron26</name>
	<range><lt>26.6.6</lt></range>
 </package>
 <package>
	<name>electron27</name>
	<range><lt>27.2.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v27.2.3">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-0518.</li>
	 <li>Security: backported fix for CVE-2024-0517.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-0518</cvename>
 <url>https://github.com/advisories/GHSA-4pvg-f3m8-ff3j</url>
 <cvename>CVE-2024-0517</cvename>
 <url>https://github.com/advisories/GHSA-v39r-662x-j524</url>
 </references>
 <dates>
 <discovery>2024-01-17</discovery>
 <entry>2024-01-17</entry>
 <modified>2024-01-18</modified>
 </dates>
 </vuln>

<vuln vid="1bc07be0-b514-11ee-86bb-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>120.0.6099.224</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>120.0.6099.224</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[1515930] High CVE-2024-0517: Out of bounds write in V8. Reported by Toan (suto) Pham of Qrious Secure on 2024-01-06</li>
	 <li>[1507412] High CVE-2024-0518: Type Confusion in V8. Reported by Ganjiang Zhou(@refrain_areu) of ChaMd5-H1 team on 2023-12-03</li>
	 <li>[1517354] High CVE-2024-0519: Out of bounds memory access in V8. Reported by Anonymous on 2024-01-11</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-0517</cvename>
 <cvename>CVE-2024-0518</cvename>
 <cvename>CVE-2024-0519</cvename>
 <url>https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html</url>
 </references>
 <dates>
 <discovery>2024-01-16</discovery>
 <entry>2024-01-17</entry>
 </dates>
 </vuln>

<vuln vid="7467c611-b490-11ee-b903-001fc69cd6dc">
 <topic>xorg server -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<name>xephyr</name>
	<name>xorg-vfbserver</name>
	<range><lt>21.1.11,1</lt></range>
 </package>
 <package>
	<name>xorg-nextserver</name>
	<range><lt>21.1.11,2</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>23.2.4</lt></range>
 </package>
 <package>
	<name>xwayland-devel</name>
	<range><lt>21.0.99.1.653</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The X.Org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg/2024-January/061525.html">
	 <ul>
	 <li>CVE-2023-6816: Heap buffer overflow in DeviceFocusEvent
	 and ProcXIQueryPointer

Both DeviceFocusEvent and the XIQueryPointer reply contain a bit
	 for each logical button currently down. Buttons can be arbitrarily
	 mapped to any value up to 255 but the X.Org Server was only
	 allocating space for the device's number of buttons,
	 leading to a heap overflow if a bigger value was used.</li>
	 <li>CVE-2024-0229: Reattaching to different master device may lead
	 to out-of-bounds memory access

If a device has both a button class and a key class and
	 numButtons is zero, we can get an out-of-bounds write due
	 to event under-allocation in the DeliverStateNotifyEvent
	 function.</li>

<li>CVE-2024-21885: Heap buffer overflow in
	 XISendDeviceHierarchyEvent

The XISendDeviceHierarchyEvent() function allocates space to
	 store up to MAXDEVICES (256) xXIHierarchyInfo structures in info.
	 If a device with a given ID was removed and a new device with
	 the same ID added both in the same operation,
	 the single device ID will lead to two info structures being
	 written to info.
	 Since this case can occur for every device ID at once,
	 a total of two times MAXDEVICES info structures might be written
	 to the allocation, leading to a heap buffer overflow.</li>

<li>CVE-2024-21886: Heap buffer overflow in DisableDevice

The DisableDevice() function is called whenever an enabled device
	 is disabled and it moves the device from the inputInfo.devices
	 linked list to the inputInfo.off_devices linked list.
	 However, its link/unlink operation has an issue during the recursive
	 call to DisableDevice() due to the prev pointer pointing to a
	 removed device.
	 This issue leads to a length mismatch between the total number of
	 devices and the number of device in the list, leading to a heap
	 overflow and, possibly, to local privilege escalation.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-6816</cvename>
 <cvename>CVE-2024-0229</cvename>
 <cvename>CVE-2024-21885</cvename>
 <cvename>CVE-2024-21886</cvename>
 <url>https://lists.x.org/archives/xorg/2024-January/061525.html</url>
 </references>
 <dates>
 <discovery>2024-01-16</discovery>
 <entry>2024-01-16</entry>
 </dates>
 </vuln>

<vuln vid="28b42ef5-80cd-440c-904b-b7fbca74c73d">
 <topic>electron{26,27} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron26</name>
	<range><lt>26.6.5</lt></range>
 </package>
 <package>
	<name>electron27</name>
	<range><lt>27.2.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v26.6.5">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2024-0224.</li>
	 <li>Security: backported fix for CVE-2024-0225.</li>
	 <li>Security: backported fix for CVE-2024-0223.</li>
	 <li>Security: backported fix for CVE-2024-0222.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2024-0224</cvename>
 <url>https://github.com/advisories/GHSA-83wx-v283-85g9</url>
 <cvename>CVE-2024-0225</cvename>
 <url>https://github.com/advisories/GHSA-gqr9-4fcc-c9jq</url>
 <cvename>CVE-2024-0223</cvename>
 <url>https://github.com/advisories/GHSA-w8x8-g534-x4rp</url>
 <cvename>CVE-2024-0222</cvename>
 <url>https://github.com/advisories/GHSA-c87c-56pw-mwgh</url>
 </references>
 <dates>
 <discovery>2024-01-10</discovery>
 <entry>2024-01-12</entry>
 </dates>
 </vuln>

<vuln vid="4c8c2218-b120-11ee-90ec-001b217b3468">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.7.0</ge><lt>16.7.2</lt></range>
	<range><ge>16.6.0</ge><lt>16.6.4</lt></range>
	<range><ge>8.13.0</ge><lt>16.5.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/">
	 Account Takeover via Password Reset without user interactions
	 Attacker can abuse Slack/Mattermost integrations to execute slash commands as another user
	 Bypass CODEOWNERS approval removal
	 Workspaces able to be created under different root namespace
	 Commit signature validation ignores headers after signature
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-7028</cvename>
 <cvename>CVE-2023-5356</cvename>
 <cvename>CVE-2023-4812</cvename>
 <cvename>CVE-2023-6955</cvename>
 <cvename>CVE-2023-2030</cvename>
 <url>https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/</url>
 </references>
 <dates>
 <discovery>2024-01-11</discovery>
 <entry>2024-01-12</entry>
 </dates>
 </vuln>

<vuln vid="8337251b-b07b-11ee-b0d7-84a93843eb75">
 <topic>OpenSSL -- Vector register corruption on PowerPC</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>3.0.12_2,1</lt></range>
 </package>
 <package>
	<name>openssl-quictls</name>
	<range><lt>3.0.12_2</lt></range>
 </package>
 <package>
	<name>openssl31</name>
	<range><lt>3.1.4_2</lt></range>
 </package>
 <package>
	<name>openssl31-quictls</name>
	<range><lt>3.1.4_2</lt></range>
 </package>
 <package>
	<name>openssl32</name>
	<range><lt>3.2.0_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL Team reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20240109.txt">
	 The POLY1305 MAC (message authentication code) implementation
	 contains a bug that might corrupt the internal state of applications running
	 on PowerPC CPU based platforms if the CPU provides vector instructions.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-6129</cvename>
 <url>https://www.openssl.org/news/secadv/20240109.txt</url>
 </references>
 <dates>
	<discovery>2024-01-09</discovery>
 <entry>2024-01-11</entry>
 </dates>
 </vuln>

<vuln vid="ec8e4040-afcd-11ee-86bb-a8a1599412c6">
 <topic>chromium -- security fix</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>120.0.6099.216</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>120.0.6099.216</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_9.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[1513379] High CVE-2024-0333: Insufficient data validation in Extensions. Reported by Malcolm Stagg (@malcolmst) of SODIUM-24, LLC on 2023-12-20</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-0333</cvename>
 <url>https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_9.html</url>
 </references>
 <dates>
 <discovery>2024-01-09</discovery>
 <entry>2024-01-10</entry>
 </dates>
 </vuln>

<vuln vid="e2f981f1-ad9e-11ee-8b55-4ccc6adda413">
 <topic>QtNetwork -- potential buffer overflow</topic>
 <affects>
 <package>
	<name>qt5-network</name>
	<range><lt>5.15.12p148_1</lt></range>
 </package>
 <package>
	<name>qt6-base</name>
	<range><lt>6.6.1_2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Andy Shaw reports:
	<blockquote cite="https://www.qt.io/blog/security-advisory-potential-integer-overflow-in-qts-http2-implementation">
	 A potential integer overflow has been discovered in Qt's HTTP2
	 implementation. If the HTTP2 implementation receives more than 4GiB
	 in total headers, or more than 2GiB for any given header pair, then
	 the internal buffers may overflow.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-51714</cvename>
 <url>https://www.qt.io/blog/security-advisory-potential-integer-overflow-in-qts-http2-implementation</url>
 </references>
 <dates>
 <discovery>2023-12-14</discovery>
 <entry>2024-01-07</entry>
 </dates>
 </vuln>

<vuln vid="1f0d0024-ac9c-11ee-8e91-1c697a013f4b">
 <topic>mantis -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mantis-php74</name>
	<name>mantis-php80</name>
	<name>mantis-php81</name>
	<name>mantis-php82</name>
	<name>mantis-php83</name>
	<range><lt>2.25.8,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Mantis 2.25.8 release reports:
	<blockquote cite="https://mantisbt.org/bugs/changelog_page.php?version_id=370">
	 Security and maintenance release
	 <ul>
	 <li>0032432: Update guzzlehttp/psr7 to 1.9.1 (CVE-2023-29197)</li>
	 <li>0032981: Information Leakage on DokuWiki Integration (CVE-2023-44394)</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-29197</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29197</url>
 <cvename>CVE-2023-44394</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44394</url>
 </references>
 <dates>
 <discovery>2023-10-14</discovery>
 <entry>2024-01-06</entry>
 </dates>
 </vuln>

<vuln vid="3ee577a9-aad4-11ee-86bb-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>120.0.6099.199</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>120.0.6099.199</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop.html">
	 This update includes 6 security fixes:
	 <ul>
	 <li>[1501798] High CVE-2024-0222: Use after free in ANGLE. Reported by Toan (suto) Pham of Qrious Secure on 2023-11-13</li>
	 <li>[1505009] High CVE-2024-0223: Heap buffer overflow in ANGLE. Reported by Toan (suto) Pham and Tri Dang of Qrious Secure on 2023-11-24</li>
	 <li>[1505086] High CVE-2024-0224: Use after free in WebAudio. Reported by Huang Xilin of Ant Group Light-Year Security Lab on 2023-11-25</li>
	 <li>[1506923] High CVE-2024-0225: Use after free in WebGPU. Reported by Anonymous on 2023-12-01</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2024-0222</cvename>
 <cvename>CVE-2024-0223</cvename>
 <cvename>CVE-2024-0224</cvename>
 <cvename>CVE-2024-0225</cvename>
 <url>https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2024-01-03</discovery>
 <entry>2024-01-04</entry>
 </dates>
 </vuln>

<vuln vid="d1b20e09-dbdf-432b-83c7-89f0af76324a">
 <topic>electron27 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron27</name>
	<range><lt>27.2.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v27.2.1">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-6706.</li>
	 <li>Security: backported fix for CVE-2023-6705.</li>
	 <li>Security: backported fix for CVE-2023-6703.</li>
	 <li>Security: backported fix for CVE-2023-6702.</li>
	 <li>Security: backported fix for CVE-2023-6704.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-6706</cvename>
 <url>https://github.com/advisories/GHSA-jqrg-rvpw-5fw5</url>
 <cvename>CVE-2023-6705</cvename>
 <url>https://github.com/advisories/GHSA-h27f-fw5q-c2gh</url>
 <cvename>CVE-2023-6703</cvename>
 <url>https://github.com/advisories/GHSA-9v72-359m-2vx4</url>
 <cvename>CVE-2023-6702</cvename>
 <url>https://github.com/advisories/GHSA-7hjc-c62g-4w73</url>
 <cvename>CVE-2023-6704</cvename>
 <url>https://github.com/advisories/GHSA-587x-fmc5-99p9</url>
 </references>
 <dates>
 <discovery>2024-01-04</discovery>
 <entry>2024-01-04</entry>
 </dates>
 </vuln>

<vuln vid="0cee4f9c-5efb-4770-b917-f4e4569e8bec">
 <topic>electron26 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron26</name>
	<range><lt>26.6.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v26.6.4">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-6704.</li>
	 <li>Security: backported fix for CVE-2023-6705.</li>
	 <li>Security: backported fix for CVE-2023-6703.</li>
	 <li>Security: backported fix for CVE-2023-6702.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-6704</cvename>
 <url>https://github.com/advisories/GHSA-587x-fmc5-99p9</url>
 <cvename>CVE-2023-6705</cvename>
 <url>https://github.com/advisories/GHSA-h27f-fw5q-c2gh</url>
 <cvename>CVE-2023-6703</cvename>
 <url>https://github.com/advisories/GHSA-9v72-359m-2vx4</url>
 <cvename>CVE-2023-6702</cvename>
 <url>https://github.com/advisories/GHSA-7hjc-c62g-4w73</url>
 </references>
 <dates>
 <discovery>2024-01-04</discovery>
 <entry>2024-01-04</entry>
 </dates>
 </vuln>

<vuln vid="13d83980-9f18-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- Prefix Truncation Attack in the SSH protocol</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>14.0</ge><lt>14.0_4</lt></range>
	<range><ge>13.2</ge><lt>13.2_9</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The SSH protocol executes an initial handshake between the
	server and the client. This protocol handshake includes the
	possibility of several extensions allowing different options to be
	selected. Validation of the packets in the handshake is done through
	sequence numbers.
	<h1>Impact:</h1>
	A man in the middle attacker can silently manipulate handshake
	messages to truncate extension negotiation messages potentially
	leading to less secure client authentication algorithms or deactivating
	keystroke timing attack countermeasures.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-48795</cvename>
 <freebsdsa>SA-23:19.openssh</freebsdsa>
 </references>
 <dates>
 <discovery>2023-12-19</discovery>
 <entry>2024-01-02</entry>
 </dates>
 </vuln>

<vuln vid="bd7592a1-cbfd-11ee-a42a-5404a6f3ca32">
 <topic>gitea -- Prevent anonymous container access</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.21.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <h1>Problem Description:</h1>
 
 Even with RequireSignInView enabled, anonymous users can use docker pull
 to fetch public images.
 
 </body>
 </description>
 <references>
 <url>https://blog.gitea.com/release-of-1.21.5/</url>
 </references>
 <dates>
 <discovery>2024-01-24</discovery>
 <entry>2024-02-15</entry>
 </dates>
 </vuln>

<vuln vid="7015ab21-9230-490f-a2fe-f7557e3de25d">
 <topic>electron{26,27} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron26</name>
	<range><lt>26.6.3</lt></range>
 </package>
 <package>
	<name>electron27</name>
	<range><lt>27.2.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v26.6.3">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-6508.</li>
	 <li>Security: backported fix for CVE-2023-7024.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-6508</cvename>
 <url>https://github.com/advisories/GHSA-3pr6-6r34-c98x</url>
 <cvename>CVE-2023-7024</cvename>
 <url>https://github.com/advisories/GHSA-7c6v-f3h8-2x89</url>
 </references>
 <dates>
 <discovery>2023-12-21</discovery>
 <entry>2023-12-22</entry>
 </dates>
 </vuln>

<vuln vid="b2765c89-a052-11ee-bed2-596753f1a87c">
 <topic>gitea -- Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.21.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/28519">
	 Update golang.org/x/crypto
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.21.3</url>
 </references>
 <dates>
 <discovery>2023-12-19</discovery>
 <entry>2023-12-21</entry>
 </dates>
 </vuln>

<vuln vid="482bb980-99a3-11ee-b5f7-6bd56600d90c">
 <topic>gitea -- missing permission checks</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.21.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/28406">
	 Fix missing check
	</blockquote>
	<blockquote cite="https://github.com/go-gitea/gitea/pull/28423">
	 Do some missing checks
	</blockquote>
	By crafting an API request, attackers can access the contents of
	issues even though the logged-in user does not have access rights to
	these issues.
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.21.2</url>
 </references>
 <dates>
 <discovery>2023-08-30</discovery>
 <entry>2023-09-10</entry>
 </dates>
 </vuln>

<vuln vid="0f7598cc-9fe2-11ee-b47f-901b0e9408dc">
 <topic>nebula -- security fix for terrapin vulnerability</topic>
 <affects>
 <package>
	<name>nebula</name>
	<range><lt>1.8.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Upstream reports:
	<blockquote cite="https://github.com/slackhq/nebula/releases/tag/v1.8.1">
	 Security fix:
	 <ul>
	 <li>Update golang.org/x/crypto, which includes a fix for CVE-2023-48795.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-48795</cvename>
 <url>https://www.openssh.com/txt/release-9.6</url>
 <url>https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d</url>
 <url>https://terrapin-attack.com/</url>
 </references>
 <dates>
 <discovery>2023-10-16</discovery>
 <entry>2023-12-19</entry>
 </dates>
 </vuln>

<vuln vid="1b2a8e8a-9fd5-11ee-86bb-a8a1599412c6">
 <topic>chromium -- security fix</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>120.0.6099.129</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>120.0.6099.129</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[1513170] High CVE-2023-7024: Heap buffer overflow in WebRTC. Reported by Clément Lecigne and Vlad Stolyarov of Google's Threat Analysis Group on 2023-12-19</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-7024</cvename>
 <url>https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html</url>
 </references>
 <dates>
 <discovery>2023-12-20</discovery>
 <entry>2023-12-21</entry>
 </dates>
 </vuln>

<vuln vid="91955195-9ebb-11ee-bc14-a703705db3a6">
 <topic>putty -- add protocol extension against 'Terrapin attack'</topic>
 <affects>
 <package>
	<name>putty</name>
	<range><lt>0.80</lt></range>
 </package>
 <package>
	<name>putty-nogtk</name>
	<range><lt>0.80</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Simon Tatham reports:
	<blockquote cite="https://lists.tartarus.org/pipermail/putty-announce/2023/000037.html">
		PuTTY version 0.80 [contains] one security fix [...] for a newly discovered security issue known as the 'Terrapin'
 attack, also numbered CVE-2023-48795. The issue affects widely-used
 OpenSSH extensions to the SSH protocol: the ChaCha20+Poly1305
 cipher system, and 'encrypt-then-MAC' mode.
 In order to benefit from the fix, you must be using a fixed version
 of PuTTY _and_ a server with the fix, so that they can agree to
	 adopt a modified version of the protocol. [...]
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-48795</cvename>
 <url>https://lists.tartarus.org/pipermail/putty-announce/2023/000037.html</url>
 <url>https://www.openssh.com/txt/release-9.6</url>
 <url>https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html</url>
 <url>https://terrapin-attack.com/</url>
 </references>
 <dates>
 <discovery>2023-10-16</discovery>
 <entry>2023-12-19</entry>
 </dates>
 </vuln>

<vuln vid="76c2110b-9e97-11ee-ae23-a0f3c100ae18">
 <topic>slurm-wlm -- Several security issues</topic>
 <affects>
 <package>
	<name>slurm-wlm</name>
	<range><lt>23.11.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Slurm releases notes:
	<blockquote cite="https://www.schedmd.com/news.php?id=283#OPT_283">
	 <h1>Description</h1>
	 <h5>CVE-2023-49933 through CVE-2023-49938</h5>
	 Slurm versions 23.11.1, 23.02.7, 22.05.11 are now available
	 and address a number of recently-discovered security issues.
	 They've been assigned CVE-2023-49933 through CVE-2023-49938.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-49933</cvename>
 <cvename>CVE-2023-49934</cvename>
 <cvename>CVE-2023-49935</cvename>
 <cvename>CVE-2023-49936</cvename>
 <cvename>CVE-2023-49937</cvename>
 <cvename>CVE-2023-49938</cvename>
 </references>
 <dates>
 <discovery>2023-11-29</discovery>
 <entry>2023-12-19</entry>
 </dates>
 </vuln>

<vuln vid="fd47fcfe-ec69-4000-b9ce-e5e62102c1c7">
 <topic>couchdb -- information sharing via couchjs processes</topic>
 <affects>
 <package>
	<name>couchdb</name>
	<range><lt>3.3.2,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nick Vatamane reports:
 <blockquote cite="https://docs.couchdb.org/en/stable/cve/2023-26268.html">
	Design documents with matching document IDs, from databases on the
 same cluster, may share a mutable Javascript environment when using
 various design document functions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-26268</cvename>
 <url>https://docs.couchdb.org/en/stable/cve/2023-26268.html</url>
 </references>
 <dates>
 <discovery>2023-05-02</discovery>
 <entry>2023-12-17</entry>
 </dates>
 </vuln>

<vuln vid="e2fb85ce-9a3c-11ee-af26-001b217b3468">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.6.0</ge><lt>16.6.2</lt></range>
	<range><ge>16.5.0</ge><lt>16.5.4</lt></range>
	<range><ge>8.17.0</ge><lt>16.4.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/12/13/security-release-gitlab-16-6-2-released/">
	 Smartcard authentication allows impersonation of arbitrary user using user's public certificate
	 When subgroup is allowed to merge or push to protected branches, subgroup members with the Developer role may gain the ability to push or merge
	 The GitLab web interface does not ensure the integrity of information when downloading the source code from installation packages or tags
	 Project maintainer can escalate to Project owner using project access token rotate API
	 Omission of Double Encoding in File Names Facilitates the Creation of Repositories with Malicious Content
	 Unvalidated timeSpent value leads to unable to load issues on Issue board
	 Developer can bypass predefined variables via REST API
	 Auditor users can create merge requests on projects they don't have access to
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-6680</cvename>
 <cvename>CVE-2023-6564</cvename>
 <cvename>CVE-2023-6051</cvename>
 <cvename>CVE-2023-3907</cvename>
 <cvename>CVE-2023-5512</cvename>
 <cvename>CVE-2023-3904</cvename>
 <cvename>CVE-2023-5061</cvename>
 <cvename>CVE-2023-3511</cvename>
 <url>https://about.gitlab.com/releases/2023/12/13/security-release-gitlab-16-6-2-released/</url>
 </references>
 <dates>
 <discovery>2023-12-13</discovery>
 <entry>2023-12-14</entry>
 </dates>
 </vuln>

<vuln vid="502c9f72-99b3-11ee-86bb-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>120.0.6099.109</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>120.0.6099.109</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html">
	 This update includes 9 security fixes:
	 <ul>
	 <li>[1501326] High CVE-2023-6702: Type Confusion in V8. Reported by Zhiyi Zhang and Zhunki from Codesafe Team of Legendsec at Qi'anxin Group on 2023-11-10</li>
	 <li>[1502102] High CVE-2023-6703: Use after free in Blink. Reported by Cassidy Kim(@cassidy6564) on 2023-11-14</li>
	 <li>[1504792] High CVE-2023-6704: Use after free in libavif. Reported by Fudan University on 2023-11-23</li>
	 <li>[1505708] High CVE-2023-6705: Use after free in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2023-11-28</li>
	 <li>[1500921] High CVE-2023-6706: Use after free in FedCM. Reported by anonymous on 2023-11-09</li>
	 <li>[1504036] Medium CVE-2023-6707: Use after free in CSS. Reported by @ginggilBesel on 2023-11-21</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-6702</cvename>
 <cvename>CVE-2023-6703</cvename>
 <cvename>CVE-2023-6704</cvename>
 <cvename>CVE-2023-6705</cvename>
 <cvename>CVE-2023-6706</cvename>
 <cvename>CVE-2023-6707</cvename>
 <url>https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html</url>
 </references>
 <dates>
 <discovery>2023-12-12</discovery>
 <entry>2023-12-13</entry>
 </dates>
 </vuln>

<vuln vid="8eefff69-997f-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- NFS client data corruption and kernel memory disclosure</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.0</ge><lt>14.0_3</lt></range>
	<range><ge>13.2</ge><lt>13.2_8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	In FreeBSD 13.2 and 14.0, the NFS client was optimized to improve
	the performance of IO_APPEND writes, that is, writes which add data
	to the end of a file and so extend its size. This uncovered an old
	bug in some routines which copy userspace data into the kernel.
	The bug also affects the NFS client's implementation of direct I/O;
	however, this implementation is disabled by default by the
	vfs.nfs.nfs_directio_enable sysctl and is only used to handle
	synchronous writes.
	<h1>Impact:</h1>
	When a program running on an affected system appends data to a
	file via an NFS client mount, the bug can cause the NFS client to
	fail to copy in the data to be written but proceed as though the
	copy operation had succeeded. This means that the data to be written
	is instead replaced with whatever data had been in the packet buffer
	previously. Thus, an unprivileged user with access to an affected
	system may abuse the bug to trigger disclosure of sensitive
	information. In particular, the leak is limited to data previously
	stored in mbufs, which are used for network transmission and
	reception, and for certain types of inter-process communication.
	The bug can also be triggered unintentionally by system
	applications, in which case the data written by the application to an
	NFS mount may be corrupted. Corrupted data is written over the
	network to the NFS server, and thus also susceptible to being snooped
	by other hosts on the network.
	Note that the bug exists only in the NFS client; the version and
	implementation of the server has no effect on whether a given system
	is affected by the problem.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-6660</cvename>
 <freebsdsa>SA-23:18.nfsclient</freebsdsa>
 </references>
 <dates>
 <discovery>2023-12-12</discovery>
 <entry>2023-12-13</entry>
 </dates>
 </vuln>

<vuln vid="972568d6-3485-40ab-80ff-994a8aaf9683">
 <topic>xorg-server -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<name>xephyr</name>
	<name>xorg-vfbserver</name>
	<range><lt>21.1.10,1</lt></range>
 </package>
 <package>
	<name>xorg-nestserver</name>
	<range><lt>21.1.10,2</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>23.2.3,1</lt></range>
 </package>
 <package>
	<name>xwayland-devel</name>
	<range><lt>21.0.99.1.582</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The X.Org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2023-December/003435.html">
	 <ul>
	 <li>CVE-2023-6377/ZDI-CAN-22412/ZDI-CAN-22413: X.Org
	 server: Out-of-bounds memory write in XKB button actions

A device has XKB button actions for each button on the
	 device. When a logical device switch happens (e.g. moving
	 from a touchpad to a mouse), the server re-calculates the
	 information available on the respective master device
	 (typically the Virtual Core Pointer). This re-calculation
	 only allocated enough memory for a single XKB action
	 rather instead of enough for the newly active physical
	 device's number of button. As a result, querying or
	 changing the XKB button actions results in out-of-bounds
	 memory reads and writes.

This may lead to local privilege escalation if the server is run as root or
	 remote code execution (e.g. x11 over ssh).</li>

<li>CVE-2023-6478/ZDI-CAN-22561: X.Org server:
	 Out-of-bounds memory read in RRChangeOutputProperty and
	 RRChangeProviderProperty

This fixes an OOB read and the resulting information disclosure.

Length calculation for the request was clipped to a 32-bit integer. With
	 the correct stuff-&gt;nUnits value the expected request size was
	 truncated, passing the REQUEST_FIXED_SIZE check.

The server then proceeded with reading at least stuff-&gt;nUnits bytes
	 (depending on stuff-&gt;format) from the request and stuffing whatever it
	 finds into the property. In the process it would also allocate at least
	 stuff-&gt;nUnits bytes, i.e. 4GB.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.x.org/archives/xorg-announce/2023-December/003435.html</url>
 <cvename>CVE-2023-6377</cvename>
 <cvename>CVE-2023-6478</cvename>
 </references>
 <dates>
 <discovery>2023-12-13</discovery>
 <entry>2023-12-13</entry>
 </dates>
 </vuln>

<vuln vid="4405e9ad-97fe-11ee-86bb-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>120.0.6099.62</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>120.0.6099.62</lt></range>
 </package>
 <package>
 <name>qt5-webengine</name>
 <range><lt>5.15.16.p5_2</lt></range>
 </package>
 <package>
 <name>qt6-webengine</name>
 <range><lt>6.6.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html">
	 This update includes 10 security fixes:
	 <ul>
	 <li>[1497984] High CVE-2023-6508: Use after free in Media Stream. Reported by Cassidy Kim(@cassidy6564) on 2023-10-31</li>
	 <li>[1494565] High CVE-2023-6509: Use after free in Side Panel Search. Reported by Khalil Zhani on 2023-10-21</li>
	 <li>[1480152] Medium CVE-2023-6510: Use after free in Media Capture. Reported by [pwn2car] on 2023-09-08</li>
	 <li>[1478613] Low CVE-2023-6511: Inappropriate implementation in Autofill. Reported by Ahmed ElMasry on 2023-09-04</li>
	 <li>[1457702] Low CVE-2023-6512: Inappropriate implementation in Web Browser UI. Reported by Om Apip on 2023-06-24</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-6508</cvename>
 <cvename>CVE-2023-6509</cvename>
 <cvename>CVE-2023-6510</cvename>
 <cvename>CVE-2023-6511</cvename>
 <cvename>CVE-2023-6512</cvename>
 <url>https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2023-12-05</discovery>
 <entry>2023-12-11</entry>
 </dates>
 </vuln>

<vuln vid="2bc376c0-977e-11ee-b4bc-b42e991fc52e">
 <topic>apache -- Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication</topic>
 <affects>
 <package>
	<name>zookeeper</name>
	<range><lt>3.7.2</lt></range>
 <range><ge>3.8.0</ge><lt>3.8.3</lt></range>
 <range><ge>3.9.0</ge><lt>3.9.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security@apache.org reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2023/10/11/4">
	 Authorization Bypass Through User-Controlled Key vulnerability in
	Apache ZooKeeper. If SASL Quorum Peer authentication is enabled
	in ZooKeeper (quorum.auth.enableSasl=true), the authorization is
	done by verifying that the instance part in SASL authentication ID
	is listed in zoo.cfg server list. The instance part in SASL auth
	ID is optional and if it's missing, like 'eve@EXAMPLE.COM',
	the authorization check will be skipped.As a result an arbitrary
	endpoint could join the cluster and begin propagating counterfeit
	changes to the leader, essentially giving it complete read-write
	access to the data tree.Quorum Peer authentication is not enabled
	by default.
	Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2,
	which fixes the issue.
	Alternately ensure the ensemble election/quorum communication is
	protected by a firewall as this will mitigate the issue.
	See the documentation for more details on correct cluster administration.
	
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-44981</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-44981</url>
 </references>
 <dates>
 <discovery>2023-10-11</discovery>
 <entry>2023-12-10</entry>
 </dates>
 </vuln>

<vuln vid="e07a7754-12a4-4661-b852-fd221d68955f">
 <topic>electron25 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron25</name>
	<range><lt>25.9.8</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v25.9.8">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-6350.</li>
	 <li>Security: backported fix for CVE-2023-6351.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-6350</cvename>
 <url>https://github.com/advisories/GHSA-wmh6-7xp9-5gh8</url>
 <cvename>CVE-2023-6351</cvename>
 <url>https://github.com/advisories/GHSA-47vw-3hx2-6877</url>
 </references>
 <dates>
 <discovery>2023-12-06</discovery>
 <entry>2023-12-07</entry>
 </dates>
 </vuln>

<vuln vid="9cbbc506-93c1-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- TCP spoofing vulnerability in pf(4)</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.0</ge><lt>14.0_2</lt></range>
	<range><ge>13.2</ge><lt>13.2_4</lt></range>
	<range><ge>12.4</ge><lt>12.4_6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	As part of its stateful TCP connection tracking implementation,
	pf performs sequence number validation on inbound packets. This
	makes it difficult for a would-be attacker to spoof the sender and
	inject packets into a TCP stream, since crafted packets must contain
	sequence numbers which match the current connection state to avoid
	being rejected by the firewall.
	A bug in the implementation of sequence number validation means
	that the sequence number is not in fact validated, allowing an
	attacker who is able to impersonate the remote host and guess the
	connection's port numbers to inject packets into the TCP stream.
	<h1>Impact:</h1>
	An attacker can, with relatively little effort, inject packets
	into a TCP stream destined to a host behind a pf firewall. This
	could be used to implement a denial-of-service attack for hosts
	behind the firewall, for example by sending TCP RST packets to the
	host.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-6534</cvename>
 <freebsdsa>SA-23:17.pf</freebsdsa>
 </references>
 <dates>
 <discovery>2023-12-05</discovery>
 <entry>2023-12-05</entry>
 <modified>2023-12-14</modified>
 </dates>
 </vuln>

<vuln vid="f25a34b1-910d-11ee-a1a2-641c67a117d8">
 <topic>varnish -- HTTP/2 Rapid Reset Attack</topic>
 <affects>
 <package>
	<name>varnish7</name>
	<range><lt>7.4.2</lt></range>
 </package>
 <package>
	<name>varnish6</name>
	<range><lt>6.6.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Varnish Cache Project reports:
	<blockquote cite="https://varnish-cache.org/security/VSV00013.html">
	 A denial of service attack can be performed on Varnish Cache servers
	that have the HTTP/2 protocol turned on. An attacker can create a large
	volume of streams and immediately reset them without ever reaching the
	maximum number of concurrent streams allowed for the session, causing
	the Varnish server to consume unnecessary resources processing requests
	for which the response will not be delivered.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-44487</cvename>
 <url>https://varnish-cache.org/security/VSV00013.html</url>
 </references>
 <dates>
 <discovery>2023-11-13</discovery>
 <entry>2023-12-02</entry>
 </dates>
 </vuln>

<vuln vid="3b14b2b4-9014-11ee-98b3-001b217b3468">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.6.0</ge><lt>16.6.1</lt></range>
	<range><ge>16.5.0</ge><lt>16.5.3</lt></range>
	<range><ge>8.13.0</ge><lt>16.4.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/11/30/security-release-gitlab-16-6-1-released/">
	 XSS and ReDoS in Markdown via Banzai pipeline of Jira
	 Members with admin_group_member custom permission can add members with higher role
	 Release Description visible in public projects despite release set as project members only through atom response
	 Manipulate the repository content in the UI (CVE-2023-3401 bypass)
	 External user can abuse policy bot to gain access to internal projects
	 Client-side DOS via Mermaid Flowchart
	 Developers can update pipeline schedules to use protected branches even if they don't have permission to merge
	 Users can install Composer packages from public projects even when Package registry is turned off
	 Unauthorized member can gain Allowed to push and merge access and affect integrity of protected branches
	 Guest users can react (emojis) on confidential work items which they cant see in a project
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-6033</cvename>
 <cvename>CVE-2023-6396</cvename>
 <cvename>CVE-2023-3949</cvename>
 <cvename>CVE-2023-5226</cvename>
 <cvename>CVE-2023-5995</cvename>
 <cvename>CVE-2023-4912</cvename>
 <cvename>CVE-2023-4317</cvename>
 <cvename>CVE-2023-3964</cvename>
 <cvename>CVE-2023-4658</cvename>
 <cvename>CVE-2023-3443</cvename>
 <url>https://about.gitlab.com/releases/2023/11/30/security-release-gitlab-16-6-1-released/</url>
 </references>
 <dates>
 <discovery>2023-11-30</discovery>
 <entry>2023-12-01</entry>
 </dates>
 </vuln>

<vuln vid="7e1a508f-7167-47b0-b9fc-95f541933a86">
 <topic>electron26 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron26</name>
	<range><lt>26.6.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v26.6.2">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-6345.</li>
	 <li>Security: backported fix for CVE-2023-6346.</li>
	 <li>Security: backported fix for CVE-2023-6347.</li>
	 <li>Security: backported fix for CVE-2023-6350.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-6345</cvename>
 <url>https://github.com/advisories/GHSA-xm5p-7w7v-qqr5</url>
 <cvename>CVE-2023-6346</cvename>
 <url>https://github.com/advisories/GHSA-w427-5x7p-xj8x</url>
 <cvename>CVE-2023-6347</cvename>
 <url>https://github.com/advisories/GHSA-6jj9-4hh8-6xpv</url>
 <cvename>CVE-2023-6350</cvename>
 <url>https://github.com/advisories/GHSA-wmh6-7xp9-5gh8</url>
 </references>
 <dates>
 <discovery>2023-11-30</discovery>
 <entry>2023-12-01</entry>
 </dates>
 </vuln>

<vuln vid="302fc846-860f-482e-a8f6-ee9f254dfacf">
 <topic>electron25 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron25</name>
	<range><lt>25.9.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v25.9.7">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-6345.</li>
	 <li>Security: backported fix for CVE-2023-6346.</li>
	 <li>Security: backported fix for CVE-2023-6347.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-6345</cvename>
 <url>https://github.com/advisories/GHSA-xm5p-7w7v-qqr5</url>
 <cvename>CVE-2023-6346</cvename>
 <url>https://github.com/advisories/GHSA-w427-5x7p-xj8x</url>
 <cvename>CVE-2023-6347</cvename>
 <url>https://github.com/advisories/GHSA-6jj9-4hh8-6xpv</url>
 </references>
 <dates>
 <discovery>2023-12-01</discovery>
 <entry>2023-12-01</entry>
 </dates>
 </vuln>

<vuln vid="8cdd38c7-8ebb-11ee-86bb-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>119.0.6045.199</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>119.0.6045.199</lt></range>
 </package>
 <package>
 <name>qt5-webengine</name>
 <range><lt>5.15.16.p5_2</lt></range>
 </package>
 <package>
 <name>qt6-webengine</name>
 <range><lt>6.6.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html">
	 This update includes 7 security fixes:
	 <ul>
	 <li>[1491459] High CVE-2023-6348: Type Confusion in Spellcheck. Reported by Mark Brand of Google Project Zero on 2023-10-10</li>
	 <li>[1494461] High CVE-2023-6347: Use after free in Mojo. Reported by Leecraso and Guang Gong of 360 Vulnerability Research Institute on 2023-10-21</li>
	 <li>[1500856] High CVE-2023-6346: Use after free in WebAudio. Reported by Huang Xilin of Ant Group Light-Year Security Lab on 2023-11-09</li>
	 <li>[1501766] High CVE-2023-6350: Out of bounds memory access in libavif. Reported by Fudan University on 2023-11-13</li>
	 <li>[1501770] High CVE-2023-6351: Use after free in libavif. Reported by Fudan University on 2023-11-13</li>
	 <li>[1505053] High CVE-2023-6345: Integer overflow in Skia. Reported by Benoît Sevens and Clément Lecigne of Google's Threat Analysis Group on 2023-11-24</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-6348</cvename>
 <cvename>CVE-2023-6347</cvename>
 <cvename>CVE-2023-6346</cvename>
 <cvename>CVE-2023-6350</cvename>
 <cvename>CVE-2023-6351</cvename>
 <cvename>CVE-2023-6345</cvename>
 <url>https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html</url>
 </references>
 <dates>
 <discovery>2023-11-28</discovery>
 <entry>2023-11-29</entry>
 </dates>
 </vuln>

<vuln vid="388e6557-8c80-11ee-9ee3-84a93843eb75">
 <topic>MariaDB -- Denial-of-Service vulnerability</topic>
 <affects>
 <package>
	<name>mariadb105-server</name>
	<range><lt>10.5.23</lt></range>
 </package>
 <package>
	<name>mariadb106-server</name>
	<range><lt>10.6.16</lt></range>
 </package>
 <package>
	<name>mariadb1011-server</name>
	<range><lt>10.11.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The MariaDB project reports:
	<blockquote cite="https://mariadb.com/kb/en/mariadb-10-11-6-release-notes/">
	 Easily exploitable vulnerability allows high privileged attacker
	 with network access via multiple protocols to compromise MySQL
	 Server. Successful attacks of this vulnerability can result in
	 unauthorized ability to cause a hang or frequently repeatable crash
	 (complete DOS) of MySQL Server.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-22084</cvename>
 <url>https://mariadb.com/kb/en/mariadb-10-11-6-release-notes/</url>
 <url>https://mariadb.com/kb/en/mariadb-10-6-16-release-notes/</url>
 <url>https://mariadb.com/kb/en/mariadb-10-5-23-release-notes/</url>
 </references>
 <dates>
 <discovery>2023-11-13</discovery>
 <entry>2023-11-26</entry>
 </dates>
 </vuln>

<vuln vid="a62c0c50-8aa0-11ee-ac0d-00e0670f2660">
 <topic>strongSwan -- vulnerability in charon-tkm</topic>
 <affects>
 <package>
	<name>strongswan</name>
	<range><ge>5.3.0</ge><lt>5.9.11_3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	strongSwan reports:
	<blockquote cite="https://www.strongswan.org/blog/2023/11/20/strongswan-vulnerability-(cve-2023-41913).html">
	 A vulnerability in charon-tkm related to processing
	 DH public values was discovered in strongSwan
	 that can result in a buffer overflow and potentially
	 remote code execution. All versions since
	 5.3.0 are affected.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-41913</cvename>
 <url>https://www.strongswan.org/blog/2023/11/20/strongswan-vulnerability-(cve-2023-41913).html</url>
 </references>
 <dates>
 <discovery>2023-11-20</discovery>
 <entry>2023-11-24</entry>
 </dates>
 </vuln>

<vuln vid="147353a3-c33b-46d1-b751-e72c0d7f29df">
 <topic>electron{25,26} -- use after free in Garbage Collection</topic>
 <affects>
 <package>
	<name>electron25</name>
	<range><lt>25.9.6</lt></range>
 </package>
 <package>
	<name>electron26</name>
	<range><lt>26.6.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v25.9.6">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2023-5997.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-5997</cvename>
 <url>https://github.com/advisories/GHSA-fggx-frxq-cpx8</url>
 </references>
 <dates>
 <discovery>2023-11-22</discovery>
 <entry>2023-11-22</entry>
 </dates>
 </vuln>

<vuln vid="0da4db89-84bf-11ee-8290-a8a1599412c6">
 <topic>chromium -- multiple security fixes</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>119.0.6045.159</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>119.0.6045.159</lt></range>
 </package>
 <package>
 <name>qt5-webengine</name>
 <range><lt>5.15.16.p5</lt></range>
 </package>
 <package>
 <name>qt6-webengine</name>
 <range><lt>6.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_14.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[1497997] High CVE-2023-5997: Use after free in Garbage Collection. Reported by Anonymous on 2023-10-31</li>
	 <li>[1499298] High CVE-2023-6112: Use after free in Navigation. Reported by Sergei Glazunov of Google Project Zero on 2023-11-04</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-5997</cvename>
 <cvename>CVE-2023-6112</cvename>
 <url>https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_14.html</url>
 </references>
 <dates>
 <discovery>2023-11-14</discovery>
 <entry>2023-11-16</entry>
 </dates>
 </vuln>

<vuln vid="a30f1a12-117f-4dac-a1d0-d65eaf084953">
 <topic>electron{25,26} -- use after free in WebAudio</topic>
 <affects>
 <package>
	<name>electron25</name>
	<range><lt>25.9.5</lt></range>
 </package>
 <package>
	<name>electron26</name>
	<range><lt>26.6.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v25.9.5">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2023-5996.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-5996</cvename>
 <url>https://github.com/advisories/GHSA-q3gq-rg4m-vgrp</url>
 </references>
 <dates>
 <discovery>2023-11-15</discovery>
 <entry>2023-11-16</entry>
 </dates>
 </vuln>

<vuln vid="2fe004f5-83fd-11ee-9f5d-31909fb2f495">
 <topic>openvpn -- 2.6.0...2.6.6 --fragment option division by zero crash, and TLS data leak</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><ge>2.6.0</ge><lt>2.6.7_1</lt></range>
 </package>
 <package>
	<name>openvpn-devel</name>
	<range><lt>g20231109,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenVPN community project team reports:
	<blockquote cite="https://github.com/OpenVPN/openvpn/blob/v2.6.7/Changes.rst#overview-of-changes-in-267">
		CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly restore "--fragment" configuration in some circumstances, leading to a division by zero when "--fragment" is used. On platforms where division by zero is fatal, this will cause an OpenVPN crash.
		 
Reported by Niccolo Belli and WIPocket (Github #400, #417).
	
	CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly use a send buffer after it has been free()d in some circumstances, causing some free()d memory to be sent to the peer. All configurations using TLS (e.g. not using --secret) are affected by this issue. (found while tracking down CVE-2023-46849 / Github #400, #417)
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-46849</cvename>
 <cvename>CVE-2023-46850</cvename>
 <url>https://github.com/OpenVPN/openvpn/blob/v2.6.7/Changes.rst#overview-of-changes-in-267</url>
 </references>
 <dates>
 <discovery>2023-08-29</discovery>
 <entry>2023-11-15</entry>
 <modified>2023-12-31</modified>
 </dates>
 </vuln>

<vuln vid="7cc003cb-83b9-11ee-957d-b42e991fc52e">
 <topic>typo3 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>typo3-11</name>
	<name>typo3-12</name>
	<range><lt>11.5.33</lt></range>
	<range><lt>12.4.33</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/TYPO3/typo3/commit/535dfbdc54fd5362e0bc08d911db44eac7f64019">
	Weak Authentication in Session Handling in typo3/cms-core:
	In typo3 installations there are always
	at least two different sites. Eg. first.example.org and
	second.example.com. In affected versions a session cookie
	generated for the first site can be reused on the second site
	without requiring additional authentication. This
	vulnerability has been addressed in versions 8.7.55, 9.5.44,
	10.4.41, 11.5.33, and 12.4.8. Users are advised to upgrade.
	There are no known workarounds for this vulnerability.
	Information Disclosure in Install Tool in typo3/cms-install:
	In affected versions the login screen of the standalone
	install tool discloses the full path of the transient data
	directory (e.g. /var/www/html/var/transient/). This applies
	to composer-based scenarios only - classic non-composer
	installations are not affected. This issue has been addressed
	in version 12.4.8. Users are advised to upgrade. There are
	no known workarounds for this vulnerability.
	
	By-passing Cross-Site Scripting Protection in HTML Sanitizer:
	In affected versions DOM processing instructions are not
	handled correctly. This allows bypassing the cross-site
	scripting mechanism of typo3/html-sanitizer. This
	vulnerability has been addressed in versions 1.5.3 and 2.1.4.
	Users are advised to upgrade. There are no known workarounds
	for this vulnerability.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-47125</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-47125</url>
 <cvename>CVE-2023-47126</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-47126</url>
 <cvename>CVE-2023-47127</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-47127</url>
 </references>
 <dates>
 <discovery>2023-11-14</discovery>
 <entry>2023-11-15</entry>
 </dates>
 </vuln>

<vuln vid="31f45d06-7f0e-11ee-94b4-6cc21735f730">
 <topic>postgresql-server -- Memory disclosure in aggregate function calls</topic>
 <affects>
 <package>
	<name>postgresql-server</name>
	<range><lt>16.1</lt></range>
	<range><lt>15.5</lt></range>
	<range><lt>14.10</lt></range>
	<range><lt>13.13</lt></range>
	<range><lt>12.17</lt></range>
	<range><lt>11.22</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL Project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-5868/">
	 
	 Certain aggregate function calls receiving "unknown"-type
	 arguments could disclose bytes of server memory from the end of
	 the "unknown"-type value to the next zero byte. One typically
	 gets an "unknown"-type value via a string literal having no type
	 designation. We have not confirmed or ruled out viability of
	 attacks that arrange for presence of notable, confidential
	 information in disclosed bytes.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-5868</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2023-5868/</url>
 </references>
 <dates>
 <discovery>2023-11-09</discovery>
 <entry>2023-11-09</entry>
 </dates>
 </vuln>

<vuln vid="0f445859-7f0e-11ee-94b4-6cc21735f730">
 <topic>postgresql-server -- Buffer overrun from integer overflow in array modification</topic>
 <affects>
 <package>
	<name>postgresql-server</name>
	<range><lt>16.1</lt></range>
	<range><lt>15.5</lt></range>
	<range><lt>14.10</lt></range>
	<range><lt>13.13</lt></range>
	<range><lt>12.17</lt></range>
	<range><lt>11.22</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL Project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-5869/">
	 
	 While modifying certain SQL array values, missing
	 overflow checks let authenticated database users write
	 arbitrary bytes to a memory area that facilitates
	 arbitrary code execution. Missing overflow checks also
	 let authenticated database users read a wide area of
	 server memory. The CVE-2021-32027 fix covered some
	 attacks of this description, but it missed others.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-5869</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2023-5869/</url>
 </references>
 <dates>
 <discovery>2023-11-09</discovery>
 <entry>2023-11-09</entry>
 </dates>
 </vuln>

<vuln vid="bbb18fcb-7f0d-11ee-94b4-6cc21735f730">
 <topic>postgresql-server -- Role pg_cancel_backend can signal certain superuser processes</topic>
 <affects>
 <package>
	<name>postgresql-server</name>
	<range><lt>16.1</lt></range>
	<range><lt>15.5</lt></range>
	<range><lt>14.10</lt></range>
	<range><lt>13.13</lt></range>
	<range><lt>12.17</lt></range>
	<range><lt>11.22</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL Project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-5870/">
	 
	 Documentation says the pg_cancel_backend role cannot
	 signal "a backend owned by a superuser". On the
	 contrary, it can signal background workers, including
	 the logical replication launcher. It can signal
	 autovacuum workers and the autovacuum launcher.
	 Signaling autovacuum workers and those two launchers
	 provides no meaningful exploit, so exploiting this
	 vulnerability requires a non-core extension with a
	 less-resilient background worker. For example, a
	 non-core background worker that does not auto-restart
	 would experience a denial of service with respect to
	 that particular background worker.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-5870</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2023-5870/</url>
 </references>
 <dates>
 <discovery>2023-11-09</discovery>
 <entry>2023-11-09</entry>
 </dates>
 </vuln>

<vuln vid="5558dded-a870-4fbe-8b0a-ba198db47007">
 <topic>electron{25,26} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron25</name>
	<range><lt>25.9.4</lt></range>
 </package>
 <package>
	<name>electron26</name>
	<range><lt>26.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v25.9.4">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-5849.</li>
	 <li>Security: backported fix for CVE-2023-5482.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-5849</cvename>
 <url>https://github.com/advisories/GHSA-7cjp-92p9-vr97</url>
 <cvename>CVE-2023-5482</cvename>
 <url>https://github.com/advisories/GHSA-pq78-6h8h-rcf4</url>
 </references>
 <dates>
 <discovery>2023-11-08</discovery>
 <entry>2023-11-09</entry>
 </dates>
 </vuln>

<vuln vid="4ade0c4d-7e83-11ee-9a8c-00155d01f201">
 <topic>libsndfile_project -- Integer overflow in dataend calculation</topic>
 <affects>
 <package>
	<name>libsndfile</name>
	<range><lt>1.2.2_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://github.com/libsndfile/libsndfile/issues/789">
	 Multiple signed integers overflow in function au_read_header in
	src/au.c and in functions mat4_open and mat4_read_header in src/mat4.c
	in Libsndfile, allows an attacker to cause Denial of Service or
	other unspecified impacts.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2022-33065</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-33065</url>
 </references>
 <dates>
 <discovery>2023-07-18</discovery>
 <entry>2023-11-08</entry>
 </dates>
 </vuln>

<vuln vid="77fc311d-7e62-11ee-8290-a8a1599412c6">
 <topic>chromium -- security update</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>119.0.6045.123</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>119.0.6045.123</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[1497859] High CVE-2023-5996: Use after free in WebAudio. Reported by Huang Xilin of Ant Group Light-Year Security Lab via Tianfu Cup 2023 on 2023-10-30</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-5996</cvename>
 <url>https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2023-11-07</discovery>
 <entry>2023-11-08</entry>
 </dates>
 </vuln>

<vuln vid="a5956603-7e4f-11ee-9df6-84a93843eb75">
 <topic>OpenSSL -- DoS in DH generation</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>3.0.12_1,1</lt></range>
 </package>
 <package>
	<name>openssl111</name>
	<range><lt>1.1.1w_1</lt></range>
 </package>
 <package>
	<name>openssl31</name>
	<range><lt>3.1.4_1</lt></range>
 </package>
 <package>
	<name>openssl-quictls</name>
	<range><lt>3.0.12_1</lt></range>
 </package>
 <package>
	<name>openssl31-quictls</name>
	<range><lt>3.1.4_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20231106.txt">
	 Excessive time spent in DH check / generation with large Q
	 parameter value (low).
	 Generating excessively long X9.42 DH keys or checking
	 excessively long X9.42 DH keys or parameters may be very slow.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-5678</cvename>
 <url>https://www.openssl.org/news/secadv/20231106.txt</url>
 </references>
 <dates>
 <discovery>2023-11-08</discovery>
 <entry>2023-11-08</entry>
 </dates>
 </vuln>

<vuln vid="f4464e49-7e04-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- Incorrect libcap_net limitation list manipulation</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.2</ge><lt>13.2_5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Casper services allow limiting operations that a process can
	perform. Each service maintains a specific list of permitted
	operations. Certain operations can be further restricted, such as
	specifying which domain names can be resolved. During the verification
	of limits, the service must ensure that the new set of constraints
	is a subset of the previous one. In the case of the cap_net service,
	the currently limited set of domain names was fetched incorrectly.
	<h1>Impact:</h1>
	In certain scenarios, if only a list of resolvable domain names
	was specified without setting any other limitations, the application
	could submit a new list of domains including include entries not
	previously in the list.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-5978</cvename>
 <freebsdsa>SA-23:16.cap_net</freebsdsa>
 </references>
 <dates>
 <discovery>2023-11-08</discovery>
 <entry>2023-11-08</entry>
 </dates>
 </vuln>

<vuln vid="5afcc9a4-7e04-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- libc stdio buffer overflow</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.2</ge><lt>13.2_5</lt></range>
	<range><ge>12.4</ge><lt>12.4_7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	For line-buffered streams the __sflush() function did not
	correctly update the FILE object's write space member when the
	write(2) system call returns an error.
	<h1>Impact:</h1>
	Depending on the nature of an application that calls libc's
	stdio functions and the presence of errors returned from the write(2)
	system call (or an overridden stdio write routine) a heap buffer
	overfly may occur. Such overflows may lead to data corruption or
	the execution of arbitrary code at the privilege level of the calling
	program.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-5941</cvename>
 <freebsdsa>SA-23:15.stdio</freebsdsa>
 </references>
 <dates>
 <discovery>2023-11-08</discovery>
 <entry>2023-11-08</entry>
 </dates>
 </vuln>

<vuln vid="a1a1f81c-7c13-11ee-bcf1-f8b156b6dcc8">
 <topic>vorbistools -- heap buffer overflow in oggenc</topic>
 <affects>
 <package>
	<name>vorbis-tools</name>
	<range><lt>1.4.2_4,3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Frank-Z7 reports:
	<blockquote cite="https://github.com/xiph/vorbis-tools/issues/41">
	 Heap buffer overflow when vorbis-tools/oggenc converts
	 WAV files to Ogg files.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-43361</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-43361</url>
 </references>
 <dates>
 <discovery>2023-09-16</discovery>
 <entry>2023-11-05</entry>
 </dates>
 </vuln>

<vuln vid="fe7ac70a-792b-11ee-bf9a-a04a5edf46d9">
 <topic>PptiPNG -- Global-buffer-overflow</topic>
 <affects>
 <package>
	<name>optipng</name>
	<range><lt>0.7.7_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Frank-Z7 reports:
	<blockquote cite="https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/optipng-global-buffer-overflow1/optipng-global-buffer-overflow1.md">
	 Running optipng with the "-zm 3 -zc 1 -zw 256 -snip -out"
	 configuration options enabled raises a global-buffer-overflow bug,
	 which could allow a remote attacker to conduct a denial-of-service
	 attack or other unspecified effect on a crafted file.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-43907</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-43907</url>
 </references>
 <dates>
 <discovery>2023-09-30</discovery>
 <entry>2023-11-02</entry>
 </dates>
 </vuln>

<vuln vid="a1e27775-7a61-11ee-8290-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>119.0.6045.105</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>119.0.6045.105</lt></range>
 </package>
 <package>
 <name>qt6-webengine</name>
 <range><lt>6.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_31.html">
	 This update includes 15 security fixes:
	 <ul>
	 <li>[1492698] High CVE-2023-5480: Inappropriate implementation in Payments. Reported by Vsevolod Kokorin (Slonser) of Solidlab on 2023-10-14</li>
	 <li>[1492381] High CVE-2023-5482: Insufficient data validation in USB. Reported by DarkNavy on 2023-10-13</li>
	 <li>[1492384] High CVE-2023-5849: Integer overflow in USB. Reported by DarkNavy on 2023-10-13</li>
	 <li>[1281972] Medium CVE-2023-5850: Incorrect security UI in Downloads. Reported by Mohit Raj (shadow2639) on 2021-12-22</li>
	 <li>[1473957] Medium CVE-2023-5851: Inappropriate implementation in Downloads. Reported by Shaheen Fazim on 2023-08-18</li>
	 <li>[1480852] Medium CVE-2023-5852: Use after free in Printing. Reported by [pwn2car] on 2023-09-10</li>
	 <li>[1456876] Medium CVE-2023-5853: Incorrect security UI in Downloads. Reported by Hafiizh on 2023-06-22</li>
	 <li>[1488267] Medium CVE-2023-5854: Use after free in Profiles. Reported by Dohyun Lee (@l33d0hyun) of SSD-Disclosure Labs &amp; DNSLab, Korea Univ on 2023-10-01</li>
	 <li>[1492396] Medium CVE-2023-5855: Use after free in Reading Mode. Reported by ChaobinZhang on 2023-10-13</li>
	 <li>[1493380] Medium CVE-2023-5856: Use after free in Side Panel. Reported by Weipeng Jiang (@Krace) of VRI on 2023-10-17</li>
	 <li>[1493435] Medium CVE-2023-5857: Inappropriate implementation in Downloads. Reported by Will Dormann on 2023-10-18</li>
	 <li>[1457704] Low CVE-2023-5858: Inappropriate implementation in WebApp Provider. Reported by Axel Chong on 2023-06-24</li>
	 <li>[1482045] Low CVE-2023-5859: Incorrect security UI in Picture In Picture. Reported by Junsung Lee on 2023-09-13</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-5480</cvename>
 <cvename>CVE-2023-5482</cvename>
 <cvename>CVE-2023-5849</cvename>
 <cvename>CVE-2023-5850</cvename>
 <cvename>CVE-2023-5851</cvename>
 <cvename>CVE-2023-5852</cvename>
 <cvename>CVE-2023-5853</cvename>
 <cvename>CVE-2023-5854</cvename>
 <cvename>CVE-2023-5855</cvename>
 <cvename>CVE-2023-5856</cvename>
 <cvename>CVE-2023-5857</cvename>
 <cvename>CVE-2023-5858</cvename>
 <cvename>CVE-2023-5859</cvename>
 <url>https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_31.html</url>
 </references>
 <dates>
 <discovery>2023-10-31</discovery>
 <entry>2023-11-03</entry>
 </dates>
 </vuln>

<vuln vid="4f370c80-79ce-11ee-be8e-589cfc0f81b0">
 <topic>phpmyfaq -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyfaq-php80</name>
	<name>phpmyfaq-php81</name>
	<name>phpmyfaq-php82</name>
	<name>phpmyfaq-php83</name>
	<range><lt>3.2.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	phpmyfaq developers report:
	<blockquote cite="https://www.phpmyfaq.de/security/advisory-2023-10-27">
	 XSS
	 Insufficient session expiration
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-5863</cvename>
 <cvename>CVE-2023-5865</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-5863</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-5865</url>
 <url>https://huntr.com/bounties/fbfd4e84-61fb-4063-8f11-15877b8c1f6f/</url>
 <url>https://huntr.com/bounties/4c4b7395-d9fd-4ca0-98d7-2e20c1249aff/</url>
 </references>
 <dates>
 <discovery>2023-10-31</discovery>
 <entry>2023-11-02</entry>
 </dates>
 </vuln>

<vuln vid="d2505ec7-78ea-11ee-9131-6f01853956d5">
 <topic>open-vm-tools -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>open-vm-tools</name>
	<range><lt>12.3.5</lt></range>
 </package>
 <package>
	<name>open-vm-tools-nox11</name>
	<range><lt>12.3.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	VMware reports:
	<blockquote cite="https://www.vmware.com/security/advisories/VMSA-2023-0024.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>High CVE-2023-34058: SAML token signature bypass vulnerability</li>
	 <li>High CVE-2023-34059: File descriptor hijack vulnerability in the vmware-user-suid-wrapper</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-34058</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-34058</url>
 <cvename>CVE-2023-34059</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-34059</url>
 </references>
 <dates>
 <discovery>2023-10-26</discovery>
 <entry>2023-11-01</entry>
 </dates>
 </vuln>

<vuln vid="a612c25f-788a-11ee-8d57-001b217b3468">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.5.0</ge><lt>16.5.1</lt></range>
	<range><ge>16.4.0</ge><lt>16.4.2</lt></range>
	<range><ge>11.6.0</ge><lt>16.3.6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/10/31/security-release-gitlab-16-5-1-16-4-2-16-3-6-released/">
	 Disclosure of CI/CD variables using Custom project templates
	 GitLab omnibus DoS crash via OOM with CI Catalogs
	 Parsing gitlab-ci.yml with large string via timeout input leads to Denial of Service
	 DoS - Blocking FIFO files in Tar archives
	 Titles exposed by service-desk template
	 Approval on protected environments can be bypassed
	 Version information disclosure when super_sidebar_logged_out feature flag is enabled
	 Add abuse detection for search syntax filter pipes
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-3399</cvename>
 <cvename>CVE-2023-5825</cvename>
 <cvename>CVE-2023-3909</cvename>
 <cvename>CVE-2023-3246</cvename>
 <cvename>CVE-2023-5600</cvename>
 <cvename>CVE-2023-4700</cvename>
 <cvename>CVE-2023-5831</cvename>
 <url>https://about.gitlab.com/releases/2023/10/31/security-release-gitlab-16-5-1-16-4-2-16-3-6-released/</url>
 </references>
 <dates>
 <discovery>2023-10-31</discovery>
 <entry>2023-11-01</entry>
 </dates>
 </vuln>

<vuln vid="386a14bb-1a21-41c6-a2cf-08d79213379b">
 <topic>zeek -- potential DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>6.0.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v6.0.2">
	 A specially-crafted SSL packet could cause Zeek to
	 leak memory and potentially crash. 
	 A specially-crafted series of FTP packets could cause
	 Zeek to log entries for requests that have already been
	 completed, using resources unnecessarily and potentially
	 causing Zeek to lose other traffic. 
	 A specially-crafted series of SSL packets could cause
	 Zeek to output a very large number of unnecessary alerts
	 for the same record. 
	 A specially-crafted series of SSL packets could cause
	 Zeek to generate very long ssl_history fields in the
	 ssl.log, potentially using a large amount of memory due
	 to unbounded state growth 
	 A specially-crafted IEEE802.11 packet could cause
	 Zeek to overflow memory and potentially crash 
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v6.0.2</url>
 </references>
 <dates>
 <discovery>2023-10-27</discovery>
 <entry>2023-10-27</entry>
 </dates>
 </vuln>

<vuln vid="db33e250-74f7-11ee-8290-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>118.0.5993.117</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>118.0.5993.117</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_24.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[1491296] High CVE-2023-5472: Use after free in Profiles. Reported by @18楼梦想改造家 on 2023-10-10</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-5472</cvename>
 <url>https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_24.html</url>
 </references>
 <dates>
 <discovery>2023-10-24</discovery>
 <entry>2023-10-27</entry>
 </dates>
 </vuln>

<vuln vid="9e2fdfc7-e237-4393-9fa5-2d50908c66b3">
 <topic>xorg-server -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<name>xephyr</name>
	<name>xorg-vfbserver</name>
	<range><lt>21.1.9,1</lt></range>
 </package>
 <package>
	<name>xorg-nestserver</name>
	<range><lt>21.1.9,2</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>23.2.2,1</lt></range>
 </package>
 <package>
	<name>xwayland-devel</name>
	<range><lt>21.0.99.1.542</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The X.Org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2023-October/003430.html">
	 <ul>
	 <li>ZDI-CAN-22153/CVE-2023-5367: X.Org server: OOB write
	 in XIChangeDeviceProperty/RRChangeOutputProperty

When prepending values to an existing property an
	 invalid offset calculation causes the existing values to
	 be appended at the wrong offset. The resulting memcpy()
	 would write into memory outside the heap-allocated
	 array.</li>

<li>ZDI-CAN-21608/CVE-2023-5380: Use-after-free bug in
	 DestroyWindow

This vulnerability requires a legacy multi-screen setup
	 with multiple protocol screens ("Zaphod"). If the pointer
	 is warped from one screen to the root window of the other
	 screen, the enter/leave code may retain a reference to the
	 previous pointer window. Destroying this window leaves
	 that reference in place, other windows may then trigger a
	 use-after-free bug when they are destroyed. </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.x.org/archives/xorg-announce/2023-October/003430.html</url>
 <cvename>CVE-2023-5367</cvename>
 <cvename>CVE-2023-5380</cvename>
 </references>
 <dates>
 <discovery>2023-10-25</discovery>
 <entry>2023-10-25</entry>
 </dates>
 </vuln>

<vuln vid="a8fb8e3a-730d-11ee-ab61-b42e991fc52e">
 <topic>squid -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>6.4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The squid-cache project reports:
	<blockquote cite="https://github.com/squid-cache/squid/security/advisories?page=1">
	 <ul>
	 <li>Denial of Service in FTP</li>
	 <li>Request/Response smuggling in HTTP/1.1 and ICAP</li>
	 <li>Denial of Service in HTTP Digest Authentication</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://github.com/squid-cache/squid/security/advisories/GHSA-2g3c-pg7q-g59w</url>
 <url>https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh</url>
 <url>https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g</url>
 </references>
 <dates>
 <discovery>2023-10-21</discovery>
 <entry>2023-10-25</entry>
 </dates>
 </vuln>

<vuln vid="4a4712ae-7299-11ee-85eb-84a93843eb75">
 <topic>OpenSSL -- potential loss of confidentiality</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>3.0.12,1</lt></range>
 </package>
 <package>
	<name>openssl31</name>
	<range><lt>3.1.4</lt></range>
 </package>
 <package>
	<name>openssl-quictls</name>
	<range><lt>3.0.12</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL team reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20231024.txt">
	 Moderate severity: A bug has been identified in the processing
	 of key and initialisation vector (IV) lengths. This can lead to
	 potential truncation or overruns during the initialisation of
	 some symmetric ciphers.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-5363</cvename>
 <url>https://www.openssl.org/news/secadv/20231024.txt</url>
 </references>
 <dates>
 <discovery>2023-10-24</discovery>
 <entry>2023-10-24</entry>
 </dates>
 </vuln>

<vuln vid="22df5074-71cd-11ee-85eb-84a93843eb75">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.44</lt></range>
 </package>
 <package>
	<name>mysql-connector-c++</name>
	<range><lt>8.0.35</lt></range>
 </package>
 <package>
	<name>mysql-connector-j</name>
	<range><lt>8.1.1</lt></range>
 </package>
 <package>
	<name>mysql-connector-odbc</name>
	<range><lt>8.1.1</lt></range>
 </package>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.35</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpuoct2023.html#AppendixMSQL">
	 This Critical Patch Update contains 37 new security patches, plus
	 additional third party patches noted below, for Oracle MySQL. 9 of
	 these vulnerabilities may be remotely exploitable without
	 authentication, i.e., may be exploited over a network without
	 requiring user credentials.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2022-42898</cvename>
 <cvename>CVE-2023-2650</cvename>
 <cvename>CVE-2023-3817</cvename>
 <cvename>CVE-2023-22015</cvename>
 <cvename>CVE-2023-22026</cvename>
 <cvename>CVE-2023-22028</cvename>
 <cvename>CVE-2023-22032</cvename>
 <cvename>CVE-2023-22059</cvename>
 <cvename>CVE-2023-22064</cvename>
 <cvename>CVE-2023-22065</cvename>
 <cvename>CVE-2023-22066</cvename>
 <cvename>CVE-2023-22068</cvename>
 <cvename>CVE-2023-22070</cvename>
 <cvename>CVE-2023-22078</cvename>
 <cvename>CVE-2023-22079</cvename>
 <cvename>CVE-2023-22084</cvename>
 <cvename>CVE-2023-22092</cvename>
 <cvename>CVE-2023-22094</cvename>
 <cvename>CVE-2023-22095</cvename>
 <cvename>CVE-2023-22097</cvename>
 <cvename>CVE-2023-22102</cvename>
 <cvename>CVE-2023-22103</cvename>
 <cvename>CVE-2023-22104</cvename>
 <cvename>CVE-2023-22110</cvename>
 <cvename>CVE-2023-22111</cvename>
 <cvename>CVE-2023-22112</cvename>
 <cvename>CVE-2023-22113</cvename>
 <cvename>CVE-2023-22114</cvename>
 <cvename>CVE-2023-22115</cvename>
 <cvename>CVE-2023-38545</cvename>
 <url>https://www.oracle.com/security-alerts/cpuoct2023.html#AppendixMSQL</url>
 </references>
 <dates>
 <discovery>2023-10-17</discovery>
 <entry>2023-10-23</entry>
 </dates>
 </vuln>

<vuln vid="e14b9870-62a4-11ee-897b-000bab9f87f1">
 <topic>Request Tracker -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rt44</name>
	<range><lt>4.4.6</lt></range>
 </package>
 <package>
	<name>rt50</name>
	<range><lt>5.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Request Tracker reports:
	CVE-2023-41259 SECURITY: RT is vulnerable to unvalidated email headers in incoming email and the mail-gateway REST interface.
	CVE-2023-41260 SECURITY: RT is vulnerable to information leakage via response messages returned from requests sent via the mail-gateway REST interface.
	CVE-2023-45024 SECURITY: RT 5.0 is vulnerable to information leakage via transaction searches made by authenticated users in the transaction query builder.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-41259</cvename>
 <cvename>CVE-2023-41260</cvename>
 <cvename>CVE-2023-45024</cvename>
 <url>https://bestpractical.com/request-tracker/</url>
 </references>
 <dates>
 <discovery>2023-10-18</discovery>
 <entry>2023-10-18</entry>
 </dates>
 </vuln>

<vuln vid="9000591b-483b-45ac-9c87-b3df3a4198ec">
 <topic>electron{25,26} -- Use after free in Site Isolation</topic>
 <affects>
 <package>
	<name>electron25</name>
	<range><lt>25.9.2</lt></range>
 </package>
 <package>
	<name>electron26</name>
	<range><lt>26.4.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v25.9.2">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2023-5218.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-5218</cvename>
 <url>https://github.com/advisories/GHSA-cvp3-7vpw-ffh6</url>
 </references>
 <dates>
 <discovery>2023-10-18</discovery>
 <entry>2023-10-19</entry>
 </dates>
 </vuln>

<vuln vid="f923205f-6e66-11ee-85eb-84a93843eb75">
 <topic>Apache httpd -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.58</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="https://dlcdn.apache.org/httpd/CHANGES_2.4.58">
	 <ul>
	 <li>CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
	 memory not reclaimed right away on RST</li>
	 <li>CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
	 initial windows size 0</li>
	 <li>CVE-2023-31122: mod_macro buffer over-read</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-45802</cvename>
 <cvename>CVE-2023-43622</cvename>
 <cvename>CVE-2023-31122</cvename>
 <url>https://dlcdn.apache.org/httpd/CHANGES_2.4.58</url>
 </references>
 <dates>
 <discovery>2023-10-19</discovery>
 <entry>2023-10-19</entry>
 </dates>
 </vuln>

<vuln vid="f8c2f741-6be1-11ee-b33a-a04a5edf46d9">
 <topic>moonlight-embedded -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moonlight-embedded</name>
	<range><lt>2.6.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The moonlight-embedded project reports:
	<blockquote cite="https://github.com/moonlight-stream/moonlight-embedded/releases/tag/v2.6.1">
	 Moonlight Embedded v2.6.1 fixed CVE-2023-42799, CVE-2023-42800,
	 and CVE-2023-42801.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2022-42799</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-42799</url>
 <cvename>CVE-2022-42800</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-42800</url>
 <cvename>CVE-2022-42801</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-42801</url>
 </references>
 <dates>
 <discovery>2022-01-11</discovery>
 <entry>2023-10-16</entry>
 </dates>
 </vuln>

<vuln vid="1ee26d45-6ddb-11ee-9898-00e081b7aa2d">
 <topic>jenkins -- HTTP/2 denial of service vulnerability in bundled Jetty</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.428</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.414.3</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2023-10-18/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-3291 / CVE-2023-36478, CVE-2023-44487</h5>
	 HTTP/2 denial of service vulnerability in bundled Jetty
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-36478</cvename>
 <cvename>CVE-2023-44487</cvename>
 <url>https://www.jenkins.io/security/advisory/2023-10-18/</url>
 </references>
 <dates>
 <discovery>2023-10-18</discovery>
 <entry>2023-10-18</entry>
 </dates>
 </vuln>

<vuln vid="d2ad7647-6dd9-11ee-85eb-84a93843eb75">
 <topic>Roundcube -- XSS vulnerability in SVG</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><lt>1.6.4,1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The Roundcube project reports:
	<blockquote cite="https://roundcube.net/news/2023/10/16/security-update-1.6.4-released">
	 cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages
	</blockquote>
	</body>
 </description>
 <references>
 <url>https://roundcube.net/news/2023/10/16/security-update-1.6.4-released</url>
 </references>
 <dates>
 <discovery>2023-10-16</discovery>
 <entry>2023-10-18</entry>
 </dates>
 </vuln>

<vuln vid="8706e097-6db7-11ee-8744-080027f5fec9">
 <topic>redis -- Possible bypassing Unix socket permissions</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><lt>7.2.2</lt></range>
 </package>
 <package>
	<name>redis-devel</name>
	<range><lt>7.2.2.20231018</lt></range>
 </package>
 <package>
	<name>redis70</name>
	<range><lt>7.0.14</lt></range>
 </package>
 <package>
	<name>redis62</name>
	<range><lt>6.2.14</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Redis core team reports:
	<blockquote cite="https://groups.google.com/g/redis-db/c/r81pHa-dcI8">
	 
	 The wrong order of listen(2) and chmod(2) calls creates a
	 race condition that can be used by another process to
	 bypass desired Unix socket permissions on startup.
	 
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-45145</cvename>
 <url>https://groups.google.com/g/redis-db/c/r81pHa-dcI8</url>
 </references>
 <dates>
 <discovery>2023-10-18</discovery>
 <entry>2023-10-18</entry>
 </dates>
 </vuln>

<vuln vid="ae0ee356-6ae1-11ee-bfb6-8c164567ca3c">
 <topic>libcue -- out-of-bounds array access</topic>
 <affects>
 <package>
	<name>libcue</name>
	<range><lt>2.3.0</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The libcue team reports:
	<blockquote cite="https://github.com/lipnitsk/libcue/releases/tag/v2.3.0">
	 There is a vulnerability to out-of-bounds array access.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-43641</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-43641</url>
 </references>
 <dates>
 <discovery>2023-10-09</discovery>
 <entry>2023-10-14</entry>
 </dates>
 </vuln>

<vuln vid="7a1b2624-6a89-11ee-af06-5404a68ad561">
 <topic>traefik -- Resource exhaustion by malicious HTTP/2 client</topic>
 <affects>
 <package>
	<name>traefik</name>
	<range><lt>2.10.5</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The traefik authors report:
	<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-7v4p-328v-8v5g">
	 There is a vulnerability in GO managing HTTP/2 requests, which
	 impacts Traefik. This vulnerability could be exploited to cause
	 a denial of service.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-39325</cvename>
 <cvename>CVE-2023-44487</cvename>
 <url>https://github.com/traefik/traefik/security/advisories/GHSA-7v4p-328v-8v5g</url>
 </references>
 <dates>
 <discovery>2023-10-10</discovery>
 <entry>2023-10-14</entry>
 </dates>
 </vuln>

<vuln vid="199cdb4d-690d-11ee-9ed0-001fc69cd6dc">
 <topic>x11/libXpm multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libXpm</name>
	<range><lt>3.5.17</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The X.Org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg/2023-October/061506.html">
	 <dl>
	 <dt>CVE-2023-43788: Out of bounds read in XpmCreateXpmImageFromBuffer</dt>
	 <dd>An out-of-bounds read is located in ParseComment() when reading from
	 a memory buffer instead of a file, as it continued to look for the
	 closing comment marker past the end of the buffer.</dd>
	 <dt>CVE-2023-43789: Out of bounds read on XPM with corrupted colormap</dt>
	 <dd>A corrupted colormap section may cause libXpm to read out of bounds.</dd>
	 </dl>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-43788</cvename>
 <cvename>CVE-2023-43789</cvename>
 <url>https://lists.x.org/archives/xorg/2023-October/061506.html</url>
 </references>
 <dates>
 <discovery>2023-09-22</discovery>
 <entry>2023-10-12</entry>
 </dates>
 </vuln>

<vuln vid="bd92f1ab-690c-11ee-9ed0-001fc69cd6dc">
 <topic>11/libX11 multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libX11</name>
	<range><lt>1.8.7</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	The X.Org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg/2023-October/061506.html">
	 <dl>
	 <dt>CVE-2023-43785: out-of-bounds memory access in _XkbReadKeySyms()</dt>
	 <dd>When libX11 is processing the reply from the X server to the XkbGetMap
	 request, if it detected the number of symbols in the new map was less
	 than the size of the buffer it had allocated, it always added room for
	 128 more symbols, instead of the actual size needed. While the
	 _XkbReadBufferCopyKeySyms() helper function returned an error if asked
	 to copy more keysyms into the buffer than there was space allocated for,
	 the caller never checked for an error and assumed the full set of keysyms
	 was copied into the buffer and could then try to read out of bounds when
	 accessing the buffer. libX11 1.8.7 has been patched to both fix the size
	 allocated and check for error returns from _XkbReadBufferCopyKeySyms().</dd>
	 <dt>CVE-2023-43786: stack exhaustion in XPutImage</dt>
	 <dd>When splitting a single line of pixels into chunks that fit in a single
	 request (not using the BIG-REQUESTS extension) to send to the X server,
	 the code did not take into account the number of bits per pixel, so would
	 just loop forever finding it needed to send more pixels than fit in the
	 given request size and not breaking them down into a small enough chunk to
	 fit. An XPM file was provided that triggered this bug when loaded via
	 libXpm's XpmReadFileToPixmap() function, which in turn calls XPutImage()
	 and hit this bug.</dd>
	 <dt>CVE-2023-43787: integer overflow in XCreateImage() leading to a heap overflow</dt>
	 <dd>When creating an image, there was no validation that the multiplication
	 of the caller-provided width by the visual's bits_per_pixel did not
	 overflow and thus result in the allocation of a buffer too small to hold
	 the data that would be copied into it. An XPM file was provided that
	 triggered this bug when loaded via libXpm's XpmReadFileToPixmap() function,
	 which in turn calls XCreateImage() and hit this bug.i</dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-43785</cvename>
 <cvename>CVE-2023-43786</cvename>
 <cvename>CVE-2023-43787</cvename>
 <url>https://lists.x.org/archives/xorg/2023-October/061506.html</url>
 </references>
 <dates>
 <discovery>2023-09-22</discovery>
 <entry>2023-10-12</entry>
 </dates>
 </vuln>

<vuln vid="07ee8c14-68f1-11ee-8290-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>118.0.5993.70</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>118.0.5993.70</lt></range>
 </package>
 <package>
 <name>qt6-webengine</name>
 <range><lt>6.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html">
	 This update includes 20 security fixes:
	 <ul>
	 <li>[1487110] Critical CVE-2023-5218: Use after free in Site Isolation. Reported by @18楼梦想改造家 on 2023-09-27</li>
	 <li>[1062251] Medium CVE-2023-5487: Inappropriate implementation in Fullscreen. Reported by Anonymous on 2020-03-17</li>
	 <li>[1414936] Medium CVE-2023-5484: Inappropriate implementation in Navigation. Reported by Thomas Orlita on 2023-02-11</li>
	 <li>[1476952] Medium CVE-2023-5475: Inappropriate implementation in DevTools. Reported by Axel Chong on 2023-08-30</li>
	 <li>[1425355] Medium CVE-2023-5483: Inappropriate implementation in Intents. Reported by Axel Chong on 2023-03-17</li>
	 <li>[1458934] Medium CVE-2023-5481: Inappropriate implementation in Downloads. Reported by Om Apip on 2023-06-28</li>
	 <li>[1474253] Medium CVE-2023-5476: Use after free in Blink History. Reported by Yunqin Sun on 2023-08-20</li>
	 <li>[1483194] Medium CVE-2023-5474: Heap buffer overflow in PDF. Reported by [pwn2car] on 2023-09-15</li>
	 <li>[1471253] Medium CVE-2023-5479: Inappropriate implementation in Extensions API. Reported by Axel Chong on 2023-08-09</li>
	 <li>[1395164] Low CVE-2023-5485: Inappropriate implementation in Autofill. Reported by Ahmed ElMasry on 2022-12-02</li>
	 <li>[1472404] Low CVE-2023-5478: Inappropriate implementation in Autofill. Reported by Ahmed ElMasry on 2023-08-12</li>
	 <li>[1472558] Low CVE-2023-5477: Inappropriate implementation in Installer. Reported by Bahaa Naamneh of Crosspoint Labs on 2023-08-13</li>
	 <li>[1357442] Low CVE-2023-5486: Inappropriate implementation in Input. Reported by Hafiizh on 2022-08-29</li>
	 <li>[1484000] Low CVE-2023-5473: Use after free in Cast. Reported by DarkNavy on 2023-09-18</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-5218</cvename>
 <cvename>CVE-2023-5487</cvename>
 <cvename>CVE-2023-5484</cvename>
 <cvename>CVE-2023-5475</cvename>
 <cvename>CVE-2023-5483</cvename>
 <cvename>CVE-2023-5481</cvename>
 <cvename>CVE-2023-5476</cvename>
 <cvename>CVE-2023-5474</cvename>
 <cvename>CVE-2023-5479</cvename>
 <cvename>CVE-2023-5485</cvename>
 <cvename>CVE-2023-5478</cvename>
 <cvename>CVE-2023-5477</cvename>
 <cvename>CVE-2023-5486</cvename>
 <cvename>CVE-2023-5473</cvename>
 <url>https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html</url>
 </references>
 <dates>
 <discovery>2023-10-10</discovery>
 <entry>2023-10-11</entry>
 </dates>
 </vuln>

<vuln vid="4281b712-ad6b-4c21-8f66-619a9150691f">
 <topic>electron25 -- Use after free in extensions vulnerability</topic>
 <affects>
 <package>
	<name>electron25</name>
	<range><lt>25.9.1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v25.9.1">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2023-5187.</li>
	 </ul>
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-5187</cvename>
 <url>https://github.com/advisories/GHSA-hg3r-958g-g8vq</url>
 </references>
 <dates>
 <discovery>2023-10-11</discovery>
 <entry>2023-10-12</entry>
 </dates>
 </vuln>

<vuln vid="d6c19e8c-6806-11ee-9464-b42e991fc52e">
 <topic>curl -- SOCKS5 heap buffer overflow</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><gt>7.69.0</gt><lt>8.4.0</lt></range>
 </package>
 <package>
	<name>cmake-core</name>
	<range><lt>3.27.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The curl team reports:
	<blockquote cite="https://curl.se/docs/CVE-2023-38545.html">
	This flaw makes curl overflow a heap based buffer in the
	 SOCKS5 proxy handshake. When curl is asked to pass along
	 the hostname to the SOCKS5 proxy to allow that to resolve
	 the address instead of it getting done by curl itself, the
	 maximum length that hostname can be is 255 bytes. If the
	 hostname is detected to be longer than 255 bytes, curl
	 switches to local name resolving and instead passes on the
	 resolved address only to the proxy. Due to a bug, the
	 local variable that means "let the host resolve the name"
	 could get the wrong value during a slow SOCKS5 handshake,
	 and contrary to the intention, copy the too long hostname
	 to the target buffer instead of copying just the resolved
	 address there.
	
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-38545</cvename>
 <url>https://curl.se/docs/CVE-2023-38545.html</url>
 </references>
 <dates>
 <discovery>2023-09-30</discovery>
 <entry>2023-10-11</entry>
 <modified>2023-10-11</modified>
 </dates>
 </vuln>

<vuln vid="bf545001-b96d-42e4-9d2e-60fdee204a43">
	 <topic>h2o -- HTTP/2 Rapid Reset attack vulnerability</topic>
 <affects>
 <package>
 <name>h2o</name>
 <range><le>2.2.6</le></range>
 </package>
 <package>
 <name>h2o-devel</name>
 <range><lt>2.3.0.d.20231010</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 Kazuo Okuhu reports:
 <blockquote cite="https://github.com/h2o/h2o/issues/3291">
		
		H2O is vulnerable to the HTTP/2 Rapid Reset attack.
		An attacker might be able to consume more than adequate amount of
		processing power of h2o and the backend servers by mounting the
		attack.
 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-44487</cvename>
 <url>https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf</url>
 </references>
 <dates>
 <discovery>2023-10-10</discovery>
 <entry>2023-10-10</entry>
 </dates>
 </vuln>

<vuln vid="4f254817-6318-11ee-b2ff-080027de9982">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py39-django32</name>
	<name>py310-django32</name>
	<name>py311-django32</name>
	<range><lt>3.2.22</lt></range>
 </package>
 <package>
	<name>py39-django41</name>
	<name>py310-django41</name>
	<name>py311-django41</name>
	<range><lt>4.1.12</lt></range>
 </package>
 <package>
	<name>py39-django42</name>
	<name>py310-django42</name>
	<name>py311-django42</name>
	<range><lt>4.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Django reports:
 <blockquote cite="https://www.djangoproject.com/weblog/2023/oct/04/security-releases/">
	CVE-2023-43665: Denial-of-service possibility in django.utils.text.Truncator.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-43665</cvename>
 <url>https://www.djangoproject.com/weblog/2023/oct/04/security-releases/</url>
 </references>
 <dates>
 <discovery>2023-10-01</discovery>
 <entry>2023-10-05</entry>
 </dates>
 </vuln>

<vuln vid="915855ad-283d-4597-b01e-e0bf611db78b">
 <topic>libspf2 -- Integer Underflow Remote Code Execution</topic>
 <affects>
 <package>
	<name>libspf2</name>
	<range><lt>1.2.11_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Trendmicro ZDI reports:
	<blockquote cite="https://www.zerodayinitiative.com/advisories/ZDI-23-1472/">
	Integer Underflow Remote Code Execution Vulnerability
	The specific flaw exists within the parsing of SPF macros.
	When parsing SPF macros, the process does not properly
	validate user-supplied data, which can result in an integer
	underflow before writing to memory. An attacker can leverage
	this vulnerability to execute code in the context of the
	service account.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-42118</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42118</url>
 </references>
 <dates>
 <discovery>2022-06-06</discovery>
 <entry>2023-10-04</entry>
 <modified>2025-05-04</modified>
 </dates>
 </vuln>

<vuln vid="4e45c45b-629e-11ee-8290-a8a1599412c6">
 <topic>chromium -- type confusion in v8</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>117.0.5938.149</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>117.0.5938.149</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[1485829] High CVE-2023-5346: Type Confusion in V8. Reported by Amit Kumar on 2023-09-22</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-5346</cvename>
 <url>https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2023-10-03</discovery>
 <entry>2023-10-04</entry>
 </dates>
 </vuln>

<vuln vid="162a675b-6251-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- arm64 boot CPUs may lack speculative execution protections</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.2</ge><lt>13.2_4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	On CPU 0 the check for the SMCCC workaround is called before
	SMCCC support has been initialized.
	<h1>Impact:</h1>
	No speculative execution workarounds are installed on CPU 0.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-5370</cvename>
 <freebsdsa>SA-23:14.smccc</freebsdsa>
 </references>
 <dates>
 <discovery>2023-10-03</discovery>
 <entry>2023-10-04</entry>
 </dates>
 </vuln>

<vuln vid="e261e71c-6250-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- copy_file_range insufficient capability rights check</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.2</ge><lt>13.2_4</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The syscall checked only for the CAP_READ and CAP_WRITE
	capabilities on the input and output file descriptors, respectively.
	Using an offset is logically equivalent to seeking, and the syscall
	must additionally require the CAP_SEEK capability.
	<h1>Impact:</h1>
	A sandboxed process with only read or write but no seek capability
	on a file descriptor may be able to read data from or write data
	to an arbitrary location within the file corresponding to that file
	descriptor.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-5369</cvename>
 <freebsdsa>SA-23:13.capsicum</freebsdsa>
 </references>
 <dates>
 <discovery>2023-10-03</discovery>
 <entry>2023-10-04</entry>
 </dates>
 </vuln>

<vuln vid="fefcd340-624f-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- msdosfs data disclosure</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.2</ge><lt>13.2_4</lt></range>
	<range><ge>12.4</ge><lt>12.4_6</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	In certain cases using the truncate or ftruncate system call
	to extend a file size populates the additional space in the file
	with unallocated data from the underlying disk device, rather than
	zero bytes.
	<h1>Impact:</h1>
	A user with write access to files on a msdosfs file system may
	be able to read unintended data (for example, from a previously
	deleted file).
 </body>
 </description>
 <references>
 <cvename>CVE-2023-5368</cvename>
 <freebsdsa>SA-23:12.msdosfs</freebsdsa>
 </references>
 <dates>
 <discovery>2023-10-03</discovery>
 <entry>2023-10-04</entry>
 </dates>
 </vuln>

<vuln vid="e59fed96-60da-11ee-9102-000c29de725b">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
	<package>
	<name>mediawiki135</name>
	<range><lt>1.35.13</lt></range>
 </package>
 <package>
	<name>mediawiki139</name>
	<range><lt>1.39.5</lt></range>
 </package>
 <package>
	<name>mediawiki140</name>
	<range><lt>1.40.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawikwi reports:
	<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/BRWOWACCHMYRIS7JRTT6XD44X3362MVL/">
	 (T264765, CVE-2023-PENDING) SECURITY: Users without correct permission
	 are incorrectly shown MediaWiki:Missing-revision-permission.
	 (T333050, CVE-2023-PENDING) SECURITY: Fix infinite loop for
	 self-redirects with variants conversion.
	 (T340217, CVE-2023-PENDING) SECURITY: Vector 2022: Numerous unescaped
	 messages leading to potential XSS.
	 (T340220, CVE-2023-PENDING) SECURITY: Vector 2022: vector-intro-page
	 message is assumed to yield a valid title.
	 (T340221, CVE-2023-PENDING) SECURITY: XSS via
	 'youhavenewmessagesmanyusers' and 'youhavenewmessages' messages.
	 (T341529, CVE-2023-PENDING) SECURITY: diff-multi-sameuser ("X
	 intermediate revisions by the same user not shown") ignores username
	 suppression.
	 (T341565, CVE-2023-3550) SECURITY: Stored XSS when uploading crafted XML
	 file to Special:Upload (non-standard configuration).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3550</cvename>
 <url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/BRWOWACCHMYRIS7JRTT6XD44X3362MVL/</url>
 </references>
 <dates>
 <discovery>2023-09-01</discovery>
 <entry>2023-10-02</entry>
 </dates>
 </vuln>

<vuln vid="33922b84-5f09-11ee-b63d-0897988a1c07">
 <topic>Remote Code Execution via web-accessible composer</topic>
 <affects>
 <package>
	<name>php80-composer</name>
	<range><lt>1.10.27</lt></range>
	<range><gt>2.0.0</gt><lt>2.6.4</lt></range>
 </package>
 <package>
	<name>php81-composer</name>
	<range><lt>1.10.27</lt></range>
	<range><gt>2.0.0</gt><lt>2.6.4</lt></range>
 </package>
 <package>
	<name>php82-composer</name>
	<range><lt>1.10.27</lt></range>
	<range><gt>2.0.0</gt><lt>2.6.4</lt></range>
 </package>
 <package>
	<name>php83-composer</name>
	<range><lt>1.10.27</lt></range>
	<range><gt>2.0.0</gt><lt>2.6.4</lt></range>
 </package>
 <package>
	<name>php80-composer2</name>
	<range><lt>2.6.4</lt></range>
 </package>
 <package>
	<name>php81-composer2</name>
	<range><lt>2.6.4</lt></range>
 </package>
 <package>
	<name>php82-composer2</name>
	<range><lt>2.6.4</lt></range>
 </package>
 <package>
	<name>php83-composer2</name>
	<range><lt>2.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Composer project reports:
	<blockquote cite="https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf">
	 Description: Users publishing a composer.phar to a
	 public web-accessible server where the composer.phar can
	 be executed as a php file may be impacted if PHP also has
	 register_argc_argv enabled in php.ini.
	 Workaround: Make sure register_argc_argv is disabled
	 in php.ini, and avoid publishing composer.phar to the web
	 as this really should not happen.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-43655</cvename>
 <url>https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf</url>
 </references>
 <dates>
 <discovery>2023-09-29</discovery>
 <entry>2023-09-29</entry>
 <modified>2023-09-30</modified>
 </dates>
 </vuln>

<vuln vid="6d9c6aae-5eb1-11ee-8290-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>117.0.5938.132</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>117.0.5938.132</lt></range>
 </package>
 <package>
 <name>qt6-webengine</name>
 <range><lt>6.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html">
	 This update includes 10 security fixes:
	 <ul>
	 <li>[1486441] High CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx. Reported by Clément Lecigne of Google's Threat Analysis Group on 2023-09-25</li>
	 <li>[1478889] High CVE-2023-5186: Use after free in Passwords. Reported by [pwn2car] on 2023-09-05</li>
	 <li>[1475798] High CVE-2023-5187: Use after free in Extensions. Reported by Thomas Orlita on 2023-08-25</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-5217</cvename>
 <cvename>CVE-2023-5186</cvename>
 <cvename>CVE-2023-5187</cvename>
 <url>https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html</url>
 </references>
 <dates>
 <discovery>2023-09-27</discovery>
 <entry>2023-09-29</entry>
 </dates>
 </vuln>

<vuln vid="2bcd6ba4-d8e2-42e5-9033-b50b722821fb">
 <topic>electron{22,24,25} -- Heap buffer overflow in vp8 encoding in libvpx</topic>
 <affects>
 <package>
	<name>electron22</name>
	<range><lt>22.3.25</lt></range>
 </package>
 <package>
	<name>electron24</name>
	<range><lt>24.8.5</lt></range>
 </package>
 <package>
	<name>electron25</name>
	<range><lt>25.8.4</lt></range>
 </package>
 <package>
	<name>libvpx</name>
	<range><lt>1.13.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.25">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2023-5217.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-5217</cvename>
 <url>https://github.com/advisories/GHSA-qqvq-6xgj-jw8g</url>
 </references>
 <dates>
 <discovery>2023-09-28</discovery>
 <entry>2023-09-29</entry>
 <modified>2023-09-30</modified>
 </dates>
 </vuln>

<vuln vid="6e0ebb4a-5e75-11ee-a365-001b217b3468">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.4.0</ge><lt>16.4.1</lt></range>
	<range><ge>16.3.0</ge><lt>16.3.5</lt></range>
	<range><ge>8.15</ge><lt>16.2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Attacker can add other projects policy bot as member to their own project and use that bot to trigger pipelines in victims project
	Group import allows impersonation of users in CI pipelines
	Developers can bypass code owners approval by changing a MR's base branch
	Leaking source code of restricted project through a fork
	Third party library Consul requires enable-script-checks to be False to enable patch
	Service account not deleted when namespace is deleted allowing access to internal projects
	Enforce SSO settings bypassed for public projects for Members without identity
	Removed project member can write to protected branches
	Unauthorised association of CI jobs for Machine Learning experiments
	Force pipelines to not have access to protected variables and will likely fail using tags
	Maintainer can create a fork relationship between existing projects
	Disclosure of masked CI variables via processing CI/CD configuration of forks
	Asset Proxy Bypass using non-ASCII character in asset URI
	Unauthorized member can gain Allowed to push and merge access and affect integrity of protected branches
	Removed Developer can continue editing the source code of a public project
	A project reporter can leak owner's Sentry instance projects
	Math rendering in markdown can escape container and hijack clicks
 </body>
 </description>
 <references>
 <cvename>CVE-2023-5207</cvename>
 <cvename>CVE-2023-5207</cvename>
 <cvename>CVE-2023-4379</cvename>
 <cvename>CVE-2023-3413</cvename>
 <cvename>CVE-2023-3914</cvename>
 <cvename>CVE-2023-3115</cvename>
 <cvename>CVE-2023-5198</cvename>
 <cvename>CVE-2023-4532</cvename>
 <cvename>CVE-2023-3917</cvename>
 <cvename>CVE-2023-3920</cvename>
 <cvename>CVE-2023-0989</cvename>
 <cvename>CVE-2023-3906</cvename>
 <cvename>CVE-2023-4658</cvename>
 <cvename>CVE-2023-3979</cvename>
 <cvename>CVE-2023-2233</cvename>
 <cvename>CVE-2023-3922</cvename>
 <url>https://about.gitlab.com/releases/2023/09/28/security-release-gitlab-16-4-1-released/</url>
 </references>
 <dates>
 <discovery>2023-09-28</discovery>
 <entry>2023-09-29</entry>
 </dates>
 </vuln>

<vuln vid="af065e47-5d62-11ee-bbae-1c61b4739ac9">
 <topic>xrdp -- unchecked access to font glyph info</topic>
 <affects>
 <package>
	<name>xrdp</name>
	<range><lt>0.9.23.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	xrdp team reports:
	<blockquote cite="https://www.cve.org/CVERecord?id=CVE-2023-42822">
	Access to the font glyphs in xrdp_painter.c is not bounds-checked.
	Since some of this data is controllable by the user, this can result
	in an out-of-bounds read within the xrdp executable. The vulnerability
	allows an out-of-bounds read within a potentially privileged process.
	On non-Debian platforms, xrdp tends to run as root. Potentially an
	out-of-bounds write can follow the out-of-bounds read. There is no
	denial-of-service impact, providing xrdp is running in forking mode. This
	issue has been addressed in release 0.9.23.1. Users are advised to upgrade.
	There are no known workarounds for this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-42822</cvename>
 <url>https://www.cve.org/CVERecord?id=CVE-2023-42822</url>
 <url>https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-2hjx-rm4f-r9hw</url>
 </references>
 <dates>
 <discovery>2023-09-27</discovery>
 <entry>2023-09-27</entry>
 </dates>
 </vuln>

<vuln vid="c9ff1150-5d63-11ee-bbae-1c61b4739ac9">
 <topic>xrdp -- Improper handling of session establishment errors allows bypassing OS-level session restrictions</topic>
 <affects>
 <package>
	<name>xrdp</name>
	<range><lt>0.9.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	xrdp team reports:
	<blockquote cite="https://www.cve.org/CVERecord?id=CVE-2023-40184">
	In versions prior to 0.9.23 improper handling of session establishment
	errors allows bypassing OS-level session restrictions. The `auth_start_session`
	function can return non-zero (1) value on, e.g., PAM error which may result
	in session restrictions such as max concurrent sessions per user by PAM
	(ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't
	use restrictions by PAM are not affected. This issue has been addressed in
	release version 0.9.23. Users are advised to upgrade. There are no known
	workarounds for this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-40184</cvename>
 <url>https://www.cve.org/CVERecord?id=CVE-2023-40184</url>
 <url>https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-f489-557v-47jq</url>
 </references>
 <dates>
 <discovery>2023-08-30</discovery>
 <entry>2023-09-27</entry>
 </dates>
 </vuln>

<vuln vid="ea9d1fd2-5d24-11ee-8507-b42e991fc52e">
 <topic>routinator -- Possible path traversal when storing RRDP responses</topic>
 <affects>
 <package>
	<name>routinator</name>
	<range><ge>0.9.0</ge><lt>0.12.2</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	sep@nlnetlabs.nl reports:
	<blockquote cite="https://nlnetlabs.nl/downloads/routinator/CVE-2023-39916.txt">
	 NLnet Labs Routinator 0.9.0 up to and including 0.12.1 contains a
	possible path traversal vulnerability in the optional, off-by-default
	keep-rrdp-responses feature that allows users to store the content
	of responses received for RRDP requests. The location of these
	stored responses is constructed from the URL of the request. Due
	to insufficient sanitation of the URL, it is possible for an attacker
	to craft a URL that results in the response being stored outside
	of the directory specified for it.
	</blockquote>
	</body>
 </description>
 <references>
 <cvename>CVE-2023-39916</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-39916</url>
 </references>
 <dates>
 <discovery>2023-09-13</discovery>
 <entry>2023-09-27</entry>
 </dates>
 </vuln>

<vuln vid="402fccd0-5b6d-11ee-9898-00e081b7aa2d">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.424</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.414.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2023-09-20/">
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-3261 / CVE-2023-43494</h5>
	 Builds can be filtered by values of sensitive build variables
	 <h5>(High) SECURITY-3245 / CVE-2023-43495</h5>
	 Stored XSS vulnerability
	 <h5>(High) SECURITY-3072 / CVE-2023-43496 </h5>
	 Temporary plugin file created with insecure permissions
	 <h5>(Low) SECURITY-3073 / CVE-2023-43497 (Stapler), CVE-2023-43498 (MultipartFormDataParser) </h5>
	 Temporary uploaded file created with insecure permissions
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-43494</cvename>
 <cvename>CVE-2023-43495</cvename>
 <cvename>CVE-2023-43496</cvename>
 <cvename>CVE-2023-43497</cvename>
 <url>https://www.jenkins.io/security/advisory/2023-09-20/</url>
 </references>
 <dates>
 <discovery>2023-09-20</discovery>
 <entry>2023-09-25</entry>
 </dates>
 </vuln>

<vuln vid="732282a5-5a10-11ee-bca0-001999f8d30b">
 <topic>Mailpit affected by vulnerability in included go markdown module</topic>
 <affects>
 <package>
	<name>mailpit</name>
	<range><lt>1.9.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mailpit author reports:
	<blockquote cite="https://github.com/axllent/mailpit/releases/tag/v1.9.1">
	 Update Go modules to address CVE-2023-42821 (go markdown module DoS).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-42821</cvename>
 </references>
 <dates>
 <discovery>2023-09-23</discovery>
 <entry>2023-09-23</entry>
 </dates>
 </vuln>

<vuln vid="4fd7a2fc-5860-11ee-a1b3-dca632daf43b">
 <topic>graphics/webp heap buffer overflow</topic>
 <affects>
 <package>
	<name>webp</name>
	<range><lt>1.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2023-4863">
	 Heap buffer overflow in WebP ... allowed a remote attacker to perform an out of bounds memory write ...
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4863</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-4863</url>
 </references>
 <dates>
 <discovery>2023-09-12</discovery>
 <entry>2023-09-21</entry>
 </dates>
 </vuln>

<vuln vid="58a738d4-57af-11ee-8c58-b42e991fc52e">
 <topic>libwebp heap buffer overflow</topic>
 <affects>
 <package>
	<name>tor-browser</name>
	<range><lt>12.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	chrome-cve-admin@google.com reports:
	<blockquote cite="https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/">
	 Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187
	allowed a remote attacker to perform an out of bounds memory write
	via a crafted HTML page. (Chromium security severity: Critical)
	The Tor browser is based on Firefox and GeckoView and uses also
	libwep so it is affected by this bug.
	
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4863</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-4863</url>
 </references>
 <dates>
 <discovery>2023-09-12</discovery>
 <entry>2023-09-20</entry>
 </dates>
 </vuln>

<vuln vid="32a4896a-56da-11ee-9186-001b217b3468">
 <topic>Gitlab -- vulnerability</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.3.0</ge><lt>16.3.4</lt></range>
	<range><ge>13.12.0</ge><lt>16.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/09/18/security-release-gitlab-16-3-4-released/">
	 Attacker can abuse scan execution policies to run pipelines as another user
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4998</cvename>
 <url>https://about.gitlab.com/releases/2023/09/18/security-release-gitlab-16-3-4-released/</url>
 </references>
 <dates>
 <discovery>2023-09-18</discovery>
 <entry>2023-09-19</entry>
 </dates>
 </vuln>

<vuln vid="11982747-544c-11ee-ac3e-a04a5edf46d9">
 <topic>routinator -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>routinator</name>
	<range><lt>0.12.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NLnet Labs report:
	<blockquote cite="https://nlnetlabs.nl/news/2023/Sep/13/routinator-0.12.2-released/">
	 This release fixes two issues in Routinator that can be exploited
	 remotely by rogue RPKI CAs and repositories. We therefore advise all
	 users of Routinator to upgrade to this release at their earliest
	 convenience.
	 The first issue, CVE-2022-39915, can lead to Routinator crashing
	 when trying to decode certain illegal RPKI objects.
	 The second issue, CVE-2022-39916, only affects users that have the
	 rrdp-keep-responses option enabled which allows storing all received
	 RRDP responses on disk. Because the file name for these responses is
	 derived from the URI and the path wasn't checked properly, a RRDP URI
	could be constructed that results in the response stored outside the
	directory, possibly overwriting existing files.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-39915</cvename>
 <url>https://nlnetlabs.nl/downloads/routinator/CVE-2023-39915.txt</url>
 <cvename>CVE-2022-39916</cvename>
 <url>https://nlnetlabs.nl/downloads/routinator/CVE-2023-39916.txt</url>
 </references>
 <dates>
 <discovery>2022-12-08</discovery>
 <entry>2023-09-16</entry>
 </dates>
 </vuln>

<vuln vid="833b469b-5247-11ee-9667-080027f5fec9">
 <topic>curl -- HTTP headers eat all memory</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>8.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	selmelc on hackerone reports:
	<blockquote cite="https://curl.se/docs/CVE-2023-38039.html">
	 
	 When curl retrieves an HTTP response, it stores the
	 incoming headers so that they can be accessed later via
	 the libcurl headers API.
	 
	 
	 However, curl did not have a limit in how many or how
	 large headers it would accept in a response, allowing a
	 malicious server to stream an endless series of headers
	 and eventually cause curl to run out of heap memory.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-38039</cvename>
 <url>https://curl.se/docs/CVE-2023-38039.html HERE</url>
 </references>
 <dates>
 <discovery>2023-09-13</discovery>
 <entry>2023-09-13</entry>
 </dates>
 </vuln>

<vuln vid="b5508c08-547a-11ee-85eb-84a93843eb75">
 <topic>Roundcube -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><lt>1.6.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Roundcube webmail project reports:
	<blockquote cite="https://roundcube.net/news/2023/09/15/security-update-1.6.3-released">
	 cross-site scripting (XSS) vulnerability in handling of
	 linkrefs in plain text messages
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://roundcube.net/news/2023/09/15/security-update-1.6.3-released</url>
 </references>
 <dates>
 <discovery>2023-09-15</discovery>
 <entry>2023-09-16</entry>
 </dates>
 </vuln>

<vuln vid="773ce35b-eabb-47e0-98ca-669b2b98107a">
 <topic>electron{24,25} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron24</name>
	<range><lt>24.8.3</lt></range>
 </package>
 <package>
	<name>electron25</name>
	<range><lt>25.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v24.8.3">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-4763.</li>
	 <li>Security: backported fix for CVE-2023-4762.</li>
	 <li>Security: backported fix for CVE-2023-4761.</li>
	 <li>Security: backported fix for CVE-2023-4863.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4763</cvename>
 <url>https://github.com/advisories/GHSA-w5hv-g8p5-vwjr</url>
 <cvename>CVE-2023-4762</cvename>
 <url>https://github.com/advisories/GHSA-3wjr-p76q-rg8q</url>
 <cvename>CVE-2023-4761</cvename>
 <url>https://github.com/advisories/GHSA-8cgp-x4c5-vg9g</url>
 <cvename>CVE-2023-4863</cvename>
 <url>https://github.com/advisories/GHSA-j7hp-h8jx-5ppr</url>
 </references>
 <dates>
 <discovery>2023-09-13</discovery>
 <entry>2023-09-13</entry>
 </dates>
 </vuln>

<vuln vid="3693eca5-f0d3-453c-9558-2353150495bb">
 <topic>electron22 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron22</name>
	<range><lt>22.3.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.24">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-4572.</li>
	 <li>Security: backported fix for CVE-2023-4762.</li>
	 <li>Security: backported fix for CVE-2023-4863.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4572</cvename>
 <url>https://github.com/advisories/GHSA-6994-5wq3-gpjv</url>
 <cvename>CVE-2023-4762</cvename>
 <url>https://github.com/advisories/GHSA-3wjr-p76q-rg8q</url>
 <cvename>CVE-2023-4863</cvename>
 <url>https://github.com/advisories/GHSA-j7hp-h8jx-5ppr</url>
 </references>
 <dates>
 <discovery>2023-09-13</discovery>
 <entry>2023-09-13</entry>
 </dates>
 </vuln>

<vuln vid="88754d55-521a-11ee-8290-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>117.0.5938.62</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>117.0.5938.62</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html">
	 This update includes 16 security fixes:
	 <ul>
	 <li>[1479274] Critical CVE-2023-4863: Heap buffer overflow in WebP. Reported by Apple Security Engineering and Architecture (SEAR) and The Citizen Lab at The University of Torontoʼs Munk School on 2023-09-06</li>
	 <li>[1430867] Medium CVE-2023-4900: Inappropriate implementation in Custom Tabs. Reported by Levit Nudi from Kenya on 2023-04-06</li>
	 <li>[1459281] Medium CVE-2023-4901: Inappropriate implementation in Prompts. Reported by Kang Ali on 2023-06-29</li>
	 <li>[1454515] Medium CVE-2023-4902: Inappropriate implementation in Input. Reported by Axel Chong on 2023-06-14</li>
	 <li>[1446709] Medium CVE-2023-4903: Inappropriate implementation in Custom Mobile Tabs. Reported by Ahmed ElMasry on 2023-05-18</li>
	 <li>[1453501] Medium CVE-2023-4904: Insufficient policy enforcement in Downloads. Reported by Tudor Enache @tudorhacks on 2023-06-09</li>
	 <li>[1441228] Medium CVE-2023-4905: Inappropriate implementation in Prompts. Reported by Hafiizh on 2023-04-29</li>
	 <li>[1449874] Low CVE-2023-4906: Insufficient policy enforcement in Autofill. Reported by Ahmed ElMasry on 2023-05-30</li>
	 <li>[1462104] Low CVE-2023-4907: Inappropriate implementation in Intents. Reported by Mohit Raj (shadow2639) on 2023-07-04</li>
	 <li>[1451543] Low CVE-2023-4908: Inappropriate implementation in Picture in Picture. Reported by Axel Chong on 2023-06-06</li>
	 <li>[1463293] Low CVE-2023-4909: Inappropriate implementation in Interstitials. Reported by Axel Chong on 2023-07-09</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4863</cvename>
 <cvename>CVE-2023-4900</cvename>
 <cvename>CVE-2023-4901</cvename>
 <cvename>CVE-2023-4902</cvename>
 <cvename>CVE-2023-4903</cvename>
 <cvename>CVE-2023-4904</cvename>
 <cvename>CVE-2023-4905</cvename>
 <cvename>CVE-2023-4906</cvename>
 <cvename>CVE-2023-4907</cvename>
 <cvename>CVE-2023-4908</cvename>
 <cvename>CVE-2023-4909</cvename>
 <url>https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html</url>
 </references>
 <dates>
 <discovery>2023-09-12</discovery>
 <entry>2023-09-13</entry>
 </dates>
 </vuln>

<vuln vid="4bc66a81-89d2-4696-a04b-defd2eb77783">
 <topic>vscode -- VS Code Remote Code Execution Vulnerability</topic>
 <affects>
 <package>
	<name>vscode</name>
	<range><lt>1.82.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	VSCode developers report:
	<blockquote cite="https://github.com/microsoft/vscode/security/advisories/GHSA-r6q2-478f-5gmr">
	 Visual Studio Code Remote Code Execution Vulnerability
	 A remote code execution vulnerability exists in VS Code 1.82.0 and earlier versions that working in a maliciously crafted package.json can result in executing commands locally. This scenario would require the attacker to get the VS Code user to open the malicious project and have get the user to open and work with malformed entries in the dependencies sections of the package.json file.
	 VS Code uses the locally installed npm command to fetch information on package dependencies. A package dependency can be named in such a way that the npm tool runs a script instead.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-36742</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-36742</url>
 <url>https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36742</url>
 </references>
 <dates>
 <discovery>2023-09-12</discovery>
 <entry>2023-09-13</entry>
 </dates>
 </vuln>

<vuln vid="8eefa87f-31f1-496d-bf8e-2b465b6e4e8a">
 <topic>zeek -- potential DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>6.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v6.0.1">
	 File extraction limits were not correctly enforced
	 for files containing large amounts of missing bytes. 
	 Sessions are sometimes not cleaned up completely
	 within Zeek during shutdown, potentially causing a crash
	 when using the -B dpd flag for debug logging. 
	 A specially-crafted HTTP packet can cause Zeek's
	 filename extraction code to take a long time to process
	 the data. 
	 A specially-crafted series of FTP packets made up of
	 a CWD request followed by a large amount of ERPT requests
	 may cause Zeek to spend a long time logging the commands.
	 
	 A specially-crafted VLAN packet can cause Zeek to
	 overflow memory and potentially crash. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v6.0.1</url>
 </references>
 <dates>
 <discovery>2023-09-12</discovery>
 <entry>2023-09-12</entry>
 </dates>
 </vuln>

<vuln vid="4061a4b2-4fb1-11ee-acc7-0151f07bc899">
 <topic>gitea -- block user account creation from blocked email domains</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.20.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/26812">
	 check blocklist for emails when adding them to account
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.com/release-of-1.20.4</url>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.20.4</url>
 </references>
 <dates>
 <discovery>2023-08-30</discovery>
 <entry>2023-09-10</entry>
 </dates>
 </vuln>

<vuln vid="a57472ba-4d84-11ee-bf05-000c29de725b">
 <topic>Python -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python38</name>
	<range><lt>3.8.18</lt></range>
 </package>
 <package>
	<name>python39</name>
	<range><lt>3.9.18</lt></range>
 </package>
 <package>
	<name>python310</name>
	<range><lt>3.10.13</lt></range>
 </package>
 <package>
	<name>python311</name>
	<range><lt>3.11.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python reports:
	<blockquote cite="https://pythoninsider.blogspot.com/2023/08/python-3115-31013-3918-and-3818-is-now.html">
	 gh-108310: Fixed an issue where instances of ssl.SSLSocket were vulnerable
	 to a bypass of the TLS handshake and included protections (like certificate
	 verification) and treating sent unencrypted data as if it were post-handshake
	 TLS encrypted data.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-40217</cvename>
 <url>https://pythoninsider.blogspot.com/2023/08/python-3115-31013-3918-and-3818-is-now.html</url>
 </references>
 <dates>
 <discovery>2023-08-22</discovery>
 <entry>2023-09-07</entry>
 </dates>
 </vuln>

<vuln vid="beb36f39-4d74-11ee-985e-bff341e78d94">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go120</name>
	<range><lt>1.20.8</lt></range>
 </package>
 <package>
	<name>go121</name>
	<range><lt>1.21.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/62198">
	 cmd/go: go.mod toolchain directive allows arbitrary
	 execution
	 The go.mod toolchain directive, introduced in Go 1.21,
	 could be leveraged to execute scripts and binaries
	 relative to the root of the module when the "go" command
	 was executed within the module. This applies to modules
	 downloaded using the "go" command from the module proxy,
	 as well as modules downloaded directly using VCS software.
	</blockquote>
	<blockquote cite="https://go.dev/issue/62196">
	 html/template: improper handling of HTML-like comments
	 within script contexts
	 The html/template package did not properly handle
	 HMTL-like "&lt;!--" and "--&gt;"
	 comment tokens, nor hashbang "#!" comment tokens, in
	 &lt;script&gt; contexts. This may cause the template
	 parser to improperly interpret the contents of
	 &lt;script&gt; contexts, causing actions to be improperly
	 escaped. This could be leveraged to perform an XSS attack.
	</blockquote>
	<blockquote cite="https://go.dev/issue/62197">
	 html/template: improper handling of special tags within
	 script contexts
	 The html/template package did not apply the proper rules
	 for handling occurrences
	 of "&lt;script", "&lt;!--", and "&lt;/script" within JS
	 literals in &lt;script&lt; contexts. This may cause the
	 template parser to improperly consider script contexts to
	 be terminated early, causing actions to be improperly
	 escaped. This could be leveraged to perform an XSS attack.
	</blockquote>
	<blockquote cite="https://go.dev/issue/62266">
	 crypto/tls: panic when processing post-handshake message
	 on QUIC connections
	 Processing an incomplete post-handshake message for a QUIC
	 connection caused a panic.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-39320</cvename>
 <cvename>CVE-2023-39318</cvename>
 <cvename>CVE-2023-39319</cvename>
 <cvename>CVE-2023-39321</cvename>
 <cvename>CVE-2023-39322</cvename>
 <url>https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ?pli=1</url>
 </references>
 <dates>
 <discovery>2023-09-06</discovery>
 <entry>2023-09-07</entry>
 </dates>
 </vuln>

<vuln vid="924cb116-4d35-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- Wi-Fi encryption bypass</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.2</ge><lt>13.2_3</lt></range>
	<range><ge>12.4</ge><lt>12.4_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The net80211 subsystem would fallback to the multicast key for unicast
	traffic in the event the unicast key was removed. This would result in
	buffered unicast traffic being exposed to any stations with access to the
	multicast key.
	<h1>Impact:</h1>
	As described in the "Framing Frames: Bypassing Wi-Fi Encryption by
	Manipulating Transmit Queues" paper, an attacker can induce an access point
	to buffer frames for a client, deauthenticate the client (causing the unicast
	key to be removed from the access point), and subsequent flushing of the
	buffered frames now encrypted with the multicast key. This would give the
	attacker access to the data.
 </body>
 </description>
 <references>
 <cvename>CVE-2022-47522</cvename>
 <freebsdsa>SA-23:11.wifi</freebsdsa>
 </references>
 <dates>
 <discovery>2023-09-06</discovery>
 <entry>2023-09-07</entry>
 </dates>
 </vuln>

<vuln vid="d35373ae-4d34-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- pf incorrectly handles multiple IPv6 fragment headers</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.2</ge><lt>13.2_3</lt></range>
	<range><ge>12.4</ge><lt>12.4_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	With a 'scrub fragment reassemble' rule, a packet containing multiple IPv6
	fragment headers would be reassembled, and then immediately processed. That
	is, a packet with multiple fragment extension headers would not be recognized
	as the correct ultimate payload. Instead a packet with multiple IPv6 fragment
	headers would unexpectedly be interpreted as a fragmented packet, rather than
	as whatever the real payload is.
	<h1>Impact:</h1>
	IPv6 fragments may bypass firewall rules written on the assumption all
	fragments have been reassembled and, as a result, be forwarded or processed
	by the host.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4809</cvename>
 <freebsdsa>SA-23:10.pf</freebsdsa>
 </references>
 <dates>
 <discovery>2023-09-06</discovery>
 <entry>2023-09-07</entry>
 </dates>
 </vuln>

<vuln vid="6c72b13f-4d1d-11ee-a7f1-080027f5fec9">
 <topic>redis -- Possible bypassing ACL configuration</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><ge>7.0.0</ge><lt>7.0.13</lt></range>
	<range><ge>7.2.0</ge><lt>7.2.1</lt></range>
 </package>
 <package>
	<name>redis-devel</name>
	<range><lt>7.2.0.20230831</lt></range>
 </package>
 <package>
	<name>redis70</name>
	<range><ge>7.0.0</ge><lt>7.0.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	yangbodong22011 reports:
	<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-q4jr-5p56-4xwc">
	 
	 Redis does not correctly identify keys accessed by SORT_RO
	 and, as a result, may grant users executing this command
	 access to keys that are not explicitly authorized by the
	 ACL configuration.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-41053</cvename>
 <url>https://github.com/redis/redis/security/advisories/GHSA-q4jr-5p56-4xwc</url>
 </references>
 <dates>
 <discovery>2023-09-06</discovery>
 <entry>2023-09-07</entry>
 </dates>
 </vuln>

<vuln vid="df0a2fd1-4c92-11ee-8290-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>116.0.5845.179</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>116.0.5845.179</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[1476403] High CVE-2023-4761: Out of bounds memory access in FedCM. Reported by DarkNavy on 2023-08-28</li>
	 <li>[1473247] High CVE-2023-4762: Type Confusion in V8. Reported by Rong Jian of VRI on 2023-08-16</li>
	 <li>[1469928] High CVE-2023-4763: Use after free in Networks. Reported by anonymous on 2023-08-03</li>
	 <li>[1447237] High CVE-2023-4764: Incorrect security UI in BFCache. Reported by Irvan Kurniawan (sourc7) on 2023-05-20</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4761</cvename>
 <cvename>CVE-2023-4762</cvename>
 <cvename>CVE-2023-4763</cvename>
 <cvename>CVE-2023-4764</cvename>
 <url>https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2023-09-05</discovery>
 <entry>2023-09-06</entry>
 </dates>
 </vuln>

<vuln vid="8fd4f40a-4b7d-11ee-aa2a-080027de9982">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py38-django32</name>
	<name>py39-django32</name>
	<name>py310-django32</name>
	<name>py311-django32</name>
	<range><lt>3.2.21</lt></range>
 </package>
 <package>
	<name>py38-django41</name>
	<name>py39-django41</name>
	<name>py310-django41</name>
	<name>py311-django41</name>
	<range><lt>4.1.11</lt></range>
 </package>
 <package>
	<name>py38-django42</name>
	<name>py39-django42</name>
	<name>py310-django42</name>
	<name>py311-django42</name>
	<range><lt>4.2.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2023/sep/04/security-releases/">
	 CVE-2023-41164: Potential denial of service vulnerability in
	 django.utils.encoding.uri_to_iri().
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-41164</cvename>
 <url>https://www.djangoproject.com/weblog/2023/sep/04/security-releases/</url>
 </references>
 <dates>
 <discovery>2023-09-01</discovery>
 <entry>2023-09-04</entry>
 </dates>
 </vuln>

<vuln vid="aaea7b7c-4887-11ee-b164-001b217b3468">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.3.0</ge><lt>16.3.1</lt></range>
	<range><ge>16.2.0</ge><lt>16.2.5</lt></range>
	<range><ge>4.1.0</ge><lt>16.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/08/31/security-release-gitlab-16-3-1-released/">
	 Privilege escalation of "external user" to internal access through group service account
	 Maintainer can leak sentry token by changing the configured URL (fix bypass)
	 Google Cloud Logging private key showed in plain text in GitLab UI leaking to other group owners
	 Information disclosure via project import endpoint
	 Developer can leak DAST scanners "Site Profile" request headers and auth password
	 Project forking outside current group
	 User is capable of creating Model experiment and updating existing run's status in public project
	 ReDoS in bulk import API
	 Pagination for Branches and Tags can be skipped leading to DoS
	 Internal Open Redirection Due to Improper handling of "../" characters
	 Subgroup Member With Reporter Role Can Edit Group Labels
	 Banned user can delete package registries
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3915</cvename>
 <cvename>CVE-2023-4378</cvename>
 <cvename>CVE-2023-3950</cvename>
 <cvename>CVE-2023-4630</cvename>
 <cvename>CVE-2022-4343</cvename>
 <cvename>CVE-2023-4638</cvename>
 <cvename>CVE-2023-4018</cvename>
 <cvename>CVE-2023-3205</cvename>
 <cvename>CVE-2023-4647</cvename>
 <cvename>CVE-2023-1279</cvename>
 <cvename>CVE-2023-0120</cvename>
 <cvename>CVE-2023-1555</cvename>
 <url>https://about.gitlab.com/releases/2023/08/31/security-release-gitlab-16-3-1-released/</url>
 </references>
 <dates>
 <discovery>2023-08-31</discovery>
 <entry>2023-09-01</entry>
 </dates>
 </vuln>

<vuln vid="b8a52e5a-483d-11ee-971d-3df00e0f9020">
 <topic>Borg (Backup) -- flaw in cryptographic authentication scheme in Borg allowed an attacker to fake archives and indirectly cause backup data loss.</topic>
 <affects>
 <package>
	<name>py37-borgbackup</name>
	<name>py38-borgbackup</name>
	<name>py39-borgbackup</name>
	<name>py310-borgbackup</name>
	<name>py311-borgbackup</name>
	<name>py312-borgbackup</name>
	<range><lt>1.2.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Thomas Waldmann reports:
	<blockquote cite="https://github.com/borgbackup/borg/blob/1.2.5-cvedocs/docs/changes.rst#pre-125-archives-spoofing-vulnerability-cve-2023-36811">
	 A flaw in the cryptographic authentication scheme in Borg allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository.
	 The attack requires an attacker to be able to
	 <ul><li>insert files (with no additional headers) into backups</li>
	 <li>gain write access to the repository</li></ul>
	 This vulnerability does not disclose plaintext to the attacker, nor does it affect the authenticity of existing archives. Creating plausible fake archives may be feasible for empty or small archives, but is unlikely for large archives.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-36811</cvename>
 <url>https://github.com/borgbackup/borg/blob/1.2.5-cvedocs/docs/changes.rst#pre-125-archives-spoofing-vulnerability-cve-2023-36811</url>
 </references>
 <dates>
 <discovery>2023-06-13</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="970dcbe0-a947-41a4-abe9-7aaba87f41fe">
 <topic>electron25 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron25</name>
	<range><lt>25.8.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v25.8.0">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-4427.</li>
	 <li>Security: backported fix for CVE-2023-4428.</li>
	 <li>Security: backported fix for CVE-2023-4429.</li>
	 <li>Security: backported fix for CVE-2023-4430.</li>
	 <li>Security: backported fix for CVE-2023-4572.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4427</cvename>
 <url>https://github.com/advisories/GHSA-qqwc-fhxf-4mf3</url>
 <cvename>CVE-2023-4428</cvename>
 <url>https://github.com/advisories/GHSA-m56x-9vph-h345</url>
 <cvename>CVE-2023-4429</cvename>
 <url>https://github.com/advisories/GHSA-r43m-48vw-xgp3</url>
 <cvename>CVE-2023-4430</cvename>
 <url>https://github.com/advisories/GHSA-h295-rcc5-87jh</url>
 <cvename>CVE-2023-4572</cvename>
 <url>https://github.com/advisories/GHSA-6994-5wq3-gpjv</url>
 </references>
 <dates>
 <discovery>2023-08-30</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="29f050e9-3ef4-4c5f-8204-503b41caf181">
 <topic>electron24 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron24</name>
	<range><lt>24.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v24.8.2">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-4427.</li>
	 <li>Security: backported fix for CVE-2023-4428.</li>
	 <li>Security: backported fix for CVE-2023-4430.</li>
	 <li>Security: backported fix for CVE-2023-4572.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4427</cvename>
 <url>https://github.com/advisories/GHSA-qqwc-fhxf-4mf3</url>
 <cvename>CVE-2023-4428</cvename>
 <url>https://github.com/advisories/GHSA-m56x-9vph-h345</url>
 <cvename>CVE-2023-4430</cvename>
 <url>https://github.com/advisories/GHSA-h295-rcc5-87jh</url>
 <cvename>CVE-2023-4572</cvename>
 <url>https://github.com/advisories/GHSA-6994-5wq3-gpjv</url>
 </references>
 <dates>
 <discovery>2023-08-30</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="579c7489-c23d-454a-b0fc-ed9d80ea46e0">
 <topic>electron22 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron22</name>
	<range><lt>22.3.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.23">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-4427.</li>
	 <li>Security: backported fix for CVE-2023-4428.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4427</cvename>
 <url>https://github.com/advisories/GHSA-qqwc-fhxf-4mf3</url>
 <cvename>CVE-2023-4428</cvename>
 <url>https://github.com/advisories/GHSA-m56x-9vph-h345</url>
 </references>
 <dates>
 <discovery>2023-08-30</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="1a15b928-5011-4953-8133-d49e24902fe1">
 <topic>py-WsgiDAV -- XSS vulnerability</topic>
 <affects>
 <package>
 <name>py37-WsgiDAV</name>
 <name>py38-WsgiDAV</name>
 <name>py39-WsgiDAV</name>
 <name>py310-WsgiDAV</name>
 <name>py311-WsgiDAV</name>
 <range><lt>4.1.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <blockquote cite="https://osv.dev/vulnerability/GHSA-xx6g-jj35-pxjv">
 Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-41905</cvename>
 <url>https://osv.dev/vulnerability/GHSA-xx6g-jj35-pxjv</url>
 </references>
 <dates>
 <discovery>2022-11-11</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="17efbe19-4e72-426a-8016-2b4e001c1378">
 <topic>py-wagtail -- stored XSS vulnerability</topic>
 <affects>
 <package>
 <name>py37-wagtail</name>
 <name>py38-wagtail</name>
 <name>py39-wagtail</name>
 <name>py310-wagtail</name>
 <name>py311-wagtail</name>
 <range><lt>4.1.4</lt></range>
 <range><ge>4.2.0</ge><lt>4.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <blockquote cite="https://osv.dev/vulnerability/GHSA-5286-f2rf-35c2">
 A stored cross-site scripting (XSS) vulnerability exists on ModelAdmin views within the Wagtail admin interface.
 A user with a limited-permission editor account for the Wagtail admin could potentially craft pages and documents that, when viewed by a user with higher privileges, could perform actions with that user's credentials.
 The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites with ModelAdmin enabled.
 For page, the vulnerability is in the "Choose a parent page" ModelAdmin view, available when managing pages via ModelAdmin.
 For documents, the vulnerability is in the ModelAdmin Inspect view when displaying document fields.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28836</cvename>
 <url>https://osv.dev/vulnerability/GHSA-5286-f2rf-35c2</url>
 </references>
 <dates>
 <discovery>2023-04-03</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="2def7c4b-736f-4754-9f03-236fcb586d91">
 <topic>py-wagtail -- DoS vulnerability</topic>
 <affects>
 <package>
 <name>py37-wagtail</name>
 <name>py38-wagtail</name>
 <name>py39-wagtail</name>
 <name>py310-wagtail</name>
 <name>py311-wagtail</name>
 <range><ge>4.2.0</ge><lt>4.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <blockquote cite="https://osv.dev/vulnerability/GHSA-33pv-vcgh-jfg9">
 A memory exhaustion bug exists in Wagtail's handling of uploaded images and documents.
 For both images and documents, files are loaded into memory during upload for additional processing.
 A user with access to upload images or documents through the Wagtail admin interface could upload a file so large that it results in a crash or denial of service.
 The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
 It can only be exploited by admin users with permission to upload images or documents.
 Image uploads are restricted to 10MB by default, however this validation only happens on the frontend and on the backend after the vulnerable code.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28837</cvename>
 <url>https://osv.dev/vulnerability/GHSA-33pv-vcgh-jfg9</url>
 </references>
 <dates>
 <discovery>2023-04-03</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="181f5e49-b71d-4527-9464-d4624d69acc3">
 <topic>py-treq -- sensitive information leak vulnerability</topic>
 <affects>
 <package>
 <name>py37-treq</name>
 <name>py38-treq</name>
 <name>py39-treq</name>
 <name>py310-treq</name>
 <name>py311-treq</name>
 <range><lt>22.1.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <blockquote cite="https://osv.dev/vulnerability/GHSA-fhpf-pp6p-55qc">
 Treq's request methods (`treq.get`, `treq.post`, `HTTPClient.request`, `HTTPClient.get`, etc.) accept cookies as a dictionary.
 Such cookies are not bound to a single domain, and are therefore sent to *every* domain ("supercookies").
 This can potentially cause sensitive information to leak upon an HTTP redirect to a different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the latter will receive the cookie `session`.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23607</cvename>
 <url>https://osv.dev/vulnerability/GHSA-fhpf-pp6p-55qc</url>
 </references>
 <dates>
 <discovery>2022-02-01</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="4eb5dccb-923c-4f18-9cd4-b53f9e28d4d7">
 <topic>py-Scrapy -- DoS vulnerability</topic>
 <affects>
 <package>
 <name>py37-Scrapy</name>
 <name>py38-Scrapy</name>
 <name>py39-Scrapy</name>
 <name>py310-Scrapy</name>
 <name>py311-Scrapy</name>
 <range><le>2.8.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 kmike and nramirezuy report:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2017-83">
 Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via large files because arbitrarily many files are read into memory, which is especially problematic if the files are then individually written in a separate thread to a slow storage resource, as demonstrated by interaction between dataReceived (in core/downloader/handlers/http11.py) and S3FilesStore.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-14158</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2017-83</url>
 <url>https://osv.dev/vulnerability/GHSA-h7wm-ph43-c39p</url>
 </references>
 <dates>
 <discovery>2017-09-05</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="67fe5e5b-549f-4a2a-9834-53f60eaa415e">
 <topic>py-Scrapy -- exposure of sensitive information vulnerability</topic>
 <affects>
 <package>
 <name>py37-Scrapy</name>
 <name>py38-Scrapy</name>
 <name>py39-Scrapy</name>
 <name>py310-Scrapy</name>
 <name>py311-Scrapy</name>
 <range><lt>2.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 ranjit-git reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2022-159">
 Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-0577</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2022-159</url>
 <url>https://osv.dev/vulnerability/GHSA-cjvr-mfj7-j4j8</url>
 </references>
 <dates>
 <discovery>2022-03-02</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="a5403af6-225e-48ba-b233-bd95ad26434a">
 <topic>py-Scrapy -- cookie injection vulnerability</topic>
 <affects>
 <package>
 <name>py37-Scrapy</name>
 <name>py38-Scrapy</name>
 <name>py39-Scrapy</name>
 <name>py310-Scrapy</name>
 <name>py311-Scrapy</name>
 <range><lt>1.8.2</lt></range>
 <range><ge>2.0.0</ge><lt>2.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <blockquote cite="https://osv.dev/vulnerability/GHSA-mfjm-vh54-3f96">
 Responses from domain names whose public domain name suffix contains 1 or more periods (e.g. responses from `example.co.uk`, given its public domain name suffix is `co.uk`) are able to set cookies that are included in requests to any other domain sharing the same domain name suffix.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://osv.dev/vulnerability/GHSA-mfjm-vh54-3f96</url>
 </references>
 <dates>
 <discovery>2022-03-01</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="2ad25820-c71a-4e6c-bb99-770c66fe496d">
 <topic>py-Scrapy -- credentials leak vulnerability</topic>
 <affects>
 <package>
 <name>py37-Scrapy</name>
 <name>py38-Scrapy</name>
 <name>py39-Scrapy</name>
 <name>py310-Scrapy</name>
 <name>py311-Scrapy</name>
 <range><lt>1.8.3</lt></range>
 <range><ge>2.0.0</ge><lt>2.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <blockquote cite="https://osv.dev/vulnerability/GHSA-9x8m-2xpf-crp3">
 When the built-in HTTP proxy downloader middleware processes a request with `proxy` metadata, and that `proxy` metadata includes proxy credentials, the built-in HTTP proxy downloader middleware sets the `Proxy-Authentication` header, but only if that header is not already set.
 There are third-party proxy-rotation downloader middlewares that set different `proxy` metadata every time they process a request.
 Because of request retries and redirects, the same request can be processed by downloader middlewares more than once, including both the built-in HTTP proxy downloader middleware and any third-party proxy-rotation downloader middleware.
 These third-party proxy-rotation downloader middlewares could change the `proxy` metadata of a request to a new value, but fail to remove the `Proxy-Authentication` header from the previous value of the `proxy` metadata, causing the credentials of one proxy to be leaked to a different proxy.
 If you rotate proxies from different proxy providers, and any of those proxies requires credentials, you are affected, unless you are handling proxy rotation as described under **Workarounds** below.
 If you use a third-party downloader middleware for proxy rotation, the same applies to that downloader middleware, and installing a patched version of Scrapy may not be enough;
 patching that downloader middlware may be necessary as well.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://osv.dev/vulnerability/GHSA-9x8m-2xpf-crp3</url>
 </references>
 <dates>
 <discovery>2022-07-29</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="e831dd5a-7d8e-4818-aa1f-17dd495584ec">
 <topic>py-httpx -- input validation vulnerability</topic>
 <affects>
 <package>
 <name>py37-httpx013</name>
 <name>py38-httpx013</name>
 <name>py39-httpx013</name>
 <name>py310-httpx013</name>
 <name>py311-httpx013</name>
 <range><lt>0.20.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 lebr0nli reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2022-183">
 Encode OSS httpx &lt;=1.0.0.beta0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41945</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2022-183</url>
 <url>https://osv.dev/vulnerability/GHSA-h8pj-cxx2-jfg2</url>
 </references>
 <dates>
 <discovery>2022-04-28</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="1e37fa3e-5988-4991-808f-eae98047e2af">
 <topic>py-httpie -- exposure of sensitive information vulnerabilities</topic>
 <affects>
 <package>
 <name>py37-httpie</name>
 <name>py38-httpie</name>
 <name>py39-httpie</name>
 <name>py310-httpie</name>
 <name>py311-httpie</name>
 <range><lt>3.1.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Glyph reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2022-34">
 HTTPie is a command-line HTTP client.
 HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage.
 Before 3.1.0, HTTPie didn't distinguish between cookies and hosts they belonged.
 This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website.
 Users are advised to upgrade.
 There are no known workarounds.
 </blockquote>
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2022-167">
 Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-24737</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2022-34</url>
 <url>https://osv.dev/vulnerability/GHSA-9w4w-cpc8-h2fq</url>
 <cvename>CVE-2022-0430</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2022-167</url>
 <url>https://osv.dev/vulnerability/GHSA-6pc9-xqrg-wfqw</url>
 </references>
 <dates>
 <discovery>2022-03-07</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="06492bd5-085a-4cc0-9743-e30164bdcb1c">
 <topic>py-flask-security -- user redirect to arbitrary URL vulnerability</topic>
 <affects>
 <package>
 <name>py37-flask-security</name>
 <name>py38-flask-security</name>
 <name>py39-flask-security</name>
 <name>py310-flask-security</name>
 <name>py311-flask-security</name>
 <range><le>3.0.0_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Snyk reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-cg8c-gc2j-2wf7">
 This affects all versions of package Flask-Security.
 When using the `get_post_logout_redirect` and `get_post_login_redirect` functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as `\\\evil.com/path`.
 This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using `'autocorrect_location_header=False`.
 **Note:** Flask-Security is not maintained anymore.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-23385</cvename>
 <url>https://osv.dev/vulnerability/GHSA-cg8c-gc2j-2wf7</url>
 </references>
 <dates>
 <discovery>2022-08-02</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="252f40cb-618c-47f4-a2cf-1abf30cffbbe">
 <topic>py-Flask-Cors -- directory traversal vulnerability</topic>
 <affects>
 <package>
 <name>py37-Flask-Cors</name>
 <name>py38-Flask-Cors</name>
 <name>py39-Flask-Cors</name>
 <name>py310-Flask-Cors</name>
 <name>py311-Flask-Cors</name>
 <range><lt>3.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 praetorian-colby-morgan reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2020-43">
 An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9.
 It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-25032</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2020-43</url>
 <url>https://osv.dev/vulnerability/GHSA-xc3p-ff3m-f46v</url>
 </references>
 <dates>
 <discovery>2020-08-31</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="692a5fd5-bb25-4df4-8a0e-eb91581f2531">
 <topic>py-flask-caching -- remote code execution or local privilege escalation vulnerabilities</topic>
 <affects>
 <package>
 <name>py37-flask-caching</name>
 <name>py38-flask-caching</name>
 <name>py39-flask-caching</name>
 <name>py310-flask-caching</name>
 <name>py311-flask-caching</name>
 <range><le>2.0.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 subnix reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-13">
 The Flask-Caching extension through 2.0.2 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation.
 If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-33026</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2021-13</url>
 <url>https://osv.dev/vulnerability/GHSA-656c-6cxf-hvcv</url>
 </references>
 <dates>
 <discovery>2021-05-13</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="c2c89dea-2859-4231-8f3b-012be0d475ff">
 <topic>py-django-photologue -- XSS vulnerability</topic>
 <affects>
 <package>
 <name>py37-django-photologue</name>
 <name>py38-django-photologue</name>
 <name>py39-django-photologue</name>
 <name>py310-django-photologue</name>
 <name>py311-django-photologue</name>
 <range><le>3.15_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 domiee13 reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-287q-jfcp-9vhv">
 A vulnerability was found in django-photologue up to 3.15.1 and classified as problematic.
 Affected by this issue is some unknown functionality of the file photologue/templates/photologue/photo_detail.html of the component Default Template Handler.
 The manipulation of the argument object.caption leads to cross site scripting.
 The attack may be launched remotely.
 Upgrading to version 3.16 is able to address this issue.
 The name of the patch is 960cb060ce5e2964e6d716ff787c72fc18a371e7.
 It is recommended to apply a patch to fix this issue.
 VDB-215906 is the identifier assigned to this vulnerability.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-4526</cvename>
 <url>https://osv.dev/vulnerability/GHSA-287q-jfcp-9vhv</url>
 </references>
 <dates>
 <discovery>2022-12-15</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="cdc685b5-1724-49a1-ad57-2eaab68e9cc0">
 <topic>py-pygments -- multiple DoS vulnerabilities</topic>
 <affects>
 <package>
 <name>py37-pygments</name>
 <name>py38-pygments</name>
 <name>py39-pygments</name>
 <name>py310-pygments</name>
 <name>py311-pygments</name>
 <range><lt>2.7.4</lt></range>
 </package>
 <package>
 <name>py37-pygments-25</name>
 <name>py38-pygments-25</name>
 <name>py39-pygments-25</name>
 <name>py310-pygments-25</name>
 <name>py311-pygments-25</name>
 <range><lt>2.7.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Red Hat reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-140">
 An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
 </blockquote>
 Ben Caller reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-141">
 In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions.
 Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS.
 By crafting malicious input, an attacker can cause a denial of service.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-20270</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2021-140</url>
 <url>https://osv.dev/vulnerability/GHSA-9w8r-397f-prfh</url>
 <cvename>CVE-2021-27291</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2021-141</url>
 <url>https://osv.dev/vulnerability/GHSA-pq64-v7f5-gqh8</url>
 </references>
 <dates>
 <discovery>2021-03-17</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="c9b3324f-8e03-4ae3-89ce-8098cdc5bfa9">
 <topic>py-markdown2 -- regular expression denial of service vulnerability</topic>
 <affects>
 <package>
 <name>py37-markdown2</name>
 <name>py38-markdown2</name>
 <name>py39-markdown2</name>
 <name>py310-markdown2</name>
 <name>py311-markdown2</name>
 <range><lt>2.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Ben Caller reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-20">
 markdown2 &gt;=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability.
 If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-26813</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2021-20</url>
 <url>https://osv.dev/vulnerability/GHSA-jr9p-r423-9m2r</url>
 </references>
 <dates>
 <discovery>2021-03-03</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="cf6f3465-e996-4672-9458-ce803f29fdb7">
 <topic>py-markdown2 -- XSS vulnerability</topic>
 <affects>
 <package>
 <name>py37-markdown2</name>
 <name>py38-markdown2</name>
 <name>py39-markdown2</name>
 <name>py310-markdown2</name>
 <name>py311-markdown2</name>
 <range><lt>2.3.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 TheGrandPew reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2020-65">
 python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds.
 For example, an attack might use elementname@ or elementname- with an onclick attribute.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-11888</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2020-65</url>
 <url>https://osv.dev/vulnerability/GHSA-fv3h-8x5j-pvgq</url>
 </references>
 <dates>
 <discovery>2020-04-20</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="83b29e3f-886f-439f-b9a8-72e014479ff9">
 <topic>py-dparse -- REDoS vulnerability</topic>
 <affects>
 <package>
 <name>py37-dparse</name>
 <name>py38-dparse</name>
 <name>py39-dparse</name>
 <name>py310-dparse</name>
 <name>py311-dparse</name>
 <range><lt>0.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 yeisonvargasf reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2022-301">
 dparse is a parser for Python dependency files.
 dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service.
 All the users parsing index server URLs with dparse are impacted by this vulnerability.
 Users unable to upgrade should avoid passing index server URLs in the source file to be parsed.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-39280</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2022-301</url>
 <url>https://osv.dev/vulnerability/GHSA-8fg9-p83m-x5pq</url>
 </references>
 <dates>
 <discovery>2022-10-06</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="9b0d9832-47c1-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- Network authentication attack via pam_krb5</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.2</ge><lt>13.2_2</lt></range>
	<range><ge>13.1</ge><lt>13.1_9</lt></range>
	<range><ge>12.4</ge><lt>12.4_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The problem detailed in FreeBSD-SA-23:04.pam_krb5 persisted following
	the patch for that advisory.
	<h1>Impact:</h1>
	The impact described in FreeBSD-SA-23:04.pam_krb5 persists.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3326</cvename>
 <freebsdsa>SA-23:09.pam_krb5</freebsdsa>
 </references>
 <dates>
 <discovery>2023-08-01</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="291d0953-47c1-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- Potential remote code execution via ssh-agent forwarding</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.2</ge><lt>13.2_2</lt></range>
	<range><ge>13.1</ge><lt>13.1_9</lt></range>
	<range><ge>12.4</ge><lt>12.4_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The server may cause ssh-agent to load shared libraries other than
	those required for PKCS#11 support. These shared libraries may have
	side effects that occur on load and unload (dlopen and dlclose).
	<h1>Impact:</h1>
	An attacker with access to a server that accepts a forwarded
	ssh-agent connection may be able to execute code on the machine running
	ssh-agent. Note that the attack relies on properties of operating
	system-provided libraries. This has been demonstrated on other
	operating systems; it is unknown whether this attack is possible using
	the libraries provided by a FreeBSD installation.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-38408</cvename>
 <freebsdsa>SA-23:08.ssh</freebsdsa>
 </references>
 <dates>
 <discovery>2023-08-01</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="ab437561-47c0-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- bhyve privileged guest escape via fwctl</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.2</ge><lt>13.2_2</lt></range>
	<range><ge>13.1</ge><lt>13.1_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The fwctl driver implements a state machine which is executed when
	the guest accesses certain x86 I/O ports. The interface lets the guest
	copy a string into a buffer resident in the bhyve process' memory. A
	bug in the state machine implementation can result in a buffer
	overflowing when copying this string.
	<h1>Impact:</h1>
	A malicious, privileged software running in a guest VM can exploit
	the buffer overflow to achieve code execution on the host in the bhyve
	userspace process, which typically runs as root. Note that bhyve runs
	in a Capsicum sandbox, so malicious code is constrained by the
	capabilities available to the bhyve process.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3494</cvename>
 <freebsdsa>SA-23:07.bhyve</freebsdsa>
 </references>
 <dates>
 <discovery>2023-08-01</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="3dabf5b8-47c0-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- Remote denial of service in IPv6 fragment reassembly</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.2</ge><lt>13.2_2</lt></range>
	<range><ge>13.1</ge><lt>13.1_9</lt></range>
	<range><ge>12.4</ge><lt>12.4_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Each fragment of an IPv6 packet contains a fragment header which
	specifies the offset of the fragment relative to the original packet,
	and each fragment specifies its length in the IPv6 header. When
	reassembling the packet, the kernel calculates the complete IPv6 payload
	length. The payload length must fit into a 16-bit field in the IPv6
	header.
	Due to a bug in the kernel, a set of carefully crafted packets can
	trigger an integer overflow in the calculation of the reassembled
	packet's payload length field.
	<h1>Impact:</h1>
	Once an IPv6 packet has been reassembled, the kernel continues
	processing its contents. It does so assuming that the fragmentation
	layer has validated all fields of the constructed IPv6 header. This bug
	violates such assumptions and can be exploited to trigger a remote
	kernel panic, resulting in a denial of service.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3107</cvename>
 <freebsdsa>SA-23:06.ipv6</freebsdsa>
 </references>
 <dates>
 <discovery>2023-08-01</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="e31a8f8e-47bf-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- ssh-add does not honor per-hop destination constraints</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.4</ge><lt>12.4_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When using ssh-add(1) to add smartcard keys to ssh-agent(1) with
	per-hop destination constraints, a logic error prevented the constraints
	from being sent to the agent resulting in keys being added to the agent
	without constraints.
	<h1>Impact:</h1>
	A malicious server could leverage the keys provided by a forwarded
	agent that would normally not be allowed due to the logic error.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28531</cvename>
 <freebsdsa>SA-23:05.openssh</freebsdsa>
 </references>
 <dates>
 <discovery>2023-06-21</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="41af0277-47bf-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- Network authentication attack via pam_krb5</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.2</ge><lt>13.2_1</lt></range>
	<range><ge>13.1</ge><lt>13.1_8</lt></range>
	<range><ge>12.4</ge><lt>12.4_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	pam_krb5 authenticates the user by essentially running kinit(1) with
	the password, getting a `ticket-granting ticket' (tgt) from the Kerberos
	KDC (Key Distribution Center) over the network, as a way to verify the
	password.
	Normally, the system running the pam_krb5 module will also have a
	keytab, a key provisioned by the KDC. The pam_krb5 module will use the
	tgt to get a service ticket and validate it against the keytab, ensuring
	the tgt is valid and therefore, the password is valid.
	However, if a keytab is not provisioned on the system, pam_krb5 has
	no way to validate the response from the KDC, and essentially trusts the
	tgt provided over the network as being valid.
	<h1>Impact:</h1>
	In a non-default FreeBSD installation that leverages pam_krb5 for
	authentication and does not have a keytab provisioned, an attacker that
	is able to control both the password and the KDC responses can return a
	valid tgt, allowing authentication to occur for any user on the
	system.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3326</cvename>
 <freebsdsa>SA-23:04.pam_krb5</freebsdsa>
 </references>
 <dates>
 <discovery>2023-06-21</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="c8eb4c40-47bd-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- Multiple vulnerabilities in OpenSSL</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.1</ge><lt>13.1_7</lt></range>
	<range><ge>12.4</ge><lt>12.4_2</lt></range>
	<range><ge>12.3</ge><lt>12.3_12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<h2>X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)</h2>
	There is a type confusion vulnerability relating to X.400 address processing
	inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
	the public structure definition for GENERAL_NAME incorrectly specified the type
	of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by
	the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an
	ASN1_STRING.
	<h2>Timing Oracle in RSA Decryption (CVE-2022-4304)</h2>
	A timing based side channel exists in the OpenSSL RSA Decryption
	implementation.
	<h2>Use-after-free following BIO_new_NDEF (CVE-2023-0215)</h2>
	The public API function BIO_new_NDEF is a helper function used for streaming
	ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support
	the SMIME, CMS and PKCS7 streaming capabilities, but may also be called
	directly by end user applications.
	The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter
	BIO onto the front of it to form a BIO chain, and then returns the new head
	of the BIO chain to the caller. Under certain conditions, for example if a
	CMS recipient public key is invalid, the new filter BIO is freed and the
	function returns a NULL result indicating a failure. However, in this case,
	the BIO chain is not properly cleaned up and the BIO passed by the caller
	still retains internal pointers to the previously freed filter BIO.
	<h2>Double free after calling PEM_read_bio_ex (CVE-2022-4450)</h2>
	The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
	decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload
	data. If the function succeeds then the "name_out", "header" and "data"
	arguments are populated with pointers to buffers containing the relevant
	decoded data. The caller is responsible for freeing those buffers. It is
	possible to construct a PEM file that results in 0 bytes of payload data. In
	this case PEM_read_bio_ex() will return a failure code but will populate the
	header argument with a pointer to a buffer that has already been freed.
	<h1>Impact:</h1>
	<h2>X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)</h2>
	When CRL checking is enabled (i.e. the application sets the
	X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass
	arbitrary pointers to a memcmp call, enabling them to read memory contents or
	enact a denial of service. In most cases, the attack requires the attacker to
	provide both the certificate chain and CRL, neither of which need to have a
	valid signature. If the attacker only controls one of these inputs, the other
	input must already contain an X.400 address as a CRL distribution point, which
	is uncommon. As such, this vulnerability is most likely to only affect
	applications which have implemented their own functionality for retrieving CRLs
	over a network.
	<h2>Timing Oracle in RSA Decryption (CVE-2022-4304)</h2>
	A timing based side channel exists in the OpenSSL RSA Decryption implementation
	which could be sufficient to recover a plaintext across a network in a
	Bleichenbacher style attack. To achieve a successful decryption an attacker
	would have to be able to send a very large number of trial messages for
	decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,
	RSA-OEAP and RSASVE.
	<h2>Use-after-free following BIO_new_NDEF (CVE-2023-0215)</h2>
	A use-after-free will occur under certain conditions. This will most likely
	result in a crash.
	<h2>Double free after calling PEM_read_bio_ex (CVE-2022-4450)</h2>
	A double free may occur. This will most likely lead to a crash. This could be
	exploited by an attacker who has the ability to supply malicious PEM files
	for parsing to achieve a denial of service attack.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0286</cvename>
 <cvename>CVE-2023-0215</cvename>
 <cvename>CVE-2022-4450</cvename>
 <cvename>CVE-2022-4304</cvename>
 <freebsdsa>SA-23:03.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2023-02-16</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="09b7cd39-47bd-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- OpenSSH pre-authentication double free</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.4</ge><lt>12.4_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A flaw in the backwards-compatibility key exchange route allows a
	pointer to be freed twice.
	<h1>Impact:</h1>
	A remote, unauthenticated attacker may be able to cause a denial of
	service, or possibly remote code execution.
	Note that FreeBSD 12.3 and FreeBSD 13.1 include older versions of
	OpenSSH, and are not affected. FreeBSD 13.2-BETA1 and later include the
	fix.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-25136</cvename>
 <freebsdsa>SA-23:02.openssh</freebsdsa>
 </references>
 <dates>
 <discovery>2023-02-16</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="3fcab88b-47bc-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- GELI silently omits the keyfile if read from stdin</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.1</ge><lt>13.1_6</lt></range>
	<range><ge>12.4</ge><lt>12.4_1</lt></range>
	<range><ge>12.3</ge><lt>12.3_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When GELI reads a key file from a standard input, it doesn't store it
	anywhere. If the user tries to initialize multiple providers at once,
	for the second and subsequent devices the standard input stream will be
	already empty. In this case, GELI silently uses a NULL key as the user
	key file. If the user used only a key file without a user passphrase,
	the master key was encrypted with an empty key file. This might not be
	noticed if the devices were also decrypted in a batch operation.
	<h1>Impact:</h1>
	Some GELI providers might be silently encrypted with a NULL key
	file.
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0751</cvename>
 <freebsdsa>SA-23:01.geli</freebsdsa>
 </references>
 <dates>
 <discovery>2023-02-08</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="a005aea9-47bb-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- Stack overflow in ping(8)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.1</ge><lt>13.1_5</lt></range>
	<range><ge>12.3</ge><lt>12.3_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	ping reads raw IP packets from the network to process responses in
	the pr_pack() function. As part of processing a response ping has to
	reconstruct the IP header, the ICMP header and if present a "quoted
	packet," which represents the packet that generated an ICMP error.
	The quoted packet again has an IP header and an ICMP header.
	The pr_pack() copies received IP and ICMP headers into stack buffers
	for further processing. In so doing, it fails to take into account the
	possible presence of IP option headers following the IP header in either
	the response or the quoted packet. When IP options are present,
	pr_pack() overflows the destination buffer by up to 40 bytes.
	<h1>Impact:</h1>
	The memory safety bugs described above can be triggered by a remote
	host, causing the ping program to crash.
	The ping process runs in a capability mode sandbox on all affected
	versions of FreeBSD and is thus very constrained in how it can interact
	with the rest of the system at the point where the bug can occur.
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23093</cvename>
 <freebsdsa>SA-22:15.ping</freebsdsa>
 </references>
 <dates>
 <discovery>2022-11-29</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="97c1b0f7-47b9-11ee-8e38-002590c1f29c">
 <topic>FreeBSD -- Multiple vulnerabilities in Heimdal</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.1</ge><lt>13.1_4</lt></range>
	<range><ge>12.3</ge><lt>12.3_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Multiple security vulnerabilities have been discovered in the Heimdal
	implementation of the Kerberos 5 network authentication
	protocols and KDC.
	<ul>
	 <li>CVE-2022-42898 PAC parse integer overflows</li>
	 <li>CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour</li>
	 <li>CVE-2021-44758 NULL dereference DoS in SPNEGO acceptors</li>
	 <li>CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec</li>
	 <li>CVE-2019-14870 Validate client attributes in protocol-transition</li>
	 <li>CVE-2019-14870 Apply forwardable policy in protocol-transition</li>
	 <li>CVE-2019-14870 Always lookup impersonate client in DB</li>
	</ul>
	<h1>Impact:</h1>
	A malicious actor with control of the network between a client and a
	service using Kerberos for authentication can impersonate either the
	client or the service, enabling a man-in-the-middle (MITM) attack
	circumventing mutual authentication.
	Note that, while CVE-2022-44640 is a severe vulnerability, possibly
	enabling remote code execution on other platforms, the version of
	Heimdal included with the FreeBSD base system cannot be exploited in
	this way on FreeBSD.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-14870</cvename>
 <cvename>CVE-2021-44758</cvename>
 <cvename>CVE-2022-3437</cvename>
 <cvename>CVE-2022-42898</cvename>
 <cvename>CVE-2022-44640</cvename>
 <freebsdsa>SA-22:14.heimdal</freebsdsa>
 </references>
 <dates>
 <discovery>2022-11-15</discovery>
 <entry>2023-08-31</entry>
 </dates>
 </vuln>

<vuln vid="22fffa69-46fa-11ee-8290-a8a1599412c6">
 <topic>chromium -- use after free in MediaStream</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>116.0.5845.140</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>116.0.5845.140</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_29.html">
	 This update includes 1 security fix:
	 <ul>
	 <li>[1472492] High CVE-2023-4572: Use after free in MediaStream. Reported by fwnfwn(@_fwnfwn) on 2023-08-12</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4472</cvename>
 <url>https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_29.html</url>
 </references>
 <dates>
 <discovery>2023-08-29</discovery>
 <entry>2023-08-30</entry>
 </dates>
 </vuln>

<vuln vid="36a37c92-44b1-11ee-b091-6162c1274384">
 <topic>gitea -- information disclosure</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.20.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/25097">
	 Fix API leaking Usermail if not logged in
	 The API should only return the real Mail of a User, if the
	 caller is logged in. The check do to this don't work. This PR
	 fixes this. This not really a security issue, but can lead to
	 Spam.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.com/release-of-1.20.3</url>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.20.3</url>
 </references>
 <dates>
 <discovery>2023-06-06</discovery>
 <entry>2023-08-27</entry>
 </dates>
 </vuln>

<vuln vid="5fa332b9-4269-11ee-8290-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>116.0.5845.110</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>116.0.5845.110</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/08/chrome-desktop-stable-update.html">
	 This update includes 5 security fixes:
	 <ul>
	 <li>[1469542] High CVE-2023-4430: Use after free in Vulkan. Reported by Cassidy Kim(@cassidy6564) on 2023-08-02</li>
	 <li>[1469754] High CVE-2023-4429: Use after free in Loader. Reported by Anonymous on 2023-08-03</li>
	 <li>[1470477] High CVE-2023-4428: Out of bounds memory access in CSS. Reported by Francisco Alonso (@revskills) on 2023-08-06</li>
	 <li>[1470668] High CVE-2023-4427: Out of bounds memory access in V8. Reported by Sergei Glazunov of Google Project Zero on 2023-08-07</li>
	 <li>[1469348] Medium CVE-2023-4431: Out of bounds memory access in Fonts. Reported by Microsoft Security Researcher on 2023-08-01</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4430</cvename>
 <cvename>CVE-2023-4429</cvename>
 <cvename>CVE-2023-4428</cvename>
 <cvename>CVE-2023-4427</cvename>
 <cvename>CVE-2023-4431</cvename>
 <url>https://chromereleases.googleblog.com/2023/08/chrome-desktop-stable-update.html</url>
 </references>
 <dates>
 <discovery>2023-08-22</discovery>
 <entry>2023-08-24</entry>
 </dates>
 </vuln>

<vuln vid="5999fc39-72d0-4b99-851c-ade7ff7125c3">
 <topic>electron25 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron25</name>
	<range><lt>25.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v25.7.0">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-4071.</li>
	 <li>Security: backported fix for CVE-2023-4070.</li>
	 <li>Security: backported fix for CVE-2023-4075.</li>
	 <li>Security: backported fix for CVE-2023-4076.</li>
	 <li>Security: backported fix for CVE-2023-4074.</li>
	 <li>Security: backported fix for CVE-2023-4072.</li>
	 <li>Security: backported fix for CVE-2023-4068.</li>
	 <li>Security: backported fix for CVE-2023-4073.</li>
	 <li>Security: backported fix for CVE-2023-4355.</li>
	 <li>Security: backported fix for CVE-2023-4354.</li>
	 <li>Security: backported fix for CVE-2023-4353.</li>
	 <li>Security: backported fix for CVE-2023-4351.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4071</cvename>
 <url>https://github.com/advisories/GHSA-qc3g-vp59-7vwh</url>
 <cvename>CVE-2023-4070</cvename>
 <url>https://github.com/advisories/GHSA-9xxv-mx64-rx27</url>
 <cvename>CVE-2023-4075</cvename>
 <url>https://github.com/advisories/GHSA-7332-j628-x48x</url>
 <cvename>CVE-2023-4076</cvename>
 <url>https://github.com/advisories/GHSA-7rfc-cwhj-x2qv</url>
 <cvename>CVE-2023-4074</cvename>
 <url>https://github.com/advisories/GHSA-6j3m-7hm6-qjrx</url>
 <cvename>CVE-2023-4072</cvename>
 <url>https://github.com/advisories/GHSA-9j4r-qr47-rcxp</url>
 <cvename>CVE-2023-4068</cvename>
 <url>https://github.com/advisories/GHSA-wh89-h5f7-hhcr</url>
 <cvename>CVE-2023-4073</cvename>
 <url>https://github.com/advisories/GHSA-g9wf-6ppg-937x</url>
 <cvename>CVE-2023-4355</cvename>
 <url>https://github.com/advisories/GHSA-xrw8-8992-37w4</url>
 <cvename>CVE-2023-4354</cvename>
 <url>https://github.com/advisories/GHSA-rq4v-7hxq-wpm5</url>
 <cvename>CVE-2023-4353</cvename>
 <url>https://github.com/advisories/GHSA-mjq9-8vf6-qh49</url>
 <cvename>CVE-2023-4351</cvename>
 <url>https://github.com/advisories/GHSA-mh2g-52mr-mr5v</url>
 </references>
 <dates>
 <discovery>2023-08-23</discovery>
 <entry>2023-08-24</entry>
 </dates>
 </vuln>

<vuln vid="99bc2966-55be-4411-825f-b04017a4c100">
 <topic>electron{22,24} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron22</name>
	<range><lt>22.3.22</lt></range>
 </package>
 <package>
	<name>electron24</name>
	<range><lt>24.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.22">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-4355.</li>
	 <li>Security: backported fix for CVE-2023-4354.</li>
	 <li>Security: backported fix for CVE-2023-4353.</li>
	 <li>Security: backported fix for CVE-2023-4352.</li>
	 <li>Security: backported fix for CVE-2023-4351.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4355</cvename>
 <url>https://github.com/advisories/GHSA-xrw8-8992-37w4</url>
 <cvename>CVE-2023-4354</cvename>
 <url>https://github.com/advisories/GHSA-rq4v-7hxq-wpm5</url>
 <cvename>CVE-2023-4353</cvename>
 <url>https://github.com/advisories/GHSA-mjq9-8vf6-qh49</url>
 <cvename>CVE-2023-4352</cvename>
 <url>https://github.com/advisories/GHSA-vp8r-986v-6qj4</url>
 <cvename>CVE-2023-4351</cvename>
 <url>https://github.com/advisories/GHSA-mh2g-52mr-mr5v</url>
 </references>
 <dates>
 <discovery>2023-08-23</discovery>
 <entry>2023-08-24</entry>
 </dates>
 </vuln>

<vuln vid="ddd3fcc9-2bdd-11ee-9af4-589cfc0f81b0">
 <topic>phpmyfaq -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyfaq-php80</name>
	<name>phpmyfaq-php81</name>
	<name>phpmyfaq-php82</name>
	<name>phpmyfaq-php83</name>
	<range><lt>3.1.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpmyfaq developers report:
	<blockquote cite="https://www.phpmyfaq.de/security/advisory-2023-07-16">
	 Cross Site Scripting vulnerability
	 CSV injection vulnerability
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://huntr.dev/bounties/e891dcbc-2092-49d3-9518-23e37187a5ea/</url>
 <url>https://huntr.dev/bounties/36149a42-cbd5-445e-a371-e351c899b189/</url>
 </references>
 <dates>
 <discovery>2023-07-16</discovery>
 <entry>2023-08-23</entry>
 </dates>
 </vuln>

<vuln vid="5666688f-803b-4cf0-9cb1-08c088f2225a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>116.0.5845.96</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>116.0.5845.96</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html">
	 This update includes 26 security fixes:
	 <ul>
	 <li>[1448548] High CVE-2023-2312: Use after free in Offline. Reported by avaue at S.S.L. on 2023-05-24</li>
	 <li>[1458303] High CVE-2023-4349: Use after free in Device Trust Connectors. Reported by Weipeng Jiang (@Krace) of VRI on 2023-06-27</li>
	 <li>[1454817] High CVE-2023-4350: Inappropriate implementation in Fullscreen. Reported by Khiem Tran (@duckhiem) on 2023-06-14</li>
	 <li>[1465833] High CVE-2023-4351: Use after free in Network. Reported by Guang and Weipeng Jiang of VRI on 2023-07-18</li>
	 <li>[1452076] High CVE-2023-4352: Type Confusion in V8. Reported by Sergei Glazunov of Google Project Zero on 2023-06-07</li>
	 <li>[1458046] High CVE-2023-4353: Heap buffer overflow in ANGLE. Reported by Christoph Diehl / Microsoft Vulnerability Research on 2023-06-27</li>
	 <li>[1464215] High CVE-2023-4354: Heap buffer overflow in Skia. Reported by Mark Brand of Google Project Zero on 2023-07-12</li>
	 <li>[1468943] High CVE-2023-4355: Out of bounds memory access in V8. Reported by Sergei Glazunov of Google Project Zero on 2023-07-31</li>
	 <li>[1449929] Medium CVE-2023-4356: Use after free in Audio. Reported by Zhenghang Xiao (@Kipreyyy) on 2023-05-30</li>
	 <li>[1458911] Medium CVE-2023-4357: Insufficient validation of untrusted input in XML. Reported by Igor Sak-Sakovskii on 2023-06-28</li>
	 <li>[1466415] Medium CVE-2023-4358: Use after free in DNS. Reported by Weipeng Jiang (@Krace) of VRI on 2023-07-20</li>
	 <li>[1443722] Medium CVE-2023-4359: Inappropriate implementation in App Launcher. Reported by @retsew0x01 on 2023-05-09</li>
	 <li>[1462723] Medium CVE-2023-4360: Inappropriate implementation in Color. Reported by Axel Chong on 2023-07-07</li>
	 <li>[1465230] Medium CVE-2023-4361: Inappropriate implementation in Autofill. Reported by Thomas Orlita on 2023-07-17</li>
	 <li>[1316379] Medium CVE-2023-4362: Heap buffer overflow in Mojom IDL. Reported by Zhao Hai of NanJing Cyberpeace TianYu Lab on 2022-04-14</li>
	 <li>[1367085] Medium CVE-2023-4363: Inappropriate implementation in WebShare. Reported by Alesandro Ortiz on 2022-09-23</li>
	 <li>[1406922] Medium CVE-2023-4364: Inappropriate implementation in Permission Prompts. Reported by Jasper Rebane on 2023-01-13</li>
	 <li>[1431043] Medium CVE-2023-4365: Inappropriate implementation in Fullscreen. Reported by Hafiizh on 2023-04-06</li>
	 <li>[1450784] Medium CVE-2023-4366: Use after free in Extensions. Reported by asnine on 2023-06-02</li>
	 <li>[1467743] Medium CVE-2023-4367: Insufficient policy enforcement in Extensions API. Reported by Axel Chong on 2023-07-26</li>
	 <li>[1467751] Medium CVE-2023-4368: Insufficient policy enforcement in Extensions API. Reported by Axel Chong on 2023-07-26</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2312</cvename>
 <cvename>CVE-2023-4349</cvename>
 <cvename>CVE-2023-4350</cvename>
 <cvename>CVE-2023-4351</cvename>
 <cvename>CVE-2023-4352</cvename>
 <cvename>CVE-2023-4353</cvename>
 <cvename>CVE-2023-4354</cvename>
 <cvename>CVE-2023-4355</cvename>
 <cvename>CVE-2023-4356</cvename>
 <cvename>CVE-2023-4357</cvename>
 <cvename>CVE-2023-4358</cvename>
 <cvename>CVE-2023-4359</cvename>
 <cvename>CVE-2023-4360</cvename>
 <cvename>CVE-2023-4361</cvename>
 <cvename>CVE-2023-4362</cvename>
 <cvename>CVE-2023-4363</cvename>
 <cvename>CVE-2023-4364</cvename>
 <cvename>CVE-2023-4365</cvename>
 <cvename>CVE-2023-4366</cvename>
 <cvename>CVE-2023-4367</cvename>
 <cvename>CVE-2023-4368</cvename>
 <url>https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html</url>
 </references>
 <dates>
 <discovery>2023-08-15</discovery>
 <entry>2023-08-17</entry>
 </dates>
 </vuln>

<vuln vid="759a5599-3ce8-11ee-a0d1-84a93843eb75">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql-connector-c++</name>
	<range><lt>8.0.33</lt></range>
 </package>
 <package>
	<name>mysql-client57</name>
	<range><lt>5.7.43</lt></range>
 </package>
 <package>
	<name>mysql-server57</name>
	<range><lt>5.7.43</lt></range>
 </package>
 <package>
	<name>mysql-client80</name>
	<range><lt>8.0.34</lt></range>
 </package>
 <package>
	<name>mysql-server80</name>
	<range><lt>8.0.34</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujul2023.html#AppendixMSQL">
	 This Critical Patch Update contains 24 new security patches for Oracle
	 MySQL. 11 of these vulnerabilities may be remotely exploitable without
	 authentication, i.e., may be exploited over a network without requiring
	 user credentials.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-4899</cvename>
 <cvename>CVE-2023-0361</cvename>
 <cvename>CVE-2022-4899</cvename>
 <cvename>CVE-2022-4899</cvename>
 <cvename>CVE-2023-22053</cvename>
 <cvename>CVE-2023-22008</cvename>
 <cvename>CVE-2023-22046</cvename>
 <cvename>CVE-2023-22054</cvename>
 <cvename>CVE-2023-22056</cvename>
 <cvename>CVE-2023-21950</cvename>
 <cvename>CVE-2023-22007</cvename>
 <cvename>CVE-2023-22057</cvename>
 <cvename>CVE-2023-22033</cvename>
 <cvename>CVE-2023-22058</cvename>
 <cvename>CVE-2023-22005</cvename>
 <cvename>CVE-2023-22048</cvename>
 <cvename>CVE-2023-22038</cvename>
 <url>https://www.oracle.com/security-alerts/cpujul2023.html#AppendixMSQL</url>
 </references>
 <dates>
 <discovery>2023-07-18</discovery>
 <entry>2023-08-17</entry>
 </dates>
 </vuln>

<vuln vid="8e561cfe-3c59-11ee-b32e-080027f5fec9">
 <topic>clamav -- Possible denial of service vulnerability in the AutoIt file parser</topic>
 <affects>
 <package>
	<name>clamav-lts</name>
	<range><lt>1.0.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The ClamAV project reports:
	<blockquote cite="https://blog.clamav.net/2023/07/2023-08-16-releases.html">
	 
	 There is a possible denial of service vulnerability in the
	 AutoIt file parser.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-20212</cvename>
 <url>https://blog.clamav.net/2023/07/2023-08-16-releases.html</url>
 </references>
 <dates>
 <discovery>2023-08-15</discovery>
 <entry>2023-08-16</entry>
 </dates>
 </vuln>

<vuln vid="51a59f36-3c58-11ee-b32e-080027f5fec9">
 <topic>clamav -- Possible denial of service vulnerability in the HFS+ file parser</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>1.1.1,1</lt></range>
 </package>
 <package>
	<name>clamav-lts</name>
	<range><lt>1.0.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Steve Smith reports:
	<blockquote cite="https://blog.clamav.net/2023/07/2023-08-16-releases.html">
	 
	 There is a possible denial of service vulnerability in the
	 HFS+ file parser.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-20197</cvename>
 <url>https://blog.clamav.net/2023/07/2023-08-16-releases.html</url>
 </references>
 <dates>
 <discovery>2023-08-15</discovery>
 <entry>2023-08-16</entry>
 </dates>
 </vuln>

<vuln vid="a6986f0f-3ac0-11ee-9a88-206a8a720317">
 <topic>krb5 -- Double-free in KDC TGS processing</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><gt>1.20</gt><lt>1.21.1_1</lt></range>
 </package>
 <package>
	<name>krb5-121</name>
	<range><lt>1.21.1_1</lt></range>
 </package>
 <package>
	<name>krb5-devel</name>
	<range><gt>1.20</gt><lt>1.22.2023.08.07</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MIT krb5 Team reports:
	<blockquote cite="https://github.com/krb5/krb5/commit/88a1701b423c13991a8064feeb26952d3641d840">
	 When issuing a ticket for a TGS renew or validate request, copy
	 only the server field from the outer part of the header ticket
	 to the new ticket. Copying the whole structure causes the
	 enc_part pointer to be aliased to the header ticket until
	 krb5_encrypt_tkt_part() is called, resulting in a double-free
	 if handle_authdata() fails..
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-39975</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39975</url>
 </references>
 <dates>
 <discovery>2023-08-07</discovery>
 <entry>2023-08-14</entry>
 </dates>
 </vuln>

<vuln vid="b1ac663f-3aa9-11ee-b887-b42e991fc52e">
 <topic>typo3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>typo3-11-php80</name>
	<name>typo3-11-php81</name>
	<range><lt>11.5.30</lt></range>
 </package>
 <package>
	<name>typo3-12-php80</name>
	<name>typo3-12-php81</name>
	<range><lt>12.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	TYPO3 reports:
	<blockquote cite="https://typo3.org/article/typo3-1211-11520-and-10433-security-releases-published">
	 TYPO3-CORE-SA-2023-002: By-passing Cross-Site Scripting Protection in HTML Sanitizer
	 TYPO3-CORE-SA-2023-003: Information Disclosure due to Out-of-scope Site Resolution
	 TYPO3-CORE-SA-2023-004: Cross-Site Scripting in CKEditor4 WordCount Plugin
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-38500</cvename>
 <cvename>CVE-2023-38499</cvename>
 <cvename>CVE-2023-37905</cvename>
 <url>https://typo3.org/article/typo3-1244-and-11530-security-releases-published</url>
 </references>
 <dates>
 <discovery>2023-07-25</discovery>
 <entry>2023-08-14</entry>
 </dates>
 </vuln>

<vuln vid="59a43a73-3786-11ee-94b4-6cc21735f730">
 <topic>postgresql-server -- MERGE fails to enforce UPDATE or SELECT row security policies</topic>
 <affects>
 <package>
	<name>postgresql-server</name>
	<range><lt>15.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL Project reports
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-39418/">
	 
	 PostgreSQL 15 introduced the MERGE command, which fails to test
	 new rows against row security policies defined for UPDATE and
	 SELECT. If UPDATE and SELECT policies forbid some row that
	 INSERT policies do not forbid, a user could store such rows.
	 Subsequent consequences are application-dependent. This
	 affects only databases that have used CREATE POLICY to define
	 a row security policy.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-39418</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2023-39418/</url>
 </references>
 <dates>
 <discovery>2023-08-10</discovery>
 <entry>2023-08-10</entry>
 </dates>
 </vuln>

<vuln vid="cfd2a634-3785-11ee-94b4-6cc21735f730">
 <topic>postgresql-server -- Extension script @substitutions@ within quoting allow SQL injection</topic>
 <affects>
 <package>
	<name>postgresql-server</name>
	<range><lt>11.21</lt></range>
	<range><lt>12.16</lt></range>
	<range><lt>13.12</lt></range>
	<range><lt>14.9</lt></range>
	<range><lt>15.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL Project reports
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-39417/">
	 
	 An extension script is vulnerable if it uses @extowner@,
	 @extschema@, or @extschema:...@ inside a quoting construct
	 (dollar quoting, '', or ""). No bundled extension is
	 vulnerable. Vulnerable uses do appear in a documentation
	 example and in non-bundled extensions. Hence, the attack
	 prerequisite is an administrator having installed files of a
	 vulnerable, trusted, non-bundled extension. Subject to that
	 prerequisite, this enables an attacker having database-level
	 CREATE privilege to execute arbitrary code as the bootstrap
	 superuser. PostgreSQL will block this attack in the core
	 server, so there's no need to modify individual extensions.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-39417</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2023-39417/</url>
 </references>
 <dates>
 <discovery>2023-08-10</discovery>
 <entry>2023-08-10</entry>
 </dates>
 </vuln>

<vuln vid="f3a35fb8-2d70-47c9-a516-6aad7eb222b1">
 <topic>electron{22,23,24,25} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron22</name>
	<range><lt>22.3.20</lt></range>
 </package>
 <package>
	<name>electron23</name>
	<range><lt>23.3.12</lt></range>
 </package>
 <package>
	<name>electron24</name>
	<range><lt>24.7.0</lt></range>
 </package>
 <package>
	<name>electron25</name>
	<range><lt>25.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v23.3.12">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-3732.</li>
	 <li>Security: backported fix for CVE-2023-3728.</li>
	 <li>Security: backported fix for CVE-2023-3730.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3732</cvename>
 <url>https://github.com/advisories/GHSA-6f46-9vvr-v3j5</url>
 <cvename>CVE-2023-3728</cvename>
 <url>https://github.com/advisories/GHSA-fxgf-5cm8-2f8q</url>
 <cvename>CVE-2023-3730</cvename>
 <url>https://github.com/advisories/GHSA-2gmm-4f9j-mw4p</url>
 </references>
 <dates>
 <discovery>2023-08-02</discovery>
 <entry>2023-08-07</entry>
 <modified>2023-08-11</modified>
 </dates>
 </vuln>

<vuln vid="441e1e1a-27a5-11ee-a156-080027f5fec9">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba416</name>
	<range><lt>4.16.11</lt></range>
 </package>
 <package>
	<name>samba413</name>
	<range><lt>4.13.17_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="https://www.samba.org/samba/latest_news.html#4.18.5">
	 <dl>
	 <dt>CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion DoS Vulnerability</dt>
	 <dd>
	 When parsing Spotlight mdssvc RPC packets, one encoded
	 data structure is a key-value style dictionary where
	 keys are character strings and values can be any of
	 the supported types in the mdssvc protocol. Due to a
	 lack of type checking in callers of the function
	 dalloc_value_for_key(), which returns the object
	 associated with a key, a caller may trigger a crash in
	 talloc_get_size() when talloc detects that the passed in
	 pointer is not a valid talloc pointer. As RPC worker
	 processes are shared among multiple client connections,
	 a malicious client can crash the worker process
	 affecting all other clients that are also served by this
	 worker.
	 </dd>
	 <dt>CVE-2022-2127: Out-Of-Bounds read in winbind AUTH_CRAP</dt>
	 <dd>
	 When doing NTLM authentication, the client sends replies
	 to cryptographic challenges back to the server. These
	 replies have variable length. Winbind did not properly
	 bounds-check the lan manager response length, which
	 despite the lan manager version no longer being used is
	 still part of the protocol. If the system is running
	 Samba's ntlm_auth as authentication backend for services
	 like Squid (or a very unusual configuration with
	 FreeRADIUS), the vulnarebility is remotely exploitable.
	 If not so configured, or to exploit this vulnerability
	 locally, the user must have access to the privileged
	 winbindd UNIX domain socket (a subdirectory with name
	 'winbindd_privileged' under "state directory", as set in
	 the smb.conf). This access is normally only given so
	 special system services like Squid or FreeRADIUS, use
	 this feature.
	 </dd>
	 <dt>CVE-2023-34968: Spotlight server-side Share Path Disclosure</dt>
	 <dd>
	 As part of the Spotlight protocol, the initial request
	 returns a path associated with the sharename targeted by
	 the RPC request. Samba returns the real server-side
	 share path at this point, as well as returning the
	 absolute server-side path of results in search queries
	 by clients. Known server side paths could be used to
	 mount subsequent more serious security attacks or could
	 disclose confidential information that is part of the
	 path. To mitigate the issue, Samba will replace the
	 real server-side path with a fake path constructed from
	 the sharename.
	 </dd>
	 <dt>CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop DoS Vulnerability</dt>
	 <dd>
	 When parsing Spotlight mdssvc RPC packets sent by the
	 client, the core unmarshalling function sl_unpack_loop()
	 did not validate a field in the network packet that
	 contains the count of elements in an array-like
	 structure. By passing 0 as the count value, the attacked
	 function will run in an endless loop consuming 100% CPU.
	 This bug only affects servers where Spotlight is
	 explicitly enabled globally or on individual shares with
	 "spotlight = yes".
	 </dd>
	 <dt>CVE-2023-3347: SMB2 packet signing not enforced</dt>
	 <dd>
	 SMB2 packet signing is not enforced if an admin
	 configured "server signing = required" or for SMB2
	 connections to Domain Controllers where SMB2 packet
	 signing is mandatory. SMB2 packet signing is a
	 mechanism that ensures the integrity and authenticity of
	 data exchanged between a client and a server using the
	 SMB2 protocol. It provides protection against certain
	 types of attacks, such as man-in-the-middle attacks,
	 where an attacker intercepts network traffic and
	 modifies the SMB2 messages. Both client and server of
	 an SMB2 connection can require that signing is being
	 used. The server-side setting in Samba to configure
	 signing to be required is "server signing = required".
	 Note that on an Samba AD DCs this is also the default
	 for all SMB2 connections. Unless the client requires
	 signing which would result in signing being used on the
	 SMB2 connection, sensitive data might have been modified
	 by an attacker. Clients connecting to IPC$ on an AD DC
	 will require signed connections being used, so the
	 integrity of these connections was not affected.
	 </dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-34967</cvename>
 <cvename>CVE-2022-2127</cvename>
 <cvename>CVE-2023-34968</cvename>
 <cvename>CVE-2023-34966</cvename>
 <cvename>CVE-2023-3347</cvename>
 <url>https://www.samba.org/samba/security/CVE-2023-34967.html</url>
 <url>https://www.samba.org/samba/security/CVE-2022-2127.html</url>
 <url>https://www.samba.org/samba/security/CVE-2023-34968.html</url>
 <url>https://www.samba.org/samba/security/CVE-2023-34966.html</url>
 <url>https://www.samba.org/samba/security/CVE-2023-3347.html</url>
 </references>
 <dates>
 <discovery>2023-07-19</discovery>
 <entry>2023-08-05</entry>
 </dates>
 </vuln>

<vuln vid="6e4e8e87-9fb8-4e32-9f8e-9b4303f4bfd5">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>115.0.5790.170</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>115.0.5790.170</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html">
	 This update includes 17 security fixes:
	 <ul>
	 <li>[1466183] High CVE-2023-4068: Type Confusion in V8. Reported by Jerry on 2023-07-20</li>
	 <li>[1465326] High CVE-2023-4069: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2023-07-17</li>
	 <li>[1462951] High CVE-2023-4070: Type Confusion in V8. Reported by Jerry on 2023-07-07</li>
	 <li>[1458819] High CVE-2023-4071: Heap buffer overflow in Visuals. Reported by Guang and Weipeng Jiang of VRI on 2023-06-28</li>
	 <li>[1464038] High CVE-2023-4072: Out of bounds read and write in WebGL. Reported by Apple Security Engineering and Architecture (SEAR) on 2023-07-12</li>
	 <li>[1456243] High CVE-2023-4073: Out of bounds memory access in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2023-06-20</li>
	 <li>[1464113] High CVE-2023-4074: Use after free in Blink Task Scheduling. Reported by Anonymous on 2023-07-12</li>
	 <li>[1457757] High CVE-2023-4075: Use after free in Cast. Reported by Cassidy Kim(@cassidy6564) on 2023-06-25</li>
	 <li>[1459124] High CVE-2023-4076: Use after free in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2023-06-29</li>
	 <li>[1451146] Medium CVE-2023-4077: Insufficient data validation in Extensions. Reported by Anonymous on 2023-06-04</li>
	 <li>[1461895] Medium CVE-2023-4078: Inappropriate implementation in Extensions. Reported by Anonymous on 2023-07-04</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-4068</cvename>
 <cvename>CVE-2023-4069</cvename>
 <cvename>CVE-2023-4070</cvename>
 <cvename>CVE-2023-4071</cvename>
 <cvename>CVE-2023-4072</cvename>
 <cvename>CVE-2023-4073</cvename>
 <cvename>CVE-2023-4074</cvename>
 <cvename>CVE-2023-4075</cvename>
 <cvename>CVE-2023-4076</cvename>
 <cvename>CVE-2023-4077</cvename>
 <cvename>CVE-2023-4078</cvename>
 <url>https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2023-08-02</discovery>
 <entry>2023-08-04</entry>
 </dates>
 </vuln>

<vuln vid="78f2e491-312d-11ee-85f2-bd89b893fcb4">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go119</name>
	<range><lt>1.19.12</lt></range>
 </package>
 <package>
	<name>go120</name>
	<range><lt>1.20.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://groups.google.com/u/1/g/golang-announce/c/X0b6CsSAaYI">
	 crypto/tls: restrict RSA keys in certificates to &lt;= 8192 bits
	 Extremely large RSA keys in certificate chains can cause
	 a client/server to expend significant CPU time verifying
	 signatures. Limit this by restricting the size of RSA keys
	 transmitted during handshakes to &lt;= 8192 bits. 
	</blockquote>
	<blockquote cite="https://go.dev/issue/60374">
	 net/http: insufficient sanitization of Host header
	 The HTTP/1 client did not fully validate the contents of
	 the Host header. A maliciously crafted Host header could
	 inject additional headers or entire requests. The HTTP/1
	 client now refuses to send requests containing an
	 invalid Request.Host or Request.URL.Host value.
	</blockquote>
	<blockquote cite="https://go.dev/issue/60167">
	 cmd/go: cgo code injection
	 The go command may generate unexpected code at build
	 time when using cgo. This may result in unexpected
	 behavior when running a go program which uses cgo.
	</blockquote>
	<blockquote cite="https://go.dev/issue/60272">
	 runtime: unexpected behavior of setuid/setgid binaries
	 The Go runtime didn't act any differently when a binary
	 had the setuid/setgid bit set. On Unix platforms, if a
	 setuid/setgid binary was executed with standard I/O file
	 descriptors closed, opening any files could result in
	 unexpected content being read/written with elevated
	 prilieges. Similarly if a setuid/setgid program was
	 terminated, either via panic or signal, it could leak the
	 contents of its registers.
	</blockquote>
	<blockquote cite="https://go.dev/issue/60305">
	 cmd/go: improper sanitization of LDFLAGS
	 The go command may execute arbitrary code at build time
	 when using cgo. This may occur when running "go get" on a
	 malicious module, or when running any other command which
	 builds untrusted code. This is can by triggered by linker
	 flags, specified via a "#cgo LDFLAGS" directive.
	</blockquote>
	<blockquote cite="https://go.dev/issue/59720">
	 html/template: improper sanitization of CSS values
	 
	 Angle brackets (&lt;&gt;) were not considered dangerous
	 characters when inserted into CSS contexts. Templates
	 containing multiple actions separated by a '/' character
	 could result in unexpectedly closing the CSS context and
	 allowing for injection of unexpected HMTL, if executed
	 with untrusted input.
	</blockquote>
	<blockquote cite="https://go.dev/issue/59721">
	 html/template: improper handling of JavaScript whitespace
	 
	 Not all valid JavaScript whitespace characters were
	 considered to be whitespace. Templates containing
	 whitespace characters outside of the character set
	 "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that
	 also contain actions may not be properly sanitized
	 during execution.
	</blockquote>
	<blockquote cite="https://go.dev/issue/59722">
	 html/template: improper handling of empty HTML attributes
	 
	 Templates containing actions in unquoted HTML attributes
	 (e.g. "attr={{.}}") executed with empty input could
	 result in output that would have unexpected results when
	 parsed due to HTML normalization rules. This may allow
	 injection of arbitrary attributes into tags.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-29406</cvename>
 <cvename>CVE-2023-29402</cvename>
 <cvename>CVE-2023-29403</cvename>
 <cvename>CVE-2023-29404</cvename>
 <cvename>CVE-2023-24539</cvename>
 <cvename>CVE-2023-24540</cvename>
 <cvename>CVE-2023-29400</cvename>
 <url>https://groups.google.com/u/1/g/golang-announce/c/X0b6CsSAaYI</url>
 <url>https://groups.google.com/u/1/g/golang-announce/c/2q13H6LEEx0</url>
 <url>https://groups.google.com/u/1/g/golang-announce/c/q5135a9d924</url>
 <url>https://groups.google.com/u/1/g/golang-announce/c/MEb0UyuSMsU</url>
 </references>
 <dates>
 <discovery>2023-04-27</discovery>
 <entry>2023-08-02</entry>
 </dates>
 </vuln>

<vuln vid="fa239535-30f6-11ee-aef9-001b217b3468">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.2.0</ge><lt>16.2.2</lt></range>
	<range><ge>16.1.0</ge><lt>16.1.3</lt></range>
	<range><ge>9.3.0</ge><lt>16.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/08/01/security-release-gitlab-16-2-2-released/">
	 ReDoS via ProjectReferenceFilter in any Markdown fields
	 ReDoS via AutolinkFilter in any Markdown fields
	 Regex DoS in Harbor Registry search
	 Arbitrary read of files owned by the "git" user via malicious tar.gz file upload using GitLab export functionality
	 Stored XSS in Web IDE Beta via crafted URL
	 securityPolicyProjectAssign mutation does not authorize security policy project ID
	 An attacker can run pipeline jobs as arbitrary user
	 Possible Pages Unique Domain Overwrite
	 Access tokens may have been logged when a query was made to an endpoint
	 Reflected XSS via PlantUML diagram
	 The main branch of a repository with a specially designed name may allow an attacker to create repositories with malicious code
	 Invalid 'start_sha' value on merge requests page may lead to Denial of Service
	 Developers can create pipeline schedules on protected branches even if they don't have access to merge
	 Potential DOS due to lack of pagination while loading license data
	 Leaking emails of newly created users
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3994</cvename>
 <cvename>CVE-2023-3364</cvename>
 <cvename>CVE-2023-0632</cvename>
 <cvename>CVE-2023-3385</cvename>
 <cvename>CVE-2023-2164</cvename>
 <cvename>CVE-2023-4002</cvename>
 <cvename>CVE-2023-4008</cvename>
 <cvename>CVE-2023-3993</cvename>
 <cvename>CVE-2023-3500</cvename>
 <cvename>CVE-2023-3401</cvename>
 <cvename>CVE-2023-3900</cvename>
 <cvename>CVE-2023-2022</cvename>
 <cvename>CVE-2023-4011</cvename>
 <cvename>CVE-2023-1210</cvename>
 <url>https://about.gitlab.com/releases/2023/08/01/security-release-gitlab-16-2-2-released/</url>
 </references>
 <dates>
 <discovery>2023-08-01</discovery>
 <entry>2023-08-02</entry>
 </dates>
 </vuln>

<vuln vid="bad6588e-2fe0-11ee-a0d1-84a93843eb75">
 <topic>OpenSSL -- Excessive time spent checking DH q parameter value</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.1.1u_1,1</lt></range>
 </package>
 <package>
	<name>openssl30</name>
	<range><lt>3.0.9_2</lt></range>
 </package>
 <package>
	<name>openssl31</name>
	<range><lt>3.1.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20230731.txt">
	 Checking excessively long DH keys or parameters may be very slow
	 (severity: Low).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3817</cvename>
 <url>https://www.openssl.org/news/secadv/20230731.txt</url>
 </references>
 <dates>
 <discovery>2023-07-31</discovery>
 <entry>2023-07-31</entry>
 </dates>
 </vuln>

<vuln vid="a0321b74-031d-485c-bb76-edd75256a6f0">
 <topic>jenkins -- Stored XSS vulnerability</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.416</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.401.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2023-07-26/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-3188 / CVE-2023-39151</h5>
	 Stored XSS vulnerability
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-39151</cvename>
 <url>https://www.jenkins.io/security/advisory/2023-07-26/</url>
 </references>
 <dates>
 <discovery>2023-07-26</discovery>
 <entry>2023-07-26</entry>
 </dates>
 </vuln>

<vuln vid="ab0bab3c-2927-11ee-8608-07b8d3947721">
 <topic>gitea -- Disallow dangerous URL schemes</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.20.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/25960">
	 Disallow javascript, vbscript and data (data uri images still
	 work) url schemes even if all other schemes are allowed
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.com/release-of-1.20.1</url>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.20.1</url>
 </references>
 <dates>
 <discovery>2023-06-18</discovery>
 <entry>2023-07-23</entry>
 </dates>
 </vuln>

<vuln vid="887eb570-27d3-11ee-adba-c80aa9043978">
 <topic>OpenSSH -- remote code execution via a forwarded agent socket</topic>
 <affects>
 <package>
	<name>openssh-portable</name>
	<name>openssh-portable-hpn</name>
	<name>openssh-portable-gssapi</name>
	<range><lt>9.3.p2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSH project reports:
	<blockquote cite="https://www.openssh.com/txt/release-9.3p2">
	 Fix CVE-2023-38408 - a condition where specific libaries loaded via
	 ssh-agent(1)'s PKCS#11 support could be abused to achieve remote
	 code execution via a forwarded agent socket if the following
	 conditions are met:

* Exploitation requires the presence of specific libraries on
      the victim system.
	    * Remote exploitation requires that the agent was forwarded
      to an attacker-controlled system.

Exploitation can also be prevented by starting ssh-agent(1) with an
	    empty PKCS#11/FIDO allowlist (ssh-agent -P '') or by configuring
	    an allowlist that contains only specific provider libraries.

This vulnerability was discovered and demonstrated to be exploitable
	 by the Qualys Security Advisory team.
	
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-38408</cvename>
 <url>https://www.openssh.com/txt/release-9.3p2</url>
 </references>
 <dates>
 <discovery>2023-07-19</discovery>
 <entry>2023-07-21</entry>
 </dates>
 </vuln>

<vuln vid="2f22927f-26ea-11ee-8290-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>115.0.5790.98</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>115.0.5790.98</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html">
	 This update includes 20 security fixes:
	 <ul>
	 <li>[1454086] High CVE-2023-3727: Use after free in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2023-06-12</li>
	 <li>[1457421] High CVE-2023-3728: Use after free in WebRTC. Reported by Zhenghang Xiao (@Kipreyyy) on 2023-06-23</li>
	 <li>[1453465] High CVE-2023-3730: Use after free in Tab Groups. Reported by @ginggilBesel on 2023-06-09</li>
	 <li>[1450899] High CVE-2023-3732: Out of bounds memory access in Mojo. Reported by Mark Brand of Google Project Zero on 2023-06-02</li>
	 <li>[1450203] Medium CVE-2023-3733: Inappropriate implementation in WebApp Installs. Reported by Ahmed ElMasry on 2023-05-31</li>
	 <li>[1450376] Medium CVE-2023-3734: Inappropriate implementation in Picture In Picture. Reported by Thomas Orlita on 2023-06-01</li>
	 <li>[1394410] Medium CVE-2023-3735: Inappropriate implementation in Web API Permission Prompts. Reported by Ahmed ElMasry on 2022-11-29</li>
	 <li>[1434438] Medium CVE-2023-3736: Inappropriate implementation in Custom Tabs. Reported by Philipp Beer (TU Wien) on 2023-04-19</li>
	 <li>[1446754] Medium CVE-2023-3737: Inappropriate implementation in Notifications. Reported by Narendra Bhati of Suma Soft Pvt. Ltd. Pune (India) on 2023-05-19</li>
	 <li>[1434330] Medium CVE-2023-3738: Inappropriate implementation in Autofill. Reported by Hafiizh on 2023-04-18</li>
	 <li>[1405223] Low CVE-2023-3740: Insufficient validation of untrusted input in Themes. Reported by Fardeen Siddiqui on 2023-01-06</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3727</cvename>
 <cvename>CVE-2023-3728</cvename>
 <cvename>CVE-2023-3730</cvename>
 <cvename>CVE-2023-3732</cvename>
 <cvename>CVE-2023-3733</cvename>
 <cvename>CVE-2023-3734</cvename>
 <cvename>CVE-2023-3735</cvename>
 <cvename>CVE-2023-3736</cvename>
 <cvename>CVE-2023-3737</cvename>
 <cvename>CVE-2023-3738</cvename>
 <cvename>CVE-2023-3740</cvename>
 <url>https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2023-07-19</discovery>
 <entry>2023-07-20</entry>
 </dates>
 </vuln>

<vuln vid="f32b1fbd-264d-11ee-a468-80fa5b29d485">
 <topic>virtualbox-ose -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>virtualbox-ose</name>
	<range><lt>6.1.46</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	secalert_us@oracle.com reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujul2023.html">
	 Vulnerability in the Oracle VM VirtualBox product of Oracle
	Virtualization (component: Core). Supported versions that are
	affected are Prior to 6.1.46 and Prior to 7.0.10. Easily exploitable
	vulnerability allows high privileged attacker with logon to the
	infrastructure where Oracle VM VirtualBox executes to compromise
	Oracle VM VirtualBox. Successful attacks require human interaction
	from a person other than the attacker. Successful attacks of this
	vulnerability can result in unauthorized ability to cause a hang
	or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.
	CVSS 3.1 Base Score 4.2 (Availability impacts). CVSS Vector:
	(CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-22016</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-22016</url>
 </references>
 <dates>
 <discovery>2023-07-18</discovery>
 <entry>2023-07-19</entry>
 </dates>
 </vuln>

<vuln vid="cf40e8b7-264d-11ee-a468-80fa5b29d485">
 <topic>virtualbox-ose -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>virtualbox-ose</name>
	<range><lt>6.1.46</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	secalert_us@oracle.com reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujul2023.html">
	 Vulnerability in the Oracle VM VirtualBox product of Oracle
	Virtualization (component: Core). Supported versions that are
	affected are Prior to 6.1.46 and Prior to 7.0.10. Easily exploitable
	vulnerability allows low privileged attacker with logon to the
	infrastructure where Oracle VM VirtualBox executes to compromise
	Oracle VM VirtualBox. Successful attacks of this vulnerability can
	result in unauthorized ability to cause a hang or frequently
	repeatable crash (complete DOS) of Oracle VM VirtualBox. Note:
	This vulnerability applies to Windows VMs only. CVSS 3.1 Base Score
	5.5 (Availability impacts). CVSS Vector:
	(CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-22017</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-22017</url>
 </references>
 <dates>
 <discovery>2023-07-18</discovery>
 <entry>2023-07-19</entry>
 </dates>
 </vuln>

<vuln vid="bc90e894-264b-11ee-a468-80fa5b29d485">
 <topic>virtualbox-ose -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>virtualbox-ose</name>
	<range><lt>6.1.46</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	secalert_us@oracle.com reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujul2023.html">
	 Vulnerability in the Oracle VM VirtualBox product of Oracle
	Virtualization (component: Core). Supported versions that are
	affected are Prior to 6.1.46 and Prior to 7.0.10. Difficult to
	exploit vulnerability allows unauthenticated attacker with network
	access via RDP to compromise Oracle VM VirtualBox. Successful
	attacks of this vulnerability can result in takeover of Oracle VM
	VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity
	and Availability impacts). CVSS Vector:
	(CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-22018</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-22018</url>
 </references>
 <dates>
 <discovery>2023-07-18</discovery>
 <entry>2023-07-19</entry>
 </dates>
 </vuln>

<vuln vid="c70c3dc3-258c-11ee-b37b-901b0e9408dc">
 <topic>element-web -- Cross site scripting in Export Chat feature</topic>
 <affects>
 <package>
	<name>element-web</name>
	<range><lt>1.11.36</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix Developers reports:
	<blockquote cite="https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-c9vx-2g7w-rp65">
	 The Export Chat feature includes certain attacker-controlled elements in the
	 generated document without sufficient escaping, leading to stored XSS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-37259</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-37259</url>
 </references>
 <dates>
 <discovery>2023-07-18</discovery>
 <entry>2023-07-18</entry>
 </dates>
 </vuln>

<vuln vid="b3f77aae-241c-11ee-9684-c11c23f7b0f9">
 <topic>gitea -- multiple issues</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.20.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/22759">
	 Test if container blob is accessible before mounting.
	</blockquote>
	<blockquote cite="https://github.com/go-gitea/gitea/pull/22175">
	 Set type="password" on all auth_token fields
	 Seen when migrating from other hosting platforms.
	 Prevents exposing the token to screen capture/cameras/eyeballs.
	 Prevents the browser from saving the value in its autocomplete
	 dictionary, which often is not secure.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.com/release-of-1.20.0</url>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.20.0</url>
 </references>
 <dates>
 <discovery>2023-06-08</discovery>
 <entry>2023-07-05</entry>
 </dates>
 </vuln>

<vuln vid="41c60e16-2405-11ee-a0d1-84a93843eb75">
 <topic>OpenSSL -- AES-SIV implementation ignores empty associated data entries</topic>
 <affects>
 <package>
	<name>openssl30</name>
	<range><lt>3.0.9_1</lt></range>
 </package>
 <package>
	<name>openssl31</name>
	<range><lt>3.1.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20230714.txt">
	 The AES-SIV cipher implementation contains a bug that causes
	 it to ignore empty associated data entries which are unauthenticated as
	 a consequence.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2975</cvename>
 <url>https://www.openssl.org/news/secadv/20230714.txt</url>
 </references>
 <dates>
 <discovery>2023-07-14</discovery>
 <entry>2023-07-16</entry>
 </dates>
 </vuln>

<vuln vid="3446e45d-a51b-486f-9b0e-e4402d91fed6">
 <topic>electron22 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron22</name>
	<range><lt>22.3.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.17">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-3422.</li>
	 <li>Security: backported fix for CVE-2023-3421.</li>
	 <li>Security: backported fix for CVE-2023-3420.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3422</cvename>
 <url>https://github.com/advisories/GHSA-gqjh-f545-vcx3</url>
 <cvename>CVE-2023-3421</cvename>
 <url>https://github.com/advisories/GHSA-943x-93ff-jr62</url>
 <cvename>CVE-2023-3420</cvename>
 <url>https://github.com/advisories/GHSA-4297-fx5c-x987</url>
 </references>
 <dates>
 <discovery>2023-07-12</discovery>
 <entry>2023-07-14</entry>
 </dates>
 </vuln>

<vuln vid="b67d768c-1f53-11ee-82ed-4ccc6adda413">
 <topic>librecad -- out-of-bounds read in importshp plugin</topic>
 <affects>
 <package>
	<name>librecad</name>
	<range><lt>2.2.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Albin Eldstål-Ahrens reports:
	<blockquote cite="https://github.com/LibreCAD/LibreCAD/issues/1481">
	 An out-of-bounds read on a heap buffer in the importshp plugin may
 allow an attacker to read sensitive data via a crafted DBF file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-30259</cvename>
 <url>https://github.com/LibreCAD/LibreCAD/issues/1481</url>
 </references>
 <dates>
 <discovery>2021-12-28</discovery>
 <entry>2023-07-10</entry>
 </dates>
 </vuln>

<vuln vid="6fae2d6c-1f38-11ee-a475-080027f5fec9">
 <topic>redis -- heap overflow in COMMAND GETKEYS and ACL evaluation</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><lt>7.0.12</lt></range>
 </package>
 <package>
	<name>redis-devel</name>
	<range><lt>7.0.12.20230710</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redis core team reports:
	<blockquote cite="https://groups.google.com/g/redis-db/c/JDjKS0GubsQ">
	 
	 Extracting key names from a command and a list of
	 arguments may, in some cases, trigger a heap overflow and
	 result in reading random heap memory, heap corruption and
	 potentially remote code execution. Specifically: using
	 COMMAND GETKEYS* and validation of key names in ACL rules.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-36824</cvename>
 <url>https://groups.google.com/g/redis-db/c/JDjKS0GubsQ</url>
 <url>https://github.com/redis/redis/security/advisories/GHSA-4cfx-h9gq-xpx3</url>
 </references>
 <dates>
 <discovery>2023-07-10</discovery>
 <entry>2023-07-10</entry>
 </dates>
 </vuln>

<vuln vid="0e254b4a-1f37-11ee-a475-080027f5fec9">
 <topic>redis -- Heap overflow in the cjson and cmsgpack libraries</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><lt>7.0.12</lt></range>
 </package>
 <package>
	<name>redis-devel</name>
	<range><lt>7.0.12.20230710</lt></range>
 </package>
 <package>
	<name>redis62</name>
	<range><lt>6.2.13</lt></range>
 </package>
 <package>
	<name>redis60</name>
	<range><lt>6.0.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redis core team reports:
	<blockquote cite="https://groups.google.com/g/redis-db/c/JDjKS0GubsQ">
	 
	 A specially crafted Lua script executing in Redis can
	 trigger a heap overflow in the cjson and cmsgpack
	 libraries, and result in heap corruption and potentially
	 remote code execution.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-24834</cvename>
 <url>https://groups.google.com/g/redis-db/c/JDjKS0GubsQ</url>
 </references>
 <dates>
 <discovery>2023-07-10</discovery>
 <entry>2023-07-10</entry>
 </dates>
 </vuln>

<vuln vid="8ea24413-1b15-11ee-9331-570525adb7f1">
 <topic>gitea -- avoid open HTTP redirects</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.19.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/25143">
	 If redirect_to parameter has set value starting with
	 \\example.com redirect will be created with header Location:
	 /\\example.com that will redirect to example.com domain.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.io/2023/07/gitea-1.19.4-is-released/</url>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.19.4</url>
 </references>
 <dates>
 <discovery>2023-06-08</discovery>
 <entry>2023-07-05</entry>
 </dates>
 </vuln>

<vuln vid="d1681df3-421e-4a63-95b4-a3d6e29d395d">
 <topic>electron{23,24} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron23</name>
	<range><lt>23.3.10</lt></range>
 </package>
 <package>
	<name>electron24</name>
	<range><lt>24.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v23.3.10">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-3422.</li>
	 <li>Security: backported fix for CVE-2023-3421.</li>
	 <li>Security: backported fix for CVE-2023-3420.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3422</cvename>
 <url>https://github.com/advisories/GHSA-gqjh-f545-vcx3</url>
 <cvename>CVE-2023-3421</cvename>
 <url>https://github.com/advisories/GHSA-943x-93ff-jr62</url>
 <cvename>CVE-2023-3420</cvename>
 <url>https://github.com/advisories/GHSA-4297-fx5c-x987</url>
 </references>
 <dates>
 <discovery>2023-07-05</discovery>
 <entry>2023-07-06</entry>
 </dates>
 </vuln>

<vuln vid="d8972bcd-1b64-11ee-9cd6-001b217b3468">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.1.0</ge><lt>16.1.2</lt></range>
	<range><ge>16.0.0</ge><lt>16.0.7</lt></range>
	<range><ge>15.11.0</ge><lt>15.11.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/07/05/security-release-gitlab-16-1-2-released/">
	 A user can change the name and path of some public GitLab groups
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3484</cvename>
 <url>https://about.gitlab.com/releases/2023/07/05/security-release-gitlab-16-1-2-released/</url>
 </references>
 <dates>
 <discovery>2023-07-05</discovery>
 <entry>2023-07-05</entry>
 </dates>
 </vuln>

<vuln vid="01eeea33-1afa-11ee-8a9b-b42e991fc52e">
 <topic>phpldapadmin -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>phpldapadmin-php80</name>
	<name>phpldapadmin-php81</name>
	<range><lt>1.2.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://bugs.launchpad.net/ubuntu/+source/phpldapadmin/+bug/1906474">
	 An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2
	that allows users to store malicious values that may be executed
	by other users at a later time via get_request in lib/function.php.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-35132</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-35132</url>
 </references>
 <dates>
 <discovery>2020-12-11</discovery>
 <entry>2023-07-05</entry>
 </dates>
 </vuln>

<vuln vid="4ee7fa77-19a6-11ee-8a05-080027eda32c">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py38-django32</name>
	<name>py39-django32</name>
	<name>py310-django32</name>
	<name>py311-django32</name>
	<range><lt>3.2.20</lt></range>
 </package>
 <package>
	<name>py38-django41</name>
	<name>py39-django41</name>
	<name>py310-django41</name>
	<name>py311-django41</name>
	<range><lt>4.1.10</lt></range>
 </package>
 <package>
	<name>py38-django42</name>
	<name>py39-django42</name>
	<name>py310-django42</name>
	<name>py311-django42</name>
	<range><lt>4.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2023/jul/03/security-releases/">
	 CVE-2023-36053: Potential regular expression denial of service
	 vulnerability in EmailValidator/URLValidator.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-36053</cvename>
 <url>https://www.djangoproject.com/weblog/2023/jul/03/security-releases/</url>
 </references>
 <dates>
 <discovery>2023-07-01</discovery>
 <entry>2023-07-03</entry>
 </dates>
 </vuln>

<vuln vid="95dad123-180e-11ee-86ba-080027eda32c">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki135</name>
	<range><lt>1.35.11</lt></range>
 </package>
 <package>
	<name>mediawiki138</name>
	<range><lt>1.38.7</lt></range>
 </package>
 <package>
	<name>mediawiki139</name>
	<range><lt>1.39.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawiki reports:
	<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/HVT3U3XYY35PSCIQPHMY4VQNF3Q6MHUO/">
	 (T335203, CVE-2023-29197) Upgrade guzzlehttp/psr7 to &gt;= 1.9.1/2.4.5.
	 (T335612, CVE-2023-36674) Manualthumb bypasses badFile lookup.
	 (T332889, CVE-2023-36675) XSS in BlockLogFormatter due to unsafe message
	 use.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-29197</cvename>
 <cvename>CVE-2023-36674</cvename>
 <cvename>CVE-2023-36675</cvename>
 <url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/HVT3U3XYY35PSCIQPHMY4VQNF3Q6MHUO/</url>
 </references>
 <dates>
 <discovery>2023-04-21</discovery>
 <entry>2023-07-01</entry>
 </dates>
 </vuln>

<vuln vid="3117e6cd-1772-11ee-9cd6-001b217b3468">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.1.0</ge><lt>16.1.1</lt></range>
	<range><ge>16.0.0</ge><lt>16.0.6</lt></range>
	<range><ge>15.11.0</ge><lt>15.11.10</lt></range>
	<range><ge>7.14.0</ge><lt>15.10.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/06/29/security-release-gitlab-16-1-1-released/">
	 ReDoS via EpicReferenceFilter in any Markdown fields
	 New commits to private projects visible in forks created while project was public
	 New commits to private projects visible in forks created while project was public
	 Maintainer can leak masked webhook secrets by manipulating URL masking
	 Information disclosure of project import errors
	 Sensitive information disclosure via value stream analytics controller
	 Bypassing Code Owners branch protection rule in GitLab
	 HTML injection in email address
	 Webhook token leaked in Sidekiq logs if log format is 'default'
	 Private email address of service desk issue creator disclosed via issues API
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3424</cvename>
 <cvename>CVE-2023-2190</cvename>
 <cvename>CVE-2023-3444</cvename>
 <cvename>CVE-2023-2620</cvename>
 <cvename>CVE-2023-3362</cvename>
 <cvename>CVE-2023-3102</cvename>
 <cvename>CVE-2023-2576</cvename>
 <cvename>CVE-2023-2200</cvename>
 <cvename>CVE-2023-3363</cvename>
 <cvename>CVE-2023-1936</cvename>
 <url>https://about.gitlab.com/releases/2023/06/29/security-release-gitlab-16-1-1-released/</url>
 </references>
 <dates>
 <discovery>2023-06-29</discovery>
 <entry>2023-06-30</entry>
 </dates>
 </vuln>

<vuln vid="d821956f-1753-11ee-ad66-1c61b4739ac9">
 <topic>SoftEtherVPN -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>softether</name>
	<range><lt>4.42.9798</lt></range>
 </package>
 <package>
	<name>softether-devel</name>
	<range><lt>4.42.9798</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Daiyuu Nobori reports:
	<blockquote cite="https://www.softether.org/9-about/News/904-SEVPN202301">
	 The SoftEther VPN project received a high level code review and technical assistance from Cisco Systems, Inc. of the United States from April to June 2023 to fix several vulnerabilities in the SoftEther VPN code.
	 The risk of exploitation of any of the fixed vulnerabilities is low under normal usage and environment, and actual attacks are very difficult. However, SoftEther VPN is now an open source VPN software used by 7.4 million unique users worldwide, and is used daily by many users to defend against the risk of blocking attacks by national censorship firewalls and attempts to eavesdrop on communications. Therefore, as long as the slightest attack possibility exists, there is great value in preventing vulnerabilities as much as possible in anticipation of the most sophisticated cyber attackers in the world, such as malicious ISPs and man-in-the-middle attackers on national Internet communication channels. These fixes are important and useful patches for users who use SoftEther VPN and the Internet for secure communications to prevent advanced attacks that can theoretically be triggered by malicious ISPs and man-in-the-middle attackers on national Internet communication pathways.
	 The fixed vulnerabilities are CVE-2023-27395, CVE-2023-22325, CVE-2023-32275, CVE-2023-27516, CVE-2023-32634, and CVE-2023-31192. All of these were discovered in an outstanding code review of SoftEther VPN by Cisco Systems, Inc.
	 <ol>
	 <li>CVE-2023-27395: Heap overflow in SoftEther VPN DDNS client functionality at risk of crashing and theoretically arbitrary code execution caused by a malicious man-in-the-middle attacker such like ISP-level or on national Internet communication channels</li>
	 <li>CVE-2023-22325: Integer overflow in the SoftEther VPN DDNS client functionality could result in crashing caused by a malicious man-in-the-middle attacker such like ISP-level or on national Internet communication channels</li>
	 <li>CVE-2023-32275: Vulnerability that allows the administrator himself of a 32-bit version of VPN Client or VPN Server to see the 32-bit value heap address of each of trusted CA's certificates in the VPN process</li>
	 <li>CVE-2023-27516: If the user forget to set the administrator password of SoftEther VPN Client and enable remote administration with blank password, the administrator password of VPN Client can be changed remotely or VPN client can be used remotely by anonymouse third person</li>
	 <li>CVE-2023-32634: If an attacker succeeds in launching a TCP relay program on the same port as the VPN Client on a local computer running the SoftEther VPN Client before the VPN Client process is launched, the TCP relay program can conduct a man-in-the-middle attack on communication between the administrator and the VPN Client process</li>
	 <li>CVE-2023-31192: When SoftEther VPN Client connects to an untrusted VPN Server, an invalid redirection response for the clustering (load balancing) feature causes 20 bytes of uninitialized stack space to be read</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-27395</cvename>
 <cvename>CVE-2023-22325</cvename>
 <cvename>CVE-2023-32275</cvename>
 <cvename>CVE-2023-27516</cvename>
 <cvename>CVE-2023-32634</cvename>
 <cvename>CVE-2023-31192</cvename>
 <url>https://www.softether.org/9-about/News/904-SEVPN202301</url>
 </references>
 <dates>
 <discovery>2023-06-30</discovery>
 <entry>2023-06-30</entry>
 </dates>
 </vuln>

<vuln vid="06428d91-152e-11ee-8b14-dbdd62da85fb">
 <topic>OpenEXR -- heap buffer overflow in internal_huf_decompress</topic>
 <affects>
 <package>
	<name>openexr</name>
	<range><lt>3.1.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	oss-fuzz reports:
	<blockquote cite="https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59382">
	 heap buffer overflow in internal_huf_decompress.
	</blockquote>
	Cary Phillips reports:
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.1.9">
	 v3.1.9 - Patch release that addresses [...] also OSS-fuzz 59382 Heap-buffer-overflow in internal_huf_decompress
	</blockquote>
	Kimball Thurston reports:
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/pull/1439">
	 Fix scenario where malformed dwa file could read past end of buffer - fixes OSS-Fuzz 59382
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59382</url>
 <url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.1.9</url>
 <url>https://github.com/AcademySoftwareFoundation/openexr/commit/e431f7e189d0785bb84a5bfb83391e9e58590c49</url>
 <url>https://github.com/AcademySoftwareFoundation/openexr/pull/1439</url>
 </references>
 <dates>
 <discovery>2023-05-28</discovery>
 <entry>2023-06-27</entry>
 </dates>
 </vuln>

<vuln vid="ad05a737-14bd-11ee-8290-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>114.0.5735.198</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>114.0.5735.198</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html">
	 This update includes 4 security fixes:
	 <ul>
	 <li>[1452137] High CVE-2023-3420: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2023-06-07</li>
	 <li>[1447568] High CVE-2023-3421: Use after free in Media. Reported by Piotr Bania of Cisco Talos on 2023-05-22</li>
	 <li>[1450397] High CVE-2023-3422: Use after free in Guest View. Reported by asnine on 2023-06-01</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3420</cvename>
 <cvename>CVE-2023-3421</cvename>
 <cvename>CVE-2023-3422</cvename>
 <url>https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html</url>
 </references>
 <dates>
 <discovery>2023-06-26</discovery>
 <entry>2023-06-27</entry>
 </dates>
 </vuln>

<vuln vid="fdbe9aec-118b-11ee-908a-6c3be5272acd">
 <topic>Grafana -- Account takeover / authentication bypass</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>6.7.0</ge><lt>8.5.27</lt></range>
	<range><ge>9.0.0</ge><lt>9.2.20</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.16</lt></range>
	<range><ge>9.4.0</ge><lt>9.4.13</lt></range>
	<range><ge>9.5.0</ge><lt>9.5.5</lt></range>
	<range><ge>10.0.0</ge><lt>10.0.1</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><lt>8.5.27</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><lt>9.2.20</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.16</lt></range>
	<range><ge>9.4.0</ge><lt>9.4.13</lt></range>
	<range><ge>9.5.0</ge><lt>9.5.5</lt></range>
 </package>
 <package>
	<name>grafana10</name>
	<range><lt>10.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2023/06/22/grafana-security-release-for-cve-2023-3128/">
	 Grafana validates Azure Active Directory accounts based on the email claim.
	 On Azure AD, the profile email field is not unique across Azure AD tenants.
	 This can enable a Grafana account takeover and authentication bypass when
	 Azure AD OAuth is configured with a multi-tenant Azure AD OAuth application.
	 
	 The CVSS score for this vulnerability is 9.4 Critical.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3128</cvename>
 <url>https://grafana.com/security/security-advisories/cve-2023-3128</url>
 </references>
 <dates>
 <discovery>2023-06-22</discovery>
 <entry>2023-06-23</entry>
 </dates>
 </vuln>

<vuln vid="a03b2d9e-b3f2-428c-8f66-21092ed2ba94">
 <topic>electron{23,24} -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron23</name>
	<range><lt>23.3.8</lt></range>
 </package>
 <package>
	<name>electron24</name>
	<range><lt>24.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v23.3.8">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-3215.</li>
	 <li>Security: backported fix for CVE-2023-3216.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3215</cvename>
 <url>https://github.com/advisories/GHSA-5rw6-vf4w-p4j3</url>
 <cvename>CVE-2023-3216</cvename>
 <url>https://github.com/advisories/GHSA-f35r-mcw4-gg3w</url>
 </references>
 <dates>
 <discovery>2023-06-22</discovery>
 <entry>2023-06-22</entry>
 </dates>
 </vuln>

<vuln vid="770d88cc-f6dc-4385-bdfe-497f8080c3fb">
 <topic>electron22 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron22</name>
	<range><lt>22.3.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.14">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-3215.</li>
	 <li>Security: backported fix for CVE-2023-3216.</li>
	 <li>Security: backported fix for CVE-2023-0698.</li>
	 <li>Security: backported fix for CVE-2023-0932.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3215</cvename>
 <url>https://github.com/advisories/GHSA-5rw6-vf4w-p4j3</url>
 <cvename>CVE-2023-3216</cvename>
 <url>https://github.com/advisories/GHSA-f35r-mcw4-gg3w</url>
 <cvename>CVE-2023-0698</cvename>
 <url>https://github.com/advisories/GHSA-q6xx-4pmr-m3m4</url>
 <cvename>CVE-2023-0932</cvename>
 <url>https://github.com/advisories/GHSA-hh2g-39pc-2575</url>
 </references>
 <dates>
 <discovery>2023-06-22</discovery>
 <entry>2023-06-22</entry>
 </dates>
 </vuln>

<vuln vid="734b8f46-773d-4fef-bed3-61114fe8e4c5">
 <topic>libX11 -- Sub-object overflows</topic>
 <affects>
 <package>
	<name>libX11</name>
	<range><lt>1.8.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The X.Org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2023-June/003406.html">
	 <ul>
	 <li>Buffer overflows in InitExt.c in libX11 prior to 1.8.6 [CVE-2023-3138]

The functions in src/InitExt.c in libX11 prior to 1.8.6 do not check
	 that the values provided for the Request, Event, or Error IDs are
	 within the bounds of the arrays that those functions write to, using
	 those IDs as array indexes. Instead they trusted that they were called
	 with values provided by an Xserver that was adhering to the bounds
	 specified in the X11 protocol, as all X servers provided by X.Org do.

As the protocol only specifies a single byte for these values, an
	 out-of-bounds value provided by a malicious server (or a malicious
	 proxy-in-the-middle) can only overwrite other portions of the Display
	 structure and not write outside the bounds of the Display structure
	 itself. Testing has found it is possible to at least cause the client
	 to crash with this memory corruption.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.x.org/archives/xorg-announce/2023-June/003406.html</url>
 <cvename>CVE-2023-3138</cvename>
 </references>
 <dates>
 <discovery>2023-06-15</discovery>
 <entry>2023-06-16</entry>
 </dates>
 </vuln>

<vuln vid="aae2ab45-2d21-4cd5-a53b-07ec933400ac">
 <topic>electron24 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron24</name>
	<range><lt>24.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v24.5.1">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-3079.</li>
	 <li>Security: backported fix for CVE-2023-2933.</li>
	 <li>Security: backported fix for CVE-2023-2932.</li>
	 <li>Security: backported fix for CVE-2023-2931.</li>
	 <li>Security: backported fix for CVE-2023-2936.</li>
	 <li>Security: backported fix for CVE-2023-2935.</li>
	 <li>Security: backported fix for CVE-2023-2934.</li>
	 <li>Security: backported fix for CVE-2023-2930.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3079</cvename>
 <url>https://github.com/advisories/GHSA-8mwf-hvfp-6xfg</url>
 <cvename>CVE-2023-2933</cvename>
 <url>https://github.com/advisories/GHSA-qrc7-3p69-2jpf</url>
 <cvename>CVE-2023-2932</cvename>
 <url>https://github.com/advisories/GHSA-7g49-wq8x-r6rh</url>
 <cvename>CVE-2023-2931</cvename>
 <url>https://github.com/advisories/GHSA-w3xh-m877-x3c2</url>
 <cvename>CVE-2023-2936</cvename>
 <url>https://github.com/advisories/GHSA-x723-3x32-qg44</url>
 <cvename>CVE-2023-2935</cvename>
 <url>https://github.com/advisories/GHSA-5ccq-3h49-vjp2</url>
 <cvename>CVE-2023-2934</cvename>
 <url>https://github.com/advisories/GHSA-mqff-qm67-cr66</url>
 <cvename>CVE-2023-2930</cvename>
 <url>https://github.com/advisories/GHSA-44xq-533g-gj79</url>
 </references>
 <dates>
 <discovery>2023-06-14</discovery>
 <entry>2023-06-16</entry>
 </dates>
 </vuln>

<vuln vid="3bf6795c-d44c-4033-9b37-ed2e30f34fca">
 <topic>electron23 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron23</name>
	<range><lt>23.3.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v23.3.7">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-2724.</li>
	 <li>Security: backported fix for CVE-2023-2725.</li>
	 <li>Security: backported fix for CVE-2023-2721.</li>
	 <li>Security: backported fix for CVE-2023-3079.</li>
	 <li>Security: backported fix for CVE-2023-2933.</li>
	 <li>Security: backported fix for CVE-2023-2932.</li>
	 <li>Security: backported fix for CVE-2023-2931.</li>
	 <li>Security: backported fix for CVE-2023-2936.</li>
	 <li>Security: backported fix for CVE-2023-2935.</li>
	 <li>Security: backported fix for CVE-2023-2934.</li>
	 <li>Security: backported fix for CVE-2023-2930.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2724</cvename>
 <url>https://github.com/advisories/GHSA-j5rv-3m5p-q6rc</url>
 <cvename>CVE-2023-2725</cvename>
 <url>https://github.com/advisories/GHSA-c4fp-wmv9-q4cr</url>
 <cvename>CVE-2023-2721</cvename>
 <url>https://github.com/advisories/GHSA-5cww-gpqh-ggqj</url>
 <cvename>CVE-2023-3079</cvename>
 <url>https://github.com/advisories/GHSA-8mwf-hvfp-6xfg</url>
 <cvename>CVE-2023-2933</cvename>
 <url>https://github.com/advisories/GHSA-qrc7-3p69-2jpf</url>
 <cvename>CVE-2023-2932</cvename>
 <url>https://github.com/advisories/GHSA-7g49-wq8x-r6rh</url>
 <cvename>CVE-2023-2931</cvename>
 <url>https://github.com/advisories/GHSA-w3xh-m877-x3c2</url>
 <cvename>CVE-2023-2936</cvename>
 <url>https://github.com/advisories/GHSA-x723-3x32-qg44</url>
 <cvename>CVE-2023-2935</cvename>
 <url>https://github.com/advisories/GHSA-5ccq-3h49-vjp2</url>
 <cvename>CVE-2023-2934</cvename>
 <url>https://github.com/advisories/GHSA-mqff-qm67-cr66</url>
 <cvename>CVE-2023-2930</cvename>
 <url>https://github.com/advisories/GHSA-44xq-533g-gj79</url>
 </references>
 <dates>
 <discovery>2023-06-14</discovery>
 <entry>2023-06-16</entry>
 </dates>
 </vuln>

<vuln vid="3c3d3dcb-bef7-4d20-9580-b4216b5ff6a2">
 <topic>electron22 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>electron22</name>
	<range><lt>22.3.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.13">
	 This update fixes the following vulnerabilities:
	 <ul>
	 <li>Security: backported fix for CVE-2023-2724.</li>
	 <li>Security: backported fix for CVE-2023-2723.</li>
	 <li>Security: backported fix for CVE-2023-2725.</li>
	 <li>Security: backported fix for CVE-2023-2721.</li>
	 <li>Security: backported fix for CVE-2023-3079.</li>
	 <li>Security: backported fix for CVE-2023-2933.</li>
	 <li>Security: backported fix for CVE-2023-2932.</li>
	 <li>Security: backported fix for CVE-2023-2931.</li>
	 <li>Security: backported fix for CVE-2023-2936.</li>
	 <li>Security: backported fix for CVE-2023-2935.</li>
	 <li>Security: backported fix for CVE-2023-2930.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2724</cvename>
 <url>https://github.com/advisories/GHSA-j5rv-3m5p-q6rc</url>
 <cvename>CVE-2023-2723</cvename>
 <url>https://github.com/advisories/GHSA-7797-6fvm-v8xw</url>
 <cvename>CVE-2023-2725</cvename>
 <url>https://github.com/advisories/GHSA-c4fp-wmv9-q4cr</url>
 <cvename>CVE-2023-2721</cvename>
 <url>https://github.com/advisories/GHSA-5cww-gpqh-ggqj</url>
 <cvename>CVE-2023-3079</cvename>
 <url>https://github.com/advisories/GHSA-8mwf-hvfp-6xfg</url>
 <cvename>CVE-2023-2933</cvename>
 <url>https://github.com/advisories/GHSA-qrc7-3p69-2jpf</url>
 <cvename>CVE-2023-2932</cvename>
 <url>https://github.com/advisories/GHSA-7g49-wq8x-r6rh</url>
 <cvename>CVE-2023-2931</cvename>
 <url>https://github.com/advisories/GHSA-w3xh-m877-x3c2</url>
 <cvename>CVE-2023-2936</cvename>
 <url>https://github.com/advisories/GHSA-x723-3x32-qg44</url>
 <cvename>CVE-2023-2935</cvename>
 <url>https://github.com/advisories/GHSA-5ccq-3h49-vjp2</url>
 <cvename>CVE-2023-2930</cvename>
 <url>https://github.com/advisories/GHSA-44xq-533g-gj79</url>
 </references>
 <dates>
 <discovery>2023-06-14</discovery>
 <entry>2023-06-16</entry>
 </dates>
 </vuln>

<vuln vid="b4db7d78-bb62-4f4c-9326-6e9fc2ddd400">
 <topic>jenkins -- CSRF protection bypass vulnerability</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.400</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.401.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2023-06-14/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-3135 / CVE-2023-35141</h5>
	 CSRF protection bypass vulnerability
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-35141</cvename>
 <url>https://www.jenkins.io/security/advisory/2023-06-14/</url>
 </references>
 <dates>
 <discovery>2023-06-14</discovery>
 <entry>2023-06-14</entry>
 </dates>
 </vuln>

<vuln vid="f0250129-fdb8-41ed-aa9e-661ff5026845">
 <topic>vscode -- VS Code Information Disclosure Vulnerability</topic>
 <affects>
 <package>
	<name>vscode</name>
	<range><lt>1.79.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	VSCode developers reports:
	<blockquote cite="https://github.com/microsoft/vscode/security/advisories/GHSA-j5wm-6crw-xvmr">
	 VS Code Information Disclosure Vulnerability
	 A information disclosure vulnerability exists in VS Code 1.79.0 and earlier versions on Windows when file system operations are performed on malicious UNC paths. Examples include reading or resolving metadata of such paths. An authorised attacker must send the user a malicious file and convince the user to open it for the vulnerability to occur. Exploiting this vulnerability could allow the disclosure of NTLM hashes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-33144</cvename>
 <url>https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33144</url>
 </references>
 <dates>
 <discovery>2023-06-13</discovery>
 <entry>2023-06-13</entry>
 </dates>
 </vuln>

<vuln vid="1567be8c-0a15-11ee-8290-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>114.0.5735.133</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>114.0.5735.133</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_13.html">
	 This update includes 5 security fixes:
	 <ul>
	 <li>[1450568] Critical CVE-2023-3214: Use after free in Autofill payments. Reported by Rong Jian of VRI on 2023-06-01</li>
	 <li>[1446274] High CVE-2023-3215: Use after free in WebRTC. Reported by asnine on 2023-05-17</li>
	 <li>[1450114] High CVE-2023-3216: Type Confusion in V8. Reported by 5n1p3r0010 from Topsec ChiXiao Lab on 2023-05-31</li>
	 <li>[1450601] High CVE-2023-3217: Use after free in WebXR. Reported by Sergei Glazunov of Google Project Zero on 2023-06-01</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3214</cvename>
 <cvename>CVE-2023-3215</cvename>
 <cvename>CVE-2023-3216</cvename>
 <cvename>CVE-2023-3217</cvename>
 <url>https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_13.html</url>
 </references>
 <dates>
 <discovery>2023-06-13</discovery>
 <entry>2023-06-13</entry>
 </dates>
 </vuln>

<vuln vid="f7e9a1cc-0931-11ee-94b4-6cc21735f730">
 <topic>xmltooling -- remote resource access</topic>
 <affects>
 <package>
	<name>xmltooling</name>
	<range><lt>3.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Shibboleth consortium reports:
	<blockquote cite="https://shibboleth.net/community/advisories/secadv_20230612.txt">
	 An updated version of the XMLTooling library that is part of the
	 OpenSAML and Shibboleth Service Provider software is now available
	 which corrects a server-side request forgery (SSRF) vulnerability.
	 Including certain legal but "malicious in intent" content in the
	 KeyInfo element defined by the XML Signature standard will result
	 in attempts by the SP's shibd process to dereference untrusted
	 URLs.
	 While the content of the URL must be supplied within the message
	 and does not include any SP internal state or dynamic content,
	 there is at minimum a risk of denial of service, and the attack
	 could be combined with others to create more serious vulnerabilities
	 in the future.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://shibboleth.net/community/advisories/secadv_20230612.txt</url>
 </references>
 <dates>
 <discovery>2023-06-12</discovery>
 <entry>2023-06-12</entry>
 </dates>
 </vuln>

<vuln vid="fdca9418-06f0-11ee-abe2-ecf4bbefc954">
 <topic>acme.sh -- closes potential remote vuln</topic>
 <affects>
 <package>
	<name>acme.sh</name>
	<range><lt>3.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Neil Pang reports:
	<blockquote cite="https://github.com/acmesh-official/acme.sh/issues/4659">
	 HiCA was injecting arbitrary code/commands into the certificate obtaining process and acme.sh is running them on the client machine.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/acmesh-official/acme.sh/issues/4665</url>
 </references>
 <dates>
 <discovery>2023-06-08</discovery>
 <entry>2023-06-09</entry>
 </dates>
 </vuln>

<vuln vid="d86becfe-05a4-11ee-9d4a-080027eda32c">
 <topic>Python -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python37</name>
	<range><lt>3.7.17</lt></range>
 </package>
 <package>
	<name>python38</name>
	<range><lt>3.8.17</lt></range>
 </package>
 <package>
	<name>python39</name>
	<range><lt>3.9.17</lt></range>
 </package>
 <package>
	<name>python310</name>
	<range><lt>3.10.12</lt></range>
 </package>
 <package>
	<name>python311</name>
	<range><lt>3.11.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python reports:
	<blockquote cite="https://pythoninsider.blogspot.com/2023/06/python-3114-31012-3917-3817-3717-and.html">
	 gh-103142: The version of OpenSSL used in Windows and Mac installers has been upgraded
	 to 1.1.1u to address CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464, as well
	 as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 fixed previously in 1.1.1t (gh-101727).
	 gh-102153: urllib.parse.urlsplit() now strips leading C0 control and space characters
	 following the specification for URLs defined by WHATWG in response to CVE-2023-24329.
	 gh-99889: Fixed a security in flaw in uu.decode() that could allow for directory traversal
	 based on the input if no out_file was specified.
	 gh-104049: Do not expose the local on-disk location in directory indexes produced by
	 http.client.SimpleHTTPRequestHandler.
	 gh-101283: subprocess.Popen now uses a safer approach to find cmd.exe when launching with
	 shell=True.
	 gh-103935: trace.__main__ now uses io.open_code() for files to be executed instead of raw open().
	 gh-102953: The extraction methods in tarfile, and shutil.unpack_archive(), have a new filter
	 argument that allows limiting tar features than may be surprising or dangerous, such as creating
	 files outside the destination directory. 
	 gh-102126: Fixed a deadlock at shutdown when clearing thread states if any finalizer tries to
	 acquire the runtime head lock.
	 gh-100892: Fixed a crash due to a race while iterating over thread states in clearing
	 threading.local.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-4303</cvename>
 <cvename>CVE-2023-2650</cvename>
 <cvename>CVE-2023-0286</cvename>
 <cvename>CVE-2023-0464</cvename>
 <cvename>CVE-2023-0465</cvename>
 <cvename>CVE-2023-0466</cvename>
 <cvename>CVE-2023-24329</cvename>
 <url>https://pythoninsider.blogspot.com/2023/06/python-3114-31012-3917-3817-3717-and.html</url>
 </references>
 <dates>
 <discovery>2022-06-08</discovery>
 <entry>2023-06-08</entry>
 </dates>
 </vuln>

<vuln vid="6c1de144-056f-11ee-8e16-6c3be5272acd">
 <topic>Grafana -- Broken access control: viewer can send test alerts</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>8.0.0</ge><lt>8.5.26</lt></range>
	<range><ge>9.0.0</ge><lt>9.2.19</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.15</lt></range>
	<range><ge>9.4.0</ge><lt>9.4.12</lt></range>
	<range><ge>9.5.0</ge><lt>9.5.3</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.0.0</ge><lt>8.5.26</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><lt>9.2.19</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.15</lt></range>
	<range><ge>9.4.0</ge><lt>9.4.12</lt></range>
	<range><ge>9.5.0</ge><lt>9.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2023/06/06/grafana-security-release-new-grafana-versions-with-security-fixes-for-cve-2023-2183-and-cve-2023-2801/">
	 Grafana can allow an attacker in the Viewer role
	 to send alerts by API Alert - Test. This option,
	 however, is not available in the user panel UI for the Viewer role.
	 
	 The CVSS score for this vulnerability is 4.1 Medium
	 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2183</cvename>
 <url>https://grafana.com/security/security-advisories/cve-2023-2183/</url>
 </references>
 <dates>
 <discovery>2023-06-06</discovery>
 <entry>2023-06-07</entry>
 </dates>
 </vuln>

<vuln vid="652064ef-056f-11ee-8e16-6c3be5272acd">
 <topic>Grafana -- Grafana DS proxy race condition</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>9.4.0</ge><lt>9.4.12</lt></range>
	<range><ge>9.5.0</ge><lt>9.5.3</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.4.0</ge><lt>9.4.12</lt></range>
	<range><ge>9.5.0</ge><lt>9.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2023/06/06/grafana-security-release-new-grafana-versions-with-security-fixes-for-cve-2023-2183-and-cve-2023-2801/">
	 We have discovered a vulnerability with Grafana’s data source query
	 endpoints that could end up crashing a Grafana instance.
	 If you have public dashboards (PD) enabled, we
	 are scoring this as a CVSS 7.5 High.
	 If you have disabled PD, this vulnerability is still a risk,
	 but triggering the issue requires data source read privileges
	 and access to the Grafana API through a developer script.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2801</cvename>
 <url>CVE-2023-2801</url>
 </references>
 <dates>
 <discovery>2023-06-06</discovery>
 <entry>2023-06-07</entry>
 </dates>
 </vuln>

<vuln vid="12741b1f-04f9-11ee-8290-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>114.0.5735.106</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>114.0.5735.106</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[1450481] High CVE-2023-3079: Type Confusion in V8. Reported by Clément Lecigne of Google's Threat Analysis Group on 2023-06-01</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-3079</cvename>
 <url>https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2023-06-05</discovery>
 <entry>2023-06-07</entry>
 </dates>
 </vuln>

<vuln vid="cdb5338d-04ec-11ee-9c88-001b217b3468">
 <topic>Gitlab -- Vulnerability</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>16.0.0</ge><lt>16.0.2</lt></range>
	<range><ge>15.11.0</ge><lt>15.11.7</lt></range>
	<range><ge>15.10.0</ge><lt>15.10.8</lt></range>
	<range><ge>1.2</ge><lt>15.9.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/06/05/security-release-gitlab-16-0-2-released/">
	 Stored-XSS with CSP-bypass in Merge requests
	 ReDoS via FrontMatterFilter in any Markdown fields
	 ReDoS via InlineDiffFilter in any Markdown fields
	 ReDoS via DollarMathPostFilter in Markdown fields
	 DoS via malicious test report artifacts
	 Restricted IP addresses can clone repositories of public projects
	 Reflected XSS in Report Abuse Functionality
	 Privilege escalation from maintainer to owner by importing members from a project
	 Bypassing tags protection in GitLab
	 Denial of Service using multiple labels with arbitrarily large descriptions
	 Ability to use an unverified email for public and commit emails
	 Open Redirection Through HTTP Response Splitting
	 Disclosure of issue notes to an unauthorized user when exporting a project
	 Ambiguous branch name exploitation
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2442</cvename>
 <cvename>CVE-2023-2199</cvename>
 <cvename>CVE-2023-2198</cvename>
 <cvename>CVE-2023-2132</cvename>
 <cvename>CVE-2023-0121</cvename>
 <cvename>CVE-2023-2589</cvename>
 <cvename>CVE-2023-2015</cvename>
 <cvename>CVE-2023-2485</cvename>
 <cvename>CVE-2023-2001</cvename>
 <cvename>CVE-2023-0921</cvename>
 <cvename>CVE-2023-1204</cvename>
 <cvename>CVE-2023-0508</cvename>
 <cvename>CVE-2023-1825</cvename>
 <cvename>CVE-2023-2013</cvename>
 <url>https://about.gitlab.com/releases/2023/06/05/security-release-gitlab-16-0-2-released/</url>
 </references>
 <dates>
 <discovery>2023-06-05</discovery>
 <entry>2023-06-07</entry>
 </dates>
 </vuln>

<vuln vid="2f38c6a2-04a4-11ee-8cb0-e41f13b9c674">
 <topic>qpress -- directory traversal</topic>
 <affects>
 <package>
	<name>qpress</name>
	<range><lt>11.3</lt></range>
 </package>
 <package>
	<name>xtrabackup8</name>
	<range><lt>8.0.32</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="https://github.com/EvgeniyPatlan/qpress/commit/ddb312090ebd5794e81bc6fb1dfb4e79eda48761">
	 qpress before PierreLvx/qpress 20220819 and before version 11.3,
	as used in Percona XtraBackup and other products, allows directory
	traversal via ../ in a .qp file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-45866</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-45866</url>
 </references>
 <dates>
 <discovery>2022-11-23</discovery>
 <entry>2023-06-06</entry>
 </dates>
 </vuln>

<vuln vid="bfca647c-0456-11ee-bafd-b42e991fc52e">
 <topic>Kanboard -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php80-kanboard</name>
	<range><lt>1.2.30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	
	Kanboard is project management software that focuses on the Kanban
	methodology. The last update includes 4 vulnerabilities:
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/kanboard/kanboard/commit/b501ef44bc28ee9cf603a4fa446ee121d66f652f">
	 <ul>
	 <li>Missing access control in internal task links feature</li>
	 <li>Stored Cross site scripting in the Task External Link Functionality in Kanboard</li>
	 <li>Missing Access Control allows User to move and duplicate tasks in Kanboard</li>
	 <li>Parameter based Indirect Object Referencing leading to private file exposure in Kanboard</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-33970</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-33970</url>
 <cvename>CVE-2023-33969</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-33969</url>
 <cvename>CVE-2023-33968</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-33968</url>
 <cvename>CVE-2023-33956</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-33956</url>
 </references>
 <dates>
 <discovery>2023-06-05</discovery>
 <entry>2023-06-06</entry>
 </dates>
 </vuln>

<vuln vid="eb9a3c57-ff9e-11ed-a0d1-84a93843eb75">
 <topic>OpenSSL -- Possible DoS translating ASN.1 identifiers</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.1.1u,1</lt></range>
 </package>
 <package>
	<name>openssl30</name>
	<range><lt>3.0.9</lt></range>
 </package>
 <package>
	<name>openssl31</name>
	<range><lt>3.1.1</lt></range>
 </package>
 <package>
	<name>openssl-quictls</name>
	<range><lt>3.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20230530.txt">
	 Severity: Moderate. Processing some specially crafted ASN.1
	 object identifiers or data containing them may be very slow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2650</cvename>
 <url>https://www.openssl.org/news/secadv/20230530.txt</url>
 </references>
 <dates>
 <discovery>2023-05-30</discovery>
 <entry>2023-05-31</entry>
 </dates>
 </vuln>

<vuln vid="79514fcd-feb4-11ed-92b5-b42e991fc52e">
 <topic>Kanboard -- Clipboard based cross-site scripting (blocked with default CSP) in Kanboard</topic>
 <affects>
 <package>
	<name>php80-kanboard</name>
	<range><lt>1.2.29</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/kanboard/kanboard/commit/26b6eebb78d4306e48b836a58f7c386251aa2bc7">
	 Kanboard is project management software that focuses on the Kanban
	methodology. Due to improper handling of elements under the
	`contentEditable` element, maliciously crafted clipboard content
	can inject arbitrary HTML tags into the DOM. A low-privileged
	attacker with permission to attach a document on a vulnerable
	Kanboard instance can trick the victim into pasting malicious
	screenshot data and achieve cross-site scripting if CSP is improperly
	configured. This issue has been patched in version 1.2.29.
	
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-32685</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-32685</url>
 </references>
 <dates>
 <discovery>2023-05-30</discovery>
 <entry>2023-05-30</entry>
 </dates>
 </vuln>

<vuln vid="fd87a250-ff78-11ed-8290-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>114.0.5735.90</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>114.0.5735.90</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html">
	 This update includes 16 security fixes:
	 <ul>
	 <li>[1410191] High CVE-2023-2929: Out of bounds write in Swiftshader. Reported by Jaehun Jeong(@n3sk) of Theori on 2023-01-25</li>
	 <li>[1443401] High CVE-2023-2930: Use after free in Extensions. Reported by asnine on 2023-05-08</li>
	 <li>[1444238] High CVE-2023-2931: Use after free in PDF. Reported by Huyna at Viettel Cyber Security on 2023-05-10</li>
	 <li>[1444581] High CVE-2023-2932: Use after free in PDF. Reported by Huyna at Viettel Cyber Security on 2023-05-11</li>
	 <li>[1445426] High CVE-2023-2933: Use after free in PDF. Reported by Quang Nguyễn (@quangnh89) of Viettel Cyber Security and Nguyen Phuong on 2023-05-15</li>
	 <li>[1429720] High CVE-2023-2934: Out of bounds memory access in Mojo. Reported by Mark Brand of Google Project Zero on 2023-04-01</li>
	 <li>[1440695] High CVE-2023-2935: Type Confusion in V8. Reported by Sergei Glazunov of Google Project Zero on 2023-04-27</li>
	 <li>[1443452] High CVE-2023-2936: Type Confusion in V8. Reported by Sergei Glazunov of Google Project Zero on 2023-05-08</li>
	 <li>[1413813] Medium CVE-2023-2937: Inappropriate implementation in Picture In Picture. Reported by NDevTK on 2023-02-08</li>
	 <li>[1416350] Medium CVE-2023-2938: Inappropriate implementation in Picture In Picture. Reported by Alesandro Ortiz on 2023-02-15</li>
	 <li>[1427431] Medium CVE-2023-2939: Insufficient data validation in Installer. Reported by ycdxsb from VARAS@IIE on 2023-03-24</li>
	 <li>[1426807] Medium CVE-2023-2940: Inappropriate implementation in Downloads. Reported by Axel Chong on 2023-03-22</li>
	 <li>[1430269] Low CVE-2023-2941: Inappropriate implementation in Extensions API. Reported by Jasper Rebane on 2023-04-04</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2929</cvename>
 <cvename>CVE-2023-2930</cvename>
 <cvename>CVE-2023-2931</cvename>
 <cvename>CVE-2023-2932</cvename>
 <cvename>CVE-2023-2933</cvename>
 <cvename>CVE-2023-2934</cvename>
 <cvename>CVE-2023-2935</cvename>
 <cvename>CVE-2023-2936</cvename>
 <cvename>CVE-2023-2937</cvename>
 <cvename>CVE-2023-2938</cvename>
 <cvename>CVE-2023-2939</cvename>
 <cvename>CVE-2023-2940</cvename>
 <cvename>CVE-2023-2941</cvename>
 <url>https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html</url>
 </references>
 <dates>
 <discovery>2023-05-30</discovery>
 <entry>2023-05-31</entry>
 </dates>
 </vuln>

<vuln vid="5d1b1a0a-fd36-11ed-a0d1-84a93843eb75">
 <topic>MariaDB -- Nullpointer dereference</topic>
 <affects>
 <package>
	<name>mariadb1011-server</name>
	<range><lt>10.11.3</lt></range>
 </package>
 <package>
	<name>mariadb106-server</name>
	<range><lt>10.6.13</lt></range>
 </package>
 <package>
	<name>mariadb105-server</name>
	<range><lt>10.5.20</lt></range>
 </package>
 <package>
	<name>mariadb104-server</name>
	<range><lt>10.4.29</lt></range>
 </package>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.39</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MariaDB project reports:
	<blockquote cite="https://mariadb.com/kb/en/security/">
	 MariaDB Server is vulnerable to Denial of Service. It is possible for
	 function spider_db_mbase::print_warnings to dereference a null pointer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-47015</cvename>
 <url>https://mariadb.com/kb/en/security/</url>
 </references>
 <dates>
 <discovery>2023-05-10</discovery>
 <entry>2023-05-28</entry>
 </dates>
 </vuln>

<vuln vid="7d6be8d4-f812-11ed-a7ff-589cfc0f81b0">
 <topic>phpmyfaq -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><lt>3.1.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpmyfaq developers report:
	<blockquote cite="https://www.phpmyfaq.de/security/advisory-2023-04-23">
	 Multiple XSS vulnerabilities
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://huntr.dev/bounties/4d89c7cc-fb4c-4b64-9b67-f0189f70a620/</url>
 <url>https://huntr.dev/bounties/8282d78e-f399-4bf4-8403-f39103a31e78/</url>
 </references>
 <dates>
 <discovery>2023-05-17</discovery>
 <entry>2023-05-21</entry>
 </dates>
 </vuln>

<vuln vid="a4f8bb03-f52f-11ed-9859-080027083a05">
 <topic>curl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>8.1.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wei Chong Tan, Harry Sintonen, and Hiroki Kurosawa reports:
	<blockquote cite="https://curl.se/docs/security.html">
	 This update fixes 4 security vulnerabilities:
	 <ul>
	 <li>Medium CVE-2023-28319: UAF in SSH sha256 fingerprint check. Reported by Wei Chong Tan on 2023-03-21</li>
	 <li>Low CVE-2023-28320: siglongjmp race condition. Reported by Harry Sintonen on 2023-04-02</li>
	 <li>Low CVE-2023-28321: IDN wildcard match. Reported by Hiroki Kurosawa on 2023-04-17</li>
	 <li>Low CVE-2023-28322: more POST-after-PUT confusion. Reported by Hiroki Kurosawa on 2023-04-19</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28319</cvename>
	<url>https://curl.se/docs/CVE-2023-28319.html</url>
	<cvename>CVE-2023-28320</cvename>
	<url>https://curl.se/docs/CVE-2023-28320.html</url>
	<cvename>CVE-2023-28321</cvename>
	<url>https://curl.se/docs/CVE-2023-28321.html</url>
	<cvename>CVE-2023-28322</cvename>
	<url>https://curl.se/docs/CVE-2023-28322.html</url>
 </references>
 <dates>
 <discovery>2023-03-21</discovery>
 <entry>2023-05-19</entry>
 </dates>
 </vuln>

<vuln vid="1ab7357f-a3c2-406a-89fb-fd00e49a71b5">
 <topic>zeek -- potential DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>5.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.9">
	 A specially-crafted series of FTP packets with a CMD
	 command with a large path followed by a very large number
	 of replies could cause Zeek to spend a long time processing
	 the data. 
	 A specially-crafted with a truncated header can cause
	 Zeek to overflow memory and potentially crash. 
	 A specially-crafted series of SMTP packets can cause
	 Zeek to generate a very large number of events and take
	 a long time to process them. 
	 A specially-crafted series of POP3 packets containing
	 MIME data can cause Zeek to spend a long time dealing
	 with each individual file ID. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v5.0.9</url>
 </references>
 <dates>
 <discovery>2023-05-19</discovery>
 <entry>2023-05-19</entry>
 </dates>
 </vuln>

<vuln vid="b09d77d0-b27c-48ae-b69b-9641bb68b39e">
 <topic>electron -- vulnerability</topic>
 <affects>
 <package>
	<name>electron22</name>
	<range><lt>22.3.10</lt></range>
 </package>
 <package>
	<name>electron23</name>
	<range><lt>23.3.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Electron developers report:
	<blockquote cite="https://github.com/electron/electron/releases/tag/v22.3.10">
	 This update fixes the following vulnerability:
	 <ul>
	 <li>Security: backported fix for CVE-2023-29469</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-29469</cvename>
 <url>https://github.com/advisories/GHSA-7jv7-hr35-fwjr</url>
 </references>
 <dates>
 <discovery>2023-05-17</discovery>
 <entry>2023-05-18</entry>
 </dates>
 </vuln>

<vuln vid="bea52545-f4a7-11ed-8290-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>113.0.5672.126</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>113.0.5672.126</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html">
	 This update includes 12 security fixes:
	 <ul>
	 <li>[1444360] Critical CVE-2023-2721: Use after free in Navigation. Reported by Guang Gong of Alpha Lab, Qihoo 360 on 2023-05-10</li>
	 <li>[1400905] High CVE-2023-2722: Use after free in Autofill UI. Reported by Rong Jian of VRI on 2022-12-14</li>
	 <li>[1435166] High CVE-2023-2723: Use after free in DevTools. Reported by asnine on 2023-04-21</li>
	 <li>[1433211] High CVE-2023-2724: Type Confusion in V8. Reported by Sergei Glazunov of Google Project Zero on 2023-04-14</li>
	 <li>[1442516] High CVE-2023-2725: Use after free in Guest View. Reported by asnine on 2023-05-04</li>
	 <li>[1442018] Medium CVE-2023-2726: Inappropriate implementation in WebApp Installs. Reported by Ahmed ElMasry on 2023-05-03</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2721</cvename>
 <cvename>CVE-2023-2722</cvename>
 <cvename>CVE-2023-2723</cvename>
 <cvename>CVE-2023-2724</cvename>
 <cvename>CVE-2023-2725</cvename>
 <cvename>CVE-2023-2726</cvename>
 <url>https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html</url>
 </references>
 <dates>
 <discovery>2023-05-16</discovery>
 <entry>2023-05-17</entry>
 </dates>
 </vuln>

<vuln vid="4a08a4fb-f152-11ed-9c88-001b217b3468">
 <topic>Gitlab -- Vulnerability</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>15.11.0</ge><lt>15.11.3</lt></range>
	<range><ge>15.10.0</ge><lt>15.10.7</lt></range>
	<range><ge>9.0</ge><lt>15.9.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/05/10/security-release-gitlab-15-11-3-released/">
	 Smuggling code changes via merge requests with refs/replace
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2181</cvename>
 <url>https://about.gitlab.com/releases/2023/05/10/security-release-gitlab-15-11-3-released/</url>
 </references>
 <dates>
 <discovery>2023-05-10</discovery>
 <entry>2023-05-13</entry>
 </dates>
 </vuln>

<vuln vid="ec63bc8e-f092-11ed-85ca-001517a2e1a4">
 <topic>piwigo -- SQL injection</topic>
 <affects>
 <package>
	<name>piwigo</name>
	<range><lt>13.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Piwigo reports:
	<blockquote cite="https://www.piwigo.org/release-13.7.0">
	 Piwigo is affected by multiple SQL injection issues.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.piwigo.org/release-13.7.0</url>
 </references>
 <dates>
 <discovery>2023-03-01</discovery>
 <entry>2023-05-12</entry>
 </dates>
 </vuln>

<vuln vid="4b636f50-f011-11ed-bbae-6cc21735f730">
 <topic>postgresql-server -- Row security policies disregard user ID changes after inlining</topic>
 <affects>
 <package>
	<name>postgresql-server</name>
	<range><lt>15.3</lt></range>
	<range><lt>14.8</lt></range>
	<range><lt>13.11</lt></range>
	<range><lt>12.15</lt></range>
	<range><lt>11.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL Project reports
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-2455/">
	 
	 While CVE-2016-2193 fixed most interaction between row security and
	 user ID changes, it missed a scenario involving function
	 inlining. This leads to potentially incorrect policies being
	 applied in cases where role-specific policies are used and a
	 given query is planned under one role and then executed under
	 other roles. This scenario can happen under security definer
	 functions or when a common user and query is planned
	 initially and then re-used across multiple SET ROLEs.
	 Applying an incorrect policy may permit a user to complete
	 otherwise-forbidden reads and modifications. This affects
	 only databases that have used CREATE POLICY to define a row
	 security policy.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2455</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2023-2455/</url>
 </references>
 <dates>
 <discovery>2023-05-11</discovery>
 <entry>2023-05-11</entry>
 </dates>
 </vuln>

<vuln vid="fbb5a260-f00f-11ed-bbae-6cc21735f730">
 <topic>postgresql-server -- CREATE SCHEMA ... schema elements defeats protective search_path changes</topic>
 <affects>
 <package>
	<name>postgresql-server</name>
	<range><lt>15.3</lt></range>
	<range><lt>14.8</lt></range>
	<range><lt>13.11</lt></range>
	<range><lt>12.15</lt></range>
	<range><lt>11.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL Project reports
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-2454/">
	 
	 This enabled an attacker having database-level CREATE
	 privilege to execute arbitrary code as the bootstrap
	 superuser. Database owners have that right by default,
	 and explicit grants may extend it to other users.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2454</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2023-2454/</url>
 </references>
 <dates>
 <discovery>2023-05-11</discovery>
 <entry>2023-05-11</entry>
 </dates>
 </vuln>

<vuln vid="7913fe6d-2c6e-40ba-a7d7-35696f3db2b6">
 <topic>vscode -- Visual Studio Code Information Disclosure Vulnerability</topic>
 <affects>
 <package>
	<name>vscode</name>
	<range><lt>1.78.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	secure@microsoft.com reports:
	<blockquote cite="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29338">
	 Visual Studio Code Information Disclosure Vulnerability
	 A information disclosure vulnerability exists in VS Code 1.78.0 and earlier versions on Windows when file system operations are performed on malicious UNC paths. Examples include reading or resolving metadata of such paths. An authorised attacker must send the user a malicious file and convince the user to open it for the vulnerability to occur. Exploiting this vulnerability could allow the disclosure of NTLM hashes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-29338</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-29338</url>
 <url>https://github.com/microsoft/vscode/security/advisories/GHSA-mmfh-4pv3-39hr</url>
 </references>
 <dates>
 <discovery>2023-05-09</discovery>
 <entry>2023-05-10</entry>
 </dates>
 </vuln>

<vuln vid="68958e18-ed94-11ed-9688-b42e991fc52e">
 <topic>glpi -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>10.0.7,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	glpi Project reports:
	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.7">
	 Multiple vulnerabilities found and fixed in this version:
	 <ul>
	 <li>High CVE-2023-28849: SQL injection and Stored XSS via inventory agent request.</li>
	 <li>High CVE-2023-28632: Account takeover by authenticated user.</li>
	 <li>High CVE-2023-28838: SQL injection through dynamic reports.</li>
	 <li>Moderate CVE-2023-28852: Stored XSS through dashboard administration.</li>
	 <li>Moderate CVE-2023-28636: Stored XSS on external links.</li>
	 <li>Moderate CVE-2023-28639: Reflected XSS in search pages.</li>
	 <li>Moderate CVE-2023-28634: Privilege Escalation from technician to super-admin.</li>
	 <li>Low CVE-2023-28633: Blind Server-Side Request Forgery (SSRF) in RSS feeds.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28849</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28849</url>
 <cvename>CVE-2023-28632</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28632</url>
 <cvename>CVE-2023-28838</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28838</url>
 <cvename>CVE-2023-28852</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28852</url>
 <cvename>CVE-2023-28636</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28636</url>
 <cvename>CVE-2023-28639</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28639</url>
 <cvename>CVE-2023-28634</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28634</url>
 </references>
 <dates>
 <discovery>2023-03-20</discovery>
 <entry>2023-05-08</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="96b2d4db-ddd2-11ed-b6ea-080027f5fec9">
 <topic>redis -- HINCRBYFLOAT can be used to crash a redis-server process</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><lt>7.0.11</lt></range>
 </package>
 <package>
	<name>redis62</name>
	<range><lt>6.2.12</lt></range>
 </package>
 <package>
	<name>redis6</name>
	<range><lt>6.0.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redis core team reports:
	<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-hjv8-vjf6-wcr6">
	 
	 Authenticated users can use the HINCRBYFLOAT command to
	 create an invalid hash field that may later crash Redis on
	 access.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28856</cvename>
 <url>https://github.com/redis/redis/security/advisories/GHSA-hjv8-vjf6-wcr6</url>
 </references>
 <dates>
 <discovery>2023-04-17</discovery>
 <entry>2023-05-08</entry>
 </dates>
 </vuln>

<vuln vid="89fdbd85-ebd2-11ed-9c88-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>15.11.0</ge><lt>15.11.2</lt></range>
	<range><ge>15.10.0</ge><lt>15.10.6</lt></range>
	<range><ge>9.0</ge><lt>15.9.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/05/05/critical-security-release-gitlab-15-11-2-released/">
	 Malicious Runner Attachment via GraphQL
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2478</cvename>
 <url>https://about.gitlab.com/releases/2023/05/05/critical-security-release-gitlab-15-11-2-released/</url>
 </references>
 <dates>
 <discovery>2023-05-05</discovery>
 <entry>2023-05-06</entry>
 </dates>
 </vuln>

<vuln vid="d55e1b4d-eadc-11ed-9cc0-080027de9982">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py37-django32</name>
	<name>py38-django32</name>
	<name>py39-django32</name>
	<name>py310-django32</name>
	<name>py311-django32</name>
	<range><lt>3.2.19</lt></range>
 </package>
 <package>
	<name>py38-django41</name>
	<name>py39-django41</name>
	<name>py310-django41</name>
	<name>py311-django41</name>
	<range><lt>4.1.9</lt></range>
 </package>
 <package>
	<name>py38-django42</name>
	<name>py39-django42</name>
	<name>py310-django42</name>
	<name>py311-django42</name>
	<range><lt>4.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2023/may/03/security-releases/">
	 CVE-2023-31047: Potential bypass of validation when uploading multiple
	 files using one form field.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-31047</cvename>
 <url>https://www.djangoproject.com/weblog/2023/may/03/security-releases/</url>
 </references>
 <dates>
 <discovery>2023-05-01</discovery>
 <entry>2023-05-05</entry>
 </dates>
 </vuln>

<vuln vid="246174d3-e979-11ed-8290-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>113.0.5672.63</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>113.0.5672.63</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html">
	 This update includes 15 security fixes:
	 <ul>
	 <li>[1423304] Medium CVE-2023-2459: Inappropriate implementation in Prompts. Reported by Rong Jian of VRI on 2023-03-10</li>
	 <li>[1419732] Medium CVE-2023-2460: Insufficient validation of untrusted input in Extensions. Reported by Martin Bajanik, Fingerprint[.]com on 2023-02-27</li>
	 <li>[1350561] Medium CVE-2023-2461: Use after free in OS Inputs. Reported by @ginggilBesel on 2022-08-06</li>
	 <li>[1375133] Medium CVE-2023-2462: Inappropriate implementation in Prompts. Reported by Alesandro Ortiz on 2022-10-17</li>
	 <li>[1406120] Medium CVE-2023-2463: Inappropriate implementation in Full Screen Mode. Reported by Irvan Kurniawan (sourc7) on 2023-01-10</li>
	 <li>[1418549] Medium CVE-2023-2464: Inappropriate implementation in PictureInPicture. Reported by Thomas Orlita on 2023-02-23</li>
	 <li>[1399862] Medium CVE-2023-2465: Inappropriate implementation in CORS. Reported by @kunte_ctf on 2022-12-10</li>
	 <li>[1385714] Low CVE-2023-2466: Inappropriate implementation in Prompts. Reported by Jasper Rebane (popstonia) on 2022-11-17</li>
	 <li>[1413586] Low CVE-2023-2467: Inappropriate implementation in Prompts. Reported by Thomas Orlita on 2023-02-07</li>
	 <li>[1416380] Low CVE-2023-2468: Inappropriate implementation in PictureInPicture. Reported by Alesandro Ortiz on 2023-02-15</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2459</cvename>
 <cvename>CVE-2023-2460</cvename>
 <cvename>CVE-2023-2461</cvename>
 <cvename>CVE-2023-2462</cvename>
 <cvename>CVE-2023-2463</cvename>
 <cvename>CVE-2023-2464</cvename>
 <cvename>CVE-2023-2465</cvename>
 <cvename>CVE-2023-2466</cvename>
 <cvename>CVE-2023-2467</cvename>
 <cvename>CVE-2023-2468</cvename>
 <url>https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2023-05-03</discovery>
 <entry>2023-05-03</entry>
 </dates>
 </vuln>

<vuln vid="4ffcccae-e924-11ed-9c88-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>15.11.0</ge><lt>15.11.1</lt></range>
	<range><ge>15.10.0</ge><lt>15.10.5</lt></range>
	<range><ge>9.0</ge><lt>15.9.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/05/02/security-release-gitlab-15-11-1-released/">
	 Privilege escalation for external users when OIDC is enabled under certain conditions
	 Account takeover through open redirect for Group SAML accounts
	 Users on banned IP addresses can still commit to projects
	 User with developer role (group) can modify Protected branches setting on imported project and leak group CI/CD variables
	 The Gitlab web interface does not guarantee file integrity when downloading source code or installation packages from a tag or from a release.
	 Banned group member continues to have access to the public projects of a public group with the access level as same as before the ban.
	 The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.
	 XSS and content injection and iframe injection when viewing raw files on iOS devices
	 Authenticated users can find other users by their private email
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2182</cvename>
 <cvename>CVE-2023-1965</cvename>
 <cvename>CVE-2023-1621</cvename>
 <cvename>CVE-2023-2069</cvename>
 <cvename>CVE-2023-1178</cvename>
 <cvename>CVE-2023-0805</cvename>
 <cvename>CVE-2023-0756</cvename>
 <cvename>CVE-2023-1836</cvename>
 <cvename>CVE-2022-4376</cvename>
 <url>https://about.gitlab.com/releases/2023/05/02/security-release-gitlab-15-11-1-released/</url>
 </references>
 <dates>
 <discovery>2023-05-02</discovery>
 <entry>2023-05-02</entry>
 </dates>
 </vuln>

<vuln vid="02562a78-e6b7-11ed-b0ce-b42e991fc52e">
 <topic>cloud-init -- sensitive data exposure in cloud-init logs</topic>
 <affects>
 <package>
	<name>cloud-init</name>
	<range><lt>23.1.2</lt></range>
 </package>
 <package>
	<name>cloud-init-devel</name>
	<range><lt>23.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	security@ubuntu.com reports:
	<blockquote cite="https://bugs.launchpad.net/cloud-init/+bug/2013967">
	 Sensitive data could be exposed in logs of cloud-init before version
	23.1.2. An attacker could use this information to find hashed
	passwords and possibly escalate their privilege.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-1786</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-1786</url>
 </references>
 <dates>
 <discovery>2023-04-26</discovery>
 <entry>2023-04-29</entry>
 </dates>
 </vuln>

<vuln vid="4da51989-5a8b-4eb9-b442-46d94ec0802d">
 <topic>h2o -- Malformed HTTP/1.1 causes Out-of-Memory Denial of Service</topic>
 <affects>
 <package>
 <name>h2o</name>
 <range><le>2.2.6</le></range>
 </package>
 <package>
 <name>h2o-devel</name>
 <range><lt>2.3.0.d.20230427</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Elijah Glover reports:
 <blockquote cite="https://github.com/h2o/h2o/issues/3228">
 
 Malformed HTTP/1.1 requests can crash worker processes.
 occasionally locking up child workers and causing denial of
 service, and an outage dropping any open connections.
 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-30847</cvename>
 <url>https://github.com/h2o/h2o/security/advisories/GHSA-p5hj-phwj-hrvx</url>
 </references>
 <dates>
 <discovery>2023-04-27</discovery>
 <entry>2023-04-30</entry>
 </dates>
 </vuln>

<vuln vid="d2c6173f-e43b-11ed-a1d7-002590f2a714">
 <topic>git -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>git</name>
	<range><lt>2.40.1</lt></range>
 </package>
 <package>
	<name>git-lite</name>
	<range><lt>2.40.1</lt></range>
 </package>
 <package>
	<name>git-tiny</name>
	<range><lt>2.40.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	git developers reports:
	<blockquote cite="INSERT URL HERE">
	 This update includes 2 security fixes:
	 <ul>
	 <li>CVE-2023-25652: By feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch)</li>
	 <li>CVE-2023-29007: A specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug that can be used to inject arbitrary configuration into user's git config. This can result in arbitrary execution of code, by inserting values for core.pager, core.editor and so on</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-25652</cvename>
 <url>https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx</url>
 <cvename>CVE-2023-29007</cvename>
 <url>https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844</url>
 </references>
 <dates>
 <discovery>2023-04-25</discovery>
 <entry>2023-04-26</entry>
 </dates>
 </vuln>

<vuln vid="0b85b1cd-e468-11ed-834b-6c3be5272acd">
 <topic>Grafana -- Critical vulnerability in golang</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><lt>8.5.24</lt></range>
	<range><ge>9.0.0</ge><lt>9.2.17</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.13</lt></range>
	<range><ge>9.4.0</ge><lt>9.4.9</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><lt>8.5.24</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><lt>9.2.17</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.13</lt></range>
	<range><ge>9.4.0</ge><lt>9.4.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2023/04/26/precautionary-patches-for-grafana-released-following-critical-go-vulnerability-cve-2023-24538/">
	 An issue in how go handles backticks (`) with Javascript can lead to
	 an injection of arbitrary code into go templates. While Grafana Labs software
	 contains potentially vulnerable versions of go, we have not identified any
	 exploitable use cases at this time.
	 The CVSS score for this vulnerability is 0.0 (adjusted), 9.8 (base).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-24538</cvename>
 <url>https://grafana.com/blog/2023/04/26/precautionary-patches-for-grafana-released-following-critical-go-vulnerability-cve-2023-24538/</url>
 </references>
 <dates>
 <discovery>2023-04-19</discovery>
 <entry>2023-04-26</entry>
 </dates>
 </vuln>

<vuln vid="5e257b0d-e466-11ed-834b-6c3be5272acd">
 <topic>Grafana -- Exposure of sensitive information to an unauthorized actor</topic>
 <affects>
 <package>
	<name>grafana</name>
	<name>grafana9</name>
	<range><ge>9.1.0</ge><lt>9.2.17</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.13</lt></range>
	<range><ge>9.4.0</ge><lt>9.4.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2023/04/26/grafana-security-release-new-versions-of-grafana-with-security-fixes-for-cve-2023-28119-and-cve-2023-1387/">
	 When setting up Grafana, there is an option to enable
	 <a href="https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/jwt/">
	 JWT authentication</a>. Enabling this will allow users to authenticate towards
	 the Grafana instance with a special header (default <code>X-JWT-Assertion</code>
	 ).
	 In Grafana, there is an additional way to authenticate using JWT called
	 <a href="https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/jwt/#url-login">
	 URL login</a> where the token is passed as a query parameter.
	 When using this option, a JWT token is passed to the data source as a header,
	 which leads to exposure of sensitive information to an unauthorized party.
	 The CVSS score for this vulnerability is 4.2 Medium
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-1387</cvename>
 <url>https://grafana.com/security/security-advisories/cve-2023-1387/</url>
 </references>
 <dates>
 <discovery>2023-04-26</discovery>
 <entry>2023-04-26</entry>
 </dates>
 </vuln>

<vuln vid="c676bb1b-e3f8-11ed-b37b-901b0e9408dc">
 <topic>element-web -- matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting</topic>
 <affects>
 <package>
	<name>element-web</name>
	<range><lt>1.11.30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://github.com/advisories/GHSA-xv83-x443-7rmw">
	 matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP
	client into a web page. Prior to version 3.71.0, plain text messages
	containing HTML tags are rendered as HTML in the search results.
	To exploit this, an attacker needs to trick a user into searching
	for a specific message containing an HTML injection payload. No
	cross-site scripting attack is possible due to the hardcoded content
	security policy. Version 3.71.0 of the SDK patches over the issue.
	As a workaround, restarting the client will clear the HTML injection.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-30609</cvename>
 <url>https://github.com/advisories/GHSA-xv83-x443-7rmw</url>
 </references>
 <dates>
 <discovery>2023-04-25</discovery>
 <entry>2023-04-26</entry>
 </dates>
 </vuln>

<vuln vid="4ee322e9-e363-11ed-b934-b42e991fc52e">
 <topic>jellyfin -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jellyfin</name>
	<range><lt>10.8.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	security-advisories@github.com reports:
	<blockquote cite="https://github.com/jellyfin/jellyfin-web/security/advisories/GHSA-89hp-h43h-r5pq">
	 Jellyfin is a free-software media system. Versions starting with
	10.8.0 and prior to 10.8.10 and prior have a directory traversal
	vulnerability inside the `ClientLogController`, specifically
	`/ClientLog/Document`. When combined with a cross-site scripting
	vulnerability (CVE-2023-30627), this can result in file write and
	arbitrary code execution. Version 10.8.10 has a patch for this
	issue. There are no known workarounds.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-30626</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-30626</url>
 <cvename>CVE-2023-30627</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-30627</url>
 </references>
 <dates>
 <discovery>2023-04-24</discovery>
 <entry>2023-04-25</entry>
 </dates>
 </vuln>

<vuln vid="bb528d7c-e2c6-11ed-a3e6-589cfc0f81b0">
 <topic>phpmyfaq -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><lt>3.1.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpmyfaq developers report:
	<blockquote cite="https://www.phpmyfaq.de/security/advisory-2023-04-23">
	 XSS
	 email address manipulation
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://huntr.dev/bounties/20d3a0b3-2693-4bf1-b196-10741201a540/</url>
 <url>https://huntr.dev/bounties/89005a6d-d019-4cb7-ae88-486d2d44190d/</url>
 <url>https://huntr.dev/bounties/cee65b6d-b003-4e6a-9d14-89aa94bee43e/</url>
 <url>https://huntr.dev/bounties/840c8d91-c97e-4116-a9f8-4ab1a38d239b/</url>
 </references>
 <dates>
 <discovery>2023-04-23</discovery>
 <entry>2023-04-24</entry>
 </dates>
 </vuln>

<vuln vid="f504a8d2-e105-11ed-85f6-84a93843eb75">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql-connector-java</name>
	<range><lt>8.0.33</lt></range>
 </package>
 <package>
	<name>mysql-client57</name>
	<range><lt>5.7.42</lt></range>
 </package>
 <package>
	<name>mysql-server57</name>
	<range><lt>5.7.42</lt></range>
 </package>
 <package>
	<name>mysql-client80</name>
	<range><lt>8.0.33</lt></range>
 </package>
 <package>
	<name>mysql-server80</name>
	<range><lt>8.0.33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpuapr2023.html#AppendixMSQL">
	 This Critical Patch Update contains 34 new security patches, plus
	 additional third party patches noted below, for Oracle MySQL. 11 of
	 these vulnerabilities may be remotely exploitable without
	 authentication, i.e., may be exploited over a network without
	 requiring user credentials.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-37434</cvename>
 <cvename>CVE-2023-21912</cvename>
 <cvename>CVE-2023-21980</cvename>
 <cvename>CVE-2023-21946</cvename>
 <cvename>CVE-2023-21929</cvename>
 <cvename>CVE-2023-21971</cvename>
 <cvename>CVE-2023-21911</cvename>
 <cvename>CVE-2023-21962</cvename>
 <cvename>CVE-2023-21919</cvename>
 <cvename>CVE-2023-21933</cvename>
 <cvename>CVE-2023-21972</cvename>
 <cvename>CVE-2023-21966</cvename>
 <cvename>CVE-2023-21913</cvename>
 <cvename>CVE-2023-21917</cvename>
 <cvename>CVE-2023-21920</cvename>
 <cvename>CVE-2023-21935</cvename>
 <cvename>CVE-2023-21945</cvename>
 <cvename>CVE-2023-21976</cvename>
 <cvename>CVE-2023-21977</cvename>
 <cvename>CVE-2023-21982</cvename>
 <cvename>CVE-2023-21953</cvename>
 <cvename>CVE-2023-21955</cvename>
 <cvename>CVE-2023-21940</cvename>
 <cvename>CVE-2023-21947</cvename>
 <cvename>CVE-2023-21963</cvename>
 <url>https://www.oracle.com/security-alerts/cpuapr2023.html#AppendixMSQL</url>
 </references>
 <dates>
 <discovery>2023-04-19</discovery>
 <entry>2023-04-22</entry>
 <modified>2023-04-22</modified>
 </dates>
 </vuln>

<vuln vid="90c48c04-d549-4fc0-a503-4775e32d438e">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>112.0.5615.165</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>112.0.5615.165</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html">
	 This update includes 8 security fixes:
	 <ul>
	 <li>[1429197] High CVE-2023-2133: Out of bounds memory access in Service Worker API. Reported by Rong Jian of VRI on 2023-03-30</li>
	 <li>[1429201] High CVE-2023-2134: Out of bounds memory access in Service Worker API. Reported by Rong Jian of VRI on 2023-03-30</li>
	 <li>[1424337] High CVE-2023-2135: Use after free in DevTools. Reported by Cassidy Kim(@cassidy6564) on 2023-03-14</li>
	 <li>[1432603] High CVE-2023-2136: Integer overflow in Skia. Reported by Clément Lecigne of Google's Threat Analysis Group on 2023-04-12</li>
	 <li>[1430644] Medium CVE-2023-2137: Heap buffer overflow in sqlite. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute on 2023-04-05</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2133</cvename>
 <cvename>CVE-2023-2134</cvename>
 <cvename>CVE-2023-2135</cvename>
 <cvename>CVE-2023-2136</cvename>
 <cvename>CVE-2023-2137</cvename>
 <url>https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html</url>
 </references>
 <dates>
 <discovery>2023-04-20</discovery>
 <entry>2023-04-20</entry>
 </dates>
 </vuln>

<vuln vid="0bd7f07b-dc22-11ed-bf28-589cfc0f81b0">
 <topic>libxml2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.10.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The libxml2 project reports:
	<blockquote cite="https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4">
	 Hashing of empty dict strings isn't deterministic
	 Fix null deref in xmlSchemaFixupComplexType
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28484</cvename>
 <cvename>CVE-2023-29469</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=2185984</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=2185994</url>
 </references>
 <dates>
 <discovery>2023-04-11</discovery>
 <entry>2023-04-16</entry>
 </dates>
 </vuln>

<vuln vid="e8b20517-dbb6-11ed-bf28-589cfc0f81b0">
 <topic>mod_gnutls -- Infinite Loop on request read timeout</topic>
 <affects>
 <package>
	<name>ap24-mod_gnutls</name>
	<range><lt>0.12.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The mod_gnutls project reports:
	<blockquote cite="https://lists.gnupg.org/pipermail/mod_gnutls-devel/2023-February/000221.html">
	 Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions
	 from 0.9.0 to 0.12.0 (including) did not properly fail blocking
	 read operations on TLS connections when the transport hit timeouts.
	 Instead it entered an endless loop retrying the read operation,
	 consuming CPU resources. This could be exploited for denial of
	 service attacks. If trace level logging was enabled, it would also
	 produce an excessive amount of log output during the loop, consuming
	 disk space.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-25824</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-25824</url>
 <url>https://mod.gnutls.org/browser/mod_gnutls/CHANGELOG?rev=17b2836dc3e27754159ffb098323a4cd4426192f</url>
 </references>
 <dates>
 <discovery>2023-02-23</discovery>
 <entry>2023-04-15</entry>
 </dates>
 </vuln>

<vuln vid="6f0327d4-9902-4042-9b68-6fc2266944bc">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>112.0.5615.121</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>112.0.5615.121</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_14.html">
	 This update includes 2 security fixes:
	 <ul>
	 <li>[1432210] High CVE-2023-2033: Type Confusion in V8. Reported by Clément Lecigne of Google's Threat Analysis Group on 2023-04-11</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-2033</cvename>
 <url>https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_14.html</url>
 </references>
 <dates>
 <discovery>2023-04-14</discovery>
 <entry>2023-04-15</entry>
 </dates>
 </vuln>

<vuln vid="25872b25-da2d-11ed-b715-a1e76793953b">
 <topic>ghostscript -- exploitable buffer overflow in (T)BCP in PS interpreter</topic>
 <affects>
 <package><name>ghostscript</name> <range><lt>10.01.1</lt></range></package>
 <package><name>ghostscript7-base</name><range><lt>10.01.1</lt></range></package>
 <package><name>ghostscript7-commfont</name><range><lt>10.01.1</lt></range></package>
 <package><name>ghostscript7-jpnfont</name><range><lt>10.01.1</lt></range></package>
 <package><name>ghostscript7-korfont</name><range><lt>10.01.1</lt></range></package>
 <package><name>ghostscript7-x11</name><range><lt>10.01.1</lt></range></package>
 <package><name>ghostscript8-base</name><range><lt>10.01.1</lt></range></package>
 <package><name>ghostscript8-x11</name><range><lt>10.01.1</lt></range></package>
 <package><name>ghostscript9-agpl-base</name><range><lt>9.56.1_10</lt></range></package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cve@mitre.org reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2023/04/12/4">
	 In Artifex Ghostscript through 10.01.0, there is a buffer overflow
	leading to potential corruption of data internal to the PostScript
	interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode,
	TBCPEncode, and TBCPDecode. If the write buffer is filled to one
	byte less than full, and one then tries to write an escaped character,
	two bytes are written.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28879</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-28879</url>
 <url>https://artifex.com/news/critical-security-vulnerability-fixed-in-ghostscript</url>
 </references>
 <dates>
 <discovery>2023-03-23</discovery>
 <entry>2023-04-13</entry>
 <modified>2023-04-28</modified>
 </dates>
 </vuln>

<vuln vid="96d6809a-81df-46d4-87ed-2f78c79f06b1">
 <topic>zeek -- potential DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>5.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.8">
	 Receiving DNS responses from async DNS requests (via
	 A specially-crafted stream of FTP packets containing a
	 command reply with many intermediate lines can cause Zeek
	 to spend a large amount of time processing data. 
	 A specially-crafted set of packets containing extremely
	 large file offsets cause cause the reassembler code to
	 allocate large amounts of memory. 
	 The DNS manager does not correctly expire responses
	 that don't contain any data, such those containing NXDOMAIN
	 or NODATA status codes. This can lead to Zeek allocating
	 large amounts of memory for these responses and never
	 deallocating them. 
	 A specially-crafted stream of RDP packets can cause
	 Zeek to spend large protocol validation. 
	 A specially-crafted stream of SMTP packets can cause
	 Zeek to spend large amounts of time processing data. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v5.0.8</url>
 </references>
 <dates>
 <discovery>2023-04-12</discovery>
 <entry>2023-04-12</entry>
 </dates>
 </vuln>

<vuln vid="b54abe9d-7024-4d10-98b2-180cf1717766">
 <topic>py-beaker -- arbitrary code execution vulnerability</topic>
 <affects>
 <package>
 <name>py37-beaker</name>
 <name>py38-beaker</name>
 <name>py39-beaker</name>
 <name>py310-beaker</name>
 <name>py311-beaker</name>
 <range><le>1.12.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 matheusbrat reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2020-216">
 The Beaker library through 1.12.1 for Python is affected by deserialization of untrusted data, which could lead to arbitrary code execution.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-7489</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2020-216</url>
 </references>
 <dates>
 <discovery>2020-06-26</discovery>
 <entry>2023-04-10</entry>
 </dates>
 </vuln>

<vuln vid="374793ad-2720-4c4a-b86c-fc4a1780deac">
 <topic>py-psutil -- double free vulnerability</topic>
 <affects>
 <package>
 <name>py37-psutil121</name>
 <name>py38-psutil121</name>
 <name>py39-psutil121</name>
 <name>py310-psutil121</name>
 <name>py311-psutil121</name>
 <range><lt>5.6.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 ret2libc reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-41">
 psutil (aka python-psutil) through 5.6.5 can have a double free.
 This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-18874</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2019-41</url>
 <url>https://osv.dev/vulnerability/GHSA-qfc5-mcwq-26q8</url>
 </references>
 <dates>
 <discovery>2019-11-12</discovery>
 <entry>2023-04-10</entry>
 </dates>
 </vuln>

<vuln vid="e1b77733-a982-442e-8796-a200571bfcf2">
 <topic>py-ansible -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>py37-ansible</name>
 <name>py38-ansible</name>
 <name>py39-ansible</name>
 <name>py310-ansible</name>
 <name>py311-ansible</name>
 <range><le>7.2.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 abeluck reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2020-220">
 A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is completed.
 Files would remain in the bucket exposing the data.
 This issue affects directly data confidentiality.
 </blockquote>
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2020-221">
 A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers.
 Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes.
 This issue affects mainly the service availability.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-25635</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2020-220</url>
 <cvename>CVE-2020-25636</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2020-221</url>
 </references>
 <dates>
 <discovery>2020-10-05</discovery>
 <entry>2023-04-10</entry>
 </dates>
 </vuln>

<vuln vid="f418cd50-561a-49a2-a133-965d03ede72a">
 <topic>py-ansible -- data leak vulnerability</topic>
 <affects>
 <package>
 <name>py37-ansible</name>
 <name>py38-ansible</name>
 <name>py39-ansible</name>
 <name>py310-ansible</name>
 <name>py311-ansible</name>
 <range><le>7.1.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Tapas jena reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-125">
 A flaw was found in Ansible where the secret information present in async_files are getting disclosed when the user changes the jobdir to a world readable directory.
 Any secret information in an async status file will be readable by a malicious user on that system.
 This flaw affects Ansible Tower 3.7 and Ansible Automation Platform 1.2.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-3532</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2021-125</url>
 </references>
 <dates>
 <discovery>2021-06-09</discovery>
 <entry>2023-04-10</entry>
 </dates>
 </vuln>

<vuln vid="2acdf364-9f8d-4aaf-8d1b-867fdfd771c6">
 <topic>py-kerberos -- DoS and MitM vulnerabilities</topic>
 <affects>
 <package>
 <name>py37-kerberos</name>
 <name>py38-kerberos</name>
 <name>py39-kerberos</name>
 <name>py310-kerberos</name>
 <name>py311-kerberos</name>
 <range><le>1.3.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 macosforgebot reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2017-49">
 The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by performing a man-in-the-middle attack.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3206</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2017-49</url>
 </references>
 <dates>
 <discovery>2017-08-25</discovery>
 <entry>2023-04-10</entry>
 </dates>
 </vuln>

<vuln vid="c1a8ed1c-2814-4260-82aa-9e37c83aac93">
 <topic>py-cryptography -- includes a vulnerable copy of OpenSSL</topic>
 <affects>
 <package>
 <name>py37-cryptography</name>
 <name>py38-cryptography</name>
 <name>py39-cryptography</name>
 <name>py310-cryptography</name>
 <name>py311-cryptography</name>
 <range><lt>39.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <blockquote cite="https://osv.dev/vulnerability/GHSA-x4qr-2fvf-3mr5">
 pyca/cryptography's wheels include a statically linked copy of OpenSSL.
 The versions of OpenSSL included in cryptography 0.8.1-39.0.0 are vulnerable to a security issue.
 More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221213.txt and https://www.openssl.org/news/secadv/20230207.txt.
 If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL.
 Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0286</cvename>
 <url>https://osv.dev/vulnerability/GHSA-x4qr-2fvf-3mr5</url>
 </references>
 <dates>
 <discovery>2023-02-08</discovery>
 <entry>2023-04-10</entry>
 </dates>
 </vuln>

<vuln vid="a32ef450-9781-414b-a944-39f2f61677f2">
 <topic>py-cryptography -- allows programmers to misuse an API</topic>
 <affects>
 <package>
 <name>py37-cryptography</name>
 <name>py38-cryptography</name>
 <name>py39-cryptography</name>
 <name>py310-cryptography</name>
 <name>py311-cryptography</name>
 <range><ge>1.8</ge><lt>39.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 alex reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-w7pp-m8wf-vj6r">
 Previously, `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers.
 This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python.
 This is a soundness bug -- it allows programmers to misuse an API, it cannot be exploited by attacker controlled data alone.
 This now correctly raises an exception.
 This issue has been present since `update_into` was originally introduced in cryptography 1.8.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-23931</cvename>
 <url>https://osv.dev/vulnerability/GHSA-w7pp-m8wf-vj6r</url>
 </references>
 <dates>
 <discovery>2023-02-07</discovery>
 <entry>2023-04-10</entry>
 </dates>
 </vuln>

<vuln vid="ae132c6c-d716-11ed-956f-7054d21a9e2a">
 <topic>py-tensorflow -- denial of service vulnerability</topic>
 <affects>
 <package>
 <name>py37-tensorflow</name>
 <name>py38-tensorflow</name>
 <name>py39-tensorflow</name>
 <name>py310-tensorflow</name>
 <name>py311-tensorflow</name>
 <range><lt>2.8.4</lt></range>
 <range><ge>2.9.0</ge><lt>2.9.3</lt></range>
 <range><ge>2.10.0</ge><lt>2.10.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Kang Hong Jin, Neophytos Christou, 刘力源 and Pattarakrit Rattankul report:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-cqvq-fvhr-v6hc">
 Another instance of CVE-2022-35935, where `SobolSample` is vulnerable to a denial of service via assumed scalar inputs, was found and fixed.
 </blockquote>
 Pattarakrit Rattankul reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-xf83-q765-xm6m">
 Another instance of CVE-2022-35991, where `TensorListScatter` and `TensorListScatterV2` crash via non scalar inputs in`element_shape`, was found in eager mode and fixed.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-35935</cvename>
 <url>https://osv.dev/vulnerability/GHSA-cqvq-fvhr-v6hc</url>
 <cvename>CVE-2022-35991</cvename>
 <url>https://osv.dev/vulnerability/GHSA-xf83-q765-xm6m</url>
 </references>
 <dates>
 <discovery>2022-11-21</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="52311651-f100-4720-8c62-0887dad6d321">
 <topic>py-tensorflow -- unchecked argument causing crash</topic>
 <affects>
 <package>
 <name>py37-tensorflow</name>
 <name>py38-tensorflow</name>
 <name>py39-tensorflow</name>
 <name>py310-tensorflow</name>
 <name>py311-tensorflow</name>
 <range><lt>2.7.2</lt></range>
 <range><ge>2.8.0</ge><lt>2.8.1</lt></range>
 <range><ge>2.9.0</ge><lt>2.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Jingyi Shi reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-mgmh-g2v6-mqw5">
 The 'AvgPoolOp' function takes an argument `ksize` that must be positive but is not checked.
 A negative `ksize` can trigger a `CHECK` failure and crash the program.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-35941</cvename>
 <url>https://osv.dev/vulnerability/GHSA-mgmh-g2v6-mqw5</url>
 </references>
 <dates>
 <discovery>2022-09-16</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="951b513a-9f42-436d-888d-2162615d0fe4">
 <topic>py-pymatgen -- regular expression denial of service</topic>
 <affects>
 <package>
 <name>py37-pymatgen</name>
 <name>py38-pymatgen</name>
 <name>py39-pymatgen</name>
 <name>py310-pymatgen</name>
 <name>py311-pymatgen</name>
 <range><le>2022.9.21</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <blockquote cite="https://osv.dev/vulnerability/GHSA-5jqp-885w-xj32">
 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-42964</cvename>
 <url>https://osv.dev/vulnerability/GHSA-5jqp-885w-xj32</url>
 </references>
 <dates>
 <discovery>2022-11-10</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="e87a9326-dd35-49fc-b20b-f57cbebaae87">
 <topic>py-nicotine-plus -- Denial of service vulnerability</topic>
 <affects>
 <package>
 <name>py37-nicotine-plus</name>
 <name>py38-nicotine-plus</name>
 <name>py39-nicotine-plus</name>
 <name>py310-nicotine-plus</name>
 <name>py311-nicotine-plus</name>
 <range><lt>3.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 ztauras reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-p4v2-r99v-wjc2">
 Denial of service (DoS) vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-45848</cvename>
 <url>https://osv.dev/vulnerability/GHSA-p4v2-r99v-wjc2</url>
 </references>
 <dates>
 <discovery>2022-03-16</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="93db4f92-9997-4f4f-8614-3963d9e2b0ec">
 <topic>py-slixmpp -- incomplete SSL certificate validation</topic>
 <affects>
 <package>
 <name>py37-slixmpp</name>
 <name>py38-slixmpp</name>
 <name>py39-slixmpp</name>
 <name>py310-slixmpp</name>
 <name>py311-slixmpp</name>
 <range><lt>1.8.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <blockquote cite="https://osv.dev/vulnerability/GHSA-q6cq-m9gm-6q2f">
 Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-45197</cvename>
 <url>https://osv.dev/vulnerability/GHSA-q6cq-m9gm-6q2f</url>
 </references>
 <dates>
 <discovery>2022-12-25</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="b31f7029-817c-4c1f-b7d3-252de5283393">
 <topic>py-suds -- vulnerable to symlink attacks</topic>
 <affects>
 <package>
 <name>py37-suds</name>
 <name>py38-suds</name>
 <name>py39-suds</name>
 <name>py310-suds</name>
 <name>py311-suds</name>
 <range><lt>1.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 SUSE reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2013-32">
 cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2217</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2013-32</url>
 </references>
 <dates>
 <discovery>2013-09-23</discovery>
 <entry>2023-04-09</entry>
 <modified>2023-07-08</modified>
 </dates>
 </vuln>

<vuln vid="b692a49c-9ae7-4958-af21-cbf8f5b819ea">
 <topic>py-impacket -- multiple path traversal vulnerabilities</topic>
 <affects>
 <package>
 <name>py37-impacket</name>
 <name>py38-impacket</name>
 <name>py39-impacket</name>
 <name>py310-impacket</name>
 <name>py311-impacket</name>
 <range><ge>0.9.10</ge><lt>0.9.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 asolino reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-17">
 Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ directory traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow or an SSH authorized key.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-31800</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2021-17</url>
 <url>https://osv.dev/vulnerability/GHSA-mj63-64x7-57xf</url>
 </references>
 <dates>
 <discovery>2021-05-05</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="326b2f3e-6fc7-4661-955d-a772760db9cf">
 <topic>py-tflite -- buffer overflow vulnerability</topic>
 <affects>
 <package>
 <name>py37-tflite</name>
 <name>py38-tflite</name>
 <name>py39-tflite</name>
 <name>py310-tflite</name>
 <name>py311-tflite</name>
 <range><lt>2.8.4</lt></range>
 <range><ge>2.9.0</ge><lt>2.9.3</lt></range>
 <range><ge>2.10.0</ge><lt>2.10.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Thibaut Goetghebuer-Planchon reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-h6q3-vv32-2cq5">
 The reference kernel of the CONV_3D_TRANSPOSE TensorFlow Lite operator wrongly increments the data_ptr when adding the bias to the result.
 Instead of `data_ptr += num_channels;` it should be `data_ptr += output_num_channels;` as if the number of input channels is different than the number of output channels, the wrong result will be returned and a buffer overflow will occur if num_channels &gt; output_num_channels.
 An attacker can craft a model with a specific number of input channels in a way similar to the attached example script.
 It is then possible to write specific values through the bias of the layer outside the bounds of the buffer.
 This attack only works if the reference kernel resolver is used in the interpreter (i.e. `experimental_op_resolver_type=tf.lite.experimental.OpResolverType.BUILTIN_REF` is used).
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-41894</cvename>
 <url>https://osv.dev/vulnerability/GHSA-h6q3-vv32-2cq5</url>
 </references>
 <dates>
 <discovery>2022-11-21</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="d82bcd2b-5cd6-421c-8179-b3ff0231029f">
 <topic>py-tflite -- denial of service vulnerability</topic>
 <affects>
 <package>
 <name>py37-tflite</name>
 <name>py38-tflite</name>
 <name>py39-tflite</name>
 <name>py310-tflite</name>
 <name>py311-tflite</name>
 <range><lt>2.3.4</lt></range>
 <range><ge>2.4.0</ge><lt>2.4.3</lt></range>
 <range><ge>2.5.0</ge><lt>2.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Yakun Zhang of Baidu Security reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-wf5p-c75w-w3wh">
 An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-37689</cvename>
 <url>https://osv.dev/vulnerability/GHSA-wf5p-c75w-w3wh</url>
 </references>
 <dates>
 <discovery>2021-08-25</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="a0509648-65ce-4a1b-855e-520a75bd2549">
 <topic>py-cinder -- unauthorized data access</topic>
 <affects>
 <package>
 <name>py37-cinder</name>
 <name>py38-cinder</name>
 <name>py39-cinder</name>
 <name>py310-cinder</name>
 <name>py311-cinder</name>
 <range><lt>19.1.2</lt></range>
 <range><ge>20.0.0</ge><lt>20.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Utkarsh Gupta reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-7h75-hwxx-qpgc">
 An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0.
 By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-47951</cvename>
 <url>https://osv.dev/vulnerability/GHSA-7h75-hwxx-qpgc</url>
 </references>
 <dates>
 <discovery>2023-01-27</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="f4a94232-7864-4afb-bbf9-ff2dc8e288d1">
 <topic>py-cinder -- data leak</topic>
 <affects>
 <package>
 <name>py37-cinder</name>
 <name>py38-cinder</name>
 <name>py39-cinder</name>
 <name>py310-cinder</name>
 <name>py311-cinder</name>
 <range><le>12.0.9</le></range>
 <range><ge>13.0.0</ge><le>13.0.9</le></range>
 <range><ge>14.0.0</ge><le>14.3.1</le></range>
 <range><ge>15.0.0</ge><le>15.6.0</le></range>
 <range><ge>16.0.0</ge><le>16.4.2</le></range>
 <range><ge>17.0.0</ge><le>17.4.0</le></range>
 <range><ge>18.0.0</ge><le>18.2.1</le></range>
 <range><ge>19.0.0</ge><le>19.2.0</le></range>
 <range><ge>20.0.0</ge><le>20.1.0</le></range>
 <range><ge>21.0.0</ge><le>21.1.0</le></range>
 <range><ge>22.0.0</ge><le>22.0.0.0rc2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Duncan Thomas reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-qhch-g8qr-p497">
 The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3641</cvename>
 <url>https://osv.dev/vulnerability/GHSA-qhch-g8qr-p497</url>
 </references>
 <dates>
 <discovery>2022-05-17</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="02e51cb3-d7e4-11ed-9f7a-5404a68ad561">
 <topic>traefik -- Use of vulnerable Go modules net/http, net/textproto</topic>
 <affects>
 <package>
	<name>traefik</name>
	<range><lt>2.9.9_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://pkg.go.dev/vuln/GO-2023-1704">
	 HTTP and MIME header parsing can allocate large amounts
	 of memory, even when parsing small inputs, potentially
	 leading to a denial of service. Certain unusual patterns
	 of input data can cause the common function used to parse
	 HTTP and MIME headers to allocate substantially more
	 memory than required to hold the parsed headers. An
	 attacker can exploit this behavior to cause an HTTP
	 server to allocate large amounts of memory from a small
	 request, potentially leading to memory exhaustion and a
	 denial of service. With fix, header parsing now correctly
	 allocates only the memory required to hold parsed headers.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-24534</cvename>
 <url>https://www.cve.org/CVERecord?id=CVE-2023-24534</url>
 <cvename>CVE-2023-29013</cvename>
 <url>https://www.cve.org/CVERecord?id=CVE-2023-29013</url>
 </references>
 <dates>
 <discovery>2023-03-10</discovery>
 <entry>2023-04-07</entry>
 </dates>
 </vuln>

<vuln vid="f767d615-01db-47e9-b4ab-07bb8d3409fd">
 <topic>py39-cinder -- insecure-credentials flaw</topic>
 <affects>
 <package>
 <name>py39-cinder</name>
 <range><lt>14.1.0</lt></range>
 <range><ge>15.0.0</ge><lt>15.2.0</lt></range>
 <range><ge>16.0.0</ge><lt>15.1.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 OpenStack project reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2020-228">
 An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0.
 When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the ``connection_info`` element in all Block Storage v3 Attachments API calls containing that element.
 This flaw enables an end-user to create a volume, make an API call to show the attachment detail information, and retrieve a username and password that may be used to connect to another user's volume.
 Additionally, these credentials are valid for the ScaleIO or VxFlex OS Management API, should an attacker discover the Management API endpoint.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-10755</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2020-228</url>
 </references>
 <dates>
 <discovery>2020-06-10</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="e5d117b3-2153-4129-81ed-42b0221afa78">
 <topic>py39-OWSLib -- arbitrary file read vulnerability</topic>
 <affects>
 <package>
 <name>py39-OWSLib</name>
 <range><lt>0.28.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Jorge Rosillo reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-8h9c-r582-mggc">
 OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution for `lxml`, and could lead to arbitrary file reads from an attacker-controlled XML payload.
 This affects all XML parsing in the codebase.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-27476</cvename>
 <url>https://osv.dev/vulnerability/GHSA-8h9c-r582-mggc</url>
 </references>
 <dates>
 <discovery>2023-03-07</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="17083017-d993-43eb-8aaf-7138f4486d1c">
 <topic>py39-unicorn -- sandbox escape and arbitrary code execution vulnerability</topic>
 <affects>
 <package>
 <name>py39-unicorn</name>
 <range><lt>2.0.0rc1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 jwang-a reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-868">
 An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5.
 It allows local attackers to escape the sandbox.
 An attacker must first obtain the ability to execute crafted code in the target sandbox in order to exploit this vulnerability.
 The specific flaw exists within the virtual memory manager.
 The issue results from the faulty comparison of GVA and GPA while calling uc_mem_map_ptr to free part of a claimed memory block.
 An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code on the host machine.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44078</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2021-868</url>
 </references>
 <dates>
 <discovery>2021-12-26</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="43e9ffd4-d6e0-11ed-956f-7054d21a9e2a">
 <topic>py39-pycares -- domain hijacking vulnerability</topic>
 <affects>
 <package>
 <name>py39-pycares</name>
 <range><lt>4.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Philipp Jeitner and Haya Shulman report:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-c58j-88f5-h53f">
 A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking.
 The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-3672</cvename>
 <url>https://osv.dev/vulnerability/GHSA-c58j-88f5-h53f</url>
 </references>
 <dates>
 <discovery>2021-06-11</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="1b38aec4-4149-4c7d-851c-3c4de3a1fbd0">
 <topic>py39-setuptools -- denial of service vulnerability</topic>
 <affects>
 <package>
 <name>py39-setuptools</name>
 <range><lt>44.1.1_1</lt></range>
 <range><ge>57.0.0</ge><lt>58.5.3_3</lt></range>
 <range><ge>62.1.0</ge><lt>63.1.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 SCH227 reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579">
 Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects.
 Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in `package_index`.
 This has been patched in version 65.5.1. The patch backported to the revision 63.1.0_1.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-40897</cvename>
 <url>https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579</url>
 </references>
 <dates>
 <discovery>2022-12-23</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="187ab98e-2953-4495-b379-4060bd4b75ee">
 <topic>py27-setuptools44 -- denial of service vulnerability</topic>
 <affects>
 <package>
 <name>py27-setuptools44</name>
 <range><lt>44.1.1_1</lt></range>
 <range><ge>57.0.0</ge><lt>58.5.3_3</lt></range>
 <range><ge>62.1.0</ge><lt>63.1.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 SCH227 reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579">
 Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects.
 Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in `package_index`.
 This has been patched in version 65.5.1. The patch backported to the revision 44.1.1_1.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-40897</cvename>
 <url>https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579</url>
 </references>
 <dates>
 <discovery>2022-12-23</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="24da150a-33e0-4fee-b4ee-2c6b377d3395">
 <topic>py39-setuptools58 -- denial of service vulnerability</topic>
 <affects>
 <package>
 <name>py39-setuptools58</name>
 <range><lt>44.1.1_1</lt></range>
 <range><ge>57.0.0</ge><lt>58.5.3_3</lt></range>
 <range><ge>62.1.0</ge><lt>63.1.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 SCH227 reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579">
 Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects.
 Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in `package_index`.
 This has been patched in version 65.5.1. The patch backported to the revision 58.5.3_3.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-40897</cvename>
 <url>https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579</url>
 </references>
 <dates>
 <discovery>2022-12-23</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="15dae5cc-9ee6-4577-a93e-2ab57780e707">
 <topic>py39-sentry-sdk -- sensitive cookies leak</topic>
 <affects>
 <package>
 <name>py39-sentry-sdk</name>
 <range><lt>1.14.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Tom Wolters reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-29pr-6jr8-q5jm">
 When using the Django integration of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the session cookie to Sentry.
 These sensitive cookies could then be used by someone with access to your Sentry issues to impersonate or escalate their privileges within your application.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28117</cvename>
 <url>https://osv.dev/vulnerability/GHSA-29pr-6jr8-q5jm</url>
 </references>
 <dates>
 <discovery>2023-03-21</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="28a37df6-ba1a-4eed-bb64-623fc8e8dfd0">
 <topic>py39-py -- Regular expression Denial of Service vulnerability</topic>
 <affects>
 <package>
 <name>py39-py</name>
 <range><le>1.11.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 SCH227 reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2022-42969">
 The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-42969</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2022-42969</url>
 <url>https://osv.dev/vulnerability/GHSA-w596-4wvx-j9j6</url>
 </references>
 <dates>
 <discovery>2022-11-04</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="845f8430-d0ee-4134-ae35-480a3e139b8a">
 <topic>py39-joblib -- arbitrary code execution</topic>
 <affects>
 <package>
 <name>py39-joblib</name>
 <range><lt>1.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 jimlinntu reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2022-288">
 The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-21797</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2022-288</url>
 <url>https://osv.dev/vulnerability/GHSA-6hrg-qmvc-2xh8</url>
 </references>
 <dates>
 <discovery>2022-09-26</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="de970aef-d60e-466b-8e30-1ae945a047f1">
 <topic>py39-configobj -- vulnerable to Regular Expression Denial of Service</topic>
 <affects>
 <package>
 <name>py39-configobj</name>
 <range><le>5.0.6_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 DarkTinia reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-c33w-24p9-8m24">
 All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)$(.*)$.
 **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-26112</cvename>
 <url>https://osv.dev/vulnerability/GHSA-c33w-24p9-8m24</url>
 </references>
 <dates>
 <discovery>2023-04-03</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="0a38a0d9-757f-4ac3-9561-b439e933dfa9">
 <topic>py39-celery -- command injection vulnerability</topic>
 <affects>
 <package>
 <name>py39-celery</name>
 <range><lt>5.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Snyk reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2021-858">
 This affects the package celery before 5.2.2.
 It by default trusts the messages and metadata stored in backends (result stores).
 When reading task metadata from the backend, the data is deserialized.
 Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-23727</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2021-858</url>
 <url>https://osv.dev/vulnerability/GHSA-q4xr-rc97-m4xx</url>
 </references>
 <dates>
 <discovery>2021-12-09</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="8aa6340d-e7c6-41e0-b2a3-3c9e9930312a">
 <topic>py39-redis -- can send response data to the client of an unrelated request</topic>
 <affects>
 <package>
 <name>py39-redis</name>
 <range><ge>4.4.0</ge><lt>4.4.4</lt></range>
 <range><ge>4.5.0</ge><lt>4.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 drago-balto reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-8fww-64cx-x8p5">
 redis-py through 4.5.3 and 4.4.3 leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a non-pipeline operation), and can send response data to the client of an unrelated request.
 NOTE: this issue exists because of an incomplete fix for CVE-2023-28858.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28859</cvename>
 <url>https://osv.dev/vulnerability/GHSA-8fww-64cx-x8p5</url>
 </references>
 <dates>
 <discovery>2023-03-26</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="3f6d6181-79b2-4d33-bb1e-5d3f9df0c1d1">
 <topic>py39-redis -- can send response data to the client of an unrelated request</topic>
 <affects>
 <package>
 <name>py39-redis</name>
 <range><lt>4.3.6</lt></range>
 <range><ge>4.4.0</ge><lt>4.4.3</lt></range>
 <range><ge>4.5.0</ge><lt>4.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 drago-balto reports:
 <blockquote cite="https://osv.dev/vulnerability/GHSA-24wv-mv5m-xv4h">
 redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner.
 The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but [are believed to be incomplete](https://github.com/redis/redis-py/issues/2665).
 CVE-2023-28859 has been assigned the issues caused by the incomplete fixes.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28858</cvename>
 <url>https://osv.dev/vulnerability/GHSA-24wv-mv5m-xv4h</url>
 </references>
 <dates>
 <discovery>2023-03-26</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="d2293e22-4390-42c2-a323-34cca2066000">
 <topic>py39-sqlalchemy12 -- multiple SQL Injection vulnerabilities</topic>
 <affects>
 <package>
 <name>py39-sqlalchemy12</name>
 <range><lt>1.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 21k reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-123">
 SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
 </blockquote>
 nosecurity reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-124">
 SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-7548</cvename>
 <cvename>CVE-2019-7164</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2019-123</url>
 <url>https://osv.dev/vulnerability/PYSEC-2019-124</url>
 <url>https://osv.dev/vulnerability/GHSA-38fc-9xqv-7f7q</url>
 <url>https://osv.dev/vulnerability/GHSA-887w-45rq-vxgf</url>
 </references>
 <dates>
 <discovery>2019-02-06</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="8ccff771-ceca-43a0-85ad-3e595e73b425">
 <topic>py39-sqlalchemy11 -- multiple SQL Injection vulnerabilities</topic>
 <affects>
 <package>
 <name>py39-sqlalchemy11</name>
 <range><lt>1.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 21k reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-123">
 SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
 </blockquote>
 nosecurity reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-124">
 SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-7164</cvename>
 <cvename>CVE-2019-7548</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2019-123</url>
 <url>https://osv.dev/vulnerability/PYSEC-2019-124</url>
 <url>https://osv.dev/vulnerability/GHSA-38fc-9xqv-7f7q</url>
 <url>https://osv.dev/vulnerability/GHSA-887w-45rq-vxgf</url>
 </references>
 <dates>
 <discovery>2019-02-06</discovery>
 <entry>2023-04-09</entry>
 </dates>
 </vuln>

<vuln vid="e4181981-ccf1-11ed-956f-7054d21a9e2a">
 <topic>py39-sqlalchemy10 -- multiple SQL Injection vulnerabilities</topic>
 <affects>
 <package>
 <name>py39-sqlalchemy10</name>
 <range><lt>1.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 21k reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-123">
 SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
 </blockquote>
 nosecurity reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-124">
 SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-7164</cvename>
 <cvename>CVE-2019-7548</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2019-123</url>
 <url>https://osv.dev/vulnerability/PYSEC-2019-124</url>
 <url>https://osv.dev/vulnerability/GHSA-887w-45rq-vxgf</url>
 <url>https://osv.dev/vulnerability/GHSA-38fc-9xqv-7f7q</url>
 </references>
 <dates>
 <discovery>2019-02-06</discovery>
 <entry>2023-03-28</entry>
 </dates>
 </vuln>

<vuln vid="c13a8c17-cbeb-11ed-956f-7054d21a9e2a">
 <topic>py39-lmdb -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>py39-lmdb</name>
 <range><lt>0.98</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 TeamSeri0us reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-236">
 An issue was discovered in py-lmdb 0.97. For certain values of md_flags, mdb_node_add does not properly set up a memcpy destination, leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.
 </blockquote>
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-237">
 An issue was discovered in py-lmdb 0.97. For certain values of mp_flags, mdb_page_touch does not properly set up mc-&gt;mc_pg[mc-&gt;top], leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.
 </blockquote>
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-238">
 An issue was discovered in py-lmdb 0.97. mdb_node_del does not validate a memmove in the case of an unexpected node-&gt;mn_hi, leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.
 </blockquote>
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-239">
 An issue was discovered in py-lmdb 0.97. For certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invalid write operation within mdb_xcursor_init1. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.
 </blockquote>
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2019-240">
 An issue was discovered in py-lmdb 0.97. There is a divide-by-zero error in the function mdb_env_open2 if mdb_env_read_header obtains a zero value for a certain size field. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-16224</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2019-236</url>
 <cvename>CVE-2019-16225</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2019-237</url>
 <cvename>CVE-2019-16226</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2019-238</url>
 <cvename>CVE-2019-16227</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2019-239</url>
 <cvename>CVE-2019-16228</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2019-240</url>
 </references>
 <dates>
 <discovery>2019-09-11</discovery>
 <entry>2023-03-26</entry>
 </dates>
 </vuln>

<vuln vid="2991178f-cbe8-11ed-956f-7054d21a9e2a">
 <topic>py39-Elixir -- weak use of cryptography</topic>
 <affects>
 <package>
 <name>py39-Elixir</name>
 <range><le>0.8.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Red Hat Security Response Team reports:
 <blockquote cite="https://osv.dev/vulnerability/PYSEC-2012-13">
 Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique initialization vector (IV), which makes it easier for context-dependent users to obtain sensitive information and decrypt the database.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2146</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2012-13</url>
 </references>
 <dates>
 <discovery>2012-08-26</discovery>
 <entry>2023-03-26</entry>
 </dates>
 </vuln>

<vuln vid="70d0d2ec-cb62-11ed-956f-7054d21a9e2a">
 <topic>py39-rencode -- infinite loop that could lead to Denial of Service</topic>
 <affects>
 <package>
 <name>py39-rencode</name>
 <range><le>1.0.6_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 NIST reports:
 <blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2021-40839">
 The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-40839</cvename>
 <url>https://osv.dev/vulnerability/PYSEC-2021-345</url>
 <url>https://osv.dev/vulnerability/GHSA-gh8j-2pgf-x458</url>
 </references>
 <dates>
 <discovery>2021-09-09</discovery>
 <entry>2023-03-25</entry>
 <modified>2023-03-26</modified>
 </dates>
 </vuln>

<vuln vid="3d5581ff-d388-11ed-8581-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>112.0.5615.49</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>112.0.5615.49</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html">
	 This update includes 16 security fixes:
	 <ul>
	 <li>[1414018] High CVE-2023-1810: Heap buffer overflow in Visuals. Reported by Weipeng Jiang (@Krace) of VRI on 2023-02-08</li>
	 <li>[1420510] High CVE-2023-1811: Use after free in Frames. Reported by Thomas Orlita on 2023-03-01</li>
	 <li>[1418224] Medium CVE-2023-1812: Out of bounds memory access in DOM Bindings. Reported by Shijiang Yu on 2023-02-22</li>
	 <li>[1423258] Medium CVE-2023-1813: Inappropriate implementation in Extensions. Reported by Axel Chong on 2023-03-10</li>
	 <li>[1417325] Medium CVE-2023-1814: Insufficient validation of untrusted input in Safe Browsing. Reported by Young Min Kim (@ylemkimon), CompSec Lab at Seoul National University on 2023-02-18</li>
	 <li>[1278708] Medium CVE-2023-1815: Use after free in Networking APIs. Reported by DDV_UA on 2021-12-10</li>
	 <li>[1413919] Medium CVE-2023-1816: Incorrect security UI in Picture In Picture. Reported by NDevTK on 2023-02-08</li>
	 <li>[1418061] Medium CVE-2023-1817: Insufficient policy enforcement in Intents. Reported by Axel Chong on 2023-02-22</li>
	 <li>[1223346] Medium CVE-2023-1818: Use after free in Vulkan. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research, Eric Lawrence, Microsoft, Patrick Walker (@HomeSen), and Kirtikumar Anandrao Ramchandani on 2021-06-24</li>
	 <li>[1406588] Medium CVE-2023-1819: Out of bounds read in Accessibility. Reported by Microsoft Edge Team on 2023-01-12</li>
	 <li>[1408120] Medium CVE-2023-1820: Heap buffer overflow in Browser History. Reported by raven at KunLun lab on 2023-01-17</li>
	 <li>[1413618] Low CVE-2023-1821: Inappropriate implementation in WebShare. Reported by Axel Chong on 2023-02-07</li>
	 <li>[1066555] Low CVE-2023-1822: Incorrect security UI in Navigation. Reported by 강우진 on 2020-04-01</li>
	 <li>[1406900] Low CVE-2023-1823: Inappropriate implementation in FedCM. Reported by Jasper Rebane (popstonia) on 2023-01-13</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-1810</cvename>
 <cvename>CVE-2023-1811</cvename>
 <cvename>CVE-2023-1812</cvename>
 <cvename>CVE-2023-1813</cvename>
 <cvename>CVE-2023-1814</cvename>
 <cvename>CVE-2023-1815</cvename>
 <cvename>CVE-2023-1816</cvename>
 <cvename>CVE-2023-1817</cvename>
 <cvename>CVE-2023-1818</cvename>
 <cvename>CVE-2023-1819</cvename>
 <cvename>CVE-2023-1820</cvename>
 <cvename>CVE-2023-1821</cvename>
 <cvename>CVE-2023-1822</cvename>
 <cvename>CVE-2023-1823</cvename>
 <url>https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2023-04-05</discovery>
 <entry>2023-04-05</entry>
 </dates>
 </vuln>

<vuln vid="348ee234-d541-11ed-ad86-a134a566f1e6">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go119</name>
	<range><lt>1.19.8</lt></range>
 </package>
 <package>
	<name>go120</name>
	<range><lt>1.20.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/59180">
	 go/parser: infinite loop in parsing
	 Calling any of the Parse functions on Go source code
	 which contains //line directives with very large line
	 numbers can cause an infinite loop due to integer
	 overflow.
	</blockquote>
	<blockquote cite="https://go.dev/issue/59234">
	 html/template: backticks not treated as string delimiters
	 Templates did not properly consider backticks (`) as
	 Javascript string delimiters, and as such did not escape
	 them as expected. Backticks are used, since ES6, for JS
	 template literals. If a template contained a Go template
	 action within a Javascript template literal, the contents
	 of the action could be used to terminate the literal,
	 injecting arbitrary Javascript code into the Go template.
	 As ES6 template literals are rather complex, and
	 themselves can do string interpolation, we've decided
	 to simply disallow Go template actions from being used
	 inside of them (e.g. "var a = {{.}}"), since there is no
	 obviously safe way to allow this behavior. This takes the
	 same approach as github.com/google/safehtml.
	 Template.Parse will now return an Error when it encounters
	 templates like this, with a currently unexported ErrorCode
	 with a value of 12. This ErrorCode will be exported in the
	 next major release.
	</blockquote>
	<blockquote cite="https://go.dev/issue/58975">
	 net/http, net/textproto: denial of service from excessive
	 memory allocation
	 HTTP and MIME header parsing could allocate large
	 amounts of memory, even when parsing small inputs.
	 Certain unusual patterns of input data could cause the
	 common function used to parse HTTP and MIME headers to
	 allocate substantially more memory than required to hold
	 the parsed headers. An attacker can exploit this
	 behavior to cause an HTTP server to allocate large
	 amounts of memory from a small request, potentially
	 leading to memory exhaustion and a denial of service.
	 Header parsing now correctly allocates only the memory
	 required to hold parsed headers.
	</blockquote>
	<blockquote cite="https://go.dev/issue/59153">
	 net/http, net/textproto, mime/multipart: denial of service
	 from excessive resource consumption
	 Multipart form parsing can consume large amounts of CPU
	 and memory when processing form inputs containing very
	 large numbers of parts. This stems from several causes:
	 mime/multipart.Reader.ReadForm limits the total memory a
	 parsed multipart form can consume. ReadForm could
	 undercount the amount of memory consumed, leading it to
	 accept larger inputs than intended. Limiting total
	 memory does not account for increased pressure on the
	 garbage collector from large numbers of small
	 allocations in forms with many parts. ReadForm could
	 allocate a large number of short-lived buffers, further
	 increasing pressure on the garbage collector. The
	 combination of these factors can permit an attacker to
	 cause an program that parses multipart forms to consume
	 large amounts of CPU and memory, potentially resulting
	 in a denial of service. This affects programs that use
	 mime/multipart.Reader.ReadForm, as well as form parsing
	 in the net/http package with the Request methods
	 FormFile, FormValue, ParseMultipartForm, and
	 PostFormValue. ReadForm now does a better job of
	 estimating the memory consumption of parsed forms, and
	 performs many fewer short-lived allocations. In
	 addition, mime/multipart.Reader now imposes the
	 following limits on the size of parsed forms: Forms
	 parsed with ReadForm may contain no more than 1000
	 parts. This limit may be adjusted with the environment
	 variable GODEBUG=multipartmaxparts=. Form parts parsed
	 with NextPart and NextRawPart may contain no more than
	 10,000 header fields. In addition, forms parsed with
	 ReadForm may contain no more than 10,000 header fields
	 across all parts. This limit may be adjusted with the
	 environment variable GODEBUG=multipartmaxheaders=.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-24537</cvename>
 <cvename>CVE-2023-24538</cvename>
 <cvename>CVE-2023-24534</cvename>
 <cvename>CVE-2023-24536</cvename>
 <url>https://groups.google.com/g/golang-dev/c/P-sOFU28bj0/m/QE_cqf22AgAJ</url>
 </references>
 <dates>
 <discovery>2023-04-04</discovery>
 <entry>2023-04-07</entry>
 </dates>
 </vuln>

<vuln vid="e86b8e4d-d551-11ed-8d1e-005056a311d1">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba416</name>
	<range><lt>4.16.10</lt></range>
 </package>
 <package>
	<name>samba417</name>
	<range><lt>4.17.7</lt></range>
 </package>
 <package>
	<name>samba418</name>
	<range><lt>4.18.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="https://www.samba.org/samba/security/CVE-2023-0225.html">
	 An incomplete access check on dnsHostName allows
	 authenticated but otherwise unprivileged users to
	 delete this attribute from any object in the directory.
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2023-0922.html">
	 The Samba AD DC administration tool, when operating
	 against a remote LDAP server, will by default send
	 new or reset passwords over a signed-only connection. 
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2023-0614.html">
	 The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for
	 CVE-2018-10919 Confidential attribute disclosure via
	 LDAP filters was insufficient and an attacker may be
	 able to obtain confidential BitLocker recovery keys
	 from a Samba AD DC.
	 Installations with such secrets in their Samba AD
	 should assume they have been obtained and need replacing.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0225</cvename>
 <url>https://www.samba.org/samba/security/CVE-2023-0225.html</url>
 <cvename>CVE-2023-0922</cvename>
 <url>https://www.samba.org/samba/security/CVE-2023-0922.html</url>
 <cvename>CVE-2023-0614</cvename>
 <url>https://www.samba.org/samba/security/CVE-2023-0614.html</url>
 </references>
 <dates>
 <discovery>2023-03-29</discovery>
 <entry>2023-04-07</entry>
 </dates>
 </vuln>

<vuln vid="faf7c1d0-f5bb-47b4-a6a8-ef57317b9766">
 <topic>ffmpeg -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ffmpeg</name>
	<range><ge>5.1,1</ge><lt>5.1.3,1</lt></range>
	<range><ge>5.0,1</ge><lt>5.0.3,1</lt></range>
	<range><lt>4.4.4,1</lt></range>
 </package>
 <package>
	<name>ffmpeg4</name>
	<range><lt>4.4.4</lt></range>
 </package>
 <package>
	<name>avidemux</name>
	
	<range><le>2.9</le></range>
 </package>
 <package>
	<name>emby-server</name>
	<name>emby-server-devel</name>
	
	
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>handbrake</name>
	
	<range><lt>1.6.0</lt></range>
 </package>
 <package>
	<name>mythtv</name>
	<name>mythtv-frontend</name>
	
	<range><le>33.0,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2022-3109">
	 An issue was discovered in the FFmpeg package, where
	 vp3_decode_frame in libavcodec/vp3.c lacks check of the
	 return value of av_malloc() and will cause a null pointer
	 dereference, impacting availability.
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2022-3341">
	 A null pointer dereference issue was discovered in
	 'FFmpeg' in decode_main_header() function of
	 libavformat/nutdec.c file. The flaw occurs because the
	 function lacks check of the return value of
	 avformat_new_stream() and triggers the null pointer
	 dereference error, causing an application to crash.
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2022-3964">
	 A vulnerability classified as problematic has been found
	 in ffmpeg. This affects an unknown part of the file
	 libavcodec/rpzaenc.c of the component QuickTime RPZA Video
	 Encoder. The manipulation of the argument y_size leads to
	 out-of-bounds read. It is possible to initiate the attack
	 remotely. The name of the patch is
	 92f9b28ed84a77138105475beba16c146bdaf984. It is recommended
	 to apply a patch to fix this issue. The associated
	 identifier of this vulnerability is VDB-213543.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3109</cvename>
 <cvename>CVE-2022-3341</cvename>
 <cvename>CVE-2022-3964</cvename>
 <url>https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/2cdddcd6ec90c7a248ffe792d85faa4d89eab9f7</url>
 <url>https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/481e81be1271ac9a0124ee615700390c2371bd89</url>
 <url>https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/1eb002596e3761d88de4aeea3158692b82fb6307</url>
 <url>https://ffmpeg.org/security.html</url>
 </references>
 <dates>
 <discovery>2022-11-12</discovery>
 <entry>2023-04-07</entry>
 <modified>2023-04-10</modified>
 </dates>
 </vuln>

<vuln vid="466ba8bd-d033-11ed-addf-080027eda32c">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki135</name>
	<range><lt>1.35.10</lt></range>
 </package>
 <package>
	<name>mediawiki138</name>
	<range><lt>1.38.6</lt></range>
 </package>
 <package>
	<name>mediawiki139</name>
	<range><lt>1.39.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawikwi reports:
	<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/6UQBHI5FWLATD7QO7DI4YS54U7XSSLAN/">
	 (T285159, CVE-2023-PENDING) SECURITY: X-Forwarded-For header allows
	 brute-forcing autoblocked IP addresses.
	 (T326946, CVE-2020-36649) SECURITY: Bundled PapaParse copy in
	 VisualEditor has known ReDos.
	 (T330086, CVE-2023-PENDING) SECURITY: OATHAuth allows replay attacks when
	 MediaWiki is configured without ObjectCache; Insecure Default Configuration.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-36649</cvename>
 <url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/6UQBHI5FWLATD7QO7DI4YS54U7XSSLAN/</url>
 </references>
 <dates>
 <discovery>2020-04-02</discovery>
 <entry>2023-04-01</entry>
 </dates>
 </vuln>

<vuln vid="54006796-cf7b-11ed-a5d5-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>15.10.0</ge><lt>15.10.1</lt></range>
	<range><ge>15.9.0</ge><lt>15.9.4</lt></range>
	<range><ge>8.1</ge><lt>15.8.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/">
	 Cross-site scripting in "Maximum page reached" page
	 Private project guests can read new changes using a fork
	 Mirror repository error reveals password in Settings UI
	 DOS and high resource consumption of Prometheus server through abuse of Prometheus integration proxy endpoint
	 Unauthenticated users can view Environment names from public projects limited to project members only
	 Copying information to the clipboard could lead to the execution of unexpected commands
	 Maintainer can leak masked webhook secrets by adding a new parameter to the webhook URL
	 Arbitrary HTML injection possible when :soft_email_confirmation feature flag is enabled in the latest release
	 Framing of arbitrary content (leading to open redirects) on any page allowing user controlled markdown
	 MR for security reports are available to everyone
	 API timeout when searching for group issues
	 Unauthorised user can add child epics linked to victim's epic in an unrelated group
	 GitLab search allows to leak internal notes
	 Ambiguous branch name exploitation in GitLab
	 Improper permissions checks for moving an issue
	 Private project branches names can be leaked through a fork
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3513</cvename>
 <cvename>CVE-2023-0485</cvename>
 <cvename>CVE-2023-1098</cvename>
 <cvename>CVE-2023-1733</cvename>
 <cvename>CVE-2023-0319</cvename>
 <cvename>CVE-2023-1708</cvename>
 <cvename>CVE-2023-0838</cvename>
 <cvename>CVE-2023-0523</cvename>
 <cvename>CVE-2023-0155</cvename>
 <cvename>CVE-2023-1167</cvename>
 <cvename>CVE-2023-1417</cvename>
 <cvename>CVE-2023-1710</cvename>
 <cvename>CVE-2023-0450</cvename>
 <cvename>CVE-2023-1071</cvename>
 <cvename>CVE-2022-3375</cvename>
 <url>https://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/</url>
 </references>
 <dates>
 <discovery>2023-03-30</discovery>
 <entry>2023-03-31</entry>
 </dates>
 </vuln>

<vuln vid="6bd2773c-cf1a-11ed-bd44-080027f5fec9">
 <topic>rubygem-time -- ReDoS vulnerability</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>2.7.0,1</ge><lt>2.7.8,1</lt></range>
	<range><ge>3.0.0,1</ge><lt>3.0.6,1</lt></range>
	<range><ge>3.1.0,1</ge><lt>3.1.4,1</lt></range>
	<range><ge>3.2.0.p1,1</ge><lt>3.2.2,1</lt></range>
 </package>
 <package>
	<name>ruby27</name>
	<range><ge>2.7.0,1</ge><lt>2.7.8,1</lt></range>
 </package>
 <package>
	<name>ruby30</name>
	<range><ge>3.0.0,1</ge><lt>3.0.6,1</lt></range>
 </package>
 <package>
	<name>ruby31</name>
	<range><ge>3.1.0,1</ge><lt>3.1.4,1</lt></range>
 </package>
 <package>
	<name>ruby32</name>
	<range><ge>3.2.0.p1,1</ge><lt>3.2.2,1</lt></range>
 </package>
 <package>
	<name>rubygem-time</name>
	<range><lt>0.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ooooooo_q reports:
	<blockquote cite="https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/">
	 
	 The Time parser mishandles invalid strings that have
	 specific characters. It causes an increase in execution
	 time for parsing strings to Time objects.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28756</cvename>
 <url>https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/</url>
 </references>
 <dates>
 <discovery>2023-03-30</discovery>
 <entry>2023-03-30</entry>
 </dates>
 </vuln>

<vuln vid="9b60bba1-cf18-11ed-bd44-080027f5fec9">
 <topic>rubygem-uri -- ReDoS vulnerability</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>2.7.0,1</ge><lt>2.7.8,1</lt></range>
	<range><ge>3.0.0,1</ge><lt>3.0.6,1</lt></range>
	<range><ge>3.1.0,1</ge><lt>3.1.4,1</lt></range>
	<range><ge>3.2.0.p1,1</ge><lt>3.2.2,1</lt></range>
 </package>
 <package>
	<name>ruby27</name>
	<range><ge>2.7.0,1</ge><lt>2.7.8,1</lt></range>
 </package>
 <package>
	<name>ruby30</name>
	<range><ge>3.0.0,1</ge><lt>3.0.6,1</lt></range>
 </package>
 <package>
	<name>ruby31</name>
	<range><ge>3.1.0,1</ge><lt>3.1.4,1</lt></range>
 </package>
 <package>
	<name>ruby32</name>
	<range><ge>3.2.0.p1,1</ge><lt>3.2.2,1</lt></range>
 </package>
 <package>
	<name>rubygem-uri</name>
	<range><lt>0.12.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dominic Couture reports:
	<blockquote cite="https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/">
	 
	 A ReDoS issue was discovered in the URI component. The URI
	 parser mishandles invalid URLs that have specific
	 characters. It causes an increase in execution time for
	 parsing strings to URI objects.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28755</cvename>
 <url>https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/</url>
 </references>
 <dates>
 <discovery>2023-03-28</discovery>
 <entry>2023-03-30</entry>
 </dates>
 </vuln>

<vuln vid="dc33795f-ced7-11ed-b1fe-6805ca2fa271">
 <topic>powerdns-recursor -- denial of service</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><lt>4.8.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://blog.powerdns.com/2023/03/29/security-advisory-2023-02-for-powerdns-recursor-up-to-and-including-4-6-5-4-7-4-and-4-8-3/">
	 PowerDNS Security Advisory 2023-02: Deterred spoofing attempts
	 can lead to authoritative servers being marked unavailable
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-26437</cvename>
 <url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-02.html</url>
 </references>
 <dates>
 <discovery>2023-03-29</discovery>
 <entry>2023-03-30</entry>
 </dates>
 </vuln>

<vuln vid="96d84238-b500-490b-b6aa-2b77090a0410">
 <topic>xorg-server -- Overlay Window Use-After-Free</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<name>xephyr</name>
	<name>xorg-vfbserver</name>
	<range><lt>21.1.8,1</lt></range>
 </package>
 <package>
	<name>xorg-nestserver</name>
	<range><lt>21.1.8,2</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><ge>23.0.0,1</ge><lt>23.1.1,1</lt></range>
	<range><lt>22.1.9,1</lt></range>
 </package>
 <package>
	<name>xwayland-devel</name>
	<range><lt>21.0.99.1.439</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The X.Org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2023-March/003374.html">
	 <ul>
	 <li>ZDI-CAN-19866/CVE-2023-1393: X.Org Server Overlay Window Use-After-Free
	 Local Privilege Escalation Vulnerability

If a client explicitly destroys the compositor overlay window (aka COW),
	 the Xserver would leave a dangling pointer to that window in the CompScreen
	 structure, which will trigger a use-after-free later.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.x.org/archives/xorg-announce/2023-March/003374.html</url>
 <cvename>CVE-2023-1393</cvename>
 </references>
 <dates>
 <discovery>2023-03-29</discovery>
 <entry>2023-03-29</entry>
 </dates>
 </vuln>

<vuln vid="425b9538-ce5f-11ed-ade3-d4c9ef517024">
 <topic>OpenSSL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.1.1t,1_2</lt></range>
 </package>
 <package>
	<name>openssl30</name>
	<range><lt>3.0.8_2</lt></range>
 </package>
 <package>
	<name>openssl31</name>
	<range><lt>3.1.0_2</lt></range>
 </package>
 <package>
	<name>openssl-quic</name>
	<range><lt>3.0.8_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20230328.txt">
	 Severity: low
	 Applications that use a non-default option when verifying certificates may be
	 vulnerable to an attack from a malicious CA to circumvent certain checks.
	 The function X509_VERIFY_PARAM_add0_policy() is documented to
	 implicitly enable the certificate policy check when doing certificate
	 verification. However the implementation of the function does not
	 enable the check which allows certificates with invalid or incorrect
	 policies to pass the certificate verification.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0465</cvename>
 <cvename>CVE-2023-0466</cvename>
 <url>https://www.openssl.org/news/secadv/20230328.txt</url>
 </references>
 <dates>
 <discovery>2023-03-28</discovery>
 <entry>2023-03-29</entry>
 </dates>
 </vuln>

<vuln vid="955eb3cc-ce0b-11ed-825f-6c3be5272acd">
 <topic>Grafana -- Stored XSS in Graphite FunctionDescription tooltip</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><lt>8.5.22</lt></range>
	<range><ge>9.0.0</ge><lt>9.2.15</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.11</lt></range>
	<range><ge>9.4.0</ge><lt>9.4.7</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><lt>8.5.22</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><lt>9.2.15</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.11</lt></range>
	<range><ge>9.4.0</ge><lt>9.4.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2023/03/22/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-1410/">
	 When a user adds a Graphite data source, they can then use the data source
	 in a dashboard. This capability contains a feature to use Functions. Once
	 a function is selected, a small tooltip appears when hovering over the name
	 of the function. This tooltip allows you to delete the selected Function
	 from your query or show the Function Description. However, no sanitization
	 is done when adding this description to the DOM.
	 Since it is not uncommon to connect to public data sources, an attacker
	 could host a Graphite instance with modified Function Descriptions containing
	 XSS payloads. When the victim uses it in a query and accidentally hovers
	 over the Function Description, an attacker-controlled XSS payload
	 will be executed.
	 The severity of this vulnerability is of CVSSv3.1 5.7 Medium
	 (CVSS: AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N (5.7)).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-1410</cvename>
 <url>https://grafana.com/security/security-advisories/cve-2023-1410/</url>
 </references>
 <dates>
 <discovery>2023-03-14</discovery>
 <entry>2023-03-29</entry>
 </dates>
 </vuln>

<vuln vid="5b0ae405-cdc7-11ed-bb39-901b0e9408dc">
 <topic>Matrix clients -- Prototype pollution in matrix-js-sdk</topic>
 <affects>
 <package>
	<name>element-web</name>
	<range><lt>1.11.26</lt></range>
 </package>
 <package>
	<name>cinny</name>
	<range><le>2.2.4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0">
	 Today we are issuing security releases of matrix-js-sdk and matrix-react-sdk
	 to patch a pair of High severity vulnerabilities (CVE-2023-28427 /
	 GHSA-mwq8-fjpf-c2gr for matrix-js-sdk and CVE-2023-28103 / GHSA-6g43-88cp-w5gv
	 for matrix-react-sdk).
	 The issues involve prototype pollution via events containing special strings
	 in key locations, which can temporarily disrupt normal functioning of matrix-js-sdk
	 and matrix-react-sdk, potentially impacting the consumer's ability to process data
	 safely.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28103</cvename>
 <cvename>CVE-2023-28427</cvename>
 <url>https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0</url>
 </references>
 <dates>
 <discovery>2023-03-28</discovery>
 <entry>2023-03-29</entry>
 </dates>
 </vuln>

<vuln vid="6bacd9fd-ca56-11ed-bc52-589cfc0f81b0">
 <topic>phpmyfaq -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><lt>3.1.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpmyfaq developers report:
	<blockquote cite="https://www.phpmyfaq.de/security/advisory-2023-03-20">
	 XSS
	 weak passwords
	 privilege escalation
	 Captcha bypass
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://huntr.dev/bounties/e8109aed-d364-4c0c-9545-4de0347b10e1/</url>
 <url>https://huntr.dev/bounties/39715aaf-e798-4c60-97c4-45f4f2cd5c61/</url>
 <url>https://huntr.dev/bounties/01d6ae23-3a8f-42a8-99f4-10246187d71b/</url>
 <url>https://huntr.dev/bounties/dda73cb6-9344-4822-97a1-2e31efb6a73e/</url>
 <url>https://huntr.dev/bounties/529f2361-eb2e-476f-b7ef-4e561a712e28/</url>
 <url>https://huntr.dev/bounties/1dc7f818-c8ea-4f80-b000-31b48a426334/</url>
 <url>https://huntr.dev/bounties/e495b443-b328-42f5-aed5-d68b929b4cb9/</url>
 <url>https://huntr.dev/bounties/ece5f051-674e-4919-b998-594714910f9e/</url>
 <url>https://huntr.dev/bounties/93f981a3-231d-460d-a239-bb960e8c2fdc/</url>
 <url>https://huntr.dev/bounties/e4a58835-96b5-412c-a17e-3ceed30231e1/</url>
 <url>https://huntr.dev/bounties/b7d244b7-5ac3-4964-81ee-8dbb5bb5e33a/</url>
 <url>https://huntr.dev/bounties/24c0a65f-0751-4ff8-af63-4b325ac8879f/</url>
 <url>https://huntr.dev/bounties/3c2374cc-7082-44b7-a6a6-ccff7a650a3a/</url>
 <url>https://huntr.dev/bounties/0854328e-eb00-41a3-9573-8da8f00e369c/</url>
 <url>https://huntr.dev/bounties/2f1e417d-cf64-4cfb-954b-3a9cb2f38191/</url>
 <url>https://huntr.dev/bounties/584a200a-6ff8-4d53-a3c0-e7893edff60c/</url>
 <url>https://huntr.dev/bounties/bce84c02-abb2-474f-a67b-1468c9dcabb8/</url>
 <url>https://huntr.dev/bounties/882ffa07-5397-4dbb-886f-4626859d711a/</url>
 <url>https://huntr.dev/bounties/8ab09a1c-cfd5-4ce0-aae3-d33c93318957/</url>
 <url>https://huntr.dev/bounties/2d0ac48a-490d-4548-8d98-7447042dd1b5/</url>
 </references>
 <dates>
 <discovery>2023-03-20</discovery>
 <entry>2023-03-24</entry>
 </dates>
 </vuln>

<vuln vid="1ba034fb-ca38-11ed-b242-d4c9ef517024">
 <topic>OpenSSL -- Excessive Resource Usage Verifying X.509 Policy Constraints</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.1.1t,1_1</lt></range>
 </package>
 <package>
	<name>openssl30</name>
	<range><lt>3.0.8_1</lt></range>
 </package>
 <package>
	<name>openssl31</name>
	<range><lt>3.1.0_1</lt></range>
 </package>
 <package>
	<name>openssl-quic</name>
	<range><lt>3.0.8_1</lt></range>
 </package>
 <package>
	<name>virtualbox-ose</name>
	<range><lt>6.1.46</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20230322.txt">
	 Severity: Low
	 A security vulnerability has been identified in all supported versions
	 of OpenSSL related to the verification of X.509 certificate chains
	 that include policy constraints. Attackers may be able to exploit this
	 vulnerability by creating a malicious certificate chain that triggers
	 exponential use of computational resources, leading to a denial-of-service
	 (DoS) attack on affected systems.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0464</cvename>
 <url>https://www.openssl.org/news/secadv/20230322.txt</url>
 </references>
 <dates>
 <discovery>2023-03-23</discovery>
 <entry>2023-03-24</entry>
 <modified>2023-07-19</modified>
 </dates>
 </vuln>

<vuln vid="2fdb053c-ca25-11ed-9d7e-080027f5fec9">
 <topic>rack -- possible denial of service vulnerability in header parsing</topic>
 <affects>
 <package>
	<name>rubygem-rack</name>
	<range><lt>3.0.6.1,3</lt></range>
 </package>
 <package>
	<name>rubygem-rack22</name>
	<range><lt>2.2.6.6,3</lt></range>
 </package>
 <package>
	<name>rubygem-rack16</name>
	<range><lt>1.6.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ooooooo_q reports:
	<blockquote cite="https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466">
	 
	 Carefully crafted input can cause header parsing in Rack
	 to take an unexpected amount of time, possibly resulting
	 in a denial of service attack vector. Any applications
	 that parse headers using Rack (virtually all Rails
	 applications) are impacted.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-27539</cvename>
 <url>https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466</url>
 </references>
 <dates>
 <discovery>2023-03-13</discovery>
 <entry>2023-03-24</entry>
 </dates>
 </vuln>

<vuln vid="dec6b8e9-c9fe-11ed-bb39-901b0e9408dc">
 <topic>dino -- Insufficient message sender validation in Dino</topic>
 <affects>
 <package>
	<name>dino</name>
	<range><lt>0.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dino team reports:
	<blockquote cite="https://dino.im/security/cve-2023-28686/">
	 Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows
	attackers to modify the personal bookmark store via a crafted
	message. The attacker can change the display of group chats or
	force a victim to join a group chat; the victim may then be tricked
	into disclosing sensitive information.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28686</cvename>
 <url>https://dino.im/security/cve-2023-28686/</url>
 </references>
 <dates>
 <discovery>2023-03-23</discovery>
 <entry>2023-03-24</entry>
 </dates>
 </vuln>

<vuln vid="38f213b6-8f3d-4067-91ef-bf14de7ba518">
 <topic>libXpm -- Issues handling XPM files</topic>
 <affects>
 <package>
	<name>libXpm</name>
	<range><lt>3.5.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The X.Org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2023-January/003312.html">
	 <ol>
	 <li>CVE-2022-46285: Infinite loop on unclosed comments

When reading XPM images from a file with libXpm 3.5.14 or older, if a
	 comment in the file is not closed (i.e. a C-style comment starts with
	 "/*" and is missing the closing "*/"), the ParseComment() function will
	 loop forever calling getc() to try to read the rest of the comment,
	 failing to notice that it has returned EOF, which may cause a denial of
	 service to the calling program.

This issue was found by Marco Ivaldi of the Humanativa Group's HN Security team.

The fix is provided in
	 https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/a3a7c6dcc3b629d7650148</li>

<li>CVE-2022-44617: Runaway loop on width of 0 and enormous height

When reading XPM images from a file with libXpm 3.5.14 or older, if a
	 image has a width of 0 and a very large height, the ParsePixels() function
	 will loop over the entire height calling getc() and ungetc() repeatedly,
	 or in some circumstances, may loop seemingly forever, which may cause a denial
	 of service to the calling program when given a small crafted XPM file to parse.

This issue was found by Martin Ettl.

The fix is provided in
	 https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28
	 and
	 https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/c5ab17bcc34914c0b0707d</li>

<li>CVE-2022-4883: compression commands depend on $PATH

By default, on all platforms except MinGW, libXpm will detect if a filename
	 ends in .Z or .gz, and will when reading such a file fork off an uncompress
	 or gunzip command to read from via a pipe, and when writing such a file will
	 fork off a compress or gzip command to write to via a pipe.

In libXpm 3.5.14 or older these are run via execlp(), relying on $PATH
	 to find the commands. If libXpm is called from a program running with
	 raised privileges, such as via setuid, then a malicious user could set
	 $PATH to include programs of their choosing to be run with those privileges.

This issue was found by Alan Coopersmith of the Oracle Solaris team.</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.x.org/archives/xorg-announce/2023-January/003312.html</url>
 <cvename>CVE-2022-46285</cvename>
 <cvename>CVE-2022-44617</cvename>
 <cvename>CVE-2022-4883</cvename>
 </references>
 <dates>
 <discovery>2023-01-17</discovery>
 <entry>2023-03-23</entry>
 </dates>
 </vuln>

<vuln vid="1b15a554-c981-11ed-bb39-901b0e9408dc">
 <topic>tailscale -- security vulnerability in Tailscale SSH</topic>
 <affects>
 <package>
	<name>tailscale</name>
	<range><lt>1.38.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tailscale team reports:
	<blockquote cite="https://tailscale.com/security-bulletins/#ts-2023-003">
	 A vulnerability identified in the implementation of Tailscale SSH in FreeBSD
	 allowed commands to be run with a higher privilege group ID than that specified
	 by Tailscale SSH access rules.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28436</cvename>
 <url>https://tailscale.com/security-bulletins/#ts-2023-003</url>
 </references>
 <dates>
 <discovery>2023-03-22</discovery>
 <entry>2023-03-23</entry>
 </dates>
 </vuln>

<vuln vid="c8b334e0-6e83-4575-81d1-f9d5803ceb07">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>111.0.5563.110</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>111.0.5563.110</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html">
	 This update includes 8 security fixes:
	 <ul>
	 <li>[1421773] High CVE-2023-1528: Use after free in Passwords. Reported by Wan Choi of Seoul National University on 2023-03-07</li>
	 <li>[1419718] High CVE-2023-1529: Out of bounds memory access in WebHID. Reported by anonymous on 2023-02-27</li>
	 <li>[1419831] High CVE-2023-1530: Use after free in PDF. Reported by The UK's National Cyber Security Centre (NCSC) on 2023-02-27</li>
	 <li>[1415330] High CVE-2023-1531: Use after free in ANGLE. Reported by Piotr Bania of Cisco Talos on 2023-02-13</li>
	 <li>[1421268] High CVE-2023-1532: Out of bounds read in GPU Video. Reported by Mark Brand of Google Project Zero on 2023-03-03</li>
	 <li>[1422183] High CVE-2023-1533: Use after free in WebProtect. Reported by Weipeng Jiang (@Krace) of VRI on 2023-03-07</li>
	 <li>[1422594] High CVE-2023-1534: Out of bounds read in ANGLE. Reported by Jann Horn and Mark Brand of Google Project Zero on 2023-03-08</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-1528</cvename>
 <cvename>CVE-2023-1529</cvename>
 <cvename>CVE-2023-1530</cvename>
 <cvename>CVE-2023-1531</cvename>
 <cvename>CVE-2023-1532</cvename>
 <cvename>CVE-2023-1533</cvename>
 <cvename>CVE-2023-1534</cvename>
 <url>https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html</url>
 </references>
 <dates>
 <discovery>2023-03-21</discovery>
 <entry>2023-03-22</entry>
 </dates>
 </vuln>

<vuln vid="a60cc0e4-c7aa-11ed-8a4b-080027f5fec9">
 <topic>redis -- specially crafted MSETNX command can lead to denial-of-service</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><lt>7.0.10</lt></range>
 </package>
 <package>
	<name>redis-devel</name>
	<range><lt>7.0.10.20230320</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Yupeng Yang reports:
	<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8c">
	 
	 Authenticated users can use the MSETNX command to trigger
	 a runtime assertion and termination of the Redis server
	 process.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-28425</cvename>
 <url>https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8c</url>
 </references>
 <dates>
 <discovery>2023-03-20</discovery>
 <entry>2023-03-21</entry>
 </dates>
 </vuln>

<vuln vid="0d7d104c-c6fb-11ed-8a4b-080027f5fec9">
 <topic>curl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>8.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Harry Sintonen reports:
	<blockquote cite="https://curl.se/docs/security.html">
	 <dl>
	 <dt>CVE-2023-27533</dt>
	 <dd>
	 curl supports communicating using the TELNET protocol
	 and as a part of this it offers users to pass on user
	 name and "telnet options" for the server
	 negotiation.

Due to lack of proper input scrubbing and without it
	 being the documented functionality, curl would pass on
	 user name and telnet options to the server as
	 provided. This could allow users to pass in carefully
	 crafted content that pass on content or do option
	 negotiation without the application intending to do
	 so. In particular if an application for example allows
	 users to provide the data or parts of the data.
	 </dd>
	 <dt>CVE-2023-27534</dt>
	 <dd>
	 curl supports SFTP transfers. curl's SFTP implementation
	 offers a special feature in the path component of URLs:
	 a tilde (~) character as the first path element in the
	 path to denotes a path relative to the user's home
	 directory. This is supported because of wording in the
	 once proposed to-become RFC draft that was to dictate
	 how SFTP URLs work.

Due to a bug, the handling of the tilde in SFTP path did
	      however not only replace it when it is used stand-alone
	      as the first path element but also wrongly when used as
	      a mere prefix in the first element.

Using a path like /~2/foo when accessing a server using
	      the user dan (with home directory /home/dan) would then
	      quite surprisingly access the file /home/dan2/foo.

This can be taken advantage of to circumvent filtering
	 or worse.
	 </dd>
	 <dt>CVE-2023-27535</dt>
	 <dd>
	 libcurl would reuse a previously created FTP connection
	 even when one or more options had been changed that
	 could have made the effective user a very different one,
	 thus leading to the doing the second transfer with wrong
	 credentials.

libcurl keeps previously used connections in a
	 connection pool for subsequent transfers to reuse if one
	 of them matches the setup. However, several FTP settings
	 were left out from the configuration match checks,
	 making them match too easily. The settings in questions
	 are CURLOPT_FTP_ACCOUNT,
	 CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC and
	 CURLOPT_USE_SSL level.
	 </dd>
	 <dt>CVE-2023-27536</dt>
	 <dd>
	 ibcurl would reuse a previously created connection even
	 when the GSS delegation (CURLOPT_GSSAPI_DELEGATION)
	 option had been changed that could have changed the
	 user's permissions in a second transfer.

libcurl keeps previously used connections in a
	 connection pool for subsequent transfers to reuse if one
	 of them matches the setup. However, this GSS delegation
	 setting was left out from the configuration match
	 checks, making them match too easily, affecting
	 krb5/kerberos/negotiate/GSSAPI transfers.
	 </dd>
	 <dt>CVE-2023-27537</dt>
	 <dd>
	 libcurl supports sharing HSTS data between separate
	 "handles". This sharing was introduced without
	 considerations for do this sharing across separate
	 threads but there was no indication of this fact in the
	 documentation.

Due to missing mutexes or thread locks, two threads
	 sharing the same HSTS data could end up doing a
	 double-free or use-after-free.
	 </dd>
	 <dt>CVE-2023-27538</dt>
	 <dd>
	 libcurl would reuse a previously created connection even
	 when an SSH related option had been changed that should
	 have prohibited reuse.

libcurl keeps previously used connections in a
	 connection pool for subsequent transfers to reuse if one
	 of them matches the setup. However, two SSH settings
	 were left out from the configuration match checks,
	 making them match too easily.
	 </dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-27533</cvename>
 <cvename>CVE-2023-27534</cvename>
 <cvename>CVE-2023-27535</cvename>
 <cvename>CVE-2023-27536</cvename>
 <cvename>CVE-2023-27537</cvename>
 <cvename>CVE-2023-27538</cvename>
 <url>https://curl.se/docs/security.html</url>
 </references>
 <dates>
 <discovery>2023-03-20</discovery>
 <entry>2023-03-20</entry>
 </dates>
 </vuln>

<vuln vid="72583cb3-a7f9-11ed-bd9e-589cfc0f81b0">
 <topic>phpMyAdmin -- XSS vulnerability in drag-and-drop upload</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<name>phpMyAdmin-php80</name>
	<name>phpMyAdmin-php81</name>
	<name>phpMyAdmin-php82</name>
	<name>phpMyAdmin5</name>
	<name>phpMyAdmin5-php80</name>
	<name>phpMyAdmin5-php81</name>
	<name>phpMyAdmin5-php82</name>
	<range><lt>4.9.11</lt></range>
	<range><ge>5.0</ge><lt>5.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpMyAdmin Team reports:
	<blockquote cite="https://www.phpmyadmin.net/news/2023/2/8/phpmyadmin-4911-and-521-are-released/">
	 PMASA-2023-1 XSS vulnerability in drag-and-drop upload
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2023-1/</url>
 </references>
 <dates>
 <discovery>2023-02-07</discovery>
 <entry>2023-03-16</entry>
 </dates>
 </vuln>

<vuln vid="8edeb3c1-bfe7-11ed-96f5-3497f65b111b">
 <topic>Apache httpd -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.56</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="https://downloads.apache.org/httpd/CHANGES_2.4.56">
	 <ul>
	 <li>CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi
	 HTTP response splitting (cve.mitre.org).
	 HTTP Response Smuggling vulnerability in Apache HTTP Server
	 via mod_proxy_uwsgi. This issue affects Apache HTTP Server:
	 from 2.4.30 through 2.4.55.
	 Special characters in the origin response header can
	 truncate/split the response forwarded to the client.</li>
	 <li>CVE-2023-25690: HTTP request splitting with mod_rewrite
	 and mod_proxy (cve.mitre.org).
	 Some mod_proxy configurations on Apache HTTP Server versions
	 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.
	 Configurations are affected when mod_proxy is enabled along
	 with some form of RewriteRule or ProxyPassMatch in which a
	 non-specific pattern matches some portion of the user-supplied
	 request-target (URL) data and is then re-inserted into the
	 proxied request-target using variable substitution.
	 </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-25690</cvename>
 <cvename>CVE-2023-27522</cvename>
 <url>https://downloads.apache.org/httpd/CHANGES_2.4.56</url>
 </references>
 <dates>
 <discovery>2023-03-08</discovery>
 <entry>2023-03-11</entry>
 </dates>
 </vuln>

<vuln vid="d357f6bb-0af4-4ac9-b096-eeec183ad829">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>111.0.5563.64</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>111.0.5563.64</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html">
	 This update includes 40 security fixes:
	 <ul>
	 <li>[1411210] High CVE-2023-1213: Use after free in Swiftshader. Reported by Jaehun Jeong(@n3sk) of Theori on 2023-01-30</li>
	 <li>[1412487] High CVE-2023-1214: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2023-02-03</li>
	 <li>[1417176] High CVE-2023-1215: Type Confusion in CSS. Reported by Anonymous on 2023-02-17</li>
	 <li>[1417649] High CVE-2023-1216: Use after free in DevTools. Reported by Ganjiang Zhou(@refrain_areu) of ChaMd5-H1 team on 2023-02-21</li>
	 <li>[1412658] High CVE-2023-1217: Stack buffer overflow in Crash reporting. Reported by sunburst of Ant Group Tianqiong Security Lab on 2023-02-03</li>
	 <li>[1413628] High CVE-2023-1218: Use after free in WebRTC. Reported by Anonymous on 2023-02-07</li>
	 <li>[1415328] High CVE-2023-1219: Heap buffer overflow in Metrics. Reported by Sergei Glazunov of Google Project Zero on 2023-02-13</li>
	 <li>[1417185] High CVE-2023-1220: Heap buffer overflow in UMA. Reported by Sergei Glazunov of Google Project Zero on 2023-02-17</li>
	 <li>[1385343] Medium CVE-2023-1221: Insufficient policy enforcement in Extensions API. Reported by Ahmed ElMasry on 2022-11-16</li>
	 <li>[1403515] Medium CVE-2023-1222: Heap buffer overflow in Web Audio API. Reported by Cassidy Kim(@cassidy6564) on 2022-12-24</li>
	 <li>[1398579] Medium CVE-2023-1223: Insufficient policy enforcement in Autofill. Reported by Ahmed ElMasry on 2022-12-07</li>
	 <li>[1403539] Medium CVE-2023-1224: Insufficient policy enforcement in Web Payments API. Reported by Thomas Orlita on 2022-12-25</li>
	 <li>[1408799] Medium CVE-2023-1225: Insufficient policy enforcement in Navigation. Reported by Roberto Ffrench-Davis @Lihaft on 2023-01-20</li>
	 <li>[1013080] Medium CVE-2023-1226: Insufficient policy enforcement in Web Payments API. Reported by Anonymous on 2019-10-10</li>
	 <li>[1348791] Medium CVE-2023-1227: Use after free in Core. Reported by @ginggilBesel on 2022-07-31</li>
	 <li>[1365100] Medium CVE-2023-1228: Insufficient policy enforcement in Intents. Reported by Axel Chong on 2022-09-18</li>
	 <li>[1160485] Medium CVE-2023-1229: Inappropriate implementation in Permission prompts. Reported by Thomas Orlita on 2020-12-20</li>
	 <li>[1404230] Medium CVE-2023-1230: Inappropriate implementation in WebApp Installs. Reported by Axel Chong on 2022-12-30</li>
	 <li>[1274887] Medium CVE-2023-1231: Inappropriate implementation in Autofill. Reported by Yan Zhu, Brave on 2021-11-30</li>
	 <li>[1346924] Low CVE-2023-1232: Insufficient policy enforcement in Resource Timing. Reported by Sohom Datta on 2022-07-24</li>
	 <li>[1045681] Low CVE-2023-1233: Insufficient policy enforcement in Resource Timing. Reported by Soroush Karami on 2020-01-25</li>
	 <li>[1404621] Low CVE-2023-1234: Inappropriate implementation in Intents. Reported by Axel Chong on 2023-01-03</li>
	 <li>[1404704] Low CVE-2023-1235: Type Confusion in DevTools. Reported by raven at KunLun lab on 2023-01-03</li>
	 <li>[1374518] Low CVE-2023-1236: Inappropriate implementation in Internals. Reported by Alesandro Ortiz on 2022-10-14</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-1213</cvename>
 <cvename>CVE-2023-1214</cvename>
 <cvename>CVE-2023-1215</cvename>
 <cvename>CVE-2023-1216</cvename>
 <cvename>CVE-2023-1217</cvename>
 <cvename>CVE-2023-1218</cvename>
 <cvename>CVE-2023-1219</cvename>
 <cvename>CVE-2023-1220</cvename>
 <cvename>CVE-2023-1221</cvename>
 <cvename>CVE-2023-1222</cvename>
 <cvename>CVE-2023-1223</cvename>
 <cvename>CVE-2023-1224</cvename>
 <cvename>CVE-2023-1225</cvename>
 <cvename>CVE-2023-1226</cvename>
 <cvename>CVE-2023-1227</cvename>
 <cvename>CVE-2023-1228</cvename>
 <cvename>CVE-2023-1229</cvename>
 <cvename>CVE-2023-1230</cvename>
 <cvename>CVE-2023-1231</cvename>
 <cvename>CVE-2023-1232</cvename>
 <cvename>CVE-2023-1233</cvename>
 <cvename>CVE-2023-1234</cvename>
 <cvename>CVE-2023-1235</cvename>
 <cvename>CVE-2023-1236</cvename>
 <url>https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2023-03-08</discovery>
 <entry>2023-03-09</entry>
 </dates>
 </vuln>

<vuln vid="f68bb358-be8e-11ed-9215-00e081b7aa2d">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.394</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.387.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2023-03-08/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-3037 / CVE-2023-27898</h5>
	 XSS vulnerability in plugin manager
	 <h5>(Medium) SECURITY-3030 / CVE-2023-24998 (upstream issue), CVE-2023-27900 (MultipartFormDataParser), CVE-2023-27901 (StaplerRequest)</h5>
	 DoS vulnerability in bundled Apache Commons FileUpload library
	 <h5/>
	 <h5>(Medium) SECURITY-1807 / CVE-2023-27902</h5>
	 Workspace temporary directories accessible through directory browser
	 <h5>(Low) SECURITY-3058 / CVE-2023-27903</h5>
	 Temporary file parameter created with insecure permissions
	 <h5>(Low) SECURITY-2120 / CVE-2023-27904</h5>
	 Information disclosure through error stack traces related to agents
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-27898</cvename>
 <cvename>CVE-2023-24998</cvename>
 <cvename>CVE-2023-27900</cvename>
 <cvename>CVE-2023-27901</cvename>
 <cvename>CVE-2023-27902</cvename>
 <cvename>CVE-2023-27903</cvename>
 <cvename>CVE-2023-27904</cvename>
 <url>https://www.jenkins.io/security/advisory/2023-03-08/</url>
 </references>
 <dates>
 <discovery>2023-03-08</discovery>
 <entry>2023-03-09</entry>
 </dates>
 </vuln>

<vuln vid="742279d6-bdbe-11ed-a179-2b68e9d12706">
 <topic>go -- crypto/elliptic: incorrect P-256 ScalarMult and ScalarBaseMult results</topic>
 <affects>
 <package>
	<name>go119</name>
	<range><lt>1.19.7</lt></range>
 </package>
 <package>
	<name>go120</name>
	<range><lt>1.20.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/58647">
	 crypto/elliptic: incorrect P-256 ScalarMult and
	 ScalarBaseMult results
	 The ScalarMult and ScalarBaseMult methods of the P256
	 Curve may return an incorrect result if called with some
	 specific unreduced scalars (a scalar larger than the
	 order of the curve).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-24532</cvename>
 <url>https://groups.google.com/g/golang-dev/c/3wmx8i5WvNY/m/AEOlccrGAwAJ</url>
 </references>
 <dates>
 <discovery>2023-02-22</discovery>
 <entry>2023-03-08</entry>
 </dates>
 </vuln>

<vuln vid="bed545c6-bdb8-11ed-bca8-a33124f1beb1">
 <topic>mantis -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mantis-php74</name>
	<name>mantis-php80</name>
	<name>mantis-php81</name>
	<name>mantis-php82</name>
	<range><lt>2.25.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mantis 2.25.6 release reports:
	<blockquote cite="https://mantisbt.org/bugs/changelog_page.php?project=mantisbt&amp;version=2.25.6">
	 Security and maintenance release
	 <ul>
	 <li>0031086: Private issue summary disclosure (CVE-2023-22476)</li>
	 <li>0030772: Update (bundled) moment.js to 2.29.4 (CVE-2022-31129)</li>
	 <li>0030791: Allow adding relation type noopener/noreferrer to outgoing links</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-22476</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-22476</url>
 <cvename>CVE-2022-31129</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-31129</url>
 </references>
 <dates>
 <discovery>2023-01-06</discovery>
 <entry>2023-03-08</entry>
 </dates>
 </vuln>

<vuln vid="6678211c-bd47-11ed-beb0-1c1b0d9ea7e6">
 <topic>Apache OpenOffice -- master password vulnerabilities</topic>
 <affects>
 <package>
	<name>apache-openoffice</name>
	<range><lt>4.1.13</lt></range>
 </package>
 <package>
	<name>apache-openoffice-devel</name>
	<range><lt>4.2.1678061694,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Openoffice project reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-37400">
	 Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26306 - LibreOffice
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-37401">
	 Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulnerable to a brute force attack if an attacker has access to the users stored config. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26307 - LibreOffice
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-37400</cvename>
 <cvename>CVE-2022-37401</cvename>
 <url>https://cwiki.apache.org/confluence/display/OOOUSERS/AOO+4.1.13+Release+Notes</url>
 </references>
 <dates>
 <discovery>2022-02-25</discovery>
 <entry>2023-03-08</entry>
 </dates>
 </vuln>

<vuln vid="f0798a6a-bbdb-11ed-ba99-080027f5fec9">
 <topic>rack -- possible DoS vulnerability in multipart MIME parsing</topic>
 <affects>
 <package>
	<name>rubygem-rack</name>
	<range><lt>3.0.4.2,3</lt></range>
 </package>
 <package>
	<name>rubygem-rack22</name>
	<range><lt>2.2.6.3,3</lt></range>
 </package>
 <package>
	<name>rubygem-rack16</name>
	<range><lt>1.6.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aaron Patterson reports:
	<blockquote cite="https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388">
	 
	 The Multipart MIME parsing code in Rack limits the number
	 of file parts, but does not limit the total number of
	 parts that can be uploaded. Carefully crafted requests can
	 abuse this and cause multipart parsing to take longer than
	 expected.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-27530</cvename>
 <url>https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388</url>
 </references>
 <dates>
 <discovery>2023-03-03</discovery>
 <entry>2023-03-06</entry>
 </dates>
 </vuln>

<vuln vid="be233fc6-bae7-11ed-a4fb-080027f5fec9">
 <topic>curl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>7.88.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Harry Sintonen and Patrick Monnerat report:
	<blockquote cite="https://curl.se/docs/security.html">
	 <dl>
	 <dt>CVE-2023-23914</dt>
	 <dd>
	 A cleartext transmission of sensitive information
	 vulnerability exists in curl &lt; v7.88.0 that could
	 cause HSTS functionality fail when multiple URLs are
	 requested serially. Using its HSTS support, curl can be
	 instructed to use HTTPS instead of using an insecure
	 clear-text HTTP step even when HTTP is provided in the
	 URL. This HSTS mechanism would however surprisingly be
	 ignored by subsequent transfers when done on the same
	 command line because the state would not be properly
	 carried on.
	 </dd>
	 <dt>CVE-2023-23915</dt>
	 <dd>
	 A cleartext transmission of sensitive information
	 vulnerability exists in curl &lt; v7.88.0 that could
	 cause HSTS functionality to behave incorrectly when
	 multiple URLs are requested in parallel. Using its HSTS
	 support, curl can be instructed to use HTTPS instead of
	 using an insecure clear-text HTTP step even when HTTP is
	 provided in the URL. This HSTS mechanism would however
	 surprisingly fail when multiple transfers are done in
	 parallel as the HSTS cache file gets overwritten by the
	 most recently completed transfer. A later HTTP-only
	 transfer to the earlier host name would then *not* get
	 upgraded properly to HSTS.
	 </dd>
	 <dt>CVE-2023-23916</dt>
	 <dd>
	 An allocation of resources without limits or throttling
	 vulnerability exists in curl &lt; v7.88.0 based on the
	 "chained" HTTP compression algorithms, meaning
	 that a server response can be compressed multiple times
	 and potentially with different algorithms. The number of
	 acceptable "links" in this "decompression
	 chain" was capped, but the cap was implemented on a
	 per-header basis allowing a malicious server to insert a
	 virtually unlimited number of compression steps simply
	 by using many headers. The use of such a decompression
	 chain could result in a "malloc bomb", making
	 curl end up spending enormous amounts of allocated heap
	 memory, or trying to and returning out of memory errors.
	 </dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-23914</cvename>
 <cvename>CVE-2023-23915</cvename>
 <cvename>CVE-2023-23916</cvename>
 <url>https://curl.se/docs/security.html</url>
 </references>
 <dates>
 <discovery>2023-02-15</discovery>
 <entry>2023-03-05</entry>
 </dates>
 </vuln>

<vuln vid="3f9b6943-ba58-11ed-bbbd-00e0670f2660">
 <topic>strongSwan -- certificate verification vulnerability</topic>
 <affects>
 <package>
	<name>strongswan</name>
	<range><ge>5.9.8</ge><lt>5.9.9_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	strongSwan reports:
	<blockquote cite="https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-(cve-2023-26463).html">
	 A vulnerability related to certificate verification in TLS-based EAP methods
	 was discovered in strongSwan that results in a denial of service
	 but possibly even remote code execution. Versions 5.9.8 and 5.9.9
	 may be affected. 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-26463</cvename>
 <url>https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-(cve-2023-26463).html</url>
 </references>
 <dates>
 <discovery>2023-03-02</discovery>
 <entry>2023-03-04</entry>
 </dates>
 </vuln>

<vuln vid="f7c5b3a9-b9fb-11ed-99c6-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>15.9.0</ge><lt>15.9.2</lt></range>
	<range><ge>15.8.0</ge><lt>15.8.4</lt></range>
	<range><ge>9.0.0</ge><lt>15.7.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/03/02/security-release-gitlab-15-9-2-released/">
	 Stored XSS via Kroki diagram
	 Prometheus integration Google IAP details are not hidden, may leak account details from instance/group/project settings
	 Improper validation of SSO and SCIM tokens while managing groups
	 Maintainer can leak Datadog API key by changing Datadog site
	 Clipboard based XSS in the title field of work items
	 Improper user right checks for personal snippets
	 Release Description visible in public projects despite release set as project members only
	 Group integration settings sensitive information exposed to project maintainers
	 Improve pagination limits for commits
	 Gitlab Open Redirect Vulnerability
	 Maintainer may become an Owner of a project
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0050</cvename>
 <cvename>CVE-2022-4289</cvename>
 <cvename>CVE-2022-4331</cvename>
 <cvename>CVE-2023-0483</cvename>
 <cvename>CVE-2022-4007</cvename>
 <cvename>CVE-2022-3758</cvename>
 <cvename>CVE-2023-0223</cvename>
 <cvename>CVE-2022-4462</cvename>
 <cvename>CVE-2023-1072</cvename>
 <cvename>CVE-2022-3381</cvename>
 <cvename>CVE-2023-1084</cvename>
 <url>https://about.gitlab.com/releases/2023/03/02/security-release-gitlab-15-9-2-released/</url>
 </references>
 <dates>
 <discovery>2023-03-02</discovery>
 <entry>2023-03-03</entry>
 </dates>
 </vuln>

<vuln vid="6dccc186-b824-11ed-b695-6c3be5272acd">
 <topic>Grafana -- Stored XSS in text panel plugin</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>9.2.0</ge><lt>9.2.10</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.4</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.2.0</ge><lt>9.2.10</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/">
	 During an internal audit of Grafana on January 1, a member of the security
	 team found a stored XSS vulnerability affecting the core text plugin.
	 The stored XSS vulnerability requires several user interactions in order
	 to be fully exploited. The vulnerability was possible due to React’s render
	 cycle that will pass through the unsanitized HTML code, but in the next cycle,
	 the HTML is cleaned up and saved in Grafana’s database.
	 The CVSS score for this vulnerability is 6.4 Medium
	 (CVSS:6.4/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-22462</cvename>
 <url>https://github.com/grafana/grafana/security/advisories/GHSA-7rqg-hjwc-6mjf</url>
 </references>
 <dates>
 <discovery>2023-01-01</discovery>
 <entry>2023-03-01</entry>
 </dates>
 </vuln>

<vuln vid="e7841611-b808-11ed-b695-6c3be5272acd">
 <topic>Grafana -- Stored XSS in TraceView panel</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><lt>8.5.21</lt></range>
	<range><ge>9.0.0</ge><lt>9.2.13</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.8</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><lt>8.5.21</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge><lt>9.2.13</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/">
	 During an internal audit of Grafana on January 30, a member
	 of the engineering team found a stored XSS vulnerability affecting
	 the <code>TraceView</code> panel.
	 The stored XSS vulnerability was possible because the value of a span’s
	 attributes/resources were not properly sanitized, and this will be rendered
	 when the span’s attributes/resources are expanded.
	 The CVSS score for this vulnerability is 7.3 High
	 (CVSS:7.3/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0594</cvename>
 <url>https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/</url>
 </references>
 <dates>
 <discovery>2023-01-30</discovery>
 <entry>2023-03-01</entry>
 </dates>
 </vuln>

<vuln vid="e2a8e2bd-b808-11ed-b695-6c3be5272acd">
 <topic>Grafana -- Stored XSS in geomap panel plugin via attribution</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><lt>8.5.21</lt></range>
	<range><ge>9.0.0</ge><lt>9.2.13</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.8</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><lt>8.5.21</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge><lt>9.2.13</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/">
	 During an internal audit of Grafana on January 25, a member of the security
	 team found a stored XSS vulnerability affecting the core geomap plugin.
	 The stored XSS vulnerability was possible because map attributions weren’t
	 properly sanitized, allowing arbitrary JavaScript to be executed in the context
	 of the currently authorized user of the Grafana instance.
	 The CVSS score for this vulnerability is 7.3 High
	 (CVSS:7.3/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0507</cvename>
 <url>https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/</url>
 </references>
 <dates>
 <discovery>2023-01-25</discovery>
 <entry>2023-03-01</entry>
 </dates>
 </vuln>

<vuln vid="b17bce48-b7c6-11ed-b304-080027f5fec9">
 <topic>redis -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><lt>7.0.9</lt></range>
 </package>
 <package>
	<name>redis-devel</name>
	<range><lt>7.0.9.20230228</lt></range>
 </package>
 <package>
	<name>redis62</name>
	<range><lt>6.2.11</lt></range>
 </package>
 <package>
	<name>redis6</name>
	<range><lt>6.0.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Redis core team	reports:
	<blockquote cite="https://groups.google.com/g/redis-db/c/3hQ1oTO4hMI">
	 <dl>
	 <dt>CVE-2023-25155</dt>
	 <dd>
	 Specially crafted SRANDMEMBER, ZRANDMEMBER, and
	 HRANDFIELD commands can trigger an integer overflow,
	 resulting in a runtime assertion and termination of the
	 Redis server process.
	 </dd>
	 <dt>CVE-2022-36021</dt>
	 <dd>
	 String matching commands (like SCAN or KEYS) with a
	 specially crafted pattern to trigger a denial-of-service
	 attack on Redis, causing it to hang and consume 100% CPU
	 time.
	 </dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-25155</cvename>
 <cvename>CVE-2022-36021</cvename>
 <url>https://groups.google.com/g/redis-db/c/3hQ1oTO4hMI</url>
 </references>
 <dates>
 <discovery>2023-02-28</discovery>
 <entry>2023-03-01</entry>
 </dates>
 </vuln>

<vuln vid="a75929bd-b6a4-11ed-bad6-080027f5fec9">
 <topic>emacs -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>emacs</name>
	<name>emacs-canna</name>
	<name>emacs-nox</name>
	<range><lt>28.2_3,3</lt></range>
 </package>
 <package>
	<name>emacs-devel</name>
	<name>emacs-devel-nox</name>
	<range><lt>30.0.50.20230101,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Xi Lu reports:
	<blockquote cite="https://www.debian.org/security/2023/dsa-5360">
	 <dl>
	 <dt>CVE-2022-48337</dt>
	 <dd>
	 GNU Emacs through 28.2 allows attackers to execute
	 commands via shell metacharacters in the name of a
	 source-code file, because lib-src/etags.c uses the
	 system C library function in its implementation of the
	 etags program. For example, a victim may use the
	 "etags -u *" command (suggested in the etags
	 documentation) in a situation where the current working
	 directory has contents that depend on untrusted input.
	 </dd>
	 <dt>CVE-2022-48338</dt>
	 <dd>
	 An issue was discovered in GNU Emacs through 28.2. In
	 ruby-mode.el, the ruby-find-library-file function has a
	 local command injection vulnerability. The
	 ruby-find-library-file function is an interactive
	 function, and bound to C-c C-f. Inside the function, the
	 external command gem is called through
	 shell-command-to-string, but the feature-name parameters
	 are not escaped. Thus, malicious Ruby source files may
	 cause commands to be executed.
	 </dd>
	 <dt>CVE-2022-48339</dt>
	 <dd>
	 An issue was discovered in GNU Emacs through
	 28.2. htmlfontify.el has a command injection
	 vulnerability. In the hfy-istext-command function, the
	 parameter file and parameter srcdir come from external
	 input, and parameters are not escaped. If a file name or
	 directory name contains shell metacharacters, code may
	 be executed.
	 </dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-48337</cvename>
 <cvename>CVE-2022-48338</cvename>
 <cvename>CVE-2022-48339</cvename>
 <url>https://www.debian.org/security/2023/dsa-5360</url>
 </references>
 <dates>
 <discovery>2022-12-06</discovery>
 <entry>2023-02-27</entry>
 </dates>
 </vuln>

<vuln vid="dd271de6-b444-11ed-9268-b42e991fc52e">
 <topic>freerdp -- clients using the `/video` command line switch might read uninitialized data</topic>
 <affects>
 <package>
	<name>freerdp</name>
	<range><lt>2.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
 <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39283">
	
	 All FreeRDP based clients when using the `/video`
	 command line switch might read uninitialized data, decode
	 it as audio/video and display the result. FreeRDP based
	 server implementations are not affected.
	
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-39283</cvename>
 <url>https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6cf9-3328-qrvh</url>
 </references>
 <dates>
 <discovery>2022-10-13</discovery>
 <entry>2023-02-24</entry>
 </dates>
 </vuln>

<vuln vid="c682923d-b444-11ed-9268-b42e991fc52e">
 <topic>freerdp -- clients using `/parallel` command line switch might read uninitialized data</topic>
 <affects>
 <package>
	<name>freerdp</name>
	<range><lt>2.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
 <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39282">
	
	 FreeRDP based clients on unix systems using
	 `/parallel` command line switch might read uninitialized
	 data and send it to the server the client is currently
	 connected to. FreeRDP based server implementations are not
	 affected.
	
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-39282</cvename>
 <url>https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c45q-wcpg-mxjq</url>
 </references>
 <dates>
 <discovery>2022-10-13</discovery>
 <entry>2023-02-24</entry>
 </dates>
 </vuln>

<vuln vid="4d6b5ea9-bc64-4e77-a7ee-d62ba68a80dd">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>110.0.5481.177</lt></range>
 </package>
 <package>
 <name>ungoogled-chromium</name>
 <range><lt>110.0.5481.177</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html">
	 This update includes 10 security fixes:
	 <ul>
	 <li>[1415366] Critical CVE-2023-0941: Use after free in Prompts. Reported by Anonymous on 2023-02-13</li>
	 <li>[1414738] High CVE-2023-0927: Use after free in Web Payments API. Reported by Rong Jian of VRI on 2023-02-10</li>
	 <li>[1309035] High CVE-2023-0928: Use after free in SwiftShader. Reported by Anonymous on 2022-03-22</li>
	 <li>[1399742] High CVE-2023-0929: Use after free in Vulkan. Reported by Cassidy Kim(@cassidy6564) on 2022-12-09</li>
	 <li>[1410766] High CVE-2023-0930: Heap buffer overflow in Video. Reported by Cassidy Kim(@cassidy6564) on 2023-01-27</li>
	 <li>[1407701] High CVE-2023-0931: Use after free in Video. Reported by Cassidy Kim(@cassidy6564) on 2023-01-17</li>
	 <li>[1413005] High CVE-2023-0932: Use after free in WebRTC. Reported by Omri Bushari (Talon Cyber Security) on 2023-02-05</li>
	 <li>[1404864] Medium CVE-2023-0933: Integer overflow in PDF. Reported by Zhiyi Zhang from Codesafe Team of Legendsec at QI-ANXIN</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0941</cvename>
 <cvename>CVE-2023-0927</cvename>
 <cvename>CVE-2023-0928</cvename>
 <cvename>CVE-2023-0929</cvename>
 <cvename>CVE-2023-0930</cvename>
 <cvename>CVE-2023-0931</cvename>
 <cvename>CVE-2023-0932</cvename>
 <cvename>CVE-2023-0933</cvename>
 <url>https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html</url>
 </references>
 <dates>
 <discovery>2023-02-22</discovery>
 <entry>2023-02-22</entry>
 </dates>
 </vuln>

<vuln vid="7a425536-74f7-4ce4-9768-0079a9d44d11">
 <topic>zeek -- potential DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>5.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.6">
	 Receiving DNS responses from async DNS requests (via
	 the lookup_addr, etc BIF methods) with the TTL set to
	 zero could cause the DNS manager to eventually stop being
	 able to make new requests. 
	 Specially-crafted FTP packets with excessively long
	 usernames, passwords, or other fields could cause log
	 writes to use large amounts of disk space. 
	 The find_all and find_all_ordered BIF methods could
	 take extremely large amounts of time to process incoming
	 data depending on the size of the input. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v5.0.7</url>
 </references>
 <dates>
 <discovery>2023-02-21</discovery>
 <entry>2023-02-21</entry>
 </dates>
 </vuln>

<vuln vid="421c0af9-b206-11ed-9fe5-f4a47516fb57">
 <topic>libde256 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libde265</name>
	<range><lt>1.0.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Libde265 developer reports:
	<blockquote cite="https://github.com/strukturag/libde265/releases/tag/v1.0.10">
	 This release fixes the known CVEs below. Many of them are actually caused by the same underlying issues that manifest in different ways.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-21594</cvename>
 <cvename>CVE-2020-21595</cvename>
 <cvename>CVE-2020-21596</cvename>
 <cvename>CVE-2020-21597</cvename>
 <cvename>CVE-2020-21598</cvename>
 <cvename>CVE-2020-21599</cvename>
 <cvename>CVE-2020-21600</cvename>
 <cvename>CVE-2020-21601</cvename>
 <cvename>CVE-2020-21602</cvename>
 <cvename>CVE-2020-21603</cvename>
 <cvename>CVE-2020-21604</cvename>
 <cvename>CVE-2020-21605</cvename>
 <cvename>CVE-2020-21606</cvename>
 <cvename>CVE-2022-1253</cvename>
 <cvename>CVE-2022-43236</cvename>
 <cvename>CVE-2022-43237</cvename>
 <cvename>CVE-2022-43238</cvename>
 <cvename>CVE-2022-43239</cvename>
 <cvename>CVE-2022-43240</cvename>
 <cvename>CVE-2022-43241</cvename>
 <cvename>CVE-2022-43242</cvename>
 <cvename>CVE-2022-43243</cvename>
 <cvename>CVE-2022-43244</cvename>
 <cvename>CVE-2022-43245</cvename>
 <cvename>CVE-2022-43248</cvename>
 <cvename>CVE-2022-43249</cvename>
 <cvename>CVE-2022-43250</cvename>
 <cvename>CVE-2022-43252</cvename>
 <cvename>CVE-2022-43253</cvename>
 <cvename>CVE-2022-47655</cvename>
 <url>https://github.com/strukturag/libde265/releases/tag/v1.0.10</url>
 </references>
 <dates>
 <discovery>2023-01-27</discovery>
 <entry>2023-02-21</entry>
 </dates>
 </vuln>

<vuln vid="21f12de8-b1db-11ed-b0f4-002590f2a714">
 <topic>git -- "git apply" overwriting paths outside the working tree</topic>
 <affects>
 <package>
	<name>git</name>
	<range><lt>2.39.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	git team reports:
	<blockquote cite="https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh">
	 By feeding a crafted input to "git apply", a path outside the
	 working tree can be overwritten as the user who is running "git
	 apply".
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-23946</cvename>
 <url>https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/#cve-2023-23946</url>
 </references>
 <dates>
 <discovery>2023-02-14</discovery>
 <entry>2023-02-21</entry>
 </dates>
 </vuln>

<vuln vid="9548d6ed-b1da-11ed-b0f4-002590f2a714">
 <topic>git -- Local clone-based data exfiltration with non-local transports</topic>
 <affects>
 <package>
	<name>git</name>
	<range><lt>2.39.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	git team reports:
	<blockquote cite="https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q">
	 Using a specially-crafted repository, Git can be tricked into using
	 its local clone optimization even when using a non-local transport.
	 Though Git will abort local clones whose source $GIT_DIR/objects
	 directory contains symbolic links (c.f., CVE-2022-39253), the objects
	 directory itself may still be a symbolic link.

These two may be combined to include arbitrary files based on known
	 paths on the victim's filesystem within the malicious repository's
	 working copy, allowing for data exfiltration in a similar manner as
	 CVE-2022-39253.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-22490</cvename>
 <url>https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/#cve-2023-22490</url>
 </references>
 <dates>
 <discovery>2023-02-14</discovery>
 <entry>2023-02-21</entry>
 </dates>
 </vuln>

<vuln vid="8fafbef4-b1d9-11ed-b0f4-002590f2a714">
 <topic>git -- gitattributes parsing integer overflow</topic>
 <affects>
 <package>
	<name>git</name>
	<range><lt>2.39.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	git team reports:
	<blockquote cite="https://github.com/git/git/security/advisories/GHSA-c738-c5qq-xg89">
	 gitattributes are used to define unique attributes corresponding
	 to paths in your repository. These attributes are defined by
	 .gitattributes file(s) within your repository.

The parser used to read these files has multiple integer
	 overflows, which can occur when parsing either a large number
	 of patterns, a large number of attributes, or attributes with
	 overly-long names.

These overflows may be triggered via a malicious
	 .gitattributes file. However, Git automatically splits lines at
	 2KB when reading .gitattributes from a file, but not when parsing
	 it from the index. Successfully exploiting this vulnerability
	 depends on the location of the .gitattributes file in question.

This integer overflow can result in arbitrary heap reads
	 and writes, which may result in remote code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23521</cvename>
 <url>https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2/#cve-2022-23521</url>
 </references>
 <dates>
 <discovery>2023-01-17</discovery>
 <entry>2023-02-21</entry>
 </dates>
 </vuln>

<vuln vid="2fcca7e4-b1d7-11ed-b0f4-002590f2a714">
 <topic>git -- Heap overflow in `git archive`, `git log --format` leading to RCE</topic>
 <affects>
 <package>
	<name>git</name>
	<range><lt>2.39.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The git team reports:
	<blockquote cite="https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq">
	 git log has the ability to display commits using an arbitrary
	 format with its --format specifiers. This functionality is also
	 exposed to git archive via the export-subst gitattribute.
	 When processing the padding operators (e.g., %&lt;(, %&lt;|(,
	 %&gt;(, %&gt;&gt;(, or %&gt;&lt;( ), an integer overflow can occur in
	 pretty.c::format_and_pad_commit() where a size_t is improperly
	 stored as an int, and then added as an offset to a subsequent
	 memcpy() call.
	 This overflow can be triggered directly by a user running a
	 command which invokes the commit formatting machinery (e.g., git
	 log --format=...). It may also be triggered indirectly through
	 git archive via the export-subst mechanism, which expands format
	 specifiers inside of files within the repository during a git
	 archive.
	 This integer overflow can result in arbitrary heap writes, which
	 may result in remote code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-41903</cvename>
 <url>https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2/#cve-2022-41903</url>
 </references>
 <dates>
 <discovery>2023-01-17</discovery>
 <entry>2023-02-21</entry>
 </dates>
 </vuln>

<vuln vid="5048ed45-b0f1-11ed-ab04-9106b1b896dd">
 <topic>gitea -- password hash quality</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.18.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/22942">
	 This PR refactors and improves the password hashing code within
	 gitea and makes it possible for server administrators to set the
	 password hashing parameters.
	 In addition it takes the opportunity to adjust the settings for
	 pbkdf2 in order to make the hashing a little stronger.
	</blockquote>
	<blockquote cite="https://github.com/go-gitea/gitea/pull/22823">
	 Add command to bulk set must-change-password
	 As part of administration sometimes it is appropriate to
	 forcibly tell users to update their passwords.
	 This PR creates a new command gitea admin user
	 must-change-password which will set the MustChangePassword flag on
	 the provided users.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.io/2023/02/gitea-1.18.4-is-released/</url>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.18.4</url>
 </references>
 <dates>
 <discovery>2022-02-14</discovery>
 <entry>2023-02-20</entry>
 </dates>
 </vuln>

<vuln vid="428922c9-b07e-11ed-8700-5404a68ad561">
 <topic>traefik -- Use of vulnerable Go module x/net/http2</topic>
 <affects>
 <package>
	<name>traefik</name>
	<range><lt>2.9.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://pkg.go.dev/vuln/GO-2023-1495">
	 A request smuggling attack is possible when using
 MaxBytesHandler. When using MaxBytesHandler, the body of
 an HTTP request is not fully consumed. When the server
 attempts to read HTTP2 frames from the connection, it
 will instead be reading the body of the HTTP request,
 which could be attacker-manipulated to represent
 arbitrary HTTP2 requests.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-41721</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41721</url>
 </references>
 <dates>
 <discovery>2022-10-22</discovery>
 <entry>2023-02-19</entry>
 </dates>
 </vuln>

<vuln vid="27c822a0-addc-11ed-a9ee-dca632b19f10">
 <topic>Rundeck3 -- Log4J RCE vulnerability</topic>
 <affects>
 <package>
	<name>rundeck3</name>
	<range><lt>3.4.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Rundeck project reports:
	<blockquote cite="https://docs.rundeck.com/docs/history/3_4_x/version-3.4.10.html">
	 This release updates both Community and Enterprise with the latest Log4J
	 to address CVE-2021-44832 by updating it to 2.17.1.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44832</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44832</url>
 </references>
 <dates>
 <discovery>2021-12-11</discovery>
 <entry>2023-02-16</entry>
 </dates>
 </vuln>

<vuln vid="8e20430d-a72b-11ed-a04f-40b034455553">
 <topic>MinIO -- unprivileged users can create service accounts for admin users</topic>
 <affects>
 <package>
	<name>minio</name>
	<range><lt>2022.04.12.06.55.35</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MinIO reports:
	<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-2j69-jjmg-534q">
	 
	 A security issue was found where an unprivileged user is
	 able to create service accounts for root or other admin
	 users and then is able to assume their access policies
	 via the generated credentials.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-24842</cvename>
 <url>https://github.com/minio/minio/security/advisories/GHSA-2j69-jjmg-534q</url>
 </references>
 <dates>
 <discovery>2022-04-11</discovery>
 <entry>2023-02-13</entry>
 </dates>
 </vuln>

<vuln vid="fd792048-ad91-11ed-a879-080027f5fec9">
 <topic>clamav -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>1.0.1,1</lt></range>
 </package>
 <package>
	<name>clamav-lts</name>
	<range><lt>0.103.8,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Scannell reports:
	<blockquote cite="https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html">
	 <dl>
	 <dt>CVE-2023-20032</dt>
	 <dd>
	 Fixed a possible remote code execution vulnerability in the HFS+ file parser.
	 </dd>
	 <dt>CVE-2023-20052</dt>
	 <dd>
	 Fixed a possible remote information leak vulnerability in the DMG file parser.
	 </dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-20032</cvename>
 <cvename>CVE-2023-20052</cvename>
 <url>https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html</url>
 </references>
 <dates>
 <discovery>2023-02-15</discovery>
 <entry>2023-02-16</entry>
 </dates>
 </vuln>

<vuln vid="3d73e384-ad1f-11ed-983c-83fe35862e3a">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go119</name>
	<range><lt>1.19.6</lt></range>
 </package>
 <package>
	<name>go120</name>
	<range><lt>1.20.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/57274">
	 path/filepath: path traversal in filepath.Clean on Windows
	 On Windows, the filepath.Clean function could transform
	 an invalid path such as a/../c:/b into the valid path
	 c:\b. This transformation of a relative (if invalid)
	 path into an absolute path could enable a directory
	 traversal attack. The filepath.Clean function will now
	 transform this path into the relative (but still
	 invalid) path .\c:\b.
	</blockquote>
	<blockquote cite="https://go.dev/issue/58006">
	 net/http, mime/multipart: denial of service from excessive
	 resource consumption
	 Multipart form parsing with
	 mime/multipart.Reader.ReadForm can consume largely
	 unlimited amounts of memory and disk files. This also
	 affects form parsing in the net/http package with the
	 Request methods FormFile, FormValue, ParseMultipartForm,
	 and PostFormValue.
	</blockquote>
	<blockquote cite="https://go.dev/issue/58001">
	 crypto/tls: large handshake records may cause panics
	 
	 Both clients and servers may send large TLS handshake
	 records which cause servers and clients,
	 respectively, to panic when attempting to construct responses.
	</blockquote>
	<blockquote cite="https://go.dev/issue/57855">
	 net/http: avoid quadratic complexity in HPACK decoding
	 A maliciously crafted HTTP/2 stream could cause
	 excessive CPU consumption in the HPACK decoder,
	 sufficient to cause a denial of service from a small
	 number of small requests.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-41722</cvename>
 <cvename>CVE-2022-41725</cvename>
 <cvename>CVE-2022-41724</cvename>
 <cvename>CVE-2022-41723</cvename>
 <url>https://groups.google.com/g/golang-dev/c/G2APtTxT1HQ/m/6O6aksDaBAAJ</url>
 </references>
 <dates>
 <discovery>2023-02-14</discovery>
 <entry>2023-02-15</entry>
 </dates>
 </vuln>

<vuln vid="9c9ee9a6-ac5e-11ed-9323-080027d3a315">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py37-django32</name>
	<name>py38-django32</name>
	<name>py39-django32</name>
	<name>py310-django32</name>
	<range><lt>3.2.18</lt></range>
 </package>
 <package>
	<name>py38-django40</name>
	<name>py39-django40</name>
	<name>py310-django40</name>
	<range><lt>4.0.10</lt></range>
 </package>
 <package>
	<name>py38-django41</name>
	<name>py39-django41</name>
	<name>py310-django41</name>
	<range><lt>4.1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2023/feb/14/security-releases/">
	 CVE-2023-24580: Potential denial-of-service vulnerability in file uploads.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-24580</cvename>
 <url>https://www.djangoproject.com/weblog/2023/feb/14/security-releases/</url>
 </references>
 <dates>
 <discovery>2023-02-01</discovery>
 <entry>2023-02-14</entry>
 </dates>
 </vuln>

<vuln vid="0a7a5dfb-aba4-11ed-be2c-001cc0382b2f">
 <topic>GnuTLS -- timing sidechannel in RSA decryption</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>3.7.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GnuTLS project reports:
	<blockquote cite="https://gnutls.org/security-new.html#GNUTLS-SA-2020-07-14">
	 A vulnerability was found that the response times to malformed RSA
	 ciphertexts in ClientKeyExchange differ from response times of
	 ciphertexts with correct PKCS#1 v1.5 padding. Only TLS ciphertext
	 processing is affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0361</cvename>
 <url>https://gnutls.org/security-new.html#GNUTLS-SA-2020-07-14</url>
 </references>
 <dates>
 <discovery>2023-02-10</discovery>
 <entry>2023-02-13</entry>
 </dates>
 </vuln>

<vuln vid="3eccc968-ab17-11ed-bd9e-589cfc0f81b0">
 <topic>phpmyfaq -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><lt>3.1.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpmyfaq developers report:
	<blockquote cite="https://www.phpmyfaq.de/security/advisory-2022-10-24">
	 a bypass to flood admin with FAQ proposals
	 stored XSS in questions
	 stored HTML injections
	 weak passwords 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://huntr.dev/bounties/14fc4841-0f5d-4e12-bf9e-1b60d2ac6a6c/</url>
 <url>https://huntr.dev/bounties/8c74ccab-0d1d-4c6b-a0fa-803aa65de04f/</url>
 <url>https://huntr.dev/bounties/87397c71-7b84-4617-a66e-fa6c73be9024/</url>
 <url>https://huntr.dev/bounties/808d5452-607c-4af1-812f-26c49faf3e61/</url>
 <url>https://huntr.dev/bounties/d9375178-2f23-4f5d-88bd-bba3d6ba7cc5/</url>
 <url>https://huntr.dev/bounties/06af150b-b481-4248-9a48-56ded2814156/</url>
 <url>https://huntr.dev/bounties/7152b340-c6f3-4ac8-9f62-f764a267488d/</url>
 <url>https://huntr.dev/bounties/9e21156b-ab1d-4c60-88ef-8c9f3e2feb7f/</url>
 <url>https://huntr.dev/bounties/b3881a1f-2f1e-45cb-86f3-735f66e660e9/</url>
 <url>https://huntr.dev/bounties/949975f1-271d-46aa-85e5-1a013cdb5efb/</url>
 </references>
 <dates>
 <discovery>2023-02-12</discovery>
 <entry>2023-02-12</entry>
 </dates>
 </vuln>

<vuln vid="310ca30e-a951-11ed-8314-a8a1599412c6">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>110.0.5481.77</lt></range>
 </package>
 <package>
	<name>ungoogled-chromium</name>
	<range><lt>110.0.5481.77</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html">
	 This release contains 15 security fixes, including:
	 <ul>
	 <li>[1402270] High CVE-2023-0696: Type Confusion in V8. Reported by Haein Lee at KAIST Hacking Lab on 2022-12-18</li>
	 <li>[1341541] High CVE-2023-0697: Inappropriate implementation in Full screen mode. Reported by Ahmed ElMasry on 2022-07-03</li>
	 <li>[1403573] High CVE-2023-0698: Out of bounds read in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2022-12-25</li>
	 <li>[1371859] Medium CVE-2023-0699: Use after free in GPU. Reported by 7o8v and Cassidy Kim(@cassidy6564) on 2022-10-06</li>
	 <li>[1393732] Medium CVE-2023-0700: Inappropriate implementation in Download. Reported by Axel Chong on 2022-11-26</li>
	 <li>[1405123] Medium CVE-2023-0701: Heap buffer overflow in WebUI. Reported by Sumin Hwang of SSD Labs on 2023-01-05</li>
	 <li>[1316301] Medium CVE-2023-0702: Type Confusion in Data Transfer. Reported by Sri on 2022-04-14</li>
	 <li>[1405574] Medium CVE-2023-0703: Type Confusion in DevTools. Reported by raven at KunLun lab on 2023-01-07</li>
	 <li>[1385982] Low CVE-2023-0704: Insufficient policy enforcement in DevTools. Reported by Rhys Elsmore and Zac Sims of the Canva security team on 2022-11-18</li>
	 <li>[1238642] Low CVE-2023-0705: Integer overflow in Core. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-11</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0696</cvename>
 <cvename>CVE-2023-0697</cvename>
 <cvename>CVE-2023-0698</cvename>
 <cvename>CVE-2023-0699</cvename>
 <cvename>CVE-2023-0700</cvename>
 <cvename>CVE-2023-0701</cvename>
 <cvename>CVE-2023-0702</cvename>
 <cvename>CVE-2023-0703</cvename>
 <cvename>CVE-2023-0704</cvename>
 <cvename>CVE-2023-0705</cvename>
 <url>https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2023-02-07</discovery>
 <entry>2023-02-10</entry>
 </dates>
 </vuln>

<vuln vid="7a8b6170-a889-11ed-bbae-6cc21735f730">
 <topic>PostgreSQL server -- Client memory disclosure when connecting, with Kerberos, to modified server.</topic>
 <affects>
 <package>
	<name>postgresql15-client</name>
	<range><lt>15.2</lt></range>
 </package>
 <package>
	<name>postgresql14-client</name>
	<range><lt>14.7</lt></range>
 </package>
 <package>
	<name>postgresql13-client</name>
	<range><lt>13.10</lt></range>
 </package>
 <package>
	<name>postgresql12-client</name>
	<range><lt>12.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL Project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2022-41862/">
	 
	 A modified, unauthenticated server can send an
	 unterminated string during the establishment of Kerberos
	 transport encryption. When a libpq client application
	 has a Kerberos credential cache and doesn't explicitly
	 disable option gssencmode, a server can cause libpq to
	 over-read and report an error message containing
	 uninitialized bytes from and following its receive
	 buffer. If libpq's caller somehow makes that message
	 accessible to the attacker, this achieves a disclosure
	 of the over-read bytes. We have not confirmed or ruled
	 out viability of attacks that arrange for a crash or for
	 presence of notable, confidential information in
	 disclosed bytes.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-41862</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2022-41862/</url>
 </references>
 <dates>
 <discovery>2023-02-09</discovery>
 <entry>2023-02-09</entry>
 </dates>
 </vuln>

<vuln vid="ecffb881-a7a7-11ed-8d6a-6c3be5272acd">
 <topic>Grafana -- Stored XSS in ResourcePicker component</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>8.1.0</ge><lt>8.5.16</lt></range>
	<range><ge>9.0.0</ge><lt>9.2.10</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.4</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.1.0</ge><lt>8.5.16</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge><lt>9.2.10</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2023/01/25/grafana-security-releases-new-versions-with-fixes-for-cve-2022-23552-cve-2022-41912-and-cve-2022-39324/">
	 On 2022-12-16 during an internal audit of Grafana, a member of the security
	 team found a stored XSS vulnerability affecting the core plugin GeoMap.
	 The stored XSS vulnerability was possible due to SVG-files weren't properly
	 sanitized and allowed arbitrary JavaScript to be executed in the context
	 of the currently authorized user of the Grafana instance.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23552</cvename>
 <url>https://github.com/grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xv</url>
 </references>
 <dates>
 <discovery>2022-12-16</discovery>
 <entry>2023-02-09</entry>
 </dates>
 </vuln>

<vuln vid="e6281d88-a7a7-11ed-8d6a-6c3be5272acd">
 <topic>Grafana -- Spoofing originalUrl of snapshots</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>8.0.0</ge><lt>8.5.16</lt></range>
	<range><ge>9.0.0</ge><lt>9.2.10</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.4</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.0.0</ge><lt>8.5.16</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge><lt>9.2.10</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2023/01/25/grafana-security-releases-new-versions-with-fixes-for-cve-2022-23552-cve-2022-41912-and-cve-2022-39324/">
	 A third-party penetration test of Grafana found a vulnerability
	 in the snapshot functionality. The value of the originalUrl parameter
	 is automatically generated. The purpose of the presented originalUrl parameter
	 is to provide a user who views the snapshot with the possibility to click
	 on the Local Snapshot button in the Grafana web UI
	 and be presented with the dashboard that the snapshot captured. The value
	 of the originalUrl parameter can be arbitrarily chosen by a malicious user that
	 creates the snapshot. (Note: This can be done by editing the query thanks
	 to a web proxy like Burp.)
	 We have assessed this vulnerability as having a CVSS score of 6.7 MEDIUM
	 (CVSS:6.7/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-39324</cvename>
 <url>https://github.com/grafana/grafana/security/advisories/GHSA-4724-7jwc-3fpw</url>
 </references>
 <dates>
 <discovery>2023-01-25</discovery>
 <entry>2023-02-09</entry>
 </dates>
 </vuln>

<vuln vid="1dd84344-a7da-11ed-86e9-d4c9ef517024">
 <topic>LibreSSL -- Arbitrary memory read</topic>
 <affects>
 <package>
	<name>libressl</name>
	<range><lt>3.5.4</lt></range>
 </package>
 <package>
	<name>libressl-devel</name>
	<range><lt>3.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenBSD project reports:
	<blockquote cite="https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.5.4-relnotes.txt">
	 A malicious certificate revocation list or timestamp response token
	 would allow an attacker to read arbitrary memory.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.5.4-relnotes.txt</url>
 </references>
 <dates>
 <discovery>2023-02-08</discovery>
 <entry>2023-02-08</entry>
 </dates>
 </vuln>

<vuln vid="6cc63bf5-a727-4155-8ec4-68b626475e68">
 <topic>xorg-server -- Security issue in the X server</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<name>xephyr</name>
	<name>xorg-vfbserver</name>
	<range><lt>21.1.7,1</lt></range>
 </package>
 <package>
	<name>xorg-nestserver</name>
	<range><lt>21.1.7,2</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>22.1.8,1</lt></range>
 </package>
 <package>
	<name>xwayland-devel</name>
	<range><lt>21.0.99.1.386</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The X.org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2023-February/003320.html">
	 <ul>
	 <li>CVE-2023-0494/ZDI-CAN-19596: X.Org Server DeepCopyPointerClasses
	 use-after-free

A dangling pointer in DeepCopyPointerClasses can be exploited by
	 ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read/write into
	 freed memory.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.x.org/archives/xorg-announce/2023-February/003320.html</url>
 <cvename>CVE-2023-0494</cvename>
 </references>
 <dates>
 <discovery>2023-02-07</discovery>
 <entry>2023-02-08</entry>
 </dates>
 </vuln>

<vuln vid="b34c1947-a749-11ed-b24b-1c61b4739ac9">
 <topic>TightVNC -- Muliple Vulnerabilities</topic>
 <affects>
 <package>
	<name>tightvnc</name>
	<range><le>1.3.10_6</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8287">
	 TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15678">
	 TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15679">
	 TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15680">
	 TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network connectivity.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-8287</cvename>
 <cvename>CVE-2019-15678</cvename>
 <cvename>CVE-2019-15679</cvename>
 <cvename>CVE-2019-15680</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8287</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15678</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15679</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15680</url>
 </references>
 <dates>
 <discovery>2019-02-12</discovery>
 <entry>2023-02-08</entry>
 </dates>
 </vuln>

<vuln vid="648a432c-a71f-11ed-86e9-d4c9ef517024">
 <topic>OpenSSL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.1.1t,1</lt></range>
 </package>
 <package>
	<name>openssl-devel</name>
	<range><lt>3.0.8</lt></range>
 </package>
 <package>
	<name>openssl-quictls</name>
	<range><lt>3.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20230207.txt">
	 X.400 address type confusion in X.509 GeneralName (CVE-2023-0286) (High):
	 There is a type confusion vulnerability relating to X.400 address processing
	 inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
	 the public structure definition for GENERAL_NAME incorrectly specified the type
	 of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by
	 the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an
	 ASN1_STRING.
	 Timing Oracle in RSA Decryption (CVE-2022-4304) (Moderate):
	 A timing based side channel exists in the OpenSSL RSA Decryption implementation
	 which could be sufficient to recover a plaintext across a network in a
	 Bleichenbacher style attack. To achieve a successful decryption an attacker
	 would have to be able to send a very large number of trial messages for
	 decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,
	 RSA-OEAP and RSASVE.
	 X.509 Name Constraints Read Buffer Overflow (CVE-2022-4203) (Moderate):
	 A read buffer overrun can be triggered in X.509 certificate verification,
	 specifically in name constraint checking. Note that this occurs
	 after certificate chain signature verification and requires either a
	 CA to have signed the malicious certificate or for the application to
	 continue certificate verification despite failure to construct a path
	 to a trusted issuer.
	 Use-after-free following BIO_new_NDEF (CVE-2023-0215) (Moderate):
	 The public API function BIO_new_NDEF is a helper function used for streaming
	 ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the
	 SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by
	 end user applications.
	 Double free after calling PEM_read_bio_ex (CVE-2022-4450) (Moderate):
	 The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
	 decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data.
	 If the function succeeds then the "name_out", "header" and "data" arguments are
	 populated with pointers to buffers containing the relevant decoded data. The
	 caller is responsible for freeing those buffers. It is possible to construct a
	 PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()
	 will return a failure code but will populate the header argument with a pointer
	 to a buffer that has already been freed. If the caller also frees this buffer
	 then a double free will occur. This will most likely lead to a crash. This
	 could be exploited by an attacker who has the ability to supply malicious PEM
	 files for parsing to achieve a denial of service attack.
	 Invalid pointer dereference in d2i_PKCS7 functions (CVE-2023-0216) (Moderate):
	 An invalid pointer dereference on read can be triggered when an
	 application tries to load malformed PKCS7 data with the
	 d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.
	 NULL dereference validating DSA public key (CVE-2023-0217) (Moderate):
	 An invalid pointer dereference on read can be triggered when an
	 application tries to check a malformed DSA public key by the
	 EVP_PKEY_public_check() function. This will most likely lead
	 to an application crash. This function can be called on public
	 keys supplied from untrusted sources which could allow an attacker
	 to cause a denial of service attack.
	 NULL dereference during PKCS7 data verification (CVE-2023-0401) (Moderate):
	 A NULL pointer can be dereferenced when signatures are being
	 verified on PKCS7 signed or signedAndEnveloped data. In case the hash
	 algorithm used for the signature is known to the OpenSSL library but
	 the implementation of the hash algorithm is not available the digest
	 initialization will fail. There is a missing check for the return
	 value from the initialization function which later leads to invalid
	 usage of the digest API most likely leading to a crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0286</cvename>
 <cvename>CVE-2022-4304</cvename>
 <cvename>CVE-2022-4203</cvename>
 <cvename>CVE-2023-0215</cvename>
 <cvename>CVE-2022-4450</cvename>
 <cvename>CVE-2023-0216</cvename>
 <cvename>CVE-2023-0401</cvename>
 <url>https://www.openssl.org/news/secadv/20230207.txt</url>
 </references>
 <dates>
 <discovery>2023-02-07</discovery>
 <entry>2023-02-07</entry>
 </dates>
 </vuln>

<vuln vid="c49a880d-a5bb-11ed-aab5-080027de9982">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py37-django32</name>
	<name>py38-django32</name>
	<name>py39-django32</name>
	<name>py310-django32</name>
	<range><lt>3.2.17</lt></range>
 </package>
 <package>
	<name>py38-django40</name>
	<name>py39-django40</name>
	<name>py310-django40</name>
	<range><lt>4.0.9</lt></range>
 </package>
 <package>
	<name>py38-django41</name>
	<name>py39-django41</name>
	<name>py310-django41</name>
	<range><lt>4.1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2023/feb/01/security-releases/">
	 CVE-2023-23969: Potential denial-of-service via Accept-Language headers.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-23969</cvename>
 <url>https://www.djangoproject.com/weblog/2023/feb/01/security-releases/</url>
 </references>
 <dates>
 <discovery>2023-02-01</discovery>
 <entry>2023-02-06</entry>
 </dates>
 </vuln>

<vuln vid="01823528-a4c1-11ed-b6af-b42e991fc52e">
 <topic>kafka -- Denial Of Service vulnerability</topic>
 <affects>
 <package>
	<name>kafka</name>
	<range><lt>3.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NIST reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2020-36518">
	 jackson-databind before 2.13.0 allows a Java StackOverflow
	 exception and denial of service via a large depth of nested
	 objects.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-36518</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-36518</url>
 </references>
 <dates>
 <discovery>2022-03-11</discovery>
 <entry>2023-02-04</entry>
 </dates>
 </vuln>

<vuln vid="d835c54f-a4bd-11ed-b6af-b42e991fc52e">
 <topic>node_exporter -- bypass security with cache poisoning</topic>
 <affects>
 <package>
	<name>node_exporter</name>
	<range><lt>1.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prometheus team reports:
	<blockquote cite="https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p">
	
	 Prometheus and its exporters can be secured by a web.yml file that
	 specifies usernames and hashed passwords for basic authentication.
	 Passwords are hashed with bcrypt, which means that even if you have
	 access to the hash, it is very hard to find the original password
	 back. Passwords are hashed with bcrypt, which means that even if you
	 have access to the hash, it is very hard to find the original
	 password back. However, a flaw in the way this mechanism was
	 implemented in the exporter toolkit makes it possible with people
	 who know the hashed password to authenticate against Prometheus.
	 A request can be forged by an attacker to poison the internal cache
	 used to cache the computation of hashes and make subsequent requests
	 successful. This cache is used in both happy and unhappy scenarios
	 in order to limit side channel attacks that could tell an attacker
	 if a user is present in the file or not.
	
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-46146</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46146</url>
 </references>
 <dates>
 <discovery>2021-11-28</discovery>
 <entry>2023-02-04</entry>
 </dates>
 </vuln>

<vuln vid="8dd438ed-a338-11ed-b48b-589cfc0f81b0">
 <topic>Asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk18</name>
	<range><lt>18.15.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories/">
	 AST-2022-007: Remote Crash Vulnerability in H323 channel add on
	 AST-2022-008: Use after free in res_pjsip_pubsub.c
	 AST-2022-009: GetConfig AMI Action can read files outside of
	 Asterisk directory
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-37325</cvename>
 <cvename>CVE-2022-42705</cvename>
 <cvename>CVE-2022-42706</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2022-007.html</url>
 <url>https://downloads.asterisk.org/pub/security/AST-2022-008.html</url>
 <url>https://downloads.asterisk.org/pub/security/AST-2022-009.html</url>
 </references>
 <dates>
 <discovery>2022-12-01</discovery>
 <entry>2023-02-02</entry>
 </dates>
 </vuln>

<vuln vid="c3fb48cc-a2ff-11ed-8fbc-6cf0490a8c18">
 <topic>Spotipy -- Path traversal vulnerability</topic>
 <affects>
 <package>
	<name>py37-spotipy</name>
	<name>py38-spotipy</name>
	<name>py39-spotipy</name>
	<name>py310-spotipy</name>
	<name>py311-spotipy</name>
	<range><le>2.22.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	StÃ©phane Bruckert
 <blockquote cite="https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v">
	 If a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-23608</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23608</url>
 <url>https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v</url>
 </references>
 <dates>
 <discovery>2023-01-16</discovery>
 <entry>2023-02-02</entry>
 </dates>
 </vuln>

<vuln vid="2b5fc9c4-eaca-46e0-83d0-9b10c51c4b1b">
 <topic>zeek -- potential DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>5.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.6">
	 A missing field in the SMB FSControl script-land record could
	 cause a heap buffer overflow when receiving packets containing
	 those header types. 
	 Receiving a series of packets that start with HTTP/1.0
	 and then switch to HTTP/0.9 could cause Zeek to spend a
	 large amount of time processing the packets. 
	 Receiving large numbers of FTP commands sequentially
	 from the network with bad data in them could cause Zeek
	 to spend a large amount of time processing the packets,
	 and generate a large amount of events. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v5.0.6</url>
 </references>
 <dates>
 <discovery>2023-02-01</discovery>
 <entry>2023-02-01</entry>
 </dates>
 </vuln>

<vuln vid="ee890be3-a1ec-11ed-a81d-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>15.8.0</ge><lt>15.8.1</lt></range>
	<range><ge>15.7.0</ge><lt>15.7.6</lt></range>
	<range><ge>12.4.0</ge><lt>15.6.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/01/31/security-release-gitlab-15-8-1-released/">
	 Denial of Service via arbitrarily large Issue descriptions
	 CSRF via file upload allows an attacker to take over a repository
	 Sidekiq background job DoS by uploading malicious CI job artifact zips
	 Sidekiq background job DoS by uploading a malicious Helm package
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3411</cvename>
 <cvename>CVE-2022-4138</cvename>
 <cvename>CVE-2022-3759</cvename>
 <cvename>CVE-2023-0518</cvename>
 <url>https://about.gitlab.com/releases/2023/01/31/security-release-gitlab-15-8-1-released/</url>
 </references>
 <dates>
 <discovery>2023-01-31</discovery>
 <entry>2023-02-01</entry>
 </dates>
 </vuln>

<vuln vid="98f78c7a-a08e-11ed-946e-002b67dfc673">
 <topic>Plex Media Server -- security vulnerability</topic>
 <affects>
 <package>
	<name>plexmediaserver</name>
	<name>plexmediaserver-plexpass</name>
	<range><lt>1.25.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Plex Security Team reports:
	<blockquote cite="https://forums.plex.tv/t/security-regarding-cve-2021-42835/761510">
	 We have recently been made aware of a security vulnerability in Plex Media Server versions prior to 1.25.0 that could allow a local Windows user to obtain administrator privileges without authorization. To be clear, this required the user to already have local, physical access to the computer (just with a different user account on Windows). There are no indications that this exploit could be used from a remote machine.
	 Plex Media Server versions 1.25.0.5282 and newer are not subject to this vulnerability, and feature additional hardening to prevent similar issues from occurring in the future. Users running older server versions are encouraged to update their Plex Media Server installations.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-42835</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42835</url>
 </references>
 <dates>
 <discovery>2021-10-22</discovery>
 <entry>2023-01-30</entry>
 </dates>
 </vuln>

<vuln vid="791a09c5-a086-11ed-954d-b42e991fc52e">
 <topic>prometheus2 -- basic authentication bypass</topic>
 <affects>
 <package>
	<name>prometheus</name>
	<range><lt>0.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prometheus team reports:
	<blockquote cite="https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p">
	
	 Prometheus and its exporters can be secured by a web.yml file that
	 specifies usernames and hashed passwords for basic authentication.
	 Passwords are hashed with bcrypt, which means that even if you have
	 access to the hash, it is very hard to find the original password
	 back. Passwords are hashed with bcrypt, which means that even if you
	 have access to the hash, it is very hard to find the original
	 password back. However, a flaw in the way this mechanism was
	 implemented in the exporter toolkit makes it possible with people
	 who know the hashed password to authenticate against Prometheus.
	 A request can be forged by an attacker to poison the internal cache
	 used to cache the computation of hashes and make subsequent requests
	 successful. This cache is used in both happy and unhappy scenarios
	 in order to limit side channel attacks that could tell an attacker
	 if a user is present in the file or not.
	
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-46146</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46146</url>
 </references>
 <dates>
 <discovery>2022-11-28</discovery>
 <entry>2023-01-30</entry>
 </dates>
 </vuln>

<vuln vid="3d0a3eb0-9ca3-11ed-a925-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>109.0.5414.119</lt></range>
 </package>
 <package>
	<name>ungoogled-chromium</name>
	<range><lt>109.0.5414.119</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop_24.html">
	 This release contains 6 security fixes, including:
	 <ul>
	 <li>[1376354] High CVE-2023-0471: Use after free in WebTransport. Reported by chichoo Kim(chichoo) and Cassidy Kim(@cassidy6564) on 2022-10-19</li>
	 <li>[1405256] High CVE-2023-0472: Use after free in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2023-01-06</li>
	 <li>[1404639] Medium CVE-2023-0473: Type Confusion in ServiceWorker API. Reported by raven at KunLun lab on 2023-01-03</li>
	 <li>[1400841] Medium CVE-2023-0474: Use after free in GuestView. Reported by avaue at S.S.L on 2022-12-14</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0471</cvename>
 <cvename>CVE-2023-0472</cvename>
 <cvename>CVE-2023-0473</cvename>
 <cvename>CVE-2023-0474</cvename>
 <url>https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop_24.html</url>
 </references>
 <dates>
 <discovery>2023-01-24</discovery>
 <entry>2023-01-25</entry>
 </dates>
 </vuln>

<vuln vid="b0e1fa2b-9c86-11ed-9296-002b67dfc673">
 <topic>re2c -- uncontrolled recursion</topic>
 <affects>
 <package>
	<name>re2c</name>
	<range><lt>2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	re2c reports:
	<blockquote cite="https://github.com/advisories/GHSA-pgr8-gpgg-9j5m">
	 re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-21232</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2018-21232</url>
 </references>
 <dates>
 <discovery>2022-05-24</discovery>
 <entry>2023-01-25</entry>
 </dates>
 </vuln>

<vuln vid="b8a0fea2-9be9-11ed-8acf-0800277bb8a8">
 <topic>gitea -- information disclosure</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.18.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/22566">
	 Prevent multiple To recipients: Change the mailer interface to
	 prevent leaking of possible hidden email addresses when sending
	 to multiple recipients.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.io/2023/01/gitea-1.18.3-is-released/</url>
 </references>
 <dates>
 <discovery>2022-01-22</discovery>
 <entry>2023-01-24</entry>
 </dates>
 </vuln>

<vuln vid="7844789a-9b1f-11ed-9a3f-b42e991fc52e">
 <topic>net/krill -- DoS vulnerability</topic>
 <affects>
 <package>
	<name>krill</name>
	<range><lt>0.12.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0158">
	
		NLnet Labs Krill supports direct access to the RRDP repository
		content through its built-in web server at the "/rrdp" endpoint.
		Prior to 0.12.1 a direct query for any existing directory under
		"/rrdp/", rather than an RRDP file such as "/rrdp/notification.xml"
		as would be expected, causes Krill to crash. If the built-in "/rrdp"
		endpoint is exposed directly to the internet, then malicious remote
		parties can cause the publication server to crash. The repository
		content is not affected by this, but the availability of the server
		and repository can cause issues if this attack is persistent and is
		not mitigated. .
	
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0158</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0158</url>
 </references>
 <dates>
 <discovery>2023-01-10</discovery>
 <entry>2023-01-23</entry>
 </dates>
 </vuln>

<vuln vid="bba3f684-9b1d-11ed-9a3f-b42e991fc52e">
 <topic>www/awstats -- Partial absolute pathname</topic>
 <affects>
 <package>
	<name>awstats</name>
	<range><lt>7.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35176">
	 It seems #90 is not completely fixed in 7.8.
	 (that is, even after CVE-2017-1000501 and CVE-2020-29600 are fixed).
	 In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a
	 partial absolute pathname (omitting the initial /etc), even
	 though it was intended to only read a file in the /etc/awstats/awstats.conf format.
	 NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600.
	
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-35176</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35176</url>
 </references>
 <dates>
 <discovery>2022-12-11</discovery>
 <entry>2023-01-23</entry>
 </dates>
 </vuln>

<vuln vid="b6f7ad7d-9b19-11ed-9a3f-b42e991fc52e">
 <topic>net/eternalterminal -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>eternalterminal</name>
	<range><lt>6.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48257">
	 etserver and etclient have predictable logfile names in
	 /tmp and they are world-readable logfiles
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-48257</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48257</url>
 <cvename>CVE-2022-48258</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48258</url>
 </references>
 <dates>
 <discovery>2023-01-13</discovery>
 <entry>2023-01-23</entry>
 </dates>
 </vuln>

<vuln vid="28b69630-9b10-11ed-97a6-6805ca2fa271">
 <topic>powerdns-recursor -- denial of service</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><ge>4.8.0</ge><lt>4.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://blog.powerdns.com/2023/01/20/security-advisory-2023-01-for-powerdns-recursor-4-8-0/">
	 PowerDNS Security Advisory 2023-01: unbounded recursion results in program termination
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-22617</cvename>
 <url>https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-01.html</url>
 </references>
 <dates>
 <discovery>2023-01-20</discovery>
 <entry>2023-01-23</entry>
 </dates>
 </vuln>

<vuln vid="a3b10c9b-99d9-11ed-aa55-d05099fed512">
	 <topic>shells/fish -- arbitrary code execution via git</topic>
 <affects>
 <package>
	<name>fish</name>
	<range><ge>3.1.0</ge><lt>3.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Peter Ammon reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2022-20001">
	
		fish is a command line shell. fish version 3.1.0 through
		version 3.3.1 is vulnerable to arbitrary code execution.
		git repositories can contain per-repository
		configuration that change the behavior of git, including
		running arbitrary commands. When using the default
		configuration of fish, changing to a directory
		automatically runs git commands in order to display
		information about the current repository in the prompt.
		If an attacker can convince a user to change their
		current directory into one controlled by the attacker,
		such as on a shared file system or extracted archive,
		fish will run arbitrary commands under the attacker's
		control. This problem has been fixed in fish 3.4.0. Note
		that running git in these directories, including using
		the git tab completion, remains a potential trigger for
		this issue. As a workaround, remove the
		fish_git_prompt function from the prompt.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-20001</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20001</url>
 </references>
 <dates>
 <discovery>2021-12-26</discovery>
 <entry>2023-01-21</entry>
 </dates>
 </vuln>

<vuln vid="dc49f6dc-99d2-11ed-86e9-d4c9ef517024">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql-connector-c++</name>
	<range><lt>8.0.33</lt></range>
 </package>
 <package>
	<name>mysql-connector-odbc</name>
	<range><lt>8.0.33</lt></range>
 </package>
 <package>
	<name>mysql-client57</name>
	<range><lt>5.7.42</lt></range>
 </package>
 <package>
	<name>mysql-server57</name>
	<range><lt>5.7.42</lt></range>
 </package>
 <package>
	<name>mysql-client80</name>
	<range><lt>8.0.33</lt></range>
 </package>
 <package>
	<name>mysql-server80</name>
	<range><lt>8.0.33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujan2023.html#AppendixMSQL">
	 This Critical Patch Update contains 37 new security patches for
	 Oracle MySQL. 8 of these vulnerabilities may be remotely exploitable
	 without authentication, i.e., may be exploited over a network withouti
	 requiring user credentials.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-32221</cvename>
 <cvename>CVE-2022-24407</cvename>
 <cvename>CVE-2022-24407</cvename>
 <cvename>CVE-2022-3171</cvename>
 <cvename>CVE-2022-1941</cvename>
 <cvename>CVE-2023-21868</cvename>
 <cvename>CVE-2023-21860</cvename>
 <cvename>CVE-2023-21875</cvename>
 <cvename>CVE-2023-21869</cvename>
 <cvename>CVE-2023-21877</cvename>
 <cvename>CVE-2023-21880</cvename>
 <cvename>CVE-2023-21872</cvename>
 <cvename>CVE-2023-21871</cvename>
 <cvename>CVE-2023-21836</cvename>
 <cvename>CVE-2023-21887</cvename>
 <cvename>CVE-2023-21863</cvename>
 <cvename>CVE-2023-21864</cvename>
 <cvename>CVE-2023-21865</cvename>
 <cvename>CVE-2023-21866</cvename>
 <cvename>CVE-2023-21867</cvename>
 <cvename>CVE-2023-21870</cvename>
 <cvename>CVE-2023-21873</cvename>
 <cvename>CVE-2023-21876</cvename>
 <cvename>CVE-2023-21878</cvename>
 <cvename>CVE-2023-21879</cvename>
 <cvename>CVE-2023-21881</cvename>
 <cvename>CVE-2023-21883</cvename>
 <cvename>CVE-2023-21840</cvename>
 <cvename>CVE-2023-21882</cvename>
 <cvename>CVE-2023-21874</cvename>
 <url>https://www.oracle.com/security-alerts/cpujan2023.html#AppendixMSQL</url>
 </references>
 <dates>
 <discovery>2023-01-20</discovery>
 <entry>2023-01-21</entry>
 </dates>
 </vuln>

<vuln vid="005dfb48-990d-11ed-b9d3-589cfc0f81b0">
 <topic>phpmyfaq -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><lt>3.1.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpmyfaq developers report:
	<blockquote cite="https://www.phpmyfaq.de/security/advisory-2022-10-24">
	 phpMyFAQ does not implement sufficient checks to avoid a stored
	 XSS in "Add new question"
	 phpMyFAQ does not implement sufficient checks to avoid a stored XSS
	 in admin user page
	 phpMyFAQ does not implement sufficient checks to avoid a stored XSS
	 in FAQ comments
	 phpMyFAQ does not implement sufficient checks to avoid a blind
	 stored XSS in admin open question page
	 phpMyFAQ does not implement sufficient checks to avoid a reflected
	 XSS in the admin backend login
	 phpMyFAQ does not implement sufficient checks to avoid stored XSS
	 on user, category, FAQ, news and configuration admin backend
	 phpMyFAQ does not implement sufficient checks to avoid weak passwords
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://huntr.dev/bounties/cbba22f0-89ed-4d01-81ea-744979c8cbde/</url>
 <url>https://huntr.dev/bounties/fac01e9f-e3e5-4985-94ad-59a76485f215/</url>
 <url>https://huntr.dev/bounties/83cfed62-af8b-4aaa-94f2-5a33dc0c2d69/</url>
 <url>https://huntr.dev/bounties/051d5e20-7fab-4769-bd7d-d986b804bb5a/</url>
 <url>https://huntr.dev/bounties/c03c5925-43ff-450d-9827-2b65a3307ed6/</url>
 <url>https://huntr.dev/bounties/f50ec8d1-cd60-4c2d-9ab8-3711870d83b9/</url>
 <url>https://huntr.dev/bounties/82b0b629-c56b-4651-af3f-17f749751857/</url>
 <url>https://huntr.dev/bounties/eac0a9d7-9721-4191-bef3-d43b0df59c67/</url>
 <url>https://huntr.dev/bounties/bc27e84b-1f91-4e1b-a78c-944edeba8256/</url>
 </references>
 <dates>
 <discovery>2023-01-15</discovery>
 <entry>2023-01-20</entry>
 </dates>
 </vuln>

<vuln vid="95176ba5-9796-11ed-bfbf-080027f5fec9">
 <topic>rack -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-rack</name>
	<range><lt>3.0.4.1,3</lt></range>
 </package>
 <package>
	<name>rubygem-rack22</name>
	<range><lt>2.2.6.2,3</lt></range>
 </package>
 <package>
	<name>rubygem-rack16</name>
	<range><lt>1.6.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aaron Patterson reports:
	<blockquote cite="https://github.com/rack/rack/blob/v3.0.4.1/CHANGELOG.md">
	 <dl>
	 <dt>CVE-2022-44570</dt>
	 <dd>
	 Carefully crafted input can cause the Range header
	 parsing component in Rack to take an unexpected amount
	 of time, possibly resulting in a denial of service
	 attack vector. Any applications that deal with Range
	 requests (such as streaming applications, or
	 applications that serve files) may be impacted.
	 </dd>
	 <dt>CVE-2022-44571</dt>
	 <dd>
	 Carefully crafted input can cause Content-Disposition
	 header parsing in Rack to take an unexpected amount of
	 time, possibly resulting in a denial of service attack
	 vector. This header is used typically used in multipart
	 parsing. Any applications that parse multipart posts
	 using Rack (virtually all Rails applications) are
	 impacted.
	 </dd>
	 <dt>CVE-2022-44572</dt>
	 <dd>
	 Carefully crafted input can cause RFC2183 multipart
	 boundary parsing in Rack to take an unexpected amount of
	 time, possibly resulting in a denial of service attack
	 vector. Any applications that parse multipart posts
	 using Rack (virtually all Rails applications) are
	 impacted.
	 </dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-44570</cvename>
 <cvename>CVE-2022-44571</cvename>
 <cvename>CVE-2022-44572</cvename>
 <url>https://github.com/rack/rack/blob/v3.0.4.1/CHANGELOG.md</url>
 <url>https://github.com/advisories/GHSA-65f5-mfpf-vfhj</url>
 <url>https://github.com/advisories/GHSA-93pm-5p5f-3ghx</url>
 <url>https://github.com/advisories/GHSA-rqv2-275x-2jq5</url>
 </references>
 <dates>
 <discovery>2023-01-17</discovery>
 <entry>2023-01-19</entry>
 </dates>
 </vuln>

<vuln vid="00919005-96a3-11ed-86e9-d4c9ef517024">
 <topic>Apache httpd -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.55</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="https://downloads.apache.org/httpd/CHANGES_2.4.55">
	 mod_dav out of bounds read, or write of zero byte (CVE-2006-20001)
	 (moderate)
	 mod_proxy_ajp Possible request smuggling (CVE-2022-36760) (moderate)
	 mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response
	 splitting (CVE-2022-37436) (moderate)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-37436</cvename>
 <cvename>CVE-2022-36760</cvename>
 <cvename>CVE-2006-20001</cvename>
 <url>https://downloads.apache.org/httpd/CHANGES_2.4.55</url>
 </references>
 <dates>
 <discovery>2023-01-17</discovery>
 <entry>2023-01-17</entry>
 </dates>
 </vuln>

<vuln vid="5fa68bd9-95d9-11ed-811a-080027f5fec9">
 <topic>redis -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><lt>7.0.8</lt></range>
 </package>
 <package>
	<name>redis-devel</name>
	<range><lt>7.0.8.20230116</lt></range>
 </package>
 <package>
	<name>redis62</name>
	<range><lt>6.2.9</lt></range>
 </package>
 <package>
	<name>redis6</name>
	<range><lt>6.0.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Redis core team reports:
	<blockquote cite="https://github.com/redis/redis/releases/tag/7.0.8">
	 <dl>
	 <dt>CVE-2022-35977</dt>
	 <dd>
	 Integer overflow in the Redis SETRANGE and SORT/SORT_RO
	 commands can drive Redis to OOM panic.
	 </dd>
	 <dt>CVE-2023-22458</dt>
	 <dd>
	 Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER
	 commands can lead to denial-of-service.
	 </dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-35977</cvename>
 <cvename>CVE-2023-22458</cvename>
 <url>https://github.com/redis/redis/releases/tag/7.0.8</url>
 </references>
 <dates>
 <discovery>2023-01-16</discovery>
 <entry>2023-01-16</entry>
 </dates>
 </vuln>

<vuln vid="9d9e9439-959e-11ed-b464-b42e991fc52e">
 <topic>security/keycloak -- Multiple possible DoS attacks</topic>
 <affects>
 <package>
	<name>keycloak</name>
	<range><lt>20.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CIRCL reports:
	<blockquote cite="https://cve.circl.lu/cve/CVE-2022-41966">
	 <ul>
	 <li>CVE-2022-41966: XStream serializes Java objects to XML
	 and back again.
	 Versions prior to 1.4.20 may allow a remote attacker
	 to terminate the application with a stack
	 overflow error, resulting in a denial of
	 service only via manipulation the
	 processed input stream.
	 </li>
	 <li>CVE-2022-40151: If the parser is running on user
	 supplied input, an attacker may supply content that
	 causes the parser to crash by stackoverflow. This
	 effect may support a denial of service attack.
	 </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-40151</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40151</url>
 <cvename>CVE-2022-41966</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-41966</url>
 </references>
 <dates>
 <discovery>2022-09-07</discovery>
 <entry>2023-01-16</entry>
 </dates>
 </vuln>

<vuln vid="847f16e5-9406-11ed-a925-3065ec8fd3ec">
 <topic>security/tor -- SOCKS4(a) inversion bug</topic>
 <affects>
 <package>
	<name>tor</name>
	<range><lt>0.4.7.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Tor Project reports:
	<blockquote cite="https://gitlab.torproject.org/tpo/core/tor/-/issues/40730">
	 TROVE-2022-002: The SafeSocks option for SOCKS4(a) is inverted leading to SOCKS4 going through
	 This is a report from hackerone: 
	 We have classified this as medium considering that tor was not defending in-depth for dangerous SOCKS request and so any user relying on SafeSocks 1 to make sure they don't link DNS leak and their Tor traffic wasn't safe afterall for SOCKS4(a).
	 Tor Browser doesn't use SafeSocks 1 and SOCKS4 so at least the likely vast majority of users are not affected.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://hackerone.com/bugs?subject=torproject&amp;report_id=1784589</url>
 <url>https://gitlab.torproject.org/tpo/core/tor/-/issues/40730</url>
 </references>
 <dates>
 <discovery>2023-01-12</discovery>
 <entry>2023-01-14</entry>
 </dates>
 </vuln>

<vuln vid="76e2fcce-92d2-11ed-a635-080027f5fec9">
 <topic>emacs -- arbitary shell command execution vulnerability of ctags</topic>
 <affects>
 <package>
	<name>emacs</name>
	<name>emacs-canna</name>
	<name>emacs-nox</name>
	<range><lt>28.2_2,3</lt></range>
 </package>
 <package>
	<name>emacs-devel</name>
	<name>emacs-devel-nox</name>
	<range><lt>30.0.50.202211128,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	lu4nx reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2022-45939">
	 
	 GNU Emacs through 28.2 allows attackers to execute
	 commands via shell metacharacters in the name of a
	 source-code file, because lib-src/etags.c uses the system
	 C library function in its implementation of the ctags
	 program. For example, a victim may use the "ctags *"
	 command (suggested in the ctags documentation) in a
	 situation where the current working directory has contents
	 that depend on untrusted input.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-45939</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-45939</url>
 </references>
 <dates>
 <discovery>2022-11-28</discovery>
 <entry>2023-01-12</entry>
 </dates>
 </vuln>

<vuln vid="53caf29b-9180-11ed-acbe-b42e991fc52e">
 <topic>cassandra3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cassandra3</name>
	<range><lt>3.11.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cassandra tema reports:
	<blockquote cite="https://gitbox.apache.org/repos/asf?p=cassandra.git;a=blob_plain;f=CHANGES.txt;hb=refs/tags/cassandra-3.11.14">
	 This release contains 6 security fixes including
	 <ul>
	 <li>CVE-2022-24823: When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory</li>
	 <li>CVE-2020-7238: Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header.</li>
	 <li>CVE-2019-2684: Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE</li>
	 <li>CVE-2022-25857: The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.</li>
	 <li>CVE-2022-42003: In FasterXML jackson-databind, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.</li>
	 <li>CVE-2022-42004: In FasterXML jackson-databind, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-24823</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24823</url>
 <cvename>CVE-2020-7238</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7238</url>
 <cvename>CVE-2019-2684</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2684</url>
 <cvename>CVE-2022-25857</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25857</url>
 <cvename>CVE-2022-42003</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42003</url>
 <cvename>CVE-2022-42004</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42004</url>
 </references>
 <dates>
 <discovery>2023-01-11</discovery>
 <entry>2023-01-11</entry>
 </dates>
 </vuln>

<vuln vid="60624f63-9180-11ed-acbe-b42e991fc52e">
 <topic>cassandra3 -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>cassandra3</name>
	<range><lt>3.11.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marcus Eriksson reports:
	<blockquote cite="https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356">
	 
	 When running Apache Cassandra with
	 the following configuration:
	 enable_user_defined_functions: true
	 enable_scripted_user_defined_functions: true
	 enable_user_defined_functions_threads: false
	 it is possible for an attacker to execute arbitrary code on
	 the host. The attacker would need to have enough permissions
	 to create user defined functions in the cluster to be able
	 to exploit this.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44521</cvename>
 <url>https://www.cvedetails.com/cve/CVE-2021-44521</url>
 </references>
 <dates>
 <discovery>2022-02-11</discovery>
 <entry>2023-01-11</entry>
 </dates>
 </vuln>

<vuln vid="b3fd12ea-917a-11ed-acbe-b42e991fc52e">
 <topic>cassandra3 -- jBCrypt integer overflow</topic>
 <affects>
 <package>
	<name>cassandra3</name>
	<range><lt>3.11.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mindrot project reports:
	<blockquote cite="http://www.mindrot.org/projects/jBCrypt/news/rel04.html">
	 There is an integer overflow that
	 occurs with very large log_rounds values, first reported by
	 Marcus Rathsfeld.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0886</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0886</url>
 </references>
 <dates>
 <discovery>2015-01-30</discovery>
 <entry>2023-01-11</entry>
 </dates>
 </vuln>

<vuln vid="9fa7b139-c1e9-409e-bed0-006aadcf5845">
 <topic>xorg-server -- Multiple security issues in X server extensions</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<name>xephyr</name>
	<name>xorg-vfbserver</name>
	<range><lt>21.1.5,1</lt></range>
 </package>
 <package>
	<name>xorg-nestserver</name>
	<range><lt>21.1.5,2</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>22.1.6,1</lt></range>
 </package>
 <package>
	<name>xwayland-devel</name>
	<range><lt>21.0.99.1.319</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The X.org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2022-December/003302.html">
	 <ul>
	 <li>CVE-2022-46340/ZDI-CAN-19265: X.Org Server XTestSwapFakeInput stack
	 overflow

The swap handler for the XTestFakeInput request of the XTest extension
	 may corrupt the stack if GenericEvents with lengths larger than 32 bytes
	 are sent through a the XTestFakeInput request.

This issue does not affect systems where client and server use the same
	 byte order.</li>

<li>CVE-2022-46341/ZDI-CAN-19381: X.Org Server XIPassiveUngrab
	 out-of-bounds access

The handler for the XIPassiveUngrab request accesses out-of-bounds
	 memory when invoked with a high keycode or button code.</li>

<li>CVE-2022-46342/ZDI-CAN-19400: X.Org Server XvdiSelectVideoNotify
	 use-after-free

The handler for the XvdiSelectVideoNotify request may write to memory
	 after it has been freed.</li>

<li>CVE-2022-46343/ZDI-CAN-19404: X.Org Server ScreenSaverSetAttributes
	 use-after-free

The handler for the ScreenSaverSetAttributes request may write to memory
	 after it has been freed.</li>

<li>CVE-2022-46344/ZDI-CAN-19405: X.Org Server XIChangeProperty
	 out-of-bounds access

The handler for the XIChangeProperty request has a length-validation
	 issues, resulting in out-of-bounds memory reads and potential
	 information disclosure.</li>

<li>CVE-2022-4283/ZDI-CAN-19530: X.Org Server XkbGetKbdByName use-after-free

The XkbCopyNames function left a dangling pointer to freed memory,
	 resulting in out-of-bounds memory access on subsequent XkbGetKbdByName
	 requests.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.x.org/archives/xorg-announce/2022-December/003302.html</url>
 <cvename>CVE-2022-46340</cvename>
 <cvename>CVE-2022-46341</cvename>
 <cvename>CVE-2022-46342</cvename>
 <cvename>CVE-2022-46343</cvename>
 <cvename>CVE-2022-46344</cvename>
 <cvename>CVE-2022-4283</cvename>
 </references>
 <dates>
 <discovery>2022-12-14</discovery>
 <entry>2023-01-11</entry>
 </dates>
 </vuln>

<vuln vid="3a023570-91ab-11ed-8950-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>15.7.0</ge><lt>15.7.2</lt></range>
	<range><ge>15.6.0</ge><lt>15.6.4</lt></range>
	<range><ge>6.6.0</ge><lt>15.5.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2023/01/09/security-release-gitlab-15-7-2-released/">
	 Race condition on gitlab.com enables verified email forgery and third-party account hijacking
	 DOS and high resource consumption of Prometheus server through abuse of Grafana integration proxy endpoint
	 Maintainer can leak sentry token by changing the configured URL
	 Maintainer can leak masked webhook secrets by changing target URL of the webhook
	 Cross-site scripting in wiki changes page affecting self-hosted instances running without strict CSP
	 Group access tokens continue to work after owner loses ability to revoke them
	 Users' avatar disclosure by user ID in private GitLab instances
	 Arbitrary Protocol Redirection in GitLab Pages
	 Regex DoS due to device-detector parsing user agents
	 Regex DoS in the Submodule Url Parser
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-4037</cvename>
 <cvename>CVE-2022-3613</cvename>
 <cvename>CVE-2022-4365</cvename>
 <cvename>CVE-2022-4342</cvename>
 <cvename>CVE-2022-3573</cvename>
 <cvename>CVE-2022-4167</cvename>
 <cvename>CVE-2022-3870</cvename>
 <cvename>CVE-2023-0042</cvename>
 <cvename>CVE-2022-4131</cvename>
 <cvename>CVE-2022-3514</cvename>
 <url>https://about.gitlab.com/releases/2023/01/09/security-release-gitlab-15-7-2-released/</url>
 </references>
 <dates>
 <discovery>2023-01-09</discovery>
 <entry>2023-01-11</entry>
 </dates>
 </vuln>

<vuln vid="7b929503-911d-11ed-a925-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>109.0.5414.74</lt></range>
 </package>
 <package>
	<name>ungoogled-chromium</name>
	<range><lt>109.0.5414.74</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html">
	 This release contains 17 security fixes, including:
	 <ul>
	 <li>[1353208] High CVE-2023-0128: Use after free in Overview Mode. Reported by Khalil Zhani on 2022-08-16</li>
	 <li>[1382033] High CVE-2023-0129: Heap buffer overflow in Network Service. Reported by asnine on 2022-11-07</li>
	 <li>[1370028] Medium CVE-2023-0130: Inappropriate implementation in Fullscreen API. Reported by Hafiizh on 2022-09-30</li>
	 <li>[1357366] Medium CVE-2023-0131: Inappropriate implementation in iframe Sandbox. Reported by NDevTK on 2022-08-28</li>
	 <li>[1371215] Medium CVE-2023-0132: Inappropriate implementation in Permission prompts. Reported by Jasper Rebane (popstonia) on 2022-10-05</li>
	 <li>[1375132] Medium CVE-2023-0133: Inappropriate implementation in Permission prompts. Reported by Alesandro Ortiz on 2022-10-17</li>
	 <li>[1385709] Medium CVE-2023-0134: Use after free in Cart. Reported by Chaoyuan Peng (@ret2happy) on 2022-11-17</li>
	 <li>[1385831] Medium CVE-2023-0135: Use after free in Cart. Reported by Chaoyuan Peng (@ret2happy) on 2022-11-18</li>
	 <li>[1356987] Medium CVE-2023-0136: Inappropriate implementation in Fullscreen API. Reported by Axel Chong on 2022-08-26</li>
	 <li>[1399904] Medium CVE-2023-0137: Heap buffer overflow in Platform Apps. Reported by avaue and Buff3tts at S.S.L. on 2022-12-10</li>
	 <li>[1346675] Low CVE-2023-0138: Heap buffer overflow in libphonenumber. Reported by Michael Dau on 2022-07-23</li>
	 <li>[1367632] Low CVE-2023-0139: Insufficient validation of untrusted input in Downloads. Reported by Axel Chong on 2022-09-24</li>
	 <li>[1326788] Low CVE-2023-0140: Inappropriate implementation in File System API. Reported by harrison.mitchell, cybercx.com.au on 2022-05-18</li>
	 <li>[1362331] Low CVE-2023-0141: Insufficient policy enforcement in CORS. Reported by scarlet on 2022-09-12</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-0128</cvename>
 <cvename>CVE-2023-0129</cvename>
 <cvename>CVE-2023-0130</cvename>
 <cvename>CVE-2023-0131</cvename>
 <cvename>CVE-2023-0132</cvename>
 <cvename>CVE-2023-0133</cvename>
 <cvename>CVE-2023-0134</cvename>
 <cvename>CVE-2023-0135</cvename>
 <cvename>CVE-2023-0136</cvename>
 <cvename>CVE-2023-0137</cvename>
 <cvename>CVE-2023-0138</cvename>
 <cvename>CVE-2023-0139</cvename>
 <cvename>CVE-2023-0140</cvename>
 <cvename>CVE-2023-0141</cvename>
 <url>https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2023-01-10</discovery>
 <entry>2023-01-10</entry>
 </dates>
 </vuln>

<vuln vid="59c284f4-8d2e-11ed-9ce0-b42e991fc52e">
 <topic>net-mgmt/cacti is vulnerable to remote command injection</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>1.2.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cacti team reports:
	<blockquote cite="https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf">
	
	 A command injection vulnerability allows an
	 unauthenticated user to execute arbitrary code on a server
	 running Cacti, if a specific data source was selected for
	 any monitored device.
	
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-46169</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-46169</url>
 </references>
 <dates>
 <discovery>2022-12-05</discovery>
 <entry>2023-01-05</entry>
 <modified>2023-01-09</modified>
 </dates>
 </vuln>

<vuln vid="541696ed-8d12-11ed-af80-ecf4bbc0bda0">
 <topic>devel/viewvc-devel is vulnerable to cross-site scripting</topic>
 <affects>
 <package>
	<name>py37-viewvc-devel</name>
	<name>py38-viewvc-devel</name>
	<name>py39-viewvc-devel</name>
	<range><lt>1.3.0.20230104</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	C. Michael Pilato reports:
	<blockquote cite="https://github.com/viewvc/viewvc/releases/tag/1.1.30">
	 security fix: escape revision view copy paths (#311) [CVE-2023-22464]
	</blockquote>
	<blockquote cite="https://github.com/viewvc/viewvc/releases/tag/1.1.29">
	 security fix: escape revision view changed paths (#311) [CVE-2023-22456]
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2023-22464</cvename>
 <cvename>CVE-2023-22456</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-22464</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2023-22456</url>
 </references>
 <dates>
 <discovery>2023-01-04</discovery>
 <entry>2023-01-05</entry>
 </dates>
 </vuln>

<vuln vid="5b2eac07-8b4d-11ed-8b23-a0f3c100ae18">
 <topic>rxvt-unicode is vulnerable to a remote code execution</topic>
 <affects>
 <package>
	<name>rxvt-unicode</name>
	<range><lt>9.31</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marc Lehmann reports:
	<blockquote cite="http://lists.schmorp.de/pipermail/rxvt-unicode/2023q1/002638.html">
	 The biggest issue is resolving CVE-2022-4170, which allows command
	 execution inside urxvt from within the terminal (that means anything that
	 can output text in the terminal can start commands in the context of the
	 urxvt process, even remotely).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-4170</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-4170</url>
 </references>
 <dates>
 <discovery>2022-12-05</discovery>
 <entry>2023-01-03</entry>
 </dates>
 </vuln>

<vuln vid="86c330fe-bbae-4ca7-85f7-5321e627a4eb">
 <topic>gitea -- multiple issues</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.18.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/22219">
	 Remove ReverseProxy authentication from the API
	</blockquote>
	<blockquote cite="https://github.com/go-gitea/gitea/pull/21139">
	 Support Go Vulnerability Management
	</blockquote>
	<blockquote cite="https://github.com/go-gitea/gitea/pull/20935">
	 Forbid HTML string tooltips
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.io/2022/12/gitea-1.18.0-is-released/</url>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.18.0</url>
 </references>
 <dates>
 <discovery>2022-08-23</discovery>
 <entry>2023-01-02</entry>
 </dates>
 </vuln>

<vuln vid="140a20e1-8769-11ed-b074-002b67dfc673">
 <topic>webtrees -- vulnerability</topic>
 <affects>
 <package>
	<name>webtrees</name>
	<range><lt>1.7.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Webtrees reports:
	<blockquote cite="https://webtrees.net/blog/2022/06/04/new-webtrees-release-1-7-20.html">
	 GEDCOM imports containing errors and HTML displayed unescaped.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://webtrees.net/blog/2022/06/04/new-webtrees-release-1-7-20.html</url>
 </references>
 <dates>
 <discovery>2022-06-04</discovery>
 <entry>2022-12-29</entry>
 </dates>
 </vuln>

<vuln vid="d379aa14-8729-11ed-b988-080027d3a315">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki135</name>
	<range><lt>1.35.9</lt></range>
 </package>
 <package>
	<name>mediawiki138</name>
	<range><lt>1.38.5</lt></range>
 </package>
 <package>
	<name>mediawiki139</name>
	<range><lt>1.39.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawikwi reports:
	<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/UEMW64LVEH3BEXCJV43CVS6XPYURKWU3/">
	 (T322637, CVE-2022-PENDING) SECURITY: Make sqlite DB files not world readable.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/UEMW64LVEH3BEXCJV43CVS6XPYURKWU3/</url>
 </references>
 <dates>
 <discovery>2022-12-01</discovery>
 <entry>2022-12-29</entry>
 </dates>
 </vuln>

<vuln vid="4b60c3d9-8640-11ed-a762-482ae324f959">
 <topic>netdata -- multiple vulnerabilities with streaming</topic>
 <affects>
 <package>
	<name>netdata</name>
	<range><lt>1.37.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Netdata reports:
	<blockquote cite="https://github.com/netdata/netdata/security/advisories">
	 GHSA-xg38-3vmw-2978: Netdata Streaming Alert Command Injection
	 GHSA-jx85-39cw-66f2: Netdata Streaming Authentication Bypass
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/netdata/netdata/security/advisories/GHSA-xg38-3vmw-2978</url>
 <url>https://github.com/netdata/netdata/security/advisories/GHSA-jx85-39cw-66f2</url>
 </references>
 <dates>
 <discovery>2022-11-30</discovery>
 <entry>2022-12-27</entry>
 </dates>
 </vuln>

<vuln vid="1f0421b1-8398-11ed-973d-002b67dfc673">
 <topic>freerdp -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>freerdp</name>
	<range><lt>2.9.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	FreeRDP reports:
	<blockquote cite="https://www.freerdp.com/2022/11/16/2_9_0-release">
	 GHSA-5w4j-mrrh-jjrm: Out of bound read in zgfx decoder.
	 GHSA-99cm-4gw7-c8jh: Undefined behaviour in zgfx decoder.
	 GHSA-387j-8j96-7q35: Division by zero in urbdrc channel.
	 GHSA-mvxm-wfj2-5fvh: Missing length validation in urbdrc channel.
	 GHSA-qfq2-82qr-7f4j: Heap buffer overflow in urbdrc channel.
	 GHSA-c5xq-8v35-pffg: Missing path sanitation with `drive` channel.
	 GHSA-pmv3-wpw4-pw5h: Missing input length validation in `drive` channel.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-39316</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-39316</url>
 <cvename>CVE-2022-39317</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-39317</url>
 <cvename>CVE-2022-39318</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-39318</url>
 <cvename>CVE-2022-39319</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-39319</url>
 <cvename>CVE-2022-39320</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-39320</url>
 <cvename>CVE-2022-39347</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-39347</url>
 <cvename>CVE-2022-41877</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-41877</url>
 </references>
 <dates>
 <discovery>2022-12-24</discovery>
 <entry>2022-12-24</entry>
 </dates>
 </vuln>

<vuln vid="d0da046a-81e6-11ed-96ca-0800277bb8a8">
 <topic>gitea -- multiple issues</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.17.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/21849">
	 Do not allow Ghost access to limited visible user/org
	</blockquote>
	<blockquote cite="https://github.com/go-gitea/gitea/pull/21580">
	 Fix package access for admins and inactive users
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.17.4</url>
 </references>
 <dates>
 <discovery>2022-10-24</discovery>
 <entry>2022-12-22</entry>
 </dates>
 </vuln>

<vuln vid="d9e154c9-7de9-11ed-adca-080027d3a315">
 <topic>typo3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>typo3-11-php81</name>
	<range><lt>11.5.20</lt></range>
 </package>
 <package>
	<name>typo3-12-php81</name>
	<range><lt>12.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	TYPO3 reports:
	<blockquote cite="https://typo3.org/article/typo3-1211-11520-and-10433-security-releases-published">
	 TYPO3-CORE-SA-2022-012: Denial of Service in Page Error Handling.
	 TYPO3-CORE-SA-2022-013: Weak Authentication in Frontend Login.
	 TYPO3-CORE-SA-2022-014: Insufficient Session Expiration after Password Reset.
	 TYPO3-CORE-SA-2022-015: Arbitrary Code Execution via Form Framework.
	 TYPO3-CORE-SA-2022-016: Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration.
	 TYPO3-CORE-SA-2022-017: By-passing Cross-Site Scripting Protection in HTML Sanitizer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23499</cvename>
 <cvename>CVE-2022-23500</cvename>
 <cvename>CVE-2022-23501</cvename>
 <cvename>CVE-2022-23502</cvename>
 <cvename>CVE-2022-23503</cvename>
 <cvename>CVE-2022-23504</cvename>
 <url>https://typo3.org/article/typo3-1211-11520-and-10433-security-releases-published</url>
 </references>
 <dates>
 <discovery>2022-12-13</discovery>
 <entry>2022-12-17</entry>
 </dates>
 </vuln>

<vuln vid="83eb9374-7b97-11ed-be8f-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>108.0.5359.124</lt></range>
 </package>
 <package>
	<name>ungoogled-chromium</name>
	<range><lt>108.0.5359.124</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html">
	 This release contains 8 security fixes, including:
	 <ul>
	 <li>[1383991] High CVE-2022-4436: Use after free in Blink Media. Reported by Anonymous on 2022-11-15</li>
	 <li>[1394692] High CVE-2022-4437: Use after free in Mojo IPC. Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2022-11-30</li>
	 <li>[1381871] High CVE-2022-4438: Use after free in Blink Frames. Reported by Anonymous on 2022-11-07</li>
	 <li>[1392661] High CVE-2022-4439: Use after free in Aura. Reported by Anonymous on 2022-11-22</li>
	 <li>[1382761] Medium CVE-2022-4440: Use after free in Profiles. Reported by Anonymous on 2022-11-09</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-4436</cvename>
 <cvename>CVE-2022-4437</cvename>
 <cvename>CVE-2022-4438</cvename>
 <cvename>CVE-2022-4439</cvename>
 <cvename>CVE-2022-4440</cvename>
 <url>https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html</url>
 </references>
 <dates>
 <discovery>2022-12-13</discovery>
 <entry>2022-12-14</entry>
 </dates>
 </vuln>

<vuln vid="0f99a30c-7b4b-11ed-9168-080027f5fec9">
 <topic>curl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>7.86.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Daniel Stenberg reports:
	<blockquote cite="https://curl.se/docs/security.html">
	 <dl>
	 <dt>CVE-2022-32221: POST following PUT confusion</dt>
	 <dd>
	 When doing HTTP(S) transfers, libcurl might erroneously
	 use the read callback
	 (<code>CURLOPT_READFUNCTION</code>) to ask for data to
	 send, even when the <code>CURLOPT_POSTFIELDS</code>
	 option has been set, if the same handle previously was
	 used to issue a <code>PUT</code> request which used that
	 callback. This flaw may surprise the application and
	 cause it to misbehave and either send off the wrong data
	 or use memory after free or similar in the subsequent
	 <code>POST</code> request. The problem exists in the
	 logic for a reused handle when it is changed from a PUT
	 to a POST.
	 </dd>
	 <dt>CVE-2022-35260: .netrc parser out-of-bounds access</dt>
	 <dd>
	 curl can be told to parse a .netrc file for
	 credentials. If that file ends in a line with
	 consecutive non-white space letters and no newline, curl
	 could read past the end of the stack-based buffer, and
	 if the read works, write a zero byte possibly beyond its
	 boundary. This will in most cases cause a segfault or
	 similar, but circumstances might also cause different
	 outcomes. If a malicious user can provide a custom netrc
	 file to an application or otherwise affect its contents,
	 this flaw could be used as denial-of-service.
	 </dd>
	 <dt>CVE-2022-42915: HTTP proxy double-free</dt>
	 <dd>
	 f curl is told to use an HTTP proxy for a transfer with
	 a non-HTTP(S) URL, it sets up the connection to the
	 remote server by issuing a CONNECT request to the proxy,
	 and then tunnels the rest of protocol through. An HTTP
	 proxy might refuse this request (HTTP proxies often only
	 allow outgoing connections to specific port numbers,
	 like 443 for HTTPS) and instead return a non-200
	 response code to the client. Due to flaws in the
	 error/cleanup handling, this could trigger a double-free
	 in curl if one of the following schemes were used in the
	 URL for the transfer: dict, gopher, gophers, ldap,
	 ldaps, rtmp, rtmps, telnet
	 </dd>
	 <dt>CVE-2022-42916: HSTS bypass via IDN</dt>
	 <dd>
	 curl's HSTS check could be bypassed to trick it to keep
	 using HTTP. Using its HSTS support, curl can be
	 instructed to use HTTPS directly instead of using an
	 insecure clear-text HTTP step even when HTTP is provided
	 in the URL. This mechanism could be bypassed if the host
	 name in the given URL uses IDN characters that get
	 replaced to ASCII counterparts as part of the IDN
	 conversion. Like using the character UTF-8 U+3002
	 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full
	 stop (U+002E) .. Like this: http://curl。se。
	 </dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-32221</cvename>
 <cvename>CVE-2022-35260</cvename>
 <cvename>CVE-2022-42915</cvename>
 <cvename>CVE-2022-42916</cvename>
 <url>https://curl.se/docs/CVE-2022-32221.html</url>
 <url>https://curl.se/docs/CVE-2022-35260.html</url>
 <url>https://curl.se/docs/CVE-2022-42915.html</url>
 <url>https://curl.se/docs/CVE-2022-42916.html</url>
 </references>
 <dates>
 <discovery>2022-10-26</discovery>
 <entry>2022-12-14</entry>
 </dates>
 </vuln>

<vuln vid="439f3f81-7a49-11ed-97ac-589cfc0f81b0">
 <topic>phpmyfaq -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><lt>3.1.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpmyfaq developers report:
	<blockquote cite="https://www.phpmyfaq.de/security/advisory-2022-10-24">
	 an authenticated SQL injection when adding categories in the admin backend
	 a stored cross-site scripting vulnerability in the category name
	 a stored cross-site scripting vulnerability in the admin logging
	 a stored cross-site scripting vulnerability in the FAQ title
	 a PostgreSQL based SQL injection for the lang parameter 
	 a SQL injection when storing an instance name in the admin backend
	 a SQL injection when adding attachments in the admin backend
	 a stored cross-site scripting vulnerability when adding users by admins
	 a missing "secure" flag for cookies when using TLS
	 a cross-site request forgery / cross-site scripting vulnerability when saving new questions
	 a reflected cross-site scripting vulnerability in the admin backend
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://huntr.dev/bounties/a1649f43-78c9-4927-b313-36911872a84b/</url>
 <url>https://huntr.dev/bounties/2ec4ddd4-de22-4f2d-ba92-3382b452bfea/</url>
 <url>https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c/</url>
 <url>https://huntr.dev/bounties/5944f154-c0ab-4547-9d9d-3101e86eb975/</url>
 <url>https://huntr.dev/bounties/315aa78d-7bd2-4b14-86f2-b5c211e62034/</url>
 <url>https://huntr.dev/bounties/eb3a8ea3-daea-4555-a3e6-80b82f533792/</url>
 <url>https://huntr.dev/bounties/faac0c92-8d4b-4901-a933-662b661a3f99/</url>
 <url>https://huntr.dev/bounties/56499a60-2358-41fe-9b38-8cb23cdfc17c/</url>
 <url>https://huntr.dev/bounties/f531bbf2-32c8-4efe-8156-ae9bc6b5d3aa/</url>
 <url>https://huntr.dev/bounties/322c12b1-08d5-4ee3-9d94-d4bb40366c7a/</url>
 <url>https://huntr.dev/bounties/f2857bc7-8fbc-489a-9a38-30b93300eec5/</url>
 </references>
 <dates>
 <discovery>2022-12-11</discovery>
 <entry>2022-12-12</entry>
 </dates>
 </vuln>

<vuln vid="508da89c-78b9-11ed-854f-5404a68ad561">
 <topic>traefik -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>traefik</name>
	<range><lt>2.9.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Traefik project reports:
	<blockquote cite="https://github.com/traefik/traefik/releases/tag/v2.9.6">
	 This update is recommended for all traefik users and provides following important security fixes:
	 <ul>
	 <li>CVE-2022-23469: Authorization header displayed in the debug logs</li>
	 <li>CVE-2022-46153: Routes exposed with an empty TLSOption in traefik</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23469</cvename>
 <cvename>CVE-2022-46153</cvename>
 <url>https://github.com/traefik/traefik/releases/tag/v2.9.6</url>
 </references>
 <dates>
 <discovery>2022-12-08</discovery>
 <entry>2022-12-10</entry>
 </dates>
 </vuln>

<vuln vid="ba94433c-7890-11ed-859e-1c61b4739ac9">
 <topic>xrdp -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xrdp</name>
	<range><lt>0.9.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	xrdp project reports:
	<blockquote cite="https://github.com/neutrinolabs/xrdp/releases/tag/v0.9.21">
	 This update is recommended for all xrdp users and provides following important security fixes:
	 <ul>
	 <li>CVE-2022-23468</li>
	 <li>CVE-2022-23477</li>
	 <li>CVE-2022-23478</li>
	 <li>CVE-2022-23479</li>
	 <li>CVE-2022-23480</li>
	 <li>CVE-2022-23481</li>
	 <li>CVE-2022-23483</li>
	 <li>CVE-2022-23482</li>
	 <li>CVE-2022-23484</li>
	 <li>CVE-2022-23493</li>
	 </ul>
	 These security issues are reported by Team BT5 (BoB 11th). We appreciate their great help with making and reviewing patches.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23468</cvename>
 <cvename>CVE-2022-23477</cvename>
 <cvename>CVE-2022-23478</cvename>
 <cvename>CVE-2022-23479</cvename>
 <cvename>CVE-2022-23480</cvename>
 <cvename>CVE-2022-23481</cvename>
 <cvename>CVE-2022-23483</cvename>
 <cvename>CVE-2022-23482</cvename>
 <cvename>CVE-2022-23484</cvename>
 <cvename>CVE-2022-23493</cvename>
 <url>https://github.com/neutrinolabs/xrdp/releases/tag/v0.9.21</url>
 </references>
 <dates>
 <discovery>2022-12-01</discovery>
 <entry>2022-12-10</entry>
 </dates>
 </vuln>

<vuln vid="050eba46-7638-11ed-820d-080027d3a315">
 <topic>Python -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python37</name>
	<range><lt>3.7.16</lt></range>
 </package>
 <package>
	<name>python38</name>
	<range><lt>3.8.16</lt></range>
 </package>
 <package>
	<name>python39</name>
	<range><lt>3.9.16</lt></range>
 </package>
 <package>
	<name>python310</name>
	<range><lt>3.10.9</lt></range>
 </package>
 <package>
	<name>python311</name>
	<range><lt>3.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python reports:
	<blockquote cite="https://docs.python.org/3/whatsnew/changelog.html#changelog">
	 gh-100001: python -m http.server no longer allows terminal control characters sent
	 within a garbage request to be printed to the stderr server log.
	 This is done by changing the http.server BaseHTTPRequestHandler .log_message method
	 to replace control characters with a \xHH hex escape before printing.
	 gh-87604: Avoid publishing list of active per-interpreter audit hooks via the gc module.
	 gh-98433: The IDNA codec decoder used on DNS hostnames by socket or asyncio related
	 name resolution functions no longer involves a quadratic algorithm. This prevents a
	 potential CPU denial of service if an out-of-spec excessive length hostname involving
	 bidirectional characters were decoded. Some protocols such as urllib http 3xx redirects
	 potentially allow for an attacker to supply such a name.
	 gh-98739: Update bundled libexpat to 2.5.0.
	 gh-97612: Fix a shell code injection vulnerability in the get-remote-certificate.py example
	 script. The script no longer uses a shell to run openssl commands. Issue reported and
	 initial fix by Caleb Shortt. Patch by Victor Stinner.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.python.org/3/whatsnew/changelog.html#changelog</url>
 </references>
 <dates>
 <discovery>2022-09-28</discovery>
 <entry>2022-12-07</entry>
 </dates>
 </vuln>

<vuln vid="6f5192f5-75a7-11ed-83c0-411d43ce7fe4">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go118</name>
	<range><lt>1.18.9</lt></range>
 </package>
 <package>
	<name>go119</name>
	<range><lt>1.19.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/56694">
	 os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
	 The os.DirFS function and http.Dir type provide access to a
	 tree of files rooted at a given directory. These functions
	 permitted access to Windows device files under that root. For
	 example, os.DirFS("C:/tmp").Open("COM1") would open the COM1 device.
	 Both os.DirFS and http.Dir only provide read-only filesystem access.
	 In addition, on Windows, an os.DirFS for the directory \(the root
	 of the current drive) can permit a maliciously crafted path to escape
	 from the drive and access any path on the system.
	 The behavior of os.DirFS("") has changed. Previously, an empty root
	 was treated equivalently to "/", so os.DirFS("").Open("tmp") would
	 open the path "/tmp". This now returns an error.
	</blockquote>
	<blockquote cite="https://go.dev/issue/56350">
	 net/http: limit canonical header cache by bytes, not entries
	 An attacker can cause excessive memory growth in a Go server
	 accepting HTTP/2 requests. HTTP/2 server connections contain a
	 cache of HTTP header keys sent by the client. While the total number
	 of entries in this cache is capped, an attacker sending very large
	 keys can cause the server to allocate approximately 64 MiB per open
	 connection.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-41720</cvename>
 <cvename>CVE-2022-41717</cvename>
 <url>https://groups.google.com/g/golang-dev/c/G9Jj4cO4Gpk/m/kOkLVG6TAgAJ</url>
 </references>
 <dates>
 <discovery>2022-10-20</discovery>
 <entry>2022-12-06</entry>
 </dates>
 </vuln>

<vuln vid="2899da38-7300-11ed-92ce-3065ec8fd3ec">
 <topic>chromium -- Type confusion in V8</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>108.0.5359.94</lt></range>
 </package>
 <package>
	<name>ungoogled-chromium</name>
	<range><lt>108.0.5359.94</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop.html">
	 This release contains 1 security fix:
	 <ul>
	 <li>[1394403] High CVE-2022-4262: Type Confusion in V8. Reported by Clement Lecigne of Google's Threat Analysis Group on 2022-11-29</li>
	 </ul>
	 Google is aware that an exploit for CVE-2022-4262 exists in the wild.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-4262</cvename>
 <url>https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2022-12-02</discovery>
 <entry>2022-12-03</entry>
 </dates>
 </vuln>

<vuln vid="0c52abde-717b-11ed-98ca-40b034429ecf">
 <topic>rpm4 -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>rpm4</name>
	<range><lt>4.18.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	rpm project reports:
	<blockquote cite="https://rpm.org/wiki/Releases/4.18.0">
	 Fix intermediate symlinks not verified (CVE-2021-35939).
	 Fix subkey binding signatures not checked on PGP public keys (CVE-2021-3521).
	 Refactor file and directory operations to use fd-based APIs throughout (CVE-2021-35938)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-35939</cvename>
 <cvename>CVE-2021-3521</cvename>
 <cvename>CVE-2021-35938</cvename>
 </references>
 <dates>
 <discovery>2022-08-22</discovery>
 <entry>2022-12-01</entry>
 </dates>
 </vuln>

<vuln vid="3cde510a-7135-11ed-a28b-bff032704f00">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>15.6.0</ge><lt>15.6.1</lt></range>
	<range><ge>15.5.0</ge><lt>15.5.5</lt></range>
	<range><ge>9.3.0</ge><lt>15.4.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2022/11/30/security-release-gitlab-15-6-1-released/">
	 DAST API scanner exposes Authorization headers in vulnerabilities
	 Group IP allow-list not fully respected by the Package Registry
	 Deploy keys and tokens may bypass External Authorization service if it is enabled
	 Repository import still allows to import 40 hexadecimal branches
	 Webhook secret tokens leaked in webhook logs
	 Maintainer can leak webhook secret token by changing the webhook URL
	 Cross-site scripting in Jira Integration affecting self-hosted instances without strict CSP
	 Release names visible in public projects despite release set as project members only
	 Sidekiq background job DoS by uploading malicious NuGet packages
	 SSRF in Web Terminal advertise_address
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-4206</cvename>
 <cvename>CVE-2022-3820</cvename>
 <cvename>CVE-2022-3740</cvename>
 <cvename>CVE-2022-4205</cvename>
 <cvename>CVE-2022-3902</cvename>
 <cvename>CVE-2022-4054</cvename>
 <cvename>CVE-2022-3572</cvename>
 <cvename>CVE-2022-3482</cvename>
 <cvename>CVE-2022-3478</cvename>
 <cvename>CVE-2022-4201</cvename>
 <url>https://about.gitlab.com/releases/2022/11/30/security-release-gitlab-15-6-1-released/</url>
 </references>
 <dates>
 <discovery>2022-11-30</discovery>
 <entry>2022-12-01</entry>
 </dates>
 </vuln>

<vuln vid="5f7ed6ea-70a7-11ed-92ce-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>108.0.5359.71</lt></range>
 </package>
 <package>
	<name>ungoogled-chromium</name>
	<range><lt>108.0.5359.71</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html">
	 This release contains 28 security fixes, including:
	 <ul>
	 <li>[1379054] High CVE-2022-4174: Type Confusion in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2022-10-27</li>
	 <li>[1381401] High CVE-2022-4175: Use after free in Camera Capture. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2022-11-04</li>
	 <li>[1361066] High CVE-2022-4176: Out of bounds write in Lacros Graphics. Reported by @ginggilBesel on 2022-09-08</li>
	 <li>[1379242] High CVE-2022-4177: Use after free in Extensions. Reported by Chaoyuan Peng (@ret2happy) on 2022-10-28</li>
	 <li>[1376099] High CVE-2022-4178: Use after free in Mojo. Reported by Sergei Glazunov of Google Project Zero on 2022-10-18</li>
	 <li>[1377783] High CVE-2022-4179: Use after free in Audio. Reported by Sergei Glazunov of Google Project Zero on 2022-10-24</li>
	 <li>[1378564] High CVE-2022-4180: Use after free in Mojo. Reported by Anonymous on 2022-10-26</li>
	 <li>[1382581] High CVE-2022-4181: Use after free in Forms. Reported by Aviv A. on 2022-11-09</li>
	 <li>[1368739] Medium CVE-2022-4182: Inappropriate implementation in Fenced Frames. Reported by Peter Nemeth on 2022-09-28</li>
	 <li>[1251790] Medium CVE-2022-4183: Insufficient policy enforcement in Popup Blocker. Reported by David Sievers on 2021-09-22</li>
	 <li>[1358647] Medium CVE-2022-4184: Insufficient policy enforcement in Autofill. Reported by Ahmed ElMasry on 2022-09-01</li>
	 <li>[1373025] Medium CVE-2022-4185: Inappropriate implementation in Navigation. Reported by James Lee (@Windowsrcer) on 2022-10-10</li>
	 <li>[1377165] Medium CVE-2022-4186: Insufficient validation of untrusted input in Downloads. Reported by Luan Herrera (@lbherrera_) on 2022-10-21</li>
	 <li>[1381217] Medium CVE-2022-4187: Insufficient policy enforcement in DevTools. Reported by Axel Chong on 2022-11-04</li>
	 <li>[1340879] Medium CVE-2022-4188: Insufficient validation of untrusted input in CORS. Reported by Philipp Beer (TU Wien) on 2022-06-30</li>
	 <li>[1344647] Medium CVE-2022-4189: Insufficient policy enforcement in DevTools. Reported by NDevTK on 2022-07-15</li>
	 <li>[1378997] Medium CVE-2022-4190: Insufficient data validation in Directory. Reported by Axel Chong on 2022-10-27</li>
	 <li>[1373941] Medium CVE-2022-4191: Use after free in Sign-In. Reported by Jaehun Jeong(@n3sk) of Theori on 2022-10-12</li>
	 <li>[1344514] Medium CVE-2022-4192: Use after free in Live Caption. Reported by Samet Bekmezci @sametbekmezci on 2022-07-14</li>
	 <li>[1354518] Medium CVE-2022-4193: Insufficient policy enforcement in File System API. Reported by Axel Chong on 2022-08-19</li>
	 <li>[1370562] Medium CVE-2022-4194: Use after free in Accessibility. Reported by Anonymous on 2022-10-03</li>
	 <li>[1371926] Medium CVE-2022-4195: Insufficient policy enforcement in Safe Browsing. Reported by Eric Lawrence of Microsoft on 2022-10-06</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-4174</cvename>
 <cvename>CVE-2022-4175</cvename>
 <cvename>CVE-2022-4176</cvename>
 <cvename>CVE-2022-4177</cvename>
 <cvename>CVE-2022-4178</cvename>
 <cvename>CVE-2022-4179</cvename>
 <cvename>CVE-2022-4180</cvename>
 <cvename>CVE-2022-4181</cvename>
 <cvename>CVE-2022-4182</cvename>
 <cvename>CVE-2022-4183</cvename>
 <cvename>CVE-2022-4184</cvename>
 <cvename>CVE-2022-4185</cvename>
 <cvename>CVE-2022-4186</cvename>
 <cvename>CVE-2022-4187</cvename>
 <cvename>CVE-2022-4188</cvename>
 <cvename>CVE-2022-4189</cvename>
 <cvename>CVE-2022-4190</cvename>
 <cvename>CVE-2022-4191</cvename>
 <cvename>CVE-2022-4192</cvename>
 <cvename>CVE-2022-4193</cvename>
 <cvename>CVE-2022-4194</cvename>
 <cvename>CVE-2022-4195</cvename>
 <url>https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html</url>
 </references>
 <dates>
 <discovery>2022-11-29</discovery>
 <entry>2022-11-30</entry>
 </dates>
 </vuln>

<vuln vid="8d3838b0-6ca8-11ed-92ce-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>107.0.5304.121</lt></range>
 </package>
 <package>
	<name>ungoogled-chromium</name>
	<range><lt>107.0.5304.121</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html">
	 This release contains 1 security fix:
	 <ul>
	 <li>[1392715] High CVE-2022-4135: Heap buffer overflow in GPU. Reported by Clement Lecigne of Google's Threat Analysis Group on 2022-11-22</li>
	 </ul>
	 Google is aware that an exploit for CVE-2022-4135 exists in the wild.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-4135</cvename>
 <url>https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html</url>
 </references>
 <dates>
 <discovery>2022-11-24</discovery>
 <entry>2022-11-25</entry>
 </dates>
 </vuln>

<vuln vid="84ab03b6-6c20-11ed-b519-080027f5fec9">
 <topic>rubygem-cgi -- HTTP response splitting vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-cgi</name>
	<range><lt>0.3.4</lt></range>
 </package>
 <package>
	<name>ruby</name>
	<range><ge>2.7.0,1</ge><lt>2.7.7,1</lt></range>
	<range><ge>3.0.0,1</ge><lt>3.0.5,1</lt></range>
	<range><ge>3.1.0,1</ge><lt>3.1.3,1</lt></range>
	<range><ge>3.2.0.p1,1</ge><lt>3.2.0.r1,1</lt></range>
 </package>
 <package>
	<name>ruby27</name>
	<range><ge>2.7.0,1</ge><lt>2.7.7,1</lt></range>
 </package>
 <package>
	<name>ruby30</name>
	<range><ge>3.0.0,1</ge><lt>3.0.5,1</lt></range>
 </package>
 <package>
	<name>ruby31</name>
	<range><ge>3.1.0,1</ge><lt>3.1.3,1</lt></range>
 </package>
 <package>
	<name>ruby32</name>
	<range><ge>3.2.0.p1,1</ge><lt>3.2.0.r1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hiroshi Tokumaru reports:
	<blockquote cite="https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/">
	 
	 If an application that generates HTTP responses using the
	 cgi gem with untrusted user input, an attacker can exploit
	 it to inject a malicious HTTP response header and/or body.
	 
	 
	 Also, the contents for a <code>CGI::Cookie</code> object
	 were not checked properly. If an application creates a
	 <code>CGI::Cookie</code> object based on user input, an
	 attacker may exploit it to inject invalid attributes in
	 <code>Set-Cookie</code> header. We think such applications
	 are unlikely, but we have included a change to check
	 arguments for <code>CGI::Cookie#initialize</code>
	 preventatively.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-33621</cvename>
 <url>https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/</url>
 </references>
 <dates>
 <discovery>2022-11-22</discovery>
 <entry>2022-11-24</entry>
 </dates>
 </vuln>

<vuln vid="658b9198-8106-4c3d-a2aa-dc4a0a7cc3b6">
 <topic>zeek -- potential DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>5.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.4">
	 A specially-crafted series of HTTP 0.9 packets can
	 cause Zeek to spend large amounts of time processing the
	 packets. 
	 A specially-crafted FTP packet can cause Zeek to spend
	 large amounts of time processing the command. 
	 A specially-crafted IPv6 packet can cause Zeek to
	 overflow memory and potentially crash. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v5.0.4</url>
 </references>
 <dates>
 <discovery>2022-11-24</discovery>
 <entry>2022-11-24</entry>
 </dates>
 </vuln>

<vuln vid="b6a84729-6bd0-11ed-8d9a-b42e991fc52e">
 <topic>advancecomp -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>advancecomp</name>
	<range><lt>2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitHub advisories reports:
	<blockquote cite="https://github.com/advisories/GHSA-8xqx-5mpr-g8xj">
	Multiple vulnerabilities found in advancecomp including:
	<ul>
	 <li>Three segmentation faults.</li>
	 <li>Heap buffer overflow via le_uint32_read at /lib/endianrw.h.</li>
	 <li>Three more heap buffer overflows.</li>
	</ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-35014</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-35014</url>
 <cvename>CVE-2022-35015</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-35015</url>
 <cvename>CVE-2022-35016</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-35016</url>
 <cvename>CVE-2022-35017</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-35017</url>
 <cvename>CVE-2022-35018</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-35018</url>
 <cvename>CVE-2022-35019</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-35019</url>
 <cvename>CVE-2022-35020</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-35020</url>
 </references>
 <dates>
 <discovery>2022-08-29</discovery>
 <entry>2022-11-24</entry>
 </dates>
 </vuln>

<vuln vid="e0f26ac5-6a17-11ed-93e7-901b0e9408dc">
 <topic>tailscale -- Security vulnerability in the client</topic>
 <affects>
 <package>
	<name>tailscale</name>
	<range><lt>1.32.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tailscale team reports:
	<blockquote cite="https://tailscale.com/security-bulletins/#ts-2022-005">
	A vulnerability identified in the Tailscale client allows a
	malicious website to access the peer API, which can then be used
	to access Tailscale environment variables.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-41925</cvename>
 <url>https://tailscale.com/security-bulletins/#ts-2022-005</url>
 </references>
 <dates>
 <discovery>2022-11-21</discovery>
 <entry>2022-11-22</entry>
 </dates>
 </vuln>

<vuln vid="556fdf03-6785-11ed-953b-002b67dfc673">
 <topic>Tomcat -- Request Smuggling</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><ge>8.5.0</ge><lt>8.5.83</lt></range>
	<range><ge>9.0.0-M1</ge><lt>9.0.68</lt></range>
	<range><ge>10.0.0-M1</ge><lt>10.0.27</lt></range>
	<range><ge>10.1.0-M1</ge><lt>10.1.1</lt></range>
 </package>
 <package>
	<name>tomcat85</name>
	<range><ge>8.5.0</ge><lt>8.5.83</lt></range>
 </package>
 <package>
	<name>tomcat9</name>
	<range><ge>9.0.0-M1</ge><lt>9.0.68</lt></range>
 </package>
 <package>
	<name>tomcat10</name>
	<range><ge>10.0.0-M1</ge><lt>10.0.27</lt></range>
 </package>
 <package>
	<name>tomcat101</name>
	<range><ge>10.1.0-M1</ge><lt>10.1.1</lt></range>
 </package>
 <package>
	<name>tomcat-devel</name>
	<range><ge>10.1.0-M1</ge><lt>10.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache Tomcat reports:
	<blockquote cite="https://lists.apache.org/thread/zzcxzvqfdqn515zfs3dxb7n8gty589sq">
	 
	 If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.
	 
	 The CVSS score for this vulnerability is 7.5 High
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-42252</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-42252</url>
 </references>
 <dates>
 <discovery>2022-10-31</discovery>
 <entry>2022-11-18</entry>
 </dates>
 </vuln>

<vuln vid="094e4a5b-6511-11ed-8c5e-206a8a720317">
 <topic>krb5 -- Integer overflow vulnerabilities in PAC parsing</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><lt>1.19.3_1</lt></range>
	<range><gt>1.20</gt><lt>1.20_1</lt></range>
 </package>
 <package>
	<name>krb5-120</name>
	<range><lt>1.20_1</lt></range>
 </package>
 <package>
	<name>krb5-119</name>
	<range><lt>1.19.3_1</lt></range>
 </package>
 <package>
	<name>krb5-devel</name>
	<range><lt>1.20.2022.11.03</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITKRB5-SA-2022-001 Vulnerabilities in PAC parsing:
	<blockquote cite="https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2022-001.txt">
	 Due to an integer overflow vulnerabilities in PAC parsing
	 An authenticated attacker may be able to cause a KDC or kadmind
	 process to crash by reading beyond the bounds of allocated memory,
	 creating a denial of service.
	 On 32-bit platforms an authenticated attacker may be able to
	 cause heap corruption resulting in an RCE.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-42898</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42898</url>
 </references>
 <dates>
 <discovery>2022-11-05</discovery>
 <entry>2022-11-15</entry>
 </dates>
 </vuln>

<vuln vid="0a80f159-629b-11ed-9ca2-6c3be5272acd">
 <topic>Grafana -- Username enumeration</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>8.0.0</ge><lt>8.5.15</lt></range>
	<range><ge>9.0.0</ge><lt>9.2.4</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.0.0</ge><lt>8.5.15</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge><lt>9.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2022/11/08/security-release-new-versions-of-grafana-with-critical-and-moderate-fixes-for-cve-2022-39328-cve-2022-39307-and-cve-2022-39306/">
	 When using the forget password on the login page, a POST request is made
	 to the <code>/api/user/password/sent-reset-email</code> URL. When the username
	 or email does not exist, a JSON response contains a “user not found” message.
	 
	 The CVSS score for this vulnerability is 5.3 Moderate
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-39307</cvename>
 <url>https://github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5</url>
 </references>
 <dates>
 <discovery>2022-10-24</discovery>
 <entry>2022-11-12</entry>
 </dates>
 </vuln>

<vuln vid="6eb6a442-629a-11ed-9ca2-6c3be5272acd">
 <topic>Grafana -- Privilege escalation</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>8.0.0</ge><lt>8.5.15</lt></range>
	<range><ge>9.0.0</ge><lt>9.2.4</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.0.0</ge><lt>8.5.15</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge><lt>9.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2022/11/08/security-release-new-versions-of-grafana-with-critical-and-moderate-fixes-for-cve-2022-39328-cve-2022-39307-and-cve-2022-39306/">
	 Grafana admins can invite other members to the organization they are
	 an admin for. When admins add members to the organization, non existing users
	 get an email invite, existing members are added directly to the organization.
	 When an invite link is sent, it allows users to sign up with whatever
	 username/email address the user chooses and become a member of the organization.
	 
	 The CVSS score for this vulnerability is 6.4 Moderate
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-39306</cvename>
 <url>https://github.com/grafana/grafana/security/advisories/GHSA-2x6g-h2hg-rq84</url>
 </references>
 <dates>
 <discovery>2022-10-24</discovery>
 <entry>2022-11-12</entry>
 </dates>
 </vuln>

<vuln vid="db895ed0-6298-11ed-9ca2-6c3be5272acd">
 <topic>Grafana -- Privilege escalation</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>9.2.0</ge><lt>9.2.4</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.2.0</ge><lt>9.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2022/11/08/security-release-new-versions-of-grafana-with-critical-and-moderate-fixes-for-cve-2022-39328-cve-2022-39307-and-cve-2022-39306/">
	 Internal security audit identified a race condition in the Grafana codebase,
	 which allowed an unauthenticated user to query an arbitrary endpoint in Grafana.
	 A race condition in the <a href="https://github.com/grafana/grafana/blob/main/pkg/web/router.go#L153">
	 HTTP context</a> creation could make a HTTP request being assigned
	 the authentication/authorization middlewares of another call. Under heavy load
	 it is possible that a call protected by a privileged middleware receives instead
	 the middleware of a public query. As a result, an unauthenticated user can
	 successfully query protected endpoints.
	 The CVSS score for this vulnerability is 9.8 Critical
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-39328</cvename>
 <url>https://github.com/grafana/grafana/security/advisories/GHSA-vqc4-mpj8-jxch</url>
 </references>
 <dates>
 <discovery>2022-11-08</discovery>
 <entry>2022-11-12</entry>
 </dates>
 </vuln>

<vuln vid="4e60d660-6298-11ed-9ca2-6c3be5272acd">
 <topic>Grafana -- Plugin signature bypass</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>7.0.0</ge><lt>8.5.14</lt></range>
	<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
 </package>
 <package>
	<name>grafana7</name>
	<range><ge>7.0.0</ge></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.0.0</ge><lt>8.5.14</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2022/10/12/grafana-security-releases-new-versions-with-fixes-for-cve-2022-39229-cve-2022-39201-cve-2022-31130-cve-2022-31123/">
	 On July 4th as a result of an internal security audit we have discovered
	 a bypass in the plugin signature verification by exploiting a versioning flaw.
	 We believe that this vulnerability is rated at CVSS 6.1
	 (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-31123</cvename>
 <url>https://github.com/grafana/grafana/security/advisories/GHSA-rhxj-gh46-jvw8</url>
 </references>
 <dates>
 <discovery>2022-07-04</discovery>
 <entry>2022-11-12</entry>
 </dates>
 </vuln>

<vuln vid="6f6c9420-6297-11ed-9ca2-6c3be5272acd">
 <topic>Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>7.0.0</ge><lt>8.5.14</lt></range>
	<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
 </package>
 <package>
	<name>grafana7</name>
	<range><ge>7.0.0</ge></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.0.0</ge><lt>8.5.14</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2022/10/12/grafana-security-releases-new-versions-with-fixes-for-cve-2022-39229-cve-2022-39201-cve-2022-31130-cve-2022-31123/">
	 On June 26 a security researcher contacted Grafana Labs to disclose
	 a vulnerability with the GitLab data source plugin that could leak the API key
	 to GitLab. After further analysis the vulnerability impacts data source
	 and plugin proxy endpoints with authentication tokens but under some conditions.
	 We believe that this vulnerability is rated at CVSS 4.9
	 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-31130</cvename>
 <url>https://github.com/grafana/grafana/security/advisories/GHSA-jv32-5578-pxjc</url>
 </references>
 <dates>
 <discovery>2022-06-26</discovery>
 <entry>2022-11-12</entry>
 </dates>
 </vuln>

<vuln vid="6877e164-6296-11ed-9ca2-6c3be5272acd">
 <topic>Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>5.0.0</ge><lt>8.5.14</lt></range>
	<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
 </package>
 <package>
	<name>grafana7</name>
	<range><ge>7.0.0</ge></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.0.0</ge><lt>8.5.14</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2022/10/12/grafana-security-releases-new-versions-with-fixes-for-cve-2022-39229-cve-2022-39201-cve-2022-31130-cve-2022-31123/">
	 On September 7th as a result of an internal security audit we have discovered
	 that Grafana could leak the authentication cookie of users to plugins. After
	 further analysis the vulnerability impacts data source and plugin proxy
	 endpoints under certain conditions.
	 We believe that this vulnerability is rated at CVSS 6.8
	 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-39201</cvename>
 <url>https://github.com/grafana/grafana/security/advisories/GHSA-x744-mm8v-vpgr</url>
 </references>
 <dates>
 <discovery>2022-09-07</discovery>
 <entry>2022-11-12</entry>
 </dates>
 </vuln>

<vuln vid="909a80ba-6294-11ed-9ca2-6c3be5272acd">
 <topic>Grafana -- Improper authentication</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>8.0.0</ge><lt>8.5.14</lt></range>
	<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.0.0</ge><lt>8.5.14</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge><lt>9.1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2022/10/12/grafana-security-releases-new-versions-with-fixes-for-cve-2022-39229-cve-2022-39201-cve-2022-31130-cve-2022-31123/">
	 On September 7, as a result of an internal security audit, we discovered
	 a security vulnerability in Grafana’s basic authentication related to the usage
	 of username and email address.
	 n Grafana, a user’s username and email address are unique fields, which
	 means no other user can have the same username or email address as another user.
	 
	 In addition, a user can have an email address as a username, and the Grafana
	 login allows users to sign in with either username or email address. This
	 creates an unusual behavior, where user_1 can register with one email
	 address and user_2 can register their username as user_1’s
	 email address. As a result, user_1 would be prevented from signing
	 in to Grafana, since user_1 password won’t match with user_2
	 email address.
	 The CVSS score for this vulnerability is 4.3 moderate
	 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-39229</cvename>
 <url>https://github.com/grafana/grafana/security/advisories/GHSA-gj7m-853r-289r</url>
 </references>
 <dates>
 <discovery>2022-09-07</discovery>
 <entry>2022-11-12</entry>
 </dates>
 </vuln>

<vuln vid="35d1e192-628e-11ed-8c5e-641c67a117d8">
 <topic>ipython -- Execution with Unnecessary Privileges</topic>
 <affects>
 <package>
	<name>py37-ipython</name>
	<name>py38-ipython</name>
	<name>py39-ipython</name>
	<name>py310-ipython</name>
	<name>py311-ipython</name>
	<range><lt>7.31.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	IPython project reports:
	<blockquote cite="https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699">
	 IPython 8.0.1, 7.31.1 and 5.11 are security releases that change some
	 default values in order to prevent potential Execution with Unnecessary
	 Privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-21699</cvename>
 <url>https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x</url>
 <url>https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699</url>
 </references>
 <dates>
 <discovery>2022-01-19</discovery>
 <entry>2022-11-12</entry>
 </dates>
 </vuln>

<vuln vid="f5a48a7a-61d3-11ed-9094-589cfc0f81b0">
 <topic>phpmyfaq -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><lt>3.1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpmyfaq developers report:
	<blockquote cite="https://www.phpmyfaq.de/security/advisory-2022-10-24">
	 a pre-auth SQL injection in then saving user comments
	 a reflected cross-site scripting vulnerability in the search
	 a stored cross-site scripting vulnerability in the meta data administration
	 a weak password requirement
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://huntr.dev/bounties/613143a1-8e51-449a-b214-12458308835d/</url>
 <url>https://huntr.dev/bounties/d9666520-4ff5-43bb-aacf-50c8e5570983/</url>
 <url>https://huntr.dev/bounties/f4711d7f-1368-48ab-9bef-45f32e356c47/</url>
 </references>
 <dates>
 <discovery>2022-10-24</discovery>
 <entry>2022-11-11</entry>
 </dates>
 </vuln>

<vuln vid="5b8d8dee-6088-11ed-8c5e-641c67a117d8">
 <topic>varnish -- HTTP/2 Request Forgery Vulnerability</topic>
 <affects>
 <package>
	<name>varnish7</name>
	<range><lt>7.2.1</lt></range>
 </package>
 <package>
	<name>varnish6</name>
	<range><le>6.6.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Varnish Cache Project reports:
	<blockquote cite="https://varnish-cache.org/security/VSV00011.html">
 A request forgery attack can be performed on Varnish Cache servers that
	 have the HTTP/2 protocol turned on. An attacker may introduce
	 characters through the HTTP/2 pseudo-headers that are invalid in the
	 context of an HTTP/1 request line, causing the Varnish server to
	 produce invalid HTTP/1 requests to the backend. This may in turn be
	 used to successfully exploit vulnerabilities in a server behind the
	 Varnish server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://varnish-cache.org/security/VSV00011.html</url>
 </references>
 <dates>
 <discovery>2022-11-08</discovery>
 <entry>2022-11-09</entry>
 </dates>
 </vuln>

<vuln vid="b10d1afa-6087-11ed-8c5e-641c67a117d8">
 <topic>varnish -- Request Smuggling Vulnerability</topic>
 <affects>
 <package>
	<name>varnish7</name>
	<range><lt>7.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Varnish Cache Project reports:
	<blockquote cite="https://varnish-cache.org/security/VSV00010.html">
 A request smuggling attack can be performed on Varnish Cache servers by
	 requesting that certain headers are made hop-by-hop, preventing the
	 Varnish Cache servers from forwarding critical headers to the backend.
	 Among the headers that can be filtered this way are both Content-Length
	 and Host, making it possible for an attacker to both break the HTTP/1
	 protocol framing, and bypass request to host routing in VCL.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://varnish-cache.org/security/VSV00010.html</url>
 </references>
 <dates>
 <discovery>2022-11-08</discovery>
 <entry>2022-11-09</entry>
 </dates>
 </vuln>

<vuln vid="6b04476f-601c-11ed-92ce-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>107.0.5304.110</lt></range>
 </package>
 <package>
	<name>ungoogled-chromium</name>
	<range><lt>107.0.5304.110</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html">
	 This release contains 10 security fixes, including:
	 <ul>
	 <li>[1377816] High CVE-2022-3885: Use after free in V8. Reported by gzobqq@ on 2022-10-24</li>
	 <li>[1372999] High CVE-2022-3886: Use after free in Speech Recognition. Reported by anonymous on 2022-10-10</li>
	 <li>[1372695] High CVE-2022-3887: Use after free in Web Workers. Reported by anonymous on 2022-10-08</li>
	 <li>[1375059] High CVE-2022-3888: Use after free in WebCodecs. Reported by Peter Nemeth on 2022-10-16</li>
	 <li>[1380063] High CVE-2022-3889: Type Confusion in V8. Reported by anonymous on 2022-11-01</li>
	 <li>[1380083] High CVE-2022-3890: Heap buffer overflow in Crashpad. Reported by anonymous on 2022-11-01</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3885</cvename>
 <cvename>CVE-2022-3886</cvename>
 <cvename>CVE-2022-3887</cvename>
 <cvename>CVE-2022-3888</cvename>
 <cvename>CVE-2022-3889</cvename>
 <cvename>CVE-2022-3890</cvename>
 <url>https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2022-11-08</discovery>
 <entry>2022-11-09</entry>
 </dates>
 </vuln>

<vuln vid="60d4d31a-a573-41bd-8c1e-5af7513c1ee9">
 <topic>zeek -- potential DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>5.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.3">
	 Fix an issue where a specially-crafted FTP packet can
	 cause Zeek to spend large amounts of time attempting to
	 search for valid commands in the data stream. 
	 Fix a possible overflow in the Zeek dictionary code
	 that may lead to a memory leak. 
	 Fix an issue where a specially-crafted packet can
	 cause Zeek to spend large amounts of time reporting
	 analyzer violations. 
	 Fix a possible assert and crash in the HTTP analyzer
	 when receiving a specially crafted packet. 
	 Fix an issue where a specially-crafted HTTP or SMTP
	 packet can cause Zeek to spend a large amount of time
	 attempting to search for filenames within the packet data.
	 
	 Fix two separate possible crashes when converting
	 processed IP headers for logging via the raw_packet event
	 handlers. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v5.0.3</url>
 </references>
 <dates>
 <discovery>2022-11-09</discovery>
 <entry>2022-11-09</entry>
 </dates>
 </vuln>

<vuln vid="9c399521-5f80-11ed-8ac4-b42e991fc52e">
 <topic>darkhttpd -- DOS vulnerability</topic>
 <affects>
 <package>
	<name>darkhttpd</name>
	<range><lt>1.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25691">
	 
	 flaw was found in darkhttpd. Invalid error handling allows
	 remote attackers to cause denial-of-service by accessing a
	 file with a large modification date. The highest threat
	 from this vulnerability is to system availability.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-25691</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25691</url>
 </references>
 <dates>
 <discovery>2020-11-02</discovery>
 <entry>2022-11-08</entry>
 </dates>
 </vuln>

<vuln vid="3310014a-5ef9-11ed-812b-206a8a720317">
 <topic>sudo -- Potential out-of-bounds write for small passwords</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><ge>1.8.0</ge><lt>1.9.12p1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE.org reports:
	<blockquote cite="https://www.cve.org/CVERecord?id=CVE-2022-43995">
	 Sudo 1.8.0 through 1.9.12, with the crypt() password backend,
	 contains a plugins/sudoers/auth/passwd.c array-out-of-bounds
	 error that can result in a heap-based buffer over-read. This
	 can be triggered by arbitrary local users with access to sudo
	 by entering a password of seven characters or fewer. The impact
	 could vary depending on the system libraries, compiler,
	 and processor architecture.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-43995</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43995</url>
 </references>
 <dates>
 <discovery>2022-11-07</discovery>
 <entry>2022-11-07</entry>
 </dates>
 </vuln>

<vuln vid="16f7ec68-5cce-11ed-9be7-454b1dd82c64">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>15.5.0</ge><lt>15.5.2</lt></range>
	<range><ge>15.4.0</ge><lt>15.4.4</lt></range>
	<range><ge>9.3.0</ge><lt>15.3.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2022/11/02/security-release-gitlab-15-5-2-released/">
	 DAST analyzer sends custom request headers with every request
	 Stored-XSS with CSP-bypass via scoped labels' color
	 Maintainer can leak Datadog API key by changing integration URL
	 Uncontrolled resource consumption when parsing URLs
	 Issue HTTP requests when users view an OpenAPI document and click buttons
	 Command injection in CI jobs via branch name in CI pipelines
	 Open redirection
	 Prefill variables do not check permission of the project in external CI config
	 Disclosure of audit events to insufficiently permissioned group and project members
	 Arbitrary GFM references rendered in Jira issue description leak private/confidential resources
	 Award emojis API for an internal note is accessible to users without access to the note
	 Open redirect in pipeline artifacts when generating HTML documents
	 Retrying a job in a downstream pipeline allows the retrying user to take ownership of the retried jobs in upstream pipelines
	 Project-level Secure Files can be written out of the target directory
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3767</cvename>
 <cvename>CVE-2022-3265</cvename>
 <cvename>CVE-2022-3483</cvename>
 <cvename>CVE-2022-3818</cvename>
 <cvename>CVE-2022-3726</cvename>
 <cvename>CVE-2022-2251</cvename>
 <cvename>CVE-2022-3486</cvename>
 <cvename>CVE-2022-3793</cvename>
 <cvename>CVE-2022-3413</cvename>
 <cvename>CVE-2022-2761</cvename>
 <cvename>CVE-2022-3819</cvename>
 <cvename>CVE-2022-3280</cvename>
 <cvename>CVE-2022-3706</cvename>
 <url>https://about.gitlab.com/releases/2022/11/02/security-release-gitlab-15-5-2-released/</url>
 </references>
 <dates>
 <discovery>2022-11-02</discovery>
 <entry>2022-11-05</entry>
 </dates>
 </vuln>

<vuln vid="b278783f-5c1d-11ed-a21f-001fc69cd6dc">
 <topic>pixman -- heap overflow</topic>
 <affects>
 <package>
	<name>pixman</name>
	<range><lt>0.42.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pixman reports: for release 0.42.2
	<blockquote cite="https://lists.freedesktop.org/archives/pixman/2022-November/004994.html">
	 Avoid integer overflow leading to out-of-bounds write
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-44638</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-44638</url>
 </references>
 <dates>
 <discovery>2022-11-02</discovery>
 <entry>2022-11-03</entry>
 </dates>
 </vuln>

<vuln vid="26b1100a-5a27-11ed-abfe-29ac76ec31b5">
 <topic>go -- syscall, os/exec: unsanitized NUL in environment variables</topic>
 <affects>
 <package>
	<name>go118</name>
	<range><lt>1.18.8</lt></range>
 </package>
 <package>
	<name>go119</name>
	<range><lt>1.19.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/56284">
	 syscall, os/exec: unsanitized NUL in environment
	 variables
	 On Windows, syscall.StartProcess and os/exec.Cmd did not
	 properly check for invalid environment variable values. A
	 malicious environment variable value could exploit this
	 behavior to set a value for a different environment
	 variable. For example, the environment variable string
	 "A=B\x00C=D" set the variables "A=B" and "C=D".
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-41716</cvename>
 <url>https://groups.google.com/g/golang-dev/c/83nKqv2W1Dk/m/gEJdD5vjDwAJ</url>
 </references>
 <dates>
 <discovery>2022-10-17</discovery>
 <entry>2022-11-01</entry>
 </dates>
 </vuln>

<vuln vid="0844671c-5a09-11ed-856e-d4c9ef517024">
 <topic>OpenSSL -- Buffer overflows in Email verification</topic>
 <affects>
 <package>
	<name>openssl-devel</name>
	<range><lt>3.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20221101.txt">
	 X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602) (High):
	 A buffer overrun can be triggered in X.509 certificate verification,
	 specifically in name constraint checking.
	 X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)
	 (High): A buffer overrun can be triggered in X.509 certificate
	 verification, specifically in name constraint checking.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3602</cvename>
 <cvename>CVE-2022-3786</cvename>
 <url>https://www.openssl.org/news/secadv/20221101.txt</url>
 </references>
 <dates>
 <discovery>2022-11-01</discovery>
 <entry>2022-11-01</entry>
 </dates>
 </vuln>

<vuln vid="4b9c1c17-587c-11ed-856e-d4c9ef517024">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql-connector-c++</name>
	<range><lt>8.0.31</lt></range>
 </package>
 <package>
	<name>mysql-connector-odbc</name>
	<range><lt>8.0.31</lt></range>
 </package>
 <package>
	<name>mysql-client57</name>
	<range><lt>5.7.40</lt></range>
 </package>
 <package>
	<name>mysql-server57</name>
	<range><lt>5.7.40</lt></range>
 </package>
 <package>
	<name>mysql-client80</name>
	<range><lt>8.0.31</lt></range>
 </package>
 <package>
	<name>mysql-server80</name>
	<range><lt>8.0.31</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpuoct2022.html#AppendixMSQL">
	 This Critical Patch Update contains 37 new security patches for
	 Oracle MySQL. 11 of these vulnerabilities may be remotely
	 exploitable without authentication, i.e., may be exploited over a
	 network without requiring user credentials
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-21600</cvename>
 <cvename>CVE-2022-21635</cvename>
 <cvename>CVE-2022-39408</cvename>
 <cvename>CVE-2022-39410</cvename>
 <cvename>CVE-2022-2097</cvename>
 <cvename>CVE-2022-21604</cvename>
 <cvename>CVE-2022-21637</cvename>
 <cvename>CVE-2022-21617</cvename>
 <cvename>CVE-2022-21605</cvename>
 <cvename>CVE-2022-21594</cvename>
 <cvename>CVE-2022-21607</cvename>
 <cvename>CVE-2022-21608</cvename>
 <cvename>CVE-2022-21638</cvename>
 <cvename>CVE-2022-21640</cvename>
 <cvename>CVE-2022-21641</cvename>
 <cvename>CVE-2022-39400</cvename>
 <cvename>CVE-2022-21633</cvename>
 <cvename>CVE-2022-21632</cvename>
 <cvename>CVE-2022-21599</cvename>
 <cvename>CVE-2022-21595</cvename>
 <cvename>CVE-2022-21625</cvename>
 <cvename>CVE-2022-21592</cvename>
 <cvename>CVE-2022-21589</cvename>
 <cvename>CVE-2022-39402</cvename>
 <cvename>CVE-2022-39404</cvename>
 <cvename>CVE-2022-21611</cvename>
 <cvename>CVE-2022-39403</cvename>
 <url>https://www.oracle.com/security-alerts/cpuoct2022.html#AppendixMSQL</url>
 </references>
 <dates>
 <discovery>2022-10-18</discovery>
 <entry>2022-10-30</entry>
 </dates>
 </vuln>

<vuln vid="1225c888-56ea-11ed-b5c3-3065ec8fd3ec">
 <topic>chromium -- Type confusion in V8</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>107.0.5304.87</lt></range>
 </package>
 <package>
	<name>ungoogled-chromium</name>
	<range><lt>107.0.5304.87</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_27.html">
	 This release contains 1 security fix:
	 <ul>
	 <li>[1378239] High CVE-2022-3723: Type Confusion in V8. Reported by Jan Vojtešek, Milánek, and Przemek Gmerek of Avast on 2022-10-25</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3723</cvename>
 <url>https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_27.html</url>
 </references>
 <dates>
 <discovery>2022-10-27</discovery>
 <entry>2022-10-28</entry>
 </dates>
 </vuln>

<vuln vid="1c5f3fd7-54bf-11ed-8d1e-005056a311d1">
 <topic>samba -- buffer overflow in Heimdal unwrap_des3()</topic>
 <affects>
 <package>
	<name>samba412</name>
	<range><lt>4.12.16</lt></range>
 </package>
 <package>
	<name>samba413</name>
	<range><lt>4.13.17_4</lt></range>
 </package>
 <package>
	<name>samba416</name>
	<range><lt>4.16.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="https://www.samba.org/samba/security/CVE-2022-3437.html">
	 The DES (for Samba 4.11 and earlier) and Triple-DES decryption
	 routines in the Heimdal GSSAPI library allow a length-limited write
	 buffer overflow on malloc() allocated memory when presented with a
	 maliciously small packet.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3437</cvename>
 <url>https://www.samba.org/samba/security/CVE-2022-3437.html</url>
 </references>
 <dates>
 <discovery>2022-08-02</discovery>
 <entry>2022-10-25</entry>
 </dates>
 </vuln>

<vuln vid="b4ef02f4-549f-11ed-8ad9-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>107.0.5304.68</lt></range>
 </package>
 <package>
	<name>ungoogled-chromium</name>
	<range><lt>107.0.5304.68</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html">
	 This release contains 14 security fixes, including:
	 <ul>
	 <li>[1369871] High CVE-2022-3652: Type Confusion in V8. Reported by srodulv and ZNMchtss at S.S.L Team on 2022-09-30</li>
	 <li>[1354271] High CVE-2022-3653: Heap buffer overflow in Vulkan. Reported by SeongHwan Park (SeHwa) on 2022-08-19</li>
	 <li>[1365330] High CVE-2022-3654: Use after free in Layout. Reported by Sergei Glazunov of Google Project Zero on 2022-09-19</li>
	 <li>[1343384] Medium CVE-2022-3655: Heap buffer overflow in Media Galleries. Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2022-07-11</li>
	 <li>[1345275] Medium CVE-2022-3656: Insufficient data validation in File System. Reported by Ron Masas, Imperva on 2022-07-18</li>
	 <li>[1351177] Medium CVE-2022-3657: Use after free in Extensions. Reported by Omri Bushari, Talon Cyber Security on 2022-08-09</li>
	 <li>[1352817] Medium CVE-2022-3658: Use after free in Feedback service on Chrome OS. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute on 2022-08-14</li>
	 <li>[1355560] Medium CVE-2022-3659: Use after free in Accessibility. Reported by @ginggilBesel on 2022-08-23</li>
	 <li>[1327505] Medium CVE-2022-3660: Inappropriate implementation in Full screen mode. Reported by Irvan Kurniawan (sourc7) on 2022-05-20</li>
	 <li>[1350111] Low CVE-2022-3661: Insufficient data validation in Extensions. Reported by Young Min Kim (@ylemkimon), CompSec Lab at Seoul National University on 2022-08-04</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3652</cvename>
 <cvename>CVE-2022-3653</cvename>
 <cvename>CVE-2022-3654</cvename>
 <cvename>CVE-2022-3655</cvename>
 <cvename>CVE-2022-3656</cvename>
 <cvename>CVE-2022-3657</cvename>
 <cvename>CVE-2022-3658</cvename>
 <cvename>CVE-2022-3659</cvename>
 <cvename>CVE-2022-3660</cvename>
 <cvename>CVE-2022-3661</cvename>
 <url>https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html</url>
 </references>
 <dates>
 <discovery>2022-10-25</discovery>
 <entry>2022-10-25</entry>
 </dates>
 </vuln>

<vuln vid="68fcee9b-5259-11ed-89c9-0800276af896">
 <topic>Cleartext leak in libudisks</topic>
 <affects>
 <package>
	<name>libudisks</name>
	<range><lt>2.9.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	From libudisks 2.9.4 NEWS:
	<blockquote cite="https://github.com/storaged-project/udisks/blob/udisks-2.9.4/NEWS">
	 udiskslinuxblock: Fix leaking cleartext block interface
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/storaged-project/udisks/blob/udisks-2.9.4/NEWS</url>
 </references>
 <dates>
 <discovery>2021-09-29</discovery>
 <entry>2022-10-22</entry>
 </dates>
 </vuln>

<vuln vid="c253c4aa-5126-11ed-8a21-589cfc0f81b0">
 <topic>phpmyfaq -- CSRF vulnerability</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><lt>3.1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpmyfaq developers report:
	<blockquote cite="https://www.phpmyfaq.de/security/advisory-2022-10-02">
	 phpMyFAQ does not implement sufficient checks to avoid
	 CSRF when logging out an user.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://huntr.dev/bounties/76095ac1-da12-449b-9564-4a086be96592/</url>
 </references>
 <dates>
 <discovery>2022-10-02</discovery>
 <entry>2022-10-21</entry>
 </dates>
 </vuln>

<vuln vid="d6d088c9-5064-11ed-bade-080027881239">
 <topic>Python -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python37</name>
	<range><lt>3.7.15</lt></range>
 </package>
 <package>
	<name>python38</name>
	<range><lt>3.8.15</lt></range>
 </package>
 <package>
	<name>python39</name>
	<range><lt>3.9.15</lt></range>
 </package>
 <package>
	<name>python310</name>
	<range><lt>3.10.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python reports:
	<blockquote cite="https://docs.python.org/release/3.9.15/whatsnew/changelog.html">
	 gh-97616: Fix multiplying a list by an integer (list *= int): detect
	 the integer overflow when the new allocated length is close to the
	 maximum size. Issue reported by Jordan Limor. Patch by Victor Stinner.
	 gh-97612: Fix a shell code injection vulnerability in the
	 get-remote-certificate.py example script. The script no longer uses
	 a shell to run openssl commands. Issue reported and initial fix by
	 Caleb Shortt. Patch by Victor Stinner.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.python.org/release/3.9.15/whatsnew/changelog.html</url>
 </references>
 <dates>
 <discovery>2022-09-29</discovery>
 <entry>2022-10-20</entry>
 </dates>
 </vuln>

<vuln vid="676d4f16-4fb3-11ed-a374-8c164567ca3c">
 <topic>nginx -- Two vulnerabilities</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><ge>1.0.7</ge><lt>1.22.1</lt></range>
 </package>
 <package>
	<name>nginx-devel</name>
	<range><ge>1.1.3</ge><lt>1.23.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NGINX Development Team reports:
	<blockquote cite="https://mailman.nginx.org/archives/list/nginx@nginx.org/thread/F7TMIHDNNU3M52GYS23UWDWW2R2BLVVH/">
	 Two security issues were identified in the ngx_http_mp4_module,
	 which might allow an attacker to cause a worker process crash
	 or worker process memory disclosure by using a specially crafted
	 mp4 file, or might have potential other impact (CVE-2022-41741,
	 CVE-2022-41742).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-41741</cvename>
 <cvename>CVE-2022-41742</cvename>
 <url>https://mailman.nginx.org/archives/list/nginx@nginx.org/thread/F7TMIHDNNU3M52GYS23UWDWW2R2BLVVH/</url>
 </references>
 <dates>
 <discovery>2022-10-19</discovery>
 <entry>2022-10-19</entry>
 </dates>
 </vuln>

<vuln vid="2523bc76-4f01-11ed-929b-002590f2a714">
 <topic>git -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>git</name>
	<range><lt>2.38.1</lt></range>
 </package>
 <package>
	<name>git-lite</name>
	<range><lt>2.38.1</lt></range>
 </package>
 <package>
	<name>git-tiny</name>
	<range><lt>2.38.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	
	<blockquote cite="https://lore.kernel.org/git/xmqq4jw1uku5.fsf@gitster.g/T/#u">
	 <h1>This release contains 2 security fixes:</h1>
	 <h2>CVE-2022-39253</h2>
	 
	 When relying on the `--local` clone optimization, Git dereferences
	 symbolic links in the source repository before creating hardlinks
	 (or copies) of the dereferenced link in the destination repository.
	 This can lead to surprising behavior where arbitrary files are
	 present in a repository's `$GIT_DIR` when cloning from a malicious
	 repository.

Git will no longer dereference symbolic links via the `--local`
	   clone mechanism, and will instead refuse to clone repositories that
	   have symbolic links present in the `$GIT_DIR/objects` directory.

Additionally, the value of `protocol.file.allow` is changed to be
	 "user" by default.
	 
	 <h2>CVE-2022-39260</h2>
	 
	 An overly-long command string given to `git shell` can result in
	 overflow in `split_cmdline()`, leading to arbitrary heap writes and
	 remote code execution when `git shell` is exposed and the directory
	 `$HOME/git-shell-commands` exists.

`git shell` is taught to refuse interactive commands that are
	 longer than 4MiB in size. `split_cmdline()` is hardened to reject
	 inputs larger than 2GiB.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-39253</cvename>
 <cvename>CVE-2022-39260</cvename>
 <url>https://lore.kernel.org/git/xmqq4jw1uku5.fsf@gitster.g/T/#u</url>
 </references>
 <dates>
 <discovery>2022-06-09</discovery>
 <entry>2022-10-18</entry>
 </dates>
 </vuln>

<vuln vid="7392e1e3-4eb9-11ed-856e-d4c9ef517024">
 <topic>OpenSSL -- Potential NULL encryption in NID_undef with Custom Cipher</topic>
 <affects>
 <package>
	<name>openssl-devel</name>
	<range><lt>3.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="://www.openssl.org/news/secadv/20221011.txt">
	 Using a Custom Cipher with NID_undef may lead to NULL encryption (low)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3358</cvename>
 <url>https://www.openssl.org/news/secadv/20221011.txt</url>
 </references>
 <dates>
 <discovery>2022-10-11</discovery>
 <entry>2022-10-18</entry>
 </dates>
 </vuln>

<vuln vid="d713d709-4cc9-11ed-a621-0800277bb8a8">
 <topic>gitea -- multiple issues</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.17.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/21463">
	 Sanitize and Escape refs in git backend
	</blockquote>
	<blockquote cite="https://github.com/go-gitea/gitea/pull/21412">
	 Bump golang.org/x/text
	</blockquote>
	<blockquote cite="https://github.com/go-gitea/gitea/pull/21281">
	 Update bluemonday
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.17.3</url>
 </references>
 <dates>
 <discovery>2022-09-27</discovery>
 <entry>2022-10-15</entry>
 </dates>
 </vuln>

<vuln vid="127674c6-4a27-11ed-9f93-002b67dfc673">
 <topic>roundcube-thunderbird_labels -- RCE with custom label titles</topic>
 <affects>
 <package>
	<name>roundcube-thunderbird_labels</name>
	<range><le>1.4.12</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Roundcube project reports:
	<blockquote cite="https://roundcube.net/news/2021/12/30/security-update-1.4.13-released">
	 <h1>Description:</h1>
	 Remote code execution vulnerability in
	 roundcube-thunderbird_labels when tb_label_modify_labels is enabled.
	 <h1>Workaround:</h1>
	 If you cannot upgrade to roundcube-thunderbird_labels-1.4.13 disable the
	 tb_label_modify_labels config option.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/mike-kfed/roundcube-thunderbird_labels/security/advisories/GHSA-wp6h-wgxq-v949</url>
 </references>
 <dates>
 <discovery>2022-10-10</discovery>
 <entry>2022-10-12</entry>
 </dates>
 </vuln>

<vuln vid="7cb12ee0-4a13-11ed-8ad9-3065ec8fd3ec">
 <topic>chromium -- mulitple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>106.0.5249.119</lt></range>
 </package>
 <package>
	<name>ungoogled-chromium</name>
	<range><lt>106.0.5249.119</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html">
	 This release contains 6 security fixes:
	 <ul>
	 <li>[1364604] High CVE-2022-3445: Use after free in Skia. Reported by Nan Wang (@eternalsakura13) and Yong Liu of 360 Vulnerability Research Institute on 2022-09-16</li>
	 <li>[1368076] High CVE-2022-3446: Heap buffer overflow in WebSQL. Reported by Kaijie Xu (@kaijieguigui) on 2022-09-26</li>
	 <li>[1366582] High CVE-2022-3447: Inappropriate implementation in Custom Tabs. Reported by Narendra Bhati of Suma Soft Pvt. Ltd. Pune (India) on 2022-09-22</li>
	 <li>[1363040] High CVE-2022-3448: Use after free in Permissions API. Reported by raven at KunLun lab on 2022-09-13</li>
	 <li>[1364662] High CVE-2022-3449: Use after free in Safe Browsing. Reported by asnine on 2022-09-17</li>
	 <li>[1369882] High CVE-2022-3450: Use after free in Peer Connection. Reported by Anonymous on 2022-09-30</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3445</cvename>
 <cvename>CVE-2022-3446</cvename>
 <cvename>CVE-2022-3447</cvename>
 <cvename>CVE-2022-3448</cvename>
 <cvename>CVE-2022-3449</cvename>
 <cvename>CVE-2022-3450</cvename>
 <url>https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html</url>
 </references>
 <dates>
 <discovery>2022-10-11</discovery>
 <entry>2022-10-12</entry>
 </dates>
 </vuln>

<vuln vid="f9140ad4-4920-11ed-a07e-080027f5fec9">
 <topic>samba -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba412</name>
	<range><lt>4.12.16</lt></range>
 </package>
 <package>
	<name>samba413</name>
	<range><lt>4.13.17_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="https://lists.samba.org/archive/samba-announce/2022/000609.html">
	 <dl>
	 <dt>CVE-2022-2031</dt>
	 <dd>
	 The KDC and the kpasswd service share a single account
	 and set of keys, allowing them to decrypt each other's
	 tickets. A user who has been requested to change their
	 password can exploit this to obtain and use tickets to
	 other services.
	 </dd>
	 <dt>CVE-2022-32744</dt>
	 <dd>
	 The KDC accepts kpasswd requests encrypted with any key
	 known to it. By encrypting forged kpasswd requests with
	 its own key, a user can change the passwords of other
	 users, enabling full domain takeover.
	 </dd>
	 <dt>CVE-2022-32745</dt>
	 <dd>
	 Samba AD users can cause the server to access
	 uninitialised data with an LDAP add or modify request,
	 usually resulting in a segmentation fault.
	 </dd>
	 <dt>CVE-2022-32746</dt>
	 <dd>
	 The AD DC database audit logging module can be made to
	 access LDAP message values that have been freed by a
	 preceding database module, resulting in a
	 use-after-free. This is only possible when modifying
	 certain privileged attributes, such as
	 userAccountControl.
	 </dd>
	 <dt>CVE-2022-32742</dt>
	 <dd>
	 SMB1 Client with write access to a share can cause
	 server memory contents to be written into a file or
	 printer.
	 </dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2031</cvename>
 <cvename>CVE-2022-32744</cvename>
 <cvename>CVE-2022-32745</cvename>
 <cvename>CVE-2022-32746</cvename>
 <cvename>CVE-2022-32742</cvename>
 <url>https://lists.samba.org/archive/samba-announce/2022/000609.html</url>
 <url>https://www.samba.org/samba/security/CVE-2022-2031.html</url>
 <url>https://www.samba.org/samba/security/CVE-2022-32744.html</url>
 <url>https://www.samba.org/samba/security/CVE-2022-32745.html</url>
 <url>https://www.samba.org/samba/security/CVE-2022-32746.html</url>
 <url>https://www.samba.org/samba/security/CVE-2022-32742.html</url>
 </references>
 <dates>
 <discovery>2022-07-27</discovery>
 <entry>2022-10-11</entry>
 </dates>
 </vuln>

<vuln vid="0ae56f3e-488c-11ed-bb31-b42e99a1b9c3">
 <topic>strongswan -- DOS attack vulnerability</topic>
 <affects>
 <package>
	<name>strongswan</name>
	<range><lt>5.9.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Lahav Schlesinger reported a bug related to online
	 certificate revocation checking that can lead to a
	 denial-of-service attack
	<blockquote cite="https://www.strongswan.org/blog/2022/10/03/strongswan-vulnerability-(cve-2022-40617).html">
	 .
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-40617</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-40617</url>
 </references>
 <dates>
 <discovery>2022-10-03</discovery>
 <entry>2022-10-10</entry>
 </dates>
 </vuln>

<vuln vid="e4133d8b-ab33-451a-bc68-3719de73d54a">
 <topic>routinator -- potential DOS attack</topic>
 <affects>
 <package>
	<name>routinator</name>
	<range><ge>0.9.0</ge><lt>0.11.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	
	 Due to a mistake in error handling, data in RRDP snapshot and delta files
	 that isn’t correctly base 64 encoded is treated as a fatal error and causes
	 Routinator to exit.

Worst case impact of this vulnerability is denial of service for the RPKI
	 data that Routinator provides to routers. This may stop your network from
	 validating route origins based on RPKI data. This vulnerability does not
	 allow an attacker to manipulate RPKI data. We are not aware of exploitation
	 of this vulnerability at this point in time.

Starting with release 0.11.3, Routinator handles encoding errors by rejecting
	 the snapshot or delta file and continuing with validation. In case of an
	 invalid delta file, it will try using the snapshot instead. If a snapshot file
	 is invalid, the update of the repository will fail and an update through rsync
	 is attempted.
	 
	<blockquote cite="https://www.cvedetails.com/cve/CVE-2022-3029/">
	 .
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3029</cvename>
 <url>https://nlnetlabs.nl/downloads/routinator/CVE-2022-3029.txt</url>
 </references>
 <dates>
 <discovery>2022-10-06</discovery>
 <entry>2022-10-07</entry>
 </dates>
 </vuln>

<vuln vid="f4f15051-4574-11ed-81a1-080027881239">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py37-django32</name>
	<name>py38-django32</name>
	<name>py39-django32</name>
	<name>py310-django32</name>
	<range><lt>3.2.16</lt></range>
 </package>
 <package>
	<name>py38-django40</name>
	<name>py39-django40</name>
	<name>py310-django40</name>
	<range><lt>4.0.8</lt></range>
 </package>
 <package>
	<name>py38-django41</name>
	<name>py39-django41</name>
	<name>py310-django41</name>
	<range><lt>4.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2022/oct/04/security-releases/">
	 CVE-2022-41323: Potential denial-of-service vulnerability in
	 internationalized URLs.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-41323</cvename>
 <url>https://www.djangoproject.com/weblog/2022/oct/04/security-releases/</url>
 </references>
 <dates>
 <discovery>2022-09-23</discovery>
 <entry>2022-10-06</entry>
 </dates>
 </vuln>

<vuln vid="c2a89e8f-44e9-11ed-9215-00e081b7aa2d">
 <topic>jenkins -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.370</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2022-09-21/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-2886 / CVE-2022-41224</h5>
	 Jenkins 2.367 through 2.369 (both inclusive) does not escape
	 tooltips of the l:helpIcon UI component used for some help icons on
	 the Jenkins web UI.
	 This results in a stored cross-site scripting (XSS) vulnerability
	 exploitable by attackers able to control tooltips for this
	 component.
	 Jenkins 2.370 escapes tooltips of the l:helpIcon UI component.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-41224</cvename>
 <url>https://www.jenkins.io/security/advisory/2022-09-21/</url>
 </references>
 <dates>
 <discovery>2022-09-21</discovery>
 <entry>2022-10-05</entry>
 <modified>2022-10-07</modified>
 </dates>
 </vuln>

<vuln vid="854c2afb-4424-11ed-af97-adcabf310f9b">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go118</name>
	<range><lt>1.18.7</lt></range>
 </package>
 <package>
	<name>go119</name>
	<range><lt>1.19.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/54853">
	 archive/tar: unbounded memory consumption when reading
	 headers
	 Reader.Read did not set a limit on the maximum size of
	 file headers. A maliciously crafted archive could cause
	 Read to allocate unbounded amounts of memory, potentially
	 causing resource exhaustion or panics. Reader.Read now
	 limits the maximum size of header blocks to 1 MiB.
	</blockquote>
	<blockquote cite="https://go.dev/issue/54663">
	 net/http/httputil: ReverseProxy should not forward
	 unparseable query parameters
	 Requests forwarded by ReverseProxy included the raw
	 query parameters from the inbound request, including
	 unparseable parameters rejected by net/http. This could
	 permit query parameter smuggling when a Go proxy
	 forwards a parameter with an unparseable value.
	 ReverseProxy will now sanitize the query parameters in
	 the forwarded query when the outbound request's Form
	 field is set after the ReverseProxy.Director function
	 returns, indicating that the proxy has parsed the query
	 parameters. Proxies which do not parse query parameters
	 continue to forward the original query parameters
	 unchanged.
	</blockquote>
	<blockquote cite="https://go.dev/issue/55949">
	 regexp/syntax: limit memory used by parsing regexps
	 The parsed regexp representation is linear in the size
	 of the input, but in some cases the constant factor can be
	 as high as 40,000, making relatively small regexps consume
	 much larger amounts of memory.
	 Each regexp being parsed is now limited to a 256 MB
	 memory footprint. Regular expressions whose
	 representation would use more space than that are now
	 rejected. Normal use of regular expressions is
	 unaffected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2879</cvename>
 <cvename>CVE-2022-2880</cvename>
 <cvename>CVE-2022-41715</cvename>
 <url>https://groups.google.com/g/golang-announce/c/xtuG5faxtaU/m/jEhlI_5WBgAJ</url>
 </references>
 <dates>
 <discovery>2022-10-04</discovery>
 <entry>2022-10-04</entry>
 </dates>
 </vuln>

<vuln vid="d487d4fc-43a8-11ed-8b01-b42e991fc52e">
 <topic>zydis -- heap buffer overflow</topic>
 <affects>
 <package>
	<name>zydis</name>
	<range><lt>3.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Zyantific reports:
	<blockquote cite="https://github.com/zyantific/zydis/security/advisories/GHSA-q42v-hv86-3m4g">
	
	Zydis users of versions v3.2.0 and older
	that use the string functions provided in zycore in order to
	append untrusted user data to the formatter buffer within
	their custom formatter hooks can run into heap buffer
	overflows. Older versions of Zydis failed to properly
	initialize the string object within the formatter buffer,
	forgetting to initialize a few fields, leaving their value
	to chance. This could then in turn cause zycore functions
	like ZyanStringAppend to make incorrect calculations for the
	new target size, resulting in heap memory corruption.
	
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41253</cvename>
 <url>https://www.cvedetails.com/cve/CVE-2021-41253</url>
 </references>
 <dates>
 <discovery>2021-11-08</discovery>
 <entry>2022-10-04</entry>
 </dates>
 </vuln>

<vuln vid="67057b48-41f4-11ed-86c3-080027881239">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki135</name>
	<range><lt>1.35.8</lt></range>
 </package>
 <package>
	<name>mediawiki137</name>
	<range><lt>1.37.6</lt></range>
 </package>
 <package>
	<name>mediawiki138</name>
	<range><lt>1.38.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawiki reports:
	<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/SPYFDCGZE7KJNO73ET7QVSUXMHXVRFTE/">
	 (T316304, CVE-2022-41767) SECURITY: reassignEdits doesn't update results
	 in an IP range check on Special:Contributions..
	 (T309894, CVE-2022-41765) SECURITY: HTMLUserTextField exposes existence
	 of hidden users.
	 (T307278, CVE-2022-41766) SECURITY: On action=rollback the message
	 "alreadyrolled" can leak revision deleted user name.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-41765</cvename>
 <cvename>CVE-2022-41766</cvename>
 <cvename>CVE-2022-41767</cvename>
 <url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/SPYFDCGZE7KJNO73ET7QVSUXMHXVRFTE/</url>
 </references>
 <dates>
 <discovery>2022-09-29</discovery>
 <entry>2022-10-02</entry>
 </dates>
 </vuln>

<vuln vid="d459c914-4100-11ed-9bc7-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>106.0.5249.91</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_30.html">
	 This release contains 3 security fixes, including:
	 <ul>
	 <li>[1366813] High CVE-2022-3370: Use after free in Custom Elements. Reported by Aviv A. on 2022-09-22</li>
	 <li>[1366399] High CVE-2022-3373: Out of bounds write in V8. Reported by Tibor Klajnscek on 2022-09-21</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3370</cvename>
 <cvename>CVE-2022-3373</cvename>
 <url>https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_30.html</url>
 </references>
 <dates>
 <discovery>2022-09-30</discovery>
 <entry>2022-09-30</entry>
 </dates>
 </vuln>

<vuln vid="04422df1-40d8-11ed-9be7-454b1dd82c64">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>15.4.0</ge><lt>15.4.1</lt></range>
	<range><ge>15.3.0</ge><lt>15.3.4</lt></range>
	<range><ge>9.3.0</ge><lt>15.2.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2022/09/29/security-release-gitlab-15-4-1-released/">
	 Denial of Service via cloning an issue
	 Arbitrary PUT request as victim user through Sentry error list
	 Content injection via External Status Checks
	 Project maintainers can access Datadog API Key from logs
	 Unsafe serialization of Json data could lead to sensitive data leakage
	 Import bug allows importing of private local git repos
	 Maintainer can leak Github access tokens by changing integration URL (even after 15.2.1 patch)
	 Unauthorized users able to create issues in any project
	 Bypass group IP restriction on Dependency Proxy
	 Healthcheck endpoint allow list can be bypassed when accessed over HTTP in an HTTPS enabled system
	 Disclosure of Todo details to guest users
	 A user's primary email may be disclosed through group member events webhooks
	 Content manipulation due to branch/tag name confusion with the default branch name
	 Leakage of email addresses in WebHook logs
	 Specially crafted output makes job logs inaccessible
	 Enforce editing approval rules on project level
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3283</cvename>
 <cvename>CVE-2022-3060</cvename>
 <cvename>CVE-2022-2904</cvename>
 <cvename>CVE-2022-3018</cvename>
 <cvename>CVE-2022-3291</cvename>
 <cvename>CVE-2022-3067</cvename>
 <cvename>CVE-2022-2882</cvename>
 <cvename>CVE-2022-3066</cvename>
 <cvename>CVE-2022-3286</cvename>
 <cvename>CVE-2022-3285</cvename>
 <cvename>CVE-2022-3330</cvename>
 <cvename>CVE-2022-3351</cvename>
 <cvename>CVE-2022-3288</cvename>
 <cvename>CVE-2022-3293</cvename>
 <cvename>CVE-2022-3279</cvename>
 <cvename>CVE-2022-3325</cvename>
 <url>https://about.gitlab.com/releases/2022/09/29/security-release-gitlab-15-4-1-released/</url>
 </references>
 <dates>
 <discovery>2022-09-29</discovery>
 <entry>2022-09-30</entry>
 </dates>
 </vuln>

<vuln vid="5a1c2e06-3fb7-11ed-a402-b42e991fc52e">
 <topic>unbound -- Non-Responsive Delegation Attack</topic>
 <affects>
 <package>
	<name>unbound</name>
	<range><lt>1.16.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 
	A vulnerability named 'Non-Responsive Delegation Attack'
	(NRDelegation Attack) has been discovered in various DNS
	resolving software. The NRDelegation Attack works by having
	a malicious delegation with a considerable number of non
	responsive nameservers. The attack starts by querying a
	resolver for a record that relies on those unresponsive
	nameservers. The attack can cause a resolver to spend a lot
	of time/resources resolving records under a malicious
	delegation point where a considerable number of unresponsive
	NS records reside. It can trigger high CPU usage in some
	resolver implementations that continually look in the cache
	for resolved NS records in that delegation.
 
	<blockquote cite="https://www.cvedetails.com/cve/CVE-2022-3204">
	 .
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3204</cvename>
 <url>https://nlnetlabs.nl/downloads/unbound/CVE-2022-3204.txt</url>
 </references>
 <dates>
 <discovery>2022-09-26</discovery>
 <entry>2022-09-29</entry>
 </dates>
 </vuln>

<vuln vid="cb902a77-3f43-11ed-9402-901b0e9408dc">
 <topic>Matrix clients -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>cinny</name>
	<range><lt>2.2.1</lt></range>
 </package>
 <package>
	<name>element-web</name>
	<range><lt>1.11.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients">
	 Two critical severity vulnerabilities in end-to-end encryption were
	 found in the SDKs which power Element, Beeper, Cinny, SchildiChat,
	 Circuli, Synod.im and any other clients based on matrix-js-sdk,
	 matrix-ios-sdk or matrix-android-sdk2.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-39249</cvename>
 <cvename>CVE-2022-39250</cvename>
 <cvename>CVE-2022-39251</cvename>
 <cvename>CVE-2022-39236</cvename>
 <url>https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients</url>
 </references>
 <dates>
 <discovery>2022-09-23</discovery>
 <entry>2022-09-28</entry>
 </dates>
 </vuln>

<vuln vid="18529cb0-3e9c-11ed-9bc7-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>106.0.5249.61</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html">
	 This release contains 20 security fixes, including:
	 <ul>
	 <li>[1358907] High CVE-2022-3304: Use after free in CSS. Reported by Anonymous on 2022-09-01</li>
	 <li>[1343104] High CVE-2022-3201: Insufficient validation of untrusted input in Developer Tools. Reported by NDevTK on 2022-07-09</li>
	 <li>[1319229] High CVE-2022-3305: Use after free in Survey. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute on 2022-04-24</li>
	 <li>[1320139] High CVE-2022-3306: Use after free in Survey. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute on 2022-04-27</li>
	 <li>[1323488] High CVE-2022-3307: Use after free in Media. Reported by Anonymous Telecommunications Corp. Ltd. on 2022-05-08</li>
	 <li>[1342722] Medium CVE-2022-3308: Insufficient policy enforcement in Developer Tools. Reported by Andrea Cappa (zi0Black) @ Shielder on 2022-07-08</li>
	 <li>[1348415] Medium CVE-2022-3309: Use after free in Assistant. Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab on 2022-07-29</li>
	 <li>[1240065] Medium CVE-2022-3310: Insufficient policy enforcement in Custom Tabs. Reported by Ashwin Agrawal from Optus, Sydney on 2021-08-16</li>
	 <li>[1302813] Medium CVE-2022-3311: Use after free in Import. Reported by Samet Bekmezci @sametbekmezci on 2022-03-04</li>
	 <li>[1303306] Medium CVE-2022-3312: Insufficient validation of untrusted input in VPN. Reported by Andr.Ess on 2022-03-06</li>
	 <li>[1317904] Medium CVE-2022-3313: Incorrect security UI in Full Screen. Reported by Irvan Kurniawan (sourc7) on 2022-04-20</li>
	 <li>[1328708] Medium CVE-2022-3314: Use after free in Logging. Reported by Anonymous on 2022-05-24</li>
	 <li>[1322812] Medium CVE-2022-3315: Type confusion in Blink. Reported by Anonymous on 2022-05-05</li>
	 <li>[1333623] Low CVE-2022-3316: Insufficient validation of untrusted input in Safe Browsing. Reported by Sven Dysthe (@svn_dy) on 2022-06-07</li>
	 <li>[1300539] Low CVE-2022-3317: Insufficient validation of untrusted input in Intents. Reported by Hafiizh on 2022-02-24</li>
	 <li>[1318791] Low CVE-2022-3318: Use after free in ChromeOS Notifications. Reported by GraVity0 on 2022-04-22</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3201</cvename>
 <cvename>CVE-2022-3304</cvename>
 <cvename>CVE-2022-3305</cvename>
 <cvename>CVE-2022-3306</cvename>
 <cvename>CVE-2022-3307</cvename>
 <cvename>CVE-2022-3308</cvename>
 <cvename>CVE-2022-3309</cvename>
 <cvename>CVE-2022-3310</cvename>
 <cvename>CVE-2022-3311</cvename>
 <cvename>CVE-2022-3312</cvename>
 <cvename>CVE-2022-3313</cvename>
 <cvename>CVE-2022-3314</cvename>
 <cvename>CVE-2022-3315</cvename>
 <cvename>CVE-2022-3316</cvename>
 <cvename>CVE-2022-3317</cvename>
 <cvename>CVE-2022-3318</cvename>
 <url>https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html</url>
 </references>
 <dates>
 <discovery>2022-09-27</discovery>
 <entry>2022-09-27</entry>
 </dates>
 </vuln>

<vuln vid="0a0670a1-3e1a-11ed-b48b-e0d55e2a8bf9">
 <topic>expat -- Heap use-after-free vulnerability</topic>
 <affects>
 <package>
	<name>expat</name>
	<range><lt>2.4.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian Security Advisory reports:
	<blockquote cite="https://www.debian.org/security/2022/dsa-5236">
	 Rhodri James discovered a heap use-after-free vulnerability in the doContent function in Expat, an XML parsing C library, which could result in denial of service or potentially the execution of arbitrary code, if a malformed XML file is processed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-40674</cvename>
 <url>https://www.debian.org/security/2022/dsa-5236</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-40674</url>
 </references>
 <dates>
 <discovery>2022-09-14</discovery>
 <entry>2022-09-27</entry>
 </dates>
 </vuln>

<vuln vid="f9ada0b5-3d80-11ed-9330-080027f5fec9">
 <topic>squid -- Exposure of sensitive information in cache manager</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>5.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mikhail Evdokimov (aka konata) reports:
	<blockquote cite="https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq">
	 
	 Due to inconsistent handling of internal URIs Squid is
	 vulnerable to Exposure of Sensitive Information about
	 clients using the proxy. This problem allows a trusted
	 client to directly access cache manager information
	 bypassing the manager ACL protection. The available cache
	 manager information contains records of internal network
	 structure, client credentials, client identity and client
	 traffic behaviour.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-41317</cvename>
 <url>https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq</url>
 </references>
 <dates>
 <discovery>2022-04-17</discovery>
 <entry>2022-09-26</entry>
 </dates>
 </vuln>

<vuln vid="f1f637d1-39eb-11ed-ab44-080027f5fec9">
 <topic>redis -- Potential remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><ge>7.0.0</ge><lt>7.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Redis core team reports:
	<blockquote cite="https://github.com/redis/redis/releases/tag/7.0.5">
	 
	 Executing a XAUTOCLAIM command on a stream key in a
	 specific state, with a specially crafted COUNT argument,
	 may cause an integer overflow, a subsequent heap overflow,
	 and potentially lead to remote code execution. The problem
	 affects Redis versions 7.0.0 or newer.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-35951</cvename>
 <url>https://github.com/redis/redis/releases/tag/7.0.5</url>
 </references>
 <dates>
 <discovery>2022-09-21</discovery>
 <entry>2022-09-21</entry>
 </dates>
 </vuln>

<vuln vid="95e6e6ca-3986-11ed-8e0c-6c3be5272acd">
 <topic>Grafana -- Privilege escalation</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>2.1.0</ge><lt>8.5.13</lt></range>
	<range><ge>9.0.0</ge><lt>9.0.9</lt></range>
	<range><ge>9.1.0</ge><lt>9.1.6</lt></range>
 </package>
 <package>
	<name>grafana7</name>
	<range><ge>7.0</ge></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.0.0</ge><lt>8.5.13</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge><lt>9.0.9</lt></range>
	<range><ge>9.1.0</ge><lt>9.1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2022/09/20/grafana-security-releases-new-versions-with-moderate-severity-security-fixes-for-cve-2022-35957-and-cve-2022-36062/">
	 On August 9 an internal security review identified a vulnerability
	 in the Grafana which allows an escalation from Admin privileges
	 to Server Admin when Auth proxy authentication is used.
	 <a href="https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/#configure-auth-proxy-authentication">
	 Auth proxy</a> allows to authenticate a user by only providing the username
	 (or email) in a <code>X-WEBAUTH-USER</code> HTTP header: the trust assumption
	 is that a front proxy will take care of authentication and that Grafana server
	 is publicly reachable only with this front proxy.
	 <a href="https://grafana.com/docs/grafana/latest/developers/http_api/data_source/#data-source-proxy-calls">
	 Datasource proxy</a> breaks this assumption:
	 <ul>
	 <li>it is possible to configure a fake datasource pointing to a localhost
	 Grafana install with a <code>X-WEBAUTH-USER</code> HTTP header containing
	 admin username.</li>
	 <li>This fake datasource can be called publicly via this proxying feature.</li>
	 </ul>
	 The CVSS score for this vulnerability is 6.6 Moderate
	 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-35957</cvename>
 <url>https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9q</url>
 </references>
 <dates>
 <discovery>2022-08-09</discovery>
 <entry>2022-09-21</entry>
 </dates>
 </vuln>

<vuln vid="656b0152-faa9-4755-b08d-aee4a774bd04">
 <topic>zeek -- potential DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>5.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.2">
	 Fix a possible overflow and crash in the ICMP analyzer
	when receiving a specially crafted packet. 
	 Fix a possible overflow and crash in the IRC analyzer
	when receiving a specially crafted packet. 
	 Fix a possible overflow and crash in the SMB analyzer
	when receiving a specially crafted packet. 
	 Fix two possible crashes when converting IP headers for
	output via the raw_packet event. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v5.0.2</url>
 </references>
 <dates>
 <discovery>2022-09-19</discovery>
 <entry>2022-09-19</entry>
 </dates>
 </vuln>

<vuln vid="aeb4c85b-3600-11ed-b52d-589cfc007716">
 <topic>puppetdb -- Potential SQL injection</topic>
 <affects>
 <package>
	<name>puppetdb6</name>
	<range><lt>6.22.1</lt></range>
 </package>
 <package>
	<name>puppetdb7</name>
	<range><lt>7.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Puppet reports:
	<blockquote cite="https://puppet.com/docs/puppetdb/7/release_notes.html#puppetdb-7111">
	 The org.postgresql/postgresql driver has been updated to version 42.4.1 to address CVE-2022-31197, which is an SQL injection risk that according to the CVE report, can only be exploited if an attacker controls the database to the extent that they can adjust relevant tables to have "malicious" column names.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-31197</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2022-31197</url>
 <url>https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-r38f-c4h4-hqq2</url>
 </references>
 <dates>
 <discovery>2022-08-03</discovery>
 <entry>2022-09-16</entry>
 </dates>
 </vuln>

<vuln vid="b59847e0-346d-11ed-8fe9-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>105.0.5195.125</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html">
	 This release includes 11 security fixes, including:
	 <ul>
	 <li>[1358381] High CVE-2022-3195: Out of bounds write in Storage. Reported by Ziling Chen and Nan Wang (@eternalsakura13) of 360 Vulnerability Research Institute on 2022-08-31</li>
	 <li>[1358090] High CVE-2022-3196: Use after free in PDF. Reported by triplepwns on 2022-08-30</li>
	 <li>[1358075] High CVE-2022-3197: Use after free in PDF. Reported by triplepwns on 2022-08-30</li>
	 <li>[1355682] High CVE-2022-3198: Use after free in PDF. Reported by MerdroidSG on 2022-08-23</li>
	 <li>[1355237] High CVE-2022-3199: Use after free in Frames. Reported by Anonymous on 2022-08-22</li>
	 <li>[1355103] High CVE-2022-3200: Heap buffer overflow in Internals. Reported by Richard Lorenz, SAP on 2022-08-22</li>
	 <li>[1343104] High CVE-2022-3201: Insufficient validation of untrusted input in DevTools. Reported by NDevTK on 2022-07-09</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3195</cvename>
 <cvename>CVE-2022-3196</cvename>
 <cvename>CVE-2022-3197</cvename>
 <cvename>CVE-2022-3198</cvename>
 <cvename>CVE-2022-3199</cvename>
 <cvename>CVE-2022-3200</cvename>
 <cvename>CVE-2022-3201</cvename>
 <url>https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html</url>
 </references>
 <dates>
 <discovery>2022-09-14</discovery>
 <entry>2022-09-14</entry>
 </dates>
 </vuln>

<vuln vid="4ebaa983-3299-11ed-95f8-901b0e9408dc">
 <topic>dendrite -- Signature checks not applied to some retrieved missing events</topic>
 <affects>
 <package>
	<name>dendrite</name>
	<range><lt>0.9.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dendrite team reports:
	<blockquote cite="https://github.com/matrix-org/dendrite/security/advisories/GHSA-pfw4-xjgm-267c">
	 Events retrieved from a remote homeserver using /get_missing_events did
	 not have their signatures verified correctly. This could potentially allow
	 a remote homeserver to provide invalid/modified events to Dendrite via this
	 endpoint.
	 Note that this does not apply to events retrieved through other endpoints
	 (e.g. /event, /state) as they have been correctly verified.
	 Homeservers that have federation disabled are not vulnerable.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/matrix-org/dendrite/security/advisories/GHSA-pfw4-xjgm-267c</url>
 </references>
 <dates>
 <discovery>2022-09-12</discovery>
 <entry>2022-09-12</entry>
 </dates>
 </vuln>

<vuln vid="f75722ce-31b0-11ed-8b56-0800277bb8a8">
 <topic>gitea -- multiple issues</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.17.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/20869">
	 Double check CloneURL is acceptable
	</blockquote>
	<blockquote cite="https://github.com/go-gitea/gitea/pull/21011">
	 Add more checks in migration code
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.io/2022/09/gitea-1.17.2-is-released/</url>
 </references>
 <dates>
 <discovery>2022-08-19</discovery>
 <entry>2022-09-11</entry>
 </dates>
 </vuln>

<vuln vid="80e057e7-2f0a-11ed-978f-fcaa147e860e">
 <topic>Python -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python37</name>
	<range><lt>3.7.14</lt></range>
 </package>
 <package>
	<name>python38</name>
	<range><lt>3.8.14</lt></range>
 </package>
 <package>
	<name>python39</name>
	<range><lt>3.9.14</lt></range>
 </package>
 <package>
	<name>python310</name>
	<range><lt>3.10.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python reports:
	<blockquote cite="https://docs.python.org/release/3.7.14/whatsnew/changelog.html#changelog">
	 gh-95778: Converting between int and str in bases other than 2 (binary), 4, 8 (octal),
	 16 (hexadecimal), or 32 such as base 10 (decimal) now raises a ValueError if the number
	 of digits in string form is above a limit to avoid potential denial of service attacks
	 due to the algorithmic complexity.
	 gh-87389: http.server: Fix an open redirection vulnerability in the HTTP server when
	 an URI path starts with //. Vulnerability discovered, and initial fix proposed, by
	 Hamza Avvan.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-10735</cvename>
 <url>https://docs.python.org/release/3.7.14/whatsnew/changelog.html#changelog</url>
 </references>
 <dates>
 <discovery>2020-03-20</discovery>
 <entry>2022-09-08</entry>
 </dates>
 </vuln>

<vuln vid="6fea7103-2ea4-11ed-b403-3dae8ac60d3e">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go118</name>
	<range><lt>1.18.6</lt></range>
 </package>
 <package>
	<name>go119</name>
	<range><lt>1.19.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/54658">
	 net/http: handle server errors after sending GOAWAY
	 A closing HTTP/2 server connection could hang forever
	 waiting for a clean shutdown that was preempted by a
	 subsequent fatal error. This failure mode could be
	 exploited to cause a denial of service.
	</blockquote>
	<blockquote cite="https://go.dev/issue/54385">
	 net/url: JoinPath does not strip relative path components
	 in all circumstances
	 JoinPath and URL.JoinPath would not remove ../ path
	 components appended to a relative path.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-27664</cvename>
 <cvename>CVE-2022-32190</cvename>
 <url>https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ</url>
 </references>
 <dates>
 <discovery>2022-09-06</discovery>
 <entry>2022-09-07</entry>
 </dates>
 </vuln>

<vuln vid="f38d25ac-2b7a-11ed-a1ef-3065ec8fd3ec">
 <topic>chromium -- insufficient data validation in Mojo</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>105.0.5195.102</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html">
	 This release contains 1 security fix:
	 <ul>
	 <li>[1358134] High CVE-2022-3075: Insufficient data validation in Mojo. Reported by Anonymous on 2022-08-30</li>
	 </ul>
	 Google is aware that an exploit of CVE-2022-3075 exists in the wild.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3075</cvename>
 <url>https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2022-09-02</discovery>
 <entry>2022-09-03</entry>
 </dates>
 </vuln>

<vuln vid="5418b360-29cc-11ed-a6d4-6805ca2fa271">
 <topic>powerdns-recursor -- denial of service</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><lt>4.7.2</lt></range>
	<range><lt>4.6.3</lt></range>
	<range><lt>4.5.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://www.powerdns.com/news.html#20220823">
	 PowerDNS Security Advisory 2022-02: incomplete exception handling related to protobuf message generation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-37428</cvename>
 <url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-02.html</url>
 </references>
 <dates>
 <discovery>2022-08-23</discovery>
 <entry>2022-09-01</entry>
 </dates>
 </vuln>

<vuln vid="827b95ff-290e-11ed-a2e7-6c3be5272acd">
 <topic>Grafana -- Unauthorized file disclosure</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>5.2.0</ge><lt>8.3.11</lt></range>
	<range><ge>8.4.0</ge><lt>8.4.11</lt></range>
	<range><ge>8.5.0</ge><lt>8.5.11</lt></range>
	<range><ge>9.0.0</ge><lt>9.0.8</lt></range>
	<range><ge>9.1.0</ge><lt>9.1.2</lt></range>
 </package>
 <package>
	<name>grafana7</name>
	<range><ge>7.0</ge></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.3.0</ge><lt>8.3.11</lt></range>
	<range><ge>8.4.0</ge><lt>8.4.11</lt></range>
	<range><ge>8.5.0</ge><lt>8.5.11</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><ge>9.0.0</ge><lt>9.0.8</lt></range>
	<range><ge>9.1.0</ge><lt>9.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2022/08/30/security-release-new-versions-of-grafana-and-grafana-image-renderer-with-a-high-severity-security-fix-for-cve-2022-31176/">
	 On July 21, an internal security review identified an unauthorized file disclosure vulnerability in the <a href="https://grafana.com/grafana/plugins/grafana-image-renderer/">Grafana Image Renderer plugin</a> when HTTP remote rendering is used. The Chromium browser embedded in the Grafana Image Renderer allows for “printing” of unauthorized files in a PNG file. This makes it possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake data source (this applies if the user has admin permissions in Grafana).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-31176</cvename>
 <url>https://github.com/grafana/grafana-image-renderer/security/advisories/GHSA-2cfh-233g-m4c5</url>
 </references>
 <dates>
 <discovery>2022-07-21</discovery>
 <entry>2022-09-01</entry>
 </dates>
 </vuln>

<vuln vid="e4d93d07-297a-11ed-95f8-901b0e9408dc">
 <topic>Matrix clients -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>cinny</name>
	<range><lt>2.1.3</lt></range>
 </package>
 <package>
	<name>element-web</name>
	<range><lt>1.11.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://matrix.org/blog/2022/08/31/security-releases-matrix-js-sdk-19-4-0-and-matrix-react-sdk-3-53-0">
	 The vulnerabilities give an adversary who you share a
	 room with the ability to carry out a denial-of-service
	 attack against the affected clients, making it not show all
	 of a user's rooms or spaces and/or causing minor temporary
	 corruption.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-36059</cvename>
 <cvename>CVE-2022-36060</cvename>
 <url>https://matrix.org/blog/2022/08/31/security-releases-matrix-js-sdk-19-4-0-and-matrix-react-sdk-3-53-0</url>
 </references>
 <dates>
 <discovery>2022-08-31</discovery>
 <entry>2022-08-31</entry>
 </dates>
 </vuln>

<vuln vid="f2043ff6-2916-11ed-a1ef-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>105.0.5195.52</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html">
	 This release contains 24 security fixes, including:
	 <ul>
	 <li>[1340253] Critical CVE-2022-3038: Use after free in Network Service. Reported by Sergei Glazunov of Google Project Zero on 2022-06-28</li>
	 <li>[1343348] High CVE-2022-3039: Use after free in WebSQL. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute on 2022-07-11</li>
	 <li>[1341539] High CVE-2022-3040: Use after free in Layout. Reported by Anonymous on 2022-07-03</li>
	 <li>[1345947] High CVE-2022-3041: Use after free in WebSQL. Reported by Ziling Chen and Nan Wang(@eternalsakura13) of 360 Vulnerability Research Institute on 2022-07-20</li>
	 <li>[1338553] High CVE-2022-3042: Use after free in PhoneHub. Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2022-06-22</li>
	 <li>[1336979] High CVE-2022-3043: Heap buffer overflow in Screen Capture. Reported by @ginggilBesel on 2022-06-16</li>
	 <li>[1051198] High CVE-2022-3044: Inappropriate implementation in Site Isolation. Reported by Lucas Pinheiro, Microsoft Browser Vulnerability Research on 2020-02-12</li>
	 <li>[1339648] High CVE-2022-3045: Insufficient validation of untrusted input in V8. Reported by Ben Noordhuis &lt;info@bnoordhuis.nl&gt; on 2022-06-26</li>
	 <li>[1346245] High CVE-2022-3046: Use after free in Browser Tag. Reported by Rong Jian of VRI on 2022-07-21</li>
	 <li>[1342586] Medium CVE-2022-3047: Insufficient policy enforcement in Extensions API. Reported by Maurice Dauer on 2022-07-07</li>
	 <li>[1303308] Medium CVE-2022-3048: Inappropriate implementation in Chrome OS lockscreen. Reported by Andr.Ess on 2022-03-06</li>
	 <li>[1316892] Medium CVE-2022-3049: Use after free in SplitScreen. Reported by @ginggilBesel on 2022-04-17</li>
	 <li>[1337132] Medium CVE-2022-3050: Heap buffer overflow in WebUI. Reported by Zhihua Yao of KunLun Lab on 2022-06-17</li>
	 <li>[1345245] Medium CVE-2022-3051: Heap buffer overflow in Exosphere. Reported by @ginggilBesel on 2022-07-18</li>
	 <li>[1346154] Medium CVE-2022-3052: Heap buffer overflow in Window Manager. Reported by Khalil Zhani on 2022-07-21</li>
	 <li>[1267867] Medium CVE-2022-3053: Inappropriate implementation in Pointer Lock. Reported by Jesper van den Ende (Pelican Party Studios) on 2021-11-08</li>
	 <li>[1290236] Medium CVE-2022-3054: Insufficient policy enforcement in DevTools. Reported by Kuilin Li on 2022-01-24</li>
	 <li>[1351969] Medium CVE-2022-3055: Use after free in Passwords. Reported by Weipeng Jiang (@Krace) and Guang Gong of 360 Vulnerability Research Institute on 2022-08-11</li>
	 <li>[1329460] Low CVE-2022-3056: Insufficient policy enforcement in Content Security Policy. Reported by Anonymous on 2022-05-26</li>
	 <li>[1336904] Low CVE-2022-3057: Inappropriate implementation in iframe Sandbox. Reported by Gareth Heyes on 2022-06-16</li>
	 <li>[1337676] Low CVE-2022-3058: Use after free in Sign-In Flow. Reported by raven at KunLun lab on 2022-06-20</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-3038</cvename>
 <cvename>CVE-2022-3039</cvename>
 <cvename>CVE-2022-3040</cvename>
 <cvename>CVE-2022-3041</cvename>
 <cvename>CVE-2022-3042</cvename>
 <cvename>CVE-2022-3043</cvename>
 <cvename>CVE-2022-3044</cvename>
 <cvename>CVE-2022-3045</cvename>
 <cvename>CVE-2022-3046</cvename>
 <cvename>CVE-2022-3047</cvename>
 <cvename>CVE-2022-3048</cvename>
 <cvename>CVE-2022-3049</cvename>
 <cvename>CVE-2022-3050</cvename>
 <cvename>CVE-2022-3051</cvename>
 <cvename>CVE-2022-3052</cvename>
 <cvename>CVE-2022-3053</cvename>
 <cvename>CVE-2022-3054</cvename>
 <cvename>CVE-2022-3055</cvename>
 <cvename>CVE-2022-3056</cvename>
 <cvename>CVE-2022-3057</cvename>
 <cvename>CVE-2022-3058</cvename>
 <url>https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html</url>
 </references>
 <dates>
 <discovery>2022-08-30</discovery>
 <entry>2022-08-31</entry>
 </dates>
 </vuln>

<vuln vid="a1323a76-28f1-11ed-a72a-002590c1f29c">
 <topic>FreeBSD -- zlib heap buffer overflow</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.1</ge><lt>13.1_2</lt></range>
	<range><ge>13.0</ge><lt>13.0_13</lt></range>
	<range><ge>12.3</ge><lt>12.3_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	zlib through 1.2.12 has a heap-based buffer over-read or buffer
	overflow in inflate in inflate.c via a large gzip header extra
	field.
	<h1>Impact:</h1>
	Applications that call inflateGetHeader may be vulnerable to a
	buffer overflow. Note that inflateGetHeader is not used by anything
	in the FreeBSD base system, but may be used by third party
	software.
 </body>
 </description>
 <references>
 <cvename>CVE-2022-37434</cvename>
 <freebsdsa>SA-22:13.zlib</freebsdsa>
 </references>
 <dates>
 <discovery>2022-08-30</discovery>
 <entry>2022-08-31</entry>
 </dates>
 </vuln>

<vuln vid="e6b994e2-2891-11ed-9be7-454b1dd82c64">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>15.3.0</ge><lt>15.3.2</lt></range>
	<range><ge>15.2.0</ge><lt>15.2.4</lt></range>
	<range><ge>10.0.0</ge><lt>15.1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2022/08/30/critical-security-release-gitlab-15-3-2-released/">
	 Remote Command Execution via GitHub import
	 Stored XSS via labels color
	 Content injection via Incidents Timeline description
	 Lack of length validation in Snippets leads to Denial of Service
	 Group IP allow-list not fully respected by the Package Registry
	 Abusing Gitaly.GetTreeEntries calls leads to denial of service
	 Arbitrary HTTP Requests Possible in .ipynb Notebook with Malicious Form Tags
	 Regular Expression Denial of Service via special crafted input
	 Information Disclosure via Arbitrary GFM references rendered in Incident Timeline Events
	 Regex backtracking through the Commit message field
	 Read repository content via LivePreview feature
	 Denial of Service via the Create branch API
	 Denial of Service via Issue preview
	 IDOR in Zentao integration leaked issue details
	 Brute force attack may guess a password even when 2FA is enabled
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2992</cvename>
 <cvename>CVE-2022-2865</cvename>
 <cvename>CVE-2022-2527</cvename>
 <cvename>CVE-2022-2592</cvename>
 <cvename>CVE-2022-2533</cvename>
 <cvename>CVE-2022-2455</cvename>
 <cvename>CVE-2022-2428</cvename>
 <cvename>CVE-2022-2908</cvename>
 <cvename>CVE-2022-2630</cvename>
 <cvename>CVE-2022-2931</cvename>
 <cvename>CVE-2022-2907</cvename>
 <cvename>CVE-2022-3031</cvename>
 <url>https://about.gitlab.com/releases/2022/08/30/critical-security-release-gitlab-15-3-2-released/</url>
 </references>
 <dates>
 <discovery>2022-08-30</discovery>
 <entry>2022-08-30</entry>
 </dates>
 </vuln>

<vuln vid="3110b29e-c82d-4287-9f6c-db82bb883b1e">
 <topic>zeek -- potential DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>5.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.1">
	 Fix a possible overflow and crash in the ARP analyzer
	when receiving a specially crafted packet. Due to the
	possibility of this happening with packets received from
	the network, this is a potential DoS vulnerability. 
	 Fix a possible overflow and crash in the Modbus analyzer
	when receiving a specially crafted packet. Due to the
	possibility of this happening with packets received from
	the network, this is a potential DoS vulnerability. 
	 Fix two possible crashes when converting IP headers for
	output via the raw_packet event. Due to the possibility of
	this happening with packets received from the network, this
	is a potential DoS vulnerability. Note that the raw_packet
	event is not enabled by default so these are likely
	low-severity issues. 
	 Fix an abort related to an error related to the ordering
	of record fields when processing DNS EDNS headers via events.
	Due to the possibility of this happening with packets
	received from the network, this is a potential DoS
	vulnerability. Note that the dns_EDNS events are not
	implemented by default so this is likely a low-severity
	issue. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v5.0.1</url>
 </references>
 <dates>
 <discovery>2022-08-23</discovery>
 <entry>2022-08-26</entry>
 </dates>
 </vuln>

<vuln vid="36d10af7-248d-11ed-856e-d4c9ef517024">
 <topic>MariaDB -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.36</lt></range>
 </package>
 <package>
	<name>mariadb104-server</name>
	<range><lt>10.4.26</lt></range>
 </package>
 <package>
	<name>mariadb105-server</name>
	<range><lt>10.5.17</lt></range>
 </package>
 <package>
	<name>mariadb106-server</name>
	<range><lt>10.6.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MariaDB project reports:
	<blockquote cite="https://mariadb.com/kb/en/cve/">
	 Multiple vulnerabilities, mostly segfaults, in
	 the server component
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-32082</cvename>
 <cvename>CVE-2022-32089</cvename>
 <cvename>CVE-2022-32081</cvename>
 <cvename>CVE-2018-25032</cvename>
 <cvename>CVE-2022-32091</cvename>
 <cvename>CVE-2022-32084</cvename>
 <url>https://mariadb.com/kb/en/cve/</url>
 </references>
 <dates>
 <discovery>2022-08-22</discovery>
 <entry>2022-08-25</entry>
 </dates>
 </vuln>

<vuln vid="8a0cd618-22a0-11ed-b1e7-001b217b3468">
 <topic>Gitlab -- Remote Code Execution</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>15.3.0</ge><lt>15.3.1</lt></range>
	<range><ge>15.2.0</ge><lt>15.2.3</lt></range>
	<range><ge>11.3.4</ge><lt>15.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitlab-15-3-1-released/">
	 Remote Command Execution via Github import
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2884</cvename>
 <url>https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitlab-15-3-1-released/</url>
 </references>
 <dates>
 <discovery>2022-08-22</discovery>
 <entry>2022-08-23</entry>
 </dates>
 </vuln>

<vuln vid="03bb8373-2026-11ed-9d70-080027240888">
 <topic>drupal9 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal9</name>
	<range><lt>9.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal reports:
	<blockquote cite="https://www.drupal.org/project/drupal/releases/9.4.5">
	 CVE-2022-31175: Cross-site scripting (XSS) caused by the editor
	 instance destroying process.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-31175</cvename>
 <url>https://www.drupal.org/project/drupal/releases/9.4.5</url>
 </references>
 <dates>
 <discovery>2022-08-01</discovery>
 <entry>2022-08-20</entry>
 </dates>
 </vuln>

<vuln vid="f12368a8-1e05-11ed-a1ef-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>104.0.5112.101</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html">
	 This release contains 11 security fixes, including:
	 <ul>
	 <li>[1349322] Critical CVE-2022-2852: Use after free in FedCM. Reported by Sergei Glazunov of Google Project Zero on 2022-08-02</li>
	 <li>[1337538] High CVE-2022-2854: Use after free in SwiftShader. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2022-06-18</li>
	 <li>[1345042] High CVE-2022-2855: Use after free in ANGLE. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2022-07-16</li>
	 <li>[1338135] High CVE-2022-2857: Use after free in Blink. Reported by Anonymous on 2022-06-21</li>
	 <li>[1341918] High CVE-2022-2858: Use after free in Sign-In Flow. Reported by raven at KunLun lab on 2022-07-05</li>
	 <li>[1350097] High CVE-2022-2853: Heap buffer overflow in Downloads. Reported by Sergei Glazunov of Google Project Zero on 2022-08-04</li>
	 <li>[1345630] High CVE-2022-2856: Insufficient validation of untrusted input in Intents. Reported by Ashley Shen and Christian Resell of Google Threat Analysis Group on 2022-07-19</li>
	 <li>[1338412] Medium CVE-2022-2859: Use after free in Chrome OS Shell. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-06-22</li>
	 <li>[1345193] Medium CVE-2022-2860: Insufficient policy enforcement in Cookies. Reported by Axel Chong on 2022-07-18</li>
	 <li>[1346236] Medium CVE-2022-2861: Inappropriate implementation in Extensions API. Reported by Rong Jian of VRI on 2022-07-21</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2852</cvename>
 <cvename>CVE-2022-2853</cvename>
 <cvename>CVE-2022-2854</cvename>
 <cvename>CVE-2022-2855</cvename>
 <cvename>CVE-2022-2856</cvename>
 <cvename>CVE-2022-2857</cvename>
 <cvename>CVE-2022-2858</cvename>
 <cvename>CVE-2022-2859</cvename>
 <cvename>CVE-2022-2860</cvename>
 <cvename>CVE-2022-2861</cvename>
 <url>https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html</url>
 </references>
 <dates>
 <discovery>2022-08-16</discovery>
 <entry>2022-08-17</entry>
 </dates>
 </vuln>

<vuln vid="d658042c-1c98-11ed-95f8-901b0e9408dc">
 <topic>dendrite -- Incorrect parsing of the event default power level in event auth</topic>
 <affects>
 <package>
	<name>dendrite</name>
	<range><lt>0.9.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dendrite team reports:
	<blockquote cite="https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-grvv-h2f9-7v9c">
	 The power level parsing within gomatrixserverlib was failing to parse the "events_default"
	 key of the m.room.power_levels event, defaulting the event default power level to zero in all cases.
	 In rooms where the "events_default" power level had been changed, this could result in
	 events either being incorrectly authorised or rejected by Dendrite servers.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-36009</cvename>
 <url>https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-grvv-h2f9-7v9c</url>
 </references>
 <dates>
 <discovery>2022-08-15</discovery>
 <entry>2022-08-15</entry>
 <modified>2022-08-25</modified>
 </dates>
 </vuln>

<vuln vid="e2e7faf9-1b51-11ed-ae46-002b67dfc673">
 <topic>Tomcat -- XSS in examples web application</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><ge>8.5.50</ge><lt>8.5.81</lt></range>
	<range><ge>9.0.30</ge><lt>9.0.64</lt></range>
	<range><ge>10.0.0-M1</ge><lt>10.0.22</lt></range>
	<range><ge>10.1.0-M1</ge><lt>10.1.0-M16</lt></range>
 </package>
 <package>
	<name>tomcat85</name>
	<range><ge>8.5.50</ge><lt>8.5.81</lt></range>
 </package>
 <package>
	<name>tomcat9</name>
	<range><ge>9.0.30</ge><lt>9.0.64</lt></range>
 </package>
 <package>
	<name>tomcat10</name>
	<range><ge>10.0.0-M1</ge><lt>10.0.22</lt></range>
 </package>
 <package>
	<name>tomcat-devel</name>
	<range><ge>10.1.0-M1</ge><lt>10.1.0-M16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache Tomcat reports:
	<blockquote cite="https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k">
	 The Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-34305</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34305</url>
 </references>
 <dates>
 <discovery>2022-06-22</discovery>
 <entry>2022-08-14</entry>
 </dates>
 </vuln>

<vuln vid="75c073cc-1a1d-11ed-bea0-48ee0c739857">
 <topic>XFCE tumbler -- Vulnerability in the GStreamer plugin</topic>
 <affects>
 <package>
	<name>xfce4-tumbler</name>
	<range><lt>4.16.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The XFCE project reports:
	<blockquote cite="https://mail.xfce.org/pipermail/xfce-announce/2022-August/001133.html">
	 Added mime type check to the gst-thumbnailer plugin
	 to fix an undisclosed vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mail.xfce.org/pipermail/xfce-announce/2022-August/001133.html</url>
 <url>https://gitlab.xfce.org/xfce/tumbler/-/commit/a0fc191e8ab41fe579f3333085d649fdacb2daa5</url>
 </references>
 <dates>
 <discovery>2022-08-02</discovery>
 <entry>2022-08-12</entry>
 </dates>
 </vuln>

<vuln vid="c3610f39-18f1-11ed-9854-641c67a117d8">
 <topic>varnish -- Denial of Service Vulnerability</topic>
 <affects>
 <package>
	<name>varnish7</name>
	<range><lt>7.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Varnish Cache Project reports:
	<blockquote cite="https://varnish-cache.org/security/VSV00009.html">
	A denial of service attack can be performed against Varnish Cache
	 servers by specially formatting the reason phrase of the backend response
	 status line. In order to execute an attack, the attacker would have to
	 be able to influence the HTTP/1 responses that the Varnish Server
	 receives from its configured backends. A successful attack would cause
	 the Varnish Server to assert and automatically restart.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://varnish-cache.org/security/VSV00009.html</url>
 </references>
 <dates>
 <discovery>2022-08-09</discovery>
 <entry>2022-08-10</entry>
 </dates>
 </vuln>

<vuln vid="8eaaf135-1893-11ed-9b22-002590c1f29c">
 <topic>FreeBSD -- Missing bounds check in 9p message handling</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.1</ge><lt>13.1_1</lt></range>
	<range><ge>13.0</ge><lt>13.0_12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The implementation of lib9p's handling of RWALK messages was
	missing a bounds check needed when unpacking the message contents.
	The missing check means that the receipt of a specially crafted
	message will cause lib9p to overwrite unrelated memory.
	<h1>Impact:</h1>
	The bug can be triggered by a malicious bhyve guest kernel to
	overwrite memory in the bhyve(8) process. This could potentially lead
	to user-mode code execution on the host, subject to bhyve's Capsicum
	sandbox.
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23092</cvename>
 <freebsdsa>SA-22:12.lib9p</freebsdsa>
 </references>
 <dates>
 <discovery>2022-08-09</discovery>
 <entry>2022-08-10</entry>
 </dates>
 </vuln>

<vuln vid="02fb9764-1893-11ed-9b22-002590c1f29c">
 <topic>FreeBSD -- Memory disclosure by stale virtual memory mapping</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.1</ge><lt>13.1_1</lt></range>
	<range><ge>13.0</ge><lt>13.0_12</lt></range>
	<range><ge>12.3</ge><lt>12.3_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A particular case of memory sharing is mishandled in the virtual
	memory system. This is very similar to SA-21:08.vm, but with a
	different root cause.
	<h1>Impact:</h1>
	An unprivileged local user process can maintain a mapping of a page
	after it is freed, allowing that process to read private data
	belonging to other processes or the kernel.
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23091</cvename>
 <freebsdsa>SA-22:11.vm</freebsdsa>
 </references>
 <dates>
 <discovery>2022-08-09</discovery>
 <entry>2022-08-10</entry>
 </dates>
 </vuln>

<vuln vid="5ddbe47b-1891-11ed-9b22-002590c1f29c">
 <topic>FreeBSD -- AIO credential reference count leak</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.0</ge><lt>13.0_12</lt></range>
	<range><ge>12.3</ge><lt>12.3_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The aio_aqueue function, used by the lio_listio system call, fails
	to release a reference to a credential in an error case.
	<h1>Impact:</h1>
	An attacker may cause the reference count to overflow, leading to a
	use after free (UAF).
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23090</cvename>
 <freebsdsa>SA-22:10.aio</freebsdsa>
 </references>
 <dates>
 <discovery>2022-08-09</discovery>
 <entry>2022-08-10</entry>
 <modified>2022-08-10</modified>
 </dates>
 </vuln>

<vuln vid="5028c1ae-1890-11ed-9b22-002590c1f29c">
 <topic>FreeBSD -- Out of bound read in elf_note_prpsinfo()</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.1</ge><lt>13.1_1</lt></range>
	<range><ge>13.0</ge><lt>13.0_12</lt></range>
	<range><ge>12.3</ge><lt>12.3_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When dumping core and saving process information, proc_getargv()
	might return an sbuf which have a sbuf_len() of 0 or -1, which is not
	properly handled.
	<h1>Impact:</h1>
	An out-of-bound read can happen when user constructs a specially
	crafted ps_string, which in turn can cause the kernel to crash.
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23089</cvename>
 <freebsdsa>SA-22:09.elf</freebsdsa>
 </references>
 <dates>
 <discovery>2022-08-09</discovery>
 <entry>2022-08-10</entry>
 </dates>
 </vuln>

<vuln vid="21f43976-1887-11ed-9911-40b034429ecf">
 <topic>rsync -- client-side arbitrary file write vulnerability</topic>
 <affects>
 <package>
	<name>rsync</name>
	<range><lt>3.2.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Openwall oss-security reports:
	<blockquote cite="https://www.openwall.com/lists/oss-security/2022/08/02/1">
	 We have discovered a critical arbitrary file write vulnerability
	 in the rsync utility that allows malicious remote servers to write
	 arbitrary files inside the directories of connecting peers.
	 The server chooses which files/directories are sent to the client.
	 Due to the insufficient controls inside the do_server_recv function
	 a malicious rysnc server (or Man-in-The-Middle attacker) can
	 overwrite arbitrary files in the rsync client target directory and
	 subdirectories.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-29154</cvename>
 <url>https://www.openwall.com/lists/oss-security/2022/08/02/1</url>
 </references>
 <dates>
 <discovery>2022-08-02</discovery>
 <entry>2022-08-10</entry>
 </dates>
 </vuln>

<vuln vid="1cd0c17a-17c0-11ed-91a5-080027f5fec9">
 <topic>gnutls -- double free vulnerability</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><ge>3.6.0</ge><lt>3.7.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GnuTLS project reports:
	<blockquote cite="https://www.gnutls.org/security-new.html#GNUTLS-SA-2022-07-07">
	 
	 When gnutls_pkcs7_verify cannot verify signature against
	 given trust list, it starts creating a chain of
	 certificates starting from identified signer up to known
	 root. During the creation of this chain the signer
	 certificate gets freed which results in double free when
	 the same signer certificate is freed at the end of the
	 algorithm.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2509</cvename>
 <url>https://www.gnutls.org/security-new.html#GNUTLS-SA-2022-07-07</url>
 </references>
 <dates>
 <discovery>2022-07-07</discovery>
 <entry>2022-08-09</entry>
 </dates>
 </vuln>

<vuln vid="9b9a5f6e-1755-11ed-adef-589cfc01894a">
 <topic>wolfssl -- multiple issues</topic>
 <affects>
 <package>
	<name>wolfssl</name>
	<range><lt>5.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wolfSSL blog reports:
	<blockquote cite="https://www.wolfssl.com/wolfssl-5-4-0-release/">
	 In release 5.4.0 there were 3 vulnerabilities listed as
	 fixed in wolfSSL. Two relatively new reports, one dealing with a DTLS
	 1.0/1.2 denial of service attack and the other a ciphertext attack on
	 ECC/DH operations. The last vulnerability listed was a public
	 disclosure of a previous attack on AMD devices fixed since wolfSSL
	 version 5.1.0. Coordination of the disclosure of the attack was done
	 responsibly, in cooperation with the researchers, waiting for the
	 public release of the attack details since it affects multiple
	 security libraries.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-34293</cvename>
 <cvename>CVE-2020-12966</cvename>
 <cvename>CVE-2021-46744</cvename>
 <url>https://github.com/wolfSSL/wolfssl/releases/tag/v5.4.0-stable</url>
 <url>https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1013</url>
 <url>https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1033</url>
 </references>
 <dates>
 <discovery>2022-07-11</discovery>
 <entry>2022-08-08</entry>
 </dates>
 </vuln>

<vuln vid="8bec3994-104d-11ed-a7ac-0800273f11ea">
 <topic>gitea -- multiple issues</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.17.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/20114">
	 Use git.HOME_PATH for Git HOME directory
	</blockquote>
	<blockquote cite="https://github.com/go-gitea/gitea/pull/20332">
	 Add write check for creating Commit status
	</blockquote>
	<blockquote cite="https://github.com/go-gitea/gitea/pull/18697">
	 Remove deprecated SSH ciphers from default
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.17.0</url>
 </references>
 <dates>
 <discovery>2022-07-12</discovery>
 <entry>2022-08-05</entry>
 </dates>
 </vuln>

<vuln vid="bc43a578-14ec-11ed-856e-d4c9ef517024">
 <topic>Unbound -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>unbound</name>
	<range><lt>1.16.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NLnet Labs reports:
	<blockquote cite="https://www.nlnetlabs.nl/projects/unbound/security-advisories/">
	 novel type of the "ghost domain names" attack. The vulnerability
	 works by targeting an Unbound instance. Unbound is queried for a
	 rogue domain name when the cached delegation information is about to
	 expire. The rogue nameserver delays the response so that the cached
	 delegation information is expired. Upon receiving the delayed answer
	 containing the delegation information, Unbound overwrites the now
	 expired entries. This action can be repeated when the delegation
	 information is about to expire making the rogue delegation
	 information ever-updating.
	 novel type of the "ghost domain names" attack. The vulnerability
	 works by targeting an Unbound instance. Unbound is queried for a
	 subdomain of a rogue domain name. The rogue nameserver returns
	 delegation information for the subdomain that updates Unbound's
	 delegation cache. This action can be repeated before expiry of the
	 delegation information by querying Unbound for a second level
	 subdomain which the rogue nameserver provides new delegation
	 information.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-30699</cvename>
 <cvename>CVE-2022-30698</cvename>
 <url>https://www.nlnetlabs.nl/projects/unbound/security-advisories/</url>
 </references>
 <dates>
 <discovery>2022-08-01</discovery>
 <entry>2022-08-05</entry>
 </dates>
 </vuln>

<vuln vid="df29c391-1046-11ed-a7ac-0800273f11ea">
 <topic>gitea -- multiple issues</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.16.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/20334">
	 Add write check for creating Commit status
	</blockquote>
	<blockquote cite="https://github.com/go-gitea/gitea/pull/20196">
	 Check for permission when fetching user controlled issues
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.16.9</url>
 </references>
 <dates>
 <discovery>2022-07-12</discovery>
 <entry>2022-08-05</entry>
 </dates>
 </vuln>

<vuln vid="3b47104f-1461-11ed-a0c5-080027240888">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py38-django32</name>
	<name>py39-django32</name>
	<name>py310-django32</name>
	<range><lt>3.2.15</lt></range>
 </package>
 <package>
	<name>py38-django40</name>
	<name>py39-django40</name>
	<name>py310-django40</name>
	<range><lt>4.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2022/aug/03/security-releases/">
	 CVE-2022-36359: Potential reflected file download vulnerability in FileResponse.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-36359</cvename>
 <url>https://www.djangoproject.com/weblog/2022/aug/03/security-releases/</url>
 </references>
 <dates>
 <discovery>2022-08-01</discovery>
 <entry>2022-08-05</entry>
 </dates>
 </vuln>

<vuln vid="96a41723-133a-11ed-be3b-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>104.0.5112.79</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html">
	 This release contains 27 security fixes, including:
	 <ul>
	 <li>[1325699] High CVE-2022-2603: Use after free in Omnibox. Reported by Anonymous on 2022-05-16</li>
	 <li>[1335316] High CVE-2022-2604: Use after free in Safe Browsing. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-06-10</li>
	 <li>[1338470] High CVE-2022-2605: Out of bounds read in Dawn. Reported by Looben Yang on 2022-06-22</li>
	 <li>[1330489] High CVE-2022-2606: Use after free in Managed devices API. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-05-31</li>
	 <li>[1286203] High CVE-2022-2607: Use after free in Tab Strip. Reported by @ginggilBesel on 2022-01-11</li>
	 <li>[1330775] High CVE-2022-2608: Use after free in Overview Mode. Reported by Khalil Zhani on 2022-06-01</li>
	 <li>[1338560] High CVE-2022-2609: Use after free in Nearby Share. Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2022-06-22</li>
	 <li>[1278255] Medium CVE-2022-2610: Insufficient policy enforcement in Background Fetch. Reported by Maurice Dauer on 2021-12-09</li>
	 <li>[1320538] Medium CVE-2022-2611: Inappropriate implementation in Fullscreen API. Reported by Irvan Kurniawan (sourc7) on 2022-04-28</li>
	 <li>[1321350] Medium CVE-2022-2612: Side-channel information leakage in Keyboard input. Reported by Erik Kraft (erik.kraft5@gmx.at), Martin Schwarzl (martin.schwarzl@iaik.tugraz.at) on 2022-04-30</li>
	 <li>[1325256] Medium CVE-2022-2613: Use after free in Input. Reported by Piotr Tworek (Vewd) on 2022-05-13</li>
	 <li>[1341907] Medium CVE-2022-2614: Use after free in Sign-In Flow. Reported by raven at KunLun lab on 2022-07-05</li>
	 <li>[1268580] Medium CVE-2022-2615: Insufficient policy enforcement in Cookies. Reported by Maurice Dauer on 2021-11-10</li>
	 <li>[1302159] Medium CVE-2022-2616: Inappropriate implementation in Extensions API. Reported by Alesandro Ortiz on 2022-03-02</li>
	 <li>[1292451] Medium CVE-2022-2617: Use after free in Extensions API. Reported by @ginggilBesel on 2022-01-31</li>
	 <li>[1308422] Medium CVE-2022-2618: Insufficient validation of untrusted input in Internals. Reported by asnine on 2022-03-21</li>
	 <li>[1332881] Medium CVE-2022-2619: Insufficient validation of untrusted input in Settings. Reported by Oliver Dunk on 2022-06-04</li>
	 <li>[1337304] Medium CVE-2022-2620: Use after free in WebUI. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-06-17</li>
	 <li>[1323449] Medium CVE-2022-2621: Use after free in Extensions. Reported by Huyna at Viettel Cyber Security on 2022-05-07</li>
	 <li>[1332392] Medium CVE-2022-2622: Insufficient validation of untrusted input in Safe Browsing. Reported by Imre Rad (@ImreRad) and @j00sean on 2022-06-03</li>
	 <li>[1337798] Medium CVE-2022-2623: Use after free in Offline. Reported by raven at KunLun lab on 2022-06-20</li>
	 <li>[1339745] Medium CVE-2022-2624: Heap buffer overflow in PDF. Reported by YU-CHANG CHEN and CHIH-YEN CHANG, working with DEVCORE Internship Program on 2022-06-27</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2603</cvename>
 <cvename>CVE-2022-2604</cvename>
 <cvename>CVE-2022-2605</cvename>
 <cvename>CVE-2022-2606</cvename>
 <cvename>CVE-2022-2607</cvename>
 <cvename>CVE-2022-2608</cvename>
 <cvename>CVE-2022-2609</cvename>
 <cvename>CVE-2022-2610</cvename>
 <cvename>CVE-2022-2611</cvename>
 <cvename>CVE-2022-2612</cvename>
 <cvename>CVE-2022-2613</cvename>
 <cvename>CVE-2022-2614</cvename>
 <cvename>CVE-2022-2615</cvename>
 <cvename>CVE-2022-2616</cvename>
 <cvename>CVE-2022-2617</cvename>
 <cvename>CVE-2022-2618</cvename>
 <cvename>CVE-2022-2619</cvename>
 <cvename>CVE-2022-2620</cvename>
 <cvename>CVE-2022-2621</cvename>
 <cvename>CVE-2022-2622</cvename>
 <cvename>CVE-2022-2623</cvename>
 <cvename>CVE-2022-2624</cvename>
 <url>https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2022-08-02</discovery>
 <entry>2022-08-03</entry>
 </dates>
 </vuln>

<vuln vid="7f8d5435-125a-11ed-9a69-10c37b4ac2ea">
 <topic>go -- decoding big.Float and big.Rat can panic</topic>
 <affects>
 <package>
	<name>go118</name>
	<range><lt>1.18.5</lt></range>
 </package>
 <package>
	<name>go117</name>
	<range><lt>1.17.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/53871">
	 encoding/gob &amp; math/big: decoding big.Float and
	 big.Rat can panic
	 Decoding big.Float and big.Rat types can panic if the
	 encoded message is too short.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-32189</cvename>
 <url>https://groups.google.com/g/golang-announce/c/YqYYG87xB10</url>
 </references>
 <dates>
 <discovery>2022-07-14</discovery>
 <entry>2022-08-02</entry>
 </dates>
 </vuln>

<vuln vid="4c26f668-0fd2-11ed-a83d-001b217b3468">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>15.2.0</ge><lt>15.2.1</lt></range>
	<range><ge>15.1.0</ge><lt>15.1.4</lt></range>
	<range><ge>0</ge><lt>15.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2022/07/28/security-release-gitlab-15-2-1-released/">
	 Revoke access to confidential notes todos
	 Pipeline subscriptions trigger new pipelines with the wrong author
	 Ability to gain access to private project through an email invite by using other user's email address as an unverified secondary email
	 Import via git protocol allows to bypass checks on repository
	 Unauthenticated IP allowlist bypass when accessing job artifacts through GitLab Pages
	 Maintainer can leak Packagist and other integration access tokens by changing integration URL
	 Unauthenticated access to victims Grafana datasources through path traversal
	 Unauthorized users can filter issues by contact and organization
	 Malicious Maintainer may change the visibility of project or a group
	 Stored XSS in job error messages
	 Enforced group MFA can be bypassed when using Resource Owner Password Credentials grant
	 Non project members can view public project's Deploy Keys
	 IDOR in project with Jira integration leaks project owner's other projects Jira issues
	 Group Bot Users and Tokens not deleted after group deletion
	 Email invited members can join projects even after the member lock has been enabled
	 Datadog integration returns user emails
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2512</cvename>
 <cvename>CVE-2022-2498</cvename>
 <cvename>CVE-2022-2326</cvename>
 <cvename>CVE-2022-2417</cvename>
 <cvename>CVE-2022-2501</cvename>
 <cvename>CVE-2022-2497</cvename>
 <cvename>CVE-2022-2531</cvename>
 <cvename>CVE-2022-2539</cvename>
 <cvename>CVE-2022-2456</cvename>
 <cvename>CVE-2022-2500</cvename>
 <cvename>CVE-2022-2303</cvename>
 <cvename>CVE-2022-2095</cvename>
 <cvename>CVE-2022-2499</cvename>
 <cvename>CVE-2022-2307</cvename>
 <cvename>CVE-2022-2459</cvename>
 <cvename>CVE-2022-2534</cvename>
 <url>https://about.gitlab.com/releases/2022/07/28/security-release-gitlab-15-2-1-released/</url>
 </references>
 <dates>
 <discovery>2022-07-28</discovery>
 <entry>2022-07-30</entry>
 </dates>
 </vuln>

<vuln vid="e1387e95-08d0-11ed-be26-001999f8d30b">
 <topic>VirtualBox -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>virtualbox-ose</name>
	<range><lt>6.1.36</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujul2022.html">
	 Easily exploitable vulnerability allows high privileged
	 attacker with logon to the infrastructure where Oracle
	 VM VirtualBox executes to compromise Oracle VM VirtualBox.
	 Successful attacks of this vulnerability can result in
	 unauthorized ability to cause a hang or frequently
	 repeatable crash (complete DOS) of Oracle VM VirtualBox.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-21554</cvename>
 <cvename>CVE-2022-21571</cvename>
 <url>https://www.oracle.com/security-alerts/cpujul2022.html</url>
 </references>
 <dates>
 <discovery>2022-07-20</discovery>
 <entry>2022-07-21</entry>
 </dates>
 </vuln>

<vuln vid="8e150606-08c9-11ed-856e-d4c9ef517024">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql-server56</name>
	<range><lt>5.6.52</lt></range>
 </package>
 <package>
	<name>mysql-server57</name>
	<range><lt>5.7.39</lt></range>
 </package>
 <package>
	<name>mysql-client80</name>
	<range><lt>8.0.30</lt></range>
 </package>
 <package>
	<name>mysql-server80</name>
	<range><lt>8.0.30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujul2022.html#AppendixMSQL">
	 This Critical Patch Update contains 34 new security patches plus
	 additional third party patches noted below for Oracle MySQL. 10 of
	 these vulnerabilities may be remotely exploitable without
	 authentication, i.e., may be exploited over a network without
	 requiring user credentials.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1292</cvename>
 <cvename>CVE-2022-21824</cvename>
 <cvename>CVE-2022-27778</cvename>
 <cvename>CVE-2018-25032</cvename>
 <cvename>CVE-2022-21556</cvename>
 <cvename>CVE-2022-21569</cvename>
 <cvename>CVE-2022-21550</cvename>
 <cvename>CVE-2022-21519</cvename>
 <cvename>CVE-2022-21527</cvename>
 <cvename>CVE-2022-21528</cvename>
 <cvename>CVE-2022-21509</cvename>
 <cvename>CVE-2022-21539</cvename>
 <cvename>CVE-2022-21517</cvename>
 <cvename>CVE-2022-21537</cvename>
 <cvename>CVE-2022-21547</cvename>
 <cvename>CVE-2022-21525</cvename>
 <cvename>CVE-2022-21526</cvename>
 <cvename>CVE-2022-21529</cvename>
 <cvename>CVE-2022-21530</cvename>
 <cvename>CVE-2022-21531</cvename>
 <cvename>CVE-2022-21553</cvename>
 <cvename>CVE-2022-21515</cvename>
 <cvename>CVE-2022-21455</cvename>
 <cvename>CVE-2022-21534</cvename>
 <cvename>CVE-2022-21522</cvename>
 <cvename>CVE-2022-21538</cvename>
 <cvename>CVE-2022-21535</cvename>
 <url>https://www.oracle.com/security-alerts/cpujul2022.html#AppendixMSQL</url>
 </references>
 <dates>
 <discovery>2022-07-19</discovery>
 <entry>2022-07-21</entry>
 </dates>
 </vuln>

<vuln vid="27cc4258-0805-11ed-8ac1-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>103.0.5060.134</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html">
	 This release contains 11 security fixes, including:
	 <ul>
	 <li>[1336266] High CVE-2022-2477: Use after free in Guest View. Reported by anonymous on 2022-06-14</li>
	 <li>[1335861] High CVE-2022-2478: Use after free in PDF. Reported by triplepwns on 2022-06-13</li>
	 <li>[1329987] High CVE-2022-2479: Insufficient validation of untrusted input in File. Reported by anonymous on 2022-05-28</li>
	 <li>[1339844] High CVE-2022-2480: Use after free in Service Worker API. Reported by Sergei Glazunov of Google Project Zero on 2022-06-27</li>
	 <li>[1341603] High CVE-2022-2481: Use after free in Views. Reported by YoungJoo Lee(@ashuu_lee) of CompSecLab at Seoul National University on 2022-07-04</li>
	 <li>[1308341] Low CVE-2022-2163: Use after free in Cast UI and Toolbar. Reported by Chaoyuan Peng (@ret2happy) on 2022-03-21</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2163</cvename>
 <cvename>CVE-2022-2477</cvename>
 <cvename>CVE-2022-2478</cvename>
 <cvename>CVE-2022-2479</cvename>
 <cvename>CVE-2022-2480</cvename>
 <cvename>CVE-2022-2481</cvename>
 <url>https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html</url>
 </references>
 <dates>
 <discovery>2022-07-19</discovery>
 <entry>2022-07-20</entry>
 </dates>
 </vuln>

<vuln vid="871d93f9-06aa-11ed-8d5f-080027f5fec9">
 <topic>redis -- Potential remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><ge>7.0.0</ge><lt>7.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Redis core team reports:
	<blockquote cite="https://groups.google.com/g/redis-db/c/FWngtg3WpfA">
	 
	 A specially crafted XAUTOCLAIM command on a stream key in
	 a specific state may result with heap overflow, and
	 potentially remote code execution.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-31144</cvename>
 <url>https://groups.google.com/g/redis-db/c/FWngtg3WpfA</url>
 </references>
 <dates>
 <discovery>2022-07-18</discovery>
 <entry>2022-07-18</entry>
 </dates>
 </vuln>

<vuln vid="0c367e98-0415-11ed-a53b-6c3be5272acd">
 <topic>Grafana -- Stored XSS</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>8.3.0</ge><lt>8.3.10</lt></range>
	<range><ge>8.4.0</ge><lt>8.4.10</lt></range>
	<range><ge>8.5.0</ge><lt>8.5.9</lt></range>
	<range><ge>9.0.0</ge><lt>9.0.3</lt></range>
	<range><ge>9.1.0</ge><lt>9.2.7</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.3.0</ge><lt>8.3.10</lt></range>
	<range><ge>8.4.0</ge><lt>8.4.10</lt></range>
	<range><ge>8.5.0</ge><lt>8.5.9</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><lt>9.0.3</lt></range>
	<range><ge>9.1.0</ge><lt>9.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2022/07/14/grafana-v9-0-3-8-5-9-8-4-10-and-8-3-10-released-with-high-severity-security-fix/">
	 An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. (Note: Grafana Alerting is activated by default in Grafana 9.0.)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-31097</cvename>
 <url>https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f</url>
 </references>
 <dates>
 <discovery>2022-06-19</discovery>
 <entry>2022-07-15</entry>
 </dates>
 </vuln>

<vuln vid="0859e6d5-0415-11ed-a53b-6c3be5272acd">
 <topic>Grafana -- OAuth Account Takeover</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>5.3.0</ge><lt>8.3.10</lt></range>
	<range><ge>8.4.0</ge><lt>8.4.10</lt></range>
	<range><ge>8.5.0</ge><lt>8.5.9</lt></range>
	<range><ge>9.0.0</ge><lt>9.0.3</lt></range>
 </package>
 <package>
	<name>grafana7</name>
	<range><ge>7.0</ge></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.3.0</ge><lt>8.3.10</lt></range>
	<range><ge>8.4.0</ge><lt>8.4.10</lt></range>
	<range><ge>8.5.0</ge><lt>8.5.9</lt></range>
 </package>
 <package>
	<name>grafana9</name>
	<range><lt>9.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2022/07/14/grafana-v9-0-3-8-5-9-8-4-10-and-8-3-10-released-with-high-severity-security-fix/">
	 It is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP to take over an existing Grafana account under some conditions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-31107</cvename>
 <url>https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2</url>
 </references>
 <dates>
 <discovery>2022-06-27</discovery>
 <entry>2022-07-15</entry>
 </dates>
 </vuln>

<vuln vid="a4f2416c-02a0-11ed-b817-10c37b4ac2ea">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go118</name>
	<range><lt>1.18.4</lt></range>
 </package>
 <package>
	<name>go117</name>
	<range><lt>1.17.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/53188">
	 net/http: improper sanitization of Transfer-Encoding
	 header
	 The HTTP/1 client accepted some invalid
	 Transfer-Encoding headers as indicating a "chunked"
	 encoding. This could potentially allow for request
	 smuggling, but only if combined with an intermediate
	 server that also improperly failed to reject the header
	 as invalid.
	</blockquote>
	<blockquote cite="https://go.dev/issue/53423">
	 When httputil.ReverseProxy.ServeHTTP was called with a
	 Request.Header map containing a nil value for the
	 X-Forwarded-For header, ReverseProxy would set the client
	 IP as the value of the X-Forwarded-For header, contrary to
	 its documentation. In the more usual case where a Director
	 function set the X-Forwarded-For header value to nil,
	 ReverseProxy would leave the header unmodified as
	 expected.
	</blockquote>
	<blockquote cite="https://go.dev/issue/53168">
	 compress/gzip: stack exhaustion in Reader.Read
	 Calling Reader.Read on an archive containing a large
	 number of concatenated 0-length compressed files can
	 cause a panic due to stack exhaustion.
	</blockquote>
	<blockquote cite="https://go.dev/issue/53611">
	 encoding/xml: stack exhaustion in Unmarshal
	 Calling Unmarshal on a XML document into a Go struct
	 which has a nested field that uses the any field tag can
	 cause a panic due to stack exhaustion.
	</blockquote>
	<blockquote cite="https://go.dev/issue/53614">
	 encoding/xml: stack exhaustion in Decoder.Skip
	 Calling Decoder.Skip when parsing a deeply nested XML
	 document can cause a panic due to stack exhaustion.
	</blockquote>
	<blockquote cite="https://go.dev/issue/53615">
	 encoding/gob: stack exhaustion in Decoder.Decode
	 Calling Decoder.Decode on a message which contains
	 deeply nested structures can cause a panic due to stack
	 exhaustion.
	</blockquote>
	<blockquote cite="https://go.dev/issue/53416">
	 path/filepath: stack exhaustion in Glob
	 Calling Glob on a path which contains a large number of
	 path separators can cause a panic due to stack
	 exhaustion.
	</blockquote>
	<blockquote cite="https://go.dev/issue/53415">
	 io/fs: stack exhaustion in Glob
	 Calling Glob on a path which contains a large number of
	 path separators can cause a panic due to stack
	 exhaustion.
	</blockquote>
	<blockquote cite="https://go.dev/issue/53616">
	 go/parser: stack exhaustion in all Parse* functions
	 Calling any of the Parse functions on Go source code
	 which contains deeply nested types or declarations can
	 cause a panic due to stack exhaustion.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1705</cvename>
 <cvename>CVE-2022-32148</cvename>
 <cvename>CVE-2022-30631</cvename>
 <cvename>CVE-2022-30633</cvename>
 <cvename>CVE-2022-28131</cvename>
 <cvename>CVE-2022-30635</cvename>
 <cvename>CVE-2022-30632</cvename>
 <cvename>CVE-2022-30630</cvename>
 <cvename>CVE-2022-1962</cvename>
 <url>https://groups.google.com/g/golang-dev/c/frczlF8OFQ0</url>
 </references>
 <dates>
 <discovery>2022-07-12</discovery>
 <entry>2022-07-13</entry>
 </dates>
 </vuln>

<vuln vid="b99f99f6-021e-11ed-8c6f-000c29ffbb6c">
 <topic>git -- privilege escalation</topic>
 <affects>
 <package>
	<name>git</name>
	<range><lt>2.37.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The git project reports:
	<blockquote cite="https://lkml.org/lkml/2022/7/12/1137">
	 Git is vulnerable to privilege escalation in all platforms.
	 An unsuspecting user could still be affected by the issue
	 reported in CVE-2022-24765, for example when navigating as
	 root into a shared tmp directory that is owned by them, but
	 where an attacker could create a git repository.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-29187</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29187</url>
 </references>
 <dates>
 <discovery>2022-07-12</discovery>
 <entry>2022-07-12</entry>
 </dates>
 </vuln>

<vuln vid="830855f3-ffcc-11ec-9d41-d05099c8b5a7">
 <topic>mat2 -- directory traversal/arbitrary file read during ZIP file processing</topic>
 <affects>
 <package>
	<name>mat2</name>
	<range><lt>0.13.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35410">
	 
	 mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../
	 directory traversal during the ZIP archive cleaning process. This
	 primarily affects mat2 web instances, in which clients could obtain
	 sensitive information via a crafted archive.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-35410</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35410</url>
 </references>
 <dates>
 <discovery>2022-07-08</discovery>
 <entry>2022-07-10</entry>
 </dates>
 </vuln>

<vuln vid="d1b35142-ff4a-11ec-8be3-001b217b3468">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>15.1.0</ge><lt>15.1.1</lt></range>
	<range><ge>15.0.0</ge><lt>15.0.4</lt></range>
	<range><ge>0</ge><lt>14.10.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2022/06/30/critical-security-release-gitlab-15-1-1-released/">
	 Remote Command Execution via Project Imports
	 XSS in ZenTao integration affecting self hosted instances without strict CSP
	 XSS in project settings page
	 Unallowed users can read unprotected CI variables
	 IP allow-list bypass to access Container Registries
	 2FA status is disclosed to unauthenticated users
	 CI variables provided to runners outside of a group's restricted IP range
	 IDOR in sentry issues
	 Reporters can manage issues in error tracking
	 Regular Expression Denial of Service via malicious web server responses
	 Unauthorized read for conan repository
	 Open redirect vulnerability
	 Group labels are editable through subproject
	 Release titles visible for any users if group milestones are associated with any project releases
	 Restrict membership by email domain bypass
	 Job information is leaked to users who previously were maintainers via the Runner Jobs API endpoint
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2185</cvename>
 <cvename>CVE-2022-2235</cvename>
 <cvename>CVE-2022-2230</cvename>
 <cvename>CVE-2022-2229</cvename>
 <cvename>CVE-2022-1983</cvename>
 <cvename>CVE-2022-1963</cvename>
 <cvename>CVE-2022-2228</cvename>
 <cvename>CVE-2022-2243</cvename>
 <cvename>CVE-2022-2244</cvename>
 <cvename>CVE-2022-1954</cvename>
 <cvename>CVE-2022-2270</cvename>
 <cvename>CVE-2022-2250</cvename>
 <cvename>CVE-2022-1999</cvename>
 <cvename>CVE-2022-2281</cvename>
 <cvename>CVE-2022-1981</cvename>
 <cvename>CVE-2022-2227</cvename>
 <url>https://about.gitlab.com/releases/2022/06/30/critical-security-release-gitlab-15-1-1-released/</url>
 </references>
 <dates>
 <discovery>2022-06-30</discovery>
 <entry>2022-07-09</entry>
 </dates>
 </vuln>

<vuln vid="b9210706-feb0-11ec-81fa-1c697a616631">
 <topic>Node.js -- July 7th 2022 Security Releases</topic>
 <affects>
 <package>
	<name>node</name>
	<range><ge>14.0.0</ge><lt>14.20.0</lt></range>
	<range><ge>16.0.0</ge><lt>16.16.0</lt></range>
	<range><ge>18.0.0</ge><lt>18.5.0</lt></range>
 </package>
 <package>
	<name>node16</name>
	<range><lt>16.16.0</lt></range>
 </package>
 <package>
	<name>node14</name>
	<range><lt>14.20.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/">
	 <h1>HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding
	 (Medium)(CVE-2022-32213)</h1>
	 The llhttp parser in the http module does not correctly parse and
	 validate Transfer-Encoding headers. This can lead to HTTP Request
	 Smuggling (HRS).
	 <h1>HTTP Request Smuggling - Improper Delimiting of Header Fields
	 (Medium)(CVE-2022-32214)</h1>
	 The llhttp parser in the http module does not strictly use the CRLF
	 sequence to delimit HTTP requests. This can lead to HTTP Request
	 Smuggling (HRS).
	 <h1>HTTP Request Smuggling - Incorrect Parsing of Multi-line
	 Transfer-Encoding (Medium)(CVE-2022-32215)</h1>
	 The llhttp parser in the http module does not correctly handle
	 multi-line Transfer-Encoding headers. This can lead to HTTP Request
	 Smuggling (HRS).
	 <h1>DNS rebinding in --inspect via invalid IP addresses
	 (High)(CVE-2022-32212)</h1>
	 The IsAllowedHost check can easily be bypassed because IsIPAddress
	 does not properly check if an IP address is invalid or not. When an
	 invalid IPv4 address is provided (for instance 10.0.2.555 is
	 provided), browsers (such as Firefox) will make DNS requests to the
	 DNS server, providing a vector for an attacker-controlled DNS server
	 or a MITM who can spoof DNS responses to perform a rebinding attack
	 and hence connect to the WebSocket debugger, allowing for arbitrary
	 code execution. This is a bypass of CVE-2021-22884.
	 <h1>Attempt to read openssl.cnf from /home/iojs/build/ upon startup
	 (Medium)(CVE-2022-32222)</h1>
	 When Node.js starts on linux based systems, it attempts to read
	 /home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf,
	 which ordinarily doesn't exist. On some shared systems an attacker may
	 be able create this file and therefore affect the default OpenSSL
	 configuration for other users.
	 <h1>OpenSSL - AES OCB fails to encrypt some bytes
	 (Medium)(CVE-2022-2097)</h1>
	 AES OCB mode for 32-bit x86 platforms using the AES-NI assembly
	 optimised implementation will not encrypt the entirety of the data
	 under some circumstances. This could reveal sixteen bytes of data that
	 was preexisting in the memory that wasn't written. In the special case
	 of "in place" encryption, sixteen bytes of the plaintext would be
	 revealed. Since OpenSSL does not support OCB based cipher suites for
	 TLS and DTLS, they are both unaffected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-32212</cvename>
 <cvename>CVE-2022-32213</cvename>
 <cvename>CVE-2022-32214</cvename>
 <cvename>CVE-2022-32215</cvename>
 <cvename>CVE-2022-32222</cvename>
 <cvename>CVE-2022-2097</cvename>
 <url>https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/</url>
 </references>
 <dates>
 <discovery>2022-07-05</discovery>
 <entry>2022-07-08</entry>
 <modified>2022-07-08</modified>
 </dates>
 </vuln>

<vuln vid="744ec9d7-fe0f-11ec-bcd2-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>103.0.5060.114</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.html">
	 This release contains 4 security fixes, including:
	 <ul>
	 <li>[1341043] High CVE-2022-2294: Heap buffer overflow in WebRTC. Reported by Jan Vojtesek from the Avast Threat Intelligence team on 2022-07-01</li>
	 <li>[1336869] High CVE-2022-2295: Type Confusion in V8. Reported by avaue and Buff3tts at S.S.L. on 2022-06-16</li>
	 <li>[1327087] High CVE-2022-2296: Use after free in Chrome OS Shell. Reported by Khalil Zhani on 2022-05-19</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2294</cvename>
 <cvename>CVE-2022-2295</cvename>
 <cvename>CVE-2022-2296</cvename>
 <url>https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2022-07-04</discovery>
 <entry>2022-07-07</entry>
 </dates>
 </vuln>

<vuln vid="a28e8b7e-fc70-11ec-856e-d4c9ef517024">
 <topic>OpenSSL -- AES OCB fails to encrypt some bytes</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.1.1q,1</lt></range>
 </package>
 <package>
	<name>openssl-devel</name>
	<range><lt>3.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20220705.txt">
	 AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised
	 implementation will not encrypt the entirety of the data under some
	 circumstances. This could reveal sixteen bytes of data that was
	 preexisting in the memory that wasn't written. In the special case of
	 "in place" encryption, sixteen bytes of the plaintext would be revealed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2097</cvename>
 <url>https://www.openssl.org/news/secadv/20220705.txt</url>
 </references>
 <dates>
 <discovery>2022-07-05</discovery>
 <entry>2022-07-05</entry>
 </dates>
 </vuln>

<vuln vid="5be19b0d-fb85-11ec-95cd-080027b24e86">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py37-django32</name>
	<name>py38-django32</name>
	<name>py39-django32</name>
	<name>py310-django32</name>
	<range><lt>3.2.14</lt></range>
 </package>
 <package>
	<name>py38-django40</name>
	<name>py39-django40</name>
	<name>py310-django40</name>
	<range><lt>4.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Django Project reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2022/jul/04/security-releases/">
	 CVE-2022-34265: Potential SQL injection via Trunc(kind) and
	 Extract(lookup_name) arguments.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-34265</cvename>
 <url>https://www.djangoproject.com/weblog/2022/jul/04/security-releases/</url>
 </references>
 <dates>
 <discovery>2022-06-21</discovery>
 <entry>2022-07-04</entry>
 </dates>
 </vuln>

<vuln vid="f0e45968-faff-11ec-856e-d4c9ef517024">
 <topic>OpenSSL -- Heap memory corruption with RSA private key operation</topic>
 <affects>
 <package>
	<name>openssl-devel</name>
	<range><ge>3.0.4</ge><lt>3.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://mta.openssl.org/pipermail/openssl-announce/2022-July/000229.html">
	 The OpenSSL 3.0.4 release introduced a serious bug in the RSA
	 implementation for X86_64 CPUs supporting the AVX512IFMA instructions.
	 This issue makes the RSA implementation with 2048 bit private keys
	 incorrect on such machines and memory corruption will happen during
	 the computation. As a consequence of the memory corruption an attacker
	 may be able to trigger a remote code execution on the machine performing
	 the computation.
	 SSL/TLS servers or other servers using 2048 bit RSA private keys running
	 on machines supporting AVX512IFMA instructions of the X86_64 architecture
	 are affected by this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2274</cvename>
 <url>https://www.openssl.org/news/secadv/20220705.txt</url>
 </references>
 <dates>
 <discovery>2022-07-01</discovery>
 <entry>2022-07-03</entry>
 <modified>2022-07-05</modified>
 </dates>
 </vuln>

<vuln vid="5ab54ea0-fa94-11ec-996c-080027b24e86">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki135</name>
	<range><lt>1.35.7</lt></range>
 </package>
 <package>
	<name>mediawiki137</name>
	<range><lt>1.37.3</lt></range>
 </package>
 <package>
	<name>mediawiki138</name>
	<range><lt>1.38.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawiki reports:
	<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/PIPYDRSHXOYW5DB7X755QDNUV5EZWPWB/">
	 (T308471) Username is not escaped in the "welcomeuser" message.
	 (T308473) Username not escaped in the contributions-title message.
	 (T309377, CVE-2022-29248) Update "guzzlehttp/guzzle" to version 6.5.6.
	 (T311384, CVE-2022-27776) Update "guzzlehttp/guzzle" to 6.5.8/7.4.5.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-29248</cvename>
 <cvename>CVE-2022-27776</cvename>
 <url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/PIPYDRSHXOYW5DB7X755QDNUV5EZWPWB/</url>
 </references>
 <dates>
 <discovery>2022-05-16</discovery>
 <entry>2022-07-03</entry>
 </dates>
 </vuln>

<vuln vid="07c0d782-f758-11ec-acaa-901b0e9408dc">
 <topic>py-matrix-synapse -- unbounded recursion in urlpreview</topic>
 <affects>
 <package>
	<name>py37-matrix-synapse</name>
	<name>py38-matrix-synapse</name>
	<name>py39-matrix-synapse</name>
	<name>py310-matrix-synapse</name>
	<name>py311-matrix-synapse</name>
	<range><lt>1.61.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://matrix.org/blog/2022/06/28/security-release-synapse-1-61-1">
	 This release fixes a vulnerability with Synapse's URL preview feature. URL previews
	 of some web pages can lead to unbounded recursion, causing the request to either fail,
	 or in some cases crash the running Synapse process.
	 Note that:
	 <ul>
	 <li>Homeservers with the url_preview_enabled configuration option set to false
	 (the default value) are unaffected.</li>
	 <li>Instances with the enable_media_repo configuration option set to false are
	 also unaffected, as this also disables the URL preview functionality.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-31052</cvename>
 <url>https://matrix.org/blog/2022/06/28/security-release-synapse-1-61-1</url>
 </references>
 <dates>
 <discovery>2022-06-28</discovery>
 <entry>2022-06-29</entry>
 </dates>
 </vuln>

<vuln vid="ae5722a6-f5f0-11ec-856e-d4c9ef517024">
 <topic>cURL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.16.4</ge><lt>7.84.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports:
	<blockquote cite="https://curl.se/docs/security.html">
	 <ul>
	 <li>CVE-2022-32205: Set-Cookie denial of service</li>
	 <li>CVE-2022-32206: HTTP compression denial of service</li>
	 <li>CVE-2022-32207: Unpreserved file permissions</li>
	 <li>CVE-2022-32208: FTP-KRB bad message verification</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-32205</cvename>
 <cvename>CVE-2022-32206</cvename>
 <cvename>CVE-2022-32207</cvename>
 <cvename>CVE-2022-32208</cvename>
 <url>https://curl.se/docs/security.html</url>
 </references>
 <dates>
 <discovery>2022-06-27</discovery>
 <entry>2022-06-27</entry>
 </dates>
 </vuln>

<vuln vid="25be46f0-f25d-11ec-b62a-00e081b7aa2d">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.356</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.346.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2022-06-22/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-2781 / CVE-2022-34170 (SECURITY-2779), CVE-2022-34171 (SECURITY-2761), CVE-2022-34172 (SECURITY-2776), CVE-2022-34173 (SECURITY-2780)</h5>
	 Multiple XSS vulnerabilities
	 <h5>(Medium) SECURITY-2566 / CVE-2022-34174</h5>
	 Observable timing discrepancy allows determining username validity
	 <h5>(Medium) Unauthorized view fragment access</h5>
	 SECURITY-2777 / CVE-2022-34175
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-34170</cvename>
 <cvename>CVE-2022-34171</cvename>
 <cvename>CVE-2022-34172</cvename>
 <cvename>CVE-2022-34173</cvename>
 <cvename>CVE-2022-34174</cvename>
 <cvename>CVE-2022-34175</cvename>
 <url>https://www.jenkins.io/security/advisory/2022-06-22/</url>
 </references>
 <dates>
 <discovery>2022-06-22</discovery>
 <entry>2022-06-22</entry>
 </dates>
 </vuln>

<vuln vid="4eeb93bf-f204-11ec-8fbd-d4c9ef517024">
 <topic>OpenSSL -- Command injection vulnerability</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.1.1p,1</lt></range>
 </package>
 <package>
	<name>openssl-devel</name>
	<range><lt>3.0.4</lt></range>
 </package>
 <package>
	<name>openssl-quictls</name>
	<range><lt>3.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20220621.txt">
	 Circumstances where the c_rehash script does not properly
	 sanitise shell metacharacters to prevent command injection were
	 found by code review.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2068</cvename>
 <url>https://www.openssl.org/news/secadv/20220621.txt</url>
 </references>
 <dates>
 <discovery>2022-06-21</discovery>
 <entry>2022-06-22</entry>
 </dates>
 </vuln>

<vuln vid="b2a4c5f1-f1fe-11ec-bcd2-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>103.0.5060.53</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html">
	 This release contains 14 security fixes, including:
	 <ul>
	 <li>[1335458] Critical CVE-2022-2156: Use after free in Base. Reported by Mark Brand of Google Project Zero on 2022-06-11</li>
	 <li>[1327312] High CVE-2022-2157: Use after free in Interest groups. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-05-19</li>
	 <li>[1321078] High CVE-2022-2158: Type Confusion in V8. Reported by Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu Lab on 2022-04-29</li>
	 <li>[1116450] Medium CVE-2022-2160: Insufficient policy enforcement in DevTools. Reported by David Erceg on 2020-08-14</li>
	 <li>[1330289] Medium CVE-2022-2161: Use after free in WebApp Provider. Reported by Zhihua Yao of KunLun Lab on 2022-05-30</li>
	 <li>[1307930] Medium CVE-2022-2162: Insufficient policy enforcement in File System API. Reported by Abdelhamid Naceri (halov) on 2022-03-19</li>
	 <li>[1308341] Low CVE-2022-2163: Use after free in Cast UI and Toolbar. Reported by Chaoyuan Peng (@ret2happy) on 2022-03-21</li>
	 <li>[1268445] Low CVE-2022-2164: Inappropriate implementation in Extensions API. Reported by José Miguel Moreno Computer Security Lab (COSEC) at UC3M on 2021-11-10</li>
	 <li>[1250993] Low CVE-2022-2165: Insufficient data validation in URL formatting. Reported by Rayyan Bijoora on 2021-09-19</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2156</cvename>
 <cvename>CVE-2022-2157</cvename>
 <cvename>CVE-2022-2158</cvename>
 <cvename>CVE-2022-2160</cvename>
 <cvename>CVE-2022-2161</cvename>
 <cvename>CVE-2022-2162</cvename>
 <cvename>CVE-2022-2163</cvename>
 <cvename>CVE-2022-2164</cvename>
 <cvename>CVE-2022-2165</cvename>
 <url>https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html</url>
 </references>
 <dates>
 <discovery>2022-06-21</discovery>
 <entry>2022-06-22</entry>
 </dates>
 </vuln>

<vuln vid="482456fb-e9af-11ec-93b6-318d1419ea39">
 <topic>Security Vulnerability found in ExifTool leading to RCE</topic>
 <affects>
 <package>
	<name>p5-Image-ExifTool</name>
	<range><lt>12.38</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian Security tracker reports:
	<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2022-23935">
	 ExifTool.pm in ExifTool before 12.38 mishandles a file special characters check, leading to command injection
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23935</cvename>
 <url>https://www.cvedetails.com/cve/CVE-2022-23935</url>
 </references>
 <dates>
 <discovery>2022-01-25</discovery>
 <entry>2022-06-11</entry>
 </dates>
 </vuln>

<vuln vid="ad37a349-ebb7-11ec-b9f7-21427354249d">
 <topic>mitmproxy -- Insufficient Protection against HTTP Request Smuggling</topic>
 <affects>
 <package>
	<name>mitmproxy</name>
	<range><lt>8.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Zeyu Zhang reports:
	<blockquote cite="https://github.com/mitmproxy/mitmproxy/commit/b06fb6d157087d526bd02e7aadbe37c56865c71b">
	 
	 In mitmproxy 7.0.4 and below, a malicious client or server is able to
	 perform HTTP request smuggling attacks through mitmproxy. This means
	 that a malicious client/server could smuggle a request/response through
	 mitmproxy as part of another request/response's HTTP message body. While
	 mitmproxy would only see one request, the target server would see
	 multiple requests. A smuggled request is still captured as part of
	 another request's body, but it does not appear in the request list and
	 does not go through the usual mitmproxy event hooks, where users may
	 have implemented custom access control checks or input sanitization.
	 
	 
	 Unless you use mitmproxy to protect an HTTP/1 service, no action is required.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-24766</cvename>
 <url>https://github.com/mitmproxy/mitmproxy/commit/b06fb6d157087d526bd02e7aadbe37c56865c71b</url>
 </references>
 <dates>
 <discovery>2022-03-21</discovery>
 <entry>2022-06-20</entry>
 </dates>
 </vuln>

<vuln vid="5d1e4f6a-ee4f-11ec-86c2-485b3931c969">
 <topic>Tor - Unspecified high severity vulnerability</topic>
 <affects>
 <package>
	<name>tor</name>
	<range><lt>0.4.7.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tor organization reports:
	<blockquote cite="https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE">
	 TROVE-2022-001
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE</url>
 </references>
 <dates>
 <discovery>2022-06-14</discovery>
 <entry>2022-06-17</entry>
 </dates>
 </vuln>

<vuln vid="55cff5d2-e95c-11ec-ae20-001999f8d30b">
 <topic>XFCE -- Allows executing malicious .desktop files pointing to remote code</topic>
 <affects>
 <package>
	<name>libexo</name>
	<range><lt>4.16.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	XFCE Project reports:
	<blockquote cite="https://gitlab.xfce.org/xfce/exo/-/commit/cc047717c3b5efded2cc7bd419c41a3d1f1e48b6">
	 Prevent executing possibly malicious .desktop files
	 from online sources (ftp://, http:// etc.).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-32278</cvename>
 <url>https://gitlab.xfce.org/xfce/exo/-/commit/cc047717c3b5efded2cc7bd419c41a3d1f1e48b6</url>
 </references>
 <dates>
 <discovery>2022-06-11</discovery>
 <entry>2022-06-11</entry>
 </dates>
 </vuln>

<vuln vid="b51cfaea-e919-11ec-9fba-080027240888">
 <topic>py-numpy -- Missing return-value validation of the function PyArray_DescrNew</topic>
 <affects>
 <package>
	<name>py38-numpy</name>
	<name>py39-numpy</name>
	<name>py310-numpy</name>
	<range><lt>1.22.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Numpy reports:
	<blockquote cite="https://github.com/numpy/numpy/pull/20960">
	 At most call-sites for PyArray_DescrNew, there are no validations of its return,
	 but an invalid address may be returned.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41495</cvename>
 <url>https://github.com/numpy/numpy/pull/20960</url>
 </references>
 <dates>
 <discovery>2021-05-19</discovery>
 <entry>2022-06-11</entry>
 </dates>
 </vuln>

<vuln vid="c80ce2dd-e831-11ec-bcd2-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>102.0.5005.115</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop.html">
	 This release contains 7 security fixes, including:
	 <ul>
	 <li>[1326210] High CVE-2022-2007: Use after free in WebGPU. Reported by David Manouchehri on 2022-05-17</li>
	 <li>[1317673] High CVE-2022-2008: Out of bounds memory access in WebGL. Reported by khangkito - Tran Van Khang (VinCSS) on 2022-04-19</li>
	 <li>[1325298] High CVE-2022-2010: Out of bounds read in compositing. Reported by Mark Brand of Google Project Zero on 2022-05-13</li>
	 <li>[1330379] High CVE-2022-2011: Use after free in ANGLE. Reported by SeongHwan Park (SeHwa) on 2022-05-31</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-2007</cvename>
 <cvename>CVE-2022-2008</cvename>
 <cvename>CVE-2022-2010</cvename>
 <cvename>CVE-2022-2011</cvename>
 <url>https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2022-06-09</discovery>
 <entry>2022-06-09</entry>
 </dates>
 </vuln>

<vuln vid="49adfbe5-e7d1-11ec-8fbd-d4c9ef517024">
 <topic>Apache httpd -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.54</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="http://downloads.apache.org/httpd/CHANGES_2.4.54">
	 <ul>
	 <li>CVE-2022-31813: mod_proxy X-Forwarded-For dropped by hop-by-hop
	 mechanism. Apache HTTP Server 2.4.53 and earlier may not send the
	 X-Forwarded-* headers to the origin server based on client side
	 Connection header hop-by-hop mechanism. This may be used to bypass
	 IP based authentication on the origin server/application.</li>
	 <li>CVE-2022-30556: Information Disclosure in mod_lua with websockets.
	 Apache HTTP Server 2.4.53 and earlier may return lengths to
	 applications calling r:wsread() that point past the end of the
	 storage allocated for the buffer.</li>
	 <li>CVE-2022-30522: mod_sed denial of service. If Apache HTTP Server
	 2.4.53 is configured to do transformations with mod_sed in contexts
	 where the input to mod_sed may be very large, mod_sed may make
	 excessively large memory allocations and trigger an abort.</li>
	 <li>CVE-2022-29404: Denial of service in mod_lua r:parsebody. In Apache
	 HTTP Server 2.4.53 and earlier, a malicious request to a lua script
	 that calls r:parsebody(0) may cause a denial of service due to no
	 default limit on possible input size.</li>
	 <li>CVE-2022-28615: Read beyond bounds in ap_strcmp_match(). Apache
	 HTTP Server 2.4.53 and earlier may crash or disclose information due
	 to a read beyond bounds in ap_strcmp_match() when provided with an
	 extremely large input buffer. While no code distributed with the
	 server can be coerced into such a call, third-party modules or lua
	 scripts that use ap_strcmp_match() may hypothetically be affected.
	 </li>
	 <li>CVE-2022-28614: read beyond bounds via ap_rwrite(). The ap_rwrite()
	 function in Apache HTTP Server 2.4.53 and earlier may read unintended
	 memory if an attacker can cause the server to reflect very large
	 input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts()
	 function.</li>
	 <li>CVE-2022-28330: read beyond bounds in mod_isapi. Apache HTTP Server
	 2.4.53 and earlier on Windows may read beyond bounds when configured
	 to process requests with the mod_isapi module.</li>
	 <li>CVE-2022-26377: mod_proxy_ajp: Possible request smuggling.
	 Inconsistent Interpretation of HTTP Requests ('HTTP Request
	 Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
	 allows an attacker to smuggle requests to the AJP server it forwards
	 requests to.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-31813</cvename>
 <cvename>CVE-2022-30556</cvename>
 <cvename>CVE-2022-30522</cvename>
 <cvename>CVE-2022-29404</cvename>
 <cvename>CVE-2022-28615</cvename>
 <cvename>CVE-2022-28614</cvename>
 <cvename>CVE-2022-28330</cvename>
 <cvename>CVE-2022-26377</cvename>
 <url>http://downloads.apache.org/httpd/CHANGES_2.4.54</url>
 </references>
 <dates>
 <discovery>2022-06-08</discovery>
 <entry>2022-06-09</entry>
 <modified>2022-06-10</modified>
 </dates>
 </vuln>

<vuln vid="15888c7e-e659-11ec-b7fe-10c37b4ac2ea">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go118</name>
	<range><lt>1.18.3</lt></range>
 </package>
 <package>
	<name>go117</name>
	<range><lt>1.17.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://go.dev/issue/52561">
	 crypto/rand: rand.Read hangs with extremely large buffers
	 On Windows, rand.Read will hang indefinitely if passed a
	 buffer larger than 1 &lt;&lt; 32 - 1 bytes.
	</blockquote>
	<blockquote cite="https://go.dev/issue/52814">
	 crypto/tls: session tickets lack random ticket_age_add
	 Session tickets generated by crypto/tls did not contain
	 a randomly generated ticket_age_add. This allows an
	 attacker that can observe TLS handshakes to correlate
	 successive connections by comparing ticket ages during
	 session resumption.
	</blockquote>
	<blockquote cite="https://go.dev/issue/52574">
	 os/exec: empty Cmd.Path can result in running unintended
	 binary on Windows
	 If, on Windows, Cmd.Run, cmd.Start, cmd.Output, or
	 cmd.CombinedOutput are executed when Cmd.Path is unset
	 and, in the working directory, there are binaries named
	 either "..com" or "..exe", they will be executed.
	</blockquote>
	<blockquote cite="https://go.dev/issue/52476">
	 path/filepath: Clean(`.\c:`) returns `c:` on Windows
	 On Windows, the filepath.Clean function could convert an
	 invalid path to a valid, absolute path. For example,
	 Clean(`.\c:`) returned `c:`.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://groups.google.com/g/golang-dev/c/DidEMYAH_n0</url>
 <cvename>CVE-2022-30634</cvename>
 <url>https://go.dev/issue/52561</url>
 <cvename>CVE-2022-30629</cvename>
 <url>https://go.dev/issue/52814</url>
 <cvename>CVE-2022-30580</cvename>
 <url>https://go.dev/issue/52574</url>
 <cvename>CVE-2022-29804</cvename>
 <url>https://go.dev/issue/52476</url>
 </references>
 <dates>
 <discovery>2022-06-01</discovery>
 <entry>2022-06-07</entry>
 </dates>
 </vuln>

<vuln vid="a58f3fde-e4e0-11ec-8340-2d623369b8b5">
 <topic>e2fsprogs -- out-of-bounds read/write vulnerability</topic>
 <affects>
 <package>
	<name>e2fsprogs</name>
	<range><lt>1.46.5_1</lt></range>
 </package>
 <package>
	<name>e2fsprogs-nobootfsck</name>
	<range><lt>1.46.5_1</lt></range>
 </package>
 <package>
	<name>e2fsprogs-roothardlinks</name>
	<range><lt>1.46.5_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nils Bars reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=2068113">
	 
	 During the processing of [a specially fuzzed disk image], an
	 out-of-bounds write is triggered and causes a segmentation fault
	 (SIGSEGV).
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1304</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=2068113</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=2069726</url>
 <url>https://lore.kernel.org/linux-ext4/20220421173148.20193-1-lczerner@redhat.com/T/#u</url>
 </references>
 <dates>
 <discovery>2022-03-24</discovery>
 <entry>2022-06-05</entry>
 </dates>
 </vuln>

<vuln vid="f414d69f-e43d-11ec-9ea4-001b217b3468">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>15.0.0</ge><lt>15.0.1</lt></range>
	<range><ge>14.10.0</ge><lt>14.10.4</lt></range>
	<range><ge>11.10.0</ge><lt>14.9.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/">
	 Account take over via SCIM email change
	 Stored XSS in Jira integration
	 Quick action commands susceptible to XSS
	 IP allowlist bypass when using Trigger tokens
	 IP allowlist bypass when using Project Deploy Tokens
	 Improper authorization in the Interactive Web Terminal
	 Subgroup member can list members of parent group
	 Group member lock bypass
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1680</cvename>
 <cvename>CVE-2022-1940</cvename>
 <cvename>CVE-2022-1948</cvename>
 <cvename>CVE-2022-1935</cvename>
 <cvename>CVE-2022-1936</cvename>
 <cvename>CVE-2022-1944</cvename>
 <cvename>CVE-2022-1821</cvename>
 <cvename>CVE-2022-1783</cvename>
 <url>https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/</url>
 </references>
 <dates>
 <discovery>2022-06-01</discovery>
 <entry>2022-06-04</entry>
 </dates>
 </vuln>

<vuln vid="204f1a7a-43df-412f-ad25-7dbe88f54fa4">
 <topic>zeek -- potential DoS vulnerabilty</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>4.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v4.0.7">
	 Fix potential hang in the DNS analyzer when receiving
	 a specially-crafted packet. Due to the possibility of
	 this happening with packets received from the network,
	 this is a potential DoS vulnerability. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v4.0.7</url>
 </references>
 <dates>
 <discovery>2022-06-01</discovery>
 <entry>2022-06-03</entry>
 </dates>
 </vuln>

<vuln vid="40e2c35e-db99-11ec-b0cf-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>102.0.5005.61</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html">
	 This release contains 32 security fixes, including:
	 <ul>
	 <li>[1324864] Critical CVE-2022-1853: Use after free in Indexed DB. Reported by Anonymous on 2022-05-12</li>
	 <li>[1320024] High CVE-2022-1854: Use after free in ANGLE. Reported by SeongHwan Park (SeHwa) on 2022-04-27</li>
	 <li>[1228661] High CVE-2022-1855: Use after free in Messaging. Reported by Anonymous on 2021-07-13</li>
	 <li>[1323239] High CVE-2022-1856: Use after free in User Education. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-05-06</li>
	 <li>[1227995] High CVE-2022-1857: Insufficient policy enforcement in File System API. Reported by Daniel Rhea on 2021-07-11</li>
	 <li>[1314310] High CVE-2022-1858: Out of bounds read in DevTools. Reported by EllisVlad on 2022-04-07</li>
	 <li>[1322744] High CVE-2022-1859: Use after free in Performance Manager. Reported by Guannan Wang (@Keenan7310) of Tencent Security Xuanwu Lab on 2022-05-05</li>
	 <li>[1297209] High CVE-2022-1860: Use after free in UI Foundations. Reported by @ginggilBesel on 2022-02-15</li>
	 <li>[1316846] High CVE-2022-1861: Use after free in Sharing. Reported by Khalil Zhani on 2022-04-16</li>
	 <li>[1236325] Medium CVE-2022-1862: Inappropriate implementation in Extensions. Reported by Alesandro Ortiz on 2021-08-04</li>
	 <li>[1292870] Medium CVE-2022-1863: Use after free in Tab Groups. Reported by David Erceg on 2022-02-01</li>
	 <li>[1320624] Medium CVE-2022-1864: Use after free in WebApp Installs. Reported by Yuntao You (@GraVity0) of Bytedance Wuheng Lab on 2022-04-28</li>
	 <li>[1289192] Medium CVE-2022-1865: Use after free in Bookmarks. Reported by Rong Jian of VRI on 2022-01-20</li>
	 <li>[1292264] Medium CVE-2022-1866: Use after free in Tablet Mode. Reported by @ginggilBesel on 2022-01-29</li>
	 <li>[1315563] Medium CVE-2022-1867: Insufficient validation of untrusted input in Data Transfer. Reported by Michal Bentkowski of Securitum on 2022-04-12</li>
	 <li>[1301203] Medium CVE-2022-1868: Inappropriate implementation in Extensions API. Reported by Alesandro Ortiz on 2022-02-28</li>
	 <li>[1309467] Medium CVE-2022-1869: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2022-03-23</li>
	 <li>[1323236] Medium CVE-2022-1870: Use after free in App Service. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-05-06</li>
	 <li>[1308199] Low CVE-2022-1871: Insufficient policy enforcement in File System API. Reported by Thomas Orlita on 2022-03-21</li>
	 <li>[1310461] Low CVE-2022-1872: Insufficient policy enforcement in Extensions API. Reported by ChaobinZhang on 2022-03-26</li>
	 <li>[1305394] Low CVE-2022-1873: Insufficient policy enforcement in COOP. Reported by NDevTK on 2022-03-11</li>
	 <li>[1251588] Low CVE-2022-1874: Insufficient policy enforcement in Safe Browsing. Reported by hjy79425575 on 2021-09-21</li>
	 <li>[1306443] Low CVE-2022-1875: Inappropriate implementation in PDF. Reported by NDevTK on 2022-03-15</li>
	 <li>[1313600] Low CVE-2022-1876: Heap buffer overflow in DevTools. Reported by @ginggilBesel on 2022-04-06</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1853</cvename>
 <cvename>CVE-2022-1854</cvename>
 <cvename>CVE-2022-1855</cvename>
 <cvename>CVE-2022-1856</cvename>
 <cvename>CVE-2022-1857</cvename>
 <cvename>CVE-2022-1858</cvename>
 <cvename>CVE-2022-1859</cvename>
 <cvename>CVE-2022-1860</cvename>
 <cvename>CVE-2022-1861</cvename>
 <cvename>CVE-2022-1862</cvename>
 <cvename>CVE-2022-1863</cvename>
 <cvename>CVE-2022-1864</cvename>
 <cvename>CVE-2022-1865</cvename>
 <cvename>CVE-2022-1866</cvename>
 <cvename>CVE-2022-1867</cvename>
 <cvename>CVE-2022-1868</cvename>
 <cvename>CVE-2022-1869</cvename>
 <cvename>CVE-2022-1870</cvename>
 <cvename>CVE-2022-1871</cvename>
 <cvename>CVE-2022-1872</cvename>
 <cvename>CVE-2022-1873</cvename>
 <cvename>CVE-2022-1874</cvename>
 <cvename>CVE-2022-1875</cvename>
 <cvename>CVE-2022-1876</cvename>
 <url>https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html</url>
 </references>
 <dates>
 <discovery>2022-05-24</discovery>
 <entry>2022-05-24</entry>
 </dates>
 </vuln>

<vuln vid="04fecc47-dad2-11ec-8fbd-d4c9ef517024">
 <topic>MariaDB -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb103-client</name>
	<range><lt>10.3.35</lt></range>
 </package>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.35</lt></range>
 </package>
 <package>
	<name>mariadb104-client</name>
	<range><lt>10.4.25</lt></range>
 </package>
 <package>
	<name>mariadb104-server</name>
	<range><lt>10.4.25</lt></range>
 </package>
 <package>
	<name>mariadb105-client</name>
	<range><lt>10.5.16</lt></range>
 </package>
 <package>
	<name>mariadb105-server</name>
	<range><lt>10.5.16</lt></range>
 </package>
 <package>
	<name>mariadb106-client</name>
	<range><lt>10.6.8</lt></range>
 </package>
 <package>
	<name>mariadb106-server</name>
	<range><lt>10.6.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MariaDB project reports:
	<blockquote cite="https://mariadb.com/kb/en/security/#full-list-of-cves-fixed-in-mariadb">
	 MariaDB fixed 23 vulnerabilities across all supported versions
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-46669</cvename>
 <cvename>CVE-2022-27376</cvename>
 <cvename>CVE-2022-27377</cvename>
 <cvename>CVE-2022-27378</cvename>
 <cvename>CVE-2022-27379</cvename>
 <cvename>CVE-2022-27380</cvename>
 <cvename>CVE-2022-27381</cvename>
 <cvename>CVE-2022-27382</cvename>
 <cvename>CVE-2022-27383</cvename>
 <cvename>CVE-2022-27384</cvename>
 <cvename>CVE-2022-27386</cvename>
 <cvename>CVE-2022-27387</cvename>
 <cvename>CVE-2022-27444</cvename>
 <cvename>CVE-2022-27445</cvename>
 <cvename>CVE-2022-27446</cvename>
 <cvename>CVE-2022-27447</cvename>
 <cvename>CVE-2022-27448</cvename>
 <cvename>CVE-2022-27449</cvename>
 <cvename>CVE-2022-27451</cvename>
 <cvename>CVE-2022-27452</cvename>
 <cvename>CVE-2022-27455</cvename>
 <cvename>CVE-2022-27456</cvename>
 <cvename>CVE-2022-27457</cvename>
 <cvename>CVE-2022-27458</cvename>
 <url>https://mariadb.com/kb/en/security/#full-list-of-cves-fixed-in-mariadb</url>
 </references>
 <dates>
 <discovery>2022-05-20</discovery>
 <entry>2022-05-23</entry>
 </dates>
 </vuln>

<vuln vid="b2407db1-d79f-11ec-a15f-589cfc0f81b0">
 <topic>clamav -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.104.3,1</lt></range>
 </package>
 <package>
	<name>clamav-lts</name>
	<range><lt>0.103.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The ClamAV project reports:
	<blockquote cite="https://blog.clamav.net/2022/05/clamav-01050-01043-01036-released.html">
	 Fixed a possible double-free vulnerability in the OLE2 file
	 parser. Issue affects versions 0.104.0 through 0.104.2. Issue
	 identified by OSS-Fuzz.
	 Fixed a possible infinite loop vulnerability in the CHM file
	 parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
	 version 0.103.5 and prior versions. Thank you to Michał Dardas
	 for reporting this issue.
	 Fixed a possible NULL-pointer dereference crash in the scan
	 verdict cache check. Issue affects versions 0.103.4, 0.103.5,
	 0.104.1, and 0.104.2. Thank you to Alexander Patrakov and
	 Antoine Gatineau for reporting this issue.
	 Fixed a possible infinite loop vulnerability in the TIFF file
	 parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
	 version 0.103.5 and prior versions. The issue only occurs if the
	 "--alert-broken-media" ClamScan option is enabled. For ClamD,
	 the affected option is "AlertBrokenMedia yes", and for libclamav
	 it is the "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. Thank
	 you to Michał Dardas for reporting this issue.
	 Fixed a possible memory leak in the HTML file parser /
	 Javascript normalizer. Issue affects versions 0.104.0 through
	 0.104.2 and LTS version 0.103.5 and prior versions. Thank you to
	 Michał Dardas for reporting this issue.
	 Fixed a possible multi-byte heap buffer overflow write
	 vulnerability in the signature database load module. The fix was
	 to update the vendored regex library to the latest version.
	 Issue affects versions 0.104.0 through 0.104.2 and LTS version
	 0.103.5 and prior versions. Thank you to Michał Dardas for
	 reporting this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-20803</cvename>
 <cvename>CVE-2022-20770</cvename>
 <cvename>CVE-2022-20796</cvename>
 <cvename>CVE-2022-20771</cvename>
 <cvename>CVE-2022-20785</cvename>
 <cvename>CVE-2022-20792</cvename>
 <url>https://blog.clamav.net/2022/05/clamav-01050-01043-01036-released.html#more</url>
 </references>
 <dates>
 <discovery>2022-05-04</discovery>
 <entry>2022-05-19</entry>
 </dates>
 </vuln>

<vuln vid="a1360138-d446-11ec-8ea1-10c37b4ac2ea">
 <topic>go -- syscall.Faccessat checks wrong group on Linux</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.18.2,1</lt></range>
 </package>
 <package>
	<name>go117</name>
	<range><lt>1.17.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/52313">
	 When called with a non-zero flags parameter, the
	 syscall.Faccessat function could incorrectly report that a
	 file is accessible. This bug only occurs on Linux systems.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-29526</cvename>
 <url>https://github.com/golang/go/issues/52313</url>
 <url>https://groups.google.com/g/golang-dev/c/CPU3TB6d4oY</url>
 </references>
 <dates>
 <discovery>2022-04-12</discovery>
 <entry>2022-05-15</entry>
 </dates>
 </vuln>

<vuln vid="11e36890-d28c-11ec-a06f-d4c9ef517024">
 <topic>curl -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>7.83.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The curl project reports:
	<blockquote cite="https://curl.se/docs/security.html">
	 CVE-2022-27778: curl removes wrong file on error
	 CVE-2022-27779: cookie for trailing dot TLD
	 CVE-2022-27780: percent-encoded path separator in URL host
	 CVE-2022-27781: CERTINFO never-ending busy-loop
	 CVE-2022-27782: TLS and SSH connection too eager reuse
	 CVE-2022-30115: HSTS bypass via trailing dot
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-27778</cvename>
 <cvename>CVE-2022-27779</cvename>
 <cvename>CVE-2022-27780</cvename>
 <cvename>CVE-2022-27781</cvename>
 <cvename>CVE-2022-27782</cvename>
 <cvename>CVE-2022-30115</cvename>
 <url>https://curl.se/docs/security.html</url>
 </references>
 <dates>
 <discovery>2022-05-11</discovery>
 <entry>2022-05-13</entry>
 </dates>
 </vuln>

<vuln vid="157ce083-d145-11ec-ab9b-6cc21735f730">
 <topic>PostgreSQL Server -- execute arbitrary SQL code as DBA user</topic>
 <affects>
 <package>
	<name>postgresql14-server</name>
	<range><lt>14.3</lt></range>
 </package>
 <package>
	<name>postgresql13-server</name>
	<range><lt>13.7</lt></range>
 </package>
 <package>
	<name>postgresql12-server</name>
	<range><lt>12.11</lt></range>
 </package>
 <package>
	<name>postgresql11-server</name>
	<range><lt>11.16</lt></range>
 </package>
 <package>
	<name>postgresql10-server</name>
	<range><lt>10.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote>
	 
	 Confine additional operations within "security restricted
	 operation" sandboxes.
	 
	 
	 Autovacuum, CLUSTER, CREATE INDEX, REINDEX, REFRESH MATERIALIZED VIEW,
	 and pg_amcheck activated the "security restricted operation" protection
	 mechanism too late, or even not at all in some code paths.
	 A user having permission to create non-temporary objects within a
	 database could define an object that would execute arbitrary SQL
	 code with superuser permissions the next time that autovacuum
	 processed the object, or that some superuser ran one of the affected
	 commands against it.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1552</cvename>
 </references>
 <dates>
 <discovery>2022-05-11</discovery>
 <entry>2022-05-11</entry>
 </dates>
 </vuln>

<vuln vid="ac91cf5e-d098-11ec-bead-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>101.0.4951.64</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html">
	 This release contains 13 security fixes, including:
	 <ul>
	 <li>[1316990] High CVE-2022-1633: Use after free in Sharesheet. Reported by Khalil Zhani on 2022-04-18</li>
	 <li>[1314908] High CVE-2022-1634: Use after free in Browser UI. Reported by Khalil Zhani on 2022-04-09</li>
	 <li>[1319797] High CVE-2022-1635: Use after free in Permission Prompts. Reported by Anonymous on 2022-04-26</li>
	 <li>[1297283] High CVE-2022-1636: Use after free in Performance APIs. Reported by Seth Brenith, Microsoft on 2022-02-15</li>
	 <li>[1311820] High CVE-2022-1637: Inappropriate implementation in Web Contents. Reported by Alesandro Ortiz on 2022-03-31</li>
	 <li>[1316946] High CVE-2022-1638: Heap buffer overflow in V8 Internationalization. Reported by DoHyun Lee (@l33d0hyun) of DNSLab, Korea University on 2022-04-17</li>
	 <li>[1317650] High CVE-2022-1639: Use after free in ANGLE. Reported by SeongHwan Park (SeHwa) on 2022-04-19</li>
	 <li>[1320592] High CVE-2022-1640: Use after free in Sharing. Reported by Weipeng Jiang (@Krace) and Guang Gong of 360 Vulnerability Research Institute on 2022-04-28</li>
	 <li>[1305068] Medium CVE-2022-1641: Use after free in Web UI Diagnostics. Reported by Rong Jian of VRI on 2022-03-10</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1633</cvename>
 <cvename>CVE-2022-1634</cvename>
 <cvename>CVE-2022-1635</cvename>
 <cvename>CVE-2022-1636</cvename>
 <cvename>CVE-2022-1637</cvename>
 <cvename>CVE-2022-1638</cvename>
 <cvename>CVE-2022-1639</cvename>
 <cvename>CVE-2022-1640</cvename>
 <cvename>CVE-2022-1641</cvename>
 <url>https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html</url>
 </references>
 <dates>
 <discovery>2022-05-10</discovery>
 <entry>2022-05-10</entry>
 </dates>
 </vuln>

<vuln vid="b9837fa1-cd72-11ec-98f1-6805ca0b3d42">
 <topic>rsyslog8 -- heap buffer overflow on receiving TCP syslog</topic>
 <affects>
 <package>
	<name>rsyslog</name>
	<range><lt>8.2204.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Rainer Gerhards reports:
	<blockquote cite="https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8">
	 Modules for TCP syslog reception have a heap buffer
	 overflow when octet-counted framing is used. The attacker
	 can corrupt heap values, leading to data integrity issues
	 and availability impact. Remote code execution is unlikely
	 to happen but not impossible..
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-24903</cvename>
 <url>https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8</url>
 </references>
 <dates>
 <discovery>2022-05-05</discovery>
 <entry>2022-05-06</entry>
 </dates>
 </vuln>

<vuln vid="647ac600-cc70-11ec-9cfc-10c37b4ac2ea">
 <topic>gogs -- XSS in issue attachments</topic>
 <affects>
 <package>
	<name>gogs</name>
	<range><lt>0.12.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The gogs project reports:
	<blockquote cite="https://github.com/gogs/gogs/issues/6919">
	 Repository issues page allows HTML attachments with arbitrary
	 JS code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1464</cvename>
 <url>https://github.com/gogs/gogs/issues/6919</url>
 <url>https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d/</url>
 </references>
 <dates>
 <discovery>2022-04-12</discovery>
 <entry>2022-05-05</entry>
 </dates>
 </vuln>

<vuln vid="95ee401d-cc6a-11ec-9cfc-10c37b4ac2ea">
 <topic>gitea -- Escape git fetch remote</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.16.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/pull/19487">
	 Escape git fetch remote in
	 services/migrations/gitea_uploader.go
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/pull/19487</url>
 </references>
 <dates>
 <discovery>2022-04-25</discovery>
 <entry>2022-05-05</entry>
 </dates>
 </vuln>

<vuln vid="fceb2b08-cb76-11ec-a06f-d4c9ef517024">
 <topic>OpenSSL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.1.1o,1</lt></range>
 </package>
 <package>
	<name>openssl-devel</name>
	<range><lt>3.0.3</lt></range>
 </package>
 <package>
	<name>openssl-quictls</name>
	<range><lt>3.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20220503.txt">
	 <ul>
	 <li>The c_rehash script allows command injection (CVE-2022-1292)
	 (Moderate) The c_rehash script does not properly sanitise shell
	 metacharacters to prevent command injection. This script is distributed
	 by some operating systems in a manner where it is automatically
	 executed. On such operating systems, an attacker could execute arbitrary
	 commands with the privileges of the script.</li>
	 <li>OCSP_basic_verify may incorrectly verify the response signing
	 certificate (CVE-2022-1343) (Moderate) The function
	 `OCSP_basic_verify` verifies the signer certificate on an OCSP response.
	 In the case where the (non-default) flag OCSP_NOCHECKS is used then the
	 response will be positive (meaning a successful verification) even in
	 the case where the response signing certificate fails to verify.</li>
	 <li>Incorrect MAC key used in the RC4-MD5 ciphersuite (CVE-2022-1434)
	 (Low) The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite
	 incorrectly uses the AAD data as the MAC key. This makes the MAC key
	 trivially predictable.</li>
	 <li>Resource leakage when decoding certificates and keys (CVE-2022-1473)
	 (Low) The OPENSSL_LH_flush() function, which empties a hash table,
	 containsa bug that breaks reuse of the memory occuppied by the removed
	 hash table entries.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1292</cvename>
 <cvename>CVE-2022-1343</cvename>
 <cvename>CVE-2022-1434</cvename>
 <cvename>CVE-2022-1473</cvename>
 <url>https://www.openssl.org/news/secadv/20220503.txt</url>
 </references>
 <dates>
 <discovery>2022-05-03</discovery>
 <entry>2022-05-04</entry>
 <modified>2022-05-05</modified>
 </dates>
 </vuln>

<vuln vid="a8118db0-cac2-11ec-9288-0800270512f4">
 <topic>rainloop -- cross-site-scripting (XSS) vulnerability</topic>
 <affects>
 <package>
	<name>rainloop-php74</name>
	<name>rainloop-php80</name>
	<name>rainloop-php81</name>
	<name>rainloop-community-php74</name>
	<name>rainloop-community-php80</name>
	<name>rainloop-community-php81</name>
	<range><lt>1.16.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Scannell reports:
	<blockquote cite="https://blog.sonarsource.com/rainloop-emails-at-risk-due-to-code-flaw">
	 
	 The code vulnerability can be easily exploited by an
	 attacker by sending a malicious email to a victim that
	 uses RainLoop as a mail client. When the email is viewed
	 by the victim, the attacker gains full control over the
	 session of the victim and can steal any of their emails,
	 including those that contain highly sensitive information
	 such as passwords, documents, and password reset links.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-29360</cvename>
 <url>https://blog.sonarsource.com/rainloop-emails-at-risk-due-to-code-flaw</url>
 <url>https://github.com/RainLoop/rainloop-webmail/issues/2142</url>
 </references>
 <dates>
 <discovery>2022-04-19</discovery>
 <entry>2022-05-03</entry>
 </dates>
 </vuln>

<vuln vid="61bce714-ca0c-11ec-9cfc-10c37b4ac2ea">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.18.1,1</lt></range>
 </package>
 <package>
	<name>go117</name>
	<range><lt>1.17.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/51853">
	 encoding/pem: fix stack overflow in Decode.
	 A large (more than 5 MB) PEM input can cause a stack
	 overflow in Decode, leading the program to crash.
	</blockquote>
	<blockquote cite="https://github.com/golang/go/issues/52075">
	 crypto/elliptic: tolerate all oversized scalars in generic
	 P-256.
	 A crafted scalar input longer than 32 bytes can
	 cause P256().ScalarMult or P256().ScalarBaseMult to panic.
	 Indirect uses through crypto/ecdsa and crypto/tls are
	 unaffected. amd64, arm64, ppc64le, and s390x are
	 unaffected.
	</blockquote>
	<blockquote cite="https://github.com/golang/go/issues/51759">
	 crypto/x509: non-compliant certificates can cause a panic
	 in Verify on macOS in Go 1.18.
	 Verifying certificate chains containing certificates
	 which are not compliant with RFC 5280 causes
	 Certificate.Verify to panic on macOS. These chains can be
	 delivered through TLS and can cause a crypto/tls or
	 net/http client to crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-24675</cvename>
 <url>https://github.com/golang/go/issues/51853</url>
 <cvename>CVE-2022-28327</cvename>
 <url>https://github.com/golang/go/issues/52075</url>
 <cvename>CVE-2022-27536</cvename>
 <url>https://github.com/golang/go/issues/51759</url>
 </references>
 <dates>
 <discovery>2022-04-12</discovery>
 <entry>2022-05-02</entry>
 </dates>
 </vuln>

<vuln vid="9db93f3d-c725-11ec-9618-000d3ac47524">
 <topic>Rails -- XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-actionpack52</name>
	<range><lt>5.2.7.1</lt></range>
 </package>
 <package>
	<name>rubygem-actionpack60</name>
	<range><lt>6.0.4.8</lt></range>
 </package>
 <package>
	<name>rubygem-actionpack61</name>
	<range><lt>6.1.5.1</lt></range>
 </package>
 <package>
	<name>rubygem-actionpack70</name>
	<range><lt>7.0.2.4</lt></range>
 </package>
 <package>
	<name>rubygem-actionview52</name>
	<range><lt>5.2.7.1</lt></range>
 </package>
 <package>
	<name>rubygem-actionview60</name>
	<range><lt>6.0.4.8</lt></range>
 </package>
 <package>
	<name>rubygem-actionview61</name>
	<range><lt>6.1.5.1</lt></range>
 </package>
 <package>
	<name>rubygem-actionview70</name>
	<range><lt>7.0.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails blog:
	<blockquote cite="https://rubyonrails.org/2022/4/26/Rails-7-0-2-4-6-1-5-1-6-0-4-8-and-5-2-7-1-have-been-released">
	 This is an announcement to let you know that Rails 7.0.2.4, 6.1.5.1,
	 6.0.4.8, and 5.2.7.1 have been released!
	 These are security releases so please update as soon as you can. Once
	 again we've made these releases based on the last release tag, so
	 hopefully upgrading will go smoothly.
	 The releases address two vulnerabilities, CVE-2022-22577, and
	 CVS-2022-27777. They are both XSS vulnerabilities, so please take a look
	 at the forum posts to see how (or if) they might possibly impact your
	 application.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-22577</cvename>
 <cvename>CVE-2022-27777</cvename>
 <url>https://rubyonrails.org/2022/4/26/Rails-7-0-2-4-6-1-5-1-6-0-4-8-and-5-2-7-1-have-been-released</url>
 </references>
 <dates>
 <discovery>2022-04-26</discovery>
 <entry>2022-04-30</entry>
 </dates>
 </vuln>

<vuln vid="2220827b-c732-11ec-b272-901b0e934d69">
 <topic>hiredis -- integer/buffer overflow</topic>
 <affects>
 <package>
	<name>hiredis</name>
	<range><lt>1.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	hiredis maintainers report:
	<blockquote cite="https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2">
	 
	 Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted RESP mult-bulk protocol data.

When parsing multi-bulk (array-like) replies, hiredis fails to check if count * sizeof(redisReply*) can be represented in SIZE_MAX. If it can not, and the calloc() call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-32765</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32765</url>
 <url>https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2</url>
 </references>
 <dates>
 <discovery>2021-10-04</discovery>
 <entry>2022-04-29</entry>
 </dates>
 </vuln>

<vuln vid="92a4d881-c6cf-11ec-a06f-d4c9ef517024">
 <topic>cURL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>7.83.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports:
	<blockquote cite="https://curl.se/docs/vuln-7.82.0.html">
	 <ul>
	 <li>OAUTH2 bearer bypass in connection re-use (CVE-2022-22576)</li>
	 <li>Credential leak on redirect (CVE-2022-27774)</li>
	 <li>Bad local IPv6 connection reuse (CVE-2022-27775)</li>
	 <li>Auth/cookie leak on redirect (CVE-2022-27776)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-22576</cvename>
 <cvename>CVE-2022-27774</cvename>
 <cvename>CVE-2022-27775</cvename>
 <cvename>CVE-2022-27776</cvename>
 <url>https://curl.se/docs/vuln-7.82.0.html</url>
 </references>
 <dates>
 <discovery>2022-04-27</discovery>
 <entry>2022-04-28</entry>
 </dates>
 </vuln>

<vuln vid="26f2123b-c6c6-11ec-b66f-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>101.0.4951.41</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html">
	 This release contains 30 security fixes, including:
	 <ul>
	 <li>[1313905] High CVE-2022-1477: Use after free in Vulkan. Reported by SeongHwan Park (SeHwa) on 2022-04-06</li>
	 <li>[1299261] High CVE-2022-1478: Use after free in SwiftShader. Reported by SeongHwan Park (SeHwa) on 2022-02-20</li>
	 <li>[1305190] High CVE-2022-1479: Use after free in ANGLE. Reported by Jeonghoon Shin of Theori on 2022-03-10</li>
	 <li>[1307223] High CVE-2022-1480: Use after free in Device API. Reported by @uwu7586 on 2022-03-17</li>
	 <li>[1302949] High CVE-2022-1481: Use after free in Sharing. Reported by Weipeng Jiang (@Krace) and Guang Gong of 360 Vulnerability Research Institute on 2022-03-04</li>
	 <li>[1304987] High CVE-2022-1482: Inappropriate implementation in WebGL. Reported by Christoph Diehl, Microsoft on 2022-03-10</li>
	 <li>[1314754] High CVE-2022-1483: Heap buffer overflow in WebGPU. Reported by Mark Brand of Google Project Zero on 2022-04-08</li>
	 <li>[1297429] Medium CVE-2022-1484: Heap buffer overflow in Web UI Settings. Reported by Chaoyuan Peng (@ret2happy) on 2022-02-15</li>
	 <li>[1299743] Medium CVE-2022-1485: Use after free in File System API. Reported by Anonymous on 2022-02-22</li>
	 <li>[1314616] Medium CVE-2022-1486: Type Confusion in V8. Reported by Brendon Tiszka on 2022-04-08</li>
	 <li>[1304368] Medium CVE-2022-1487: Use after free in Ozone. Reported by Sri on 2022-03-09</li>
	 <li>[1302959] Medium CVE-2022-1488: Inappropriate implementation in Extensions API. Reported by Thomas Beverley from Wavebox.io on 2022-03-04</li>
	 <li>[1300561] Medium CVE-2022-1489: Out of bounds memory access in UI Shelf. Reported by Khalil Zhani on 2022-02-25</li>
	 <li>[1301840] Medium CVE-2022-1490: Use after free in Browser Switcher. Reported by raven at KunLun lab on 2022-03-01</li>
	 <li>[1305706] Medium CVE-2022-1491: Use after free in Bookmarks. Reported by raven at KunLun lab on 2022-03-12</li>
	 <li>[1315040] Medium CVE-2022-1492: Insufficient data validation in Blink Editing. Reported by Michal Bentkowski of Securitum on 2022-04-11</li>
	 <li>[1275414] Medium CVE-2022-1493: Use after free in Dev Tools. Reported by Zhihua Yao of KunLun Lab on 2021-12-01</li>
	 <li>[1298122] Medium CVE-2022-1494: Insufficient data validation in Trusted Types. Reported by Masato Kinugawa on 2022-02-17</li>
	 <li>[1301180] Medium CVE-2022-1495: Incorrect security UI in Downloads. Reported by Umar Farooq on 2022-02-28</li>
	 <li>[1306391] Medium CVE-2022-1496: Use after free in File Manager. Reported by Zhiyi Zhang and Zhunki from Codesafe Team of Legendsec at Qi'anxin Group on 2022-03-15</li>
	 <li>[1264543] Medium CVE-2022-1497: Inappropriate implementation in Input. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-10-29</li>
	 <li>[1297138] Low CVE-2022-1498: Inappropriate implementation in HTML Parser. Reported by SeungJu Oh (@real_as3617) on 2022-02-14</li>
	 <li>[1000408] Low CVE-2022-1499: Inappropriate implementation in WebAuthentication. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2019-09-04</li>
	 <li>[1223475] Low CVE-2022-1500: Insufficient data validation in Dev Tools. Reported by Hoang Nguyen on 2021-06-25</li>
	 <li>[1293191] Low CVE-2022-1501: Inappropriate implementation in iframe. Reported by Oriol Brufau on 2022-02-02</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1477</cvename>
 <cvename>CVE-2022-1478</cvename>
 <cvename>CVE-2022-1479</cvename>
 <cvename>CVE-2022-1480</cvename>
 <cvename>CVE-2022-1481</cvename>
 <cvename>CVE-2022-1482</cvename>
 <cvename>CVE-2022-1483</cvename>
 <cvename>CVE-2022-1484</cvename>
 <cvename>CVE-2022-1485</cvename>
 <cvename>CVE-2022-1486</cvename>
 <cvename>CVE-2022-1487</cvename>
 <cvename>CVE-2022-1488</cvename>
 <cvename>CVE-2022-1489</cvename>
 <cvename>CVE-2022-1490</cvename>
 <cvename>CVE-2022-1491</cvename>
 <cvename>CVE-2022-1492</cvename>
 <cvename>CVE-2022-1493</cvename>
 <cvename>CVE-2022-1494</cvename>
 <cvename>CVE-2022-1495</cvename>
 <cvename>CVE-2022-1496</cvename>
 <cvename>CVE-2022-1497</cvename>
 <cvename>CVE-2022-1498</cvename>
 <cvename>CVE-2022-1499</cvename>
 <cvename>CVE-2022-1500</cvename>
 <cvename>CVE-2022-1501</cvename>
 <url>https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html</url>
 </references>
 <dates>
 <discovery>2022-04-26</discovery>
 <entry>2022-04-28</entry>
 </dates>
 </vuln>

<vuln vid="cc42db1c-c65f-11ec-ad96-0800270512f4">
 <topic>redis -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><lt>6.2.7</lt></range>
 </package>
 <package>
	<name>redis-devel</name>
	<range><lt>7.0.0.20220428</lt></range>
 </package>
 <package>
	<name>redis62</name>
	<range><lt>6.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aviv Yahav reports:
	<blockquote cite="https://groups.google.com/g/redis-db/c/7iWUlwtoDqU">
	 <dl>
	 <dt>CVE-2022-24735</dt>
	 <dd>
	 By exploiting weaknesses in the Lua script execution
	 environment, an attacker with access to Redis can inject
	 Lua code that will execute with the (potentially higher)
	 privileges of another Redis user.
	 </dd>
	 <dt>CVE-2022-24736</dt>
	 <dd>
	 An attacker attempting to load a specially crafted Lua
	 script can cause NULL pointer dereference which will
	 result with a crash of the redis-server process.
	 </dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-24735</cvename>
 <cvename>CVE-2022-24736</cvename>
 <url>https://groups.google.com/g/redis-db/c/7iWUlwtoDqU</url>
 </references>
 <dates>
 <discovery>2022-04-27</discovery>
 <entry>2022-04-27</entry>
 </dates>
 </vuln>

<vuln vid="17a30a24-c579-11ec-bbbd-0800270512f4">
 <topic>eb -- Potential buffer overrun vulnerability</topic>
 <affects>
 <package>
	<name>ja-eb</name>
	<range><lt>4.4.3_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kazuhiro Ito reports:
	<blockquote cite="mailto:edict@ring.gr.jp">
	 Potential buffer overrun vulnerability is found in eb/multiplex.c.
	</blockquote>
 </body>
 </description>
 <references>
 <url>mailto:edict@ring.gr.jp</url>
 </references>
 <dates>
 <discovery>2022-04-25</discovery>
 <entry>2022-04-26</entry>
 </dates>
 </vuln>

<vuln vid="a00c76d9-0c05-4d99-bef7-ae4521cb2a4d">
 <topic>zeek -- potential DoS vulnerabilty</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>4.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v4.0.6">
	 Fix potential unbounded state growth in the FTP
	 analyzer when receiving a specially-crafted stream of
	 commands. This may lead to a buffer overflow and cause
	 Zeek to crash. Due to the possibility of this happening
	 with packets received from the network, this is a potential
	 DoS vulnerabilty. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v4.0.6</url>
 </references>
 <dates>
 <discovery>2022-04-21</discovery>
 <entry>2022-04-21</entry>
 </dates>
 </vuln>

<vuln vid="b019585a-bfea-11ec-b46c-b42e991fc52e">
 <topic>zgrep -- arbitrary file write</topic>
 <affects>
 <package>
	<name>gzip</name>
	<range><lt>1.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RedHat reports:
	<blockquote cite="https://access.redhat.com/security/cve/cve-2022-1271">
	 An arbitrary file write vulnerability was found in GNU
		gzip's zgrep utility. When zgrep is applied on the
		attacker's chosen file name (for example, a crafted
		file name), this can overwrite an attacker's content
		to an arbitrary attacker-selected file. This flaw
		occurs due to insufficient validation when processing
		filenames with two or more newlines where selected
		content and the target file names are embedded in
		crafted multi-line file names. This flaw allows a
		remote, low privileged attacker to force zgrep to
		write arbitrary files on the system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1271</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=2073310</url>
 </references>
 <dates>
 <discovery>2022-04-07</discovery>
 <entry>2022-04-19</entry>
 </dates>
 </vuln>

<vuln vid="2a314635-be46-11ec-a06f-d4c9ef517024">
 <topic>Nextcloud Calendar -- SMTP Command Injection</topic>
 <affects>
 <package>
	<name>nextcloud-calendar</name>
	<range><lt>3.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 reports:
	<blockquote cite="https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8xv5-4855-24qf">
	 SMTP Command Injection in Appointment Emails via Newlines: as newlines
	 and special characters are not sanitized in the email value in the JSON
	 request, a malicious attacker can inject newlines to break out of the
	 `RCPT TO:&lt;BOOKING USER'S EMAIL&gt;` SMTP command and begin injecting
	 arbitrary SMTP commands.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-24838</cvename>
 <url>https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8xv5-4855-24qf</url>
 </references>
 <dates>
 <discovery>2022-04-11</discovery>
 <entry>2022-04-17</entry>
 </dates>
 </vuln>

<vuln vid="add683be-bd76-11ec-a06f-d4c9ef517024">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.38</lt></range>
 </package>
 <package>
	<name>mysql80-client</name>
	<range><lt>8.0.29</lt></range>
 </package>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.29</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpuapr2022.html">
	 The 2022 April Critical Patch Update contains 43 new security
	 patches for Oracle MySQL. 11 of these vulnerabilities may be
	 remotely exploitable without authentication, i.e., may be
	 exploited over a network without requiring user credentials.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/security-alerts/cpuapr2022.html</url>
 <cvename>CVE-2022-0778</cvename>
 <cvename>CVE-2021-22570</cvename>
 <cvename>CVE-2022-0778</cvename>
 <cvename>CVE-2022-21454</cvename>
 <cvename>CVE-2022-21482</cvename>
 <cvename>CVE-2022-21483</cvename>
 <cvename>CVE-2022-21489</cvename>
 <cvename>CVE-2022-21490</cvename>
 <cvename>CVE-2022-21457</cvename>
 <cvename>CVE-2022-21425</cvename>
 <cvename>CVE-2022-21440</cvename>
 <cvename>CVE-2022-21459</cvename>
 <cvename>CVE-2022-21478</cvename>
 <cvename>CVE-2022-21479</cvename>
 <cvename>CVE-2022-21418</cvename>
 <cvename>CVE-2022-21417</cvename>
 <cvename>CVE-2022-21413</cvename>
 <cvename>CVE-2022-21427</cvename>
 <cvename>CVE-2022-21412</cvename>
 <cvename>CVE-2022-21414</cvename>
 <cvename>CVE-2022-21435</cvename>
 <cvename>CVE-2022-21436</cvename>
 <cvename>CVE-2022-21437</cvename>
 <cvename>CVE-2022-21438</cvename>
 <cvename>CVE-2022-21452</cvename>
 <cvename>CVE-2022-21462</cvename>
 <cvename>CVE-2022-21415</cvename>
 <cvename>CVE-2022-21451</cvename>
 <cvename>CVE-2022-21444</cvename>
 <cvename>CVE-2022-21460</cvename>
 <cvename>CVE-2022-21484</cvename>
 <cvename>CVE-2022-21485</cvename>
 <cvename>CVE-2022-21486</cvename>
 <cvename>CVE-2022-21423</cvename>
 </references>
 <dates>
 <discovery>2022-04-16</discovery>
 <entry>2022-04-16</entry>
 <modified>2022-05-23</modified>
 </dates>
 </vuln>

<vuln vid="a25ea27b-bced-11ec-87b5-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>100.0.4896.127</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_14.html">
	 This release contains 2 security fixes, including:
	 <ul>
	 <li>[1315901] High CVE-2022-1364: Type Confusion in V8. Reported by Clément Lecigne of Google's Threat Analysis Group on 2022-0-13</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1364</cvename>
 <url>https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_14.html</url>
 </references>
 <dates>
 <discovery>2022-04-14</discovery>
 <entry>2022-04-15</entry>
 </dates>
 </vuln>

<vuln vid="a5de43ed-bc49-11ec-b516-0897988a1c07">
 <topic>Asterisk -- func_odbc: Possible SQL Injection</topic>
 <affects>
 <package>
	<name>asterisk16</name>
	<range><lt>16.25.2</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><lt>18.11.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories/">
	 Some databases can use backslashes to escape certain
	 characters, such as backticks. If input is provided to
	 func_odbc which includes backslashes it is possible for
	 func_odbc to construct a broken SQL query and the SQL
	 query to fail.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-26651</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2022-003.html</url>
 </references>
 <dates>
 <discovery>2022-04-14</discovery>
 <entry>2022-04-14</entry>
 </dates>
 </vuln>

<vuln vid="8838abf0-bc47-11ec-b516-0897988a1c07">
 <topic>Asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk16</name>
	<range><gt>16.15.0</gt><lt>16.25.2</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><lt>18.11.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories/">
	 AST-2022-001 - When using STIR/SHAKEN, its possible
	 to download files that are not certificates. These files
	 could be much larger than what you would expect to
	 download.
	 AST-2022-002 - When using STIR/SHAKEN, its possible
	 to send arbitrary requests like GET to interfaces such
	 as localhost using the Identity header.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-26498</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2022-001.html</url>
 <cvename>CVE-2022-26499</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2022-002.html</url>
 </references>
 <dates>
 <discovery>2022-04-14</discovery>
 <entry>2022-04-14</entry>
 </dates>
 </vuln>

<vuln vid="24a9bd2b-bb43-11ec-af81-0897988a1c07">
 <topic>Composer -- Command injection vulnerability</topic>
 <affects>
 <package>
	<name>php74-composer</name>
	<name>php80-composer</name>
	<name>php81-composer</name>
	<range><lt>1.10.26</lt></range>
 </package>
 <package>
	<name>php74-composer2</name>
	<name>php80-composer2</name>
	<name>php81-composer2</name>
	<range><ge>2.0.0</ge><lt>2.2.12</lt></range>
	<range><ge>2.3.0</ge><lt>2.3.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Composer developers reports:
	<blockquote cite="https://github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6">
	 The Composer method VcsDriver::getFileContent() with
	 user-controlled $file or $identifier arguments is susceptible
	 to an argument injection vulnerability. It can be leveraged
	 to gain arbitrary command execution if the Mercurial or
	 the Git driver are used.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-24828</cvename>
 <url>https://github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6</url>
 </references>
 <dates>
 <discovery>2022-04-13</discovery>
 <entry>2022-04-13</entry>
 </dates>
 </vuln>

<vuln vid="3a1dc8c8-bb27-11ec-98d1-d43d7eed0ce2">
 <topic>Subversion -- Multiple vulnerabilities in server code</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><ge>1.10.0</ge><lt>1.10.8</lt></range>
	<range><ge>1.11.0</ge><lt>1.14.2</lt></range>
 </package>
 <package>
	<name>mod_dav_svn</name>
	<range><ge>1.10.0</ge><lt>1.10.8</lt></range>
	<range><ge>1.11.0</ge><lt>1.14.2</lt></range>
 </package>
 <package>
	<name>subversion-lts</name>
	<range><ge>1.10.0</ge><lt>1.10.8</lt></range>
 </package>
 <package>
	<name>mod_dav_svn-lts</name>
	<range><ge>1.10.0</ge><lt>1.10.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion project reports:
	<blockquote cite="https://subversion.apache.org/security/CVE-2021-28544-advisory.txt">
	 
	 Subversion servers reveal 'copyfrom' paths that should be hidden according
	 to configured path-based authorization (authz) rules. When a node has been
	 copied from a protected location, users with access to the copy can see the
	 'copyfrom' path of the original. This also reveals the fact that the node
	 was copied. Only the 'copyfrom' path is revealed; not its contents. Both
	 httpd and svnserve servers are vulnerable.
	 
	</blockquote>
	<blockquote cite="https://subversion.apache.org/security/CVE-2022-24070-advisory.txt">
	 
	 While looking up path-based authorization rules, mod_dav_svn servers
	 may attempt to use memory which has already been freed.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-28544</cvename>
 <cvename>CVE-2022-24070</cvename>
 <url>https://subversion.apache.org/security/CVE-2021-28544-advisory.txt</url>
 <url>https://subversion.apache.org/security/CVE-2022-24070-advisory.txt</url>
 </references>
 <dates>
 <discovery>2022-04-12</discovery>
 <entry>2022-04-13</entry>
 </dates>
 </vuln>

<vuln vid="06ed6a49-bad4-11ec-9cfe-0800270512f4">
 <topic>Ruby -- Buffer overrun in String-to-Float conversion</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>2.7.0,1</ge><lt>2.7.6,1</lt></range>
	<range><ge>3.0.0,1</ge><lt>3.0.4,1</lt></range>
	<range><ge>3.1.0,1</ge><lt>3.1.2,1</lt></range>
	<range><ge>3.2.0.p1,1</ge><lt>3.2.0.p1_1,1</lt></range>
 </package>
 <package>
	<name>ruby27</name>
	<range><ge>2.7.0,1</ge><lt>2.7.6,1</lt></range>
 </package>
 <package>
	<name>ruby30</name>
	<range><ge>3.0.0,1</ge><lt>3.0.4,1</lt></range>
 </package>
 <package>
	<name>ruby31</name>
	<range><ge>3.1.0,1</ge><lt>3.1.2,1</lt></range>
 </package>
 <package>
	<name>ruby32</name>
	<range><ge>3.2.0.p1,1</ge><lt>3.2.0.p1_1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	piao reports:
	<blockquote cite="https://www.ruby-lang.org/en/news/2022/04/12/buffer-overrun-in-string-to-float-cve-2022-28739/">
	 
	 Due to a bug in an internal function that converts a String
	 to a Float, some convertion methods like <code>Kernel#Float</code>
	 and <code>String#to_f</code> could cause buffer over-read.
	 A typical consequence is a process termination due to
	 segmentation fault, but in a limited circumstances, it may
	 be exploitable for illegal memory read.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-28739</cvename>
 <url>https://www.ruby-lang.org/en/news/2022/04/12/buffer-overrun-in-string-to-float-cve-2022-28739/</url>
 </references>
 <dates>
 <discovery>2022-04-12</discovery>
 <entry>2022-04-13</entry>
 </dates>
 </vuln>

<vuln vid="f22144d7-bad1-11ec-9cfe-0800270512f4">
 <topic>Ruby -- Double free in Regexp compilation</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>3.0.0,1</ge><lt>3.0.4,1</lt></range>
	<range><ge>3.1.0,1</ge><lt>3.1.2,1</lt></range>
	<range><ge>3.2.0.p1,1</ge><lt>3.2.0.p1_1,1</lt></range>
 </package>
 <package>
	<name>ruby30</name>
	<range><ge>3.0.0,1</ge><lt>3.0.4,1</lt></range>
 </package>
 <package>
	<name>ruby31</name>
	<range><ge>3.1.0,1</ge><lt>3.1.2,1</lt></range>
 </package>
 <package>
	<name>ruby32</name>
	<range><ge>3.2.0.p1,1</ge><lt>3.2.0.p1_1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	piao reports:
	<blockquote cite="https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/">
	 
	 Due to a bug in the Regexp compilation process, creating
	 a Regexp object with a crafted source string could cause
	 the same memory to be freed twice. This is known as a
	 "double free" vulnerability. Note that, in general, it
	 is considered unsafe to create and use a Regexp object
	 generated from untrusted input. In this case, however,
	 following a comprehensive assessment, we treat this issue
	 as a vulnerability.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-28738</cvename>
 <url>https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/</url>
 </references>
 <dates>
 <discovery>2022-04-12</discovery>
 <entry>2022-04-13</entry>
 </dates>
 </vuln>

<vuln vid="6eb9cf14-bab0-11ec-8f59-4437e6ad11c4">
 <topic>mutt -- mutt_decode_uuencoded() can read past the of the input line</topic>
 <affects>
 <package>
	<name>mutt</name>
	<range><lt>2.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tavis Ormandy reports:
	<blockquote cite="https://gitlab.com/muttmua/mutt/-/issues/404">
	 mutt_decode_uuencoded(), the line length is read from the untrusted uuencoded part without validation. This could result in including private memory in message parts, for example fragments of other messages, passphrases or keys in replys
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1328</cvename>
 <url>https://gitlab.com/muttmua/mutt/-/issues/404</url>
 </references>
 <dates>
 <discovery>2022-04-04</discovery>
 <entry>2022-04-12</entry>
 </dates>
 </vuln>

<vuln vid="b582a85a-ba4a-11ec-8d1e-3065ec8fd3ec">
 <topic>Chromium -- mulitple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>100.0.4896.88</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html">
	 This release contains 11 security fixes, including:
	 <ul>
	 <li>[1285234] High CVE-2022-1305: Use after free in storage. Reported by Anonymous on 2022-01-07</li>
	 <li>[1299287] High CVE-2022-1306: Inappropriate implementation in compositing. Reported by Sven Dysthe on 2022-02-21</li>
	 <li>[1301873] High CVE-2022-1307: Inappropriate implementation in full screen. Reported by Irvan Kurniawan (sourc7) on 2022-03-01</li>
	 <li>[1283050] High CVE-2022-1308: Use after free in BFCache. Reported by Samet Bekmezci (@sametbekmezci) on 2021-12-28</li>
	 <li>[1106456] High CVE-2022-1309: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-07-17</li>
	 <li>[1307610] High CVE-2022-1310: Use after free in regular expressions. Reported by Brendon Tiszka on 2022-03-18</li>
	 <li>[1310717] High CVE-2022-1311: Use after free in Chrome OS shell. Reported by Nan Wang (@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-03-28</li>
	 <li>[1311701] High CVE-2022-1312: Use after free in storage. Reported by Leecraso and Guang Gong of 360 Vulnerability Research Institute on 2022-03-30</li>
	 <li>[1270539] Medium CVE-2022-1313: Use after free in tab groups. Reported by Thomas Orlita on 2021-11-16</li>
	 <li>[1304658] Medium CVE-2022-1314: Type Confusion in V8. Reported by Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu Lab on 2022-03-09</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1305</cvename>
 <cvename>CVE-2022-1306</cvename>
 <cvename>CVE-2022-1307</cvename>
 <cvename>CVE-2022-1308</cvename>
 <cvename>CVE-2022-1309</cvename>
 <cvename>CVE-2022-1310</cvename>
 <cvename>CVE-2022-1311</cvename>
 <cvename>CVE-2022-1312</cvename>
 <cvename>CVE-2022-1313</cvename>
 <cvename>CVE-2022-1314</cvename>
 <url>https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html</url>
 </references>
 <dates>
 <discovery>2022-04-11</discovery>
 <entry>2022-04-12</entry>
 </dates>
 </vuln>

<vuln vid="0db46f84-b9fa-11ec-89df-080027240888">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py37-django22</name>
	<name>py38-django22</name>
	<name>py39-django22</name>
	<name>py310-django22</name>
	<range><lt>2.2.28</lt></range>
 </package>
 <package>
	<name>py37-django32</name>
	<name>py38-django32</name>
	<name>py39-django32</name>
	<name>py310-django32</name>
	<range><lt>3.2.13</lt></range>
 </package>
 <package>
	<name>py38-django40</name>
	<name>py39-django40</name>
	<name>py310-django40</name>
	<range><lt>4.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django Release reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2022/apr/11/security-releases/">
	 CVE-2022-28346: Potential SQL injection in QuerySet.annotate(), aggregate(), and extra().
	 CVE-2022-28347: Potential SQL injection via QuerySet.explain(**options) on PostgreSQL.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-28346</cvename>
 <cvename>CVE-2022-28347</cvename>
 <url>https://www.djangoproject.com/weblog/2022/apr/11/security-releases/</url>
 </references>
 <dates>
 <discovery>2022-04-02</discovery>
 <entry>2022-04-12</entry>
 </dates>
 </vuln>

<vuln vid="38f2e3a0-b61e-11ec-9ebc-1c697aa5a594">
 <topic>FreeBSD -- zlib compression out-of-bounds write</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.0</ge><lt>13.0_11</lt></range>
	<range><ge>12.3</ge><lt>12.3_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Certain inputs can cause zlib's compression routine to overwrite an
	internal buffer with compressed data. This issue may require the use
	of uncommon or non-default compression parameters.
	<h1>Impact:</h1>
	The out-of-bounds write may result in memory corruption and an
	application crash or kernel panic.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-25032</cvename>
 <freebsdsa>SA-22:08.zlib</freebsdsa>
 </references>
 <dates>
 <discovery>2022-04-06</discovery>
 <entry>2022-04-07</entry>
 </dates>
 </vuln>

<vuln vid="d4cc994f-b61d-11ec-9ebc-1c697aa5a594">
 <topic>FreeBSD -- 802.11 heap buffer overflow</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.0</ge><lt>13.0_11</lt></range>
	<range><ge>12.3</ge><lt>12.3_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The 802.11 beacon handling routine failed to validate the length of
	an IEEE 802.11s Mesh ID before copying it to a heap-allocated
	buffer.
	<h1>Impact:</h1>
	While a FreeBSD Wi-Fi client is in scanning mode (i.e., not
	associated with a SSID) a malicious beacon frame may overwrite kernel
	memory, leading to remote code execution.
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23088</cvename>
 <freebsdsa>SA-22:07.wifi_meshid</freebsdsa>
 </references>
 <dates>
 <discovery>2022-04-06</discovery>
 <entry>2022-04-07</entry>
 </dates>
 </vuln>

<vuln vid="703c4761-b61d-11ec-9ebc-1c697aa5a594">
 <topic>FreeBSD -- mpr/mps/mpt driver ioctl heap out-of-bounds write</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.0</ge><lt>13.0_11</lt></range>
	<range><ge>12.3</ge><lt>12.3_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and
	mpt drivers allocated a buffer of a caller-specified size, but
	copied to it a fixed size header. Other heap content would be
	overwritten if the specified size was too small.
	<h1>Impact:</h1>
	Users with access to the mpr, mps or mpt device node may overwrite
	heap data, potentially resulting in privilege escalation. Note that
	the device node is only accessible to root and members of the operator
	group.
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23086</cvename>
 <freebsdsa>SA-22:06.ioctl</freebsdsa>
 </references>
 <dates>
 <discovery>2022-04-06</discovery>
 <entry>2022-04-07</entry>
 </dates>
 </vuln>

<vuln vid="ba796b98-b61c-11ec-9ebc-1c697aa5a594">
 <topic>FreeBSD -- Bhyve e82545 device emulation out-of-bounds write</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.0</ge><lt>13.0_11</lt></range>
	<range><ge>12.3</ge><lt>12.3_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The e1000 network adapters permit a variety of modifications to an
	Ethernet packet when it is being transmitted. These include the
	insertion of IP and TCP checksums, insertion of an Ethernet VLAN
	header, and TCP segmentation offload ("TSO"). The e1000 device model
	uses an on-stack buffer to generate the modified packet header when
	simulating these modifications on transmitted packets.
	When checksum offload is requested for a transmitted packet, the
	e1000 device model used a guest-provided value to specify the checksum
	offset in the on-stack buffer. The offset was not validated for
	certain packet types.
	<h1>Impact:</h1>
	A misbehaving bhyve guest could overwrite memory in the bhyve
	process on the host, possibly leading to code execution in the host
	context.
	The bhyve process runs in a Capsicum sandbox, which (depending on
	the FreeBSD version and bhyve configuration) limits the impact of
	exploiting this issue.
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23087</cvename>
 <freebsdsa>SA-22:05.bhyve</freebsdsa>
 </references>
 <dates>
 <discovery>2022-04-06</discovery>
 <entry>2022-04-07</entry>
 </dates>
 </vuln>

<vuln vid="27d39055-b61b-11ec-9ebc-1c697aa5a594">
 <topic>FreeBSD -- Potential jail escape vulnerabilities in netmap</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.0</ge><lt>13.0_11</lt></range>
	<range><ge>12.3</ge><lt>12.3_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The total size of the user-provided nmreq to nmreq_copyin() was
	first computed and then trusted during the copyin. This
	time-of-check to time-of-use bug could lead to kernel memory
	corruption. [CVE-2022-23084]
	A user-provided integer option was passed to nmreq_copyin() without
	checking if it would overflow. This insufficient bounds checking
	could lead to kernel memory corruption. [CVE-2022-23085]
	<h1>Impact:</h1>
	On systems configured to include netmap in their devfs_ruleset, a
	privileged process running in a jail can affect the host
	environment.
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23084</cvename>
 <cvename>CVE-2022-23085</cvename>
 <freebsdsa>SA-22:04.netmap</freebsdsa>
 </references>
 <dates>
 <discovery>2022-04-06</discovery>
 <entry>2022-04-07</entry>
 </dates>
 </vuln>

<vuln vid="fe15f30a-b4c9-11ec-94a3-3065ec8fd3ec">
 <topic>chromium -- Type confusion in V8</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>100.0.4896.75</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop.html">
	 This release includes one security fix:
	 <ul>
	 <li>[1311641] High CVE-2022-1232: Type Confusion in V8. Reported by Sergei Glazunov of Google Project Zero on 2022-03-30</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1232</cvename>
 <url>https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2022-04-04</discovery>
 <entry>2022-04-05</entry>
 </dates>
 </vuln>

<vuln vid="8657eedd-b423-11ec-9559-001b217b3468">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>14.9.0</ge><lt>14.9.2</lt></range>
	<range><ge>14.8.0</ge><lt>14.8.5</lt></range>
	<range><ge>0</ge><lt>14.7.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/">
	 Static passwords inadvertently set during OmniAuth-based registration
	 Stored XSS in notes
	 Stored XSS on Multi-word milestone reference
	 Denial of service caused by a specially crafted RDoc file
	 GitLab Pages access tokens can be reused on multiple domains
	 GitLab Pages uses default (disabled) server Timeouts and a weak TCP Keep-Alive timeout
	 Incorrect include in pipeline definition exposes masked CI variables in UI
	 Regular expression denial of service in release asset link
	 Latest Commit details from private projects leaked to guest users via Merge Requests
	 CI/CD analytics are available even when public pipelines are disabled
	 Absence of limit for the number of tags that can be added to a runner can cause performance issues
	 Client DoS through rendering crafted comments
	 Blind SSRF Through Repository Mirroring
	 Bypass of branch restriction in Asana integration
	 Readable approval rules by Guest user
	 Redact InvalidURIError error messages
	 Project import maps members' created_by_id users based on source user ID
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1162</cvename>
 <cvename>CVE-2022-1175</cvename>
 <cvename>CVE-2022-1190</cvename>
 <cvename>CVE-2022-1185</cvename>
 <cvename>CVE-2022-1148</cvename>
 <cvename>CVE-2022-1121</cvename>
 <cvename>CVE-2022-1120</cvename>
 <cvename>CVE-2022-1100</cvename>
 <cvename>CVE-2022-1193</cvename>
 <cvename>CVE-2022-1105</cvename>
 <cvename>CVE-2022-1099</cvename>
 <cvename>CVE-2022-1174</cvename>
 <cvename>CVE-2022-1188</cvename>
 <cvename>CVE-2022-0740</cvename>
 <cvename>CVE-2022-1189</cvename>
 <cvename>CVE-2022-1157</cvename>
 <cvename>CVE-2022-1111</cvename>
 <url>https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/</url>
 </references>
 <dates>
 <discovery>2022-03-31</discovery>
 <entry>2022-04-04</entry>
 </dates>
 </vuln>

<vuln vid="79ea6066-b40e-11ec-8b93-080027b24e86">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki135</name>
	<range><lt>1.35.6</lt></range>
 </package>
 <package>
	<name>mediawiki136</name>
	<range><lt>1.36.4</lt></range>
 </package>
 <package>
	<name>mediawiki137</name>
	<range><lt>1.37.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawiki reports:
	<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/YJNXKPV5Z56NSUQ4G3SXPDUIZG5EQ7UR/">
	 (T297543, CVE-2022-28202) Messages widthheight/widthheightpage/nbytes not
	 escaped when used in galleries or Special:RevisionDelete.
	 (T297571, CVE-2022-28201) Title::newMainPage() goes into an infinite
	 recursion loop if it points to a local interwiki.
	 (T297731, CVE-2022-28203) Requesting Special:NewFiles on a wiki with many
	 file uploads with actor as a condition can result in a DoS.
	 (T297754, CVE-2022-28204) Special:WhatLinksHere can result in a DoS when
	 a page is used on a extremely large number of other pages.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-28201</cvename>
 <cvename>CVE-2022-28202</cvename>
 <cvename>CVE-2022-28203</cvename>
 <cvename>CVE-2022-28204</cvename>
 <url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/YJNXKPV5Z56NSUQ4G3SXPDUIZG5EQ7UR/</url>
 </references>
 <dates>
 <discovery>2021-12-12</discovery>
 <entry>2022-04-04</entry>
 </dates>
 </vuln>

<vuln vid="3f321a5a-b33b-11ec-80c2-1bb2c6a00592">
 <topic>dnsmasq -- heap use-after-free in dhcp6_no_relay</topic>
 <affects>
 <package>
	<name>dnsmasq</name>
	<range><lt>2.86_4,1</lt></range>
 </package>
 <package>
	<name>dnsmasq-devel</name>
	<range><lt>2.86_4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Petr Menšík reports:
	<blockquote cite="https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016272.html">
	 Possible vulnerability [...] found in latest dnsmasq. It [was] found
	 with help of oss-fuzz Google project by me and short after that
	 independently also by Richard Johnson of Trellix Threat Labs.
	 It is affected only by DHCPv6 requests, which could be crafted to
	 modify already freed memory. [...] We think it might be triggered
	 remotely, but we do not think it could be used to execute remote
	 code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-0934</cvename>
 <url>https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016272.html</url>
 </references>
 <dates>
 <discovery>2022-03-31</discovery>
 <entry>2022-04-03</entry>
 </dates>
 </vuln>

<vuln vid="83466f76-aefe-11ec-b4b6-d05099c0c059">
 <topic>gitea -- Open Redirect on login</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.16.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Andrew Thornton reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1058">
	 
	 When a location containing backslashes is presented, the existing
	 protections against open redirect are bypassed, because browsers
	 will convert adjacent forward and backslashes within the location
	 to double forward slashes.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1058</cvename>
 <url>https://huntr.dev/bounties/4fb42144-ac70-4f76-a5e1-ef6b5e55dc0d/</url>
 </references>
 <dates>
 <discovery>2022-03-23</discovery>
 <entry>2022-03-29</entry>
 </dates>
 </vuln>

<vuln vid="0ff80f41-aefe-11ec-b4b6-d05099c0c059">
 <topic>gitea -- Improper/incorrect authorization</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.16.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Youssef Rebahi-Gilbert reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0905">
	 
	 When Gitea is built and configured for PAM authentication
	 it skips checking authorization completely. Therefore expired
	 accounts and accounts with expired passwords can still login.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-0905</cvename>
 <url>https://huntr.dev/bounties/8d221f92-b2b1-4878-bc31-66ff272e5ceb</url>
 </references>
 <dates>
 <discovery>2022-03-06</discovery>
 <entry>2022-03-29</entry>
 </dates>
 </vuln>

<vuln vid="ab2d7f62-af9d-11ec-a0b8-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>100.0.4896.60</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html">
	 This release contains 28 security fixes, including:
	 <ul>
	 <li>[1292261] High CVE-2022-1125: Use after free in Portals.
	 Reported by Khalil Zhani on 2022-01-29</li>
	 <li>[1291891] High CVE-2022-1127: Use after free in QR Code
	 Generator. Reported by anonymous on 2022-01-28</li>
	 <li>[1301920] High CVE-2022-1128: Inappropriate implementation in
	 Web Share API. Reported by Abdel Adim (@smaury92) Oisfi of
	 Shielder on 2022-03-01</li>
	 <li>[1300253] High CVE-2022-1129: Inappropriate implementation in
	 Full Screen Mode. Reported by Irvan Kurniawan (sourc7) on
	 2022-02-24</li>
	 <li>[1142269] High CVE-2022-1130: Insufficient validation of
	 untrusted input in WebOTP. Reported by Sergey Toshin of
	 Oversecurity Inc. on 2020-10-25</li>
	 <li>[1297404] High CVE-2022-1131: Use after free in Cast UI.
	 Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability
	 Research on 2022-02-15</li>
	 <li>[1303410] High CVE-2022-1132: Inappropriate implementation in
	 Virtual Keyboard. Reported by Andr.Ess on 2022-03-07</li>
	 <li>[1305776] High CVE-2022-1133: Use after free in WebRTC.
	 Reported by Anonymous on 2022-03-13</li>
	 <li>[1308360] High CVE-2022-1134: Type Confusion in V8. Reported by
	 Man Yue Mo of GitHub Security Lab on 2022-03-21</li>
	 <li>[1285601] Medium CVE-2022-1135: Use after free in Shopping Cart.
	 Reported by Wei Yuan of MoyunSec VLab on 2022-01-09</li>
	 <li>[1280205] Medium CVE-2022-1136: Use after free in Tab Strip.
	 Reported by Krace on 2021-12-15</li>
	 <li>[1289846] Medium CVE-2022-1137: Inappropriate implementation in
	 Extensions. Reported by Thomas Orlita on 2022-01-22</li>
	 <li>[1246188] Medium CVE-2022-1138: Inappropriate implementation in
	 Web Cursor. Reported by Alesandro Ortiz on 2021-09-03</li>
	 <li>[1268541] Medium CVE-2022-1139: Inappropriate implementation in
	 Background Fetch API. Reported by Maurice Dauer on 2021-11-10</li>
	 <li>[1303253] Medium CVE-2022-1141: Use after free in File Manager.
	 Reported by raven at KunLun lab on 2022-03-05</li>
	 <li>[1303613] Medium CVE-2022-1142: Heap buffer overflow in WebUI.
	 Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2022-03-07</li>
	 <li>[1303615] Medium CVE-2022-1143: Heap buffer overflow in WebUI.
	 Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2022-03-07</li>
	 <li>[1304145] Medium CVE-2022-1144: Use after free in WebUI.
	 Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2022-03-08</li>
	 <li>[1304545] Medium CVE-2022-1145: Use after free in Extensions.
	 Reported by Yakun Zhang of Baidu Security on 2022-03-09</li>
	 <li>[1290150] Low CVE-2022-1146: Inappropriate implementation in
	 Resource Timing. Reported by Sohom Datta on 2022-01-23</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1125</cvename>
 <cvename>CVE-2022-1127</cvename>
 <cvename>CVE-2022-1128</cvename>
 <cvename>CVE-2022-1129</cvename>
 <cvename>CVE-2022-1130</cvename>
 <cvename>CVE-2022-1131</cvename>
 <cvename>CVE-2022-1132</cvename>
 <cvename>CVE-2022-1133</cvename>
 <cvename>CVE-2022-1134</cvename>
 <cvename>CVE-2022-1135</cvename>
 <cvename>CVE-2022-1136</cvename>
 <cvename>CVE-2022-1137</cvename>
 <cvename>CVE-2022-1138</cvename>
 <cvename>CVE-2022-1139</cvename>
 <cvename>CVE-2022-1141</cvename>
 <cvename>CVE-2022-1142</cvename>
 <cvename>CVE-2022-1143</cvename>
 <cvename>CVE-2022-1144</cvename>
 <cvename>CVE-2022-1145</cvename>
 <cvename>CVE-2022-1146</cvename>
 <url>https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html</url>
 </references>
 <dates>
 <discovery>2022-03-29</discovery>
 <entry>2022-03-29</entry>
 </dates>
 </vuln>

<vuln vid="cb84b940-add5-11ec-9bc8-6805ca2fa271">
 <topic>powerdns-recursor -- denial of service</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><eq>4.6.0</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://www.powerdns.com/news.html#20220325">
	 PowerDNS Security Advisory 2022-01: incomplete validation of incoming IXFR transfer in Authoritative Server and Recursor.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-27227</cvename>
 <url>https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2022-01.html</url>
 </references>
 <dates>
 <discovery>2022-03-25</discovery>
 <entry>2022-03-27</entry>
 </dates>
 </vuln>

<vuln vid="2cda5c88-add4-11ec-9bc8-6805ca2fa271">
 <topic>powerdns -- denial of service</topic>
 <affects>
 <package>
	<name>powerdns</name>
	<range><eq>4.6.0</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://www.powerdns.com/news.html#20220325">
	 PowerDNS Security Advisory 2022-01: incomplete validation of incoming IXFR transfer in Authoritative Server and Recursor.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-27227</cvename>
 <url>https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2022-01.html</url>
 </references>
 <dates>
 <discovery>2022-03-25</discovery>
 <entry>2022-03-27</entry>
 </dates>
 </vuln>

<vuln vid="323f900d-ac6d-11ec-a0b8-3065ec8fd3ec">
 <topic>chromium -- V8 type confusion</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>99.0.4844.84</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html">
	 This release contains 1 security fix:
	 <ul>
	 <li>[1309225] High CVE-2022-1096: Type Confusion in V8. Reported by
	 anonymous on 2022-03-23</li>
	 </ul>
	 Google is aware that an exploit for CVE-2022-1096 exists in the wild.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-1096</cvename>
 <url>https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html</url>
 </references>
 <dates>
 <discovery>2022-03-25</discovery>
 <entry>2022-03-25</entry>
 </dates>
 </vuln>

<vuln vid="955f377e-7bc3-11ec-a51c-7533f219d428">
 <topic>Security Vulnerability found in ExifTool</topic>
 <affects>
 <package>
	<name>p5-Image-ExifTool</name>
	<range><ge>7.44</ge><lt>12.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian Security Advisory reports:
	<blockquote cite="https://www.debian.org/security/2021/dsa-4910">
	 A vulnerability was discovered in libimage-exiftool-perl, a library and program to read and write meta information in multimedia files, which may result in execution of arbitrary code if a malformed DjVu file is processed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-22204</cvename>
 <url>https://www.cvedetails.com/cve/CVE-2021-22204/</url>
 </references>
 <dates>
 <discovery>2021-01-04</discovery>
 <entry>2022-03-25</entry>
 </dates>
 </vuln>

<vuln vid="61f416ff-aa00-11ec-b439-000d3a450398">
 <topic>tcpslice -- heap-based use-after-free in extract_slice()</topic>
 <affects>
 <package>
	<name>tcpslice</name>
	<range><lt>1.5,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Tcpdump Group reports:
	<blockquote cite="https://github.com/the-tcpdump-group/tcpslice/commit/030859fce9c77417de657b9bb29c0f78c2d68f4a">
	 heap-based use-after-free in extract_slice()
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41043</cvename>
 <url>https://github.com/the-tcpdump-group/tcpslice/issues/11</url>
 </references>
 <dates>
 <discovery>2021-09-13</discovery>
 <entry>2022-03-22</entry>
 </dates>
 </vuln>

<vuln vid="e2af876f-a7c8-11ec-9a2a-002324b2fba8">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.17.8,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/51112">
	 regexp: stack exhaustion compiling deeply nested expressions
	 On 64-bit platforms, an extremely deeply nested expression can
	 cause regexp.Compile to cause goroutine stack exhaustion, forcing
	 the program to exit. Note this applies to very large expressions, on
	 the order of 2MB.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-24921</cvename>
 <url>https://github.com/golang/go/issues/51112</url>
 </references>
 <dates>
 <discovery>2022-02-09</discovery>
 <entry>2022-03-19</entry>
 </dates>
 </vuln>

<vuln vid="45a72180-a640-11ec-a08b-85298243e224">
 <topic>openvpn -- Potential authentication by-pass with multiple deferred authentication plug-ins</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><lt>2.5.6</lt></range>
 </package>
 <package>
	<name>openvpn-mbedtls</name>
	<range><lt>2.5.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	David Sommerseth reports:
	<blockquote cite="https://community.openvpn.net/openvpn/wiki/CVE-2022-0547">
	 OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials. This issue is resolved in OpenVPN 2.4.12 and v2.5.6.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-0547</cvename>
 <url>https://community.openvpn.net/openvpn/wiki/CVE-2022-0547</url>
 <url>https://github.com/OpenVPN/openvpn/blob/release/2.5/Changes.rst#overview-of-changes-in-256</url>
 </references>
 <dates>
 <discovery>2022-03-10</discovery>
 <entry>2022-03-17</entry>
 </dates>
 </vuln>

<vuln vid="5df757ef-a564-11ec-85fa-a0369f7f7be0">
 <topic>wordpress -- multiple issues</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>5.9.2,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>zh_CN-wordpress</name>
	<name>th_TW-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<range><lt>5.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wordpress developers reports:
	<blockquote cite="https://wordpress.org/news/2022/03/wordpress-5-9-2-security-maintenance-release/">
	 This security and maintenance release features 1 bug fix in addition to 3 security fixes.
	 Because this is a security release, it is recommended that you update your sites immediately.
	 All versions since WordPress 3.7 have also been updated.
	 The security team would like to thank the following people for responsively reporting
	 vulnerabilities, allowing them to be fixed in this release:
	 -Melar Dev, for finding a Prototype Pollution Vulnerability in a jQuery dependency
	 -Ben Bidner of the WordPress security team, for finding a Stored Cross Site Scripting Vulnerability
	 -Researchers from Johns Hopkins University, for finding a Prototype Pollution Vulnerability in the block editor
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2022/03/wordpress-5-9-2-security-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2022-03-11</discovery>
 <entry>2022-03-16</entry>
 </dates>
 </vuln>

<vuln vid="3ba1ca94-a563-11ec-8be6-d4c9ef517024">
 <topic>Weechat -- Possible man-in-the-middle attack in TLS connection to servers</topic>
 <affects>
 <package>
	<name>weechat</name>
	<range><lt>3.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Weechat project reports:
	<blockquote cite="https://weechat.org/doc/security/WSA-2022-1/">
	 After changing the options weechat.network.gnutls_ca_system or
	 weechat.network.gnutls_ca_user, the TLS verification function is lost.
	 Consequently, any connection to a server with TLS is made without
	 verifying the certificate, which could lead to a man-in-the-middle
	 attack. Connection to IRC servers with TLS is affected, as well as any
	 connection a server made by a plugin or a script using the function
	 hook_connect.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://weechat.org/doc/security/WSA-2022-1/</url>
 </references>
 <dates>
 <discovery>2022-03-13</discovery>
 <entry>2022-03-16</entry>
 </dates>
 </vuln>

<vuln vid="ea05c456-a4fd-11ec-90de-1c697aa5a594">
 <topic>OpenSSL -- Infinite loop in BN_mod_sqrt parsing certificates</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.1.1n,1</lt></range>
 </package>
 <package>
	<name>openssl-devel</name>
	<range><lt>3.0.2</lt></range>
 </package>
 <package>
	<name>openssl-quictls</name>
	<range><lt>3.0.2</lt></range>
 </package>
 <package>
	<name>libressl</name>
	<range><lt>3.4.3</lt></range>
 </package>
 <package>
	<name>libressl-devel</name>
	<range><lt>3.5.1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.0</ge><lt>13.0_8</lt></range>
	<range><ge>12.3</ge><lt>12.3_3</lt></range>
	<range><ge>12.2</ge><lt>12.2_14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20220315.txt">
	Infinite loop in BN_mod_sqrt() reachable when parsing certificates
	 (High)
	The BN_mod_sqrt() function, which computes a modular square root,
	 contains a bug that can cause it to loop forever for non-prime
	 moduli.
	Internally this function is used when parsing certificates that
	 contain elliptic curve public keys in compressed form or explicit
	 elliptic curve parameters with a base point encoded in compressed
	 form.
	It is possible to trigger the infinite loop by crafting a
	 certificate that has invalid explicit curve parameters.
	Since certificate parsing happens prior to verification of the
	 certificate signature, any process that parses an externally
	 supplied certificate may thus be subject to a denial of service
	 attack. The infinite loop can also be reached when parsing crafted
	 private keys as they can contain explicit elliptic curve
	 parameters.
	Thus vulnerable situations include:
	<ul>
	 <li>TLS clients consuming server certificates</li>
	 <li>TLS servers consuming client certificates</li>
	 <li>Hosting providers taking certificates or private keys from
	 customers</li>
	 <li>Certificate authorities parsing certification requests from
	 subscribers</li>
	 <li>Anything else which parses ASN.1 elliptic curve parameters</li>
	</ul>
	Also any other applications that use the BN_mod_sqrt() where the
	 attacker can control the parameter values are vulnerable to this DoS
	 issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-0778</cvename>
 <url>https://www.openssl.org/news/secadv/20220315.txt</url>
 <freebsdsa>SA-22:03.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2022-03-15</discovery>
 <entry>2022-03-16</entry>
 <modified>2022-03-16</modified>
 </dates>
 </vuln>

<vuln vid="8d20bd48-a4f3-11ec-90de-1c697aa5a594">
 <topic>FreeBSD-kernel -- Multiple WiFi issues</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.0</ge><lt>13.0_8</lt></range>
	<range><ge>12.3</ge><lt>12.3_3</lt></range>
	<range><ge>12.2</ge><lt>12.2_14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The paper "Fragment and Forge: Breaking Wi-Fi Through Frame
	Aggregation and Fragmentation" reported a number of security
	vulnerabilities in the 802.11 specification related to frame
	aggregation and fragmentation.
	Additionally, FreeBSD 12.x missed length validation of SSIDs and
	Information Elements (IEs).
	<h1>Impact:</h1>
	As reported on the FragAttacks website, the "design flaws are hard
	to abuse because doing so requires user interaction or is only
	possible when using uncommon network settings." Under suitable
	conditions an attacker may be able to extract sensitive data or inject
	data.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-26147</cvename>
 <cvename>CVE-2020-24588</cvename>
 <cvename>CVE-2020-26144</cvename>
 <freebsdsa>SA-22:02.wifi</freebsdsa>
 </references>
 <dates>
 <discovery>2022-03-15</discovery>
 <entry>2022-03-16</entry>
 </dates>
 </vuln>

<vuln vid="857be71a-a4b0-11ec-95fc-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>98.0.4844.74</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html">
	 This release contains 11 security fixes, including:
	 <ul>
	 <li>[1299422] Critical CVE-2022-0971: Use after free in Blink
	 Layout. Reported by Sergei Glazunov of Google Project Zero on
	 2022-02-21</li>
	 <li>[1301320] High CVE-2022-0972: Use after free in Extensions.
	 Reported by Sergei Glazunov of Google Project Zero on
	 2022-02-28</li>
	 <li>[1297498] High CVE-2022-0973: Use after free in Safe Browsing.
	 Reported by avaue and Buff3tts at S.S.L. on 2022-02-15</li>
	 <li>[1291986] High CVE-2022-0974: Use after free in Splitscreen.
	 Reported by @ginggilBesel on 2022-01-28</li>
	 <li>[1295411] High CVE-2022-0975: Use after free in ANGLE. Reported
	 by SeongHwan Park (SeHwa) on 2022-02-09</li>
	 <li>[1296866] High CVE-2022-0976: Heap buffer overflow in GPU.
	 Reported by Omair on 2022-02-13</li>
	 <li>[1299225] High CVE-2022-0977: Use after free in Browser UI.
	 Reported by Khalil Zhani on 2022-02-20</li>
	 <li>[1299264] High CVE-2022-0978: Use after free in ANGLE. Reported
	 by Cassidy Kim of Amber Security Lab, OPPO Mobile
	 Telecommunications Corp. Ltd. on 2022-02-20</li>
	 <li>[1302644] High CVE-2022-0979: Use after free in Safe Browsing.
	 Reported by anonymous on 2022-03-03</li>
	 <li>[1302157] Medium CVE-2022-0980: Use after free in New Tab Page.
	 Reported by Krace on 2022-03-02</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-0971</cvename>
 <cvename>CVE-2022-0972</cvename>
 <cvename>CVE-2022-0973</cvename>
 <cvename>CVE-2022-0974</cvename>
 <cvename>CVE-2022-0975</cvename>
 <cvename>CVE-2022-0976</cvename>
 <cvename>CVE-2022-0977</cvename>
 <cvename>CVE-2022-0978</cvename>
 <cvename>CVE-2022-0979</cvename>
 <cvename>CVE-2022-0980</cvename>
 <url>https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html</url>
 </references>
 <dates>
 <discovery>2022-03-15</discovery>
 <entry>2022-03-15</entry>
 </dates>
 </vuln>

<vuln vid="6601c08d-a46c-11ec-8be6-d4c9ef517024">
 <topic>Apache httpd -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.53</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
	 <ul>
	 <li>mod_lua: Use of uninitialized value of in r:parsebody (moderate)
	 (CVE-2022-22719)A carefully crafted request body can cause a
	 read to a random memory area which could cause the process to crash.
	 </li>
	 <li>HTTP request smuggling vulnerability (important) (CVE-2022-22720)
	 httpd fails to close inbound connection when errors are
	 encountered discarding the request body, exposing the server to HTTP
	 Request Smuggling</li>
	 <li>core: Possible buffer overflow with very large or unlimited
	 LimitXMLRequestBody (low) (CVE-2022-22721)If LimitXMLRequestBody
	 is set to allow request bodies larger than 350MB (defaults to 1M) on 32
	 bit systems an integer overflow happens which later causes out of
	 bounds writes.</li>
	 <li>mod_sed: Read/write beyond bounds (important) (CVE-2022-23924)
	 Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server
		allows an attacker to overwrite heap memory with possibly attacker
		provided data.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-22719</cvename>
 <cvename>CVE-2022-22720</cvename>
 <cvename>CVE-2022-22721</cvename>
 <cvename>CVE-2022-23943</cvename>
 <url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
 </references>
 <dates>
 <discovery>2022-03-14</discovery>
 <entry>2022-03-15</entry>
 </dates>
 </vuln>

<vuln vid="5aaf534c-a069-11ec-acdc-14dae9d5a9d2">
 <topic>Teeworlds -- Buffer Overflow</topic>
 <affects>
 <package>
	<name>teeworlds</name>
	<range><lt>0.7.5_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2021-43518">
	 Teeworlds up to and including 0.7.5 is vulnerable to Buffer Overflow. A map parser does not validate m_Channels value coming from a map file, leading to a buffer overflow. A malicious server may offer a specially crafted map that will overwrite client's stack causing denial of service or code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-43518</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-43518</url>
 </references>
 <dates>
 <discovery>2021-10-23</discovery>
 <entry>2022-03-10</entry>
 </dates>
 </vuln>

<vuln vid="2823048d-9f8f-11ec-8c9c-001b217b3468">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>14.8.0</ge><lt>14.8.2</lt></range>
	<range><ge>14.7.0</ge><lt>14.7.4</lt></range>
	<range><ge>0</ge><lt>14.6.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2022/02/25/critical-security-release-gitlab-14-8-2-released/">
	 Runner registration token disclosure through Quick Actions
	 Unprivileged users can add other users to groups through an API endpoint
	 Inaccurate display of Snippet contents can be potentially misleading to users
	 Environment variables can be leaked via the sendmail delivery method
	 Unauthenticated user enumeration on GraphQL API
	 Adding a mirror with SSH credentials can leak password
	 Denial of Service via user comments
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-0735</cvename>
 <cvename>CVE-2022-0549</cvename>
 <cvename>CVE-2022-0751</cvename>
 <cvename>CVE-2022-0741</cvename>
 <cvename>CVE-2021-4191</cvename>
 <cvename>CVE-2022-0738</cvename>
 <cvename>CVE-2022-0489</cvename>
 <url>https://about.gitlab.com/releases/2022/02/25/critical-security-release-gitlab-14-8-2-released/</url>
 </references>
 <dates>
 <discovery>2022-02-25</discovery>
 <entry>2022-03-09</entry>
 </dates>
 </vuln>

<vuln vid="964c5460-9c66-11ec-ad3a-001999f8d30b">
 <topic>asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk16</name>
	<range><lt>16.24.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><lt>18.10.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories/">
	 AST-2022-004 - The header length on incoming STUN
	 messages that contain an ERROR-CODE attribute is not
	 properly checked. This can result in an integer underflow.
	 Note, this requires ICE or WebRTC support to be in use
	 with a malicious remote party.
	 AST-2022-005 - When acting as a UAC, and when placing
	 an outgoing call to a target that then forks Asterisk may
	 experience undefined behavior (crashes, hangs, etc) after
	 a dialog set is prematurely freed.
	 AST-2022-006 - If an incoming SIP message contains a
	 malformed multi-part body an out of bounds read access
	 may occur, which can result in undefined behavior. Note,
	 its currently uncertain if there is any externally
	 exploitable vector within Asterisk for this issue, but
	 providing this as a security issue out of caution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-37706</cvename>
 <cvename>CVE-2022-23608</cvename>
 <cvename>CVE-2022-21723</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2022-004.html</url>
 <url>https://downloads.asterisk.org/pub/security/AST-2022-005.html</url>
 <url>https://downloads.asterisk.org/pub/security/AST-2022-006.html</url>
 </references>
 <dates>
 <discovery>2022-03-03</discovery>
 <entry>2022-03-05</entry>
 </dates>
 </vuln>

<vuln vid="e0914087-9a09-11ec-9e61-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>99.0.4844.51</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.html">
	 This release contains 28 security fixes, including:
	 <ul>
	 <li>[1289383] High CVE-2022-0789: Heap buffer overflow in ANGLE.
	 Reported by SeongHwan Park (SeHwa) on 2022-01-21</li>
	 <li>[1274077] High CVE-2022-0790: Use after free in Cast UI.
	 Reported by Anonymous on 2021-11-26</li>
	 <li>[1278322] High CVE-2022-0791: Use after free in Omnibox.
	 Reported by Zhihua Yao of KunLun Lab on 2021-12-09</li>
	 <li>[1285885] High CVE-2022-0792: Out of bounds read in ANGLE.
	 Reported by Jaehun Jeong (@n3sk) of Theori on 2022-01-11</li>
	 <li>[1291728] High CVE-2022-0793: Use after free in Views. Reported
	 by Thomas Orlita on 2022-01-28</li>
	 <li>[1294097] High CVE-2022-0794: Use after free in WebShare.
	 Reported by Khalil Zhani on 2022-02-04</li>
	 <li>[1282782] High CVE-2022-0795: Type Confusion in Blink Layout.
	 Reported by 0x74960 on 2021-12-27</li>
	 <li>[1295786] High CVE-2022-0796: Use after free in Media. Reported
	 by Cassidy Kim of Amber Security Lab, OPPO Mobile
	 Telecommunications Corp. Ltd. on 2022-02-10</li>
	 <li>[1281908] High CVE-2022-0797: Out of bounds memory access in
	 Mojo. Reported by Sergei Glazunov of Google Project Zero on
	 2021-12-21</li>
	 <li>[1283402] Medium CVE-2022-0798: Use after free in MediaStream.
	 Reported by Samet Bekmezci @sametbekmezci on 2021-12-30</li>
	 <li>[1279188] Medium CVE-2022-0799: Insufficient policy enforcement
	 in Installer. Reported by Abdelhamid Naceri (halov) on
	 2021-12-12</li>
	 <li>[1242962] Medium CVE-2022-0800: Heap buffer overflow in Cast UI.
	 Reported by Khalil Zhani on 2021-08-24</li>
	 <li>[1231037] Medium CVE-2022-0801: Inappropriate implementation in
	 HTML parser. Reported by Michal Bentkowski of Securitum on
	 2021-07-20</li>
	 <li>[1270052] Medium CVE-2022-0802: Inappropriate implementation in
	 Full screen mode. Reported by Irvan Kurniawan (sourc7) on
	 2021-11-14</li>
	 <li>[1280233] Medium CVE-2022-0803: Inappropriate implementation in
	 Permissions. Reported by Abdulla Aldoseri on 2021-12-15</li>
	 <li>[1264561] Medium CVE-2022-0804: Inappropriate implementation in
	 Full screen mode. Reported by Irvan Kurniawan (sourc7) on
	 2021-10-29</li>
	 <li>[1290700] Medium CVE-2022-0805: Use after free in Browser
	 Switcher. Reported by raven at KunLun Lab on 2022-01-25</li>
	 <li>[1283434] Medium CVE-2022-0806: Data leak in Canvas. Reported by
	 Paril on 2021-12-31</li>
	 <li>[1287364] Medium CVE-2022-0807: Inappropriate implementation in
	 Autofill. Reported by Alesandro Ortiz on 2022-01-14</li>
	 <li>[1292271] Medium CVE-2022-0808: Use after free in Chrome OS
	 Shell. Reported by @ginggilBesel on 2022-01-29</li>
	 <li>[1293428] Medium CVE-2022-0809: Out of bounds memory access in
	 WebXR. Reported by @uwu7586 on 2022-02-03</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-0789</cvename>
 <cvename>CVE-2022-0790</cvename>
 <cvename>CVE-2022-0791</cvename>
 <cvename>CVE-2022-0792</cvename>
 <cvename>CVE-2022-0793</cvename>
 <cvename>CVE-2022-0794</cvename>
 <cvename>CVE-2022-0795</cvename>
 <cvename>CVE-2022-0796</cvename>
 <cvename>CVE-2022-0797</cvename>
 <cvename>CVE-2022-0798</cvename>
 <cvename>CVE-2022-0799</cvename>
 <cvename>CVE-2022-0800</cvename>
 <cvename>CVE-2022-0801</cvename>
 <cvename>CVE-2022-0802</cvename>
 <cvename>CVE-2022-0803</cvename>
 <cvename>CVE-2022-0804</cvename>
 <cvename>CVE-2022-0805</cvename>
 <cvename>CVE-2022-0806</cvename>
 <cvename>CVE-2022-0807</cvename>
 <cvename>CVE-2022-0808</cvename>
 <cvename>CVE-2022-0809</cvename>
 <url>https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2022-03-01</discovery>
 <entry>2022-03-02</entry>
 </dates>
 </vuln>

<vuln vid="a80c6273-988c-11ec-83ac-080027415d17">
 <topic>cyrus-sasl -- Fix off by one error</topic>
 <affects>
 <package>
	<name>cyrus-sasl</name>
	<range><ge>2.1.27</ge><lt>2.1.28</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cyrus SASL 2.1.x Release Notes New in 2.1.28 reports:
	<blockquote cite="https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28">
	 Fix off by one error
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-19906</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19906</url>
 </references>
 <dates>
 <discovery>2019-12-19</discovery>
 <entry>2022-02-28</entry>
 </dates>
 </vuln>

<vuln vid="0eab001a-9708-11ec-96c9-589cfc0f81b0">
 <topic>typo3 -- XSS vulnerability in svg-sanitize</topic>
 <affects>
 <package>
 <name>typo3-10-php74</name>
 <range><lt>10.4.25</lt></range>
 </package>
 <package>
 <name>typo3-11-php74</name>
 <name>typo3-11-php80</name>
 <name>typo3-11-php81</name>
 <range><lt>11.5.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 The TYPO3 project reports:
 <blockquote cite="https://typo3.org/article/typo3-psa-2022-001">
	 The SVG sanitizer library enshrined/svg-sanitize before version
	 0.15.0 did not remove HTML elements wrapped in a CDATA section.
	 As a result, SVG content embedded in HTML (fetched as text/html)
	 was susceptible to cross-site scripting. Plain SVG files
	 (fetched as image/svg+xml) were not affected.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23638</cvename>
 <url>https://github.com/typo3/typo3/commit/9940defb21</url>
 <url>https://typo3.org/article/typo3-psa-2022-001</url>
 </references>
 <dates>
 <discovery>2022-02-22</discovery>
 <entry>2022-02-27</entry>
 </dates>
 </vuln>

<vuln vid="d71d154a-8b83-11ec-b369-6c3be5272acd">
 <topic>Grafana -- Teams API IDOR</topic>
 <affects>
 <package>
	<name>grafana6</name>
	<range><ge>6.0.0</ge></range>
 </package>
 <package>
	<name>grafana7</name>
	<range><lt>7.5.15</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><lt>8.3.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/">
	 On Jan. 18, an external security researcher, Kürşad ALSAN from <a href="https://www.nspect.io/">NSPECT.IO</a> (<a href="https://twitter.com/nspectio">@nspectio</a> on Twitter), contacted Grafana to disclose an IDOR (Insecure Direct Object Reference) vulnerability on Grafana Teams APIs. This vulnerability only impacts the following API endpoints:
	 <ul>
	 <li>/teams/:teamId - an authenticated attacker can view unintended data by querying for the specific team ID.</li>
	 <li>/teams/:search - an authenticated attacker can search for teams and see the total number of available teams, including for those teams that the user does not have access to.</li>
	 <li>/teams/:teamId/members - when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID.</li>
	 </ul>
	 We believe that this vulnerability is rated at CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-21713</cvename>
 <url>https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/</url>
 </references>
 <dates>
 <discovery>2022-01-18</discovery>
 <entry>2022-02-12</entry>
 </dates>
 </vuln>

<vuln vid="d4284c2e-8b83-11ec-b369-6c3be5272acd">
 <topic>Grafana -- CSRF</topic>
 <affects>
 <package>
	<name>grafana6</name>
	<range><ge>6.0.0</ge></range>
 </package>
 <package>
	<name>grafana7</name>
	<range><lt>7.5.15</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><lt>8.3.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/">
	 On Jan. 18, security researchers <a href="https://twitter.com/jub0bs">@jub0bs</a> and <a href="https://twitter.com/theabrahack">@abrahack</a> contacted Grafana to <a href="https://jub0bs.com/posts/2022-02-08-cve-2022-21703-writeup/">disclose a CSRF vulnerability</a> which allows anonymous attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. We believe that this vulnerability is rated at CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-21703</cvename>
 <url>https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/</url>
 </references>
 <dates>
 <discovery>2022-01-18</discovery>
 <entry>2022-02-12</entry>
 </dates>
 </vuln>

<vuln vid="cecbc674-8b83-11ec-b369-6c3be5272acd">
 <topic>Grafana -- XSS</topic>
 <affects>
 <package>
	<name>grafana6</name>
	<range><ge>6.0.0</ge></range>
 </package>
 <package>
	<name>grafana7</name>
	<range><lt>7.5.15</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><lt>8.3.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/">
	 On Jan. 16, an external security researcher, Jasu Viding contacted Grafana to disclose an XSS vulnerability in the way that Grafana handles data sources. Should an existing data source connected to Grafana be compromised, it could be used to inappropriately gain access to other data sources connected to the same Grafana org. We believe that this vulnerability is rated at CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-21702</cvename>
 <url>https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/</url>
 </references>
 <dates>
 <discovery>2022-01-16</discovery>
 <entry>2022-02-12</entry>
 </dates>
 </vuln>

<vuln vid="7695b0af-958f-11ec-9aa3-4ccc6adda413">
 <topic>cryptopp -- ElGamal implementation allows plaintext recovery</topic>
 <affects>
 <package>
	<name>cryptopp</name>
	<range><lt>8.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Crypto++ 8.6 release notes reports:
	<blockquote cite="https://www.cryptopp.com/release860.html">
	 The ElGamal implementation in Crypto++ through 8.5 allows plaintext
	 recovery because, during interaction between two cryptographic
	 libraries, a certain dangerous combination of the prime defined by
	 the receiver's public key, the generator defined by the receiver's
	 public key, and the sender's ephemeral exponents can lead to a
	 cross-configuration attack against OpenPGP.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-40530</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-40530</url>
 </references>
 <dates>
 <discovery>2021-09-06</discovery>
 <entry>2022-02-24</entry>
 </dates>
 </vuln>

<vuln vid="5e1440c6-95af-11ec-b320-f8b156b6dcc8">
 <topic>flac -- fix encoder bug</topic>
 <affects>
 <package>
	<name>flac</name>
	<range><lt>1.3.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The FLAC 1.3.4 release reports:
	<blockquote cite="https://xiph.org/flac/changelog.html">
	 Fix 12 decoder bugs found by oss-fuzz.
	 Fix encoder bug CVE-2021-0561.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-0561</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0561</url>
 </references>
 <dates>
 <discovery>2022-02-20</discovery>
 <entry>2022-02-24</entry>
 </dates>
 </vuln>

<vuln vid="022dde12-8f4a-11ec-83ac-080027415d17">
 <topic>cyrus-sasl -- Escape password for SQL insert/update commands</topic>
 <affects>
 <package>
	<name>cyrus-sasl-sql</name>
	<range><ge>2.1.27</ge><lt>2.1.27_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cyrus SASL 2.1.x Release Notes New in 2.1.28 reports:
	<blockquote cite="https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28">
	 Escape password for SQL insert/update commands.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-24407</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24407</url>
 </references>
 <dates>
 <discovery>2022-02-04</discovery>
 <entry>2022-02-23</entry>
 </dates>
 </vuln>

<vuln vid="85d976be-93e3-11ec-aaad-14dae9d5a9d2">
 <topic>The Update Framwork -- path traversal vulnerability</topic>
 <affects>
 <package>
	<name>py37-tuf</name>
	<name>py38-tuf</name>
	<name>py39-tuf</name>
	<name>py310-tuf</name>
	<name>py311-tuf</name>
	<range><le>0.18.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2021-41131">
	 python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client system on a call to `get_one_valid_targetinfo()`. It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie `../../name.json`). The impact is mitigated by a few facts: It only affects implementations that allow arbitrary rolename selection for delegated targets metadata, The attack requires the ability to A) insert new metadata for the path-traversing role and B) get the role delegated by an existing targets metadata, The written file content is heavily restricted since it needs to be a valid, signed targets file. The file extension is always .json. A fix is available in version 0.19 or newer. There are no workarounds that do not require code changes. Clients can restrict the allowed character set for rolenames, or they can store metadata in files named in a way that is not vulnerable: neither of these approaches is possible without modifying python-tuf.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41131</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-41131</url>
 </references>
 <dates>
 <discovery>2021-10-22</discovery>
 <entry>2022-02-22</entry>
 </dates>
 </vuln>

<vuln vid="1cd565da-455e-41b7-a5b9-86ad8e81e33e">
 <topic>seatd-launch -- remove files with escalated privileges with SUID</topic>
 <affects>
 <package>
	<name>seatd</name>
	<range><ge>0.6.0</ge><lt>0.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kenny Levinsen reports:
	<blockquote cite="https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CETEO7R.QG8B1KGD531R1%40kl.wtf%3E">
	 seatd-launch could use a user-specified socket path instead of the
	 internally generated socket path, and would unlink the socket path
	 before use to guard against collision with leftover sockets. This
	 meant that a caller could freely control what file path would be
	 unlinked and replaced with a user-owned seatd socket for the duration
	 of the session.
	 If seatd-launch had the SUID bit set, this could be used by a
	 malicious user to remove files with the privileges of the owner of
	 seatd-launch, which is likely root, and replace it with a user-owned
	 domain socket.
	 This does not directly allow retrieving the contents of existing
	 files, and the user-owned socket file is at the current time not
	 believed to be directly useful for further exploitation.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CETEO7R.QG8B1KGD531R1%40kl.wtf%3E</url>
 <cvename>CVE-2022-25643</cvename>
 </references>
 <dates>
 <discovery>2022-02-21</discovery>
 <entry>2022-02-21</entry>
 <modified>2022-02-22</modified>
 </dates>
 </vuln>

<vuln vid="43ae57f6-92ab-11ec-81b4-2cf05d620ecc">
 <topic>Qt5 -- QProcess unexpected search path</topic>
 <affects>
 <package>
	<name>qt5-core</name>
	<range><lt>5.15.2p263_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Qt Company reports:
	<blockquote cite="https://lists.qt-project.org/pipermail/announce/2022-February/000333.html">
	 Recently, the Qt Project's security team was made aware of an issue regarding QProcess and determined it to be a security issue on Unix-based platforms only. We do not believe this to be a considerable risk for applications as the likelihood of it being triggered is minimal.

Specifically, the problem is around using QProcess to start an application without having an absolute path, and as a result, it depends on it finding it in the PATH environment variable. As a result, it may be possible for an attacker to place their copy of the executable in question inside the working/current directory for the QProcess and have it invoked that instead.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-25255</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25255</url>
 </references>
 <dates>
 <discovery>2022-02-17</discovery>
 <entry>2022-02-21</entry>
 </dates>
 </vuln>

<vuln vid="4d763c65-9246-11ec-9aa3-4ccc6adda413">
 <topic>libmysoft -- Heap-based buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>libmysofa</name>
	<range><lt>1.2.1.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Zhengjie Du reports:
	<blockquote cite="https://huntr.dev/bounties/7ca8d9ea-e2a6-4294-af28-70260bb53bc1/">
	 There are some heap-buffer-overflows in mysofa2json of
	 libmysofa. They are in function loudness, mysofa_check and
	 readOHDRHeaderMessageDataLayout.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-3756</cvename>
 <url>https://www.huntr.dev/bounties/7ca8d9ea-e2a6-4294-af28-70260bb53bc1/</url>
 </references>
 <dates>
 <discovery>2021-09-27</discovery>
 <entry>2022-02-20</entry>
 </dates>
 </vuln>

<vuln vid="27bf9378-8ffd-11ec-8be6-d4c9ef517024">
 <topic>MariaDB -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb103-client</name>
	<range><lt>10.3.34</lt></range>
 </package>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.34</lt></range>
 </package>
 <package>
	<name>mariadb104-client</name>
	<range><lt>10.4.24</lt></range>
 </package>
 <package>
	<name>mariadb104-server</name>
	<range><lt>10.4.24</lt></range>
 </package>
 <package>
	<name>mariadb105-client</name>
	<range><lt>10.5.15</lt></range>
 </package>
 <package>
	<name>mariadb105-server</name>
	<range><lt>10.5.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MariaDB reports:
	<blockquote cite="https://mariadb.com/kb/en/cve/">
	 MariaDB reports 5 vulnerabilities in supported versions
	 resulting from fuzzing tests
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-46661</cvename>
 <cvename>CVE-2021-46663</cvename>
 <cvename>CVE-2021-46664</cvename>
 <cvename>CVE-2021-46665</cvename>
 <cvename>CVE-2021-46668</cvename>
 <url>https://mariadb.com/kb/en/cve/</url>
 <url>https://mariadb.com/kb/en/mdb-10334-rn/</url>
 <url>https://mariadb.com/kb/en/mdb-10424-rn/</url>
 <url>https://mariadb.com/kb/en/mdb-10515-rn/</url>
 </references>
 <dates>
 <discovery>2022-02-12</discovery>
 <entry>2022-02-18</entry>
 </dates>
 </vuln>

<vuln vid="096ab080-907c-11ec-bb14-002324b2fba8">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.17.7,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/50974">
	 crypto/elliptic: fix IsOnCurve for big.Int values that are not
	 valid coordinates
	 Some big.Int values that are not valid field elements (negative or
	 overflowing) might cause Curve.IsOnCurve to incorrectly return true.
	 Operating on those values may cause a panic or an invalid curve
	 operation. Note that Unmarshal will never return such values.
	</blockquote>
	<blockquote cite="https://github.com/golang/go/issues/50699">
	 math/big: prevent large memory consumption in Rat.SetString
	 An attacker can cause unbounded memory growth in a program using
	 (*Rat).SetString due to an unhandled overflow.
	</blockquote>
	<blockquote cite="https://github.com/golang/go/issues/35671">
	 cmd/go: prevent branches from materializing into versions
	 A branch whose name resembles a version tag (such as "v1.0.0" or
	 "subdir/v2.0.0-dev") can be considered a valid version by the go
	 command. Materializing versions from branches might be unexpected
	 and bypass ACLs that limit the creation of tags but not branches.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23806</cvename>
 <url>https://github.com/golang/go/issues/50974</url>
 <cvename>CVE-2022-23772</cvename>
 <url>https://github.com/golang/go/issues/50699</url>
 <cvename>CVE-2022-23773</cvename>
 <url>https://github.com/golang/go/issues/35671</url>
 </references>
 <dates>
 <discovery>2022-02-10</discovery>
 <entry>2022-02-18</entry>
 </dates>
 </vuln>

<vuln vid="e12432af-8e73-11ec-8bc4-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>98.0.4758.102</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html">
	 This release contains 11 security fixes, including:
	 <ul>
	 <li>[1290008] High CVE-2022-0603: Use after free in File Manager.
	 Reported by Chaoyuan Peng (@ret2happy) on 2022-01-22</li>
	 <li>[1273397] High CVE-2022-0604: Heap buffer overflow in Tab
	 Groups. Reported by Krace on 2021-11-24</li>
	 <li>[1286940] High CVE-2022-0605: Use after free in Webstore API.
	 Reported by Thomas Orlita on 2022-01-13</li>
	 <li>[1288020] High CVE-2022-0606: Use after free in ANGLE. Reported
	 by Cassidy Kim of Amber Security Lab, OPPO Mobile
	 Telecommunications Corp. Ltd. on 2022-01-17</li>
	 <li>[1250655] High CVE-2022-0607: Use after free in GPU. Reported by
	 0x74960 on 2021-09-17</li>
	 <li>[1270333] High CVE-2022-0608: Integer overflow in Mojo. Reported
	 by Sergei Glazunov of Google Project Zero on 2021-11-16</li>
	 <li>[1296150] High CVE-2022-0609: Use after free in Animation.
	 Reported by Adam Weidemann and Clément Lecigne of Google'
	 Threat Analysis Group on 2022-02-10</li>
	 <li>[1285449] Medium CVE-2022-0610: Inappropriate implementation in
	 Gamepad API. Reported by Anonymous on 2022-01-08</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-0603</cvename>
 <cvename>CVE-2022-0604</cvename>
 <cvename>CVE-2022-0605</cvename>
 <cvename>CVE-2022-0606</cvename>
 <cvename>CVE-2022-0607</cvename>
 <cvename>CVE-2022-0608</cvename>
 <cvename>CVE-2022-0609</cvename>
 <cvename>CVE-2022-0610</cvename>
 <url>https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html</url>
 </references>
 <dates>
 <discovery>2022-02-14</discovery>
 <entry>2022-02-15</entry>
 </dates>
 </vuln>

<vuln vid="24049967-88ec-11ec-88f5-901b0e934d69">
 <topic>py-twisted -- cookie and authorization headers are leaked when following cross-origin redirects</topic>
 <affects>
	<package>
	 <name>py37-twisted</name>
	 <name>py38-twisted</name>
	 <name>py39-twisted</name>
	 <name>py310-twisted</name>
	 <range><lt>22.1.0</lt></range>
	</package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Twisted developers report:
	<blockquote cite="https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx">
	 Cookie and Authorization headers are leaked when following cross-origin redirects in <code>twited.web.client.RedirectAgent</code> and <code>twisted.web.client.BrowserLikeRedirectAgent</code>.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx</url>
 </references>
 <dates>
 <discovery>2022-02-07</discovery>
 <entry>2022-02-13</entry>
 </dates>
 </vuln>

<vuln vid="d923fb0c-8c2f-11ec-aa85-0800270512f4">
 <topic>zsh -- Arbitrary command execution vulnerability</topic>
 <affects>
 <package>
	<name>zsh</name>
	<range><lt>5.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 Marc Cornellà reports:
	<blockquote cite="https://zsh.sourceforge.io/releases.html">
	 
	 Some prompt expansion sequences, such as %F, support 'arguments'
	 which are themselves expanded in case they contain colour values,
	 etc. This additional expansion would trigger PROMPT_SUBST evaluation,
	 if enabled. This could be abused to execute code the user didn't
	 expect. e.g., given a certain prompt configuration, an attacker
	 could trick a user into executing arbitrary code by having them
	 check out a Git branch with a specially crafted name.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-45444</cvename>
 <url>https://zsh.sourceforge.io/releases.html</url>
 </references>
 <dates>
 <discovery>2022-02-12</discovery>
 <entry>2022-02-12</entry>
 </dates>
 </vuln>

<vuln vid="972ba0e8-8b8a-11ec-b369-6c3be5272acd">
 <topic>Node.js -- January 2022 Security Releases</topic>
 <affects>
 <package>
	<name>node</name>
	<range><ge>12.0.0</ge><lt>12.22.9</lt></range>
	<range><ge>14.0.0</ge><lt>14.18.3</lt></range>
	<range><ge>16.0.0</ge><lt>16.13.2</lt></range>
	<range><ge>17.0.0</ge><lt>17.3.1</lt></range>
 </package>
 <package>
	<name>node16</name>
	<range><lt>16.13.2</lt></range>
 </package>
 <package>
	<name>node14</name>
	<range><lt>14.18.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/">
	 <h1>Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)</h1>
	 Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.
	 <h1>Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)</h1>
	 Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.
	 <h1>Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533)</h1>
	 Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.
	 <h1>Prototype pollution via <code>console.table</code> properties (Low)(CVE-2022-21824)</h1>
	 Due to the formatting logic of the <code>console.table()</code> function it was not safe to allow user controlled input to be passed to the <code>properties</code> parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be <code>__proto__</code>. The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44531</cvename>
 <cvename>CVE-2021-44532</cvename>
 <cvename>CVE-2021-44533</cvename>
 <cvename>CVE-2022-21824</cvename>
 <url>https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/</url>
 </references>
 <dates>
 <discovery>2022-01-10</discovery>
 <entry>2022-02-12</entry>
 </dates>
 </vuln>

<vuln vid="0b0ad196-1ee8-4a98-89b1-4d5d82af49a9">
 <topic>jenkins -- DoS vulnerability in bundled XStream library</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.334</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.319.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2022-02-09/">
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-2602 / CVE-2021-43859 (upstream issue), CVE-2022-0538 (Jenkins-specific converters)</h5>
	 DoS vulnerability in bundled XStream library
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-43859</cvename>
 <cvename>CVE-2022-0538</cvename>
 <url>https://www.jenkins.io/security/advisory/2022-02-09/</url>
 </references>
 <dates>
 <discovery>2022-02-09</discovery>
 <entry>2022-02-10</entry>
 </dates>
 </vuln>

<vuln vid="ff5606f7-8a45-11ec-8be6-d4c9ef517024">
 <topic>MariaDB -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb103-client</name>
	<range><lt>10.3.33</lt></range>
 </package>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.33</lt></range>
 </package>
 <package>
	<name>mariadb104-client</name>
	<range><lt>10.4.23</lt></range>
 </package>
 <package>
	<name>mariadb104-server</name>
	<range><lt>10.4.23</lt></range>
 </package>
 <package>
	<name>mariadb105-client</name>
	<range><lt>10.5.14</lt></range>
 </package>
 <package>
	<name>mariadb105-server</name>
	<range><lt>10.5.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MariaDB reports:
	<blockquote cite="https://mariadb.com/kb/en/cve/">
	 MariaDB reports 5 vulnerabilities in supported versions
	 without further detailed information.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-24052</cvename>
 <cvename>CVE-2022-24051</cvename>
 <cvename>CVE-2022-24050</cvename>
 <cvename>CVE-2022-24048</cvename>
 <cvename>CVE-2021-46659</cvename>
 <url>https://mariadb.com/kb/en/cve/</url>
 <url>https://mariadb.com/kb/en/mdb-10333-rn/</url>
 <url>https://mariadb.com/kb/en/mdb-10423-rn/</url>
 <url>https://mariadb.com/kb/en/mdb-10514-rn/</url>
 </references>
 <dates>
 <discovery>2022-02-10</discovery>
 <entry>2022-02-10</entry>
 <modified>2022-02-17</modified>
 </dates>
 </vuln>

<vuln vid="fc2a9541-8893-11ec-9d01-80ee73419af3">
 <topic>xrdp -- privilege escalation</topic>
 <affects>
 <package>
	<name>xrdp</name>
	<range><ge>0.9.17,1</ge><lt>0.9.18.1,1</lt></range>
 </package>
 <package>
	<name>xrdp-devel</name>
	<range><ge>0.9.17,1</ge><lt>0.9.18.1,1</lt></range>
 </package>

</affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	xrdp project reports:
	<blockquote cite="https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-8h98-h426-xf32">
	 An integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is accessible to a sesman server (listens by default on localhost when installing xrdp, but can be remote if configured otherwise) to execute code as root.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23613</cvename>
 <url>https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-8h98-h426-xf32</url>
 </references>
 <dates>
 <discovery>2022-01-23</discovery>
 <entry>2022-02-08</entry>
 <modified>2022-02-15</modified>
 </dates>
 </vuln>

<vuln vid="3507bfb3-85d5-11ec-8c9c-001b217b3468">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>14.7.0</ge><lt>14.7.1</lt></range>
	<range><ge>14.6.0</ge><lt>14.6.4</lt></range>
	<range><ge>0</ge><lt>14.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2022/02/03/security-release-gitlab-14-7-1-released/">
	 Arbitrary POST requests via special HTML attributes in Jupyter Notebooks
	 DNS Rebinding vulnerability in Irker IRC Gateway integration
	 Missing certificate validation for external CI services
	 Blind SSRF Through Project Import
	 Open redirect vulnerability in Jira Integration
	 Issue link was disclosing the linked issue
	 Service desk email accessible by project non-members
	 Authenticated users can search other users by their private email
	 "External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request
	 Deleting packages in bulk from package registries may cause table locks
	 Autocomplete enabled on specific pages
	 Possible SSRF due to not blocking shared address space
	 System notes reveals private project path when Issue is moved to a public project
	 Timeout for pages using Markdown
	 Certain branch names could not be protected
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-0427</cvename>
 <cvename>CVE-2022-0425</cvename>
 <cvename>CVE-2022-0123</cvename>
 <cvename>CVE-2022-0136</cvename>
 <cvename>CVE-2022-0283</cvename>
 <cvename>CVE-2022-0390</cvename>
 <cvename>CVE-2022-0373</cvename>
 <cvename>CVE-2022-0371</cvename>
 <cvename>CVE-2021-39943</cvename>
 <cvename>CVE-2022-0477</cvename>
 <cvename>CVE-2022-0167</cvename>
 <cvename>CVE-2022-0249</cvename>
 <cvename>CVE-2022-0344</cvename>
 <cvename>CVE-2022-0488</cvename>
 <cvename>CVE-2021-39931</cvename>
 <url>https://about.gitlab.com/releases/2022/02/03/security-release-gitlab-14-7-1-released/</url>
 </references>
 <dates>
 <discovery>2022-02-03</discovery>
 <entry>2022-02-04</entry>
 </dates>
 </vuln>

<vuln vid="e852f43c-846e-11ec-b043-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>98.0.4758.80</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html">
	 This release contains 27 security fixes, including:
	 <ul>
	 <li>[1284584] High CVE-2022-0452: Use after free in Safe Browsing.
	 Reported by avaue at S.S.L. on 2022-01-05</li>
	 <li>[1284916] High CVE-2022-0453: Use after free in Reader Mode.
	 Reported by Rong Jian of VRI on 2022-01-06</li>
	 <li>[1287962] High CVE-2022-0454: Heap buffer overflow in ANGLE.
	 Reported by Seong-Hwan Park (SeHwa) of SecunologyLab on
	 2022-01-17</li>
	 <li>[1270593] High CVE-2022-0455: Inappropriate implementation in
	 Full Screen Mode. Reported by Irvan Kurniawan (sourc7) on
	 2021-11-16</li>
	 <li>[1289523] High CVE-2022-0456: Use after free in Web Search.
	 Reported by Zhihua Yao of KunLun Lab on 2022-01-21</li>
	 <li>[1274445] High CVE-2022-0457: Type Confusion in V8. Reported by
	 rax of the Group0x58 on 2021-11-29</li>
	 <li>[1267060] High CVE-2022-0458: Use after free in Thumbnail Tab
	 Strip. Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2021-11-05</li>
	 <li>[1244205] High CVE-2022-0459: Use after free in Screen Capture.
	 Reported by raven (@raid_akame) on 2021-08-28</li>
	 <li>[1250227] Medium CVE-2022-0460: Use after free in Window Dialog.
	 Reported by 0x74960 on 2021-09-16</li>
	 <li>[1256823] Medium CVE-2022-0461: Policy bypass in COOP. Reported
	 by NDevTK on 2021-10-05</li>
	 <li>[1270470] Medium CVE-2022-0462: Inappropriate implementation in
	 Scroll. Reported by Youssef Sammouda on 2021-11-16</li>
	 <li>[1268240] Medium CVE-2022-0463: Use after free in Accessibility.
	 Reported by Zhihua Yao of KunLun Lab on 2021-11-09</li>
	 <li>[1270095] Medium CVE-2022-0464: Use after free in Accessibility.
	 Reported by Zhihua Yao of KunLun Lab on 2021-11-14</li>
	 <li>[1281941] Medium CVE-2022-0465: Use after free in Extensions.
	 Reported by Samet Bekmezci @sametbekmezci on 2021-12-22</li>
	 <li>[1115460] Medium CVE-2022-0466: Inappropriate implementation in
	 Extensions Platform. Reported by David Erceg on 2020-08-12</li>
	 <li>[1239496] Medium CVE-2022-0467: Inappropriate implementation in
	 Pointer Lock. Reported by Alesandro Ortiz on 2021-08-13</li>
	 <li>[1252716] Medium CVE-2022-0468: Use after free in Payments.
	 Reported by Krace on 2021-09-24</li>
	 <li>[1279531] Medium CVE-2022-0469: Use after free in Cast. Reported
	 by Thomas Orlita on 2021-12-14</li>
	 <li>[1269225] Low CVE-2022-0470: Out of bounds memory access in V8.
	 Reported by Looben Yang on 2021-11-11</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-0452</cvename>
 <cvename>CVE-2022-0453</cvename>
 <cvename>CVE-2022-0454</cvename>
 <cvename>CVE-2022-0455</cvename>
 <cvename>CVE-2022-0456</cvename>
 <cvename>CVE-2022-0457</cvename>
 <cvename>CVE-2022-0458</cvename>
 <cvename>CVE-2022-0459</cvename>
 <cvename>CVE-2022-0460</cvename>
 <cvename>CVE-2022-0461</cvename>
 <cvename>CVE-2022-0462</cvename>
 <cvename>CVE-2022-0463</cvename>
 <cvename>CVE-2022-0464</cvename>
 <cvename>CVE-2022-0465</cvename>
 <cvename>CVE-2022-0466</cvename>
 <cvename>CVE-2022-0467</cvename>
 <cvename>CVE-2022-0468</cvename>
 <cvename>CVE-2022-0469</cvename>
 <cvename>CVE-2022-0470</cvename>
 <url>https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2022-02-01</discovery>
 <entry>2022-02-02</entry>
 </dates>
 </vuln>

<vuln vid="1d3677a8-9143-42d8-84a3-0585644dff4b">
 <topic>h2o -- uninitialised memory access in HTTP3</topic>
 <affects>
 <package>
	<name>h2o-devel</name>
	<range><lt>2.3.0.d.20220131</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Emil Lerner reports:
	<blockquote cite="https://github.com/h2o/h2o/security/advisories/GHSA-f9xw-j925-m4m4">
 When receiving QUIC frames in certain order, HTTP/3 server-side
 implementation of h2o can be misguided to treat uninitialized
 memory as HTTP/3 frames that have been received. When h2o is
 used as a reverse proxy, an attacker can abuse this vulnerability
 to send internal state of h2o to backend servers controlled by
 the attacker or third party. Also, if there is an HTTP endpoint
 that reflects the traffic sent from the client, an attacker can
 use that reflector to obtain internal state of h2o.
 This internal state includes traffic of other connections in
 unencrypted form and TLS session tickets.
 This vulnerability exists in h2o server with HTTP/3
 support, between commit 93af138 and d1f0f65. None of the
 released versions of h2o are affected by this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-43848</cvename>
 <url>https://github.com/h2o/h2o/security/advisories/GHSA-f9xw-j925-m4m4</url>
 </references>
 <dates>
 <discovery>2021-01-31</discovery>
 <entry>2022-02-02</entry>
 </dates>
 </vuln>

<vuln vid="b1b6d623-83e4-11ec-90de-1c697aa5a594">
 <topic>FreeBSD -- vt console buffer overflow</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.0</ge><lt>13.0_6</lt></range>
	<range><ge>12.2</ge><lt>12.2_12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Under certain conditions involving use of the highlight buffer
	while text is scrolling on the console, console data may overwrite
	data structures associated with the system console or other kernel
	memory.
	<h1>Impact:</h1>
	Users with access to the system console may be able to cause system
	misbehaviour.
 </body>
 </description>
 <references>
 <cvename>CVE-2021-29632</cvename>
 <freebsdsa>SA-22:01.vt</freebsdsa>
 </references>
 <dates>
 <discovery>2022-01-11</discovery>
 <entry>2022-02-02</entry>
 </dates>
 </vuln>

<vuln vid="8579074c-839f-11ec-a3b2-005056a311d1">
 <topic>samba -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>samba413</name>
	<range><lt>4.13.17</lt></range>
 </package>
 <package>
	<name>samba414</name>
	<range><lt>4.14.12</lt></range>
 </package>
 <package>
	<name>samba415</name>
	<range><lt>4.15.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="https://www.samba.org/samba/history/security.html">
	 <ul>
	 <li>CVE-2021-43566: Malicious client using an SMB1 or NFS race to allow
	 a directory to be created in an area of the server file system not
	 exported under the share definition.</li>
	 <li>CVE-2021-44141: Information leak via symlinks of existance of files
	 or directories outside of the exported share.</li>
	 <li>CVE-2021-44142: Out-of-bounds heap read/write vulnerability
	 in VFS module vfs_fruit allows code execution.</li>
	 <li>CVE-2022-0336: Samba AD users with permission to write to
	 an account can impersonate arbitrary services.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-43566</cvename>
 <cvename>CVE-2021-44141</cvename>
 <cvename>CVE-2021-44142</cvename>
 <cvename>CVE-2022-0336</cvename>
 <url>https://www.samba.org/samba/security/CVE-2021-43566.html</url>
 <url>https://www.samba.org/samba/security/CVE-2021-44141.html</url>
 <url>https://www.samba.org/samba/security/CVE-2021-44142.html</url>
 <url>https://www.samba.org/samba/security/CVE-2022-0336.html</url>
 </references>
 <dates>
 <discovery>2022-01-31</discovery>
 <entry>2022-02-01</entry>
 </dates>
 </vuln>

<vuln vid="ee26f513-826e-11ec-8be6-d4c9ef517024">
 <topic>Rust -- Race condition enabling symlink following</topic>
 <affects>
 <package>
	<name>rust</name>
	<range><lt>1.58.1</lt></range>
 </package>
 <package>
	<name>rust-nightly</name>
	<range><lt>1.60.0.20220202</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://blog.rust-lang.org/2022/01/20/cve-2022-21658.html">
	 The Rust Security Response WG was notified that the
	 std::fs::remove_dir_all standard library function is vulnerable to a
	 race condition enabling symlink following (CWE-363). An attacker could
	 use this security issue to trick a privileged program into deleting
	 files and directories the attacker couldn't otherwise access or
	 delete.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-21658</cvename>
 <url>https://blog.rust-lang.org/2022/01/20/cve-2022-21658.html</url>
 </references>
 <dates>
 <discovery>2022-01-20</discovery>
 <entry>2022-01-31</entry>
 <modified>2022-02-03</modified>
 </dates>
 </vuln>

<vuln vid="b0c83e1a-8153-11ec-84f9-641c67a117d8">
 <topic>varnish -- Request Smuggling Vulnerability</topic>
 <affects>
 <package>
	<name>varnish6</name>
	<range><lt>6.6.2</lt></range>
 </package>
 <package>
	<name>varnish4</name>
	<range><lt>4.1.11r6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Varnish Cache Project reports:
	<blockquote cite="https://varnish-cache.org/security/VSV00008.html">
	 A request smuggling attack can be performed on HTTP/1 connections on
	 Varnish Cache servers. The smuggled request would be treated as an additional
	 request by the Varnish server, go through normal VCL processing, and injected
	 as a spurious response on the client connection.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-23959</cvename>
 <url>https://varnish-cache.org/security/VSV00008.html</url>
 <url>https://docs.varnish-software.com/security/VSV00008/</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23959</url>
 </references>
 <dates>
 <discovery>2022-01-25</discovery>
 <entry>2022-01-29</entry>
 </dates>
 </vuln>

<vuln vid="b6ef8a53-8062-11ec-9af3-fb232efe4d2e">
 <topic>OpenEXR -- Heap-buffer-overflow in Imf_3_1::LineCompositeTask::execute</topic>
 <affects>
 <package>
	<name>openexr</name>
	<range><lt>3.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cary Phillips reports:
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.4/CHANGES.md#version-314-january-26-2022">
	 [OpenEXR Version 3.1.4 is a] patch release that [...]
	 addresses one public security vulnerability:
	 CVE-2021-45942 Heap-buffer-overflow in
	 Imf_3_1::LineCompositeTask::execute [and several]
	 specific OSS-fuzz issues [...].
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-45942</cvename>
 <url>https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.4/CHANGES.md#version-314-january-26-2022</url>
 <url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41416</url> 
 <url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41999</url> 
 <url>https://github.com/AcademySoftwareFoundation/openexr/pull/1209</url> 
 </references>
 <dates>
 <discovery>2021-11-26</discovery>
 <entry>2022-01-28</entry>
 </dates>
 </vuln>

<vuln vid="1aaaa5c6-804d-11ec-8be6-d4c9ef517024">
 <topic>OpenSSL -- BN_mod_exp incorrect results on MIPS</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.1.1m,1</lt></range>
 </package>
 <package>
	<name>openssl-devel</name>
	<range><lt>3.0.1</lt></range>
 </package>
 <package>
	<name>openssl-quictls</name>
	<range><lt>3.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20220128.txt">
	 BN_mod_exp may produce incorrect results on MIPS (Moderate)
	 There is a carry propagation bug in the MIPS32 and MIPS64 squaring
	 procedure. Many EC algorithms are affected, including some of the
	 TLS 1.3 default curves. Impact was not analyzed in detail, because the
	 pre-requisites for attack are considered unlikely and include reusing
	 private keys. Analysis suggests that attacks against RSA and DSA as a
	 result of this defect would be very difficult to perform and are not
	 believed likely. Attacks against DH are considered just feasible
	 (although very difficult) because most of the work necessary to deduce
	 information about a private key may be performed offline. The amount
	 of resources required for such an attack would be significant.
	 However, for an attack on TLS to be meaningful, the server would have
	 to share the DH private key among multiple clients, which is no longer
	 an option since CVE-2016-0701.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-4160</cvename>
 <url>https://www.openssl.org/news/secadv/20220128.txt</url>
 </references>
 <dates>
 <discovery>2022-01-28</discovery>
 <entry>2022-01-28</entry>
 </dates>
 </vuln>

<vuln vid="65847d9d-7f3e-11ec-8624-b42e991fc52e">
 <topic>mustache - Possible Remote Code Execution</topic>
 <affects>
 <package>
	<name>phpmustache</name>
	<range><lt>2.14.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	huntr.dev reports:
	<blockquote cite="https://huntr.dev/bounties/a5f5a988-aa52-4443-839d-299a63f44fb7/">
	 In Mustache.php v2.0.0 through v2.14.0, Sections tag can
	 lead to arbitrary php code execution even if
	 strict_callables is true when section value is
	 controllable.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-0323</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-0323</url>
 </references>
 <dates>
 <discovery>2022-01-20</discovery>
 <entry>2022-01-27</entry>
 </dates>
 </vuln>

<vuln vid="0f8bf913-7efa-11ec-8c04-2cf05d620ecc">
 <topic>polkit -- Local Privilege Escalation</topic>
 <affects>
 <package>
	<name>polkit</name>
	<range><lt>0.120_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Qualys reports:
	<blockquote cite="https://seclists.org/oss-sec/2022/q1/80">
	 We discovered a Local Privilege Escalation (from any user to root) in
polkit's pkexec, a SUID-root program that is installed by default on
every major Linux distribution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-4034</cvename>
 <url>https://seclists.org/oss-sec/2022/q1/80</url>
 <freebsdpr>ports/261482</freebsdpr>
 </references>
 <dates>
 <discovery>2022-01-25</discovery>
 <entry>2022-01-26</entry>
 </dates>
 </vuln>

<vuln vid="ccaea96b-7dcd-11ec-93df-00224d821998">
 <topic>strongswan - Incorrect Handling of Early EAP-Success Messages</topic>
 <affects>
 <package>
	<name>strongswan</name>
	<range><lt>5.9.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Strongswan Release Notes reports:
	<blockquote cite="https://github.com/strongswan/strongswan/releases/tag/5.9.5">
	 Fixed a vulnerability in the EAP client implementation
	 that was caused by incorrectly handling early EAP-Success
	 messages. It may allow to bypass the client and in some
	 scenarios even the server authentication, or could lead to
	 a denial-of-service attack. This vulnerability has been
	 registered as CVE-2021-45079.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-45079</cvename>
 <url>https://www.strongswan.org/blog/2022/01/24/strongswan-vulnerability-(cve-2021-45079).html</url>
 </references>
 <dates>
 <discovery>2021-12-16</discovery>
 <entry>2022-01-25</entry>
 </dates>
 </vuln>

<vuln vid="58528a94-5100-4208-a04d-edc01598cf01">
 <topic>strongswan - denial-of-service vulnerability in the gmp plugin/denial-of-service vulnerability in the in-memory certificate cache</topic>
 <affects>
 <package>
	<name>strongswan</name>
	<range><lt>5.9.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Strongswan Release Notes reports:
	<blockquote cite="https://github.com/strongswan/strongswan/releases/tag/5.9.4">
	 Fixed a denial-of-service vulnerability in the gmp plugin that
	 was caused by an integer overflow when processing RSASSA-PSS
	 signatures with very large salt lengths. This vulnerability has
	 been registered as CVE-2021-41990.
	 Fixed a denial-of-service vulnerability in the in-memory
	 certificate cache if certificates are replaced and a very large
	 random value caused an integer overflow. This vulnerability has
	 been registered as CVE-2021-41991.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41990</cvename>
 <cvename>CVE-2021-41991</cvename>
 <url>https://www.strongswan.org/blog/2021/10/18/strongswan-vulnerability-(cve-2021-41990).html</url>
 <url>https://www.strongswan.org/blog/2021/10/18/strongswan-vulnerability-(cve-2021-41991).html</url>
 </references>
 <dates>
 <discovery>2021-10-04</discovery>
 <entry>2022-01-25</entry>
 </dates>
 </vuln>

<vuln vid="309c35f4-7c9f-11ec-a739-206a8a720317">
 <topic>aide -- heap-based buffer overflow</topic>
 <affects>
 <package>
	<name>aide</name>
	<range><lt>0.17.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	David Bouman reports:
	<blockquote cite="INSERT URL HERE">
	 AIDE before 0.17.4 allows local users to obtain root privileges
	 via crafted file metadata (such as XFS extended attributes or
	 tmpfs ACLs), because of a heap-based buffer overflow.
	 Aide uses a fixed size (16k bytes) for the return buffer in
	 encode_base64/decode_base64 functions. This results in a segfault
	 if aide processes a file with too large extended attribute value
	 or ACL.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-45417</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45417</url>
 </references>
 <dates>
 <discovery>2022-01-15</discovery>
 <entry>2022-01-23</entry>
 </dates>
 </vuln>

<vuln vid="51496cbc-7a0e-11ec-a323-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>97.0.4692.99</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html">
	 This release contains 26 security fixes, including:
	 <ul>
	 <li>[1284367] Critical CVE-2022-0289: Use after free in Safe
	 browsing. Reported by Sergei Glazunov of Google Project Zero on
	 2022-01-05</li>
	 <li>[1260134][1260007] High CVE-2022-0290: Use after free in Site
	 isolation. Reported by Brendon Tiszka and Sergei Glazunov of
	 Google Project Zero on 2021-10-15</li>
	 <li>[1281084] High CVE-2022-0291: Inappropriate implementation in
	 Storage. Reported by Anonymous on 2021-12-19</li>
	 <li>[1270358] High CVE-2022-0292: Inappropriate implementation in
	 Fenced Frames. Reported by Brendon Tiszka on 2021-11-16</li>
	 <li>[1283371] High CVE-2022-0293: Use after free in Web packaging.
	 Reported by Rong Jian and Guang Gong of 360 Alpha Lab on
	 2021-12-30</li>
	 <li>[1273017] High CVE-2022-0294: Inappropriate implementation in
	 Push messaging. Reported by Rong Jian and Guang Gong of 360 Alpha
	 Lab on 2021-11-23</li>
	 <li>[1278180] High CVE-2022-0295: Use after free in Omnibox.
	 Reported by Weipeng Jiang (@Krace) and Guang Gong of 360
	 Vulnerability Research Institute on 2021-12-09</li>
	 <li>[1283375] High CVE-2022-0296: Use after free in Printing.
	 Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability
	 Research Institute on 2021-12-30</li>
	 <li>[1274316] High CVE-2022-0297: Use after free in Vulkan. Reported
	 by Cassidy Kim of Amber Security Lab, OPPO Mobile
	 Telecommunications Corp. Ltd. on 2021-11-28</li>
	 <li>[1212957] High CVE-2022-0298: Use after free in Scheduling.
	 Reported by Yangkang (@dnpushme) of 360 ATA on 2021-05-25</li>
	 <li>[1275438] High CVE-2022-0300: Use after free in Text Input
	 Method Editor. Reported by Rong Jian and Guang Gong of 360 Alpha
	 Lab on 2021-12-01</li>
	 <li>[1276331] High CVE-2022-0301: Heap buffer overflow in DevTools.
	 Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability
	 Research on 2021-12-03</li>
	 <li>[1278613] High CVE-2022-0302: Use after free in Omnibox.
	 Reported by Weipeng Jiang (@Krace) and Guang Gong of 360
	 Vulnerability Research Institute on 2021-12-10</li>
	 <li>[1281979] High CVE-2022-0303: Race in GPU Watchdog. Reported by
	 Yigit Can YILMAZ (@yilmazcanyigit) on 2021-12-22</li>
	 <li>[1282118] High CVE-2022-0304: Use after free in Bookmarks.
	 Reported by Rong Jian and Guang Gong of 360 Alpha Lab on
	 2021-12-22</li>
	 <li>[1282354] High CVE-2022-0305: Inappropriate implementation in
	 Service Worker API. Reported by @uwu7586 on 2021-12-23</li>
	 <li>[1283198] High CVE-2022-0306: Heap buffer overflow in PDFium.
	 Reported by Sergei Glazunov of Google Project Zero on
	 2021-12-29</li>
	 <li>[1281881] Medium CVE-2022-0307: Use after free in Optimization
	 Guide. Reported by Samet Bekmezci @sametbekmezci on
	 2021-12-21</li>
	 <li>[1282480] Medium CVE-2022-0308: Use after free in Data Transfer.
	 Reported by @ginggilBesel on 2021-12-24</li>
	 <li>[1240472] Medium CVE-2022-0309: Inappropriate implementation in
	 Autofill. Reported by Alesandro Ortiz on 2021-08-17</li>
	 <li>[1283805] Medium CVE-2022-0310: Heap buffer overflow in Task
	 Manager. Reported by Samet Bekmezci @sametbekmezci on
	 2022-01-03</li>
	 <li>[1283807] Medium CVE-2022-0311: Heap buffer overflow in Task
	 Manager. Reported by Samet Bekmezci @sametbekmezci on
	 2022-01-03</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-0289</cvename>
 <cvename>CVE-2022-0290</cvename>
 <cvename>CVE-2022-0291</cvename>
 <cvename>CVE-2022-0292</cvename>
 <cvename>CVE-2022-0293</cvename>
 <cvename>CVE-2022-0294</cvename>
 <cvename>CVE-2022-0295</cvename>
 <cvename>CVE-2022-0296</cvename>
 <cvename>CVE-2022-0297</cvename>
 <cvename>CVE-2022-0298</cvename>
 <cvename>CVE-2022-0300</cvename>
 <cvename>CVE-2022-0301</cvename>
 <cvename>CVE-2022-0302</cvename>
 <cvename>CVE-2022-0303</cvename>
 <cvename>CVE-2022-0304</cvename>
 <cvename>CVE-2022-0305</cvename>
 <cvename>CVE-2022-0306</cvename>
 <cvename>CVE-2022-0307</cvename>
 <cvename>CVE-2022-0308</cvename>
 <cvename>CVE-2022-0309</cvename>
 <cvename>CVE-2022-0310</cvename>
 <cvename>CVE-2022-0311</cvename>
 <url>https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html</url>
 </references>
 <dates>
 <discovery>2022-01-19</discovery>
 <entry>2022-01-20</entry>
 </dates>
 </vuln>

<vuln vid="7262f826-795e-11ec-8be6-d4c9ef517024">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql-connector-odbc</name>
	<range><lt>8.0.28</lt></range>
 </package>
 <package>
	<name>mysql-connector-c++</name>
	<range><lt>8.0.28</lt></range>
 </package>
 <package>
	<name>mysql-connector-java</name>
	<range><lt>8.0.28</lt></range>
 </package>
 <package>
	<name>mysql-connector-java51</name>
	<range><lt>8.0.28</lt></range>
 </package>
 <package>
	<name>mysql-server55</name>
	<range><lt>5.5.63</lt></range>
 </package>
 <package>
	<name>mysql-server56</name>
	<range><lt>5.6.52</lt></range>
 </package>
 <package>
	<name>mysql-server57</name>
	<range><lt>5.7.37</lt></range>
 </package>
 <package>
	<name>mysql-server80</name>
	<range><lt>8.0.27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujan2022.html#AppendixMSQL">
	 This Critical Patch Update contains 78 new security patches for
	 Oracle MySQL. 3 of these vulnerabilities may be remotely exploitable
	 without authentication, i.e., may be exploited over a network without
	 requiring user credentials. 
	 The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
	 MySQL is 7.4
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-22946</cvename>
 <cvename>CVE-2021-3712</cvename>
 <cvename>CVE-2022-21278</cvename>
 <cvename>CVE-2022-21351</cvename>
 <cvename>CVE-2022-21363</cvename>
 <cvename>CVE-2022-21358</cvename>
 <cvename>CVE-2022-21352</cvename>
 <cvename>CVE-2022-21367</cvename>
 <cvename>CVE-2022-21301</cvename>
 <cvename>CVE-2022-21378</cvename>
 <cvename>CVE-2022-21302</cvename>
 <cvename>CVE-2022-21254</cvename>
 <cvename>CVE-2022-21348</cvename>
 <cvename>CVE-2022-21270</cvename>
 <cvename>CVE-2022-21256</cvename>
 <cvename>CVE-2022-21379</cvename>
 <cvename>CVE-2022-21362</cvename>
 <cvename>CVE-2022-21374</cvename>
 <cvename>CVE-2022-21253</cvename>
 <cvename>CVE-2022-21264</cvename>
 <cvename>CVE-2022-21297</cvename>
 <cvename>CVE-2022-21339</cvename>
 <cvename>CVE-2022-21342</cvename>
 <cvename>CVE-2022-21370</cvename>
 <cvename>CVE-2022-21304</cvename>
 <cvename>CVE-2022-21344</cvename>
 <cvename>CVE-2022-21303</cvename>
 <cvename>CVE-2022-21368</cvename>
 <cvename>CVE-2022-21245</cvename>
 <cvename>CVE-2022-21265</cvename>
 <cvename>CVE-2022-21249</cvename>
 <cvename>CVE-2022-21372</cvename>
 <url>https://www.oracle.com/security-alerts/cpujan2022.html#AppendixMSQL</url>
 </references>
 <dates>
 <discovery>2022-01-18</discovery>
 <entry>2022-01-19</entry>
 </dates>
 </vuln>

<vuln vid="e3ec8b30-757b-11ec-922f-654747404482">
 <topic>Prosody XMPP server advisory 2022-01-13</topic>
 <affects>
 <package>
	<name>prosody</name>
	<range><lt>0.11.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Prosody teaM reports:
	<blockquote cite="https://prosody.im/security/advisory_20220113/">
	 It was discovered that an internal Prosody library to load XML based on
	 does not properly restrict the XML features allowed in parsed
	 XML data. Given suitable attacker input, this results in expansion of
	 recursive entity references from DTDs (CWE-776). In addition,
	 depending on the libexpat version used, it may also allow injections
	 using XML External Entity References (CWE-611).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-0217</cvename>
 <url>https://prosody.im/security/advisory_20220113/</url>
 </references>
 <dates>
 <discovery>2022-01-10</discovery>
 <entry>2022-01-14</entry>
 </dates>
 </vuln>

<vuln vid="79b65dc5-749f-11ec-8be6-d4c9ef517024">
 <topic>WordPress -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>5.8.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The WordPress project reports:
	<blockquote cite="https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/">
	 <ul><li>Issue with stored XSS through post slugs</li>
	 <li>Issue with Object injection in some multisite installations</li>
	 <li>SQL injection vulnerability in WP_Query</li>
	 <li>SQL injection vulnerability in WP_Meta_Query</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/</url>
 </references>
 <dates>
 <discovery>2022-01-06</discovery>
 <entry>2022-01-13</entry>
 </dates>
 </vuln>

<vuln vid="2a6106c6-73e5-11ec-8fa2-0800270512f4">
 <topic>clamav -- invalid pointer read that may cause a crash</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.104.2,1</lt></range>
 </package>
 <package>
	<name>clamav-lts</name>
	<range><lt>0.103.5,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Laurent Delosieres reports:
	<blockquote cite="https://blog.clamav.net/2022/01/clamav-01035-and-01042-security-patch.html">
	 
	 Fix for invalid pointer read that may cause a crash. This issue affects
	 0.104.1, 0.103.4 and prior when ClamAV is compiled with libjson-c and the
	 <code>CL_SCAN_GENERAL_COLLECT_METADATA</code> scan option
	 (the <code>clamscan --gen-json</code> option) is enabled.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-20698</cvename>
 <url>https://blog.clamav.net/2022/01/clamav-01035-and-01042-security-patch.html</url>
 </references>
 <dates>
 <discovery>2022-01-12</discovery>
 <entry>2022-01-12</entry>
 </dates>
 </vuln>

<vuln vid="672eeea9-a070-4f88-b0f1-007e90a2cbc3">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.330</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.319.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2021-11-04/">
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-2558 / CVE-2022-20612</h5>
	 CSRF vulnerability in build triggers
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-20612</cvename>
 <url>https://www.jenkins.io/security/advisory/2022-01-12/</url>
 </references>
 <dates>
 <discovery>2022-01-12</discovery>
 <entry>2022-01-12</entry>
 </dates>
 </vuln>

<vuln vid="43f84437-73ab-11ec-a587-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>14.6.0</ge><lt>14.6.2</lt></range>
	<range><ge>14.5.0</ge><lt>14.5.3</lt></range>
	<range><ge>7.7</ge><lt>14.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2022/01/11/security-release-gitlab-14-6-2-released/">
	 Arbitrary file read via group import feature
	 Stored XSS in notes
	 Lack of state parameter on GitHub import project OAuth
	 Vulnerability related fields are available to unauthorized users on GraphQL API
	 Deleting packages may cause table locks
	 IP restriction bypass via GraphQL
	 Repository content spoofing using Git replacement references
	 Users can import members from projects that they are not a maintainer on through API
	 Possibility to direct user to malicious site through Slack integration
	 Bypassing file size limits to the NPM package repository
	 User with expired password can still access sensitive information
	 Incorrect port validation allows access to services on ports 80 and 443 if GitLab is configured to run on another port
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-39946</cvename>
 <cvename>CVE-2022-0154</cvename>
 <cvename>CVE-2022-0152</cvename>
 <cvename>CVE-2022-0151</cvename>
 <cvename>CVE-2022-0172</cvename>
 <cvename>CVE-2022-0090</cvename>
 <cvename>CVE-2022-0125</cvename>
 <cvename>CVE-2022-0124</cvename>
 <cvename>CVE-2021-39942</cvename>
 <cvename>CVE-2022-0093</cvename>
 <cvename>CVE-2021-39927</cvename>
 <url>https://about.gitlab.com/releases/2022/01/11/security-release-gitlab-14-6-2-released/</url>
 </references>
 <dates>
 <discovery>2022-01-11</discovery>
 <entry>2022-01-12</entry>
 </dates>
 </vuln>

<vuln vid="b927b654-7146-11ec-ad4b-5404a68ad561">
 <topic>uriparser -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>uriparser</name>
	<range><lt>0.9.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Upstream project reports:
	<blockquote cite="https://github.com/uriparser/uriparser/blob/uriparser-0.9.6/ChangeLog">
	 Fix a bug affecting both uriNormalizeSyntax* and uriMakeOwner*
	 functions where the text range in .hostText would not be duped using
	 malloc but remain unchanged (and hence "not owned") for URIs with
	 an IPv4 or IPv6 address hostname; depending on how an application
	 uses uriparser, this could lead the application into a use-after-free
	 situation.
	 As the second half, fix uriFreeUriMembers* functions that would not
	 free .hostText memory for URIs with an IPv4 or IPv6 address host;
	 also, calling uriFreeUriMembers* multiple times on a URI of this
	 very nature would result in trying to free pointers to stack
	 (rather than heap) memory.
	 Fix functions uriNormalizeSyntax* for out-of-memory situations
	 (i.e. malloc returning NULL) for URIs containing empty segments
	 (any of user info, host text, query, or fragment) where previously
	 pointers to stack (rather than heap) memory were freed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-46141</cvename>
 <cvename>CVE-2021-46142</cvename>
 <url>https://github.com/uriparser/uriparser/blob/uriparser-0.9.6/ChangeLog</url>
 </references>
 <dates>
 <discovery>2022-01-06</discovery>
 <entry>2022-01-09</entry>
 </dates>
 </vuln>

<vuln vid="d3e023fb-6e88-11ec-b948-080027240888">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py37-django22</name>
	<name>py38-django22</name>
	<name>py39-django22</name>
	<range><lt>2.2.26</lt></range>
 </package>
 <package>
	<name>py37-django32</name>
	<name>py38-django32</name>
	<name>py39-django32</name>
	<range><lt>3.2.11</lt></range>
 </package>
 <package>
	<name>py37-django40</name>
	<name>py38-django40</name>
	<name>py39-django40</name>
	<range><lt>4.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django Release reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2022/jan/04/security-releases/">
	 CVE-2021-45115: Denial-of-service possibility in UserAttributeSimilarityValidator.
	 CVE-2021-45116: Potential information disclosure in dictsort template filter.
	 CVE-2021-45452: Potential directory-traversal via Storage.save().
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-45115</cvename>
 <cvename>CVE-2021-45116</cvename>
 <cvename>CVE-2021-45452</cvename>
 <url>https://www.djangoproject.com/weblog/2022/jan/04/security-releases/</url>
 </references>
 <dates>
 <discovery>2021-12-20</discovery>
 <entry>2022-01-06</entry>
 </dates>
 </vuln>

<vuln vid="9c990e67-6e30-11ec-82db-b42e991fc52e">
 <topic>routinator -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>routinator</name>
	<range><lt>0.10.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	nlnetlabs reports:
	<blockquote cite="https://nlnetlabs.nl/projects/rpki/security-advisories/">
	 Release 0.10.2 contains fixes for the following issues:
	 <ul>
	 <li>Medium CVE-2021-43172: Infinite length chain of RRDP
	 repositories. Credit: Koen van Hove. Date: 2021-11-09</li>
	 <li>Medium CVE-2021-43173: Hanging RRDP request.
	 Credit: Koen van Hove. Date: 2021-11-09</li>
	 <li>Medium	CVE-2021-43174: gzip transfer encoding caused
	 out-of-memory crash. Credit Koen van Hove. Date: 2021-11-09</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-43172</cvename>
 <cvename>CVE-2021-43173</cvename>
 <cvename>CVE-2021-43174</cvename>
 <url>https://nlnetlabs.nl/projects/rpki/security-advisories/</url>
 </references>
 <dates>
 <discovery>2021-11-09</discovery>
 <entry>2022-01-05</entry>
 </dates>
 </vuln>

<vuln vid="9eeccbf3-6e26-11ec-bb10-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>97.0.4692.71</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html">
	 This release contains 37 security fixes, including:
	 <ul>
	 <li>[$TBD][1275020] Critical CVE-2022-0096: Use after free in
	 Storage. Reported by Yangkang (@dnpushme) of 360 ATA on
	 2021-11-30</li>
	 <li>[1117173] High CVE-2022-0097: Inappropriate implementation in
	 DevTools. Reported by David Erceg on 2020-08-17</li>
	 <li>[1273609] High CVE-2022-0098: Use after free in Screen Capture.
	 Reported by @ginggilBesel on 2021-11-24</li>
	 <li>[1245629] High CVE-2022-0099: Use after free in Sign-in.
	 Reported by Rox on 2021-09-01</li>
	 <li>[1238209] High CVE-2022-0100: Heap buffer overflow in Media
	 streams API. Reported by Cassidy Kim of Amber Security Lab, OPPO
	 Mobile Telecommunications Corp. Ltd. on 2021-08-10</li>
	 <li>[1249426] High CVE-2022-0101: Heap buffer overflow in Bookmarks.
	 Reported by raven (@raid_akame) on 2021-09-14</li>
	 <li>[1260129] High CVE-2022-0102: Type Confusion in V8 . Reported by
	 Brendon Tiszka on 2021-10-14</li>
	 <li>[1272266] High CVE-2022-0103: Use after free in SwiftShader.
	 Reported by Abraruddin Khan and Omair on 2021-11-21</li>
	 <li>[1273661] High CVE-2022-0104: Heap buffer overflow in ANGLE.
	 Reported by Abraruddin Khan and Omair on 2021-11-25</li>
	 <li>[1274376] High CVE-2022-0105: Use after free in PDF. Reported by
	 Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications
	 Corp. Ltd. on 2021-11-28</li>
	 <li>[1278960] High CVE-2022-0106: Use after free in Autofill.
	 Reported by Khalil Zhani on 2021-12-10</li>
	 <li>[1248438] Medium CVE-2022-0107: Use after free in File Manager
	 API. Reported by raven (@raid_akame) on 2021-09-10</li>
	 <li>[1248444] Medium CVE-2022-0108: Inappropriate implementation in
	 Navigation. Reported by Luan Herrera (@lbherrera_) on
	 2021-09-10</li>
	 <li>[1261689] Medium CVE-2022-0109: Inappropriate implementation in
	 Autofill. Reported by Young Min Kim (@ylemkimon), CompSec Lab at
	 Seoul National University on 2021-10-20</li>
	 <li>[1237310] Medium CVE-2022-0110: Incorrect security UI in
	 Autofill. Reported by Alesandro Ortiz on 2021-08-06</li>
	 <li>[1241188] Medium CVE-2022-0111: Inappropriate implementation in
	 Navigation. Reported by garygreen on 2021-08-18</li>
	 <li>[1255713] Medium CVE-2022-0112: Incorrect security UI in Browser
	 UI. Reported by Thomas Orlita on 2021-10-04</li>
	 <li>[1039885] Medium CVE-2022-0113: Inappropriate implementation in
	 Blink. Reported by Luan Herrera (@lbherrera_) on 2020-01-07</li>
	 <li>[1267627] Medium CVE-2022-0114: Out of bounds memory access in
	 Web Serial. Reported by Looben Yang on 2021-11-06</li>
	 <li>[1268903] Medium CVE-2022-0115: Uninitialized Use in File API.
	 Reported by Mark Brand of Google Project Zero on 2021-11-10</li>
	 <li>[1272250] Medium CVE-2022-0116: Inappropriate implementation in
	 Compositing. Reported by Irvan Kurniawan (sourc7) on
	 2021-11-20</li>
	 <li>[1115847] Low CVE-2022-0117: Policy bypass in Service Workers.
	 Reported by Dongsung Kim (@kid1ng) on 2020-08-13</li>
	 <li>[1238631] Low CVE-2022-0118: Inappropriate implementation in
	 WebShare. Reported by Alesandro Ortiz on 2021-08-11</li>
	 <li>[1262953] Low CVE-2022-0120: Inappropriate implementation in
	 Passwords. Reported by CHAKRAVARTHI (Ruler96) on 2021-10-25</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2022-0096</cvename>
 <cvename>CVE-2022-0097</cvename>
 <cvename>CVE-2022-0098</cvename>
 <cvename>CVE-2022-0099</cvename>
 <cvename>CVE-2022-0100</cvename>
 <cvename>CVE-2022-0101</cvename>
 <cvename>CVE-2022-0102</cvename>
 <cvename>CVE-2022-0103</cvename>
 <cvename>CVE-2022-0104</cvename>
 <cvename>CVE-2022-0105</cvename>
 <cvename>CVE-2022-0106</cvename>
 <cvename>CVE-2022-0107</cvename>
 <cvename>CVE-2022-0108</cvename>
 <cvename>CVE-2022-0109</cvename>
 <cvename>CVE-2022-0110</cvename>
 <cvename>CVE-2022-0111</cvename>
 <cvename>CVE-2022-0112</cvename>
 <cvename>CVE-2022-0113</cvename>
 <cvename>CVE-2022-0114</cvename>
 <cvename>CVE-2022-0115</cvename>
 <cvename>CVE-2022-0116</cvename>
 <cvename>CVE-2022-0117</cvename>
 <cvename>CVE-2022-0118</cvename>
 <cvename>CVE-2022-0120</cvename>
 <url>https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2022-01-04</discovery>
 <entry>2022-01-05</entry>
 </dates>
 </vuln>

<vuln vid="47197b47-6a1a-11ec-8be6-d4c9ef517024">
 <topic>Roundcube -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><lt>1.5.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Roundcube project reports:
	<blockquote cite="://roundcube.net/news/2021/12/30/update-1.5.2-released">
	 Cross-site scripting (XSS) via HTML messages with malicious CSS
	 content
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://roundcube.net/news/2021/12/30/update-1.5.2-released</url>
 </references>
 <dates>
 <discovery>2021-12-30</discovery>
 <entry>2021-12-31</entry>
 </dates>
 </vuln>

<vuln vid="c1b2b492-6999-11ec-a50c-001cc0382b2f">
 <topic>Mbed TLS -- Potential double-free after an out of memory error</topic>
 <affects>
 <package>
	<name>mbedtls</name>
	<range><lt>2.16.12</lt></range>
	<range><ge>2.17.0</ge><lt>2.28.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Manuel Pégourié-Gonnard reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-12">
	 If mbedtls_ssl_set_session() or mbedtls_ssl_get_session() were to
	 fail with MBEDTLS_ERR_SSL_ALLOC_FAILED (in an out of memory
	 condition), then calling mbedtls_ssl_session_free() and
	 mbedtls_ssl_free() in the usual manner would cause an internal
	 session buffer to be freed twice, due to two structures both having
	 valid pointers to it after a call to ssl_session_copy().
	 An attacker could potentially trigger the out of memory condition,
	 and therefore use this bug to create memory corruption, which could
	 then be further exploited or targetted.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44732</cvename>
 <url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-12</url>
 </references>
 <dates>
 <discovery>2021-12-14</discovery>
 <entry>2021-12-30</entry>
 </dates>
 </vuln>

<vuln vid="ede832bf-6576-11ec-a636-000c29061ce6">
 <topic>OpenDMARC - Remote denial of service</topic>
 <affects>
 <package>
	<name>opendmarc</name>
	<range><ge>1.4.1</ge><lt>1.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenDMARC 1.4.1 and 1.4.1.1 will dereference a NULL pointer when
	encountering a multi-value From: header field. A remote attacker can
	send a specially crafted message resulting in a denial of service.
 </body>
 </description>
 <references>
 <cvename>CVE-2021-34555</cvename>
 <url>https://github.com/trusteddomainproject/OpenDMARC/issues/179</url>
 </references>
 <dates>
 <discovery>2021-06-09</discovery>
 <entry>2021-12-30</entry>
 </dates>
 </vuln>

<vuln vid="937aa1d6-685e-11ec-a636-000c29061ce6">
 <topic>OpenDMARC - Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opendmarc</name>
	<range><lt>1.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenDMARC releases prior to 1.4.1 are susceptible to the following
	vulnerabilities:
	<ul>
	 <li>(CVE-2019-16378) OpenDMARC through 1.3.2 and 1.4.x through
	 1.4.0-Beta1 is prone to a signature-bypass vulnerability with
	 multiple From: addresses, which might affect applications that
	 consider a domain name to be relevant to the origin of an e-mail
	 message.</li>
	 <li>(CVE-2019-20790) OpenDMARC through 1.3.2 and 1.4.x, when used
	 with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC
	 authentication in situations where the HELO field is inconsistent
	 with the MAIL FROM field.</li>
	 <li>(CVE-2020-12272) OpenDMARC through 1.3.2 and 1.4.x allows
	 attacks that inject authentication results to provide false
	 information about the domain that originated an e-mail
	 message.</li>
	 <li>(CVE-2020-12460) OpenDMARC through 1.3.2 and 1.4.x through
	 1.4.0-Beta1 has improper null termination in the function
	 opendmarc_xml_parse that can result in a one-byte heap overflow in
	 opendmarc_xml when parsing a specially crafted DMARC aggregate
	 report. This can cause remote memory corruption.</li>
	</ul>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-16378</cvename>
 <cvename>CVE-2019-20790</cvename>
 <cvename>CVE-2020-12272</cvename>
 <cvename>CVE-2020-12460</cvename>
 <url>https://github.com/trusteddomainproject/OpenDMARC/blob/rel-opendmarc-1-4-1-1/RELEASE_NOTES</url>
 </references>
 <dates>
 <discovery>2021-04-06</discovery>
 <entry>2021-12-30</entry>
 </dates>
 </vuln>

<vuln vid="a4ff3673-d742-4b83-8c2b-3ddafe732034">
 <topic>minio -- User privilege escalation</topic>
 <affects>
 <package>
	<name>minio</name>
	<range><lt>2021.12.27.07.23.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	minio developers report:
	<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cx">
	 AddUser() API endpoint was exposed to a legacy behavior. i.e it accepts a "policy" field
	 This API is mainly used to create a user or update a user's password.
	 However, a malicious client can hand-craft an HTTP API call that allows for updating Policy for a user and gaining higher privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-43858</cvename>
 <url>https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cx</url>
 </references>
 <dates>
 <discovery>2021-12-27</discovery>
 <entry>2021-12-29</entry>
 </dates>
 </vuln>

<vuln vid="ed8a4215-675c-11ec-8dd4-a0f3c100ae18">
 <topic>Pillow -- Regular Expression Denial of Service (ReDoS)</topic>
 <affects>
 <package>
	<name>py38-pillow</name>
	<range><ge>5.2.0</ge><lt>8.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitHub Advisory Database reports:
	<blockquote cite="https://github.com/advisories/GHSA-98vv-pw6r-q6q4">
	 Uncontrolled Resource Consumption in pillow.
	 The package pillow from 0 and before 8.3.2 are vulnerable to Regular
	 Expression Denial of Service (ReDoS) via the getrgb function.
	 References:
	 <ul>
	 <li>https://nvd.nist.gov/vuln/detail/CVE-2021-23437</li>
	 <li>https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b</li>
	 <li>https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html</li>
	 <li>https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443</li>
	 <li>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C/</li>
	 <li>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT/</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-23437</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-23437</url>
 </references>
 <dates>
 <discovery>2021-09-02</discovery>
 <entry>2021-09-03</entry>
 </dates>
 </vuln>

<vuln vid="d1be3d73-6737-11ec-9eea-589cfc007716">
 <topic>OpenSearch -- Log4Shell</topic>
 <affects>
 <package>
	<name>opensearch</name>
	<range><lt>1.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSearch reports:
	<blockquote cite="https://opensearch.org/blog/releases/2021/12/update-1-2-3/">
	 CVE-2021-45105 for Log4j was issued after the release of OpenSearch 1.2.2. This CVE advises upgrading to Log4j 2.17.0. While there has been no observed reproduction of the issue described in CVE-2021-45105 in OpenSearch, we have released OpenSearch 1.2.3 which updates Log4j to version 2.17.0.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-45105</cvename>
 <url>https://opensearch.org/blog/releases/2021/12/update-1-2-3/</url>
 </references>
 <dates>
 <discovery>2021-12-16</discovery>
 <entry>2021-12-27</entry>
 </dates>
 </vuln>

<vuln vid="b0f49cb9-6736-11ec-9eea-589cfc007716">
 <topic>OpenSearch -- Log4Shell</topic>
 <affects>
 <package>
	<name>opensearch</name>
	<range><lt>1.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSearch reports:
	<blockquote cite="https://opensearch.org/blog/releases/2021/12/update-1-2-2/">
	 CVE-2021-45046 was issued shortly following the release of OpenSearch 1.2.1. This new CVE advises upgrading from Log4j 2.15.0 (used in OpenSearch 1.2.1) to Log4j 2.16.0. Out of an abundance of caution, the team is releasing OpenSearch 1.2.2 which includes Log4j 2.16.0. While there has been no observed reproduction of the issue described in CVE-2021-45046, Log4j 2.16.0 takes much more extensive JNDI mitigation measures.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-45046</cvename>
 <url>https://opensearch.org/blog/releases/2021/12/update-1-2-2/</url>
 </references>
 <dates>
 <discovery>2021-12-14</discovery>
 <entry>2021-12-27</entry>
 </dates>
 </vuln>

<vuln vid="1135e939-62b4-11ec-b8e2-1c1b0d9ea7e6">
 <topic>opengrok -- Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise OpenGrok.</topic>
 <affects>
 <package>
	<name>opengrok</name>
	<range><le>1.6.7</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bobby Rauch of Accenture reports:
	<blockquote cite="https://medium.com/@bobbyrsec/oracle-opengrok-rce-cve-2021-2322-a284e5621bfe">
	 I ended up finding OpenGrok, and after careful testing, discovered that OpenGrok insecurely deserializes XML input, which can lead to Remote Code Execution. This vulnerability was found in all versions of OpenGrok &lt;1.6.8 and was reported to Oracle. The vulnerability has now been patched in OpenGrok 1.6.9, and has been issued a CVE. (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2322)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-2322</cvename>
 <url>https://www.oracle.com/security-alerts/oracle-open-source-cves-outside-other-oracle-public-documents.html</url>
 <url>https://www.oracle.com/security-alerts/oracle-open-source-cves-outside-other-oracle-public-documents.html</url>
 <url>https://github.com/oracle/opengrok/pull/3528</url>
 </references>
 <dates>
 <discovery>2021-04-07</discovery>
 <entry>2021-12-21</entry>
 </dates>
 </vuln>

<vuln vid="0a50bb48-625f-11ec-a1fb-080027cb2f6f">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki135</name>
	<range><lt>1.35.5</lt></range>
 </package>
 <package>
	<name>mediawiki136</name>
	<range><lt>1.36.3</lt></range>
 </package>
 <package>
	<name>mediawiki137</name>
	<range><lt>1.37.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawiki reports:
	<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/QEN3EK4JXAVJMJ5GF3GYOAKNJPEKFQYA/">
	 (T292763. CVE-2021-44854) REST API incorrectly publicly caches
	 autocomplete search results from private wikis.
	 (T271037, CVE-2021-44856) Title blocked in AbuseFilter can be created via
	 Special:ChangeContentModel.
	 (T297322, CVE-2021-44857) Unauthorized users can use action=mcrundo to
	 replace the content of arbitrary pages.
	 (T297322, CVE-2021-44858) Unauthorized users can view contents of private
	 wikis using various actions.
	 (T297574, CVE-2021-45038) Unauthorized users can access private wiki
	 contents using rollback action
	 (T293589, CVE-2021-44855) Blind Stored XSS in VisualEditor media dialog.
	 (T294686) Special:Nuke doesn't actually delete pages.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44854</cvename>
 <cvename>CVE-2021-44856</cvename>
 <cvename>CVE-2021-44857</cvename>
 <cvename>CVE-2021-44858</cvename>
 <cvename>CVE-2021-45038</cvename>
 <cvename>CVE-2021-44855</cvename>
 <url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/QEN3EK4JXAVJMJ5GF3GYOAKNJPEKFQYA/</url>
 </references>
 <dates>
 <discovery>2021-12-01</discovery>
 <entry>2021-12-21</entry>
 </dates>
 </vuln>

<vuln vid="650734b2-7665-4170-9a0a-eeced5e10a5e">
 <topic>graylog -- remote code execution in log4j from user-controlled log input</topic>
 <affects>
 <package>
 <name>graylog</name>
 <range><lt>4.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Apache Software Foundation reports:
 <blockquote cite="https://logging.apache.org/log4j/2.x/security.html">
 It was found that the fix to address CVE-2021-44228 in Apache
 Log4j 2.15.0 was incomplete in certain non-default
 configurations. This could allows attackers with control over
 Thread Context Map (MDC) input data when the logging
 configuration uses a non-default Pattern Layout with either a
 Context Lookup (for example, $${ctx:loginId}) or a Thread
 Context Map pattern (%X, %mdc, or %MDC) to craft malicious input
 data using a JNDI Lookup pattern resulting in a denial of
 service (DOS) attack. Log4j 2.15.0 makes a best-effort attempt
 to restrict JNDI LDAP lookups to localhost by default. Log4j
 2.16.0 fixes this issue by removing support for message lookup
 patterns and disabling JNDI functionality by default.
 
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-45046</cvename>
 <url>https://github.com/Graylog2/graylog2-server/commit/d3e441f</url>
 <url>https://github.com/Graylog2/graylog2-server/commit/dd24b85</url>
 <url>https://logging.apache.org/log4j/2.x/security.html</url>
 </references>
 <dates>
 <discovery>2021-11-14</discovery>
 <entry>2021-12-17</entry>
 </dates>
 </vuln>

<vuln vid="ca982e2d-61a9-11ec-8be6-d4c9ef517024">
 <topic>Apache httpd -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.52</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
	 moderate: Possible NULL dereference or SSRF in forward proxy
	 configurations in Apache HTTP Server 2.4.51 and earlier (CVE-2021-44224)
	 A crafted URI sent to httpd configured as a forward proxy
	 (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for
	 configurations mixing forward and reverse proxy declarations, can allow
	 for requests to be directed to a declared Unix Domain Socket endpoint
	 (Server Side Request Forgery).
	 high: Possible buffer overflow when parsing multipart content in
	 mod_lua of Apache HTTP Server 2.4.51 and earlier (CVE-2021-44790) A
	 carefully crafted request body can cause a buffer overflow in the
	 mod_lua multipart parser (r:parsebody() called from Lua scripts).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44224</cvename>
 <cvename>CVE-2021-44790</cvename>
 <url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
 </references>
 <dates>
 <discovery>2021-12-20</discovery>
 <entry>2021-12-20</entry>
 </dates>
 </vuln>

<vuln vid="1ea05bb8-5d74-11ec-bb1e-001517a2e1a4">
 <topic>serviio -- affected by log4j vulnerability</topic>
 <affects>
 <package>
	<name>serviio</name>
	<range><lt>2.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Serviio reports:
	<blockquote cite="https://serviio.org/news/124-version-2-2-1-released">
	 Serviio is affectred by the log4j vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44228</cvename>
 </references>
 <dates>
 <discovery>2021-12-13</discovery>
 <entry>2021-12-15</entry>
 </dates>
 </vuln>

<vuln vid="897e1962-5d5a-11ec-a3ed-040e3c3cf7e7">
 <topic>Privoxy -- Multiple vulnerabilities (memory leak, XSS)</topic>
 <affects>
 <package>
	<name>dropbear</name>
	<range><lt>3.0.33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Privoxy reports:
	<blockquote cite="https://lists.privoxy.org/pipermail/privoxy-announce/2021-December/000009.html">
	cgi_error_no_template(): Encode the template name to prevent
	 XSS (cross-site scripting) when Privoxy is configured to servce
	 the user-manual itself.
	Commit 0e668e9409c. OVE-20211102-0001. CVE-2021-44543.
	 Reported by: Artem Ivanov
	get_url_spec_param(): Free memory of compiled pattern spec
	 before bailing.
	 Reported by Joshua Rogers (Opera) who also provided the fix.
	 Commit 652b4b7cb0. OVE-20211201-0003. CVE-2021-44540.
	process_encrypted_request_headers(): Free header memory when
	 failing to get the request destination.
	 Reported by Joshua Rogers (Opera) who also provided the fix.
	 Commit 0509c58045. OVE-20211201-0002. CVE-2021-44541.
	send_http_request(): Prevent memory leaks when handling errors
	 Reported by Joshua Rogers (Opera) who also provided the fix.
	 Commit c48d1d6d08. OVE-20211201-0001. CVE-2021-44542.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44540</cvename>
 <cvename>CVE-2021-44541</cvename>
 <cvename>CVE-2021-44542</cvename>
 <cvename>CVE-2021-44543</cvename>
 <url>https://lists.privoxy.org/pipermail/privoxy-announce/2021-December/000009.html</url>
 </references>
 <dates>
 <discovery>2021-12-09</discovery>
 <entry>2021-12-15</entry>
 </dates>
 </vuln>

<vuln vid="0132ca5b-5d11-11ec-8be6-d4c9ef517024">
 <topic>OpenSSL -- Certificate validation issue</topic>
 <affects>
 <package>
	<name>openssl-devel</name>
	<range><lt>3.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20211214.txt">
	 Invalid handling of X509_verify_cert() internal errors in libssl
	 (Moderate)
	 Internally libssl in OpenSSL calls X509_verify_cert() on the client
	 side to verify a certificate supplied by a server. That function may
	 return a negative return value to indicate an internal error (for
	 example out of memory). Such a negative return value is mishandled by
	 OpenSSL and will cause an IO function (such as SSL_connect() or
	 SSL_do_handshake()) to not indicate success and a subsequent call to
	 SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY.
	 This return value is only supposed to be returned by OpenSSL if the
	 application has previously called SSL_CTX_set_cert_verify_callback().
	 Since most applications do not do this the
	 SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be
	 totally unexpected and applications may not behave correctly as a
	 result. The exact behaviour will depend on the application but it
	 could result in crashes, infinite loops or other similar incorrect
	 responses.
	 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-4044</cvename>
 <url>https://www.openssl.org/news/secadv/20211214.txt</url>
 </references>
 <dates>
 <discovery>2021-12-14</discovery>
 <entry>2021-12-14</entry>
 </dates>
 </vuln>

<vuln vid="515df85a-5cd7-11ec-a16d-001517a2e1a4">
 <topic>bastillion -- log4j vulnerability</topic>
 <affects>
 <package>
	<name>bastillion</name>
	<range><lt>3.10.00_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	FreeBSD port maintainer reports:
	<blockquote>
	 Bastillion uses log4j.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44228</cvename>
 </references>
 <dates>
 <discovery>2021-12-10</discovery>
 <entry>2021-12-14</entry>
 </dates>
 </vuln>

<vuln vid="fb9ba490-5cc4-11ec-aac7-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>96.0.4664.110</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop_13.html">
	 This release contains 5 security fixes, including:
	 <ul>
	 <li>[1263457] Critical CVE-2021-4098: Insufficient data validation
	 in Mojo. Reported by Sergei Glazunov of Google Project Zero on
	 2021-10-26</li>
	 <li>[1270658] High CVE-2021-4099: Use after free in Swiftshader.
	 Reported by Aki Helin of Solita on 2021-11-16</li>
	 <li>[1272068] High CVE-2021-4100: Object lifecycle issue in ANGLE.
	 Reported by Aki Helin of Solita on 2021-11-19</li>
	 <li>[1262080] High CVE-2021-4101: Heap buffer overflow in
	 Swiftshader. Reported by Abraruddin Khan and Omair on
	 2021-10-21</li>
	 <li>[1278387] High CVE-2021-4102: Use after free in V8. Reported by
	 Anonymous on 2021-12-09</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-4098</cvename>
 <cvename>CVE-2021-4099</cvename>
 <cvename>CVE-2021-4100</cvename>
 <cvename>CVE-2021-4101</cvename>
 <cvename>CVE-2021-4102</cvename>
 <url>https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop_13.html</url>
 </references>
 <dates>
 <discovery>2021-12-13</discovery>
 <entry>2021-12-14</entry>
 </dates>
 </vuln>

<vuln vid="0dcf68fa-5c31-11ec-875e-901b0e9408dc">
 <topic>Matrix clients -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>cinny</name>
	<range><lt>1.6.0</lt></range>
 </package>
 <package>
	<name>element-web</name>
	<range><lt>1.9.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://matrix.org/blog/2021/12/13/disclosure-buffer-overflow-in-libolm-and-matrix-js-sdk">
	 Today we are releasing security updates to libolm, matrix-js-sdk,
	 and several clients including Element Web / Desktop. Users are
	 encouraged to upgrade as soon as possible.
	 These releases mitigate a buffer overflow in olm_session_describe,
	 a libolm debugging function used by matrix-js-sdk in its end-to-end
	 encryption (E2EE) implementation. If you rely on matrix-js-sdk for
	 E2EE, you are affected.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://matrix.org/blog/2021/12/13/disclosure-buffer-overflow-in-libolm-and-matrix-js-sdk</url>
 </references>
 <dates>
 <discovery>2021-12-03</discovery>
 <entry>2021-12-13</entry>
 </dates>
 </vuln>

<vuln vid="93a1c9a7-5bef-11ec-a47a-001517a2e1a4">
 <topic>openhab -- log4j remote code injection</topic>
 <affects>
 <package>
	<name>openhab2</name>
	<name>openhab</name>
	<range><le>2.5.12</le></range>
	<range><lt>3.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Openhab reports:
	<blockquote cite="https://github.com/openhab/openhab-distro/security/advisories/GHSA-j99j-qp89-pcfq">
	 Any openHAB instance that is publicly available or which consumes untrusted content from remote servers is potentially a target of this attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44228</cvename>
 <url>https://github.com/openhab/openhab-distro/security/advisories/GHSA-j99j-qp89-pcfq</url>
 <url>https://github.com/ops4j/org.ops4j.pax.logging/security/advisories/GHSA-xxfh-x98p-j8fr</url>
 <url>https://github.com/advisories/GHSA-jfh8-c2jp-5v3q</url>
 </references>
 <dates>
 <discovery>2021-12-10</discovery>
 <entry>2021-12-13</entry>
 </dates>
 </vuln>

<vuln vid="66cf7c43-5be3-11ec-a587-001b217b3468">
 <topic>Solr -- Apache Log4J</topic>
 <affects>
 <package>
	<name>apache-solr</name>
	<range><lt>8.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Solr reports:
	<blockquote cite="https://solr.apache.org/security.html">
	 Apache Solr affected by Apache Log4J
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://solr.apache.org/security.html</url>
 </references>
 <dates>
 <discovery>2021-12-10</discovery>
 <entry>2021-12-13</entry>
 <modified>2021-12-13</modified>
 </dates>
 </vuln>

<vuln vid="4b1ac5a3-5bd4-11ec-8602-589cfc007716">
 <topic>OpenSearch -- Log4Shell</topic>
 <affects>
 <package>
	<name>opensearch</name>
	<range><lt>1.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSearch reports:
	<blockquote cite="https://opensearch.org/blog/releases/2021/12/update-to-1-2-1/">
	 A <a href="https://www.lunasec.io/docs/blog/log4j-zero-day/">recently published</a> security issue (<a href="https://nvd.nist.gov/vuln/detail/CVE-2021-44228">CVE-2021-44228</a>) affects several versions of the broadly-used <a href="https://logging.apache.org/log4j/2.x/">Apache Log4j</a> library. Some software in the OpenSearch project includes versions of Log4j referenced in this CVE. While, at time of writing, the team has not found a reproduceable example in OpenSearch of remote code execution (RCE) described in this issue, its severity is such that all users should take mitigation measures. As recommended by the advisory, the team has released OpenSearch 1.2.1, which updates Log4j to version 2.15.0. For those who cannot upgrade to 1.2.1, the <a href="https://logging.apache.org/log4j/2.x/">Log4j website outlines additional measures to mitigate the issue</a>. This patch release also addresses <a href="https://alas.aws.amazon.com/AL2/ALAS-2021-1722.html">CVE-2021-4352</a> in the OpenSearch Docker distributions..
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44228</cvename>
 <url>https://opensearch.org/blog/releases/2021/12/update-to-1-2-1/</url>
 </references>
 <dates>
 <discovery>2021-12-11</discovery>
 <entry>2021-12-13</entry>
 </dates>
 </vuln>

<vuln vid="c2a7de31-5b42-11ec-8398-6c3be5272acd">
 <topic>Grafana -- Directory Traversal</topic>
 <affects>
 <package>
	<name>grafana</name>
	<name>grafana8</name>
	<range><ge>8.0.0</ge><lt>8.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitHub Security Labs reports:
	<blockquote cite="https://github.com/grafana/grafana/security/advisories/GHSA-7533-c8qv-jm9m">
	 A vulnerability through which authenticated users could read out fully lowercase or fully uppercase <code>.md</code> files through directory traversal. Doing our own follow-up investigation we found a related vulnerability through which authenticated users could read out arbitrary <code>.csv</code> files through directory traversal. Thanks to our defense-in-depth approach, at no time has <a href="https://grafana.com/cloud">Grafana Cloud</a> been vulnerable.
	 The vulnerable URL path is: <code>/api/ds/query</code>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-43815</cvename>
 <url>https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/</url>
 </references>
 <dates>
 <discovery>2021-12-09</discovery>
 <entry>2021-12-12</entry>
 </dates>
 </vuln>

<vuln vid="a994ff7d-5b3f-11ec-8398-6c3be5272acd">
 <topic>Grafana -- Directory Traversal</topic>
 <affects>
 <package>
	<name>grafana</name>
	<range><ge>5.0.0</ge><lt>7.5.12</lt></range>
	<range><ge>8.0.0</ge><lt>8.3.2</lt></range>
 </package>
 <package>
	<name>grafana6</name>
	<range><ge>6.0.0</ge></range>
 </package>
 <package>
	<name>grafana7</name>
	<range><ge>7.0.0</ge><lt>7.5.12</lt></range>
 </package>
 <package>
	<name>grafana8</name>
	<range><ge>8.0.0</ge><lt>8.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitHub Security Labs reports:
	<blockquote cite="https://github.com/grafana/grafana/security/advisories/GHSA-c3q8-26ph-9g2q">
	 A vulnerability through which authenticated users could read out fully lowercase or fully uppercase <code>.md</code> files through directory traversal. Doing our own follow-up investigation we found a related vulnerability through which authenticated users could read out arbitrary <code>.csv</code> files through directory traversal. Thanks to our defense-in-depth approach, at no time has <a href="https://grafana.com/cloud">Grafana Cloud</a> been vulnerable.
	 The vulnerable URL path is: <code>/api/plugins/.*/markdown/.*</code> for <code>.md</code> files
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-43813</cvename>
 <url>https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/</url>
 </references>
 <dates>
 <discovery>2021-12-09</discovery>
 <entry>2021-12-12</entry>
 </dates>
 </vuln>

<vuln vid="e33880ed-5802-11ec-8398-6c3be5272acd">
 <topic>Grafana -- Path Traversal</topic>
 <affects>
 <package>
	<name>grafana8</name>
	<name>grafana</name>
	<range><ge>8.0.0</ge><lt>8.0.7</lt></range>
	<range><ge>8.1.0</ge><lt>8.1.8</lt></range>
	<range><ge>8.2.0</ge><lt>8.2.7</lt></range>
	<range><ge>8.3.0</ge><lt>8.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/">
	 Grafana is vulnerable to directory traversal, allowing access to local files. We have confirmed this for versions v8.0.0-beta1 to v8.3.0. Thanks to our defense-in-depth approach, at no time has <a href="https://grafana.com/cloud/?pg=blog">Grafana Cloud</a> been vulnerable.
	 The vulnerable URL path is: &lt;grafana_host_url&gt;/public/plugins/&lt;“plugin-id”&gt; where &lt;“plugin-id”&gt; is the plugin ID for any installed plugin.
	 Every Grafana instance comes with pre-installed plugins like the Prometheus plugin or MySQL plugin so the following URLs are vulnerable for every instance:
	 <ul>
	 <li>&lt;grafana_host_url&gt;/public/plugins/alertlist/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/annolist/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/barchart/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/bargauge/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/candlestick/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/cloudwatch/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/dashlist/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/elasticsearch/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/gauge/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/geomap/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/gettingstarted/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/grafana-azure-monitor-datasource/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/graph/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/heatmap/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/histogram/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/influxdb/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/jaeger/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/logs/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/loki/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/mssql/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/mysql/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/news/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/nodeGraph/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/opentsdb</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/piechart/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/pluginlist/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/postgres/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/prometheus/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/stackdriver/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/stat/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/state-timeline/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/status-history/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/table/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/table-old/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/tempo/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/testdata/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/text/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/timeseries/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/welcome/</li>
	 <li>&lt;grafana_host_url&gt;/public/plugins/zipkin/</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-43798</cvename>
 <url>https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/</url>
 </references>
 <dates>
 <discovery>2021-12-03</discovery>
 <entry>2021-12-11</entry>
 </dates>
 </vuln>

<vuln vid="99bff2bd-4852-11ec-a828-6c3be5272acd">
 <topic>Grafana -- Incorrect Access Control</topic>
 <affects>
 <package>
	<name>grafana8</name>
	<name>grafana</name>
	<range><ge>8.0.0</ge><lt>8.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2021/11/15/grafana-8.2.4-released-with-security-fixes/">
	 When the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance, Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41244</cvename>
 <url>https://grafana.com/blog/2021/11/15/grafana-8.2.4-released-with-security-fixes/</url>
 </references>
 <dates>
 <discovery>2021-11-02</discovery>
 <entry>2021-12-11</entry>
 </dates>
 </vuln>

<vuln vid="4b478274-47a0-11ec-bd24-6c3be5272acd">
 <topic>Grafana -- XSS</topic>
 <affects>
 <package>
	<name>grafana8</name>
	<name>grafana</name>
	<range><ge>8.0.0</ge><lt>8.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2021/11/03/grafana-8.2.3-released-with-medium-severity-security-fix-cve-2021-41174-grafana-xss/">
	 If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim’s browser.
	 The user visiting the malicious link must be unauthenticated, and the link must be for a page that contains the login button in the menu bar.
	 There are two ways an unauthenticated user can open a page in Grafana that contains the login button:
	 <ul>
	 <li>Anonymous authentication is enabled. This means all pages in Grafana would be open for the attack.</li>
	 <li>The link is to an unauthenticated page. The following pages are vulnerable:
	 <ul>
		<li><code>/dashboard-solo/snapshot/*</code></li>
		<li><code>/dashboard/snapshot/*</code></li>
		<li><code>/invite/:code</code></li>
	 </ul>
	 </li>
	 </ul>
	 The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: <code>{{ }}</code>
	 An example of an expression would be: <code>{{constructor.constructor(‘alert(1)’)()}}</code>. This can be included in the link URL like this:
	 <a href="https://play.grafana.org/dashboard/snapshot/%7B%7Bconstructor.constructor('alert(1)')()%7D%7D?orgId=1">https://play.grafana.org/dashboard/snapshot/%7B%7Bconstructor.constructor('alert(1)')()%7D%7D?orgId=1</a>
	 When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated, and the AngularJS rendering engine will execute the JavaScript expression contained in the URL.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41174</cvename>
 <url>https://grafana.com/blog/2021/11/03/grafana-8.2.3-released-with-medium-severity-security-fix-cve-2021-41174-grafana-xss/</url>
 </references>
 <dates>
 <discovery>2021-10-21</discovery>
 <entry>2021-12-11</entry>
 </dates>
 </vuln>

<vuln vid="942fff11-5ac4-11ec-89ea-c85b76ce9b5a">
 <topic>p7zip -- usage of uninitialized memory</topic>
 <affects>
 <package>
	<name>p7zip</name>
	<range><lt>18.05</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-10115">
 
 Incorrect initialization logic of RAR decoder objects in
 7-Zip 18.03 and before can lead to usage of
 uninitialized memory, allowing remote attackers to cause
 a denial of service (segmentation fault) or execute
 arbitrary code via a crafted RAR archive.
 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-10115</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2018-10115</url>
 </references>
 <dates>
 <discovery>2018-05-02</discovery>
 <entry>2021-12-11</entry>
 </dates>
 </vuln>

<vuln vid="3fadd7e4-f8fb-45a0-a218-8fd6423c338f">
 <topic>graylog -- include log4j patches</topic>
 <affects>
 <package>
	<name>graylog</name>
	<range><lt>4.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache Software Foundation repos:
	<blockquote cite="https://logging.apache.org/log4j/2.x/security.html">
 Apache Log4j2 JNDI features do not protect against attacker
 controlled LDAP and other JNDI related endpoints. An attacker
 who can control log messages or paramters can execute arbitrary
 code from attacker-controller LDAP servers when message lookup
 substitution is enabled.
 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44228</cvename>
 <url>https://github.com/Graylog2/graylog2-server/commit/d3e441f1126f0dc292e986879039a87c59375b2a</url>
 <url>https://logging.apache.org/log4j/2.x/security.html</url>
 </references>
 <dates>
 <discovery>2021-12-10</discovery>
 <entry>2021-12-11</entry>
 </dates>
 </vuln>

<vuln vid="720505fe-593f-11ec-9ba8-002324b2fba8">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.17.5,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
 <blockquote cite="https://github.com/golang/go/issues/50058">
	 net/http: limit growth of header canonicalization cache. An
	 attacker can cause unbounded memory growth in a Go server accepting
	 HTTP/2 requests.
	</blockquote>
	<blockquote cite="https://github.com/golang/go/issues/50057">
	 syscall: don’t close fd 0 on ForkExec error. When a Go program
	 running on a Unix system is out of file descriptors and calls
	 syscall.ForkExec (including indirectly by using the os/exec
	 package), syscall.ForkExec can close file descriptor 0 as it fails.
	 If this happens (or can be provoked) repeatedly, it can result in
	 misdirected I/O such as writing network traffic intended for one
	 connection to a different connection, or content intended for one
	 file to a different one.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44716</cvename>
 <url>https://github.com/golang/go/issues/50058</url>
 <cvename>CVE-2021-44717</cvename>
 <url>https://github.com/golang/go/issues/50057</url>
 </references>
 <dates>
 <discovery>2021-12-08</discovery>
 <entry>2021-12-09</entry>
 </dates>
 </vuln>

<vuln vid="18ac074c-579f-11ec-aac7-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>96.0.4664.93</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html">
	 This release contains 22 security fixes, including:
	 <ul>
	 <li>[1267661] High CVE-2021-4052: Use after free in web apps.
	 Reported by Wei Yuan of MoyunSec VLab on 2021-11-07</li>
	 <li>[1267791] High CVE-2021-4053: Use after free in UI. Reported by
	 Rox on 2021-11-08</li>
	 <li>[1265806] High CVE-2021-4079: Out of bounds write in WebRTC.
	 Reported by Brendon Tiszka on 2021-11-01</li>
	 <li>[1239760] High CVE-2021-4054: Incorrect security UI in autofill.
	 Reported by Alesandro Ortiz on 2021-08-13</li>
	 <li>[1268738] High CVE-2021-4078: Type confusion in V8. Reported by
	 Nan Wang (@eternalsakura13) and Guang Gong of 360 Alpha Lab on
	 2021-11-09</li>
	 <li>[1266510] High CVE-2021-4055: Heap buffer overflow in
	 extensions. Reported by Chen Rong on 2021-11-03</li>
	 <li>[1260939] High CVE-2021-4056: Type Confusion in loader. Reported
	 by @__R0ng of 360 Alpha Lab on 2021-10-18</li>
	 <li>[1262183] High CVE-2021-4057: Use after free in file API.
	 Reported by Sergei Glazunov of Google Project Zero on
	 2021-10-21</li>
	 <li>[1267496] High CVE-2021-4058: Heap buffer overflow in ANGLE.
	 Reported by Abraruddin Khan and Omair on 2021-11-06</li>
	 <li>[1270990] High CVE-2021-4059: Insufficient data validation in
	 loader. Reported by Luan Herrera (@lbherrera_) on 2021-11-17</li>
	 <li>[1271456] High CVE-2021-4061: Type Confusion in V8. Reported by
	 Paolo Severini on 2021-11-18</li>
	 <li>[1272403] High CVE-2021-4062: Heap buffer overflow in BFCache.
	 Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2021-11-22</li>
	 <li>[1273176] High CVE-2021-4063: Use after free in developer tools.
	 Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability
	 Research on 2021-11-23</li>
	 <li>[1273197] High CVE-2021-4064: Use after free in screen capture.
	 Reported by @ginggilBesel on 2021-11-23</li>
	 <li>[1273674] High CVE-2021-4065: Use after free in autofill.
	 Reported by 5n1p3r0010 on 2021-11-25</li>
	 <li>[1274499] High CVE-2021-4066: Integer underflow in ANGLE.
	 Reported by Jaehun Jeong(@n3sk) of Theori on 2021-11-29</li>
	 <li>[1274641] High CVE-2021-4067: Use after free in window manager.
	 Reported by @ginggilBesel on 2021-11-29</li>
	 <li>[1265197] Low CVE-2021-4068: Insufficient validation of
	 untrusted input in new tab page. Reported by NDevTK on
	 2021-10-31</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-4052</cvename>
 <cvename>CVE-2021-4053</cvename>
 <cvename>CVE-2021-4054</cvename>
 <cvename>CVE-2021-4055</cvename>
 <cvename>CVE-2021-4056</cvename>
 <cvename>CVE-2021-4057</cvename>
 <cvename>CVE-2021-4058</cvename>
 <cvename>CVE-2021-4059</cvename>
 <cvename>CVE-2021-4061</cvename>
 <cvename>CVE-2021-4062</cvename>
 <cvename>CVE-2021-4063</cvename>
 <cvename>CVE-2021-4064</cvename>
 <cvename>CVE-2021-4065</cvename>
 <cvename>CVE-2021-4066</cvename>
 <cvename>CVE-2021-4067</cvename>
 <cvename>CVE-2021-4068</cvename>
 <cvename>CVE-2021-4078</cvename>
 <cvename>CVE-2021-4079</cvename>
 <url>https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2021-12-06</discovery>
 <entry>2021-12-07</entry>
 </dates>
 </vuln>

<vuln vid="b299417a-5725-11ec-a587-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>14.5.0</ge><lt>14.5.2</lt></range>
	<range><ge>14.4.0</ge><lt>14.4.4</lt></range>
	<range><ge>0</ge><lt>14.3.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/">
	 Group members with developer role can escalate their privilege to maintainer on projects that they import
	 When user registration is limited, external users that aren't developers shouldn't have access to the CI Lint API
	 Collision in access memoization leads to potential elevated privileges on groups and projects
	 Project access token names are returned for unauthenticated requesters
	 Sensitive info disclosure in logs
	 Disclosure of a user's custom project and group templates
	 ReDoS in Maven package version
	 Potential denial of service via the Diff feature
	 Regular Expression Denial of Service via user comments
	 Service desk email accessible by any project member
	 Regular Expression Denial of Service via quick actions
	 IDOR in "external status check" API leaks data about any status check on the instance
	 Default branch name visible in public projects restricting access to the source code repository
	 Deploy token allows access to disabled project Wiki
	 Regular Expression Denial of Service via deploy Slash commands
	 Users can reply to Vulnerability Report discussions despite Only Project Members settings
	 Unauthorised deletion of protected branches
	 Author can approve Merge Request after having access revoked
	 HTML Injection via Swagger UI
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-39944</cvename>
 <cvename>CVE-2021-39935</cvename>
 <cvename>CVE-2021-39937</cvename>
 <cvename>CVE-2021-39915</cvename>
 <cvename>CVE-2021-39919</cvename>
 <cvename>CVE-2021-39930</cvename>
 <cvename>CVE-2021-39940</cvename>
 <cvename>CVE-2021-39932</cvename>
 <cvename>CVE-2021-39933</cvename>
 <cvename>CVE-2021-39934</cvename>
 <cvename>CVE-2021-39917</cvename>
 <cvename>CVE-2021-39916</cvename>
 <cvename>CVE-2021-39941</cvename>
 <cvename>CVE-2021-39936</cvename>
 <cvename>CVE-2021-39938</cvename>
 <cvename>CVE-2021-39918</cvename>
 <cvename>CVE-2021-39931</cvename>
 <cvename>CVE-2021-39945</cvename>
 <cvename>CVE-2021-39910</cvename>
 <url>https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/</url>
 </references>
 <dates>
 <discovery>2021-12-06</discovery>
 <entry>2021-12-07</entry>
 </dates>
 </vuln>

<vuln vid="47695a9c-5377-11ec-8be6-d4c9ef517024">
 <topic>NSS -- Memory corruption</topic>
 <affects>
 <package>
	<name>nss</name>
	<range><lt>3.73</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/">
	 Memory corruption in NSS via DER-encoded DSA and RSA-PSS signatures (Critical)
	 NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR
	 are vulnerable to a heap overflow when handling DER-encoded DSA or
	 RSA-PSS signatures. Applications using NSS for handling signatures
	 encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be
	 impacted. Applications using NSS for certificate validation or other
	 TLS, X.509, OCSP or CRL functionality may be impacted, depending on
	 how they configure NSS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-43527</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/</url>
 </references>
 <dates>
 <discovery>2021-12-01</discovery>
 <entry>2021-12-02</entry>
 </dates>
 </vuln>

<vuln vid="0d6efbe3-52d9-11ec-9472-e3667ed6088e">
	 <topic>mailman &lt; 2.1.38 -- CSRF vulnerability of list mod or member against list admin page</topic>
 <affects>
 <package>
	<name>mailman</name>
	<range><lt>2.1.38</lt></range>
 </package>
 <package>
	<name>mailman-exim4</name>
	<range><lt>2.1.38</lt></range>
 </package>
 <package>
	<name>mailman-exim4-with-htdig</name>
	<range><lt>2.1.38</lt></range>
 </package>
 <package>
	<name>mailman-postfix</name>
	<range><lt>2.1.38</lt></range>
 </package>
 <package>
	<name>mailman-postfix-with-htdig</name>
	<range><lt>2.1.38</lt></range>
 </package>
 <package>
	<name>mailman-with-htdig</name>
	<range><lt>2.1.38</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mark Sapiro reports:
	<blockquote cite="https://bugs.launchpad.net/mailman/+bug/1952384">
	 A list moderator or list member can potentially carry out a CSRF attack
	 by getting a list admin to visit a crafted web page.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-44227</cvename>
 <url>https://bugs.launchpad.net/mailman/+bug/1952384</url>
 <url>https://www.mail-archive.com/mailman-users@python.org/msg73979.html</url>
 </references>
 <dates>
 <discovery>2021-11-25</discovery>
 <entry>2021-12-01</entry>
 </dates>
 </vuln>

<vuln vid="4548ec97-4d38-11ec-a539-0800270512f4">
 <topic>rubygem-cgi -- cookie prefix spoofing in CGI::Cookie.parse</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>2.6.0,1</ge><lt>2.6.9,1</lt></range>
	<range><ge>2.7.0,1</ge><lt>2.7.5,1</lt></range>
	<range><ge>3.0.0,1</ge><lt>3.0.3,1</lt></range>
 </package>
 <package>
	<name>ruby26</name>
	<range><ge>2.6.0,1</ge><lt>2.6.9,1</lt></range>
 </package>
 <package>
	<name>ruby27</name>
	<range><ge>2.7.0,1</ge><lt>2.7.5,1</lt></range>
 </package>
 <package>
	<name>ruby30</name>
	<range><ge>3.0.0,1</ge><lt>3.0.3,1</lt></range>
 </package>
 <package>
	<name>rubygem-cgi</name>
	<range><lt>0.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ooooooo_q reports:
	<blockquote cite="https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/">
	 
	 The old versions of <code>CGI::Cookie.parse</code> applied
	 URL decoding to cookie names. An attacker could exploit
	 this vulnerability to spoof security prefixes in cookie
	 names, which may be able to trick a vulnerable
	 application.
	 
	 
	 By this fix, <code>CGI::Cookie.parse</code> no longer
	 decodes cookie names. Note that this is an incompatibility
	 if cookie names that you are using include
	 non-alphanumeric characters that are URL-encoded.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41819</cvename>
 <url>https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/</url>
 </references>
 <dates>
 <discovery>2021-11-24</discovery>
 <entry>2021-11-24</entry>
 </dates>
 </vuln>

<vuln vid="2c6af5c3-4d36-11ec-a539-0800270512f4">
 <topic>rubygem-cgi -- buffer overrun in CGI.escape_html</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>2.7.0,1</ge><lt>2.7.5,1</lt></range>
	<range><ge>3.0.0,1</ge><lt>3.0.3,1</lt></range>
 </package>
 <package>
	<name>ruby27</name>
	<range><ge>2.7.0,1</ge><lt>2.7.5,1</lt></range>
 </package>
 <package>
	<name>ruby30</name>
	<range><ge>3.0.0,1</ge><lt>3.0.3,1</lt></range>
 </package>
 <package>
	<name>rubygem-cgi</name>
	<range><lt>0.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	chamal reports:
	<blockquote cite="https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/">
	 
	 A security vulnerability that causes buffer overflow when
	 you pass a very large string (&gt; 700 MB) to
	 <code>CGI.escape_html</code> on a platform where
	 <code>long</code> type takes 4 bytes, typically, Windows.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41816</cvename>
 <url>https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/</url>
 </references>
 <dates>
 <discovery>2021-11-24</discovery>
 <entry>2021-11-24</entry>
 </dates>
 </vuln>

<vuln vid="27aa2253-4c72-11ec-b6b9-e86a64caca56">
 <topic>py-matrix-synapse -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>py36-matrix-synapse</name>
	<name>py37-matrix-synapse</name>
	<name>py38-matrix-synapse</name>
	<name>py39-matrix-synapse</name>
	<name>py310-matrix-synapse</name>
	<range><lt>1.47.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://matrix.org/blog/2021/11/23/synapse-1-47-1-released">
	 This release patches one high severity issue affecting
 Synapse installations 1.47.0 and earlier using the media repository.
 An attacker could cause these Synapses to download a remote file
 and store it in a directory outside the media repository.
 Note that:
 <ul>
 <li>This only affects homeservers using Synapse's built-in media
 repository, as opposed to synapse-s3-storage-provider or
 matrix-media-repo.</li>
 <li>Attackers cannot control the exact name or destination of the
 stored file.</li>
 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/259994</freebsdpr>
 <cvename>CVE-2021-41281</cvename>
 <url>https://matrix.org/blog/2021/11/23/synapse-1-47-1-released</url>
 </references>
 <dates>
 <discovery>2021-11-18</discovery>
 <entry>2021-11-23</entry>
 </dates>
 </vuln>

<vuln vid="0bf816f6-3cfe-11ec-86cd-dca632b19f10">
 <topic>advancecomp -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>advancecomp</name>
	<range><lt>2.1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Joonun Jang reports:
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889270">
	 heap buffer overflow running advzip with "-l poc" option
	 Running 'advzip -l poc' with the attached file raises heap buffer overflow
	 which may allow a remote attacker to cause unspecified impact including denial-of-service attack.
	 I expected the program to terminate without segfault, but the program crashes as follow. [...]
	 
	</blockquote>
	and other vulnerabilities.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-1056</cvename>
 <cvename>CVE-2019-8379</cvename>
 <cvename>CVE-2019-8383</cvename>
 <cvename>CVE-2019-9210</cvename>
 </references>
 <dates>
 <discovery>2018-07-29</discovery>
 <entry>2021-11-19</entry>
 </dates>
 </vuln>

<vuln vid="b8c0cbca-472d-11ec-83dc-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>96.0.4664.45</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html">
	 This release contains 25 security fixes, including:
	 <ul>
	 <li>[1263620] High CVE-2021-38008: Use after free in media. Reported
	 by Marcin Towalski of Cisco Talos on 2021-10-26</li>
	 <li>[1260649] High CVE-2021-38009: Inappropriate implementation in
	 cache. Reported by Luan Herrera (@lbherrera_) on 2021-10-16</li>
	 <li>[1240593] High CVE-2021-38006: Use after free in storage
	 foundation. Reported by Sergei Glazunov of Google Project Zero on
	 2021-08-17</li>
	 <li>[1254189] High CVE-2021-38007: Type Confusion in V8. Reported by
	 Polaris Feng and SGFvamll at Singular Security Lab on
	 2021-09-29</li>
	 <li>[1241091] High CVE-2021-38005: Use after free in loader.
	 Reported by Sergei Glazunov of Google Project Zero on
	 2021-08-18</li>
	 <li>[1264477] High CVE-2021-38010: Inappropriate implementation in
	 service workers. Reported by Sergei Glazunov of Google Project
	 Zero on 2021-10-28</li>
	 <li>[1268274] High CVE-2021-38011: Use after free in storage
	 foundation. Reported by Sergei Glazunov of Google Project Zero on
	 2021-11-09</li>
	 <li>[1262791] Medium CVE-2021-38012: Type Confusion in V8. Reported
	 by Yonghwi Jin (@jinmo123) on 2021-10-24</li>
	 <li>[1242392] Medium CVE-2021-38013: Heap buffer overflow in
	 fingerprint recognition. Reported by raven (@raid_akame) on
	 2021-08-23</li>
	 <li>[1248567] Medium CVE-2021-38014: Out of bounds write in
	 Swiftshader. Reported by Atte Kettunen of OUSPG on 2021-09-10</li>
	 <li>[957553] Medium CVE-2021-38015: Inappropriate implementation in
	 input. Reported by David Erceg on 2019-04-29</li>
	 <li>[1244289] Medium CVE-2021-38016: Insufficient policy
	 enforcement in background fetch. Reported by Maurice Dauer on
	 2021-08-28</li>
	 <li>[1256822] Medium CVE-2021-38017: Insufficient policy enforcement
	 in iframe sandbox. Reported by NDevTK on 2021-10-05</li>
	 <li>[1197889] Medium CVE-2021-38018: Inappropriate implementation in
	 navigation. Reported by Alesandro Ortiz on 2021-04-11</li>
	 <li>[1251179] Medium CVE-2021-38019: Insufficient policy enforcement
	 in CORS. Reported by Maurice Dauer on 2021-09-20</li>
	 <li>[1259694] Medium CVE-2021-38020: Insufficient policy enforcement
	 in contacts picker. Reported by Luan Herrera (@lbherrera_) on
	 2021-10-13</li>
	 <li>[1233375] Medium CVE-2021-38021: Inappropriate implementation in
	 referrer. Reported by Prakash (@1lastBr3ath) and Jun Kokatsu on
	 2021-07-27</li>
	 <li>[1248862] Low CVE-2021-38022: Inappropriate implementation in
	 WebAuthentication. Reported by Michal Kepkowski on 2021-09-13</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-38005</cvename>
 <cvename>CVE-2021-38006</cvename>
 <cvename>CVE-2021-38007</cvename>
 <cvename>CVE-2021-38008</cvename>
 <cvename>CVE-2021-38009</cvename>
 <cvename>CVE-2021-38010</cvename>
 <cvename>CVE-2021-38011</cvename>
 <cvename>CVE-2021-38012</cvename>
 <cvename>CVE-2021-38013</cvename>
 <cvename>CVE-2021-38014</cvename>
 <cvename>CVE-2021-38015</cvename>
 <cvename>CVE-2021-38016</cvename>
 <cvename>CVE-2021-38017</cvename>
 <cvename>CVE-2021-38018</cvename>
 <cvename>CVE-2021-38019</cvename>
 <cvename>CVE-2021-38020</cvename>
 <cvename>CVE-2021-38021</cvename>
 <cvename>CVE-2021-38022</cvename>
 <url>https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2021-11-15</discovery>
 <entry>2021-11-16</entry>
 </dates>
 </vuln>

<vuln vid="6916ea94-4628-11ec-bbe2-0800270512f4">
 <topic>rubygem-date -- Regular Expression Denial of Service Vunlerability of Date Parsing Methods</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>2.6.0,1</ge><lt>2.6.9,1</lt></range>
	<range><ge>2.7.0,1</ge><lt>2.7.5,1</lt></range>
	<range><ge>3.0.0,1</ge><lt>3.0.3,1</lt></range>
 </package>
 <package>
	<name>ruby26</name>
	<range><ge>2.6.0,1</ge><lt>2.6.9,1</lt></range>
 </package>
 <package>
	<name>ruby27</name>
	<range><ge>2.7.0,1</ge><lt>2.7.5,1</lt></range>
 </package>
 <package>
	<name>ruby30</name>
	<range><ge>3.0.0,1</ge><lt>3.0.3,1</lt></range>
 </package>
 <package>
	<name>rubygem-date</name>
	<range><lt>3.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stanislav Valkanov reports:
	<blockquote cite="https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/">
	 
	 Date's parsing methods including <code>Date.parse</code>
	 are using Regexps internally, some of which are vulnerable
	 against regular expression denial of service. Applications
	 and libraries that apply such methods to untrusted input
	 may be affected.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41817</cvename>
 <url>https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/</url>
 </references>
 <dates>
 <discovery>2021-11-15</discovery>
 <entry>2021-11-15</entry>
 <modified>2021-11-24</modified>
 </dates>
 </vuln>

<vuln vid="42a4d82d-4603-11ec-8be6-d4c9ef517024">
 <topic>Roundcube -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><lt>1.4.12,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Roundcube project reports:
	<blockquote cite="https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released">
	 XSS issue in handling attachment filename extension in mimetype mismatch warning
	 possible SQL injection via some session variables
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released</url>
 </references>
 <dates>
 <discovery>2021-11-12</discovery>
 <entry>2021-11-15</entry>
 </dates>
 </vuln>

<vuln vid="9d7a2b54-4468-11ec-8532-0d24c37c72c8">
 <topic>mailman -- 2.1.37 fixes XSS via user options, and moderator offline brute-force vuln against list admin password</topic>
 <affects>
 <package>
	<name>mailman</name>
	<range><lt>2.1.37</lt></range>
 </package>
 <package>
	<name>mailman-exim4</name>
	<range><lt>2.1.37</lt></range>
 </package>
 <package>
	<name>mailman-exim4-with-htdig</name>
	<range><lt>2.1.37</lt></range>
 </package>
 <package>
	<name>mailman-postfix</name>
	<range><lt>2.1.37</lt></range>
 </package>
 <package>
	<name>mailman-postfix-with-htdig</name>
	<range><lt>2.1.37</lt></range>
 </package>
 <package>
	<name>mailman-with-htdig</name>
	<range><lt>2.1.37</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mark Sapiro reports:
	<blockquote cite="https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/1879/NEWS#L8">
	 A potential XSS attack via the user options page has been reported by
	 Harsh Jaiswal. This is fixed. CVE-2021-43331 (LP: #1949401).
	 A potential for for a list moderator to carry out an off-line brute force
	 attack to obtain the list admin password has been reported by Andre
	 Protas, Richard Cloke and Andy Nuttall of Apple. This is fixed.
	 CVE-2021-43332 (LP: #1949403)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-43331</cvename>
 <cvename>CVE-2021-43332</cvename>
 <url>https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/1879/NEWS#L8</url>
 <url>https://bugs.launchpad.net/mailman/+bug/1949401</url>
 <url>https://bugs.launchpad.net/mailman/+bug/1949403</url>
 </references>
 <dates>
 <discovery>2021-11-01</discovery>
 <entry>2021-11-13</entry>
 </dates>
 </vuln>

<vuln vid="2ccd71bd-426b-11ec-87db-6cc21735f730">
 <topic>PostgreSQL -- Possible man-in-the-middle attacks</topic>
 <affects>
 <package>
	<name>postgresql14-server</name>
	<range><lt>14.1</lt></range>
 </package>
 <package>
	<name>postgresql13-server</name>
	<range><lt>13.5</lt></range>
 </package>
 <package>
	<name>postgresql12-server</name>
	<range><lt>12.9</lt></range>
 </package>
 <package>
	<name>postgresql11-server</name>
	<range><lt>11.14</lt></range>
 </package>
 <package>
	<name>postgresql10-server</name>
	<range><lt>10.19</lt></range>
 </package>
 <package>
	<name>postgresql96-server</name>
	<range><lt>9.6.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL Project reports:
	<blockquote cite="https://www.postgresql.org/about/news/postgresql-141-135-129-1114-1019-and-9624-released-2349/">
	 CVE-2021-23214: A man-in-the-middle with the ability to inject data into the TCP connection could stuff some cleartext data into the start of a supposedly encryption-protected database session. This could be abused to send faked SQL commands to the server, although that would only work if the server did not demand any authentication data. (However, a server relying on SSL certificate authentication might well not do so.) 
	 CVE-2021-23222: A man-in-the-middle with the ability to inject data into the TCP connection could stuff some cleartext data into the start of a supposedly encryption-protected database session. This could probably be abused to inject faked responses to the client's first few queries, although other details of libpq's behavior make that harder than it sounds. A different line of attack is to exfiltrate the client's password, or other sensitive data that might be sent early in the session. That has been shown to be possible with a server vulnerable to CVE-2021-23214. 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-23214</cvename>
 <cvename>CVE-2021-23222</cvename>
 </references>
 <dates>
 <discovery>2021-11-08</discovery>
 <entry>2021-11-10</entry>
 </dates>
 </vuln>

<vuln vid="bfea59e0-41ee-11ec-9bac-589cfc007716">
 <topic>puppet -- Silent Configuration Failure</topic>
 <affects>
 <package>
	<name>puppet6</name>
	<range><lt>6.25.1</lt></range>
 </package>
 <package>
	<name>puppet7</name>
	<range><lt>7.12.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Puppet reports:
	<blockquote cite="https://puppet.com/security/cve/cve-2021-27025">
	 A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first pluginsync.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-27025</cvename>
 <url>https://puppet.com/security/cve/cve-2021-27025</url>
 </references>
 <dates>
 <discovery>2021-11-09</discovery>
 <entry>2021-11-10</entry>
 </dates>
 </vuln>

<vuln vid="3bd3c9f8-41ee-11ec-9bac-589cfc007716">
 <topic>puppet -- Unsafe HTTP Redirect</topic>
 <affects>
 <package>
	<name>puppet6</name>
	<range><lt>6.25.1</lt></range>
 </package>
 <package>
	<name>puppet7</name>
	<range><lt>7.12.1</lt></range>
 </package>
 <package>
	<name>puppetserver6</name>
	<range><lt>6.17.1</lt></range>
 </package>
 <package>
	<name>puppetserver7</name>
	<range><lt>7.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Puppet reports:
	<blockquote cite="https://puppet.com/security/cve/cve-2021-27023">
	 A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-27023</cvename>
 <url>https://puppet.com/security/cve/cve-2021-27023</url>
 </references>
 <dates>
 <discovery>2021-11-09</discovery>
 <entry>2021-11-10</entry>
 </dates>
 </vuln>

<vuln vid="646923b0-41c7-11ec-a3b2-005056a311d1">
 <topic>samba -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>samba413</name>
	<range><lt>4.13.14</lt></range>
 </package>
 <package>
	<name>samba414</name>
	<range><lt>4.14.10</lt></range>
 </package>
 <package>
	<name>samba415</name>
	<range><lt>4.15.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="https://www.samba.org/samba/history/security.html">
	 <ul>
	 <li>CVE-2020-25717: A user in an AD Domain could become root on domain
	 members.</li>
	 <li>CVE-2020-25718: Samba AD DC did not correctly sandbox Kerberos
	 tickets issued by an RODC.</li>
	 <li>CVE-2020-25719: Samba AD DC did not always rely on the SID and PAC
	 in Kerberos tickets.</li>
	 <li>CVE-2020-25721: Kerberos acceptors need easy access to stable
	 AD identifiers (eg objectSid).</li>
	 <li>CVE-2020-25722: Samba AD DC did not do sufficient access and
	 conformance checking of data stored.</li>
	 <li>CVE-2016-2124: SMB1 client connections can be downgraded to plaintext
	 authentication.</li>
	 <li>CVE-2021-3738: Use after free in Samba AD DC RPC server.</li>
	 <li>CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-25717</cvename>
 <cvename>CVE-2020-25718</cvename>
 <cvename>CVE-2020-25719</cvename>
 <cvename>CVE-2020-25721</cvename>
 <cvename>CVE-2020-25722</cvename>
 <cvename>CVE-2016-2124</cvename>
 <cvename>CVE-2021-3738</cvename>
 <cvename>CVE-2021-23192</cvename>
 <url>https://www.samba.org/samba/security/CVE-2020-25717.html</url>
 <url>https://www.samba.org/samba/security/CVE-2020-25718.html</url>
 <url>https://www.samba.org/samba/security/CVE-2020-25719.html</url>
 <url>https://www.samba.org/samba/security/CVE-2020-25721.html</url>
 <url>https://www.samba.org/samba/security/CVE-2020-25722.html</url>
 <url>https://www.samba.org/samba/security/CVE-2016-2124.html</url>
 <url>https://www.samba.org/samba/security/CVE-2021-3738.html</url>
 <url>https://www.samba.org/samba/security/CVE-2021-23192.html</url>
 </references>
 <dates>
 <discovery>2021-11-10</discovery>
 <entry>2021-11-10</entry>
 </dates>
 </vuln>

<vuln vid="17702e54-3da0-11ec-b7e0-3085a9a95629">
 <topic>pyrad -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py36-pyrad</name>
	<name>py37-pyrad</name>
	<name>py38-pyrad</name>
	<name>py39-pyrad</name>
	<name>py310-pyrad</name>
	<range><lt>2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nathaniel McCallum reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=911682">
	 packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.
	</blockquote>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=911685">
	 The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0294</cvename>
 <cvename>CVE-2013-0342</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=911682</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=911685</url>
 </references>
 <dates>
 <discovery>2013-01-15</discovery>
 <entry>2021-11-05</entry>
 </dates>
 </vuln>

<vuln vid="930def19-3e05-11ec-9ba8-002324b2fba8">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.17.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/48990">
	 debug/macho fails out when loading a file that contains a dynamic
	 symbol table command that indicates a larger number of symbols than
	 exist in the loaded symbol table.
	</blockquote>
	<blockquote cite="https://github.com/golang/go/issues/48085">
	 Previously, opening a zip with (*Reader).Open could result in a
	 panic if the zip contained a file whose name was exclusively made up
	 of slash characters or ".." path elements. Open could also panic if
	 passed the empty string directly as an argument.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41771</cvename>
 <url>https://github.com/golang/go/issues/48990</url>
 <cvename>CVE-2021-41772</cvename>
 <url>https://github.com/golang/go/issues/48085</url>
 </references>
 <dates>
 <discovery>2021-11-04</discovery>
 <entry>2021-11-05</entry>
 </dates>
 </vuln>

<vuln vid="2bf56269-90f8-4a82-b82f-c0e289f2a0dc">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.319</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.303.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2021-11-04/">
	 <h1>Description</h1>
	 <h5>(Critical) SECURITY-2455 / CVE-2021-21685, CVE-2021-21686, CVE-2021-21687, CVE-2021-21688, CVE-2021-21689, CVE-2021-21690, CVE-2021-21691, CVE-2021-21692, CVE-2021-21693, CVE-2021-21694, CVE-2021-21695</h5>
	 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control
	 <h5>(High) SECURITY-2423 / CVE-2021-21696</h5>
	 Agent-to-controller access control allowed writing to sensitive directory used by Pipeline: Shared Groovy Libraries Plugin
	 <h5>(High) SECURITY-2428 / CVE-2021-21697</h5>
	 Agent-to-controller access control allows reading/writing most content of build directories
	 <h5>(Medium) SECURITY-2506 / CVE-2021-21698</h5>
	 Path traversal vulnerability in Subversion Plugin allows reading arbitrary files
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-21685</cvename>
 <cvename>CVE-2021-21686</cvename>
 <cvename>CVE-2021-21687</cvename>
 <cvename>CVE-2021-21688</cvename>
 <cvename>CVE-2021-21689</cvename>
 <cvename>CVE-2021-21690</cvename>
 <cvename>CVE-2021-21691</cvename>
 <cvename>CVE-2021-21692</cvename>
 <cvename>CVE-2021-21693</cvename>
 <cvename>CVE-2021-21694</cvename>
 <cvename>CVE-2021-21695</cvename>
 <cvename>CVE-2021-21696</cvename>
 <cvename>CVE-2021-21697</cvename>
 <cvename>CVE-2021-21698</cvename>
 <url>https://www.jenkins.io/security/advisory/2021-11-04/</url>
 </references>
 <dates>
 <discovery>2021-11-04</discovery>
 <entry>2021-11-04</entry>
 </dates>
 </vuln>

<vuln vid="df794e5d-3975-11ec-84e8-0800273f11ea">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.15.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.15.5:
	<blockquote cite="https://blog.gitea.io/2021/10/gitea-1.15.5-is-released/">
	 <ul>
	 <li>Upgrade Bluemonday to v1.0.16 (#17372) (#17374)</li>
	 <li>Ensure correct SSH permissions check for private and restricted users (#17370) (#17373)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.15.5</url>
 <freebsdpr>ports/259548</freebsdpr>
 </references>
 <dates>
 <discovery>2021-10-21</discovery>
 <entry>2021-11-04</entry>
 </dates>
 </vuln>

<vuln vid="33557582-3958-11ec-90ba-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>14.4.0</ge><lt>14.4.1</lt></range>
	<range><ge>14.3.0</ge><lt>14.3.4</lt></range>
	<range><ge>0</ge><lt>14.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/10/28/security-release-gitlab-14-4-1-released/">
	 Stored XSS via ipynb files
	 Pipeline schedules on imported projects can be set to automatically active after import
	 Potential Denial of service via Workhorse
	 Improper Access Control allows Merge Request creator to bypass locked status
	 Projects API discloses ID and name of private groups
	 Severity of an incident can be changed by a guest user
	 System root password accidentally written to log file
	 Potential DoS via a malformed TIFF image
	 Bypass of CODEOWNERS Merge Request approval requirement
	 Change project visibility to a restricted option
	 Project exports leak external webhook token value
	 SCIM token is visible after creation
	 Invited group members, with access inherited from parent group, continue to have project access even after invited subgroup is transfered
	 Regular expression denial of service issue when cleaning namespace path
	 Prevent creation of scopeless apps using applications API
	 Webhook data exposes assignee's private email address
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-39906</cvename>
 <cvename>CVE-2021-39895</cvename>
 <cvename>CVE-2021-39907</cvename>
 <cvename>CVE-2021-39904</cvename>
 <cvename>CVE-2021-39905</cvename>
 <cvename>CVE-2021-39902</cvename>
 <cvename>CVE-2021-39913</cvename>
 <cvename>CVE-2021-39912</cvename>
 <cvename>CVE-2021-39909</cvename>
 <cvename>CVE-2021-39903</cvename>
 <cvename>CVE-2021-39898</cvename>
 <cvename>CVE-2021-39901</cvename>
 <cvename>CVE-2021-39897</cvename>
 <cvename>CVE-2021-39914</cvename>
 <cvename>CVE-2021-39911</cvename>
 <url>https://about.gitlab.com/releases/2021/10/28/security-release-gitlab-14-4-1-released/</url>
 </references>
 <dates>
 <discovery>2021-10-28</discovery>
 <entry>2021-10-30</entry>
 </dates>
 </vuln>

<vuln vid="976d7bf9-38ea-11ec-b3b0-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>95.0.4638.69</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html">
	 This release contains 8 security fixes, including:
	 <ul>
	 <li>[1259864] High CVE-2021-37997 : Use after free in Sign-In.
	 Reported by Wei Yuan of MoyunSec VLab on 2021-10-14</li>
	 <li>[1259587] High CVE-2021-37998 : Use after free in Garbage
	 Collection. Reported by Cassidy Kim of Amber Security Lab, OPPO
	 Mobile Telecommunications Corp. Ltd. on 2021-10-13</li>
	 <li>[1251541] High CVE-2021-37999 : Insufficient data validation in
	 New Tab Page. Reported by Ashish Arun Dhone on 2021-09-21</li>
	 <li>[1249962] High CVE-2021-38000 : Insufficient validation of
	 untrusted input in Intents. Reported by Clement Lecigne, Neel
	 Mehta, and Maddie Stone of Google Threat Analysis Group on
	 2021-09-15</li>
	 <li>[1260577] High CVE-2021-38001 : Type Confusion in V8. Reported
	 by @s0rrymybad of Kunlun Lab via Tianfu Cup on 2021-10-16</li>
	 <li>[1260940] High CVE-2021-38002 : Use after free in Web Transport.
	 Reported by @__R0ng of 360 Alpha Lab, ? via Tianfu Cup on
	 2021-10-16</li>
	 <li>[1263462] High CVE-2021-38003 : Inappropriate implementation in
	 V8. Reported by Clément Lecigne from Google TAG and Samuel Gross
	 from Google Project Zero on 2021-10-26</li>
	 </ul>
	 Google is aware that exploits for CVE-2021-38000 and
	 CVE-2021-38003 exist in the wild.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-37997</cvename>
 <cvename>CVE-2021-37998</cvename>
 <cvename>CVE-2021-37999</cvename>
 <cvename>CVE-2021-38000</cvename>
 <cvename>CVE-2021-38001</cvename>
 <cvename>CVE-2021-38002</cvename>
 <cvename>CVE-2021-38003</cvename>
 <url>https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html</url>
 </references>
 <dates>
 <discovery>2021-10-28</discovery>
 <entry>2021-10-29</entry>
 </dates>
 </vuln>

<vuln vid="c848059a-318b-11ec-aa15-0800270512f4">
 <topic>fail2ban -- possible RCE vulnerability in mailing action using mailutils</topic>
 <affects>
 <package>
	<name>py36-fail2ban</name>
	<name>py37-fail2ban</name>
	<name>py38-fail2ban</name>
	<name>py39-fail2ban</name>
	<name>py310-fail2ban</name>
	<range><lt>0.11.2_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jakub Żoczek reports:
	<blockquote cite="https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmm">
	 
	 Command <code>mail</code> from mailutils package used in mail actions
	 like <code>mail-whois</code> can execute command if unescaped sequences
	 (<code>\n~</code>) are available in "foreign" input (for instance in
	 whois output).
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-32749</cvename>
 <url>https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmm</url>
 </references>
 <dates>
 <discovery>2021-07-16</discovery>
 <entry>2021-10-28</entry>
 </dates>
 </vuln>

<vuln vid="757ee63b-269a-11ec-a616-6c3be5272acd">
 <topic>Grafana -- Snapshot authentication bypass</topic>
 <affects>
 <package>
	<name>grafana8</name>
	<name>grafana7</name>
	<name>grafana6</name>
	<name>grafana</name>
	<range><ge>8.0.0</ge><lt>8.1.6</lt></range>
	<range><ge>2.0.1</ge><lt>7.5.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://grafana.com/blog/2021/10/05/grafana-7.5.11-and-8.1.6-released-with-critical-security-fix/">
	 Unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths:
	 <ul>
	 <li><code>/dashboard/snapshot/:key</code>, or</li>
	 <li><code>/api/snapshots/:key</code></li>
	 </ul>
	 If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path:
	 <ul>
	 <li><code>/api/snapshots-delete/:deleteKey</code></li>
	 </ul>
	 Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths:
	 <ul>
	 <li><code>/api/snapshots/:key</code>, or</li>
	 <li><code>/api/snapshots-delete/:deleteKey</code></li>
	 </ul>
	 The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-39226</cvename>
 <url>https://grafana.com/blog/2021/10/05/grafana-7.5.11-and-8.1.6-released-with-critical-security-fix/</url>
 </references>
 <dates>
 <discovery>2021-09-15</discovery>
 <entry>2021-10-06</entry>
 </dates>
 </vuln>

<vuln vid="f4b15f7d-d33a-4cd0-a97b-709d6af0e43e">
 <topic>minio -- policy restriction issue</topic>
 <affects>
 <package>
	<name>minio</name>
	<range><lt>2021.10.23.03.28.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	minio developers report:
	<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-v64v-g97p-577c">
	 Looks like policy restriction was not working properly for normal users when they are not svc or STS accounts.
	 <ul>
	 <li>svc accounts are now properly fixed to get right permissions when its inherited, so we do not have to set 'owner = true'</li>
	 <li>sts accounts have always been using right permissions, do not need an explicit lookup</li>
	 <li>regular users always have proper policy mapping</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41137</cvename>
 <url>https://github.com/minio/minio/security/advisories/GHSA-v64v-g97p-577c</url>
 </references>
 <dates>
 <discovery>2021-10-12</discovery>
 <entry>2021-10-23</entry>
 </dates>
 </vuln>

<vuln vid="8d65aa3b-31ce-11ec-8c32-a14e8e520dc7">
 <topic>mailman -- brute-force vuln on list admin password, and CSRF vuln in releases before 2.1.35</topic>
 <affects>
 <package>
	<name>mailman</name>
	<range><lt>2.1.35</lt></range>
 </package>
 <package>
	<name>mailman-with-htdig</name>
	<range><lt>2.1.35</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mark Sapiro reports:
	<blockquote cite="https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/1873/NEWS#L8">
	 A potential for for a list member to carry out an off-line brute
	 force attack to obtain the list admin password has been reported by
	 Andre Protas, Richard Cloke and Andy Nuttall of Apple. This is
	 fixed.
	 A CSRF attack via the user options page could allow takeover of a
	 users account. This is fixed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-42096</cvename>
 <cvename>CVE-2021-42097</cvename>
 <url>https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/1873/NEWS#L8</url>
 <url>https://bugs.launchpad.net/mailman/+bug/1947639</url>
 <url>https://bugs.launchpad.net/mailman/+bug/1947640</url>
 </references>
 <dates>
 <discovery>2021-10-18</discovery>
 <entry>2021-10-20</entry>
 </dates>
 </vuln>

<vuln vid="bdaecfad-3117-11ec-b3b0-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>95.0.4638.54</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html">
	 This release contains 19 security fixes, including:
	 <ul>
	 <li>[1246631] High CVE-2021-37981: Heap buffer overflow in Skia.
	 Reported by Yangkang (@dnpushme) of 360 ATA on 2021-09-04</li>
	 <li>[1248661] High CVE-2021-37982: Use after free in Incognito.
	 Reported by Weipeng Jiang (@Krace) from Codesafe Team of
	 Legendsec at Qi'anxin Group on 2021-09-11</li>
	 <li>[1249810] High CVE-2021-37983: Use after free in Dev Tools.
	 Reported by Zhihua Yao of KunLun Lab on 2021-09-15</li>
	 <li>[1253399] High CVE-2021-37984: Heap buffer overflow in PDFium.
	 Reported by Antti Levomäki, Joonas Pihlaja andChristian Jali
	 from Forcepoint on 2021-09-27</li>
	 <li>[1241860] High CVE-2021-37985: Use after free in V8. Reported
	 by Yangkang (@dnpushme) of 360 ATA on 2021-08-20</li>
	 <li>[1242404] Medium CVE-2021-37986: Heap buffer overflow in
	 Settings. Reported by raven (@raid_akame) on 2021-08-23</li>
	 <li>[1206928] Medium CVE-2021-37987: Use after free in Network APIs.
	 Reported by Yangkang (@dnpushme) of 360 ATA on 2021-05-08</li>
	 <li>[1228248] Medium CVE-2021-37988: Use after free in Profiles.
	 Reported by raven (@raid_akame) on 2021-07-12</li>
	 <li>[1233067] Medium CVE-2021-37989: Inappropriate implementation
	 in Blink. Reported by Matt Dyas, Ankur Sundara on 2021-07-26</li>
	 <li>[1247395] Medium CVE-2021-37990: Inappropriate implementation
	 in WebView. Reported by Kareem Selim of CyShield on
	 2021-09-07</li>
	 <li>[1250660] Medium CVE-2021-37991: Race in V8. Reported by Samuel
	 Gross of Google Project Zero on 2021-09-17</li>
	 <li>[1253746] Medium CVE-2021-37992: Out of bounds read in WebAudio.
	 Reported by sunburst@Ant Security Light-Year Lab on
	 2021-09-28</li>
	 <li>[1255332] Medium CVE-2021-37993: Use after free in PDF
	 Accessibility. Reported by Cassidy Kim of Amber Security Lab,
	 OPPO Mobile Telecommunications Corp. Ltd. on 2021-10-02</li>
	 <li>[1243020] Medium CVE-2021-37996: Insufficient validation of
	 untrusted input in Downloads. Reported by Anonymous on
	 2021-08-24</li>
	 <li>[1100761] Low CVE-2021-37994: Inappropriate implementation in
	 iFrame Sandbox. Reported by David Erceg on 2020-06-30</li>
	 <li>[1242315] Low CVE-2021-37995: Inappropriate implementation in
	 WebApp Installer. Reported by Terence Eden on 2021-08-23</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-37981</cvename>
 <cvename>CVE-2021-37982</cvename>
 <cvename>CVE-2021-37983</cvename>
 <cvename>CVE-2021-37984</cvename>
 <cvename>CVE-2021-37985</cvename>
 <cvename>CVE-2021-37986</cvename>
 <cvename>CVE-2021-37987</cvename>
 <cvename>CVE-2021-37988</cvename>
 <cvename>CVE-2021-37989</cvename>
 <cvename>CVE-2021-37990</cvename>
 <cvename>CVE-2021-37991</cvename>
 <cvename>CVE-2021-37992</cvename>
 <cvename>CVE-2021-37993</cvename>
 <cvename>CVE-2021-37994</cvename>
 <cvename>CVE-2021-37995</cvename>
 <cvename>CVE-2021-37996</cvename>
 <url>https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html</url>
 </references>
 <dates>
 <discovery>2021-10-19</discovery>
 <entry>2021-10-19</entry>
 </dates>
 </vuln>

<vuln vid="c9387e4d-2f5f-11ec-8be6-d4c9ef517024">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.36</lt></range>
 </package>
 <package>
	<name>mysql80-client</name>
	<range><lt>8.0.27</lt></range>
 </package>
 <package>
	<name>mysql-connector-java</name>
	<range><lt>8.0.27</lt></range>
 </package>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.27</lt></range>
 </package>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.32</lt></range>
 </package>
 <package>
	<name>mariadb104-server</name>
	<range><lt>10.4.22</lt></range>
 </package>
 <package>
	<name>mariadb105-server</name>
	<range><lt>10.5.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujul2021.html">
	 This Critical Patch Update contains 66 new security patches for
	 Oracle MySQL. 8 of these vulnerabilities may be remotely exploitable
	 without authentication, i.e., may be exploited over a network without
	 requiring user credentials. 
	 The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
	 MySQL is 9.8.
	 Note: MariaDB only vulnerable against CVE-2021-35604
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/security-alerts/cpuoct2021.html</url>
 <cvename>CVE-2021-22931</cvename>
 <cvename>CVE-2021-3711</cvename>
 <cvename>CVE-2021-22926</cvename>
 <cvename>CVE-2021-36222</cvename>
 <cvename>CVE-2021-35583</cvename>
 <cvename>CVE-2021-35610</cvename>
 <cvename>CVE-2021-35597</cvename>
 <cvename>CVE-2021-35607</cvename>
 <cvename>CVE-2021-2481</cvename>
 <cvename>CVE-2021-35590</cvename>
 <cvename>CVE-2021-35592</cvename>
 <cvename>CVE-2021-35593</cvename>
 <cvename>CVE-2021-35594</cvename>
 <cvename>CVE-2021-35598</cvename>
 <cvename>CVE-2021-35621</cvename>
 <cvename>CVE-2021-2471</cvename>
 <cvename>CVE-2021-35604</cvename>
 <cvename>CVE-2021-35612</cvename>
 <cvename>CVE-2021-35608</cvename>
 <cvename>CVE-2021-35602</cvename>
 <cvename>CVE-2021-35577</cvename>
 <cvename>CVE-2021-2478</cvename>
 <cvename>CVE-2021-2479</cvename>
 <cvename>CVE-2021-35537</cvename>
 <cvename>CVE-2021-35591</cvename>
 <cvename>CVE-2021-35596</cvename>
 <cvename>CVE-2021-35648</cvename>
 <cvename>CVE-2021-35631</cvename>
 <cvename>CVE-2021-35626</cvename>
 <cvename>CVE-2021-35627</cvename>
 <cvename>CVE-2021-35628</cvename>
 <cvename>CVE-2021-35629</cvename>
 <cvename>CVE-2021-35575</cvename>
 <cvename>CVE-2021-35634</cvename>
 <cvename>CVE-2021-35635</cvename>
 <cvename>CVE-2021-35636</cvename>
 <cvename>CVE-2021-35638</cvename>
 <cvename>CVE-2021-35641</cvename>
 <cvename>CVE-2021-35642</cvename>
 <cvename>CVE-2021-35643</cvename>
 <cvename>CVE-2021-35644</cvename>
 <cvename>CVE-2021-35645</cvename>
 <cvename>CVE-2021-35646</cvename>
 <cvename>CVE-2021-35647</cvename>
 <cvename>CVE-2021-35630</cvename>
 <cvename>CVE-2021-35637</cvename>
 <cvename>CVE-2021-35546</cvename>
 <cvename>CVE-2021-35622</cvename>
 <cvename>CVE-2021-35624</cvename>
 <cvename>CVE-2021-35639</cvename>
 <cvename>CVE-2021-35632</cvename>
 <cvename>CVE-2021-35584</cvename>
 <cvename>CVE-2021-35613</cvename>
 <cvename>CVE-2021-35640</cvename>
 <cvename>CVE-2021-35633</cvename>
 <cvename>CVE-2021-35625</cvename>
 <cvename>CVE-2021-35623</cvename>
 <cvename>CVE-2021-35618</cvename>
 </references>
 <dates>
 <discovery>2021-10-16</discovery>
 <entry>2021-10-17</entry>
 <modified>2021-11-09</modified>
 </dates>
 </vuln>

<vuln vid="a9c5e89d-2d15-11ec-8363-0022489ad614">
 <topic>Node.js -- October 2021 Security Releases</topic>
 <affects>
 <package>
	<name>node</name>
	<range><lt>16.11.1</lt></range>
 </package>
 <package>
	<name>node14</name>
	<range><lt>14.18.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/">
	 <h1>HTTP Request Smuggling due to spaced in headers (Medium)(CVE-2021-22959)</h1>
	 The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS).
	 <h1>HTTP Request Smuggling when parsing the body (Medium)(CVE-2021-22960)</h1>
	 The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-22959</cvename>
 <cvename>CVE-2021-22960</cvename>
 <url>https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/</url>
 </references>
 <dates>
 <discovery>2021-10-12</discovery>
 <entry>2021-10-14</entry>
 </dates>
 </vuln>

<vuln vid="2a1b931f-2b86-11ec-8acd-c80aa9043978">
 <topic>OpenSSH -- OpenSSH 6.2 through 8.7 failed to correctly initialise supplemental groups when executing an AuthorizedKeysCommand or AuthorizedPrincipalsCommand</topic>
 <affects>
 <package>
	<name>openssh-portable</name>
	<name>openssh-portable-hpn</name>
	<name>openssh-portable-gssapi</name>
	<range><ge>6.2.p1,1</ge><lt>8.7.p1_2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenBSD Project reports:
	<blockquote cite="https://www.openssh.com/txt/release-8.8">
	 
		sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise
		supplemental groups when executing an AuthorizedKeysCommand or
		AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or
		AuthorizedPrincipalsCommandUser directive has been set to run the
		command as a different user. Instead these commands would inherit
		the groups that sshd(8) was started with.
	 
	 
		Depending on system configuration, inherited groups may allow
		AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to
		gain unintended privilege.
	 
	 
		Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are
		enabled by default in sshd_config(5).
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41617</cvename>
 <url>https://www.openssh.com/txt/release-8.8</url>
 </references>
 <dates>
 <discovery>2021-09-26</discovery>
 <entry>2021-10-12</entry>
 </dates>
 </vuln>

<vuln vid="a7dd4c2d-77e4-46de-81a2-c453c317f9de">
 <topic>couchdb -- user privilege escalation</topic>
 <affects>
 <package>
	<name>couchdb</name>
	<range><lt>3.1.2,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cory Sabol reports:
 <blockquote cite="https://docs.couchdb.org/en/stable/cve/2021-38295.html">
 A malicious user with permission to create documents in a
 database is able to attach a HTML attachment to a document.
 If a CouchDB admin opens that attachment in a browser, e.g.
 via the CouchDB admin interface Fauxton, any JavaScript code
 embedded in that HTML attachment will be executed within the
 security context of that admin. A similar route is available
 with the already deprecated _show and _list functionality.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-39205</cvename>
 <url>https://docs.couchdb.org/en/stable/cve/2021-38295.html</url>
 </references>
 <dates>
 <discovery>2021-08-09</discovery>
 <entry>2021-10-12</entry>
 </dates>
 </vuln>

<vuln vid="9a8514f3-2ab8-11ec-b3a1-8c164582fbac">
 <topic>Ansible -- Ansible user credentials disclosure in ansible-connection module</topic>
 <affects>
 <package>
	<name>py36-ansible-core</name>
	<name>py37-ansible-core</name>
	<name>py38-ansible-core</name>
	<name>py39-ansible-core</name>
	<name>py310-ansible-core</name>
	<range><lt>2.11.6</lt></range>
 </package>
 <package>
	<name>py36-ansible-base</name>
	<name>py37-ansible-base</name>
	<name>py38-ansible-base</name>
	<name>py39-ansible-base</name>
	<name>py310-ansible-base</name>
	<range><lt>2.10.15</lt></range>
 </package>
 <package>
	<name>py36-ansible2</name>
	<name>py37-ansible2</name>
	<name>py38-ansible2</name>
	<name>py39-ansible2</name>
	<name>py310-ansible2</name>
	<range><lt>2.9.27</lt></range>
 </package>
 <package>
	<name>py36-ansible</name>
	<name>py37-ansible</name>
	<name>py38-ansible</name>
	<name>py39-ansible</name>
	<name>py310-ansible</name>
	<range><lt>2.9.27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Red Hat reports:
	<blockquote cite="">
 A flaw was found in Ansible Engine's ansible-connection
 module, where sensitive information such as the Ansible
 user credentials is disclosed by default in the traceback
 error message. The highest threat from this vulnerability
 is to confidentiality.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-3620</cvename>
 <url>https://access.redhat.com/security/cve/CVE-2021-3620</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-3620</url>
 <url>https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#v2-9-27</url>
 <url>https://github.com/ansible/ansible/blob/stable-2.10/changelogs/CHANGELOG-v2.10.rst#v2-10-15</url>
 <url>https://github.com/ansible/ansible/blob/stable-2.11/changelogs/CHANGELOG-v2.11.rst#v2-11-6</url>
 </references>
 <dates>
 <discovery>2021-06-25</discovery>
 <entry>2021-10-11</entry>
 </dates>
 </vuln>

<vuln vid="04d2cf7f-2942-11ec-b48c-1c1b0d9ea7e6">
 <topic>Apache OpenOffice -- multiple vulnerabilities.</topic>
 <affects>
 <package>
	<name>apache-openoffice</name>
	<range><lt>4.1.11</lt></range>
 </package>
 <package>
	<name>apache-openoffice-devel</name>
	<range><lt>4.2.1633255994,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Openoffice project reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-33035">
	 Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the allocated space, leading to the execution of arbitrary code by altering the contents of the program stack. This issue affects Apache OpenOffice up to and including version 4.1.10
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-41830">
	 It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25633 for the LibreOffice advisory 
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-41831">
	 It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25634 for the LibreOffice advisory.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-41832">
	 It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25635 for the LibreOffice advisory.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-33035</cvename>
 <cvename>CVE-2021-41830</cvename>
 <cvename>CVE-2021-41831</cvename>
 <cvename>CVE-2021-41832</cvename>
 <url>https://cwiki.apache.org/confluence/display/OOOUSERS/AOO+4.1.11+Release+Notes/#AOO4.1.11ReleaseNotes-Security</url>
 </references>
 <dates>
 <discovery>2021-05-04</discovery>
 <entry>2021-10-09</entry>
 </dates>
 </vuln>

<vuln vid="4fce9635-28c0-11ec-9ba8-002324b2fba8">
 <topic>go -- misc/wasm, cmd/link: do not let command line arguments overwrite global data</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.17.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/48797">
	 When invoking functions from WASM modules, built using GOARCH=wasm
	 GOOS=js, passing very large arguments can cause portions of the module
	 to be overwritten with data from the arguments.
	 If using wasm_exec.js to execute WASM modules, users will need to
	 replace their copy after rebuilding any modules.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-38297</cvename>
 <url>https://github.com/golang/go/issues/48797</url>
 </references>
 <dates>
 <discovery>2021-10-06</discovery>
 <entry>2021-10-09</entry>
 </dates>
 </vuln>

<vuln vid="7d3d94d3-2810-11ec-9c51-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>94.0.4606.81</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop.html">
	 This release contains 4 security fixes, including:
	 <ul>
	 <li>[1252878] High CVE-2021-37977: Use after free in Garbage
	 Collection. Reported by Anonymous on 2021-09-24</li>
	 <li>[1236318] High CVE-2021-37978: Heap buffer overflow in Blink.
	 Reported by Yangkang (@dnpushme) of 360 ATA on 2021-08-04</li>
	 <li>[1247260] High CVE-2021-37979: Heap buffer overflow in WebRTC.
	 Reported by Marcin Towalski of Cisco Talos on 2021-09-07</li>
	 <li>[1254631] High CVE-2021-37980: Inappropriate implementation in
	 Sandbox. Reported by Yonghwi Jin (@jinmo123) on 2021-09-30</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-37977</cvename>
 <cvename>CVE-2021-37978</cvename>
 <cvename>CVE-2021-37979</cvename>
 <cvename>CVE-2021-37980</cvename>
 <url>https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2021-10-07</discovery>
 <entry>2021-10-08</entry>
 </dates>
 </vuln>

<vuln vid="d001c189-2793-11ec-8fb1-206a8a720317">
 <topic>Apache httpd -- Path Traversal and Remote Code Execution</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><ge>2.4.49</ge><lt>2.4.51</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache http server project reports:
	<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
	 critical: Path Traversal and Remote Code Execution in Apache HTTP
	 Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
	 (CVE-2021-42013).
	 It was found that the fix for CVE-2021-41773 in Apache HTTP
	 Server 2.4.50 was insufficient. An attacker could use a path
	 traversal attack to map URLs to files outside the directories
	 configured by Alias-like directives.
	 If files outside of these directories are not protected by the
	 usual default configuration "require all denied", these requests
	 can succeed. If CGI scripts are also enabled for these aliased
	 pathes, this could allow for remote code execution.
	 This issue only affects Apache 2.4.49 and Apache 2.4.50 and not
	 earlier versions.
	 Acknowledgements: Reported by Juan Escobar from Dreamlab
	 Technologies, Fernando Munoz from NULL Life CTF Team, and
	 Shungo Kumasaka
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-42013</cvename>
 </references>
 <dates>
 <discovery>2021-10-07</discovery>
 <entry>2021-10-07</entry>
 </dates>
 </vuln>

<vuln vid="9bad457e-b396-4452-8773-15bec67e1ceb">
 <topic>jenkins -- Jenkins core bundles vulnerable version of the commons-httpclient library</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.315</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.303.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2021-10-06/">
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-2475 / CVE-2014-3577</h5>
	 Jenkins core bundles vulnerable version of the commons-httpclient library
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3577</cvename>
 <url>https://www.jenkins.io/security/advisory/2021-10-06/</url>
 </references>
 <dates>
 <discovery>2021-10-06</discovery>
 <entry>2021-10-07</entry>
 </dates>
 </vuln>

<vuln vid="25b78bdd-25b8-11ec-a341-d4c9ef517024">
 <topic>Apache httpd -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><ge>2.4.49</ge><lt>2.4.50</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache http server project reports:
	<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
	 <ul>
	 <li>moderate: null pointer dereference in h2 fuzzing
	 (CVE-2021-41524)</li>
	 <li>important: Path traversal and file disclosure vulnerability in
	 Apache HTTP Server 2.4.49 (CVE-2021-41773)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41524</cvename>
 <cvename>CVE-2021-41773</cvename>
 <url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
 </references>
 <dates>
 <discovery>2021-10-05</discovery>
 <entry>2021-10-05</entry>
 <modified>2021-10-06</modified>
 </dates>
 </vuln>

<vuln vid="f05dbd1f-2599-11ec-91be-001b217b3468">
 <topic>Bacula-Web -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>bacula-web</name>
	<range><lt>8.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bacula-Web reports:
	<blockquote cite="https://www.bacula-web.org/releases/2021-07-11-bacula-web-8.4.2/">
	 Address Smarty CVE
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-26119</cvename>
 <cvename>CVE-2021-26120</cvename>
 <url>https://www.bacula-web.org/releases/2021-07-11-bacula-web-8.4.2/</url>
 </references>
 <dates>
 <discovery>2021-07-11</discovery>
 <entry>2021-10-05</entry>
 </dates>
 </vuln>

<vuln vid="9b4806c1-257f-11ec-9db5-0800270512f4">
 <topic>redis -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>redis-devel</name>
	<range><lt>7.0.0.20211005</lt></range>
 </package>
 <package>
	<name>redis</name>
	<range><lt>6.2.6</lt></range>
 </package>
 <package>
	<name>redis6</name>
	<range><lt>6.0.16</lt></range>
 </package>
 <package>
	<name>redis5</name>
	<range><lt>5.0.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Redis Team reports:
	<blockquote cite="https://groups.google.com/g/redis-db/c/GS_9L2KCk9g/m/Q7ZN1R1cDAAJ">
	 <dl>
	 <dt>CVE-2021-41099</dt>
	 <dd>
	 Integer to heap buffer overflow handling certain string commands
	 and network payloads, when proto-max-bulk-len is manually configured.
	 </dd>
	 <dt>CVE-2021-32762</dt>
	 <dd>
	 Integer to heap buffer overflow issue in redis-cli and redis-sentinel
	 parsing large multi-bulk replies on some older and less common platforms.
	 </dd>
	 <dt>CVE-2021-32687</dt>
	 <dd>
	 Integer to heap buffer overflow with intsets, when set-max-intset-entries
	 is manually configured to a non-default, very large value.
	 </dd>
	 <dt>CVE-2021-32675</dt>
	 <dd>
	 Denial Of Service when processing RESP request payloads with a large
	 number of elements on many connections.
	 </dd>
	 <dt>CVE-2021-32672</dt>
	 <dd>
	 Random heap reading issue with Lua Debugger.
	 </dd>
	 <dt>CVE-2021-32628</dt>
	 <dd>
	 Integer to heap buffer overflow handling ziplist-encoded data types,
	 when configuring a large, non-default value for hash-max-ziplist-entries,
	 hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value.
	 </dd>
	 <dt>CVE-2021-32627</dt>
	 <dd>
	 Integer to heap buffer overflow issue with streams, when configuring
	 a non-default, large value for proto-max-bulk-len and
	 client-query-buffer-limit.
	 </dd>
	 <dt>CVE-2021-32626</dt>
	 <dd>
	 Specially crafted Lua scripts may result with Heap buffer overflow.
	 </dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41099</cvename>
 <cvename>CVE-2021-32762</cvename>
 <cvename>CVE-2021-32687</cvename>
 <cvename>CVE-2021-32675</cvename>
 <cvename>CVE-2021-32672</cvename>
 <cvename>CVE-2021-32628</cvename>
 <cvename>CVE-2021-32627</cvename>
 <cvename>CVE-2021-32626</cvename>
 <url>https://groups.google.com/g/redis-db/c/GS_9L2KCk9g</url>
 </references>
 <dates>
 <discovery>2021-10-04</discovery>
 <entry>2021-10-05</entry>
 </dates>
 </vuln>

<vuln vid="f84ab297-2285-11ec-9e79-08002789875b">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki131</name>
	<range><lt>1.31.16</lt></range>
 </package>
 <package>
	<name>mediawiki135</name>
	<range><lt>1.35.4</lt></range>
 </package>
 <package>
	<name>mediawiki136</name>
	<range><lt>1.36.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawiki reports:
	<blockquote cite="https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/">
	 (T285515, CVE-2021-41798) SECURITY: XSS vulnerability in Special:Search.
	 (T290379, CVE-2021-41799) SECURITY: ApiQueryBacklinks can cause a full
	 table scan.
	 (T284419, CVE-2021-41800) SECURITY: fix PoolCounter protection of
	 Special:Contributions.
	 (T279090, CVE-2021-41801) SECURITY: ReplaceText continues performing
	 actions if the user no longer has the correct permission (such as by being
	 blocked).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-41798</cvename>
 <cvename>CVE-2021-41799</cvename>
 <cvename>CVE-2021-41800</cvename>
 <cvename>CVE-2021-41801</cvename>
 <url>https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/</url>
 </references>
 <dates>
 <discovery>2021-06-24</discovery>
 <entry>2021-10-01</entry>
 </dates>
 </vuln>

<vuln vid="777edbbe-2230-11ec-8869-704d7b472482">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>94.0.4606.71</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases/Stable updates reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_30.html">
	 This release contains 4 security fixes, including:
	 <ul>
	 <li>[1245578] High CVE-2021-37974: Use after free in Safe Browsing.
	 Reported by Weipeng Jiang (@Krace) from Codesafe Team of
	 Legendsec at Qi'anxin Group on 2021-09-01</li>
	 <li>[1252918] High CVE-2021-37975: Use after free in V8. Reported by
	 Anonymous on 2021-09-24</li>
	 <li>[1251787] Medium CVE-2021-37976: Information leak in core.
	 Reported by Clement Lecigne from Google TAG, with technical
	 assistance from Sergei Glazunov and Mark Brand from Google
	 Project Zero on 2021-09-21</li>
	 </ul>
	 Google is aware the exploits for CVE-2021-37975 and CVE-2021-37976
	 exist in the wild.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-37974</cvename>
 <cvename>CVE-2021-37975</cvename>
 <cvename>CVE-2021-37976</cvename>
 <url>https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_30.html</url>
 </references>
 <dates>
 <discovery>2021-09-30</discovery>
 <entry>2021-09-30</entry>
 </dates>
 </vuln>

<vuln vid="1bdd4db6-2223-11ec-91be-001b217b3468">
 <topic>Gitlab -- vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>14.3.0</ge><lt>14.3.1</lt></range>
	<range><ge>14.2.0</ge><lt>14.2.5</lt></range>
	<range><ge>0</ge><lt>14.1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/09/30/security-release-gitlab-14-3-1-released/">
	 Stored XSS in merge request creation page
	 Denial-of-service attack in Markdown parser
	 Stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown
	 DNS Rebinding vulnerability in Gitea importer
	 Exposure of trigger tokens on project exports
	 Improper access control for users with expired password
	 Access tokens are not cleared after impersonation
	 Reflected Cross-Site Scripting in Jira Integration
	 DNS Rebinding vulnerability in Fogbugz importer
	 Access tokens persist after project deletion
	 User enumeration vulnerability
	 Potential DOS via API requests
	 Pending invitations of public groups and public projects are visible to any user
	 Bypass Disabled Repo by URL Project Creation
	 Low privileged users can see names of the private groups shared in projects
	 API discloses sensitive info to low privileged users
	 Epic listing do not honour group memberships
	 Insecure Direct Object Reference vulnerability may lead to protected branch names getting disclosed
	 Low privileged users can import users from projects that they they are not a maintainer on
	 Potential DOS via dependencies API
	 Create a project with unlimited repository size through malicious Project Import
	 Bypass disabled Bitbucket Server import source project creation
	 Requirement to enforce 2FA is not honored when using git commands
	 Content spoofing vulnerability
	 Improper session management in impersonation feature
	 Create OAuth application with arbitrary scopes through content spoofing
	 Lack of account lockout on change password functionality
	 Epic reference was not updated while moved between groups
	 Missing authentication allows disabling of two-factor authentication
	 Information disclosure in SendEntry
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-39885</cvename>
 <cvename>CVE-2021-39877</cvename>
 <cvename>CVE-2021-39887</cvename>
 <cvename>CVE-2021-39867</cvename>
 <cvename>CVE-2021-39869</cvename>
 <cvename>CVE-2021-39872</cvename>
 <cvename>CVE-2021-39878</cvename>
 <cvename>CVE-2021-39866</cvename>
 <cvename>CVE-2021-39882</cvename>
 <cvename>CVE-2021-39875</cvename>
 <cvename>CVE-2021-39870</cvename>
 <cvename>CVE-2021-39884</cvename>
 <cvename>CVE-2021-39883</cvename>
 <cvename>CVE-2021-22259</cvename>
 <cvename>CVE-2021-39868</cvename>
 <cvename>CVE-2021-39871</cvename>
 <cvename>CVE-2021-39874</cvename>
 <cvename>CVE-2021-39873</cvename>
 <cvename>CVE-2021-39881</cvename>
 <cvename>CVE-2021-39886</cvename>
 <cvename>CVE-2021-39879</cvename>
 <url>https://about.gitlab.com/releases/2021/09/30/security-release-gitlab-14-3-1-released/</url>
 </references>
 <dates>
 <discovery>2021-09-30</discovery>
 <entry>2021-09-30</entry>
 </dates>
 </vuln>

<vuln vid="5436f9a2-2190-11ec-a90b-0cc47a49470e">
 <topic>ha -- Directory traversals</topic>
 <affects>
 <package>
	<name>ha</name>
	<range><lt>0.999b_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Alexander Cherepanov reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/01/18/8">
	 Version 0.999b and older of ha archiver is susceptible to directory
	 traversal vulnerabilities via absolute and relative paths.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1198</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/01/18/8</url>
 </references>
 <dates>
 <discovery>2015-01-18</discovery>
 <entry>2021-09-30</entry>
 </dates>
 </vuln>

<vuln vid="730e922f-20e7-11ec-a574-080027eedc6a">
 <topic>nexus2-oss -- Apache ActiveMQ JMX vulnerability</topic>
 <affects>
 <package>
	<name>nexus2-oss</name>
	<range><lt>2.14.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sonatype reports:
	<blockquote cite="https://help.sonatype.com/repomanager2/release-notes/2020-release-notes#id-2020ReleaseNotes-RepositoryManage">
		<ul><li>CVE-2020-13920: Apache ActiveMQ JMX is vulnerable to a MITM attack</li></ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-13920</cvename>
 <url>https://help.sonatype.com/repomanager2/release-notes/2020-release-notes#id-2020ReleaseNotes-RepositoryManage</url>
 </references>
 <dates>
 <discovery>2020-12-28</discovery>
 <entry>2021-09-29</entry>
 </dates>
 </vuln>

<vuln vid="b2f1f86f-20e6-11ec-a574-080027eedc6a">
 <topic>nexus2-oss -- NXRM2 Directory Traversal vulnerability</topic>
 <affects>
 <package>
	<name>nexus2-oss</name>
	<range><lt>2.14.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sonatype reports:
	<blockquote cite="https://help.sonatype.com/repomanager2/release-notes/2020-release-notes#id-2020ReleaseNotes-RepositoryManager2.14.20">
		<ul><li>CVE-2020-15012: NXRM2 Directory Traversal vulnerability</li></ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-15012</cvename>
 <url>https://help.sonatype.com/repomanager2/release-notes/2020-release-notes#id-2020ReleaseNotes-RepositoryManage</url>
 </references>
 <dates>
 <discovery>2020-06-23</discovery>
 <entry>2021-09-29</entry>
 </dates>
 </vuln>

<vuln vid="576aa394-1d85-11ec-8b7d-4f5b624574e2">
 <topic>webkit2-gtk3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>webkit2-gtk3</name>
	<range><lt>2.32.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The WebKitGTK project reports vulnerabilities:
	<blockquote cite="https://webkitgtk.org/security/WSA-2021-0005.html">
		<ul><li>CVE-2021-30858: Processing maliciously crafted web content may lead to arbitrary code execution.</li></ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-30858</cvename>
 <url>https://webkitgtk.org/security/WSA-2021-0005.html</url>
 </references>
 <dates>
 <discovery>2021-09-20</discovery>
 <entry>2021-09-24</entry>
 </dates>
 </vuln>

<vuln vid="b6c875f1-1d76-11ec-ae80-704d7b472482">
 <topic>chromium -- use after free in Portals</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>94.0.4606.61</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_24.html">
	 ][1251727] High CVE-2021-37973 : Use after free in Portals.
	 Reported by Clement Lecigne from Google TAG, with technical
	 assistance from Sergei Glazunov and Mark Brand from Google Project
	 Zero on 2021-09-21
	 Google is aware that an exploit for CVE-2021-37973 exists in the wild.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-37973</cvename>
 <url>https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_24.html</url>
 </references>
 <dates>
 <discovery>2021-09-24</discovery>
 <entry>2021-09-24</entry>
 </dates>
 </vuln>

<vuln vid="d4d21998-bdc4-4a09-9849-2898d9b41459">
 <topic>zeek -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>4.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v4.0.4">
	 Paths from log stream make it into system() unchecked,
	 potentially leading to commands being run on the system
	 unintentionally. This requires either bad scripting or a
	 malicious package to be installed, and is considered low
	 severity. 
	 Fix potential unbounded state growth in the PIA
	 analyzer when receiving a connection with either a large
	 number of zero-length packets, or one which continues
	 ack-ing unseen segments. It is possible to run Zeek out
	 of memory in these instances and cause it to crash. Due
	 to the possibility of this happening with packets received
	 from the network, this is a potential DoS vulnerability.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v4.0.4</url>
 </references>
 <dates>
 <discovery>2021-08-26</discovery>
 <entry>2021-09-22</entry>
 </dates>
 </vuln>

<vuln vid="7bba5b3b-1b7f-11ec-b335-d4c9ef517024">
 <topic>mod_auth_mellon -- Redirect URL validation bypass</topic>
 <affects>
 <package>
	<name>mod_auth_mellon</name>
	<range><lt>0.18.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jakub Hrozek reports:
	<blockquote cite="https://github.com/latchset/mod_auth_mellon/releases/tag/v0.18.0">
	 Version 0.17.0 and older of mod_auth_mellon allows the redirect URL
	 validation to be bypassed by specifying an URL formatted as
	 ///fishing-site.example.com/logout.html
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-13038</cvename>
 <url>https://github.com/latchset/mod_auth_mellon/releases/tag/v0.18.0</url>
 </references>
 <dates>
 <discovery>2021-07-30</discovery>
 <entry>2021-09-22</entry>
 </dates>
 </vuln>

<vuln vid="7062bce0-1b17-11ec-9d9d-0022489ad614">
 <topic>Node.js -- August 2021 Security Releases (2)</topic>
 <affects>
 <package>
	<name>node14</name>
	<range><lt>14.17.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases2/">
	 <h1>npm 6 update - node-tar, arborist, npm cli modules</h1>
	 These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804. Subsequent internal security review of node-tar and additional external bounty reports have resulted in another 5 CVE being remediated in core npm CLI dependencies including node-tar, and npm arborist.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-32803</cvename>
 <cvename>CVE-2021-32804</cvename>
 <cvename>CVE-2021-37701</cvename>
 <cvename>CVE-2021-37712</cvename>
 <cvename>CVE-2021-37713</cvename>
 <cvename>CVE-2021-39134</cvename>
 <cvename>CVE-2021-39135</cvename>
 <url>https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases2/</url>
 </references>
 <dates>
 <discovery>2021-08-31</discovery>
 <entry>2021-09-21</entry>
 </dates>
 </vuln>

<vuln vid="b092bd4f-1b16-11ec-9d9d-0022489ad614">
 <topic>Node.js -- August 2021 Security Releases</topic>
 <affects>
 <package>
	<name>node14</name>
	<range><lt>14.17.4</lt></range>
 </package>
 <package>
	<name>node</name>
	<range><lt>16.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/">
	 <h1>cares upgrade - Improper handling of untypical characters in domain names (High) (CVE-2021-22931)</h1>
	 Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of host names returned by Domain Name Servers in the Node.js DNS library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
	 <h1>Use after free on close http2 on stream canceling (High) (CVE-2021-22940)</h1>
	 Node.js was vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. The issue is a follow on to CVE-2021-22930 as the issue was not completely resolved in the fix for CVE-2021-22930.
	 <h1>Incomplete validation of rejectUnauthorized parameter (Low) (CVE-2021-22939)</h1>
	 If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-22931</cvename>
 <cvename>CVE-2021-22940</cvename>
 <cvename>CVE-2021-22939</cvename>
 <url>https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/</url>
 </references>
 <dates>
 <discovery>2021-08-11</discovery>
 <entry>2021-09-21</entry>
 </dates>
 </vuln>

<vuln vid="f53dab71-1b15-11ec-9d9d-0022489ad614">
 <topic>Node.js -- July 2021 Security Releases (2)</topic>
 <affects>
 <package>
	<name>node14</name>
	<range><lt>14.17.4</lt></range>
 </package>
 <package>
	<name>node</name>
	<range><lt>16.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="ihttps://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/">
	 <h1>Use after free on close http2 on stream canceling (High) (CVE-2021-22930)</h1>
	 Node.js is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-22930</cvename>
 <url>https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/</url>
 </references>
 <dates>
 <discovery>2021-07-29</discovery>
 <entry>2021-09-21</entry>
 </dates>
 </vuln>

<vuln vid="c174118e-1b11-11ec-9d9d-0022489ad614">
 <topic>Node.js -- July 2021 Security Releases</topic>
 <affects>
 <package>
	<name>node14</name>
	<range><lt>14.17.2</lt></range>
 </package>
 <package>
	<name>node</name>
	<range><lt>16.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/">
	 <h1>libuv upgrade - Out of bounds read (Medium) (CVE-2021-22918)</h1>
	 Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes.
	 <h1>Windows installer - Node Installer Local Privilege Escalation (Medium) (CVE-2021-22921)</h1>
	 Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.
	 <h1>npm upgrade - ssri Regular Expression Denial of Service (ReDoS) (High) (CVE-2021-27290)</h1>
	 This is a vulnerability in the ssri npm module which may be vulnerable to denial of service attacks.
	 <h1>npm upgrade - hosted-git-info Regular Expression Denial of Service (ReDoS) (Medium) (CVE-2021-23362)</h1>
	 This is a vulnerability in the hosted-git-info npm module which may be vulnerable to denial of service attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-22918</cvename>
 <cvename>CVE-2021-22921</cvename>
 <cvename>CVE-2021-27290</cvename>
 <cvename>CVE-2021-23362</cvename>
 <url>https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/</url>
 </references>
 <dates>
 <discovery>2021-07-01</discovery>
 <entry>2021-09-21</entry>
 </dates>
 </vuln>

<vuln vid="3551e106-1b17-11ec-a8a7-704d7b472482">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>94.0.4606.54</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html">
	 This update contains 19 security fixes, including:
	 <ul>
	 <li>[1243117] High CVE-2021-37956: Use after free in Offline use.
	 Reported by Huyna at Viettel Cyber Security on 2021-08-24</li>
	 <li>[1242269] High CVE-2021-37957: Use after free in WebGPU.
	 Reported by Looben Yang on 2021-08-23</li>
	 <li>[1223290] High CVE-2021-37958: Inappropriate implementation in
	 Navigation. Reported by James Lee (@Windowsrcer) on
	 2021-06-24</li>
	 <li>[1229625] High CVE-2021-37959: Use after free in Task Manager.
	 Reported by raven (@raid_akame) on 2021-07-15</li>
	 <li>[1247196] High CVE-2021-37960: Inappropriate implementation in
	 Blink graphics. Reported by Atte Kettunen of OUSPG on
	 2021-09-07</li>
	 <li>[1228557] Medium CVE-2021-37961: Use after free in Tab Strip.
	 Reported by Khalil Zhani on 2021-07-13</li>
	 <li>[1231933] Medium CVE-2021-37962: Use after free in Performance
	 Manager. Reported by Sri on 2021-07-22</li>
	 <li>[1199865] Medium CVE-2021-37963: Side-channel information
	 leakage in DevTools. Reported by Daniel Genkin and Ayush Agarwal,
	 University of Michigan, Eyal Ronen and Shaked Yehezkel, Tel Aviv
	 University, Sioli O'Connell, University of Adelaide, and Jason
	 Kim, Georgia Institute of Technology on 2021-04-16</li>
	 <li>[1203612] Medium CVE-2021-37964: Inappropriate implementation in
	 ChromeOS Networking. Reported by Hugo Hue and Sze Yiu Chau of the
	 Chinese University of Hong Kong on 2021-04-28</li>
	 <li>[1239709] Medium CVE-2021-37965: Inappropriate implementation in
	 Background Fetch API. Reported by Maurice Dauer on 2021-08-13</li>
	 <li>[1238944] Medium CVE-2021-37966: Inappropriate implementation in
	 Compositing. Reported by Mohit Raj (shadow2639) on 2021-08-11</li>
	 <li>[1243622] Medium CVE-2021-37967: Inappropriate implementation in
	 Background Fetch API. Reported by SorryMybad (@S0rryMybad) of
	 Kunlun Lab on 2021-08-26</li>
	 <li>[1245053] Medium CVE-2021-37968: Inappropriate implementation in
	 Background Fetch API. Reported by Maurice Dauer on 2021-08-30</li>
	 <li>[1245879] Medium CVE-2021-37969: Inappropriate implementation in
	 Google Updater. Reported by Abdelhamid Naceri (halov) on
	 2021-09-02</li>
	 <li>[1248030] Medium CVE-2021-37970: Use after free in File System
	 API. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on
	 2021-09-09</li>
	 <li>[1219354] Low CVE-2021-37971: Incorrect security UI in Web
	 Browser UI. Reported by Rayyan Bijoora on 2021-06-13</li>
	 <li>[1234259] Low CVE-2021-37972: Out of bounds read in
	 libjpeg-turbo. Reported by Xu Hanyu and Lu Yutao from
	 Panguite-Forensics-Lab of Qianxin on 2021-07-29</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-37956</cvename>
 <cvename>CVE-2021-37957</cvename>
 <cvename>CVE-2021-37958</cvename>
 <cvename>CVE-2021-37959</cvename>
 <cvename>CVE-2021-37960</cvename>
 <cvename>CVE-2021-37961</cvename>
 <cvename>CVE-2021-37962</cvename>
 <cvename>CVE-2021-37963</cvename>
 <cvename>CVE-2021-37964</cvename>
 <cvename>CVE-2021-37965</cvename>
 <cvename>CVE-2021-37966</cvename>
 <cvename>CVE-2021-37967</cvename>
 <cvename>CVE-2021-37968</cvename>
 <cvename>CVE-2021-37969</cvename>
 <cvename>CVE-2021-37970</cvename>
 <cvename>CVE-2021-37971</cvename>
 <cvename>CVE-2021-37972</cvename>
 <url>https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html</url>
 </references>
 <dates>
 <discovery>2021-09-21</discovery>
 <entry>2021-09-21</entry>
 </dates>
 </vuln>

<vuln vid="57b1ee25-1a7c-11ec-9376-0800272221cc">
 <topic>libssh -- possible heap-buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>libssh</name>
	<range><ge>0.9.1</ge><le>0.9.5</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libssh security advisories:
	<blockquote cite="https://www.libssh.org/security/advisories/CVE-2021-3634.txt">
	 The SSH protocol keeps track of two shared secrets during the lifetime
	 of the session. One of them is called `secret_hash` and and the other
	 `session_id`. Initially, both of them are the same, but after key
	 re-exchange, previous `session_id` is kept and used as an input to new
	 `secret_hash`.
	 Historically, both of these buffers had shared length variable, which
	 worked as long as these buffers were same. But the key re-exchange
	 operation can also change the key exchange method, which can be based on
	 hash of different size, eventually creating `secret_hash` of different
	 size than the `session_id` has.
	 This becomes an issue when the `session_id` memory is zeroized or when
	 it is used again during second key re-exchange.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-3634</cvename>
 <url>https://www.libssh.org/security/advisories/CVE-2021-3634.txt</url>
 <url>https://www.libssh.org/2021/08/26/libssh-0-9-6-security-release/</url>
 </references>
 <dates>
 <discovery>2021-08-26</discovery>
 <entry>2021-09-21</entry>
 </dates>
 </vuln>

<vuln vid="882a38f9-17dd-11ec-b335-d4c9ef517024">
 <topic>Apache httpd -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.49</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache project reports:
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
	 <ul>
	 <li>moderate: Request splitting via HTTP/2 method injection and
	 mod_proxy (CVE-2021-33193)</li>
	 <li>moderate: NULL pointer dereference in httpd core
	 (CVE-2021-34798)</li>
	 <li>moderate: mod_proxy_uwsgi out of bound read (CVE-2021-36160)</li>
	 <li>low: ap_escape_quotes buffer overflow (CVE-2021-39275)</li>
	 <li>high: mod_proxy SSRF (CVE-2021-40438)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-33193</cvename>
 <cvename>CVE-2021-34798</cvename>
 <cvename>CVE-2021-36160</cvename>
 <cvename>CVE-2021-39275</cvename>
 <cvename>CVE-2021-40438</cvename>
 <url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
 </references>
 <dates>
 <discovery>2021-09-16</discovery>
 <entry>2021-09-17</entry>
 <modified>2021-09-28</modified>
 </dates>
 </vuln>

<vuln vid="c9221ec9-17a2-11ec-b335-d4c9ef517024">
 <topic>cURL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>curl</name>
 <range><ge>7.20.0</ge><lt>7.79.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports:
	<blockquote cite="https://curl.se/docs/security.html">
	 <ul>
	 <li>UAF and double-free in MQTT sending (CVE-2021-22945)</li>
	 <li>Protocol downgrade required TLS bypassed (CVE-2021-22946)</li>
	 <li>STARTTLS protocol injection via MITM (CVE-2021-22945)</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-22945</cvename>
 <cvename>CVE-2021-22946</cvename>
 <cvename>CVE-2021-22947</cvename>
 <url>https://curl.se/docs/security.html</url>
 </references>
 <dates>
 <discovery>2021-09-15</discovery>
 <entry>2021-09-17</entry>
 <modified>2021-09-28</modified>
 </dates>
 </vuln>

<vuln vid="15e74795-0fd7-11ec-9f2e-dca632b19f10">
 <topic>libpano13 -- arbitrary memory access through format string vulnerability</topic>
 <affects>
 <package>
	<name>libpano13</name>
	<range><lt>2.9.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libpano13 developers reports:
	<blockquote cite="https://sourceforge.net/projects/panotools/files/libpano13/libpano13-2.9.20/README.txt">
	 Fix crash and security issue caused by malformed filename prefix
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-20307</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-20307</url>
 </references>
 <dates>
 <discovery>2021-05-04</discovery>
 <entry>2021-09-07</entry>
 </dates>
 </vuln>

<vuln vid="49c35943-0eeb-421c-af4f-78e04582e5fb">
 <topic>seatd-launch -- privilege escalation with SUID</topic>
 <affects>
 <package>
	<name>seatd</name>
	<range><ge>0.6.0</ge><lt>0.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kenny Levinsen reports:
	<blockquote cite="https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CGJ2IZQ.HCKS1J0LSI803%40kl.wtf%3E">
	 seatd-launch used execlp, which reads the PATH environment variable to
	 search for the requested executable, to execute seatd. This meant that
	 the caller could freely control what executable was loaded by adding a
	 user-writable directory to PATH.
	 If seatd-launch had the SUID bit set, this could be used by a
	 malicious user with the ability to execute seatd-launch to mount a
	 privilege escalation attack to the owner of seatd-launch, which is
	 likely root.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CGJ2IZQ.HCKS1J0LSI803%40kl.wtf%3E</url>
 <cvename>CVE-2021-41387</cvename>
 </references>
 <dates>
 <discovery>2021-09-15</discovery>
 <entry>2021-09-16</entry>
 <modified>2021-09-18</modified>
 </dates>
 </vuln>

<vuln vid="47b571f2-157b-11ec-ae98-704d7b472482">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>93.0.4577.82</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html">
	 This release includes 11 security fixes, including:
	 <ul>
	 <li>[1237533] High CVE-2021-30625: Use after free in Selection API.
	 Reported by Marcin Towalski of Cisco Talos on 2021-08-06</li>
	 <li>[1241036] High CVE-2021-30626: Out of bounds memory access in
	 ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18</li>
	 <li>[1245786] High CVE-2021-30627: Type Confusion in Blink layout.
	 Reported by Aki Helin of OUSPG on 2021-09-01</li>
	 <li>[1241123] High CVE-2021-30628: Stack buffer overflow in ANGLE.
	 Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18</li>
	 <li>[1243646] High CVE-2021-30629: Use after free in Permissions.
	 Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec
	 at Qi'anxin Group on 2021-08-26</li>
	 <li>[1244568] High CVE-2021-30630: Inappropriate implementation in
	 Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on
	 2021-08-30</li>
	 <li>[1246932] High CVE-2021-30631: Type Confusion in Blink layout.
	 Reported by Atte Kettunen of OUSPG on 2021-09-06</li>
	 <li>[1247763] High CVE-2021-30632: Out of bounds write in V8.
	 Reported by Anonymous on 2021-09-08</li>
	 <li>[1247766] High CVE-2021-30633: Use after free in Indexed DB API.
	 Reported by Anonymous on 2021-09-08</li>
	 </ul>
	 Google is aware that exploits for CVE-2021-30632 and CVE-2021-30633
	 exist in the wild.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-30625</cvename>
 <cvename>CVE-2021-30626</cvename>
 <cvename>CVE-2021-30627</cvename>
 <cvename>CVE-2021-30628</cvename>
 <cvename>CVE-2021-30629</cvename>
 <cvename>CVE-2021-30630</cvename>
 <cvename>CVE-2021-30631</cvename>
 <cvename>CVE-2021-30632</cvename>
 <cvename>CVE-2021-30633</cvename>
 <url>https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2021-09-13</discovery>
 <entry>2021-09-14</entry>
 </dates>
 </vuln>

<vuln vid="93eb0e48-14ba-11ec-875e-901b0e9408dc">
 <topic>Matrix clients -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>cinny</name>
	<range><lt>1.2.1</lt></range>
 </package>
 <package>
	<name>element-web</name>
	<range><lt>1.8.3</lt></range>
 </package>
 <package>
	<name>nheko</name>
	<range><le>0.8.2_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing">
	 Today we are disclosing a critical security issue affecting
	 multiple Matrix clients and libraries including Element
	 (Web/Desktop/Android), FluffyChat, Nheko, Cinny, and SchildiChat.
	 Specifically, in certain circumstances it may be possible to
	 trick vulnerable clients into disclosing encryption keys for
	 messages previously sent by that client to user accounts later
	 compromised by an attacker.
	 Exploiting this vulnerability to read encrypted messages requires
	 gaining control over the recipient’s account. This requires either
	 compromising their credentials directly or compromising their homeserver.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-40823</cvename>
 <cvename>CVE-2021-40824</cvename>
 <url>https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing</url>
 </references>
 <dates>
 <discovery>2021-08-23</discovery>
 <entry>2021-09-13</entry>
 </dates>
 </vuln>

<vuln vid="376df2f1-1295-11ec-859e-000c292ee6b8">
 <topic>consul -- rpc: authorize raft requests</topic>
 <affects>
 <package>
	<name>consul</name>
	<range><lt>1.10.2</lt></range>
	<range><lt>1.9.9</lt></range>
	<range><lt>1.8.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hashicorp reports:
	<blockquote cite="https://github.com/hashicorp/consul/releases/tag/v1.9.9">
	 HashiCorp Consul Raft RPC layer allows non-server agents with a
	 valid certificate signed by the same CA to access server-only
	 functionality, enabling privilege escalation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-37219</cvename>
 <url>https://github.com/hashicorp/consul/releases/tag/v1.9.9</url>
 </references>
 <dates>
 <discovery>2021-08-27</discovery>
 <entry>2021-09-11</entry>
 </dates>
 </vuln>

<vuln vid="4ea1082a-1259-11ec-b4fa-dd5a552bdd17">
 <topic>go -- archive/zip: overflow in preallocation check can cause OOM panic</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.17.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/47801">
	 An oversight in the previous fix still allows for an OOM
	 panic when the indicated directory size in the archive
	 header is so large that subtracting it from the archive
	 size overflows a uint64, effectively bypassing the check
	 that the number of files in the archive is reasonable.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-39293</cvename>
 <url>https://github.com/golang/go/issues/47801</url>
 </references>
 <dates>
 <discovery>2021-08-18</discovery>
 <entry>2021-09-10</entry>
 </dates>
 </vuln>

<vuln vid="145ce848-1165-11ec-ac7e-08002789875b">
 <topic>Python -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python38</name>
	<range><lt>3.8.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python reports:
	<blockquote cite="https://docs.python.org/3.8/whatsnew/changelog.html#changelog">
	 bpo-42278: Replaced usage of tempfile.mktemp() with TemporaryDirectory to avoid
	 a potential race condition.
	bpo-44394: Update the vendored copy of libexpat to 2.4.1 (from 2.2.8) to get the
	 fix for the CVE-2013-0340 "Billion Laughs" vulnerability. This copy is most used
	 on Windows and macOS.
	bpo-43124: Made the internal putcmd function in smtplib sanitize input for
	 presence of \r and \n characters to avoid (unlikely) command injection.
	bpo-36384: ipaddress module no longer accepts any leading zeros in IPv4 address
	 strings. Leading zeros are ambiguous and interpreted as octal notation by some
	 libraries. For example the legacy function socket.inet_aton() treats leading
	 zeros as octal notation. glibc implementation of modern inet_pton() does not
	 accept any leading zeros. For a while the ipaddress module used to accept ambiguous
	 leading zeros.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.python.org/3.8/whatsnew/changelog.html#changelog</url>
 </references>
 <dates>
 <discovery>2021-08-30</discovery>
 <entry>2021-09-09</entry>
 </dates>
 </vuln>

<vuln vid="f55921aa-10c9-11ec-8647-00e0670f2660">
 <topic>MPD5 PPPoE Server remotely exploitable crash</topic>
 <affects>
 <package>
	<name>mpd5</name>
	<range><ge>5.0</ge><lt>5.9_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Version 5.9_2 contains security fix for PPPoE servers.
	Insufficient validation of incoming PPPoE Discovery request
	specially crafted by unauthenticated user might lead to unexpected
	termination of the process. The problem affects mpd versions
	since 5.0. Installations not using PPPoE server configuration
	were not affected.
 </body>
 </description>
 <references>
	<url>http://mpd.sourceforge.net/doc5/mpd4.html#4</url>
 </references>
 <dates>
 <discovery>2021-09-04</discovery>
 <entry>2021-09-09</entry>
 </dates>
 </vuln>

<vuln vid="0e561173-0fa9-11ec-a2fa-080027948c12">
 <topic>Python -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python36</name>
	<range><lt>3.6.15</lt></range>
 </package>
 <package>
	<name>python37</name>
	<range><lt>3.7.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python reports:
	<blockquote cite="https://docs.python.org/3.6/whatsnew/changelog.html#changelog">
	 bpo-44394: Update the vendored copy of libexpat to 2.4.1 (from 2.2.8) to get the
	 fix for the CVE-2013-0340 "Billion Laughs" vulnerability. This copy is most used
	 on Windows and macOS.
	 bpo-43124: Made the internal putcmd function in smtplib sanitize input for
	 presence of \r and \n characters to avoid (unlikely) command injection.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.python.org/3.6/whatsnew/changelog.html#changelog</url>
 <url>https://docs.python.org/3.7/whatsnew/changelog.html#changelog</url>
 </references>
 <dates>
 <discovery>2021-08-30</discovery>
 <entry>2021-09-07</entry>
 </dates>
 </vuln>

<vuln vid="65f05b71-0e3c-11ec-b335-d4c9ef517024">
 <topic>WeeChat -- Crash when decoding a malformed websocket frame in relay plugin.</topic>
 <affects>
 <package>
	<name>weechat</name>
	<range><lt>3.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The WeeChat project reports:
	<blockquote cite="https://weechat.org/doc/security/">
	 Crash when decoding a malformed websocket frame in relay plugin.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://weechat.org/doc/security/</url>
 <url>https://github.com/weechat/weechat/commit/8b1331f98de1714bae15a9ca2e2b393ba49d735b</url>
 </references>
 <dates>
 <discovery>2021-09-04</discovery>
 <entry>2021-09-05</entry>
 </dates>
 </vuln>

<vuln vid="a67e358c-0bf6-11ec-875e-901b0e9408dc">
 <topic>py-matrix-synapse -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>py36-matrix-synapse</name>
	<name>py37-matrix-synapse</name>
	<name>py38-matrix-synapse</name>
	<name>py39-matrix-synapse</name>
	<name>py310-matrix-synapse</name>
	<range><lt>1.41.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://matrix.org/blog/2021/08/31/synapse-1-41-1-released">
	 This release patches two moderate severity issues which
	 could reveal metadata about private rooms:
	 <ul>
	 <li>CVE-2021-39164: Enumerating a private room's list of
	 members and their display names.</li>
	 <li>CVE-2021-39163: Disclosing a private room's name,
	 avatar, topic, and number of members.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/258187</freebsdpr>
 <cvename>CVE-2021-39164</cvename>
 <cvename>CVE-2021-39163</cvename>
 <url>https://matrix.org/blog/2021/08/31/synapse-1-41-1-released</url>
 </references>
 <dates>
 <discovery>2021-08-31</discovery>
 <entry>2021-09-02</entry>
 </dates>
 </vuln>

<vuln vid="032643d7-0ba7-11ec-a689-080027e50e6d">
 <topic>Python -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python39</name>
	<range><lt>3.9.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python reports:
	<blockquote cite="https://docs.python.org/release/3.9.7/whatsnew/changelog.html">
	 bpo-42278: Replaced usage of tempfile.mktemp() with TemporaryDirectory to avoid
	 a potential race condition.
	 bpo-41180: Add auditing events to the marshal module, and stop raising
	 code.__init__ events for every unmarshalled code object. Directly instantiated
	 code objects will continue to raise an event, and audit event handlers should
	 inspect or collect the raw marshal data. This reduces a significant performance
	 overhead when loading from .pyc files.
	 bpo-44394: Update the vendored copy of libexpat to 2.4.1 (from 2.2.8) to get the
	 fix for the CVE-2013-0340 "Billion Laughs" vulnerability. This copy is most used
	 on Windows and macOS.
	 bpo-43124: Made the internal putcmd function in smtplib sanitize input for
	 presence of \r and \n characters to avoid (unlikely) command injection.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.python.org/release/3.9.7/whatsnew/changelog.html</url>
 </references>
 <dates>
 <discovery>2021-08-30</discovery>
 <entry>2021-09-02</entry>
 </dates>
 </vuln>

<vuln vid="a7732806-0b2a-11ec-836b-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>93.0.4577.63</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/08/stable-channel-update-for-desktop_31.html">
	 This release contains 27 security fixes, including:
	 <ul>
	 <li>[1233975] High CVE-2021-30606: Use after free in Blink. Reported
	 by Nan Wang (@eternalsakura13) and koocola (@alo_cook) of 360
	 Alpha Lab on 2021-07-28</li>
	 <li>[1235949] High CVE-2021-30607: Use after free in Permissions.
	 Reported by Weipeng Jiang (@Krace) from Codesafe Team of
	 Legendsec at Qi'anxin Group on 2021-08-03</li>
	 <li>[1219870] High CVE-2021-30608: Use after free in Web Share.
	 Reported by Huyna at Viettel Cyber Security on 2021-06-15</li>
	 <li>[1239595] High CVE-2021-30609: Use after free in Sign-In.
	 Reported by raven (@raid_akame) on 2021-08-13</li>
	 <li>[1200440] High CVE-2021-30610: Use after free in Extensions API.
	 Reported by Igor Bukanov from Vivaldi on 2021-04-19</li>
	 <li>[1233942] Medium CVE-2021-30611: Use after free in WebRTC.
	 Reported by Nan Wang (@eternalsakura13) and koocola (@alo_cook) of
	 360 Alpha Lab on 2021-07-28</li>
	 <li>[1234284] Medium CVE-2021-30612: Use after free in WebRTC.
	 Reported by Nan Wang (@eternalsakura13) and koocola (@alo_cook) of
	 360 Alpha Lab on 2021-07-29</li>
	 <li>[1209622] Medium CVE-2021-30613: Use after free in Base
	 internals. Reported by Yangkang (@dnpushme) of 360 ATA on
	 2021-05-16</li>
	 <li>[1207315] Medium CVE-2021-30614: Heap buffer overflow in
	 TabStrip. Reported by Huinian Yang (@vmth6) of Amber Security Lab,
	 OPPO Mobile Telecommunications Corp. Ltd. on 2021-05-10</li>
	 <li>[1208614] Medium CVE-2021-30615: Cross-origin data leak in
	 Navigation. Reported by NDevTK on 2021-05-12</li>
	 <li>[1231432] Medium CVE-2021-30616: Use after free in Media.
	 Reported by Anonymous on 2021-07-21</li>
	 <li>[1226909] Medium CVE-2021-30617: Policy bypass in Blink.
	 Reported by NDevTK on 2021-07-07</li>
	 <li>[1232279] Medium CVE-2021-30618: Inappropriate implementation in
	 DevTools. Reported by @DanAmodio and @mattaustin from Contrast
	 Security on 2021-07-23</li>
	 <li>[1235222] Medium CVE-2021-30619: UI Spoofing in Autofill.
	 Reported by Alesandro Ortiz on 2021-08-02</li>
	 <li>[1063518] Medium CVE-2021-30620: Insufficient policy enforcement
	 in Blink. Reported by Jun Kokatsu, Microsoft Browser Vulnerability
	 Research on 2020-03-20</li>
	 <li>[1204722] Medium CVE-2021-30621: UI Spoofing in Autofill.
	 Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability
	 Research on 2021-04-30</li>
	 <li>[1224419] Medium CVE-2021-30622: Use after free in WebApp
	 Installs. Reported by Jun Kokatsu, Microsoft Browser Vulnerability
	 Research on 2021-06-28</li>
	 <li>[1223667] Low CVE-2021-30623: Use after free in Bookmarks.
	 Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2021-06-25</li>
	 <li>[1230513] Low CVE-2021-30624: Use after free in Autofill.
	 Reported by Wei Yuan of MoyunSec VLab on 2021-07-19</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-30606</cvename>
 <cvename>CVE-2021-30607</cvename>
 <cvename>CVE-2021-30608</cvename>
 <cvename>CVE-2021-30609</cvename>
 <cvename>CVE-2021-30610</cvename>
 <cvename>CVE-2021-30611</cvename>
 <cvename>CVE-2021-30612</cvename>
 <cvename>CVE-2021-30613</cvename>
 <cvename>CVE-2021-30614</cvename>
 <cvename>CVE-2021-30615</cvename>
 <cvename>CVE-2021-30616</cvename>
 <cvename>CVE-2021-30617</cvename>
 <cvename>CVE-2021-30618</cvename>
 <cvename>CVE-2021-30619</cvename>
 <cvename>CVE-2021-30620</cvename>
 <cvename>CVE-2021-30621</cvename>
 <cvename>CVE-2021-30622</cvename>
 <cvename>CVE-2021-30623</cvename>
 <cvename>CVE-2021-30624</cvename>
 <url>https://chromereleases.googleblog.com/2021/08/stable-channel-update-for-desktop_31.html</url>
 </references>
 <dates>
 <discovery>2021-08-31</discovery>
 <entry>2021-09-01</entry>
 </dates>
 </vuln>

<vuln vid="3d915d96-0b1f-11ec-8d9f-080027415d17">
 <topic>cyrus-imapd -- multiple-minute daemon hang via input that is mishandled during hash-table interaction</topic>
 <affects>
 <package>
	<name>cyrus-imapd34</name>
	<range><lt>3.4.2</lt></range>
 </package>
 <package>
	<name>cyrus-imapd32</name>
	<range><lt>3.2.8</lt></range>
 </package>
 <package>
	<name>cyrus-imapd30</name>
	<range><lt>3.0.16</lt></range>
 </package>
 <package>
	<name>cyrus-imapd25</name>
	<name>cyrus-imapd24</name>
	<name>cyrus-imapd23</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cyrus IMAP 3.4.2 Release Notes states:
	<blockquote cite="https://www.cyrusimap.org/imap/download/release-notes/3.4/x/3.4.2.html">
	 Fixed CVE-2021-33582: Certain user inputs are used as hash table keys during processing. A poorly chosen string hashing algorithm meant that the user could control which bucket their data was stored in, allowing a malicious user to direct many inputs to a single bucket. Each subsequent insertion to the same bucket requires a strcmp of every other entry in it. At tens of thousands of entries, each new insertion could keep the CPU busy in a strcmp loop for minutes.
The string hashing algorithm has been replaced with a better one, and now also uses a random seed per hash table, so malicious inputs cannot be precomputed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-33582</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33582</url>
 </references>
 <dates>
 <discovery>2021-05-26</discovery>
 <entry>2021-09-01</entry>
 </dates>
 </vuln>

<vuln vid="6c22bb39-0a9a-11ec-a265-001b217b3468">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>14.2.0</ge><lt>14.2.2</lt></range>
	<range><ge>14.1.0</ge><lt>14.1.4</lt></range>
	<range><ge>0</ge><lt>14.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/08/31/security-release-gitlab-14-2-2-released/">
	 Stored XSS in DataDog Integration
	 Invited group members continue to have project access even after invited group is deleted
	 Specially crafted requests to apollo_upload_server middleware leads to denial of service
	 Privilege escalation of an external user through project token
	 Missing access control allows non-admin users to add/remove Jira Connect Namespaces
	 User enumeration on private instances
	 Member e-mails can be revealed via project import/export feature
	 Stored XSS in Jira integration
	 Stored XSS in markdown via the Design reference
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-22257</cvename>
 <cvename>CVE-2021-22258</cvename>
 <cvename>CVE-2021-22238</cvename>
 <url>https://about.gitlab.com/releases/2021/08/31/security-release-gitlab-14-2-2-released/</url>
 </references>
 <dates>
 <discovery>2021-08-31</discovery>
 <entry>2021-08-31</entry>
 </dates>
 </vuln>

<vuln vid="1d6410e8-06c1-11ec-a35d-03ca114d16d6">
 <topic>fetchmail -- STARTTLS bypass vulnerabilities</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><lt>6.4.22.r1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem:
	<blockquote cite="https://www.fetchmail.info/fetchmail-SA-2021-02.txt">
	 In certain circumstances, fetchmail 6.4.21 and older would
	 not encrypt the session using STARTTLS/STLS, and might not have
	 cleared session state across the TLS negotiation.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-39272</cvename>
 <url>https://www.fetchmail.info/fetchmail-SA-2021-02.txt</url>
 </references>
 <dates>
 <discovery>2021-08-10</discovery>
 <entry>2021-08-26</entry>
 </dates>
 </vuln>

<vuln vid="d22b336d-0567-11ec-b69d-4062311215d5">
 <topic>FreeBSD -- libfetch out of bounds read</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.0</ge><lt>13.0_4</lt></range>
	<range><ge>12.2</ge><lt>12.2_10</lt></range>
	<range><ge>11.4</ge><lt>11.4_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The passive mode in FTP communication allows an out of boundary read while
	libfetch uses strtol to parse the relevant numbers into address bytes. It
	does not check if the line ends prematurely. If it does, the for-loop
	condition checks for *p == '\0' one byte too late because p++ was already
	performed.
	<h1>Impact:</h1>
	The connection buffer size can be controlled by a malicious FTP server
	because the size is increased until a newline is encountered (or no more
	characters are read). This also allows to move the buffer into more
	interesting areas within the address space, potentially parsing relevant
	numbers for the attacker. Since these bytes become available to the server
	in form of a new TCP connection to a constructed port number or even part of
	the IPv6 address this is a potential information leak.
 </body>
 </description>
 <references>
 <cvename>CVE-2021-36159</cvename>
 <freebsdsa>SA-21:15.libfetch</freebsdsa>
 </references>
 <dates>
 <discovery>2021-08-24</discovery>
 <entry>2021-08-25</entry>
 </dates>
 </vuln>

<vuln vid="3e9d2fde-0567-11ec-b69d-4062311215d5">
 <topic>FreeBSD -- Remote code execution in ggatec(8)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.0</ge><lt>13.0_4</lt></range>
	<range><ge>12.2</ge><lt>12.2_10</lt></range>
	<range><ge>11.4</ge><lt>11.4_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The ggatec(8) daemon does not validate the size of a response before writing
	it to a fixed-sized buffer. This allows to overwrite the stack of ggatec(8).
	<h1>Impact:</h1>
	A malicious ggated(8) or an attacker in a priviledged network position can
	overwrite the stack with crafted content and potentially execute arbitrary
	code.
 </body>
 </description>
 <references>
 <cvename>CVE-2021-29630</cvename>
 <freebsdsa>SA-21:14.ggatec</freebsdsa>
 </references>
 <dates>
 <discovery>2021-08-24</discovery>
 <entry>2021-08-25</entry>
 </dates>
 </vuln>

<vuln vid="a6d5d4c1-0564-11ec-b69d-4062311215d5">
 <topic>FreeBSD -- Missing error handling in bhyve(8) device models</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.0</ge><lt>13.0_4</lt></range>
	<range><ge>12.2</ge><lt>12.2_10</lt></range>
	<range><ge>11.4</ge><lt>11.4_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Certain VirtIO-based device models failed to handle errors when fetching
	I/O descriptors. Such errors could be triggered by a malicious guest.
	As a result, the device model code could be tricked into operating on
	uninitialized I/O vectors, leading to memory corruption.
	<h1>Impact:</h1>
	A malicious guest may be able to crash the bhyve process. It may be
	possible to exploit the memory corruption bugs to achieve arbitrary code
	execution in the bhyve process.
 </body>
 </description>
 <references>
 <cvename>CVE-2021-29631</cvename>
 <freebsdsa>SA-21:13.bhyve</freebsdsa>
 </references>
 <dates>
 <discovery>2021-08-24</discovery>
 <entry>2021-08-25</entry>
 </dates>
 </vuln>

<vuln vid="96811d4a-04ec-11ec-9b84-d4c9ef517024">
 <topic>OpenSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.1.1l,1</lt></range>
 </package>
 <package>
	<name>openssl-devel</name>
	<range><lt>3.0.0.b3</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.0</ge><lt>13.0_4</lt></range>
	<range><ge>12.2</ge><lt>12.2_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20210824.txt">
	 SM2 Decryption Buffer Overflow (CVE-2021-3711: High)
	 Read buffer overruns processing ASN.1 strings (CVE-2021-3712:
	 Moderate)
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-3711</cvename>
 <cvename>CVE-2021-3712</cvename>
 <url>https://www.openssl.org/news/secadv/20210824.txt</url>
 <freebsdsa>SA-21:16.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2021-08-24</discovery>
 <entry>2021-08-24</entry>
 <modified>2021-08-25</modified>
 </dates>
 </vuln>

<vuln vid="d3180f02-031e-11ec-875f-0800273f11ea">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.15.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.15.0:
	<blockquote cite="https://blog.gitea.io/2021/08/gitea-1.15.0-is-released/">
	 <ul>
	 <li>Encrypt LDAP bind password in db with SECRET_KEY (#15547)</li>
	 <li>Remove random password in Dockerfiles (#15362)</li>
	 <li>Upgrade to the latest version of golang-jwt and increase minimum go to 1.15 (#16590) (#16606)</li>
	 <li>Correctly create of git-daemon-export-ok files (#16508) (#16514)</li>
	 <li>Don't show private user's repo in explore view (#16550) (#16554)</li>
	 <li>Update node tar dependency to 6.1.6 (#16622) (#16623)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.15.0</url>
 <freebsdpr>ports/257994</freebsdpr>
 </references>
 <dates>
 <discovery>2021-04-29</discovery>
 <entry>2021-08-22</entry>
 </dates>
 </vuln>

<vuln vid="733afd81-01cf-11ec-aec9-0800273f11ea">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.14.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.14.6:
	<blockquote cite="https://blog.gitea.io/2021/08/gitea-1.14.6-is-released/">
	 <ul>
	 <li>Bump github.com/markbates/goth from v1.67.1 to v1.68.0 (#16538) (#16540)</li>
	 <li>Switch to maintained JWT lib (#16532) (#16535)</li>
	 <li>Upgrade to latest version of golang-jwt (as forked for 1.14) (#16590) (#16607)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.14.6</url>
 <freebsdpr>ports/257973</freebsdpr>
 </references>
 <dates>
 <discovery>2021-07-24</discovery>
 <entry>2021-08-20</entry>
 </dates>
 </vuln>

<vuln vid="70e71a24-0151-11ec-bf0c-080027eedc6a">
 <topic>bouncycastle15 -- bcrypt password checking vulnerability</topic>
 <affects>
 <package>
	<name>bouncycastle15</name>
	<range><ge>1.65</ge><lt>1.67</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Bouncy Castle team reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28052">
	 
	 The OpenBSDBCrypt.checkPassword utility method compared incorrect
	 data when checking the password, allowing incorrect passwords to
	 indicate they were matching with previously hashed ones that were
	 different.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-28052</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28052</url>
 </references>
 <dates>
 <discovery>2020-11-02</discovery>
 <entry>2021-08-20</entry>
 </dates>
 </vuln>

<vuln vid="89d5bca6-0150-11ec-bf0c-080027eedc6a">
 <topic>The Bouncy Castle Crypto APIs -- EC math vulnerability</topic>
 <affects>
 <package>
	<name>bouncycastle15</name>
	<range><lt>1.66</lt></range>
 </package>
 <package>
	<name>bouncycastle</name>
	<range><lt>1.66</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Bouncy Castle team reports::
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15522">
	 
	 Bouncy Castle BC Java before 1.66 has a timing issue within the EC
	 math library that can expose information about the private key when
	 an attacker is able to observe timing information for the generation
	 of multiple deterministic ECDSA signatures.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-15522</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15522</url>
 </references>
 <dates>
 <discovery>2020-07-04</discovery>
 <entry>2021-08-20</entry>
 </dates>
 </vuln>

<vuln vid="f4c54b81-bcc8-11eb-a7a6-080027f515ea">
 <topic>binutils -- excessive debug section size can cause excessive memory consumption in bfd's dwarf2.c read_section()</topic>
 <affects>
 <package>
	<name>binutils</name>
	<range><lt>2.33.1_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hao Wang reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3487">
	 
	 There's a flaw in the BFD library of binutils in versions before 2.36.
	 An attacker who supplies a crafted file to an application linked with BFD,
	 and using the DWARF functionality, could cause an impact to system
	 availability by way of excessive memory consumption.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-3487</cvename>
 <url>https://sourceware.org/bugzilla/show_bug.cgi?id=26946</url>
 </references>
 <dates>
 <discovery>2020-11-25</discovery>
 <entry>2021-08-13</entry>
 </dates>
 </vuln>

<vuln vid="128deba6-ff56-11eb-8514-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>92.0.4515.159</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/08/stable-channel-update-for-desktop.html">
	 This release contains 9 security fixes, including:
	 <ul>
	 <li>[1234764] High CVE-2021-30598: Type Confusion in V8. Reported by
	 Manfred Paul on 2021-07-30</li>
	 <li>[1234770] High CVE-2021-30599: Type Confusion in V8. Reported by
	 Manfred Paul on 2021-07-30</li>
	 <li>[1231134] High CVE-2021-30600: Use after free in Printing.
	 Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2021-07-20</li>
	 <li>[1234009] High CVE-2021-30601: Use after free in Extensions API.
	 Reported by koocola(@alo_cook) and Nan Wang(@eternalsakura13) of
	 360 Alpha Lab on 2021-07-28</li>
	 <li>[1230767] High CVE-2021-30602: Use after free in WebRTC.
	 Reported by Marcin Towalski of Cisco Talos on 2021-07-19</li>
	 <li>[1233564] High CVE-2021-30603: Race in WebAudio. Reported by
	 Sergei Glazunov of Google Project Zero on 2021-07-27</li>
	 <li>[1234829] High CVE-2021-30604: Use after free in ANGLE. Reported
	 by Seong-Hwan Park (SeHwa) of SecunologyLab on 2021-07-30</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-30598</cvename>
 <cvename>CVE-2021-30599</cvename>
 <cvename>CVE-2021-30600</cvename>
 <cvename>CVE-2021-30601</cvename>
 <cvename>CVE-2021-30602</cvename>
 <cvename>CVE-2021-30603</cvename>
 <cvename>CVE-2021-30604</cvename>
 <url>https://chromereleases.googleblog.com/2021/08/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2021-08-16</discovery>
 <entry>2021-08-17</entry>
 </dates>
 </vuln>

<vuln vid="e9200f8e-fd34-11eb-afb1-c85b76ce9b5a">
 <topic>lynx -- SSL certificate validation error</topic>
 <affects>
 <package>
	<name>ja-lynx</name>
	<range><lt>2.8.10</lt></range>
 </package>
 <package>
	<name>ja-lynx-current</name>
	<range><lt>2.9.0d9</lt></range>
 </package>
 <package>
	<name>lynx</name>
	<range><lt>2.8.10</lt></range>
 </package>
 <package>
	<name>lynx-current</name>
	<range><lt>2.9.0d9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Axel Beckert reports:
	<blockquote cite="https://lists.nongnu.org/archive/html/lynx-dev/2021-08/msg00002.html">
	 [...] I was able to capture the password given on the commandline in traffic
of an TLS handshake using tcpdump and analysing it with Wireshark: [...]
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.nongnu.org/archive/html/lynx-dev/2021-08/msg00002.html</url>
 </references>
 <dates>
 <discovery>2021-08-07</discovery>
 <entry>2021-08-14</entry>
 <modified>2021-08-15</modified>
 </dates>
 </vuln>

<vuln vid="b471130b-fb86-11eb-87db-6cc21735f730">
 <topic>PostgreSQL server -- Memory disclosure in certain queries</topic>
 <affects>
 <package>
	<name>postgresql13-server</name>
	<range><lt>13.4</lt></range>
 </package>
 <package>
	<name>postgresql12-server</name>
	<range><lt>12.8</lt></range>
 </package>
 <package>
	<name>postgresql11-server</name>
	<range><lt>11.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL Project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2021-3677/">
	 
	 A purpose-crafted query can read arbitrary bytes of
	 server memory. In the default configuration, any
	 authenticated database user can complete this attack at
	 will. The attack does not require the ability to create
	 objects. If server settings include
	 max_worker_processes=0, the known versions of this
	 attack are infeasible. However, undiscovered variants of
	 the attack may be independent of that setting.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-3677</cvename>
 <url>https://www.postgresql.org/support/security/CVE-2021-3677/</url>
 </references>
 <dates>
 <discovery>2021-08-12</discovery>
 <entry>2021-08-12</entry>
 </dates>
 </vuln>

<vuln vid="e80073d7-f8ba-11eb-b141-589cfc007716">
 <topic>xtrlock -- xtrlock does not block multitouch events</topic>
 <affects>
 <package>
	<name>xtrlock</name>
	<range><lt>2.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian reports:
	<blockquote cite="https://lists.debian.org/debian-lts-announce/2019/10/msg00019.html">
	 xtrlock did not block multitouch events so an attacker could still
	 input and thus control various programs such as Chromium, etc. via
	 so-called "multitouch" events including pan scrolling, "pinch and
	 zoom" or even being able to provide regular mouse clicks by
	 depressing the touchpad once and then clicking with a secondary
	 finger.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-10894</cvename>
 <url>https://lists.debian.org/debian-lts-announce/2019/10/msg00019.html</url>
 </references>
 <dates>
 <discovery>2016-07-10</discovery>
 <entry>2021-08-09</entry>
 </dates>
 </vuln>

<vuln vid="848bdd06-f93a-11eb-9f7d-206a8a720317">
 <topic>x11/cde -- Local privilege escalation via CDE dtsession</topic>
 <affects>
 <package>
	<name>cde</name>
	<range><lt>2.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marco Ivaldi (marco.ivaldi () mediaservice net) reports:
	<blockquote cite="https://seclists.org/bugtraq/2020/Jan/22">
	 A buffer overflow in the CheckMonitor() function in the Common
	 Desktop Environment 2.3.1 and earlier and 1.6 and earlier,
	 as distributed with Oracle Solaris 10 1/13 (Update 11) and
	 earlier, allows local users to gain root privileges via a long
	 palette name passed to dtsession in a malicious .Xdefaults
	 file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-2696</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2696</url>
 </references>
 <dates>
 <discovery>2020-01-15</discovery>
 <entry>2021-08-09</entry>
 </dates>
 </vuln>

<vuln vid="880552c4-f63f-11eb-9d56-7186043316e9">
 <topic>go -- net/http: panic due to racy read of persistConn after handler panic</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.16.7,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/46866">
	 A net/http/httputil ReverseProxy can panic due to a race
	 condition if its Handler aborts with ErrAbortHandler, for
	 example due to an error in copying the response body. An
	 attacker might be able to force the conditions leading to
	 the race condition.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-36221</cvename>
 <url>https://github.com/golang/go/issues/46866</url>
 </references>
 <dates>
 <discovery>2021-06-21</discovery>
 <entry>2021-08-05</entry>
 </dates>
 </vuln>

<vuln vid="1d651770-f4f5-11eb-ba49-001b217b3468">
 <topic>Gitlab -- Gitlab</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>14.1.0</ge><lt>14.1.2</lt></range>
	<range><ge>14.0.0</ge><lt>14.0.7</lt></range>
	<range><ge>0</ge><lt>13.12.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2-released/">
	 Stored XSS in Mermaid when viewing Markdown files
	 Stored XSS in default branch name
	 Perform Git actions with an impersonation token even if impersonation is disabled
	 Tag and branch name confusion allows Developer to access protected CI variables
	 New subscriptions generate OAuth tokens on an incorrect OAuth client application
	 Ability to list and delete impersonation tokens for your own user
	 Pipelines page is partially visible for users that have no right to see CI/CD
	 Improper email validation on an invite URL
	 Unauthorised user was able to add meta data upon issue creation
	 Unauthorized user can trigger deployment to a protected environment
	 Guest in private project can see CI/CD Analytics
	 Guest users can create issues for Sentry errors and track their status
	 Private user email disclosure via group invitation
	 Projects are allowed to add members with email address domain that should be blocked by group settings
	 Misleading username could lead to impersonation in using SSH Certificates
	 Unauthorized user is able to access and view project vulnerability reports
	 Denial of service in repository caused by malformed commit author
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-22237</cvename>
 <cvename>CVE-2021-22236</cvename>
 <cvename>CVE-2021-22239</cvename>
 <url>https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2-released/</url>
 </references>
 <dates>
 <discovery>2021-08-03</discovery>
 <entry>2021-08-04</entry>
 </dates>
 </vuln>

<vuln vid="5ef14250-f47c-11eb-8f13-5b4de959822e">
 <topic>Prosody -- Remote Information Disclosure</topic>
 <affects>
 <package>
	<name>prosody</name>
	<range><lt>0.11.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Prosody XMPP server advisory reports:
	<blockquote cite="https://prosody.im/security/advisory_20210722/">
	It was discovered that Prosody allows any entity to access the list of
	admins, members, owners and banned entities of any federated XMPP group chat
	of which they know the address.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-37601</cvename>
 <url>https://prosody.im/security/advisory_20210722/</url>
 </references>
 <dates>
 <discovery>2021-07-22</discovery>
 <entry>2021-08-03</entry>
 </dates>
 </vuln>

<vuln vid="c3c6c4a3-f47d-11eb-b632-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>92.0.4515.131</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/search/label/Stable%20updates">
	 This release contains 10 security fixes, including:
	 <ul>
	 <li>[1227777] High CVE-2021-30590: Heap buffer overflow in
	 Bookmarks. Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2021-07-09</li>
	 <li>[1229298] High CVE-2021-30591: Use after free in File System
	 API. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on
	 2021-07-14</li>
	 <li>[1209469] High CVE-2021-30592: Out of bounds write in Tab
	 Groups. Reported by David Erceg on 2021-05-15</li>
	 <li>[1209616] High CVE-2021-30593: Out of bounds read in Tab Strip.
	 Reported by David Erceg on 2021-05-16</li>
	 <li>[1218468] High CVE-2021-30594: Use after free in Page Info UI.
	 Reported by raven (@raid_akame) on 2021-06-10</li>
	 <li>[1214481] Medium CVE-2021-30596: Incorrect security UI in
	 Navigation. Reported by Mohit Raj (shadow2639) on 2021-05-29</li>
	 <li>[1232617] Medium CVE-2021-30597: Use after free in Browser UI.
	 Reported by raven (@raid_akame) on 2021-07-24</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-30590</cvename>
 <cvename>CVE-2021-30591</cvename>
 <cvename>CVE-2021-30592</cvename>
 <cvename>CVE-2021-30593</cvename>
 <cvename>CVE-2021-30594</cvename>
 <cvename>CVE-2021-30596</cvename>
 <cvename>CVE-2021-30597</cvename>
 <url>https://chromereleases.googleblog.com/search/label/Stable%20updates</url>
 </references>
 <dates>
 <discovery>2021-08-02</discovery>
 <entry>2021-08-03</entry>
 </dates>
 </vuln>

<vuln vid="b1aa54ae-74cb-42a0-b462-cbb6831c5c50">
 <topic>RabbitMQ -- Denial of Service in AMQP1.0 plugin</topic>
 <affects>
 <package>
	<name>rabbitmq</name>
	<range><lt>3.8.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pivotal.io reports:
	<blockquote cite="https://tanzu.vmware.com/security/cve-2021-22116">
	All versions prior to 3.8.16 are prone to a denial of
	 service vulnerability due to improper input validation
	 in AMQP 1.0 client connection endpoint.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9877</cvename>
 <url>https://tanzu.vmware.com/security/cve-2021-22116</url>
 <url>https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.19</url>
 </references>
 <dates>
 <discovery>2021-05-10</discovery>
 <entry>2021-05-10</entry>
 </dates>
 </vuln>

<vuln vid="d34bef0b-f312-11eb-b12b-fc4dd43e2b6a">
 <topic>tomcat -- HTTP request smuggling in multiple versions</topic>
 <affects>
 <package>
	<name>tomcat85</name>
	<range><ge>8.5.0</ge><le>8.5.66</le></range>
 </package>
 <package>
	<name>tomcat9</name>
	<range><ge>9.0.0</ge><le>9.0.46</le></range>
 </package>
 <package>
	<name>tomcat10</name>
	<range><ge>10.0.0</ge><le>10.0.6</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bahruz Jabiyev, Steven Sprecher and Kaan Onarlioglu of NEU seclab reports:
	<blockquote cite="https://tomcat.apache.org/security.html">
	 Apache Tomcat did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: Tomcat incorrectly ignored the transfer-encoding header if the client declared it would only accept an HTTP/1.0 response; Tomcat honoured the identify encoding; and Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-33037</cvename>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33037</url>
 </references>
 <dates>
 <discovery>2021-05-07</discovery>
 <entry>2021-08-01</entry>
 </dates>
 </vuln>

<vuln vid="8b571fb2-f311-11eb-b12b-fc4dd43e2b6a">
 <topic>tomcat -- JNDI Realm Authentication Weakness in multiple versions</topic>
 <affects>
 <package>
	<name>tomcat7</name>
	<range><ge>7.0.0</ge><le>7.0.108</le></range>
 </package>
 <package>
	<name>tomcat85</name>
	<range><ge>8.5.0</ge><le>8.5.65</le></range>
 </package>
 <package>
	<name>tomcat9</name>
	<range><ge>9.0.0</ge><le>9.0.45</le></range>
 </package>
 <package>
	<name>tomcat10</name>
	<range><ge>10.0.0</ge><le>10.0.5</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ilja.farber reports:
	<blockquote cite="https://tomcat.apache.org/security.html">
	 Queries made by the JNDI Realm did not always correctly escape parameters. Parameter values could be sourced from user provided data (eg user names) as well as configuration data provided by an administrator.
In limited circumstances it was possible for users to authenticate using variations of their user name and/or to bypass some of the protection provided by the LockOut Realm.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-30640</cvename>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30640</url>
 </references>
 <dates>
 <discovery>2021-04-08</discovery>
 <entry>2021-08-01</entry>
 </dates>
 </vuln>

<vuln vid="cc7c85d9-f30a-11eb-b12b-fc4dd43e2b6a">
 <topic>tomcat -- Remote Denial of Service in multiple versions</topic>
 <affects>
 <package>
	<name>tomcat85</name>
	<range><eq>8.5.64</eq></range>
 </package>
 <package>
	<name>tomcat9</name>
	<range><eq>9.0.44</eq></range>
 </package>
 <package>
	<name>tomcat10</name>
	<range><ge>10.0.3</ge><le>10.0.4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	rbeaudry reports:
	<blockquote cite="https://tomcat.apache.org/security.html">
	 A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS.
	 Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-30639</cvename>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30639</url>
 </references>
 <dates>
 <discovery>2021-03-24</discovery>
 <entry>2021-08-01</entry>
 </dates>
 </vuln>

<vuln vid="cbfd1874-efea-11eb-8fe9-036bd763ff35">
 <topic>fetchmail -- 6.4.19 and older denial of service or information disclosure</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><lt>6.3.9</lt></range>
	<range><ge>6.3.17</ge><lt>6.4.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="https://sourceforge.net/p/fetchmail/mailman/message/37327392/">
	 When a log message exceeds c. 2 kByte in size, for instance, with very long
	 header contents, and depending on verbosity option, fetchmail can crash or
	 misreport each first log message that requires a buffer reallocation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-36386</cvename>
 <cvename>CVE-2008-2711</cvename>
 <url>https://sourceforge.net/p/fetchmail/mailman/message/37327392/</url>
 </references>
 <dates>
 <discovery>2021-07-07</discovery>
 <entry>2021-07-28</entry>
 <modified>2021-08-03</modified>
 </dates>
 </vuln>

<vuln vid="c561ce49-eabc-11eb-9c3f-0800270512f4">
 <topic>redis -- Integer overflow issues with BITFIELD command on 32-bit systems</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><lt>6.0.15</lt></range>
 </package>
 <package>
	<name>redis-devel</name>
	<range><lt>6.2.5</lt></range>
 </package>
 <package>
	<name>redis5</name>
	<range><lt>5.0.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Huang Zhw reports:
	<blockquote cite="https://github.com/redis/redis/security/advisories/GHSA-8wxq-j7rp-g8wj">
	 
	 On 32-bit versions, Redis BITFIELD command is vulnerable to integer
	 overflow that can potentially be exploited to corrupt the heap,
	 leak arbitrary heap contents or trigger remote code execution.
	 The vulnerability involves constructing specially crafted bit
	 commands which overflow the bit offset.
	 
	 
	 This problem only affects 32-bit versions of Redis.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-32761</cvename>
 <url>https://github.com/redis/redis/security/advisories/GHSA-8wxq-j7rp-g8wj</url>
 </references>
 <dates>
 <discovery>2021-07-04</discovery>
 <entry>2021-07-27</entry>
 </dates>
 </vuln>

<vuln vid="ce79167f-ee1c-11eb-9785-b42e99a1b9c3">
 <topic>powerdns -- remotely triggered crash</topic>
 <affects>
 <package>
	<name>powerdns</name>
	<range><eq>4.5.0</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	powerdns reports:
	<blockquote cite="https://www.powerdns.com/news.html#20210726">
	 PowerDNS Security Advisory 2021-01: Specific query crashes Authoritative Server
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-36754</cvename>
 <url>https://blog.powerdns.com/2021/07/26/security-advisory-2021-01-for-powerdns-authoritative-server-4-5-0/</url>
 </references>
 <dates>
 <discovery>2021-07-26</discovery>
 <entry>2021-07-27</entry>
 </dates>
 </vuln>

<vuln vid="cc553d79-e1f0-4b94-89f2-bacad42ee826">
 <topic>mosquitto -- NULL pointer dereference</topic>
 <affects>
 <package>
	<name>mosquitto</name>
	<range><ge>2.0.0</ge><lt>2.0.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Roger Light reports:
	<blockquote cite="https://github.com/eclipse/mosquitto/blob/d5ecd9f5aa98d42e7549eea09a71a23eef241f31/ChangeLog.txt">
	 If an authenticated client connected with MQTT v5 sent
	 a malformed CONNACK message to the broker a NULL pointer
	 dereference occurred, most likely resulting in a
	 segfault.
	 (Note: a CVE is referenced in the github commit but it
	 appears to be for a python-bleach vulnerability so it is
	 not included here.)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/eclipse/mosquitto/blob/d5ecd9f5aa98d42e7549eea09a71a23eef241f31/ChangeLog.txt</url>
 </references>
 <dates>
 <discovery>2021-04-10</discovery>
 <entry>2021-07-24</entry>
 </dates>
 </vuln>

<vuln vid="92ad12b8-ec09-11eb-aef1-0897988a1c07">
 <topic>pjsip -- Race condition in SSL socket server</topic>
 <affects>
 <package>
	<name>pjsip</name>
	<range><lt>2.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	pjsip reports:
	<blockquote cite="https://github.com/pjsip/pjproject/security/advisories">
	 There are a couple of issues found in the SSL socket:
	 <ul>
	 <li>A race condition between callback and destroy, due to the accepted socket having no group lock.</li>
	 <li>SSL socket parent/listener may get destroyed during handshake.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-32686</cvename>
 <url>https://github.com/pjsip/pjproject/security/advisories/GHSA-cv8x-p47p-99wr</url>
 </references>
 <dates>
 <discovery>2021-07-23</discovery>
 <entry>2021-07-23</entry>
 </dates>
 </vuln>

<vuln vid="53fbffe6-ebf7-11eb-aef1-0897988a1c07">
 <topic>asterisk -- pjproject/pjsip: crash when SSL socket destroyed during handshake</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.38.3</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><lt>16.19.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><lt>18.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 Depending on the timing, it's possible for Asterisk to
	 crash when using a TLS connection if the underlying socket
	 parent/listener gets destroyed during the handshake.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-32686</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2021-009.html</url>
 </references>
 <dates>
 <discovery>2021-05-05</discovery>
 <entry>2021-07-23</entry>
 </dates>
 </vuln>

<vuln vid="fb3455be-ebf6-11eb-aef1-0897988a1c07">
 <topic>asterisk -- Remote crash when using IAX2 channel driver</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.38.3</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><lt>16.19.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><lt>18.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 If the IAX2 channel driver receives a packet that
	 contains an unsupported media format it can cause a crash
	 to occur in Asterisk.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-32558</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2021-008.html</url>
 </references>
 <dates>
 <discovery>2021-04-13</discovery>
 <entry>2021-07-23</entry>
 </dates>
 </vuln>

<vuln vid="ffa364e1-ebf5-11eb-aef1-0897988a1c07">
 <topic>asterisk -- Remote Crash Vulnerability in PJSIP channel driver</topic>
 <affects>
 <package>
	<name>asterisk16</name>
	<range><ge>16.17.0</ge><lt>16.19.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><ge>18.3.0</ge><lt>18.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 When Asterisk receives a re-INVITE without SDP after
	 having sent a BYE request a crash will occur. This occurs
	 due to the Asterisk channel no longer being present while
	 code assumes it is.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-31878</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2021-007.html</url>
 </references>
 <dates>
 <discovery>2021-04-06</discovery>
 <entry>2021-07-23</entry>
 </dates>
 </vuln>

<vuln vid="76487640-ea29-11eb-a686-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>92.0.4515.107</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html">
	 This release contains 35 security fixes, including:
	 <ul>
	 <li>][1210985] High CVE-2021-30565: Out of bounds write in Tab
	 Groups. Reported by David Erceg on 2021-05-19</li>
	 <li>[1202661] High CVE-2021-30566: Stack buffer overflow in
	 Printing. Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2021-04-26</li>
	 <li>[1211326] High CVE-2021-30567: Use after free in DevTools.
	 Reported by DDV_UA on 2021-05-20</li>
	 <li>[1219886] High CVE-2021-30568: Heap buffer overflow in WebGL.
	 Reported by Yangkang (@dnpushme) of 360 ATA on 2021-06-15</li>
	 <li>[1218707] High CVE-2021-30569: Use after free in sqlite.
	 Reported by Chris Salls (@salls) of Makai Security on
	 2021-06-11</li>
	 <li>[1101897] High CVE-2021-30571: Insufficient policy enforcement
	 in DevTools. Reported by David Erceg on 2020-07-03</li>
	 <li>[1214234] High CVE-2021-30572: Use after free in Autofill.
	 Reported by Weipeng Jiang (@Krace) from Codesafe Team of
	 Legendsec at Qi'anxin Group on 2021-05-28</li>
	 <li>[1216822] High CVE-2021-30573: Use after free in GPU. Reported
	 by Security For Everyone Team - https://securityforeveryone.com on
	 2021-06-06</li>
	 <li>[1227315] High CVE-2021-30574: Use after free in protocol
	 handling. Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2021-07-08</li>
	 <li>[1213313] Medium CVE-2021-30575: Out of bounds read in Autofill.
	 Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2021-05-26</li>
	 <li>[1194896] Medium CVE-2021-30576: Use after free in DevTools.
	 Reported by David Erceg on 2021-04-01</li>
	 <li>[1204811] Medium CVE-2021-30577: Insufficient policy enforcement
	 in Installer. Reported by Jan van der Put (REQON B.V) on
	 2021-05-01</li>
	 <li>[1201074] Medium CVE-2021-30578: Uninitialized Use in Media.
	 Reported by Chaoyuan Peng on 2021-04-21</li>
	 <li>[1207277] Medium CVE-2021-30579: Use after free in UI framework.
	 Reported by Weipeng Jiang (@Krace) from Codesafe Team of
	 Legendsec at Qi'anxin Group on 2021-05-10</li>
	 <li>[1189092] Medium CVE-2021-30580: Insufficient policy enforcement
	 in Android intents. Reported by @retsew0x01 on 2021-03-17</li>
	 <li>[1194431] Medium CVE-2021-30581: Use after free in DevTools.
	 Reported by David Erceg on 2021-03-31</li>
	 <li>[1205981] Medium CVE-2021-30582: Inappropriate implementation in
	 Animation. Reported by George Liu on 2021-05-05</li>
	 <li>[1179290] Medium CVE-2021-30583: Insufficient policy enforcement
	 in image handling on Windows. Reported by Muneaki Nishimura
	 (nishimunea) on 2021-02-17</li>
	 <li>[1213350] Medium CVE-2021-30584: Incorrect security UI in
	 Downloads. Reported by @retsew0x01 on 2021-05-26</li>
	 <li>[1023503] Medium CVE-2021-30585: Use after free in sensor
	 handling. Reported by niarci on 2019-11-11</li>
	 <li>[1201032] Medium CVE-2021-30586: Use after free in dialog box
	 handling on Windows. Reported by kkomdal with kkwon and neodal on
	 2021-04-21</li>
	 <li>[1204347] Medium CVE-2021-30587: Inappropriate implementation in
	 Compositing on Windows. Reported by Abdulrahman Alqabandi,
	 Microsoft Browser Vulnerability Research on 2021-04-30</li>
	 <li>[1195650] Low CVE-2021-30588: Type Confusion in V8. Reported by
	 Jose Martinez (tr0y4) from VerSprite Inc. on 2021-04-04</li>
	 <li>[1180510] Low CVE-2021-30589: Insufficient validation of
	 untrusted input in Sharing. Reported by Kirtikumar Anandrao
	 Ramchandani (@Kirtikumar_A_R) and Patrick Walker (@homesen) on
	 2021-02-20</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-30565</cvename>
 <cvename>CVE-2021-30566</cvename>
 <cvename>CVE-2021-30567</cvename>
 <cvename>CVE-2021-30568</cvename>
 <cvename>CVE-2021-30569</cvename>
 <cvename>CVE-2021-30571</cvename>
 <cvename>CVE-2021-30572</cvename>
 <cvename>CVE-2021-30573</cvename>
 <cvename>CVE-2021-30574</cvename>
 <cvename>CVE-2021-30575</cvename>
 <cvename>CVE-2021-30576</cvename>
 <cvename>CVE-2021-30577</cvename>
 <cvename>CVE-2021-30578</cvename>
 <cvename>CVE-2021-30579</cvename>
 <cvename>CVE-2021-30580</cvename>
 <cvename>CVE-2021-30581</cvename>
 <cvename>CVE-2021-30582</cvename>
 <cvename>CVE-2021-30583</cvename>
 <cvename>CVE-2021-30584</cvename>
 <cvename>CVE-2021-30585</cvename>
 <cvename>CVE-2021-30586</cvename>
 <cvename>CVE-2021-30587</cvename>
 <cvename>CVE-2021-30588</cvename>
 <cvename>CVE-2021-30589</cvename>
 <url>https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html</url>
 </references>
 <dates>
 <discovery>2021-07-20</discovery>
 <entry>2021-07-21</entry>
 </dates>
 </vuln>

<vuln vid="aa646c01-ea0d-11eb-9b84-d4c9ef517024">
 <topic>cURL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>7.78.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports:
	<blockquote cite="https://curl.se/docs/vuln-7.77.0.html">
	 CURLOPT_SSLCERT mixup with Secure Transport (CVE-2021-22926)
	 TELNET stack contents disclosure again (CVE-2021-22925)
	 Bad connection reuse due to flawed path name checks (CVE-2021-92254)
	 Metalink download sends credentials (CVE-2021-92253)
	 Wrong content via metalink not discarded (CVE-2021-92252)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-22922</cvename>
 <cvename>CVE-2021-22923</cvename>
 <cvename>CVE-2021-22924</cvename>
 <cvename>CVE-2021-22925</cvename>
 <cvename>CVE-2021-22926</cvename>
 <url>https://curl.se/docs/vuln-7.77.0.html</url>
 </references>
 <dates>
 <discovery>2021-07-21</discovery>
 <entry>2021-07-21</entry>
 </dates>
 </vuln>

<vuln vid="38a4a043-e937-11eb-9b84-d4c9ef517024">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.35</lt></range>
 </package>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.26</lt></range>
 </package>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.31</lt></range>
 </package>
 <package>
	<name>mariadb104-server</name>
	<range><lt>10.4.21</lt></range>
 </package>
 <package>
	<name>mariadb105-server</name>
	<range><lt>10.5.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujul2021.html">
	 This Critical Patch Update contains 41 new security patches for
	 Oracle MySQL. 10 of these vulnerabilities may be remotely exploitable
	 without authentication, i.e., may be exploited over a network without
	 requiring user credentials. 
	 The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
	 MySQL is 8.8.
	 MariaDB is affected by CVE-2021-2372 and CVE-2021-2389 only.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/security-alerts/cpujul2021.html</url>
 <cvename>CVE-2019-17543</cvename>
 <cvename>CVE-2021-2339</cvename>
 <cvename>CVE-2021-2340</cvename>
 <cvename>CVE-2021-2342</cvename>
 <cvename>CVE-2021-2352</cvename>
 <cvename>CVE-2021-2354</cvename>
 <cvename>CVE-2021-2356</cvename>
 <cvename>CVE-2021-2357</cvename>
 <cvename>CVE-2021-2367</cvename>
 <cvename>CVE-2021-2370</cvename>
 <cvename>CVE-2021-2372</cvename>
 <cvename>CVE-2021-2374</cvename>
 <cvename>CVE-2021-2383</cvename>
 <cvename>CVE-2021-2384</cvename>
 <cvename>CVE-2021-2385</cvename>
 <cvename>CVE-2021-2387</cvename>
 <cvename>CVE-2021-2389</cvename>
 <cvename>CVE-2021-2390</cvename>
 <cvename>CVE-2021-2399</cvename>
 <cvename>CVE-2021-2402</cvename>
 <cvename>CVE-2021-2410</cvename>
 <cvename>CVE-2021-2411</cvename>
 <cvename>CVE-2021-2412</cvename>
 <cvename>CVE-2021-2417</cvename>
 <cvename>CVE-2021-2418</cvename>
 <cvename>CVE-2021-2422</cvename>
 <cvename>CVE-2021-2424</cvename>
 <cvename>CVE-2021-2425</cvename>
 <cvename>CVE-2021-2426</cvename>
 <cvename>CVE-2021-2427</cvename>
 <cvename>CVE-2021-2429</cvename>
 <cvename>CVE-2021-2437</cvename>
 <cvename>CVE-2021-2440</cvename>
 <cvename>CVE-2021-2441</cvename>
 <cvename>CVE-2021-2444</cvename>
 <cvename>CVE-2021-3450</cvename>
 <cvename>CVE-2021-22884</cvename>
 <cvename>CVE-2021-22901</cvename>
 </references>
 <dates>
 <discovery>2021-07-20</discovery>
 <entry>2021-07-20</entry>
 <modified>2021-08-04</modified>
 </dates>
 </vuln>

<vuln vid="943d23b6-e65e-11eb-ad30-0800273f11ea">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.14.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.14.5:
	<blockquote cite="https://blog.gitea.io/2021/07/gitea-1.14.5-is-released/">
	 <ul>
	 <li>Hide mirror passwords on repo settings page (#16022) (#16355)</li>
	 <li>Update bluemonday to v1.0.15 (#16379) (#16380)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.14.5</url>
 <freebsdpr>ports/257221</freebsdpr>
 </references>
 <dates>
 <discovery>2021-05-16</discovery>
 <entry>2021-07-18</entry>
 </dates>
 </vuln>

<vuln vid="1ba21ff1-e672-11eb-a686-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>91.0.4472.164</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop.html">
	 This release contains 8 security fixes, including:
	 <ul>
	 <li>[1219082] High CVE-2021-30559: Out of bounds write in ANGLE.
	 Reported by Seong-Hwan Park (SeHwa) of SecunologyLab on
	 2021-06-11</li>
	 <li>[1214842] High CVE-2021-30541: Use after free in V8. Reported by
	 Richard Wheeldon on 2021-05-31</li>
	 <li>[1219209] High CVE-2021-30560: Use after free in Blink XSLT.
	 Reported by Nick Wellnhofer on 2021-06-12</li>
	 <li>[1219630] High CVE-2021-30561: Type Confusion in V8. Reported by
	 Sergei Glazunov of Google Project Zero on 2021-06-14</li>
	 <li>[1220078] High CVE-2021-30562: Use after free in WebSerial.
	 Reported by Anonymous on 2021-06-15</li>
	 <li>[1228407] High CVE-2021-30563: Type Confusion in V8. Reported by
	 Anonymous on 2021-07-12</li>
	 <li>[1221309] Medium CVE-2021-30564: Heap buffer overflow in WebXR.
	 Reported by Ali Merchant, iQ3Connect VR Platform on
	 2021-06-17</li>
	 </ul>
	 Google is aware of reports that an exploit for CVE-2021-30563 exists in the wild.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-30541</cvename>
 <cvename>CVE-2021-30559</cvename>
 <cvename>CVE-2021-30560</cvename>
 <cvename>CVE-2021-30561</cvename>
 <cvename>CVE-2021-30562</cvename>
 <cvename>CVE-2021-30563</cvename>
 <cvename>CVE-2021-30564</cvename>
 <url>https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2021-07-15</discovery>
 <entry>2021-07-16</entry>
 </dates>
 </vuln>

<vuln vid="7ed5779c-e4c7-11eb-91d7-08002728f74c">
 <topic>Ruby -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ruby26</name>
	<range><lt>2.6.8,1</lt></range>
 </package>
 <package>
	<name>ruby</name>
	<range><lt>2.7.4,1</lt></range>
 </package>
 <package>
	<name>ruby30</name>
	<range><lt>3.0.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby news:
	<blockquote cite="https://www.ruby-lang.org/en/news/2021/07/07/ruby-3-0-2-released/">
	 This release includes security fixes. Please check the topics below for details.
	 CVE-2021-31810: Trusting FTP PASV responses vulnerability in Net::FTP
	 CVE-2021-32066: A StartTLS stripping vulnerability in Net::IMAP
	 CVE-2021-31799: A command injection vulnerability in RDoc
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-31799</cvename>
 <cvename>CVE-2021-31810</cvename>
 <cvename>CVE-2021-32066</cvename>
 <url>https://www.ruby-lang.org/en/news/2021/07/07/ruby-2-6-8-released/</url>
 <url>https://www.ruby-lang.org/en/news/2021/07/07/ruby-2-7-4-released/</url>
 <url>https://www.ruby-lang.org/en/news/2021/07/07/ruby-3-0-2-released/</url>
 <url>https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/</url>
 <url>https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/</url>
 <url>https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/</url>
 </references>
 <dates>
 <discovery>2021-07-07</discovery>
 <entry>2021-07-14</entry>
 </dates>
 </vuln>

<vuln vid="c365536d-e3cf-11eb-9d8d-b37b683944c2">
 <topic>go -- crypto/tls: clients can panic when provided a certificate of the wrong type for the negotiated parameters</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.16.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/47143">
		crypto/tls clients can panic when provided a certificate of
		 the wrong type for the negotiated parameters. net/http clients
		 performing HTTPS requests are also affected. The panic can be
		 triggered by an attacker in a privileged network position
		 without access to the server certificate's private key, as
		 long as a trusted ECDSA or Ed25519 certificate for the server
		 exists (or can be issued), or the client is configured with
		 Config.InsecureSkipVerify. Clients that disable all TLS_RSA
		 cipher suites (that is, TLS 1.0–1.2 cipher suites without
		 ECDHE), as well as TLS 1.3-only clients, are unaffected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-34558</cvename>
 <url>https://github.com/golang/go/issues/47143</url>
 </references>
 <dates>
 <discovery>2021-07-07</discovery>
 <entry>2021-07-12</entry>
 </dates>
 </vuln>

<vuln vid="9b1699ff-d84c-11eb-92d6-1b6ff3dfe4d3">
 <topic>mantis -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mantis-php73</name>
	<name>mantis-php74</name>
	<name>mantis-php80</name>
	<range><lt>2.25.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mantis 2.25.1 and 2.25.2 releases report:
	<blockquote cite="https://mantisbt.org/bugs/changelog_page.php?version_id=362">
	 Security and maintenance release, PHPMailer update to 6.5.0
	 <ul>
	 <li>0028552: XSS in manage_custom_field_edit_page.php (CVE-2021-33557)</li>
	 <li>0028821: Update PHPMailer to 6.5.0 (CVE-2021-3603, CVE-2020-36326)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-33557</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-33557</url>
 <cvename>CVE-2021-3603</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-3603</url>
 <cvename>CVE-2020-36326</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-36326</url>
 </references>
 <dates>
 <discovery>2021-04-28</discovery>
 <entry>2021-07-09</entry>
 </dates>
 </vuln>

<vuln vid="01974420-dfaf-11eb-ba49-001b217b3468">
 <topic>Gitlab -- vulnerability</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>14.0.0</ge><lt>14.0.4</lt></range>
	<range><ge>13.12.0</ge><lt>13.12.8</lt></range>
	<range><ge>13.11.0</ge><lt>13.11.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/07/07/critical-security-release-gitlab-14-0-4-released/">
	 Arbitrary file read via design feature
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2021/07/07/critical-security-release-gitlab-14-0-4-released/</url>
 </references>
 <dates>
 <discovery>2021-07-07</discovery>
 <entry>2021-07-08</entry>
 </dates>
 </vuln>

<vuln vid="d49f86ab-d9c7-11eb-a200-00155d01f201">
 <topic>Exiv2 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>exiv2</name>
	<range><lt>0.27.4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Exiv2 teams reports:
	<blockquote cite="https://github.com/Exiv2/exiv2/security/advisories">
	 Multiple vulnerabilities covering buffer overflows, out-of-bounds,
	 read of uninitialized memory and denial of serivce. The heap
	 overflow is triggered when Exiv2 is used to read the metadata of
	 a crafted image file. An attacker could potentially exploit the
	 vulnerability to gain code execution, if they can trick the victim
	 into running Exiv2 on a crafted image file. The out-of-bounds read
	 is triggered when Exiv2 is used to write metadata into a crafted
	 image file. An attacker could potentially exploit the vulnerability
	 to cause a denial of service by crashing Exiv2, if they can trick
	 the victim into running Exiv2 on a crafted image file. The read of
	 uninitialized memory is triggered when Exiv2 is used to read the
	 metadata of a crafted image file. An attacker could potentially
	 exploit the vulnerability to leak a few bytes of stack memory, if
	 they can trick the victim into running Exiv2 on a crafted image
	 file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-29457</cvename>
 <url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-v74w-h496-cgqm</url>
 <cvename>CVE-2021-29458</cvename>
 <url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-57jj-75fm-9rq5</url>
 <cvename>CVE-2021-29463</cvename>
 <url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-5p8g-9xf3-gfrr</url>
 <cvename>CVE-2021-29464</cvename>
 <url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-jgm9-5fw5-pw9p</url>
 <cvename>CVE-2021-29470</cvename>
 <url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj</url>
 <cvename>CVE-2021-29473</cvename>
 <url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-7569-phvm-vwc2</url>
 <cvename>CVE-2021-29623</cvename>
 <url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-6253-qjwm-3q4v</url>
 <cvename>CVE-2021-32617</cvename>
 <url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-w8mv-g8qq-36mj</url>
 <cvename>CVE-2021-3482</cvename>
 <url>https://github.com/Exiv2/exiv2/security/advisories/GHSA-9jp9-m3fv-2vg9</url>
 </references>
 <dates>
 <discovery>2021-04-25</discovery>
 <entry>2021-06-30</entry>
 </dates>
 </vuln>

<vuln vid="f2596f27-db4c-11eb-8bc6-c556d71493c9">
 <topic>openexr v3.0.5 -- fixes miscellaneous security issues</topic>
 <affects>
 <package>
	<name>openexr</name>
	<range><lt>3.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cary Phillips reports:
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.0.5">
	 <ul>
	 <li>1038 fix/extend part number validation in MultiPart methods</li>
	 <li>1037 verify data size in deepscanlines with NO_COMPRESSION</li>
	 <li>1036 detect buffer overflows in RleUncompress</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.0.5</url>
 </references>
 <dates>
 <discovery>2021-06-03</discovery>
 <entry>2021-07-02</entry>
 </dates>
 </vuln>

<vuln vid="8ba8278d-db06-11eb-ba49-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>14.0.0</ge><lt>14.0.2</lt></range>
	<range><ge>13.12.0</ge><lt>13.12.6</lt></range>
	<range><ge>8.0.0</ge><lt>13.11.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/07/01/security-release-gitlab-14-0-2-released/">
	 DoS using Webhook connections
	 CSRF on GraphQL API allows executing mutations through GET requests
	 Private projects information disclosure
	 Denial of service of user profile page
	 Single sign-on users not getting blocked
	 Some users can push to Protected Branch with Deploy keys
	 A deactivated user can access data through GraphQL
	 Reflected XSS in release edit page
	 Clipboard DOM-based XSS
	 Stored XSS on Audit Log
	 Forks of public projects by project members could leak codebase
	 Improper text rendering
	 HTML Injection in full name field
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2021/07/01/security-release-gitlab-14-0-2-released/</url>
 </references>
 <dates>
 <discovery>2021-07-01</discovery>
 <entry>2021-07-02</entry>
 </dates>
 </vuln>

<vuln vid="9d271bab-da22-11eb-86f0-94c691a700a6">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.300</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.289.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2021-06-30/">
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-2278 / CVE-2021-21670</h5>
	 Improper permission checks allow canceling queue items and aborting builds
	 <h5>(High) SECURITY-2371 / CVE-2021-21671</h5>
	 Session fixation vulnerability
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-21670</cvename>
 <cvename>CVE-2021-21671</cvename>
 <url>https://www.jenkins.io/security/advisory/2021-06-30/</url>
 </references>
 <dates>
 <discovery>2021-06-30</discovery>
 <entry>2021-07-01</entry>
 </dates>
 </vuln>

<vuln vid="7003b62d-7252-46ff-a9df-1b1900f1e65b">
 <topic>RabbitMQ -- Denial of Service via improper input validation</topic>
 <affects>
 <package>
	<name>rabbitmq</name>
	<range><lt>3.8.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jonathon Knudsen of Synopsys Cybersecurity Research Center reports:
	<blockquote cite="https://tanzu.vmware.com/security/cve-2021-22116">
 All versions prior to 3.8.16 are prone to a denial of service
	 vulnerability due to improper input validation in AMQP 1.0 client
	 connection endpoint. A malicious client can exploit the vulnerability
	 by sending malicious AMQP messages to the target RabbitMQ instance
	 having the AMQP 1.0 plugin enabled.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-22116</cvename>
 <url>https://tanzu.vmware.com/security/cve-2021-22116</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22116</url>
 </references>
 <dates>
 <discovery>2021-05-10</discovery>
 <entry>2021-06-28</entry>
 </dates>
 </vuln>

<vuln vid="7c555ce3-658d-4589-83dd-4b6a31c5d610">
 <topic>RabbitMQ-C -- integer overflow leads to heap corruption</topic>
 <affects>
 <package>
	<name>rabbitmq-c</name>
	<name>rabbitmq-c-devel</name>
	<range><lt>0.10.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	alanxz reports:
	<blockquote cite="https://github.com/alanxz/rabbitmq-c/commit/fc85be7123050b91b054e45b91c78d3241a5047a">
	 When parsing a frame header, validate that the frame_size is less than
	or equal to INT32_MAX. Given frame_max is limited between 0 and
	INT32_MAX in amqp_login and friends, this does not change the API.
	This prevents a potential buffer overflow when a malicious client sends
	a frame_size that is close to UINT32_MAX, in which causes an overflow
	when computing state-&gt;target_size resulting in a small value there. A
	buffer is then allocated with the small amount, then memcopy copies the
	frame_size writing to memory beyond the end of the buffer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-18609</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18609</url>
 </references>
 <dates>
 <discovery>2019-10-29</discovery>
 <entry>2021-06-25</entry>
 </dates>
</vuln>

<vuln vid="41bc849f-d5ef-11eb-ae37-589cfc007716">
 <topic>PuppetDB -- SQL Injection</topic>
 <affects>
 <package>
 <name>puppetdb6</name>
 <range><lt>6.17.0</lt></range>
 </package>
 <package>
 <name>puppetdb7</name>
 <range><lt>7.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Puppet reports:
 <blockquote cite="https://puppet.com/docs/puppetdb/latest/release_notes.html#security-fixes">
	Fixed an issue where someone with the ability to query PuppetDB
	 could arbitrarily write, update, or delete data CVE-2021-27021
	 PDB-5138.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-27021</cvename>
 <url>https://puppet.com/security/cve/cve-2021-27021/</url>
 <url>https://tickets.puppetlabs.com/browse/PDB-5138</url>
 </references>
 <dates>
 <discovery>2021-06-24</discovery>
 <entry>2021-06-25</entry>
 </dates>
 </vuln>

<vuln vid="4c9159ea-d4c9-11eb-aeee-8c164582fbac">
 <topic>Ansible -- Templating engine bug</topic>
 <affects>
 <package>
	<name>py36-ansible-core</name>
	<name>py37-ansible-core</name>
	<name>py38-ansible-core</name>
	<name>py39-ansible-core</name>
	<range><lt>2.11.2</lt></range>
 </package>
 <package>
	<name>py36-ansible-base</name>
	<name>py37-ansible-base</name>
	<name>py38-ansible-base</name>
	<name>py39-ansible-base</name>
	<range><lt>2.10.11</lt></range>
 </package>
 <package>
	<name>py36-ansible2</name>
	<name>py37-ansible2</name>
	<name>py38-ansible2</name>
	<name>py39-ansible2</name>
	<range><lt>2.9.23</lt></range>
 </package>
 <package>
	<name>py36-ansible</name>
	<name>py37-ansible</name>
	<name>py38-ansible</name>
	<name>py39-ansible</name>
	<range><lt>2.9.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ansible developers report:
	<blockquote cite="https://github.com/ansible/ansible/blob/stable-2.11/changelogs/CHANGELOG-v2.11.rst#security-fixes">
	 Templating engine fix for not preserving usnafe status
	 when trying to preserve newlines.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-3583</cvename>
 <url>https://github.com/ansible/ansible/blob/stable-2.11/changelogs/CHANGELOG-v2.11.rst#security-fixes</url>
 <url>https://github.com/ansible/ansible/blob/stable-2.10/changelogs/CHANGELOG-v2.10.rst#security-fixes</url>
 <url>https://github.com/ansible/ansible/pull/74960</url>
 <url>https://groups.google.com/g/ansible-announce/c/tmIgD1DpZJg</url>
 </references>
 <dates>
 <discovery>2021-06-10</discovery>
 <entry>2021-06-24</entry>
 <modified>2021-06-25</modified>
 </dates>
 </vuln>

<vuln vid="f3fc2b50-d36a-11eb-a32c-00a0989e4ec1">
 <topic>dovecot-pigeonhole -- Sieve excessive resource usage</topic>
 <affects>
 <package>
	<name>dovecot-pigeonhole</name>
	<range><lt>0.5.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dovecot team reports reports:
	<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2021-June/000460.html">
	 Sieve interpreter is not protected against abusive
	 scripts that claim excessive resource usage. Fixed by limiting the
	 user CPU time per single script execution and cumulatively over
	 several script runs within a configurable timeout period. Sufficiently
	 large CPU time usage is summed in the Sieve script binary and execution
	 is blocked when the sum exceeds the limit within that time. The block
	 is lifted when the script is updated after the resource usage times out.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-28200</cvename>
 <url>https://dovecot.org/pipermail/dovecot-news/2021-June/000460.html</url>
 </references>
 <dates>
 <discovery>2020-09-23</discovery>
 <entry>2021-06-22</entry>
 </dates>
 </vuln>

<vuln vid="d18f431d-d360-11eb-a32c-00a0989e4ec1">
 <topic>dovecot -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><ge>2.3.11</ge><lt>2.3.14.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dovecot team reports:
	<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2021-June/000461.html">
	 CVE-2021-29157: Dovecot does not correctly escape kid and azp
	 fields in JWT tokens.
	 This may be used to supply attacker controlled keys to validate
	 tokens in some configurations. This requires attacker
	 to be able to write files to
	 local disk.
	</blockquote>
	<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2021-June/000462.html">
	 CVE-2021-33515: On-path attacker could inject plaintext commands
	 before STARTTLS negotiation that would be executed after STARTTLS
	 finished with the client. Only the SMTP submission service is
	 affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-29157</cvename>
 <url>https://dovecot.org/pipermail/dovecot-news/2021-June/000461.html</url>
 <cvename>CVE-2021-33515</cvename>
 <url>https://dovecot.org/pipermail/dovecot-news/2021-June/000462.html</url>
 </references>
 <dates>
 <discovery>2021-03-22</discovery>
 <entry>2021-06-22</entry>
 </dates>
 </vuln>

<vuln vid="0e561c06-d13a-11eb-92be-0800273f11ea">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.14.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.14.3:
	<blockquote cite="https://blog.gitea.io/2021/06/gitea-1.14.3-is-released/">
	 <ul>
	 <li>Encrypt migration credentials at rest (#15895) (#16187)</li>
	 <li>Only check access tokens if they are likely to be tokens
	 (#16164) (#16171)</li>
	 <li>Add missing SameSite settings for the i_like_gitea cookie
	 (#16037) (#16039)</li>
	 <li>Fix setting of SameSite on cookies (#15989) (#15991)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.14.3</url>
 <freebsdpr>ports/256720</freebsdpr>
 </references>
 <dates>
 <discovery>2021-05-16</discovery>
 <entry>2021-06-19</entry>
 </dates>
 </vuln>

<vuln vid="afdc7579-d023-11eb-bcad-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>91.0.4472.114</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop_17.html">
	 This release includes 4 security fixes, including:
	 <ul>
	 <li>[1219857] High CVE-2021-30554: Use after free in WebGL. Reported
	 by anonymous on 2021-06-15</li>
	 <li>[1215029] High CVE-2021-30555: Use after free in Sharing.
	 Reported by David Erceg on 2021-06-01</li>
	 <li>[1212599] High CVE-2021-30556: Use after free in WebAudio.
	 Reported by Yangkang (@dnpushme) of 360 ATA on 2021-05-24</li>
	 <li>[1202102] High CVE-2021-30557: Use after free in TabGroups.
	 Reported by David Erceg on 2021-04-23</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-30554</cvename>
 <cvename>CVE-2021-30555</cvename>
 <cvename>CVE-2021-30556</cvename>
 <cvename>CVE-2021-30557</cvename>
 <url>https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop_17.html</url>
 </references>
 <dates>
 <discovery>2021-06-17</discovery>
 <entry>2021-06-18</entry>
 </dates>
 </vuln>

<vuln vid="9f27ac74-cdee-11eb-930d-fc4dd43e2b6a">
 <topic>ircII -- denial of service</topic>
 <affects>
 <package>
	<name>ircii</name>
	<range><lt>20210314</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michael Ortmann reports:
	<blockquote cite="https://www.openwall.com/lists/oss-security/2021/03/24/2">
	 ircii has a bug in parsing CTCP UTC messages.
	 Its unknown if this could also be used for arbitrary code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-29376</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29376</url>
 </references>
 <dates>
 <discovery>2021-03-02</discovery>
 <entry>2021-03-30</entry>
 </dates>
 </vuln>

<vuln vid="cce76eca-ca16-11eb-9b84-d4c9ef517024">
 <topic>Apache httpd -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.48</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd reports:
	<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
	 <ul>
	 <li>moderate: mod_proxy_wstunnel tunneling of non Upgraded
	 connections (CVE-2019-17567)</li>
	 <li>moderate: Improper Handling of Insufficient Privileges
	 (CVE-2020-13938)</li>
	 <li>low: mod_proxy_http NULL pointer dereference
	 (CVE-2020-13950)</li>
	 <li>low: mod_auth_digest possible stack overflow by one nul byte
	 (CVE-2020-35452)</li>
	 <li>low: mod_session NULL pointer dereference (CVE-2021-26690)</li>
	 <li>low: mod_session response handling heap overflow (CVE-2021-26691)</li>
	 <li>moderate: Unexpected URL matching with 'MergeSlashes OFF'
	 (CVE-2021-30641)</li>
	 <li>important: NULL pointer dereference on specially crafted HTTP/2
	 request (CVE-2021-31618)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-17567</cvename>
 <cvename>CVE-2020-13938</cvename>
 <cvename>CVE-2020-13950</cvename>
 <cvename>CVE-2020-35452</cvename>
 <cvename>CVE-2021-26690</cvename>
 <cvename>CVE-2021-26691</cvename>
 <cvename>CVE-2021-30641</cvename>
 <cvename>CVE-2021-31618</cvename>
 <url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
 </references>
 <dates>
 <discovery>2021-06-09</discovery>
 <entry>2021-06-10</entry>
 </dates>
 </vuln>

<vuln vid="c9e2a1a7-caa1-11eb-904f-14dae9d5a9d2">
 <topic>dragonfly -- argument injection</topic>
 <affects>
 <package>
	<name>rubygem-dragonfly</name>
	<range><lt>2.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2021-33564">
	 An argument injection vulnerability in the Dragonfly
	 gem before 1.4.0 for Ruby allows remote attackers to read
	 and write to arbitrary files via a crafted URL when the
	 verify_url option is disabled. This may lead to code
	 execution. The problem occurs because the generate and
	 process features mishandle use of the ImageMagick convert
	 utility.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-33564</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-33564</url>
 <url>https://github.com/mlr0p/CVE-2021-33564</url>
 <url>https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33564</url>
 </references>
 <dates>
 <discovery>2021-05-24</discovery>
 <entry>2021-06-11</entry>
 </dates>
 </vuln>

<vuln vid="e4cd0b38-c9f9-11eb-87e1-08002750c711">
 <topic>cacti -- SQL Injection was possible due to incorrect validation order</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><ge>1.2</ge><lt>1.2.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cati team reports:
	<blockquote cite="https://github.com/Cacti/cacti/issues/4022">
	 Due to a lack of validation, data_debug.php can be the source of a SQL injection.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-35701</cvename>
 <url>https://github.com/Cacti/cacti/issues/4022</url>
 </references>
 <dates>
 <discovery>2020-12-24</discovery>
 <entry>2021-06-10</entry>
 <modified>2021-06-24</modified>
 </dates>
 </vuln>

<vuln vid="20b3ab21-c9df-11eb-8558-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>91.0.4472.101</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop.html">
	 This release contains 14 security fixes, including:
	 <ul>
	 <li>[1212618] Critical CVE-2021-30544: Use after free in BFCache.
	 Reported by Rong Jian and Guang Gong of 360 Alpha Lab on
	 2021-05-24</li>
	 <li>[1201031] High CVE-2021-30545: Use after free in Extensions.
	 Reported by kkwon with everpall and kkomdal on 2021-04-21</li>
	 <li>[1206911] High CVE-2021-30546: Use after free in Autofill.
	 Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability
	 Research on 2021-05-08</li>
	 <li>[1210414] High CVE-2021-30547: Out of bounds write in ANGLE.
	 Reported by Seong-Hwan Park (SeHwa) of SecunologyLab on
	 2021-05-18</li>
	 <li>[1210487] High CVE-2021-30548: Use after free in Loader.
	 Reported by Yangkang(@dnpushme) &amp; Wanglu of Qihoo360 Qex Team
	 on 2021-05-18</li>
	 <li>[1212498] High CVE-2021-30549: Use after free in Spell check.
	 Reported by David Erceg on 2021-05-23</li>
	 <li>[1212500] High CVE-2021-30550: Use after free in Accessibility.
	 Reported by David Erceg on 2021-05-23</li>
	 <li>[1216437] High CVE-2021-30551: Type Confusion in V8. Reported by
	 Sergei Glazunov of Google Project Zero on 2021-06-04</li>
	 <li>[1200679] Medium CVE-2021-30552: Use after free in Extensions.
	 Reported by David Erceg on 2021-04-20</li>
	 <li>[1209769] Medium CVE-2021-30553: Use after free in Network
	 service. Reported by Anonymous on 2021-05-17</li>
	 </ul>
	 Google is aware that an exploit for CVE-2021-30551 exists in the
	 wild.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-30544</cvename>
 <cvename>CVE-2021-30545</cvename>
 <cvename>CVE-2021-30546</cvename>
 <cvename>CVE-2021-30547</cvename>
 <cvename>CVE-2021-30548</cvename>
 <cvename>CVE-2021-30549</cvename>
 <cvename>CVE-2021-30550</cvename>
 <cvename>CVE-2021-30551</cvename>
 <cvename>CVE-2021-30552</cvename>
 <cvename>CVE-2021-30553</cvename>
 <url>https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2021-06-10</discovery>
 <entry>2021-06-10</entry>
 </dates>
 </vuln>

<vuln vid="fc1bcbca-c88b-11eb-9120-f02f74d0e4bd">
 <topic>dino -- Path traversal in Dino file transfers</topic>
 <affects>
 <package>
	<name>dino</name>
	<range><lt>0.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dino team reports:
	<blockquote cite="https://dino.im/security/cve-2021-33896/">
	 It was discovered that when a user receives and downloads
	 a file in Dino, URI-encoded path separators in the file name
	 will be decoded, allowing an attacker to traverse
	 directories and create arbitrary files in the context of the
	 user.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-33896</cvename>
 <mlist msgid="392f934a-f937-7b29-5f7f-5df3ee60d8a8@.larma.de">https://marc.info/?l=oss-security&amp;m=162308719412719</mlist>
 <url>https://dino.im/security/cve-2021-33896/</url>
 </references>
 <dates>
 <discovery>2021-06-07</discovery>
 <entry>2021-06-08</entry>
 </dates>
 </vuln>

<vuln vid="45b8716b-c707-11eb-b9a0-6805ca0b3d42">
 <topic>pglogical -- shell command injection in pglogical.create_subscription()</topic>
 <affects>
 <package>
	<name>pglogical</name>
	<range><lt>2.3.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	2ndQuadrant reports:
	<blockquote cite="https://github.com/2ndQuadrant/pglogical/releases/tag/REL2_3_4">
	 <ul>
	 <li>
	 Fix pg_dump/pg_restore execution (CVE-2021-3515) 
	 
	 Correctly escape the connection string for both pg_dump
	 and pg_restore so that exotic database and user names are
	 handled correctly. 
	 
	 Reported by Pedro Gallegos
	 </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-3515</cvename>
 <url>https://github.com/2ndQuadrant/pglogical/releases/tag/REL2_3_4</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1954112</url>
 </references>
 <dates>
 <discovery>2021-06-01</discovery>
 <entry>2021-06-06</entry>
 </dates>
 </vuln>

<vuln vid="f70ab05e-be06-11eb-b983-000c294bb613">
 <topic>drupal7 -- fix possible CSS</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><gt>7.0</gt><lt>7.80</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security team reports:
	<blockquote cite="https://www.drupal.org/sa-core-2021-002">
	 Drupal core's sanitization API fails to properly filter
		cross-site scripting under certain circumstances.
		Not all sites and users are affected, but configuration
		changes to prevent the exploit might be impractical
		and will vary between sites. Therefore, we recommend
		all sites update to this release as soon as
		possible.
	 
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2020-13672</cvename>
 </references>
 <dates>
 <discovery>2021-04-21</discovery>
 <entry>2021-06-06</entry>
 </dates>
 </vuln>

<vuln vid="36a35d83-c560-11eb-84ab-e0d55e2a8bf9">
 <topic>polkit -- local privilege escalation using polkit_system_bus_name_get_creds_sync</topic>
 <affects>
 <package>
	<name>polkit</name>
	<range><lt>0.119</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cedric Buissart reports:
	<blockquote cite="https://seclists.org/oss-sec/2021/q2/180">
	 The function <code>polkit_system_bus_name_get_creds_sync</code> is used to get the
	 uid and pid of the process requesting the action. It does this by
	 sending the unique bus name of the requesting process, which is
	 typically something like ":1.96", to <code>dbus-daemon</code>. These unique names
	 are assigned and managed by <code>dbus-daemon</code> and cannot be forged, so this
	 is a good way to check the privileges of the requesting process.
	 The vulnerability happens when the requesting process disconnects from
	 <code>dbus-daemon</code> just before the call to
	 <code>polkit_system_bus_name_get_creds_sync</code> starts. In this scenario, the
	 unique bus name is no longer valid, so <code>dbus-daemon</code> sends back an error
	 reply. This error case is handled in
	 <code>polkit_system_bus_name_get_creds_sync</code> by setting the value of the
	 <code>error</code> parameter, but it still returns <code>TRUE</code>, rather than <code>FALSE</code>.
	 This behavior means that all callers of
	 <code>polkit_system_bus_name_get_creds_sync</code> need to carefully check whether
	 an error was set. If the calling function forgets to check for errors
	 then it will think that the uid of the requesting process is 0 (because
	 the <code>AsyncGetBusNameCredsData</code> struct is zero initialized). In other
	 words, it will think that the action was requested by a root process,
	 and will therefore allow it.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-3560</cvename>
 <url>https://seclists.org/oss-sec/2021/q2/180</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3560</url>
 <url>https://gitlab.freedesktop.org/polkit/polkit/-/commit/a04d13a</url>
 </references>
 <dates>
 <discovery>2021-06-03</discovery>
 <entry>2021-06-04</entry>
 </dates>
 </vuln>

<vuln vid="69815a1d-c31d-11eb-9633-b42e99a1b9c3">
 <topic>SOGo -- SAML user authentication impersonation</topic>
 <affects>
 <package>
	<name>sogo</name>
	<range><lt>5.1.1</lt></range>
 </package>
 <package>
	<name>sogo-activesync</name>
	<range><lt>5.1.1</lt></range>
 </package>
 <package>
	<name>sogo2</name>
	<range><lt>2.4.1</lt></range>
 </package>
 <package>
	<name>sogo2-activesync</name>
	<range><lt>2.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	sogo.nu reports:
	<blockquote cite="https://www.sogo.nu/news/2021/saml-vulnerability.html">
	 SOGo was not validating the signatures of any SAML assertions it received.
	 This means any actor with network access to the deployment could impersonate
	 users when SAML was the authentication method.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-33054</cvename>
 <url>https://www.sogo.nu/news/2021/saml-vulnerability.html</url>
 <url>https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html</url>
 </references>
 <dates>
 <discovery>2021-06-01</discovery>
 <entry>2021-06-02</entry>
 </dates>
 </vuln>

<vuln vid="c7855866-c511-11eb-ae1d-b42e991fc52e">
 <topic>tauthon -- Regular Expression Denial of Service</topic>
 <affects>
 <package>
	<name>tauthon</name>
	<range><lt>2.8.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	
	<blockquote cite="https://github.com/naftaliharris/tauthon/blob/master/Misc/NEWS.d/2.8.3.rst">
	 The :class:`~urllib.request.AbstractBasicAuthHandler` class
	 of the :mod:`urllib.request` module uses an inefficient
	 regular expression which can be exploited by an
	 attacker to cause a denial of service
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-8492</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492</url>
 </references>
 <dates>
 <discovery>2020-01-30</discovery>
 <entry>2021-06-04</entry>
 </dates>
 </vuln>

<vuln vid="417de1e6-c31b-11eb-9633-b42e99a1b9c3">
 <topic>lasso -- signature checking failure</topic>
 <affects>
 <package>
	<name>lasso</name>
	<range><lt>2.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 entrouvert reports:
 <blockquote cite="https://git.entrouvert.org/lasso.git/tree/NEWS?id=v2.7.0">
 When AuthnResponse messages are not signed (which is
 permitted by the specifiation), all assertion's signatures should be
 checked, but currently after the first signed assertion is checked all
 following assertions are accepted without checking their signature, and
 the last one is considered the main assertion.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-28091</cvename>
 <url>https://git.entrouvert.org/lasso.git/tree/NEWS?id=v2.7.0</url>
 </references>
 <dates>
 <discovery>2021-06-01</discovery>
 <entry>2021-06-01</entry>
 </dates>
 </vuln>

<vuln vid="079b3641-c4bd-11eb-a22a-693f0544ae52">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.16.5,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/45910">
	 The SetString and UnmarshalText methods of math/big.Rat may cause a
	 panic or an unrecoverable fatal error if passed inputs with very
	 large exponents.
	</blockquote>
	<blockquote cite="https://github.com/golang/go/issues/46313">
	 ReverseProxy in net/http/httputil could be made to forward certain
	 hop-by-hop headers, including Connection. In case the target of the
	 ReverseProxy was itself a reverse proxy, this would let an attacker
	 drop arbitrary headers, including those set by the
	 ReverseProxy.Director.
	</blockquote>
	<blockquote cite="https://github.com/golang/go/issues/46241">
	 The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr
	 functions in net, and their respective methods on the Resolver type
	 may return arbitrary values retrieved from DNS which do not follow
	 the established RFC 1035 rules for domain names. If these names are
	 used without further sanitization, for instance unsafely included in
	 HTML, they may allow for injection of unexpected content. Note that
	 LookupTXT may still return arbitrary values that could require
	 sanitization before further use.
	</blockquote>
	<blockquote cite="https://github.com/golang/go/issues/46242">
	 The NewReader and OpenReader functions in archive/zip can cause a
	 panic or an unrecoverable fatal error when reading an archive that
	 claims to contain a large number of files, regardless of its actual
	 size.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-33198</cvename>
 <url>https://github.com/golang/go/issues/45910</url>
 <cvename>CVE-2021-33197</cvename>
 <url>https://github.com/golang/go/issues/46313</url>
 <cvename>CVE-2021-33195</cvename>
 <url>https://github.com/golang/go/issues/46241</url>
 <cvename>CVE-2021-33196</cvename>
 <url>https://github.com/golang/go/issues/46242</url>
 </references>
 <dates>
 <discovery>2021-05-01</discovery>
 <entry>2021-06-03</entry>
 </dates>
 </vuln>

<vuln vid="3000acee-c45d-11eb-904f-14dae9d5a9d2">
 <topic>aiohttp -- open redirect vulnerability</topic>
 <affects>
 <package>
	<name>py36-aiohttp</name>
	<name>py37-aiohttp</name>
	<name>py38-aiohttp</name>
	<name>py39-aiohttp</name>
	<range><le>3.7.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sviatoslav Sydorenko reports:
	<blockquote cite="https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg">
	 Open redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.
	 It is caused by a bug in the <code>aiohttp.web_middlewares.normalize_path_middleware</code> middleware.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-21330</cvename>
 <url>https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-21330</url>
 </references>
 <dates>
 <discovery>2021-02-25</discovery>
 <entry>2021-06-03</entry>
 <modified>2021-06-23</modified>
 </dates>
 </vuln>

<vuln vid="a550d62c-f78d-4407-97d9-93876b6741b9">
 <topic>zeek -- several potential DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>4.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Wojtulewicz of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v4.0.2">
	 Fix potential Undefined Behavior in decode_netbios_name()
	 and decode_netbios_name_type() BIFs. The latter has a
	 possibility of a remote heap-buffer-overread, making this
	 a potential DoS vulnerability.
	 Add some extra length checking when parsing mobile
	 ipv6 packets. Due to the possibility of reading invalid
	 headers from remote sources, this is a potential DoS
	 vulnerability. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v4.0.2</url>
 </references>
 <dates>
 <discovery>2021-04-30</discovery>
 <entry>2021-06-02</entry>
 </dates>
 </vuln>

<vuln vid="c7ec6375-c3cf-11eb-904f-14dae9d5a9d2">
 <topic>PyYAML -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>py36-yaml</name>
	<name>py37-yaml</name>
	<name>py38-yaml</name>
	<name>py39-yaml</name>
	<range><lt>5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A vulnerability was discovered in the PyYAML library
	in versions before 5.4, where it is susceptible to arbitrary
	code execution when it processes untrusted YAML files
	through the full_load method or with the FullLoader loader.
	Applications that use the library to process untrusted
	input may be vulnerable to this flaw. This flaw allows
	an attacker to execute arbitrary code on the system by
	abusing the python/object/new constructor. This flaw is
	due to an incomplete fix for CVE-2020-1747.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-14343</cvename>
 <url>https://github.com/yaml/pyyaml/issues/420</url>
 <url>https://access.redhat.com/security/cve/CVE-2020-14343</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1860466</url>
 </references>
 <dates>
 <discovery>2020-07-22</discovery>
 <entry>2021-06-02</entry>
 </dates>
 </vuln>

<vuln vid="e24fb8f8-c39a-11eb-9370-b42e99a1b9c3">
 <topic>isc-dhcp -- remotely exploitable vulnerability</topic>
 <affects>
 <package>
	<name>isc-dhcp44-relay</name>
	<range><lt>4.4.2-P1</lt></range>
 </package>
 <package>
	<name>isc-dhcp44-server</name>
	<range><lt>4.4.2-P1</lt></range>
 </package>
 <package>
	<name>isc-dhcp44-client</name>
	<range><lt>4.4.2-P1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michael McNally reports:
	<blockquote cite="https://seclists.org/oss-sec/2021/q2/170">
	 Program code used by the ISC DHCP package to read and parse stored leases
	 has a defect that can be exploited by an attacker to cause one of several
	 undesirable outcomes
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-25217</cvename>
 <url>https://kb.isc.org/docs/cve-2021-25217</url>
 </references>
 <dates>
 <discovery>2021-05-26</discovery>
 <entry>2021-06-02</entry>
 </dates>
 </vuln>

<vuln vid="5f52d646-c31f-11eb-8dcf-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.12.0</ge><lt>13.12.2</lt></range>
	<range><ge>13.11.0</ge><lt>13.11.5</lt></range>
	<range><ge>7.10.0</ge><lt>13.10.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/06/01/security-release-gitlab-13-12-2-released/">
	 Stealing GitLab OAuth access tokens using XSLeaks in Safari
	 Denial of service through recursive triggered pipelines
	 Unauthenticated CI lint API may lead to information disclosure and SSRF
	 Server-side DoS through rendering crafted Markdown documents
	 Issue and merge request length limit is not being enforced
	 Insufficient Expired Password Validation
	 XSS in blob viewer of notebooks
	 Logging of Sensitive Information
	 On-call rotation information exposed when removing a member
	 Spoofing commit author for signed commits
	 Enable qsh verification for Atlassian Connect
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-22181</cvename>
 <url>https://about.gitlab.com/releases/2021/06/01/security-release-gitlab-13-12-2-released/</url>
 </references>
 <dates>
 <discovery>2021-06-01</discovery>
 <entry>2021-06-01</entry>
 </dates>
 </vuln>

<vuln vid="8eb69cd0-c2ec-11eb-b6e7-8c164567ca3c">
 <topic>redis -- integer overflow</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><ge>6.0.0</ge><lt>6.0.14</lt></range>
 </package>
 <package>
	<name>redis-devel</name>
	<range><ge>6.2.0</ge><lt>6.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redis development team reports:
	<blockquote cite="https://groups.google.com/g/redis-db/c/RLTwi1kKsCI">
	 An integer overflow bug in Redis version 6.0 or newer can be
	 exploited using the STRALGO LCS command to corrupt the heap and
	 potentially result with remote code execution. This is a result
	 of an incomplete fix by CVE-2021-29477.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-32625</cvename>
 <url>https://groups.google.com/g/redis-db/c/RLTwi1kKsCI</url>
 </references>
 <dates>
 <discovery>2021-06-01</discovery>
 <entry>2021-06-01</entry>
 </dates>
 </vuln>

<vuln vid="58d6ed66-c2e8-11eb-9fb0-6451062f0f7a">
 <topic>libX11 -- Arbitrary code execution</topic>
 <affects>
 <package>
	<name>libX11</name>
	<range><lt>1.7.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The X.org project reports:
	<blockquote cite="https://lists.freedesktop.org/archives/xorg/2021-May/060699.html">
	 XLookupColor() and other X libraries function lack proper validation
	 of the length of their string parameters. If those parameters can be
	 controlled by an external application (for instance a color name that
	 can be emitted via a terminal control sequence) it can lead to the
	 emission of extra X protocol requests to the X server.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-31535</cvename>
 <url>https://lists.freedesktop.org/archives/xorg/2021-May/060699.html</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-31535</url>
 </references>
 <dates>
 <discovery>2021-05-11</discovery>
 <entry>2021-06-01</entry>
 <modified>2022-02-08</modified>
 </dates>
 </vuln>

<vuln vid="59ab72fb-bccf-11eb-a38d-6805ca1caf5c">
 <topic>Prometheus -- arbitrary redirects</topic>
 <affects>
 <package>
	<name>prometheus2</name>
	<range><ge>2.23.0</ge><lt>2.26.1</lt></range>
	<range><eq>2.27.0</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prometheus reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2021-29622">
	 
	 Prometheus is an open-source monitoring system and time series
	 database. In 2.23.0, Prometheus changed its default UI to the New
	 ui. To ensure a seamless transition, the URL's prefixed by /new
	 redirect to /. Due to a bug in the code, it is possible for an
	 attacker to craft an URL that can redirect to any other URL, in the
	 /new endpoint. If a user visits a prometheus server with a
	 specially crafted address, they can be redirected to an arbitrary
	 URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In
	 2.28.0, the /new endpoint will be removed completely. The
	 workaround is to disable access to /new via a reverse proxy in
	 front of Prometheus.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-29622</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-29622</url>
 </references>
 <dates>
 <discovery>2021-05-18</discovery>
 <entry>2021-06-01</entry>
 </dates>
 </vuln>

<vuln vid="fd24a530-c202-11eb-b217-b42e99639323">
 <topic>wayland -- integer overflow</topic>
 <affects>
 <package>
	<name>wayland</name>
	<range><lt>1.19.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tobias Stoeckmann reports:
	<blockquote cite="https://gitlab.freedesktop.org/wayland/wayland/-/merge_requests/133">
	 The libXcursor fix for CVE-2013-2003 has never been imported into wayland, leaving it vulnerable to it.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2003</cvename>
 <url>https://gitlab.freedesktop.org/wayland/wayland/-/merge_requests/133</url>
 <freebsdpr>ports/256273</freebsdpr>
 </references>
 <dates>
 <discovery>2021-05-02</discovery>
 <entry>2021-05-31</entry>
 </dates>
 </vuln>

<vuln vid="107c7a76-beaa-11eb-b87a-901b0ef719ab">
 <topic>FreeBSD -- Missing message validation in libradius(3)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>13.0</ge><lt>13.0_1</lt></range>
	<range><ge>12.2</ge><lt>12.2_7</lt></range>
	<range><ge>11.4</ge><lt>11.4_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	libradius did not perform sufficient validation of received messages.
	rad_get_attr(3) did not verify that the attribute length is valid before
	subtracting the length of the Type and Length fields. As a result, it
	could return success while also providing a bogus length of SIZE_T_MAX -
	2 for the Value field.
	When processing attributes to find an optional authenticator,
	is_valid_response() failed to verify that each attribute length is
	non-zero and could thus enter an infinite loop.
	<h1>Impact:</h1>
	A server may use libradius(3) to process messages from RADIUS clients.
	In this case, a malicious client could trigger a denial-of-service in
	the server. A client using libradius(3) to process messages from a
	server is susceptible to the same problem.
	The impact of the rad_get_attr(3) bug depends on how the returned length
	is validated and used by the consumer. It is possible that libradius(3)
	applications will crash or enter an infinite loop when calling
	rad_get_attr(3) on untrusted RADIUS messages.
 </body>
 </description>
 <references>
 <cvename>CVE-2021-29629</cvename>
 <freebsdsa>SA-21:12.libradius</freebsdsa>
 </references>
 <dates>
 <discovery>2021-05-27</discovery>
 <entry>2021-05-27</entry>
 </dates>
 </vuln>

<vuln vid="d1ac6a6a-bea8-11eb-b87a-901b0ef719ab">
 <topic>FreeBSD-kernel -- SMAP bypass</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>13.0</ge><lt>13.0_1</lt></range>
	<range><ge>12.2</ge><lt>12.2_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The FreeBSD kernel enables SMAP during boot when the CPU reports that
	the SMAP capability is present. Subroutines such as copyin() and
	copyout() are responsible for disabling SMAP around the sections of code
	that perform user memory accesses.
	Such subroutines must handle page faults triggered when user memory is
	not mapped. The kernel's page fault handler checks the validity of the
	fault, and if it is indeed valid it will map a page and resume copying.
	If the fault is invalid, the fault handler returns control to a
	trampoline which aborts the operation and causes an error to be
	returned. In this second scenario, a bug in the implementation of SMAP
	support meant that SMAP would remain disabled until the thread returns
	to user mode.
	<h1>Impact:</h1>
	This bug may be used to bypass the protections provided by SMAP for the
	duration of a system call. It could thus be combined with other kernel
	bugs to craft an exploit.
 </body>
 </description>
 <references>
 <cvename>CVE-2021-29628</cvename>
 <freebsdsa>SA-21:11.smap</freebsdsa>
 </references>
 <dates>
 <discovery>2021-05-27</discovery>
 <entry>2021-05-27</entry>
 </dates>
 </vuln>

<vuln vid="674ed047-be0a-11eb-b927-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>91.0.4472.77</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html">
	 This release contains 32 security fixes, including:
	 <ul>
	 <li>[1208721] High CVE-2021-30521: Heap buffer overflow in Autofill.
	 Reported by ZhanJia Song on 2021-05-13</li>
	 <li>[1176218] High CVE-2021-30522: Use after free in WebAudio.
	 Reported by Piotr Bania of Cisco Talos on 2021-02-09</li>
	 <li>[1187797] High CVE-2021-30523: Use after free in WebRTC.
	 Reported by Tolyan Korniltsev on 2021-03-13</li>
	 <li>[1197146] High CVE-2021-30524: Use after free in TabStrip.
	 Reported by David Erceg on 2021-04-08</li>
	 <li>[1197888] High CVE-2021-30525: Use after free in TabGroups.
	 Reported by David Erceg on 2021-04-11</li>
	 <li>[1198717] High CVE-2021-30526: Out of bounds write in
	 TabStrip. Reported by David Erceg on 2021-04-13</li>
	 <li>[1199198] High CVE-2021-30527: Use after free in WebUI.
	 Reported by David Erceg on 2021-04-15</li>
	 <li>[1206329] High CVE-2021-30528: Use after free in
	 WebAuthentication. Reported by Man Yue Mo of GitHub Security Lab on
	 2021-05-06</li>
	 <li>[1195278] Medium CVE-2021-30529: Use after free in Bookmarks.
	 Reported by koocola (@alo_cook) and Nan Wang (@eternalsakura13) of
	 360 Alpha Lab on 2021-04-02</li>
	 <li>[1201033] Medium CVE-2021-30530: Out of bounds memory access
	 in WebAudio. Reported by kkwon on 2021-04-21</li>
	 <li>[1115628] Medium CVE-2021-30531: Insufficient policy
	 enforcement in Content Security Policy. Reported by Philip Papurt on
	 2020-08-12</li>
	 <li>[1117687] Medium CVE-2021-30532: Insufficient policy
	 enforcement in Content Security Policy. Reported by Philip Papurt on
	 2020-08-18</li>
	 <li>[1145553] Medium CVE-2021-30533: Insufficient policy
	 enforcement in PopupBlocker. Reported by Eliya Stein on
	 2020-11-04</li>
	 <li>[1151507] Medium CVE-2021-30534: Insufficient policy
	 enforcement in iFrameSandbox. Reported by Alesandro Ortiz on
	 2020-11-20</li>
	 <li>[1194899] Medium CVE-2021-30535: Double free in ICU. Reported
	 by nocma, leogan, cheneyxu of WeChat Open Platform Security Team on
	 2021-04-01</li>
	 <li>[1145024] Medium CVE-2021-21212: Insufficient data validation
	 in networking. Reported by Hugo Hue and Sze Yiu Chau of the Chinese
	 University of Hong Kong on 2020-11-03</li>
	 <li>[1194358] Low CVE-2021-30536: Out of bounds read in V8.
	 Reported by Chris Salls (@salls) on 2021-03-31</li>
	 <li>[830101] Low CVE-2021-30537: Insufficient policy enforcement
	 in cookies. Reported by Jun Kokatsu (@shhnjk) on 2018-04-06</li>
	 <li>[1115045] Low CVE-2021-30538: Insufficient policy enforcement
	 in content security policy. Reported by Tianze Ding (@D1iv3) of
	 Tencent Security Xuanwu Lab on 2020-08-11</li>
	 <li>[971231] Low CVE-2021-30539: Insufficient policy enforcement
	 in content security policy. Reported by unnamed researcher on
	 2019-06-05</li>
	 <li>[1184147] Low CVE-2021-30540: Incorrect security UI in
	 payments. Reported by @retsew0x01 on 2021-03-03</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-30521</cvename>
 <cvename>CVE-2021-30522</cvename>
 <cvename>CVE-2021-30523</cvename>
 <cvename>CVE-2021-30524</cvename>
 <cvename>CVE-2021-30525</cvename>
 <cvename>CVE-2021-30526</cvename>
 <cvename>CVE-2021-30527</cvename>
 <cvename>CVE-2021-30528</cvename>
 <cvename>CVE-2021-30529</cvename>
 <cvename>CVE-2021-30530</cvename>
 <cvename>CVE-2021-30531</cvename>
 <cvename>CVE-2021-30532</cvename>
 <cvename>CVE-2021-30533</cvename>
 <cvename>CVE-2021-30534</cvename>
 <cvename>CVE-2021-30535</cvename>
 <cvename>CVE-2021-21212</cvename>
 <cvename>CVE-2021-30536</cvename>
 <cvename>CVE-2021-30537</cvename>
 <cvename>CVE-2021-30538</cvename>
 <cvename>CVE-2021-30539</cvename>
 <cvename>CVE-2021-30540</cvename>
 <url>https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html</url>
 </references>
 <dates>
 <discovery>2021-05-25</discovery>
 <entry>2021-05-26</entry>
 </dates>
 </vuln>

<vuln vid="21ec4428-bdaa-11eb-a04e-641c67a117d8">
 <topic>libzmq4 -- Denial of Service</topic>
 <affects>
 <package>
	<name>libzmq4</name>
	<range><lt>4.3.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google's oss-fuzz project reports:
	<blockquote cite="https://github.com/zeromq/libzmq/releases/tag/v4.3.3">
	 Denial-of-Service on CURVE/ZAP-protected servers by
	 unauthenticated clients.
	 If a raw TCP socket is opened and connected to an endpoint that is fully
	 configured with CURVE/ZAP, legitimate clients will not be able to exchange
	 any message. Handshakes complete successfully, and messages are delivered to
	 the library, but the server application never receives them.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-15166</cvename>
 <url>https://github.com/zeromq/libzmq/releases/tag/v4.3.3</url>
 <url>https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m</url>
 <freebsdpr>ports/255102</freebsdpr>
 </references>
 <dates>
 <discovery>2020-09-07</discovery>
 <entry>2021-05-25</entry>
 </dates>
 </vuln>

<vuln vid="6954a2b0-bda8-11eb-a04e-641c67a117d8">
 <topic>libzmq4 -- Stack overflow</topic>
 <affects>
 <package>
	<name>libzmq4</name>
	<range><lt>4.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Fang-Pen Lin reports:
	<blockquote cite="https://github.com/zeromq/libzmq/releases/tag/v4.3.2">
	 A remote, unauthenticated client connecting to a
	 libzmq application, running with a socket listening with CURVE
	 encryption/authentication enabled, may cause a stack overflow and
	 overwrite the stack with arbitrary data, due to a buffer overflow in
	 the library. Users running public servers with the above configuration
	 are highly encouraged to upgrade as soon as possible, as there are no
	 known mitigations.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-13132</cvename>
 <url>https://github.com/zeromq/libzmq/releases/tag/v4.3.2</url>
 <url>https://github.com/zeromq/libzmq/issues/3558</url>
 <freebsdpr>ports/255102</freebsdpr>
 </references>
 <dates>
 <discovery>2019-06-27</discovery>
 <entry>2021-05-25</entry>
 </dates>
 </vuln>

<vuln vid="0882f019-bd60-11eb-9bdd-8c164567ca3c">
 <topic>NGINX -- 1-byte memory overwrite in resolver</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><lt>1.20.1,2</lt></range>
 </package>
 <package>
	<name>nginx-devel</name>
	<range><lt>1.21.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NGINX team reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23017">
	 1-byte memory overwrite might occur during DNS server response
	 processing if the "resolver" directive was used, allowing an
	 attacker who is able to forge UDP packets from the DNS server
	 to cause worker process crash or, potentially, arbitrary code
	 execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-23017</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23017</url>
 </references>
 <dates>
 <discovery>2021-05-25</discovery>
 <entry>2021-05-25</entry>
 </dates>
 </vuln>

<vuln vid="58b22f3a-bc71-11eb-b9c9-6cc21735f730">
 <topic>PG Partition Manager -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>pg_partman</name>
	<range><lt>4.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PG Partition Manager reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2021-33204">
	 
	 In the pg_partman (aka PG Partition Manager) extension before 4.5.1
	 for PostgreSQL, arbitrary code execution can be achieved via
	 SECURITY DEFINER functions because an explicit search_path is not
	 set.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-33204</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-33204</url>
 </references>
 <dates>
 <discovery>2021-05-21</discovery>
 <entry>2021-05-24</entry>
 </dates>
 </vuln>

<vuln vid="5fa90ee6-bc9e-11eb-a287-e0d55e2a8bf9">
 <topic>texproc/expat2 -- billion laugh attack</topic>
 <affects>
 <package>
	<name>expat</name>
	<range><lt>2.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kurt Seifried reports:
	<blockquote cite="https://blog.hartwork.org/posts/cve-2013-0340-billion-laughs-fixed-in-expat-2-4-0/">
	 So here are the CVE's for the two big ones, libxml2 and expat.
	 Both are affected by the expansion of internal entities
	 (which can be used to consume resources) and external entities
	 (which can cause a denial of service against other services, be
	 used to port scan, etc.).
	 A billion laughs attack is a type of denial-of-service attack
	 which is aimed at parsers of XML documents.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0340</cvename>
	<url>https://www.openwall.com/lists/oss-security/2013/02/22/3</url>
	<url>https://blog.hartwork.org/posts/cve-2013-0340-billion-laughs-fixed-in-expat-2-4-0/</url>
	<url>https://nvd.nist.gov/vuln/detail/CVE-2013-0340</url>
 </references>
 <dates>
 <discovery>2013-02-21</discovery>
 <entry>2021-05-24</entry>
 </dates>
 </vuln>

<vuln vid="524bd03a-bb75-11eb-bf35-080027f515ea">
 <topic>libxml2 -- Possible denial of service</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.9.10_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Daniel Veillard reports:
	<blockquote cite="https://ubuntu.com/security/CVE-2021-3541">
	 
	 A flaw was found in libxml2. Exponential entity expansion attack
	 its possible bypassing all existing protection mechanisms and
	 leading to denial of service.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-3541</cvename>
 <url>https://ubuntu.com/security/CVE-2021-3541</url>
 <url>https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e</url>
 </references>
 <dates>
 <discovery>2021-05-18</discovery>
 <entry>2021-05-23</entry>
 </dates>
 </vuln>

<vuln vid="62da9702-b4cc-11eb-b9c9-6cc21735f730">
 <topic>PostgreSQL server -- two security issues</topic>
 <affects>
 <package>
	<name>postgresql13-server</name>
	<range><lt>13.3</lt></range>
 </package>
 <package>
	<name>postgresql12-server</name>
	<range><lt>12.7</lt></range>
 </package>
 <package>
	<name>postgresql11-server</name>
	<range><lt>11.12</lt></range>
 </package>
 <package>
	<name>postgresql10-server</name>
	<range><lt>10.17</lt></range>
 </package>
 <package>
	<name>postgresql96-server</name>
	<range><lt>9.6.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2021-32028/">
	 Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE
	 
	 Using an INSERT ... ON CONFLICT ... DO UPDATE command on a
	 purpose-crafted table, an attacker can read arbitrary bytes of
	 server memory. In the default configuration, any authenticated
	 database user can create prerequisite objects and complete this
	 attack at will. A user lacking the CREATE and TEMPORARY privileges
	 on all databases and the CREATE privilege on all schemas cannot use
	 this attack at will..
	 
	</blockquote>
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2021-32027/">
	 
	 Buffer overrun from integer overflow in array subscripting
	 calculations
	 
	 
	 While modifying certain SQL array values, missing bounds checks let
	 authenticated database users write arbitrary bytes to a wide area of
	 server memory.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.postgresql.org/support/security/CVE-2021-32027/</url>
 <url>https://www.postgresql.org/support/security/CVE-2021-32028/</url>
 </references>
 <dates>
 <discovery>2021-05-13</discovery>
 <entry>2021-05-14</entry>
 </dates>
 </vuln>

<vuln vid="76e0bb86-b4cb-11eb-b9c9-6cc21735f730">
 <topic>PostgreSQL -- Memory disclosure in partitioned-table UPDATE ... RETURNING</topic>
 <affects>
 <package>
	<name>postgresql13-server</name>
	<range><lt>13.3</lt></range>
 </package>
 <package>
	<name>postgresql12-server</name>
	<range><lt>12.7</lt></range>
 </package>
 <package>
	<name>postgresql11-server</name>
	<range><lt>11.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/support/security/CVE-2021-32029/">
	 
	 Using an UPDATE ... RETURNING on a purpose-crafted partitioned
	 table, an attacker can read arbitrary bytes of server memory. In the
	 default configuration, any authenticated database user can create
	 prerequisite objects and complete this attack at will. A user
	 lacking the CREATE and TEMPORARY privileges on all databases and the
	 CREATE privilege on all schemas typically cannot use this attack at
	 will.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.postgresql.org/support/security/CVE-2021-32029/</url>
 </references>
 <dates>
 <discovery>2021-05-13</discovery>
 <entry>2021-05-14</entry>
 </dates>
 </vuln>

<vuln vid="fc75570a-b417-11eb-a23d-c7ab331fd711">
 <topic>Prosody -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>prosody</name>
	<range><lt>0.11.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Prosody security advisory 2021-05-12 reports:
	<blockquote cite="https://prosody.im/security/advisory_20210512/">
	 
	 This advisory details 5 new security vulnerabilities discovered in the
	 Prosody.im XMPP server software. All issues are fixed in the 0.11.9
	 release default configuration.
	 
	 <ul>
	 <li>CVE-2021-32918: DoS via insufficient memory consumption controls</li>
	 <li>CVE-2021-32920: DoS via repeated TLS renegotiation causing excessive CPU consumption</li>
	 <li>CVE-2021-32921: Use of timing-dependent string comparison with sensitive values</li>
	 <li>CVE-2021-32917: Use of mod_proxy65 is unrestricted in default configuration</li>
	 <li>CVE-2021-32919: Undocumented dialback-without-dialback option insecure</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-32918</cvename>
 <cvename>CVE-2021-32920</cvename>
 <cvename>CVE-2021-32921</cvename>
 <cvename>CVE-2021-32917</cvename>
 <cvename>CVE-2021-32919</cvename>
 </references>
 <dates>
 <discovery>2021-05-12</discovery>
 <entry>2021-05-13</entry>
 </dates>
 </vuln>

<vuln vid="3e0ca488-b3f6-11eb-a5f7-a0f3c100ae18">
 <topic>ImageMagick6 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ImageMagick6</name>
	<name>ImageMagick6-nox11</name>
	<range><lt>6.9.12.12,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=ImageMagick">
	 Several vulnerabilities have been discovered in ImageMagick:
	 <ul>
	 <li>CVE-2021-20309: A flaw was found in ImageMagick in versions before 6.9.12,
	 where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger
	 undefined behavior via a crafted image file submitted to an application using ImageMagick.</li>
	 <li>CVE-2021-20176: A divide-by-zero flaw was found in ImageMagick 6.9.11-57 in gem.c.
	 This flaw allows an attacker who submits a crafted file that is processed by ImageMagick
	 to trigger undefined behavior through a division by zero.</li>
	 <li>CVE-2020-29599: ImageMagick before 6.9.11-40 mishandles the -authenticate option,
	 which allows setting a password for password-protected PDF files.</li>
	 <li>And maybe some others…</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-29599</cvename>
 <cvename>CVE-2021-20176</cvename>
 <cvename>CVE-2021-20309</cvename>
 </references>
 <dates>
 <discovery>2020-12-17</discovery>
 <entry>2021-05-13</entry>
 </dates>
 </vuln>

<vuln vid="a7c60af1-b3f1-11eb-a5f7-a0f3c100ae18">
 <topic>ImageMagick7 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ImageMagick7</name>
	<name>ImageMagick7-nox11</name>
	<range><lt>7.0.11.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=ImageMagick">
	 Several vulnerabilities have been discovered in ImageMagick:
	 <ul>
	 <li>CVE-2021-20313: A flaw was found in ImageMagick in versions before 7.0.11.
	 A potential cipher leak when the calculate signatures in TransformSignature is possible.</li>
	 <li>CVE-2021-20312: A flaw was found in ImageMagick in versions 7.0.11,
	 where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger
	 undefined behavior via a crafted image file that is submitted by an attacker and
	 processed by an application using ImageMagick.</li>
	 <li>CVE-2021-20311: A flaw was found in ImageMagick in versions before 7.0.11,
	 where a division by zero in sRGBTransformImage() in the MagickCore/colorspace.c
	 may trigger undefined behavior via a crafted image file that is submitted by an
	 attacker processed by an application using ImageMagick.</li>
	 <li>CVE-2021-20310: A flaw was found in ImageMagick in versions before 7.0.11,
	 where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trigger
	 undefined behavior via a crafted image file that is submitted by an attacker
	 and processed by an application using ImageMagick.</li>
	 <li>CVE-2021-20309: A flaw was found in ImageMagick in versions before 7.0.11,
	 where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger
	 undefined behavior via a crafted image file submitted to an application using ImageMagick.</li>
	 <li>And several others…</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-27829</cvename>
 <cvename>CVE-2020-29599</cvename>
 <cvename>CVE-2021-20176</cvename>
 <cvename>CVE-2021-20241</cvename>
 <cvename>CVE-2021-20243</cvename>
 <cvename>CVE-2021-20244</cvename>
 <cvename>CVE-2021-20245</cvename>
 <cvename>CVE-2021-20246</cvename>
 <cvename>CVE-2021-20309</cvename>
 <cvename>CVE-2021-20310</cvename>
 <cvename>CVE-2021-20311</cvename>
 <cvename>CVE-2021-20312</cvename>
 <cvename>CVE-2021-20313</cvename>
 </references>
 <dates>
 <discovery>2020-10-27</discovery>
 <entry>2021-05-13</entry>
 </dates>
 </vuln>

<vuln vid="f947aa26-b2f9-11eb-a5f7-a0f3c100ae18">
 <topic>Pillow -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py38-pillow</name>
	<range><lt>8.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	python-pillow reports:
	<blockquote cite="https://github.com/python-pillow/Pillow/pull/5377/commits/8ec027867f19633d9adfc5c8b7504d9b609fc5f1">
	 This release fixes several vulnerabilities found with `OSS-Fuzz`.
	 <ul>
	 <li>`CVE-2021-25288`: Fix OOB read in Jpeg2KDecode.
	 This dates to Pillow 2.4.0.</li>
	 <li>`CVE-2021-28675`: Fix DOS in PsdImagePlugin.
	 This dates to the PIL fork.</li>
	 <li>`CVE-2021-28676`: Fix FLI DOS.
	 This dates to the PIL fork.</li>
	 <li>`CVE-2021-28677`: Fix EPS DOS on _open.
	 This dates to the PIL fork.</li>
	 <li>`CVE-2021-28678`: Fix BLP DOS.
	 This dates to Pillow 5.1.0.</li>
	 <li>Fix memory DOS in ImageFont.
	 This dates to the PIL fork.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-25288</cvename>
 <cvename>CVE-2021-28675</cvename>
 <cvename>CVE-2021-28676</cvename>
 <cvename>CVE-2021-28677</cvename>
 <cvename>CVE-2021-28678</cvename>
 </references>
 <dates>
 <discovery>2021-04-01</discovery>
 <entry>2021-05-12</entry>
 </dates>
 </vuln>

<vuln vid="3cac007f-b27e-11eb-97a0-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>90.0.4430.212</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html">
	 This release contains 19 security fixes, including:
	 <ul>
	 <li>[1180126] High CVE-2021-30506: Incorrect security UI in Web App
	 Installs. Reported by @retsew0x01 on 2021-02-19</li>
	 <li>[1178202] High CVE-2021-30507: Inappropriate implementation in
	 Offline. Reported by Alison Huffman, Microsoft Browser
	 Vulnerability Research on 2021-02-14</li>
	 <li>[1195340] High CVE-2021-30508: Heap buffer overflow in Media
	 Feeds. Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2021-04-02</li>
	 <li>[1196309] High CVE-2021-30509: Out of bounds write in Tab Strip.
	 Reported by David Erceg on 2021-04-06</li>
	 <li>[1197436] High CVE-2021-30510: Race in Aura. Reported by Weipeng
	 Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group
	 on 2021-04-09</li>
	 <li>[1197875] High CVE-2021-30511: Out of bounds read in Tab Groups.
	 Reported by David Erceg on 2021-04-10</li>
	 <li>[1200019] High CVE-2021-30512: Use after free in Notifications.
	 Reported by ZhanJia Song on 2021-04-17</li>
	 <li>[1200490] High CVE-2021-30513: Type Confusion in V8. Reported by
	 Man Yue Mo of GitHub Security Lab on 2021-04-19</li>
	 <li>[1200766] High CVE-2021-30514: Use after free in Autofill.
	 Reported by koocola (@alo_cook) and Nan Wang (@eternalsakura13) of
	 360 Alpha Lab on 2021-04-20</li>
	 <li>[1201073] High CVE-2021-30515: Use after free in File API.
	 Reported by Rong Jian and Guang Gong of 360 Alpha Lab on
	 2021-04-21</li>
	 <li>[1201446] High CVE-2021-30516: Heap buffer overflow in History.
	 Reported by ZhanJia Song on 2021-04-22</li>
	 <li>[1203122] High CVE-2021-30517: Type Confusion in V8. Reported by
	 laural on 2021-04-27</li>
	 <li>[1203590] High CVE-2021-30518: Heap buffer overflow in Reader
	 Mode. Reported by Jun Kokatsu, Microsoft Browser Vulnerability
	 Research on 2021-04-28</li>
	 <li>[1194058] Medium CVE-2021-30519: Use after free in Payments.
	 Reported by asnine on 2021-03-30</li>
	 <li>[1193362] Medium CVE-2021-30520: Use after free in Tab Strip.
	 Reported by Khalil Zhani on 2021-04-03</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-30506</cvename>
 <cvename>CVE-2021-30507</cvename>
 <cvename>CVE-2021-30508</cvename>
 <cvename>CVE-2021-30509</cvename>
 <cvename>CVE-2021-30510</cvename>
 <cvename>CVE-2021-30511</cvename>
 <cvename>CVE-2021-30512</cvename>
 <cvename>CVE-2021-30513</cvename>
 <cvename>CVE-2021-30514</cvename>
 <cvename>CVE-2021-30515</cvename>
 <cvename>CVE-2021-30516</cvename>
 <cvename>CVE-2021-30517</cvename>
 <cvename>CVE-2021-30518</cvename>
 <cvename>CVE-2021-30519</cvename>
 <cvename>CVE-2021-30520</cvename>
 <url>https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2021-05-10</discovery>
 <entry>2021-05-11</entry>
 </dates>
 </vuln>

<vuln vid="278561d7-b261-11eb-b788-901b0e934d69">
 <topic>py-matrix-synapse -- malicious push rules may be used for a denial of service attack.</topic>
 <affects>
 <package>
	<name>py36-matrix-synapse</name>
	<name>py37-matrix-synapse</name>
	<name>py38-matrix-synapse</name>
	<name>py39-matrix-synapse</name>
	<range><lt>1.33.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://github.com/matrix-org/synapse/security/advisories/GHSA-x345-32rc-8h85">
	 "Push rules" can specify conditions under which they will match,
	 including event_match, which matches event content against a
	 pattern including wildcards.
	 Certain patterns can cause very poor performance in the matching
	 engine, leading to a denial-of-service when processing moderate
	 length events.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-29471</cvename>
 <url>https://github.com/matrix-org/synapse/security/advisories/GHSA-x345-32rc-8h85</url>
 </references>
 <dates>
 <discovery>2021-05-11</discovery>
 <entry>2021-05-11</entry>
 </dates>
 </vuln>

<vuln vid="12156786-b18a-11eb-8cba-080027b00c2e">
 <topic>cyrus-imapd -- Remote authenticated users could bypass intended access restrictions on certain server annotations.</topic>
 <affects>
 <package>
	<name>cyrus-imapd34</name>
	<range><ge>3.4.0</ge><lt>3.4.1</lt></range>
 </package>
 <package>
	<name>cyrus-imapd32</name>
	<range><ge>3.2.0</ge><lt>3.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cyrus IMAP 3.4.1 Release Notes states:
	<blockquote cite="https://www.cyrusimap.org/imap/download/release-notes/3.4/x/3.4.1.html">
	 Fixed CVE-2021-32056: Remote authenticated users could bypass intended access restrictions on certain server annotations. Additionally, a long-standing bug in replication did not allow server annotations to be replicated. Combining these two bugs, a remote authenticated user could stall replication, requiring administrator intervention.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-32056</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32056</url>
 </references>
 <dates>
 <discovery>2021-05-05</discovery>
 <entry>2021-05-10</entry>
 </dates>
 </vuln>

<vuln vid="49346de2-b015-11eb-9bdf-f8b156b6dcc8">
 <topic>FLAC -- out-of-bounds read</topic>
 <affects>
 <package>
	<name>flac</name>
	<range><lt>1.3.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oss-Fuzz reports:
	<blockquote cite="https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17069">
	 There is a possible out of bounds read due to a heap
	 buffer overflow in FLAC__bitreader_read_rice_signed_block
	 of bitreader.c.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17069</url>
 <cvename>CVE-2020-0499</cvename>
 </references>
 <dates>
 <discovery>2019-09-08</discovery>
 <entry>2021-05-08</entry>
 </dates>
 </vuln>

<vuln vid="f7a00ad7-ae75-11eb-8113-08002728f74c">
 <topic>Rails -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-actionpack52</name>
	<range><lt>5.2.6</lt></range>
 </package>
 <package>
	<name>rubygem-actionpack60</name>
	<range><lt>6.0.3.7</lt></range>
 </package>
 <package>
	<name>rubygem-actionpack61</name>
	<range><lt>6.1.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails blog:
	<blockquote cite="https://weblog.rubyonrails.org/2021/5/5/Rails-versions-6-1-3-2-6-0-3-7-5-2-4-6-and-5-2-6-have-been-released/">
	 Rails versions 6.1.3.2, 6.0.3.7, and 5.2.6 have been released! These
	 releases contain important security fixes. Here is a list of the issues
	 fixed:
	 CVE-2021-22885: Possible Information Disclosure / Unintended Method Execution in Action Pack
	 CVE-2021-22902: Possible Denial of Service vulnerability in Action Dispatch
	 CVE-2021-22903: Possible Open Redirect Vulnerability in Action Pack
	 CVE-2021-22904: Possible DoS Vulnerability in Action Controller Token Authentication
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://weblog.rubyonrails.org/2021/5/5/Rails-versions-6-1-3-2-6-0-3-7-5-2-4-6-and-5-2-6-have-been-released/</url>
 <url>https://discuss.rubyonrails.org/t/cve-2021-22885-possible-information-disclosure-unintended-method-execution-in-action-pack/77868</url>
 <url>https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866</url>
 <url>https://discuss.rubyonrails.org/t/cve-2021-22903-possible-open-redirect-vulnerability-in-action-pack/77867</url>
 <url>https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869</url>
 <cvename>CVE-2021-22885</cvename>
 <cvename>CVE-2021-22902</cvename>
 <cvename>CVE-2021-22903</cvename>
 <cvename>CVE-2021-22904</cvename>
 </references>
 <dates>
 <discovery>2021-05-05</discovery>
 <entry>2021-05-07</entry>
 </dates>
 </vuln>

<vuln vid="7f242313-aea5-11eb-8151-67f74cf7c704">
 <topic>go -- net/http: ReadRequest can stack overflow due to recursion with very large headers</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.16.4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/45710">
	 http.ReadRequest can stack overflow due to recursion when given a
	 request with a very large header (~8-10MB depending on the
	 architecture). A http.Server which overrides the default max header
	 of 1MB by setting Server.MaxHeaderBytes to a much larger value could
	 also be vulnerable in the same way.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-31525</cvename>
 <url>https://github.com/golang/go/issues/45710</url>
 </references>
 <dates>
 <discovery>2021-04-22</discovery>
 <entry>2021-05-06</entry>
 </dates>
 </vuln>

<vuln vid="50ec3a01-ad77-11eb-8528-8c164582fbac">
 <topic>Ansible -- Insecure Temporary File</topic>
 <affects>
 <package>
	<name>py36-ansible</name>
	<name>py37-ansible</name>
	<name>py38-ansible</name>
	<name>py39-ansible</name>
	<name>py36-ansible27</name>
	<range><ge>2.9.0</ge><le>2.9.9</le></range>
 </package>
 <package>
	<name>py37-ansible27</name>
	<name>py38-ansible27</name>
	<name>py39-ansible27</name>
	<range><ge>2.7.0</ge><le>2.7.18</le></range>
 </package>
 <package>
	<name>py36-ansible28</name>
	<name>py37-ansible28</name>
	<name>py38-ansible28</name>
	<name>py39-ansible28</name>
	<range><ge>2.8.0</ge><le>2.8.12</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2020-10744">
	
	 An incomplete fix was found for the fix of the flaw CVE-2020-1733
	 ansible: insecure temporary directory when running become_user from
	 become directive. The provided fix is insufficient to prevent the
	 race condition on systems using ACLs and FUSE filesystems..
	
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-10744</url>
 <cvename>CVE-2020-10744</cvename>
 </references>
 <dates>
 <discovery>2020-05-15</discovery>
 <entry>2021-05-05</entry>
 </dates>
 </vuln>

<vuln vid="1766359c-ad6e-11eb-b2a4-080027e50e6d">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py36-django22</name>
	<name>py37-django22</name>
	<name>py38-django22</name>
	<name>py39-django22</name>
	<range><lt>2.2.21</lt></range>
 </package>
 <package>
	<name>py36-django31</name>
	<name>py37-django31</name>
	<name>py38-django31</name>
	<name>py39-django31</name>
	<range><lt>3.1.9</lt></range>
 </package>
 <package>
	<name>py36-django32</name>
	<name>py37-django32</name>
	<name>py38-django32</name>
	<name>py39-django32</name>
	<range><lt>3.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django Release reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2021/may/04/security-releases/">
	 CVE-2021-31542:Potential directory-traversal via uploaded files.
	 MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal
	 via uploaded files with suitably crafted file names.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2021/may/04/security-releases/</url>
 <cvename>CVE-2021-31542</cvename>
 </references>
 <dates>
 <discovery>2021-04-22</discovery>
 <entry>2021-05-05</entry>
 </dates>
 </vuln>

<vuln vid="bffa40db-ad50-11eb-86b8-080027846a02">
 <topic>Python -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python38</name>
	<range><lt>3.8.10</lt></range>
 </package>
 <package>
	<name>python39</name>
	<range><lt>3.9.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python reports:
	<blockquote cite="https://docs.python.org/3/whatsnew/changelog.html#changelog">
	 bpo-43434: Creating a sqlite3.Connection object now also produces a
	 sqlite3.connect auditing event. Previously this event was only produced
	 by sqlite3.connect() calls. Patch by Erlend E. Aasland.
	 bpo-43882: The presence of newline or tab characters in parts of a URL
	 could allow some forms of attacks.Following the controlling specification
	 for URLs defined by WHATWG urllib.parse() now removes A SCII newlines
	 and tabs from URLs, preventing such attacks.
	 bpo-43472: Ensures interpreter-level audit hooks receive the cpython.
	 PyInterpreterState_New event when called through the _xxsubinterpreters
	 module.
	 bpo-36384: ipaddress module no longer accepts any leading zeros in IPv4
	 address strings. Leading zeros are ambiguous and interpreted as octal
	 notation by some libraries. For example the legacy function socket.inet_aton()
	 treats leading zeros as octal notatation. glibc implementation of modern
	 inet_pton() does not accept any leading zeros. For a while the ipaddress
	 module used to accept ambiguous leading zeros.
	 bpo-43075: Fix Regular Expression Denial of Service (ReDoS) vulnerability
	 in urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable regex has
	 quadratic worst-case complexity and it allows cause a denial of service
	 when identifying crafted invalid RFCs. This ReDoS issue is on the client
	 side and needs remote attackers to control the HTTP server.
	 bpo-42800: Audit hooks are now fired for frame.f_code, traceback.tb_frame,
	 and generator code/frame attribute access.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.python.org/3/whatsnew/changelog.html#changelog</url>
 <url>https://docs.python.org/3.8/whatsnew/changelog.html#changelog</url>
 </references>
 <dates>
 <discovery>2021-03-08</discovery>
 <entry>2021-05-05</entry>
 </dates>
 </vuln>

<vuln vid="1606b03b-ac57-11eb-9bdd-8c164567ca3c">
 <topic>redis -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>redis</name>
	<range><ge>6.0.0</ge><lt>6.0.13</lt></range>
 </package>
 <package>
	<name>redis-devel</name>
	<range><ge>6.2.0</ge><lt>6.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redis project reports:
	<blockquote cite="https://groups.google.com/g/redis-db/c/6GSWzTW0PR8">
	 <dl>
	 <dt>Vulnerability in the STRALGO LCS command</dt>
	 <dd>
	 An integer overflow bug in Redis version 6.0 or newer could be
	 exploited using the STRALGO LCS command to corrupt the heap and
	 potentially result with remote code execution.
	 </dd>
	 <dt>Vulnerability in the COPY command for large intsets</dt>
	 <dd>
	 An integer overflow bug in Redis 6.2 could be exploited to corrupt
	 the heap and potentially result with remote code execution.
	 The vulnerability involves changing the default set-max-intset-entries
	 configuration value, creating a large set key that consists of
	 integer values and using the COPY command to duplicate it.
	 The integer overflow bug exists in all versions of Redis starting
	 with 2.6, where it could result with a corrupted RDB or DUMP payload,
	 but not exploited through COPY (which did not exist before 6.2).
	 </dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-29477</cvename>
 <cvename>CVE-2021-29478</cvename>
 <url>https://groups.google.com/g/redis-db/c/6GSWzTW0PR8</url>
 </references>
 <dates>
 <discovery>2021-05-03</discovery>
 <entry>2021-05-03</entry>
 </dates>
 </vuln>

<vuln vid="57027417-ab7f-11eb-9596-080027f515ea">
 <topic>RDoc -- command injection vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-rdoc</name>
	<range><lt>6.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Alexandr Savca reports:
	<blockquote cite="https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/">
	 
	 RDoc used to call Kernel#open to open a local file. If a Ruby project
	 has a file whose name starts with | and ends with tags, the command
	 following the pipe character is executed. A malicious Ruby project
	 could exploit it to run an arbitrary command execution against a user
	 who attempts to run rdoc command.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-31799</cvename>
 <url>https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/</url>
 </references>
 <dates>
 <discovery>2021-05-02</discovery>
 <entry>2021-05-02</entry>
 </dates>
 </vuln>

<vuln vid="0add6e6b-6883-11eb-b0cb-f8b156c2bfe9">
 <topic>sympa -- Unauthorised full access via SOAP API due to illegal cookie</topic>
 <affects>
 <package>
	<name>sympa</name>
	<range><lt>6.2.60</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sympa community reports:
	<blockquote cite="https://github.com/sympa-community/sympa/issues/1041">
	 Unauthorised full access via SOAP API due to illegal cookie
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-29668</cvename>
 <url>https://sympa-community.github.io/security/2020-003.html</url>
 </references>
 <dates>
 <discovery>2020-11-24</discovery>
 <entry>2021-02-06</entry>
 </dates>
 </vuln>

<vuln vid="6f33d38b-aa18-11eb-b3f1-005056a311d1">
 <topic>samba -- negative idmap cache entries vulnerability</topic>
 <affects>
 <package>
	<name>samba412</name>
	<range><lt>4.12.15</lt></range>
 </package>
 <package>
	<name>samba413</name>
	<range><lt>4.13.8</lt></range>
 </package>
 <package>
	<name>samba414</name>
	<range><lt>4.14.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="https://www.samba.org/samba/history/security.html">
	 <ul>
	 <li>CVE-2021-20254: Negative idmap cache entries can cause incorrect
	 group entries in the Samba file server process token.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/security/CVE-2021-20254.html</url>
 <cvename>CVE-2021-20254</cvename>
 </references>
 <dates>
 <discovery>2021-04-29</discovery>
 <entry>2021-05-01</entry>
 </dates>
 </vuln>

<vuln vid="518a119c-a864-11eb-8ddb-001b217b3468">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.11.0</ge><lt>13.11.2</lt></range>
	<range><ge>13.10.0</ge><lt>13.10.4</lt></range>
	<range><ge>11.6.0</ge><lt>13.9.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/04/28/security-release-gitlab-13-11-2-released/">
	 Read API scoped tokens can execute mutations
	 Pull mirror credentials were exposed
	 Denial of Service when querying repository branches API
	 Non-owners can set system_note_timestamp when creating / updating issues
	 DeployToken will impersonate a User with the same ID when using Dependency Proxy
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2021/04/28/security-release-gitlab-13-11-2-released/</url>
 <cvename>CVE-2021-22209</cvename>
 <cvename>CVE-2021-22206</cvename>
 <cvename>CVE-2021-22210</cvename>
 <cvename>CVE-2021-22208</cvename>
 <cvename>CVE-2021-22211</cvename>
 </references>
 <dates>
 <discovery>2021-04-28</discovery>
 <entry>2021-04-28</entry>
 </dates>
 </vuln>

<vuln vid="76a07f31-a860-11eb-8ddb-001b217b3468">
 <topic>Carrierwave -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-carrierwave</name>
	<range><lt>1.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Community reports:
	<blockquote cite="https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08">
	 Fix Code Injection vulnerability in CarrierWave::RMagick
	 Fix SSRF vulnerability in the remote file download feature
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08</url>
 <cvename>CVE-2021-21288</cvename>
 <cvename>CVE-2021-21305</cvename>
 </references>
 <dates>
 <discovery>2021-02-08</discovery>
 <entry>2021-04-28</entry>
 </dates>
 </vuln>

<vuln vid="31a7ffb1-a80a-11eb-b159-f8b156c2bfe9">
 <topic>sympa -- Inappropriate use of the cookie parameter can be a security threat. This parameter may also not provide sufficient security.</topic>
 <affects>
 <package>
	<name>sympa</name>
	<range><lt>6.2.62</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Earlier versions of Sympa require a parameter named cookie in sympa.conf
	configuration file.
	<blockquote cite="https://sympa-community.github.io/security/2021-001.html">
	This parameter was used to make some identifiers generated by the system
	unpredictable. For example, it was used as following:
	<ul><li>To be used as a salt to encrypt passwords stored in the database by
	the RC4 symmetric key algorithm.
	Note that RC4 is no longer considered secure enough and is not supported
	in the current version of Sympa.</li>
	<li>To prevent attackers from sending crafted messages to achieve XSS and
	so on in message archives.</li></ul>
	There were the following problems with the use of this parameter.
	<ol><li>This parameter, for its purpose, should be different for each
	installation, and once set, it cannot be changed. As a result, some sites
	have been operating without setting this parameter. This completely
	invalidates the security measures described above.</li>
	<li>Even if this parameter is properly set, it may be considered not being
	strong enough against brute force attacks.</li></ol>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://sympa-community.github.io/security/2021-001.html</url>
 </references>
 <dates>
 <discovery>2021-04-27</discovery>
 <entry>2021-04-27</entry>
 </dates>
 </vuln>

<vuln vid="9fba80e0-a771-11eb-97a0-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>90.0.4430.93</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html">
	 This release contains 9 security fixes, including:
	 <ul>
	 <li>[1199345] High CVE-2021-21227: Insufficient data validation in
	 V8. Reported by Gengming Liu of Singular Security Lab on
	 2021-04-15</li>
	 <li>[1175058] High CVE-2021-21232: Use after free in Dev Tools.
	 Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability
	 Research on 2021-02-05</li>
	 <li>[1182937] High CVE-2021-21233: Heap buffer overflow in ANGLE.
	 Reported by Omair on 2021-02-26</li>
	 <li>[1139156] Medium CVE-2021-21228: Insufficient policy enforcement
	 in extensions. Reported by Rob Wu on 2020-10-16</li>
	 <li>[$TBD][1198165] Medium CVE-2021-21229: Incorrect security UI in
	 downloads. Reported by Mohit Raj (shadow2639) on 2021-04-12</li>
	 <li>[1198705] Medium CVE-2021-21230: Type Confusion in V8. Reported
	 by Manfred Paul on 2021-04-13</li>
	 <li>[1198696] Low CVE-2021-21231: Insufficient data validation in
	 V8. Reported by Sergei Glazunov of Google Project Zero on
	 2021-04-13</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-21227</cvename>
 <cvename>CVE-2021-21228</cvename>
 <cvename>CVE-2021-21229</cvename>
 <cvename>CVE-2021-21230</cvename>
 <cvename>CVE-2021-21231</cvename>
 <cvename>CVE-2021-21232</cvename>
 <cvename>CVE-2021-21233</cvename>
 <url>https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html</url>
 </references>
 <dates>
 <discovery>2021-04-26</discovery>
 <entry>2021-04-27</entry>
 </dates>
 </vuln>

<vuln vid="e4403051-a667-11eb-b9c9-6cc21735f730">
 <topic>sbibboleth-sp -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>shibboleth-sp</name>
	<range>
	 <ge>3.0.0</ge>
	 <lt>3.2.1_1</lt>
	</range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Shibboleth project reports:
 <blockquote cite="https://shibboleth.net/community/advisories/secadv_20210426.txt">
	Session recovery feature contains a null pointer deference.
	
	 The cookie-based session recovery feature added in V3.0 contains a
	 flaw that is exploitable on systems *not* using the feature if a
	 specially crafted cookie is supplied.
	
	
	 This manifests as a crash in the shibd daemon/service process.
	
	
	 Because it is very simple to trigger this condition remotely, it
	 results in a potential denial of service condition exploitable by
	 a remote, unauthenticated attacker.
	
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://shibboleth.net/community/advisories/secadv_20210426.txt</url>
 </references>
 <dates>
 <discovery>2021-04-23</discovery>
 <entry>2021-04-26</entry>
 </dates>
 </vuln>

<vuln vid="bc83cfc9-42cf-4b00-97ad-d352ba0c5e2b">
 <topic>zeek -- null-pointer dereference vulnerability</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>4.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jon Siwek of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v4.0.1">
	 Fix null-pointer dereference when encountering an
	 invalid enum name in a config/input file that tries to
	 read it into a set[enum]. For those that have such an
	 input feed whose contents may come from external/remote
	 sources, this is a potential DoS vulnerability. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v4.0.1</url>
 </references>
 <dates>
 <discovery>2021-04-01</discovery>
 <entry>2021-04-21</entry>
 </dates>
 </vuln>

<vuln vid="efb965be-a2c0-11eb-8956-1951a8617e30">
 <topic>openvpn -- deferred authentication can be bypassed in specific circumstances</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><lt>2.5.2</lt></range>
 </package>
 <package>
	<name>openvpn-mbedtls</name>
	<range><lt>2.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gert Döring reports:
	<blockquote cite="https://community.openvpn.net/openvpn/wiki/CVE-2020-15078">
	 
	 OpenVPN 2.5.1 and earlier versions allows a remote attackers to
	 bypass authentication and access control channel data on servers
	 configured with deferred authentication, which can be used to
	 potentially trigger further information leaks.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://community.openvpn.net/openvpn/wiki/CVE-2020-15078</url>
 <url>https://github.com/OpenVPN/openvpn/blob/release/2.5/Changes.rst#overview-of-changes-in-252</url>
 <cvename>CVE-2020-15078</cvename>
 </references>
 <dates>
 <discovery>2021-03-02</discovery>
 <entry>2021-04-21</entry>
 </dates>
 </vuln>

<vuln vid="cb13a765-a277-11eb-97a0-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>90.0.4430.85</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Reelases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html">
	 This release includes 7 security fixes, including:
	 <ul>
	 <li>1194046] High CVE-2021-21222: Heap buffer overflow in V8.
	 Reported by Guang Gong of Alpha Lab, Qihoo 360 on 2021-03-30</li>
	 <li>[1195308] High CVE-2021-21223: Integer overflow in Mojo.
	 Reported by Guang Gong of Alpha Lab, Qihoo 360 on 2021-04-02</li>
	 <li>[1195777] High CVE-2021-21224: Type Confusion in V8. Reported
	 by Jose Martinez (tr0y4) from VerSprite Inc. on 2021-04-05</li>
	 <li>[1195977] High CVE-2021-21225: Out of bounds memory access in
	 V8. Reported by Brendon Tiszka (@btiszka) supporting the EFF on
	 2021-04-05</li>
	 <li>[1197904] High CVE-2021-21226: Use after free in navigation.
	 Reported by Brendon Tiszka (@btiszka) supporting the EFF on
	 2021-04-11</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-21222</cvename>
 <cvename>CVE-2021-21223</cvename>
 <cvename>CVE-2021-21224</cvename>
 <cvename>CVE-2021-21225</cvename>
 <cvename>CVE-2021-21226</cvename>
 <url>https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html</url>
 </references>
 <dates>
 <discovery>2021-04-20</discovery>
 <entry>2021-04-21</entry>
 </dates>
 </vuln>

<vuln vid="e358b470-b37d-4e47-bc8a-2cd9adbeb63c">
 <topic>jenkins -- Denial of service vulnerability in bundled Jetty</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.286</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.277.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2021-04-20/">
	 <h1>Description</h1>
	 <h5>(High) JENKINS-65280 / CVE-2021-28165</h5>
	 Denial of service vulnerability in bundled Jetty
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.jenkins.io/security/advisory/2021-04-20/</url>
 <cvename>CVE-2021-28165</cvename>
 </references>
 <dates>
 <discovery>2021-04-20</discovery>
 <entry>2021-04-20</entry>
 </dates>
 </vuln>

<vuln vid="56ba4513-a1be-11eb-9072-d4c9ef517024">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.29</lt></range>
 </package>
 <package>
	<name>mariadb104-server</name>
	<range><lt>10.4.19</lt></range>
 </package>
 <package>
	<name>mariadb105-server</name>
	<range><lt>10.5.10</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.52</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.34</lt></range>
 </package>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpuapr2021.html">
	 This Critical Patch Update contains 49 new security patches for
	 Oracle MySQL. 10 of these vulnerabilities may be remotely exploitable
	 without authentication, i.e., may be exploited over a network without
	 requiring user credentials. 
	 The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
	 MySQL is 9.8.
	 MariaDB is affected by CVE-2021-2166 and CVE-2021-2154 only
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/security-alerts/cpuapr2021.html</url>
 <url>https://mariadb.com/kb/en/mariadb-10510-release-notes/</url>
 <cvename>CVE-2020-8277</cvename>
 <cvename>CVE-2020-1971</cvename>
 <cvename>CVE-2021-3449</cvename>
 <cvename>CVE-2020-28196</cvename>
 <cvename>CVE-2021-23841</cvename>
 <cvename>CVE-2021-2144</cvename>
 <cvename>CVE-2021-2172</cvename>
 <cvename>CVE-2021-2298</cvename>
 <cvename>CVE-2021-2178</cvename>
 <cvename>CVE-2021-2202</cvename>
 <cvename>CVE-2021-2307</cvename>
 <cvename>CVE-2021-2304</cvename>
 <cvename>CVE-2021-2180</cvename>
 <cvename>CVE-2021-2194</cvename>
 <cvename>CVE-2021-2154</cvename>
 <cvename>CVE-2021-2166</cvename>
 <cvename>CVE-2021-2196</cvename>
 <cvename>CVE-2021-2300</cvename>
 <cvename>CVE-2021-2305</cvename>
 <cvename>CVE-2021-2179</cvename>
 <cvename>CVE-2021-2226</cvename>
 <cvename>CVE-2021-2160</cvename>
 <cvename>CVE-2021-2164</cvename>
 <cvename>CVE-2021-2169</cvename>
 <cvename>CVE-2021-2170</cvename>
 <cvename>CVE-2021-2193</cvename>
 <cvename>CVE-2021-2203</cvename>
 <cvename>CVE-2021-2212</cvename>
 <cvename>CVE-2021-2213</cvename>
 <cvename>CVE-2021-2278</cvename>
 <cvename>CVE-2021-2299</cvename>
 <cvename>CVE-2021-2230</cvename>
 <cvename>CVE-2021-2146</cvename>
 <cvename>CVE-2021-2201</cvename>
 <cvename>CVE-2021-2208</cvename>
 <cvename>CVE-2021-2215</cvename>
 <cvename>CVE-2021-2217</cvename>
 <cvename>CVE-2021-2293</cvename>
 <cvename>CVE-2021-2174</cvename>
 <cvename>CVE-2021-2171</cvename>
 <cvename>CVE-2021-2162</cvename>
 <cvename>CVE-2021-2301</cvename>
 <cvename>CVE-2021-2308</cvename>
 <cvename>CVE-2021-2232</cvename>
 </references>
 <dates>
 <discovery>2021-04-20</discovery>
 <entry>2021-04-20</entry>
 <modified>2021-05-04</modified>
 </dates>
 </vuln>

<vuln vid="e87c2647-a188-11eb-8806-1c1b0d9ea7e6">
 <topic>All versions of Apache OpenOffice through 4.1.9 can open non-http(s) hyperlinks. If the link is specifically crafted this could lead to untrusted code execution.</topic>
 <affects>
 <package>
 <name>apache-openoffice</name>
 <range><lt>4.1.10</lt></range>
 </package>
 <package>
 <name>apache-openoffice-devel</name>
 <range><lt>4.2.1619649022,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Openofffice project reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30245">
	 The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lead to untrusted code execution. It is always best practice to be careful opening documents from unknown and unverified sources. The mitigation in Apache OpenOffice 4.1.10 (unreleased) assures that a security warning is displayed giving the user the option of continuing to open the hyperlink.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30245</url>
 <cvename>CVE-2021-30245</cvename>
 </references>
 <dates>
 <discovery>2021-01-25</discovery>
 <entry>2021-04-20</entry>
 </dates>
 </vuln>

<vuln vid="20006b5f-a0bc-11eb-8ae6-fc4dd43e2b6a">
 <topic>Apache Maven -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>maven</name>
	<range><lt>3.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Maven project reports:
	<blockquote cite="http://maven.apache.org/docs/3.8.1/release-notes.html#cve-2021-26291">
	 We received a report from Jonathan Leitschuh about a vulnerability
	 of custom repositories in dependency POMs. We've split this up
	 into three separate issues:
	 <ul>
	 <li>Possible Man-In-The-Middle-Attack due to custom repositories
	 using HTTP.

More and more repositories use HTTPS nowadays, but this
	    hasn't always been the case. This means that Maven Central contains
	    POMs with custom repositories that refer to a URL over HTTP. This
	    makes downloads via such repository a target for a MITM attack. At
	    the same time, developers are probably not aware that for some
	    downloads an insecure URL is being used. Because uploaded POMs to
	    Maven Central are immutable, a change for Maven was required. To
	    solve this, we extended the mirror configuration with blocked
	    parameter, and we added a new external:http:* mirror selector (like
	    existing external:*), meaning "any external URL using HTTP".

The decision was made to block such external HTTP repositories by default:
	 this is done by providing a mirror in the conf/settings.xml blocking
	 insecure HTTP external URLs.</li>
	 <li>Possible Domain Hijacking due to custom repositories using abandoned
	 domains

Sonatype has analyzed which domains were abandoned and has claimed these
	 domains.</li>
	 <li>Possible hijacking of downloads by redirecting to custom repositories

This one was the hardest to analyze and explain. The short story is:
	 you're safe, dependencies are only downloaded from repositories within
	 their context. So there are two main questions: what is the context and
	 what is the order? The order is described on the Repository Order page.
	 The first group of repositories are defined in the settings.xml (both user
	 and global). The second group of repositories are based on inheritence,
	 with ultimately the super POM containing the URL to Maven Central. The
	 third group is the most complex one but is important to understand the
	 term context: repositories from the effective POMs from the dependency
	 path to the artifact. So if a dependency was defined by another dependency
	 or by a Maven project, it will also include their repositories. In the end
	 this is not a bug, but a design feature.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://maven.apache.org/docs/3.8.1/release-notes.html#cve-2021-26291</url>
	<cvename>CVE-2021-26291</cvename>
	<cvename>CVE-2020-13956</cvename>
 </references>
 <dates>
 <discovery>2021-04-04</discovery>
 <entry>2021-04-19</entry>
 </dates>
 </vuln>

<vuln vid="093a6baf-9f99-11eb-b150-000c292ee6b8">
 <topic>Consul -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>consul</name>
	<range><lt>1.9.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hashicorp reports:
	<blockquote cite="https://github.com/hashicorp/consul/releases/tag/v1.9.5">
	 Add content-type headers to raw KV responses to prevent XSS attacks
	 (CVE-2020-25864). audit-logging: Parse endpoint URL to prevent
	 requests from bypassing the audit log (CVE-2021-28156).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/hashicorp/consul/releases/tag/v1.9.5</url>
 <cvename>CVE-2020-25864</cvename>
 <cvename>CVE-2021-28156</cvename>
 </references>
 <dates>
 <discovery>2021-04-15</discovery>
 <entry>2021-04-17</entry>
 </dates>
 </vuln>

<vuln vid="75aae50b-9e3c-11eb-9bc3-8c164582fbac">
 <topic>AccountsService -- Insufficient path check in user_change_icon_file_authorized_cb()</topic>
 <affects>
 <package>
	<name>accountsservice</name>
	<range><lt>0.6.50</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-14036">
	 
	 Directory Traversal with ../ sequences occurs in AccountsService
	 before 0.6.50 because of an insufficient path check in
	 user_change_icon_file_authorized_cb() in user.c.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2018/07/02/2</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2018-14036</url>
 <url>https://www.securityfocus.com/bid/104757</url>
 <url>https://bugs.freedesktop.org/show_bug.cgi?id=107085</url>
 <url>https://bugzilla.suse.com/show_bug.cgi?id=1099699</url>
 <url>https://cgit.freedesktop.org/accountsservice/commit/?id=f9abd359f71a5bce421b9ae23432f539a067847a</url>
 <cvename>CVE-2018-14036</cvename>
 </references>
 <dates>
 <discovery>2018-07-13</discovery>
 <entry>2021-04-15</entry>
 </dates>
 </vuln>

<vuln vid="40b481a9-9df7-11eb-9bc3-8c164582fbac">
 <topic>mdbook -- XSS in mdBook's search page</topic>
 <affects>
 <package>
	<name>mdbook</name>
	<range><lt>0.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Rust Security Response Working Group reports:
	<blockquote cite="https://github.com/rust-lang/mdBook/security/advisories/GHSA-gx5w-rrhp-f436">
	 
	 The search feature of mdBook (introduced in version 0.1.4) was
	 affected by a cross site scripting vulnerability that allowed an
	 attacker to execute arbitrary JavaScript code on an user's browser
	 by tricking the user into typing a malicious search query, or
	 tricking the user into clicking a link to the search page with the
	 malicious search query prefilled.

mdBook 0.4.5 fixes the vulnerability by properly escaping the search
	 query.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/rust-lang/mdBook/blob/master/CHANGELOG.md#mdbook-045</url>
 <url>https://github.com/rust-lang/mdBook/commit/32abeef088e98327ca0dfccdad92e84afa9d2e9b</url>
 <url>https://github.com/rust-lang/mdBook/security/advisories/GHSA-gx5w-rrhp-f436</url>
 <url>https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0?pli=1</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-26297</url>
 <cvename>CVE-2020-26297</cvename>
 </references>
 <dates>
 <discovery>2021-04-01</discovery>
 <entry>2021-04-15</entry>
 </dates>
 </vuln>

<vuln vid="fb6e53ae-9df6-11eb-ba8c-001b217b3468">
 <topic>Gitlab -- Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.10.0</ge><lt>13.10.3</lt></range>
	<range><ge>13.9.0</ge><lt>13.9.6</lt></range>
	<range><ge>7.12</ge><lt>13.8.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab Team reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/">
	 Remote code execution when uploading specially crafted image files
	 Update Rexml
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/</url>
 <cvename>CVE-2021-28965</cvename>
 </references>
 <dates>
 <discovery>2021-04-14</discovery>
 <entry>2021-04-15</entry>
 </dates>
 </vuln>

<vuln vid="f3d86439-9def-11eb-97a0-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>90.0.4430.72</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html">
	 This release contains 37 security fixes, including:
	 <ul>
	 <li>[1025683] High CVE-2021-21201: Use after free in permissions.
	 Reported by Gengming Liu, Jianyu Chen at Tencent Keen Security
	 Lab on 2019-11-18</li>
	 <li>[1188889] High CVE-2021-21202: Use after free in extensions.
	 Reported by David Erceg on 2021-03-16</li>
	 <li>[1192054] High CVE-2021-21203: Use after free in Blink.
	 Reported by asnine on 2021-03-24</li>
	 <li>[1189926] High CVE-2021-21204: Use after free in Blink.
	 Reported by Chelse Tsai-Simek, Jeanette Ulloa, and Emily
	 Voigtlander of Seesaw on 2021-03-19</li>
	 <li>[1165654] High CVE-2021-21205: Insufficient policy enforcement
	 in navigation. Reported by Alison Huffman, Microsoft Browser
	 Vulnerability Research on 2021-01-12</li>
	 <li>[1195333] High CVE-2021-21221: Insufficient validation of
	 untrusted input in Mojo. Reported by Guang Gong of Alpha Lab,
	 Qihoo 360 on 2021-04-02</li>
	 <li>[1185732] Medium CVE-2021-21207: Use after free in IndexedDB.
	 Reported by koocola (@alo_cook) and Nan Wang (@eternalsakura13)
	 of 360 Alpha Lab on 2021-03-08</li>
	 <li>[1039539] Medium CVE-2021-21208: Insufficient data validation
	 in QR scanner. Reported by Ahmed Elsobky (@0xsobky) on
	 2020-01-07</li>
	 <li>[1143526] Medium CVE-2021-21209: Inappropriate implementation
	 in storage. Reported by Tom Van Goethem (@tomvangoethem) on
	 2020-10-29</li>
	 <li>[1184562] Medium CVE-2021-21210: Inappropriate implementation
	 in Network. Reported by @bananabr on 2021-03-04</li>
	 <li>[1103119] Medium CVE-2021-21211: Inappropriate implementation
	 in Navigation. Reported by Akash Labade (m0ns7er) on
	 2020-07-08</li>
	 <li>[1145024] Medium CVE-2021-21212: Incorrect security UI in
	 Network Config UI. Reported by Hugo Hue and Sze Yiu Chau of the
	 Chinese University of Hong Kong on 2020-11-03</li>
	 <li>[1161806] Medium CVE-2021-21213: Use after free in WebMIDI.
	 Reported by raven (@raid_akame) on 2020-12-25</li>
	 <li>[1170148] Medium CVE-2021-21214: Use after free in Network API.
	 Reported by Anonymous on 2021-01-24</li>
	 <li>[1172533] Medium CVE-2021-21215: Inappropriate implementation
	 in Autofill. Reported by Abdulrahman Alqabandi, Microsoft Browser
	 Vulnerability Research on 2021-01-30</li>
	 <li>[1173297] Medium CVE-2021-21216: Inappropriate implementation
	 in Autofill. Reported by Abdulrahman Alqabandi, Microsoft Browser
	 Vulnerability Research on 2021-02-02</li>
	 <li>[1166462] Low CVE-2021-21217: Uninitialized Use in PDFium.
	 Reported by Zhou Aiting (@zhouat1) of Qihoo 360 Vulcan Team on
	 2021-01-14</li>
	 <li>[1166478] Low CVE-2021-21218: Uninitialized Use in PDFium.
	 Reported by Zhou Aiting (@zhouat1) of Qihoo 360 Vulcan Team on
	 2021-01-14</li>
	 <li>[1166972] Low CVE-2021-21219: Uninitialized Use in PDFium.
	 Reported by Zhou Aiting (@zhouat1) of Qihoo 360 Vulcan Team on
	 2021-01-15</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-21201</cvename>
 <cvename>CVE-2021-21202</cvename>
 <cvename>CVE-2021-21203</cvename>
 <cvename>CVE-2021-21204</cvename>
 <cvename>CVE-2021-21205</cvename>
 <cvename>CVE-2021-21221</cvename>
 <cvename>CVE-2021-21207</cvename>
 <cvename>CVE-2021-21208</cvename>
 <cvename>CVE-2021-21209</cvename>
 <cvename>CVE-2021-21210</cvename>
 <cvename>CVE-2021-21211</cvename>
 <cvename>CVE-2021-21212</cvename>
 <cvename>CVE-2021-21213</cvename>
 <cvename>CVE-2021-21214</cvename>
 <cvename>CVE-2021-21215</cvename>
 <cvename>CVE-2021-21216</cvename>
 <cvename>CVE-2021-21217</cvename>
 <cvename>CVE-2021-21218</cvename>
 <cvename>CVE-2021-21219</cvename>
 <url>https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html</url>
 </references>
 <dates>
 <discovery>2021-04-14</discovery>
 <entry>2021-04-15</entry>
 </dates>
 </vuln>

<vuln vid="7c0d71a9-9d48-11eb-97a0-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>89.0.4389.128</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop.html">
	 This release contains two security fixes:
	 <ul>
	 <li>[1196781] High CVE-2021-21206: Use after free in Blink. Reported
	 by Anonymous on 2021-04-07</li>
	 <li>[1196683] High CVE-2021-21220: Insufficient validation of
	 untrusted input in V8 for x86_64. Reported by Bruno Keith (@bkth_)
	 and Niklas Baumstark (@_niklasb) of Dataflow Security (@dfsec_it)
	 via ZDI (ZDI-CAN-13569) on 2021-04-07&gt;</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-21206</cvename>
 <cvename>CVE-2021-21220</cvename>
 <url>https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2021-04-13</discovery>
 <entry>2021-04-14</entry>
 </dates>
 </vuln>

<vuln vid="465db5b6-9c6d-11eb-8e8a-bc542f4bd1dd">
 <topic>xorg-server -- Input validation failures in X server XInput extension</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<range><lt>1.20.11,1</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>1.20.11,1</lt></range>
 </package>
 <package>
	<name>xwayland-devel</name>
	<range><le>1.20.0.877</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	X.Org server security reports for release 1.20.11:
	<blockquote cite="https://lists.x.org/archives/xorg/2021-April/060678.html">
	 <ul>
	 <li>Fix XChangeFeedbackControl() request underflow</li>
	 </ul>
	 .
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://gitlab.freedesktop.org/xorg/xserver/-/tags/xorg-server-1.20.11</url>
 </references>
 <dates>
 <discovery>2021-04-13</discovery>
 <entry>2021-04-13</entry>
 </dates>
 </vuln>

<vuln vid="094fb2ec-9aa3-11eb-83cb-0800278d94f0">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.14.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.14.0:
	<blockquote cite="https://blog.gitea.io/2021/04/gitea-1.14.0-is-released/">
	 <ul>
	 <li>Validate email in external authenticator registration form</li>
	 <li>Ensure validation occurs on clone addresses too</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.14.0</url>
 <freebsdpr>ports/254976</freebsdpr>
 </references>
 <dates>
 <discovery>2021-03-11</discovery>
 <entry>2021-04-11</entry>
 </dates>
 </vuln>

<vuln vid="9ee01e60-6045-43df-98e5-a794007e54ef">
 <topic>syncthing -- crash due to malformed relay protocol message</topic>
 <affects>
 <package>
	<name>syncthing</name>
	<range><lt>1.15.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	syncthing developers report:
	<blockquote cite="https://github.com/syncthing/syncthing/security/advisories/GHSA-x462-89pf-6r5h">
	 syncthing can be caused to crash and exit if sent a malformed relay protocol
	 message message with a negative length field.
	 The relay server strelaysrv can be caused to crash and exit if sent a malformed
	 relay protocol message with a negative length field.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-21404</cvename>
 <url>https://github.com/syncthing/syncthing/security/advisories/GHSA-x462-89pf-6r5h</url>
 </references>
 <dates>
 <discovery>2021-04-06</discovery>
 <entry>2021-04-12</entry>
 </dates>
 </vuln>

<vuln vid="f671c282-95ef-11eb-9c34-080027f515ea">
 <topic>python -- Information disclosure via pydoc -p: /getfile?key=path allows to read arbitrary file on the filesystem</topic>
 <affects>
 <package>
	<name>python38</name>
	<range><lt>3.8.9</lt></range>
 </package>
 <package>
	<name>python39</name>
	<range><lt>3.9.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	David Schwörer reports:
	<blockquote cite="https://pythoninsider.blogspot.com/2021/04/python-393-and-389-are-now-available.html">
	 
	 Remove the getfile feature of the pydoc module which could be
	 abused to read arbitrary files on the disk (directory traversal
	 vulnerability). Moreover, even source code of Python modules
	 can contain sensitive data like passwords.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-3426</cvename>
 <url>https://pythoninsider.blogspot.com/2021/04/python-393-and-389-are-now-available.html</url>
 <url>https://bugs.python.org/issue42988</url>
 </references>
 <dates>
 <discovery>2021-01-21</discovery>
 <entry>2021-04-10</entry>
 </dates>
 </vuln>

<vuln vid="d10fc771-958f-11eb-9c34-080027f515ea">
 <topic>curl -- TLS 1.3 session ticket proxy host mixup</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.63.0</ge><lt>7.76.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Daniel Stenberg reports:
	<blockquote cite="https://curl.se/docs/CVE-2021-22890.html">
	 
	 Enabled by default, libcurl supports the use of TLS 1.3 session
	 tickets to resume previous TLS sessions to speed up subsequent
	 TLS handshakes.
	 
	 
	 When using a HTTPS proxy and TLS 1.3, libcurl can confuse session
	 tickets arriving from the HTTPS proxy but work as if they arrived
	 from the remote server and then wrongly "short-cut" the host
	 handshake. The reason for this confusion is the modified sequence
	 from TLS 1.2 when the session ids would provided only during the
	 TLS handshake, while in TLS 1.3 it happens post hand-shake and
	 the code was not updated to take that changed behavior into account.
	 
	 
	 When confusing the tickets, a HTTPS proxy can trick libcurl to use
	 the wrong session ticket resume for the host and thereby circumvent
	 the server TLS certificate check and make a MITM attack to be
	 possible to perform unnoticed.
	 
	 
	 This flaw can allow a malicious HTTPS proxy to MITM the traffic.
	 Such a malicious HTTPS proxy needs to provide a certificate that
	 curl will accept for the MITMed server for an attack to work -
	 unless curl has been told to ignore the server certificate check.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-22890</cvename>
 <url>https://curl.se/docs/CVE-2021-22890.html</url>
 </references>
 <dates>
 <discovery>2021-03-31</discovery>
 <entry>2021-04-10</entry>
 </dates>
 </vuln>

<vuln vid="b1194286-958e-11eb-9c34-080027f515ea">
 <topic>curl -- Automatic referer leaks credentials</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.1.1</ge><lt>7.76.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Daniel Stenberg reports:
	<blockquote cite="https://curl.se/docs/CVE-2021-22876.html">
	 
	 libcurl does not strip off user credentials from the URL when
	 automatically populating the Referer: HTTP request header field
	 in outgoing HTTP requests, and therefore risks leaking sensitive
	 data to the server that is the target of the second HTTP request.
	 
	 
	 libcurl automatically sets the Referer: HTTP request header field
	 in outgoing HTTP requests if the CURLOPT_AUTOREFERER option is set.
	 With the curl tool, it is enabled with --referer ";auto".
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-22876</cvename>
 <url>https://curl.se/docs/CVE-2021-22876.html</url>
 </references>
 <dates>
 <discovery>2021-03-31</discovery>
 <entry>2021-04-10</entry>
 </dates>
 </vuln>

<vuln vid="8ba23a62-997d-11eb-9f0e-0800278d94f0">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.13.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.13.7:
	<blockquote cite="https://blog.gitea.io/2021/04/gitea-1.13.7-is-released/">
	 <ul>
	 <li>Update to bluemonday-1.0.6</li>
	 <li>Clusterfuzz found another way</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.13.7</url>
 <freebsdpr>ports/254930</freebsdpr>
 </references>
 <dates>
 <discovery>2021-04-07</discovery>
 <entry>2021-04-09</entry>
 </dates>
 </vuln>

<vuln vid="9ae2c00f-97d0-11eb-8cd6-080027f515ea">
 <topic>clamav -- Multiple vulnerabilites</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.103.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Micah Snyder reports:
	<blockquote cite="https://blog.clamav.net/2021/04/clamav-01032-security-patch-release.html">
	 <dl>
	 <dt>CVE-2021-1252</dt>
	 <dd>Excel XLM parser infinite loop</dd>
	 <dt>CVE-2021-1404</dt>
	 <dd>PDF parser buffer over-read; possible crash. </dd>
	 <dt>CVE-2021-1405</dt>
	 <dd>Mail parser NULL-dereference crash. </dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-1252</cvename>
 <cvename>CVE-2021-1404</cvename>
 <cvename>CVE-2021-1405</cvename>
 <url>https://blog.clamav.net/2021/04/clamav-01032-security-patch-release.html</url>
 </references>
 <dates>
 <discovery>2021-04-07</discovery>
 <entry>2021-04-07</entry>
 </dates>
 </vuln>

<vuln vid="9595d002-edeb-4602-be2d-791cd654247e">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.287</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.277.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2021-04-07/">
	 <h1>Description</h1>
	 <h5>(Low) SECURITY-1721 / CVE-2021-21639</h5>
	 Lack of type validation in agent related REST API
	 <h5>(Medium) SECURITY-1871 / CVE-2021-21640</h5>
	 View name validation bypass
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.jenkins.io/security/advisory/2021-04-07/</url>
 </references>
 <dates>
 <discovery>2021-04-07</discovery>
 <entry>2021-04-08</entry>
 </dates>
 </vuln>

<vuln vid="c0c1834c-9761-11eb-acfd-0022489ad614">
 <topic>Node.js -- April 2021 Security Releases</topic>
 <affects>
 <package>
	<name>node10</name>
	<range><lt>10.24.1</lt></range>
 </package>
 <package>
	<name>node12</name>
	<range><lt>12.22.1</lt></range>
 </package>
 <package>
	<name>node14</name>
	<range><lt>14.16.1</lt></range>
 </package>
 <package>
	<name>node</name>
	<range><lt>15.14.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/">
	 <h1>OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450)</h1>
	 This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
	 <h1>OpenSSL - NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449)</h1>
	 This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
	 <h1>npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)</h1>
	 This is a vulnerability in the y18n npm module which may be exploited by prototype pollution. You can read more about it in https://github.com/advisories/GHSA-c4w7-xm78-47vh
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/</url>
 <url>https://www.openssl.org/news/secadv/20210325.txt</url>
 <url>https://github.com/advisories/GHSA-c4w7-xm78-47vh</url>
 <cvename>CVE-2021-3450</cvename>
 <cvename>CVE-2021-3449</cvename>
 <cvename>CVE-2020-7774</cvename>
 </references>
 <dates>
 <discovery>2021-04-06</discovery>
 <entry>2021-04-07</entry>
 </dates>
 </vuln>

<vuln vid="a7b97d26-9792-11eb-b87a-901b0ef719ab">
 <topic>FreeBSD -- jail escape possible by mounting over jail root</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.2</ge><lt>12.2_6</lt></range>
	<range><ge>11.4</ge><lt>11.4_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to a race condition between lookup of ".." and remounting a filesystem,
	a process running inside a jail might access filesystem hierarchy outside
	of jail.
	<h1>Impact:</h1>
	A process with superuser privileges running inside a jail configured
	with the allow.mount permission (not enabled by default) could change the root
	directory outside of the jail, and thus gain full read and write access
	to all files and directories in the system.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-25584</cvename>
 <freebsdsa>SA-21:10.jail_mount</freebsdsa>
 </references>
 <dates>
 <discovery>2021-04-06</discovery>
 <entry>2021-04-07</entry>
 </dates>
 </vuln>

<vuln vid="f8e1e2a6-9791-11eb-b87a-901b0ef719ab">
 <topic>FreeBSD -- double free in accept_filter(9) socket configuration interface</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.2</ge><lt>12.2_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	An unprivileged process can configure an accept filter on a listening
	socket. This is done using the setsockopt(2) system call. The process
	supplies the name of the accept filter which is to be attached to the
	socket, as well as a string containing filter-specific information.
	If the filter implements the accf_create callback, the socket option
	handler attempts to preserve the process-supplied argument string. A
	bug in the socket option handler caused this string to be freed
	prematurely, leaving a dangling pointer. Additional operations on the
	socket can turn this into a double free or a use-after-free.
	<h1>Impact:</h1>
	The bug may be exploited to trigger local privilege escalation or
	kernel memory disclosure.
 </body>
 </description>
 <references>
 <cvename>CVE-2021-29627</cvename>
 <freebsdsa>SA-21:09.accept_filter</freebsdsa>
 </references>
 <dates>
 <discovery>2021-04-06</discovery>
 <entry>2021-04-07</entry>
 </dates>
 </vuln>

<vuln vid="13d37672-9791-11eb-b87a-901b0ef719ab">
 <topic>FreeBSD -- Memory disclosure by stale virtual memory mapping</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.2</ge><lt>12.2_6</lt></range>
	<range><ge>11.4</ge><lt>11.4_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A particular case of memory sharing is mishandled in the virtual memory
	system. It is possible and legal to establish a relationship where
	multiple descendant processes share a mapping which shadows memory of an
	ancestor process. In this scenario, when one process modifies memory
	through such a mapping, the copy-on-write logic fails to invalidate
	other mappings of the source page. These stale mappings may remain even
	after the mapped pages have been reused for another purpose.
	<h1>Impact:</h1>
	An unprivileged local user process can maintain a mapping of a page
	after it is freed, allowing that process to read private data belonging
	to other processes or the kernel.
 </body>
 </description>
 <references>
 <cvename>CVE-2021-29626</cvename>
 <freebsdsa>SA-21:08.vm</freebsdsa>
 </references>
 <dates>
 <discovery>2021-04-06</discovery>
 <entry>2021-04-07</entry>
 </dates>
 </vuln>

<vuln vid="79fa9f23-9725-11eb-b530-7085c2fb2c14">
 <topic>upnp -- stack overflow vulnerability</topic>
 <affects>
 <package>
	<name>upnp</name>
	<range><lt>1.14.5,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28302">
	 
	 A stack overflow in pupnp 1.16.1 can cause the denial of service through the
	 Parser_parseDocument() function. ixmlNode_free() will release a child node
	 recursively, which will consume stack space and lead to a crash.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-28302</cvename>
 <url>https://github.com/pupnp/pupnp/issues/249</url>
 </references>
 <dates>
 <discovery>2021-03-12</discovery>
 <entry>2021-04-06</entry>
 </dates>
 </vuln>

<vuln vid="dec7e4b6-961a-11eb-9c34-080027f515ea">
 <topic>ruby -- XML round-trip vulnerability in REXML</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>2.5.0,1</ge><lt>2.5.9,1</lt></range>
	<range><ge>2.6.0,1</ge><lt>2.6.7,1</lt></range>
	<range><ge>2.7.0,1</ge><lt>2.7.3,1</lt></range>
	<range><ge>3.0.0.p1,1</ge><lt>3.0.1,1</lt></range>
 </package>
 <package>
	<name>rubygem-rexml</name>
	<range><lt>3.2.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Juho Nurminen reports:
	<blockquote cite="https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/">
	 
	 When parsing and serializing a crafted XML document, REXML gem
	 (including the one bundled with Ruby) can create a wrong XML
	 document whose structure is different from the original one.
	 The impact of this issue highly depends on context, but it may
	 lead to a vulnerability in some programs that are using REXML.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-28965</cvename>
 <url>https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/</url>
 </references>
 <dates>
 <discovery>2021-04-05</discovery>
 <entry>2021-04-05</entry>
 </dates>
 </vuln>

<vuln vid="bddadaa4-9227-11eb-99c5-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>89.0.4389.114</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html">
	 This update contains 8 security fixes, including:
	 <ul>
	 <li>[1181228] High CVE-2021-21194: Use after free in screen capture.
	 Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2021-02-23</li>
	 <li>[1182647] High CVE-2021-21195: Use after free in V8.
	 Reported by Bohan Liu (@P4nda20371774) and Moon Liang of Tencent
	 Security Xuanwu Lab on 2021-02-26</li>
	 <li>[1175992] High CVE-2021-21196: Heap buffer overflow in
	 TabStrip. Reported by Khalil Zhani on 2021-02-08</li>
	 <li>[1173903] High CVE-2021-21197: Heap buffer overflow in
	 TabStrip. Reported by Abdulrahman Alqabandi, Microsoft Browser
	 Vulnerability Research on 2021-02-03</li>
	 <li>[1184399] High CVE-2021-21198: Out of bounds read in IPC.
	 Reported by Mark Brand of Google Project Zero on 2021-03-03</li>
	 <li>[1179635] High CVE-2021-21199: Use Use after free in Aura.
	 Reported by Weipeng Jiang (@Krace) from Codesafe Team of
	 Legendsec at Qi'anxin Group and Evangelos Foutras</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-21194</cvename>
 <cvename>CVE-2021-21195</cvename>
 <cvename>CVE-2021-21196</cvename>
 <cvename>CVE-2021-21197</cvename>
 <cvename>CVE-2021-21198</cvename>
 <cvename>CVE-2021-21199</cvename>
 <url>https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html</url>
 </references>
 <dates>
 <discovery>2021-03-31</discovery>
 <entry>2021-03-31</entry>
 </dates>
 </vuln>

<vuln vid="56abf87b-96ad-11eb-a218-001b217b3468">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.10.0</ge><lt>13.10.1</lt></range>
	<range><ge>13.9.0</ge><lt>13.9.5</lt></range>
	<range><ge>9</ge><lt>13.8.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/03/31/security-release-gitlab-13-10-1-released/">
	 Arbitrary File Read During Project Import
	 Kroki Arbitrary File Read/Write
	 Stored Cross-Site-Scripting in merge requests
	 Access data of an internal project through a public project fork as an anonymous user
	 Incident metric images can be deleted by any user
	 Infinite Loop When a User Access a Merge Request
	 Stored XSS in scoped labels
	 Admin CSRF in System Hooks Execution Through API
	 Update OpenSSL dependency
	 Update PostgreSQL dependency
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2021/03/31/security-release-gitlab-13-10-1-released/</url>
 </references>
 <dates>
 <discovery>2021-03-31</discovery>
 <entry>2021-04-06</entry>
 </dates>
 </vuln>

<vuln vid="1f6d97da-8f72-11eb-b3f1-005056a311d1">
 <topic>samba -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>samba411</name>
	<range><le>4.11.15</le></range>
 </package>
 <package>
	<name>samba412</name>
	<range><lt>4.12.14</lt></range>
 </package>
 <package>
	<name>samba413</name>
	<range><lt>4.13.7</lt></range>
 </package>
 <package>
	<name>samba414</name>
	<range><lt>4.14.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="https://www.samba.org/samba/history/security.html">
	 <ul>
	 <li>CVE-2020-27840: An anonymous attacker can crash the Samba AD DC
		LDAP server by sending easily crafted DNs as
		part of a bind request. More serious heap corruption
		is likely also possible.</li>
	 <li>CVE-2021-20277: User-controlled LDAP filter strings against
		the AD DC LDAP server may crash the LDAP server.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/security/CVE-2020-27840.html</url>
 <url>https://www.samba.org/samba/security/CVE-2021-20277.html</url>
 <cvename>CVE-2020-27840</cvename>
 <cvename>CVE-2021-20277</cvename>
 </references>
 <dates>
 <discovery>2021-03-24</discovery>
 <entry>2021-03-28</entry>
 </dates>
 </vuln>

<vuln vid="80f9dbd3-8eec-11eb-b9e8-3525f51429a0">
 <topic>nettle 3.7.2 -- fix serious ECDSA signature verify bug</topic>
 <affects>
 <package>
	<name>nettle</name>
	<range><lt>3.7.2</lt></range>
 </package>
 <package>
	<name>linux-c7-nettle</name>
	<range><lt>3.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Niels Möller reports:
	<blockquote cite="https://lists.lysator.liu.se/pipermail/nettle-bugs/2021/009458.html">
	 
	 I've prepared a new bug-fix release of Nettle, a low-level
	 cryptographics library, to fix a serious bug in the function to
	 verify ECDSA signatures. Implications include an assertion failure,
	 which could be used for denial-of-service, when verifying signatures
	 on the secp_224r1 and secp521_r1 curves.
	 
	 
	 Even when no assert is triggered in ecdsa_verify, ECC point
	 multiplication may get invalid intermediate values as input, and
	 produce incorrect results. [...] It appears difficult to construct
	 an alleged signature that makes the function misbehave in such a way
	 that an invalid signature is accepted as valid, but such attacks
	 can't be ruled out without further analysis.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.lysator.liu.se/pipermail/nettle-bugs/2021/009458.html</url>
 </references>
 <dates>
 <discovery>2021-03-21</discovery>
 <entry>2021-03-27</entry>
 </dates>
 </vuln>

<vuln vid="5a668ab3-8d86-11eb-b8d6-d4c9ef517024">
 <topic>OpenSSL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.1.1k,1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.2</ge><lt>12.2_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20210325.txt">
	 High: CA certificate check bypass with X509_V_FLAG_X509_STRICT
	 (CVE-2021-3450) The X509_V_FLAG_X509_STRICT flag enables
	 additional security checks of the certificates present in a
	 certificate chain. It is not set by default.
	 High: NULL pointer deref in signature_algorithms processing
	 (CVE-2021-3449) An OpenSSL TLS server may crash if sent a
	 maliciously crafted renegotiation ClientHello message from a client.
	 If a TLSv1.2 renegotiation ClientHello omits the
	 signature_algorithms extension (where it was present in the initial
	 ClientHello), but includes a signature_algorithms_cert extension
	 then a NULL pointer dereference will result, leading to a crash and
	 a denial of service attack.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20210325.txt</url>
 <cvename>CVE-2021-3449</cvename>
 <cvename>CVE-2021-3450</cvename>
 <freebsdsa>SA-21:07.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2021-03-25</discovery>
 <entry>2021-03-26</entry>
 <modified>2021-04-07</modified>
 </dates>
 </vuln>

<vuln vid="ec04f3d0-8cd9-11eb-bb9f-206a8a720317">
 <topic>spamassassin -- Malicious rule configuration (.cf) files can be configured to run system commands</topic>
 <affects>
 <package>
	<name>spamassassin</name>
	<range><lt>3.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache SpamAssassin project reports:
	<blockquote cite="https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202103.mbox/%3C5b7cfd35-27b7-584b-1b39-b7ff0a55f586%40apache.org%3E">
	 Apache SpamAssassin 3.4.5 was recently released [1], and fixes
	 an issue of security note where malicious rule configuration (.cf)
	 files can be configured to run system commands.
	 In Apache SpamAssassin before 3.4.5, exploits can be injected in
	 a number of scenarios. In addition to upgrading to SA 3.4.5,
	 users should only use update channels or 3rd party .cf files from
	 trusted places.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://spamassassin.apache.org/news.html</url>
 <url>https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202103.mbox/%3C5b7cfd35-27b7-584b-1b39-b7ff0a55f586%40apache.org%3E</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-1946</url>
 <cvename>CVE-2020-1946</cvename>
 </references>
 <dates>
 <discovery>2021-03-24</discovery>
 <entry>2021-03-24</entry>
 </dates>
 </vuln>

<vuln vid="c4d2f950-8c27-11eb-a3ae-0800278d94f0">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.13.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.13.6:
	<blockquote cite="https://blog.gitea.io/2021/03/gitea-1.13.6-is-released/">
	 <ul>
	 <li>Fix bug on avatar middleware</li>
	 <li>Fix another clusterfuzz identified issue</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.13.5</url>
 <freebsdpr>ports/254515</freebsdpr>
 </references>
 <dates>
 <discovery>2021-03-21</discovery>
 <entry>2021-03-23</entry>
 </dates>
 </vuln>

<vuln vid="1431a25c-8a70-11eb-bd16-0800278d94f0">
 <topic>gitea -- quoting in markdown text</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.13.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.13.5:
	<blockquote cite="https://blog.gitea.io/2021/03/gitea-1.13.5-is-released/">
	 <ul>
	 <li>Update to goldmark 1.3.3</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.13.5</url>
 <freebsdpr>ports/254130</freebsdpr>
 </references>
 <dates>
 <discovery>2021-03-20</discovery>
 <entry>2021-03-21</entry>
 </dates>
 </vuln>

<vuln vid="76b5068c-8436-11eb-9469-080027f515ea">
 <topic>OpenSSH -- Double-free memory corruption in ssh-agent</topic>
 <affects>
 <package>
	<name>openssh-portable</name>
	<name>openssh-portable-hpn</name>
	<name>openssh-portable-gssapi</name>
	<range><ge>8.2.p1,1</ge><lt>8.4.p1_4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenBSD Project reports:
	<blockquote cite="https://www.openssh.com/txt/release-8.5">
	 
	 ssh-agent(1): fixed a double-free memory corruption that was
	 introduced in OpenSSH 8.2 . We treat all such memory faults as
	 potentially exploitable. This bug could be reached by an attacker
	 with access to the agent socket.
	 
	 
	 On modern operating systems where the OS can provide information
	 about the user identity connected to a socket, OpenSSH ssh-agent
	 and sshd limit agent socket access only to the originating user
	 and root. Additional mitigation may be afforded by the system's
	 malloc(3)/free(3) implementation, if it detects double-free
	 conditions.
	 
	 
	 The most likely scenario for exploitation is a user forwarding an
	 agent either to an account shared with a malicious user or to a
	 host with an attacker holding root access.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-28041</cvename>
 <url>https://www.openssh.com/txt/release-8.5</url>
 </references>
 <dates>
 <discovery>2021-03-03</discovery>
 <entry>2021-03-13</entry>
 <modified>2021-04-20</modified>
 </dates>
 </vuln>

<vuln vid="50e59056-87f2-11eb-b6a2-001b217b3468">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.9.0</ge><lt>13.9.4</lt></range>
	<range><ge>13.8.0</ge><lt>13.8.6</lt></range>
	<range><ge>13.2.0</ge><lt>13.7.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gigtlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4-released/">
	 Remote code execution via unsafe user-controlled markdown rendering options
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4-released/</url>
 </references>
 <dates>
 <discovery>2021-03-17</discovery>
 <entry>2021-03-18</entry>
 </dates>
 </vuln>

<vuln vid="5b72b1ff-877c-11eb-bd4f-2f1d57dafe46">
 <topic>dnsmasq -- cache poisoning vulnerability in certain configurations</topic>
 <affects>
 <package>
	<name>dnsmasq</name>
	<range><lt>2.85.r1,1</lt></range>
 </package>
 <package>
	<name>dnsmasq-devel</name>
	<range><lt>2.85.r1,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Kelley reports:
	<blockquote cite="https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014835.html">
	 
	 [In configurations where the forwarding server address contains an @
	 character for specifying a sending interface or source address, the]
	 random source port behavior was disabled, making cache poisoning
	 attacks possible.
	 
	</blockquote>
	
	 This only affects configurations of the form server=1.1.1.1@em0 or
	 server=1.1.1.1@192.0.2.1, i. e. those that specify an interface to
	 send through, or an IP address to send from, or use together with
	 NetworkManager.
	
 </body>
 </description>
 <references>
 <url>https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014835.html</url>
 <cvename>CVE-2021-3448</cvename>
 </references>
 <dates>
 <discovery>2021-03-17</discovery>
 <entry>2021-03-18</entry>
 </dates>
 </vuln>

<vuln vid="b073677f-253a-41f9-bf2b-2d16072a25f6">
 <topic>minio -- MITM attack</topic>
 <affects>
 <package>
	<name>minio</name>
	<range><lt>2021.03.17.02.33.02</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	minio developer report:
	<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-xr7r-7gpj-5pgp">
	 
	 This is a security issue because it enables MITM modification of
	 request bodies that are meant to have integrity guaranteed by chunk
	 signatures.
	 
	 
	 In a PUT request using aws-chunked encoding, MinIO ordinarily
	 verifies signatures at the end of a chunk. This check can be skipped
	 if the client sends a false chunk size that is much greater than the
	 actual data sent: the server accepts and completes the request
	 without ever reaching the end of the chunk + thereby without ever
	 checking the chunk signature.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/minio/minio/security/advisories/GHSA-xr7r-7gpj-5pgp</url>
 </references>
 <dates>
 <discovery>2021-03-17</discovery>
 <entry>2021-03-17</entry>
 </dates>
 </vuln>

<vuln vid="eeca52dc-866c-11eb-b8d6-d4c9ef517024">
 <topic>LibreSSL -- use-after-free</topic>
 <affects>
 <package>
	<name>libressl</name>
	<range><lt>3.2.4_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenBSD reports:
	<blockquote cite="https://marc.info/?l=openbsd-announce&amp;m=161582456312832&amp;w=2">
	 A TLS client using session resumption may cause a use-after-free.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://marc.info/?l=openbsd-announce&amp;m=161582456312832&amp;w=2</url>
 <url>https://ftp.openbsd.org/pub/OpenBSD/patches/6.8/common/017_libssl.patch.sig</url>
 </references>
 <dates>
 <discovery>2021-03-15</discovery>
 <entry>2021-03-16</entry>
 </dates>
 </vuln>

<vuln vid="b81ad6d6-8633-11eb-99c5-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>89.0.4389.90</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html">
	 This release includes 5 security fixes, including:
	 <ul>
	 <li>[1167357] High CVE-2021-21191: Use after free in WebRTC.
	 Reported by raven (@raid_akame) on 2021-01-15</li>
	 <li>[1181387] High CVE-2021-21192: Heap buffer overflow in tab
	 groups. Reported by Abdulrahman Alqabandi, Microsoft Browser
	 Vulnerability Research on 2021-02-23</li>
	 <li>[1186287] High CVE-2021-21193: Use after free in Blink.
	 Reported by Anonymous on 2021-03-09</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-11191</cvename>
 <cvename>CVE-2021-11192</cvename>
 <cvename>CVE-2021-11193</cvename>
 <url>https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html</url>
 </references>
 <dates>
 <discovery>2021-03-12</discovery>
 <entry>2021-03-16</entry>
 </dates>
 </vuln>

<vuln vid="317487c6-85ca-11eb-80fa-14dae938ec40">
 <topic>squashfs-tools -- Integer overflow</topic>
 <affects>
 <package>
	<name>squashfs-tools</name>
	<range><lt>4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Phillip Lougher reports:
	<blockquote cite="https://github.com/plougher/squashfs-tools/commit/f95864afe8833fe3ad782d714b41378e860977b1">
	 Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4645</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2015-4645</url>
 </references>
 <dates>
 <discovery>2017-03-17</discovery>
 <entry>2021-03-15</entry>
 </dates>
 </vuln>

<vuln vid="72709326-81f7-11eb-950a-00155d646401">
 <topic>go -- encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader; archive/zip: panic when calling Reader.Open</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.16.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/44913">
	 The Decode, DecodeElement, and Skip methods of an xml.Decoder
	 provided by xml.NewTokenDecoder may enter an infinite loop when
	 operating on a custom xml.TokenReader which returns an EOF in the
	 middle of an open XML element.
	</blockquote>
	<blockquote cite="https://github.com/golang/go/issues/44916">
	 The Reader.Open API, new in Go 1.16, will panic when used on a ZIP
	 archive containing files that start with "../".
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-27918</cvename>
 <url>http://golang.org/issue/44913</url>
 <cvename>CVE-2021-27919</cvename>
 <url>http://golang.org/issue/44916</url>
 </references>
 <dates>
 <discovery>2021-03-05</discovery>
 <entry>2021-03-10</entry>
 </dates>
 </vuln>

<vuln vid="502ba001-7ffa-11eb-911c-0800278d94f0">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.13.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.13.3:
	<blockquote cite="https://blog.gitea.io/2021/03/gitea-1.13.3-is-released/">
	 <ul>
	 <li>Turn default hash password algorithm back to pbkdf2 from argon2 until we find a better one </li>
	 </ul>
	</blockquote>
	The Gitea Team reports for release 1.13.4:
	<blockquote cite="https://blog.gitea.io/2021/03/gitea-1.13.4-is-released/">
	 <ul>
	 <li>Fix issue popups</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.13.3</url>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.13.4</url>
 <freebsdpr>ports/254130</freebsdpr>
 </references>
 <dates>
 <discovery>2021-01-07</discovery>
 <entry>2021-02-06</entry>
 </dates>
 </vuln>

<vuln vid="2dc8927b-54e0-11eb-9342-1c697a013f4b">
 <topic>mantis -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mantis-php72</name>
	<name>mantis-php73</name>
	<name>mantis-php74</name>
	<name>mantis-php80</name>
	<range><lt>2.24.4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mantis 2.24.4 release reports:
	<blockquote cite="https://mantisbt.org/bugs/changelog_page.php?project=mantisbt&amp;version=2.24.4">
	 Security and maintenance release, addressing 6 CVEs:
	 <ul>
	 <li>0027726: CVE-2020-29603: disclosure of private project name</li>
	 <li>0027727: CVE-2020-29605: disclosure of private issue summary</li>
	 <li>0027728: CVE-2020-29604: full disclosure of private issue contents, including bugnotes and attachments</li>
	 <li>0027361: Private category can be access/used by a non member of a private project (IDOR)</li>
	 <li>0027779: CVE-2020-35571: XSS in helper_ensure_confirmed() calls</li>
	 <li>0026794: User Account - Takeover</li>
	 <li>0027363: Fixed in version can be changed to a version that doesn't exist</li>
	 <li>0027350: When updating an issue, a Viewer user can be set as Reporter</li>
	 <li>0027370: CVE-2020-35849: Revisions allow viewing private bugnotes id and summary</li>
	 <li>0027495: CVE-2020-28413: SQL injection in the parameter "access" on the mc_project_get_users function throught the API SOAP.</li>
	 <li>0027444: Printing unsanitized user input in install.php</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-28413</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28413</url>
 <cvename>CVE-2020-35849</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35849</url>
 </references>
 <dates>
 <discovery>2020-11-10</discovery>
 <entry>2021-03-10</entry>
 </dates>
 </vuln>

<vuln vid="2f3cd69e-7dee-11eb-b92e-0022489ad614">
 <topic>Node.js -- February 2021 Security Releases</topic>
 <affects>
 <package>
	<name>node10</name>
	<range><lt>10.24.0</lt></range>
 </package>
 <package>
	<name>node12</name>
	<range><lt>12.21.0</lt></range>
 </package>
 <package>
	<name>node14</name>
	<range><lt>14.16.0</lt></range>
 </package>
 <package>
	<name>node</name>
	<range><lt>15.10.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/">
	 <h1>HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion (Critical) (CVE-2021-22883)</h1>
	 Affected Node.js versions are vulnerable to denial of service attacks when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
	 <h1>DNS rebinding in --inspect (CVE-2021-22884)</h1>
	 Affected Node.js versions are vulnerable to a DNS rebinding attack when the whitelist includes "localhost6". When "localhost6" is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the "localhost6" domain. As long as the attacker uses the "localhost6" domain, they can still apply the attack described in CVE-2018-7160.
	 <h1>OpenSSL - Integer overflow in CipherUpdate (CVE-2021-23840)</h1>
	 This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210216.txt
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/</url>
 <cvename>CVE-2021-22883</cvename>
 <cvename>CVE-2021-22884</cvename>
 <cvename>CVE-2021-23840</cvename>
 </references>
 <dates>
 <discovery>2021-02-23</discovery>
 <entry>2021-03-09</entry>
 </dates>
 </vuln>

<vuln vid="8bf856ea-7df7-11eb-9aad-001b217b3468">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.9.0</ge><lt>13.9.2</lt></range>
	<range><ge>13.8.0</ge><lt>13.8.5</lt></range>
	<range><lt>13.7.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/03/04/security-release-gitlab-13-9-2-released/">
	 JWT token leak via Workhorse
	 Stored XSS in wiki pages
	 Group Maintainers are able to use the Group CI/CD Variables API
	 Insecure storage of GitLab session keys
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2021/03/04/security-release-gitlab-13-9-2-released/</url>
 <cvename>CVE-2021-22185</cvename>
 <cvename>CVE-2021-22186</cvename>
 </references>
 <dates>
 <discovery>2021-03-04</discovery>
 <entry>2021-03-05</entry>
 </dates>
 </vuln>

<vuln vid="9e8f0766-7d21-11eb-a2be-001999f8d30b">
 <topic>asterisk -- Crash when negotiating T.38 with a zero port</topic>
 <affects>
 <package>
	<name>asterisk16</name>
	<range><lt>16.16.2</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><lt>18.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 When Asterisk sends a re-invite initiating T.38 faxing
	 and the endpoint responds with a m=image line and zero
	 port, a crash will occur in Asterisk. This is a reoccurrence
	 of AST-2019-004.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-15297</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2021-006.html</url>
 </references>
 <dates>
 <discovery>2021-02-20</discovery>
 <entry>2021-03-04</entry>
 </dates>
 </vuln>

<vuln vid="f00b65d8-7ccb-11eb-b3be-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>89.0.4389.72</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html">
	 This release includes 47 security fixes, including the below.
	 Google is aware of reports that an exploit for CVE-2021-21166 exists
	 in the wild. Please see URL for details.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-21159</cvename>
 <cvename>CVE-2021-21160</cvename>
 <cvename>CVE-2021-21161</cvename>
 <cvename>CVE-2021-21162</cvename>
 <cvename>CVE-2021-21163</cvename>
 <cvename>CVE-2021-21164</cvename>
 <cvename>CVE-2021-21165</cvename>
 <cvename>CVE-2021-21166</cvename>
 <cvename>CVE-2021-21167</cvename>
 <cvename>CVE-2021-21168</cvename>
 <cvename>CVE-2021-21169</cvename>
 <cvename>CVE-2021-21170</cvename>
 <cvename>CVE-2021-21171</cvename>
 <cvename>CVE-2021-21172</cvename>
 <cvename>CVE-2021-21173</cvename>
 <cvename>CVE-2021-21174</cvename>
 <cvename>CVE-2021-21175</cvename>
 <cvename>CVE-2021-21176</cvename>
 <cvename>CVE-2021-21177</cvename>
 <cvename>CVE-2021-21178</cvename>
 <cvename>CVE-2021-21179</cvename>
 <cvename>CVE-2021-21180</cvename>
 <cvename>CVE-2021-21181</cvename>
 <cvename>CVE-2021-21182</cvename>
 <cvename>CVE-2021-21183</cvename>
 <cvename>CVE-2021-21184</cvename>
 <cvename>CVE-2021-21185</cvename>
 <cvename>CVE-2021-21186</cvename>
 <cvename>CVE-2021-21187</cvename>
 <cvename>CVE-2021-21188</cvename>
 <cvename>CVE-2021-21189</cvename>
 <cvename>CVE-2021-21190</cvename>
 <cvename>CVE-2020-27844</cvename>
 <url>https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2021-03-02</discovery>
 <entry>2021-03-04</entry>
 </dates>
 </vuln>

<vuln vid="3a469cbc-7a66-11eb-bd3f-08002728f74c">
 <topic>jasper -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jasper</name>
	<range><lt>2.0.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	JasPer Releases:
	<blockquote cite="https://github.com/jasper-software/jasper/releases">
	 - Fix memory-related bugs in the JPEG-2000 codec resulting from
	 attempting to decode invalid code streams. (#264, #265)
	 This fix is associated with CVE-2021-26926 and CVE-2021-26927.
	 - Fix wrong return value under some compilers (#260)
	 - Fix CVE-2021-3272 heap buffer overflow in jp2_decode (#259)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/jasper-software/jasper/releases</url>
 <cvename>CVE-2021-26926</cvename>
 <cvename>CVE-2021-26927</cvename>
 <cvename>CVE-2021-3272</cvename>
 </references>
 <dates>
 <discovery>2021-02-07</discovery>
 <entry>2021-03-03</entry>
 </dates>
 </vuln>

<vuln vid="a1e03a3d-7be0-11eb-b392-20cf30e32f6d">
 <topic>salt -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py36-salt-2019</name>
	<name>py37-salt-2019</name>
	<name>py38-salt-2019</name>
	<name>py36-salt</name>
	<name>py37-salt</name>
	<name>py38-salt</name>
	<name>py39-salt</name>
	<range><lt>2019.2.8</lt></range>
	<range><ge>3000</ge><lt>3002.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SaltStack reports multiple security vulnerabilities in Salt
	<blockquote cite="https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/">
	 <ul>
	 <li>CVE-2021-3197: The Salt-API.s SSH client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.</li>
	 <li>CVE-2021-25281: The Salt-API does not have eAuth credentials for the wheel_async client.</li>
	 <li>CVE-2021-25282: The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.</li>
	 <li>CVE-2021-25283: The jinja renderer does not protect against server-side template injection attacks.</li>
	 <li>CVE-2021-25284: webutils write passwords in cleartext to /var/log/salt/minion</li>
	 <li>CVE-2021-3148: command injection in salt.utils.thin.gen_thin()</li>
	 <li>CVE-2020-35662: Several places where Salt was not verifying the SSL cert by default.</li>
	 <li>CVE-2021-3144: eauth Token can be used once after expiration.</li>
	 <li>CVE-2020-28972: Code base not validating SSL/TLS certificate of the server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack</li>
	 <li>CVE-2020-28243: Local Privilege Escalation in the Minion.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>"https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/"</url>
 <cvename>CVE-2021-3197</cvename>
 <cvename>CVE-2021-25281</cvename>
 <cvename>CVE-2021-25282</cvename>
 <cvename>CVE-2021-25283</cvename>
 <cvename>CVE-2021-25284</cvename>
 <cvename>CVE-2021-3148</cvename>
 <cvename>CVE-2020-35662</cvename>
 <cvename>CVE-2021-3144</cvename>
 <cvename>CVE-2020-28972</cvename>
 <cvename>CVE-2020-28243</cvename>
 </references>
 <dates>
 <discovery>2021-02-25</discovery>
 <entry>2021-03-03</entry>
 </dates>
 </vuln>

<vuln vid="52bd2d59-4ab5-4bef-a599-7aac4e92238b">
 <topic>vault -- unauthenticated license read</topic>
 <affects>
 <package>
	<name>vault</name>
	<range><lt>1.6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	vault developers report:
	<blockquote cite="https://github.com/hashicorp/vault/releases/tag/v1.6.3">
	 Limited Unauthenticated License Read: We addressed a security vulnerability that allowed for the unauthenticated reading of Vault licenses from DR Secondaries.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-27668</cvename>
 <url>https://github.com/hashicorp/vault/releases/tag/v1.6.3</url>
 </references>
 <dates>
 <discovery>2021-02-26</discovery>
 <entry>2021-02-27</entry>
 </dates>
 </vuln>

<vuln vid="31ad2f10-7711-11eb-b87a-901b0ef719ab">
 <topic>FreeBSD -- jail_remove(2) fails to kill all jailed processes</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.2</ge><lt>12.2_4</lt></range>
	<range><ge>11.4</ge><lt>11.4_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to a race condition in the jail_remove(2) implementation, it
	may fail to kill some of the processes.
	<h1>Impact:</h1>
	A process running inside a jail can avoid being killed during jail
	termination. If a jail is subsequently started with the same root
	path, a lingering jailed process may be able to exploit the window
	during which a devfs filesystem is mounted but the jail's devfs
	ruleset has not been applied, to access device nodes which are
	ordinarily inaccessible. If the process is privileged, it may be able
	to escape the jail and gain full access to the system.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-25581</cvename>
 <freebsdsa>SA-21:04.jail_remove</freebsdsa>
 </references>
 <dates>
 <discovery>2021-02-24</discovery>
 <entry>2021-02-25</entry>
 </dates>
 </vuln>

<vuln vid="5b8c6e1e-770f-11eb-b87a-901b0ef719ab">
 <topic>FreeBSD -- Xen grant mapping error handling issues</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.2</ge><lt>12.2_4</lt></range>
	<range><ge>11.4</ge><lt>11.4_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Grant mapping operations often occur in batch hypercalls, where a
	number of operations are done in a single hypercall, the success or
	failure of each one reported to the backend driver, and the backend
	driver then loops over the results, performing follow-up actions
	based on the success or failure of each operation.
	Unfortunately, when running in HVM/PVH mode, the FreeBSD backend
	drivers mishandle this: Some errors are ignored, effectively implying
	their success from the success of related batch elements. In other
	cases, errors resulting from one batch element lead to further batch
	elements not being inspected, and hence successful ones to not be
	possible to properly unmap upon error recovery.
	<h1>Impact:</h1>
	A malicious or buggy frontend driver may be able to cause resource
	leaks in the domain running the corresponding backend driver.
 </body>
 </description>
 <references>
 <cvename>CVE-2021-26932</cvename>
 <freebsdsa>SA-21:06.xen</freebsdsa>
 </references>
 <dates>
 <discovery>2021-02-24</discovery>
 <entry>2021-02-25</entry>
 </dates>
 </vuln>

<vuln vid="bba850fd-770e-11eb-b87a-901b0ef719ab">
 <topic>FreeBSD -- jail_attach(2) relies on the caller to change the cwd</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.2</ge><lt>12.2_4</lt></range>
	<range><ge>11.4</ge><lt>11.4_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When a process, such as jexec(8) or killall(1), calls jail_attach(2)
	to enter a jail, the jailed root can attach to it using ptrace(2) before
	the current working directory is changed.
	<h1>Impact:</h1>
	A process with superuser privileges running inside a jail could change
	the root directory outside of the jail, thereby gaining full read and
	writing access to all files and directories in the system.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-25582</cvename>
 <freebsdsa>SA-21:05.jail_chdir</freebsdsa>
 </references>
 <dates>
 <discovery>2021-02-24</discovery>
 <entry>2021-02-25</entry>
 </dates>
 </vuln>

<vuln vid="a8654f1d-770d-11eb-b87a-901b0ef719ab">
 <topic>FreeBSD -- login.access fails to apply rules</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.2</ge><lt>12.2_4</lt></range>
	<range><ge>11.4</ge><lt>11.4_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A regression in the login.access(5) rule processor has the effect
	of causing rules to fail to match even when they should not. This
	means that rules denying access may be ignored.
	<h1>Impact:</h1>
	The configuration in login.access(5) may not be applied, permitting
	login access to users even when the system is configured to deny it.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-25580</cvename>
 <freebsdsa>SA-21:03.pam_login_access</freebsdsa>
 </references>
 <dates>
 <discovery>2021-02-24</discovery>
 <entry>2021-02-25</entry>
 </dates>
 </vuln>

<vuln vid="0e38b8f8-75dd-11eb-83f2-8c164567ca3c">
 <topic>redis -- Integer overflow on 32-bit systems</topic>
 <affects>
 <package>
	<name>redis-devel</name>
	<range><lt>6.2.0</lt></range>
 </package>
 <package>
	<name>redis</name>
	<range><lt>6.0.11</lt></range>
 </package>
 <package>
	<name>redis5</name>
	<range><lt>5.0.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redis Development team reports:
	<blockquote cite="https://github.com/redis/redis/releases/tag/6.2.0">
	 Redis 4.0 or newer uses a configurable limit for
	 the maximum supported bulk input size. By default,
	 it is 512MB which is a safe value for all platforms.
	 If the limit is significantly increased, receiving a
	 large request from a client may trigger several
	 integer overflow scenarios, which would result with
	 buffer overflow and heap corruption.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-21309</cvename>
 </references>
 <dates>
 <discovery>2021-02-22</discovery>
 <entry>2021-02-23</entry>
 </dates>
 </vuln>

<vuln vid="3e9624b3-e92b-4460-8a5a-93247c52c5a1">
 <topic>zeek -- Remote crash vulnerability</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>3.0.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jon Siwek of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v3.0.13">
	 Fix ASCII Input reader's treatment of input files
	 containing null-bytes. An input file containing null-bytes
	 could lead to a buffer-over-read, crash Zeek, and be
	 exploited to cause Denial of Service. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v3.0.13</url>
 </references>
 <dates>
 <discovery>2021-02-10</discovery>
 <entry>2021-02-22</entry>
 </dates>
 </vuln>

<vuln vid="9c03845c-7398-11eb-bc0e-2cf05d620ecc">
 <topic>raptor2 -- malformed input file can lead to a segfault</topic>
 <affects>
 <package>
	<name>raptor2</name>
	<range><lt>2.0.15_17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redland Issue Tracker reports:
	<blockquote cite="https://bugs.librdf.org/mantis/view.php?id=650">
	 due to an out of bounds array access in
raptor_xml_writer_start_element_common.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.librdf.org/mantis/view.php?id=650</url>
 </references>
 <dates>
 <discovery>2020-11-24</discovery>
 <entry>2021-02-20</entry>
 </dates>
 </vuln>

<vuln vid="a45d945a-cc2c-4cd7-a941-fb58fdb1b01e">
 <topic>jenkins -- Privilege escalation vulnerability in bundled Spring Security library</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.280</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2021-02-19/">
	 <h1>Description</h1>
	 <h5>(high) SECURITY-2195 / CVE-2021-22112</h5>
	 Privilege escalation vulnerability in bundled Spring Security library
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.jenkins.io/security/advisory/2021-02-19/</url>
 </references>
 <dates>
 <discovery>2021-02-19</discovery>
 <entry>2021-02-20</entry>
 </dates>
 </vuln>

<vuln vid="1bb2826b-7229-11eb-8386-001999f8d30b">
 <topic>asterisk -- Remote Crash Vulnerability in PJSIP channel driver</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.38.2</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><lt>16.16.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><lt>18.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 Given a scenario where an outgoing call is placed from
	 Asterisk to a remote SIP server it is possible for a crash
	 to occur.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-26906</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2021-005.html</url>
 </references>
 <dates>
 <discovery>2021-02-08</discovery>
 <entry>2021-02-18</entry>
 </dates>
 </vuln>

<vuln vid="ca21f5e7-7228-11eb-8386-001999f8d30b">
 <topic>asterisk -- An unsuspecting user could crash Asterisk with multiple hold/unhold requests</topic>
 <affects>
 <package>
	<name>asterisk16</name>
	<range><ge>16.16.0</ge><lt>16.16.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><ge>18.2.0</ge><lt>18.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 Due to a signedness comparison mismatch, an authenticated
	 WebRTC client could cause a stack overflow and Asterisk
	 crash by sending multiple hold/unhold requests in quick
	 succession.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-26714</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2021-004.html</url>
 </references>
 <dates>
 <discovery>2021-02-11</discovery>
 <entry>2021-02-18</entry>
 </dates>
 </vuln>

<vuln vid="5d8ef725-7228-11eb-8386-001999f8d30b">
 <topic>asterisk -- Remote attacker could prematurely tear down SRTP calls</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><ge>13.38.1</ge><lt>13.38.2</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><ge>16.16.0</ge><lt>16.16.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><ge>18.2.0</ge><lt>18.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 An unauthenticated remote attacker could replay SRTP
	 packets which could cause an Asterisk instance configured
	 without strict RTP validation to tear down calls
	 prematurely.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-26712</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2021-003.html</url>
 </references>
 <dates>
 <discovery>2021-02-18</discovery>
 <entry>2021-02-18</entry>
 </dates>
 </vuln>

<vuln vid="e3894955-7227-11eb-8386-001999f8d30b">
 <topic>asterisk -- Remote crash possible when negotiating T.38</topic>
 <affects>
 <package>
	<name>asterisk16</name>
	<range><ge>16.15.0</ge><lt>16.16.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><ge>18.1.0</ge><lt>18.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 When re-negotiating for T.38 if the initial remote
	 response was delayed just enough Asterisk would send both
	 audio and T.38 in the SDP. If this happened, and the
	 remote responded with a declined T.38 stream then Asterisk
	 would crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-26717</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2021-002.html</url>
 </references>
 <dates>
 <discovery>2021-02-05</discovery>
 <entry>2021-02-18</entry>
 </dates>
 </vuln>

<vuln vid="b330db5f-7225-11eb-8386-001999f8d30b">
 <topic>asterisk -- Remote crash in res_pjsip_diversion</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><ge>13.38.1</ge><lt>13.38.2</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><ge>16.15.1</ge><lt>16.16.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><ge>18.1.1</ge><lt>18.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 If a registered user is tricked into dialing a malicious
	 number that sends lots of 181 responses to Asterisk, each
	 one will cause a 181 to be sent back to the original
	 caller with an increasing number of entries in the
	 "Supported" header. Eventually the number of entries in
	 the header exceeds the size of the entry array and causes
	 a crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-35776</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2021-001.html</url>
 </references>
 <dates>
 <discovery>2021-01-04</discovery>
 <entry>2021-02-18</entry>
 </dates>
 </vuln>

<vuln vid="8e670b85-706e-11eb-abb2-08002728f74c">
 <topic>Rails -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-activerecord52</name>
	<range><lt>5.2.4.5</lt></range>
 </package>
 <package>
	<name>rubygem-actionpack60</name>
	<name>rubygem-activerecord60</name>
	<range><lt>6.0.3.5</lt></range>
 </package>
 <package>
	<name>rubygem-actionpack61</name>
	<name>rubygem-activerecord61</name>
	<range><lt>6.1.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails blog:
	<blockquote cite="https://weblog.rubyonrails.org/2021/2/10/Rails-5-2-4-5-6-0-3-5-and-6-1-2-1-have-been-released/">
	 Rails version 5.2.4.5, 6.0.3.5 and 6.1.2.1 have been released! Those
	 version are security releases and addresses two issues:
	 CVE-2021-22880: Possible DoS Vulnerability in Active Record PostgreSQL adapter.
	 CVE-2021-22881: Possible Open Redirect in Host Authorization Middleware.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://weblog.rubyonrails.org/2021/2/10/Rails-5-2-4-5-6-0-3-5-and-6-1-2-1-have-been-released/</url>
 <url>https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129</url>
 <url>https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130</url>
 <cvename>CVE-2021-22880</cvename>
 <cvename>CVE-2021-22881</cvename>
 </references>
 <dates>
 <discovery>2021-02-10</discovery>
 <entry>2021-02-17</entry>
 </dates>
 </vuln>

<vuln vid="48514901-711d-11eb-9846-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>88.0.4324.182</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_16.html">
	 This release contains 10 security fixes, including:
	 <ul>
	 <li>[1138143] High CVE-2021-21149: Stack overflow in Data Transfer.
	 Reported by Ryoya Tsukasaki on 2020-10-14</li>
	 <li>[1172192] High CVE-2021-21150: Use after free in Downloads.
	 Reported by Woojin Oh(@pwn_expoit) of STEALIEN on 2021-01-29</li>
	 <li>[1165624] High CVE-2021-21151: Use after free in Payments.
	 Reported by Khalil Zhani on 2021-01-12</li>
	 <li>[1166504] High CVE-2021-21152: Heap buffer overflow in Media.
	 Reported by Anonymous on 2021-01-14</li>
	 <li>[1155974] High CVE-2021-21153: Stack overflow in GPU Process.
	 Reported by Jan Ruge of ERNW GmbH on 2020-12-06</li>
	 <li>[1173269] High CVE-2021-21154: Heap buffer overflow in Tab
	 Strip. Reported by Abdulrahman Alqabandi, Microsoft Browser
	 Vulnerability Research on 2021-02-01</li>
	 <li>[1175500] High CVE-2021-21155: Heap buffer overflow in Tab
	 Strip. Reported by Khalil Zhani on 2021-02-07</li>
	 <li>[1177341] High CVE-2021-21156: Heap buffer overflow in V8.
	 Reported by Sergei Glazunov of Google Project Zero on
	 2021-02-11</li>
	 <li>[1170657] Medium CVE-2021-21157: Use after free in Web
	 Sockets. Reported by Anonymous on 2021-01-26</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-21149</cvename>
 <cvename>CVE-2021-21150</cvename>
 <cvename>CVE-2021-21151</cvename>
 <cvename>CVE-2021-21152</cvename>
 <cvename>CVE-2021-21153</cvename>
 <cvename>CVE-2021-21154</cvename>
 <cvename>CVE-2021-21155</cvename>
 <cvename>CVE-2021-21156</cvename>
 <cvename>CVE-2021-21157</cvename>
 <url>https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_16.html</url>
 </references>
 <dates>
 <discovery>2021-02-16</discovery>
 <entry>2021-02-17</entry>
 </dates>
 </vuln>

<vuln vid="96a21236-707b-11eb-96d8-d4c9ef517024">
 <topic>OpenSSL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.1.1j,1</lt></range>
 </package>
 <package>
	<name>openssl-devel</name>
	<range><lt>3.0.0.a12</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.2</ge><lt>12.2_10</lt></range>
	<range><ge>11.4</ge><lt>11.4_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20210216.txt">
	 Null pointer deref in X509_issuer_and_serial_hash()
	 CVE-2021-23841 (Moderate) The OpenSSL public API function
	 X509_issuer_and_serial_hash() attempts to create a unique hash
	 value based on the issuer and serial number data contained within
	 an X509 certificate. However it fails to correctly handle any errors
	 that may occur while parsing the issuer field (which might occur if
	 the issuer field is maliciously constructed). This may subsequently
	 result in a NULL pointer deref and a crash leading to a potential
	 denial of service attack.
	 Integer overflow in CipherUpdate CVE-2021-23840 (Low)
	 Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate
	 may overflow the output length argument in some cases where the
	 input length is close to the maximum permissable length for an
	 integer on the platform. In such cases the return value from the
	 function call will be 1 (indicating success), but the output length
	 value will be negative. This could cause applications to behave
	 incorrectly or crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20210216.txt</url>
 <cvename>CVE-2021-23841</cvename>
 <cvename>CVE-2021-23840</cvename>
 <cvename>CVE-2021-23839</cvename>
 <freebsdsa>SA-21:17.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2021-02-16</discovery>
 <entry>2021-02-16</entry>
 <modified>2021-08-25</modified>
 </dates>
 </vuln>

<vuln vid="98044aba-6d72-11eb-aed7-1b1b8a70cc8b">
 <topic>openexr, ilmbase -- security fixes related to reading corrupted input files</topic>
 <affects>
 <package>
	<name>ilmbase</name>
	<range><lt>2.5.5</lt></range>
 </package>
 <package>
	<name>openexr</name>
	<range><lt>2.5.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cary Phillips reports:
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.5">
	 Patch release with various bug/sanitizer/security fixes, primarily related to reading corrupted input files[...].
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.5</url>
 
 <url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.4</url>
 <cvename>CVE-2021-20296</cvename>
 <cvename>CVE-2021-3479</cvename>
 <cvename>CVE-2021-3478</cvename>
 <cvename>CVE-2021-3477</cvename>
 <cvename>CVE-2021-3476</cvename>
 <cvename>CVE-2021-3475</cvename>
 <cvename>CVE-2021-3474</cvename>
 </references>
 <dates>
 <discovery>2021-02-12</discovery>
 <entry>2021-02-12</entry>
 </dates>
 </vuln>

<vuln vid="1020d401-6d2d-11eb-ab0b-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.8.0</ge><lt>13.8.4</lt></range>
	<range><ge>13.7.0</ge><lt>13.7.7</lt></range>
	<range><ge>10.5</ge><lt>13.6.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/02/11/security-release-gitlab-13-8-4-released/">
	 Improper Certificate Validation for Fortinet OTP
	 Denial of Service Attack on gitlab-shell
	 Resource exhaustion due to pending jobs
	 Confidential issue titles were exposed
	 Improper access control allowed demoted project members to access authored merge requests
	 Improper access control allowed unauthorized users to access analytic pages
	 Unauthenticated CI lint API may lead to information disclosure and SSRF
	 Prometheus integration in Gitlab may lead to SSRF
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2021/02/11/security-release-gitlab-13-8-4-released/</url>
 </references>
 <dates>
 <discovery>2021-02-11</discovery>
 <entry>2021-02-12</entry>
 </dates>
 </vuln>

<vuln vid="3003ba60-6cec-11eb-8815-040e3c1b8a02">
 <topic>oauth2-proxy -- domain whitelist could be used as redirect</topic>
 <affects>
 <package>
	<name>oauth2-proxy</name>
	<range><lt>7.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The oauth2-proxy Team reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2021-21291">
	 In OAuth2 Proxy before version 7.0.0, for users that use the
	 whitelist domain feature, a domain that ended in a similar way to
	 the intended domain could have been allowed as a redirect.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2021-21291</url>
 </references>
 <dates>
 <discovery>2021-02-02</discovery>
 <entry>2021-02-12</entry>
 </dates>
 </vuln>

<vuln vid="06a5abd4-6bc2-11eb-b292-90e2baa3bafc">
 <topic>mod_dav_svn -- server crash</topic>
 <affects>
 <package>
	<name>mod_dav_svn</name>
	<range><ge>1.9.0</ge><le>1.10.6</le></range>
	<range><ge>1.11.0</ge><le>1.14.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion project reports:
	<blockquote cite="https://subversion.apache.org/security/CVE-2020-17525-advisory.txt">
	Subversion's mod_authz_svn module will crash if the server is using
	 in-repository authz rules with the AuthzSVNReposRelativeAccessFile
	 option and a client sends a request for a non-existing repository URL.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://subversion.apache.org/security/CVE-2020-17525-advisory.txt</url>
 </references>
 <dates>
 <discovery>2021-01-29</discovery>
 <entry>2021-02-10</entry>
 </dates>
 </vuln>

<vuln vid="cdb10765-6879-11eb-a7d8-08002734b9ed">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.13.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.13.2:
	<blockquote cite="https://blog.gitea.io/2021/02/gitea-1.13.2-is-released/">
	 <ul>
	 <li>Prevent panic on fuzzer provided string</li>
	 <li>Add secure/httpOnly attributes to the lang cookie</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.13.2</url>
 <freebsdpr>ports/253295</freebsdpr>
 </references>
 <dates>
 <discovery>2021-01-07</discovery>
 <entry>2021-02-06</entry>
 </dates>
 </vuln>

<vuln vid="3e01aad2-680e-11eb-83e2-e09467587c17">
 <topic>chromium -- heap buffer overflow in V8</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>88.0.4324.150</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_4.html">
	 [1170176] High CVE-2021-21148: Heap buffer overflow in V8.
	 Reported by Mattias Buelens on 2021-01-24. Google is aware of
	 reports that an exploit for CVE-2021-21148 exists in the wild.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-21148</cvename>
 <url>https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_4.html</url>
 </references>
 <dates>
 <discovery>2021-02-04</discovery>
 <entry>2021-02-05</entry>
 </dates>
 </vuln>

<vuln vid="479fdfda-6659-11eb-83e2-e09467587c17">
 <topic>www/chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>88.0.4324.146</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html">
	 This update include 6 security fixes:
	 <ul>
	 <li>1169317] Critical CVE-2021-21142: Use after free in Payments.
	 Reported by Khalil Zhani on 2021-01-21</li>
	 <li>[1163504] High CVE-2021-21143: Heap buffer overflow in
	 Extensions. Reported by Allen Parker and Alex Morgan of MU on
	 2021-01-06</li>
	 <li>[1163845] High CVE-2021-21144: Heap buffer overflow in Tab
	 Groups. Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2021-01-07</li>
	 <li>[1154965] High CVE-2021-21145: Use after free in Fonts. Reported
	 by Anonymous on 2020-12-03</li>
	 <li>[1161705] High CVE-2021-21146: Use after free in Navigation.
	 Reported by Alison Huffman and Choongwoo Han of Microsoft Browser
	 Vulnerability Research on 2020-12-24</li>
	 <li>[1162942] Medium CVE-2021-21147: Inappropriate implementation in
	 Skia. Reported by Roman Starkov on 2021-01-04</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-21142</cvename>
 <cvename>CVE-2021-21143</cvename>
 <cvename>CVE-2021-21144</cvename>
 <cvename>CVE-2021-21145</cvename>
 <cvename>CVE-2021-21146</cvename>
 <cvename>CVE-2021-21147</cvename>
 <url>https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2021-02-02</discovery>
 <entry>2021-02-03</entry>
 </dates>
 </vuln>

<vuln vid="66d1c277-652a-11eb-bb3f-001b217b3468">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.8.0</ge><lt>13.8.2</lt></range>
	<range><ge>13.7.0</ge><lt>13.7.6</lt></range>
	<range><ge>11.8</ge><lt>13.6.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/blog/2021/02/01/security-release-gitlab-13-8-2-released/">
	 Stored XSS in merge request
	 Stored XSS in epic's pages
	 Sensitive GraphQL variables exposed in structured log
	 Guest user can see tag names in private projects
	 Information disclosure via error message
	 DNS rebinding protection bypass
	 Validate existence of private project
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/blog/2021/02/01/security-release-gitlab-13-8-2-released/</url>
 <cvename>CVE-2021-22172</cvename>
 <cvename>CVE-2021-22169</cvename>
 </references>
 <dates>
 <discovery>2021-02-01</discovery>
 <entry>2021-02-02</entry>
 </dates>
 </vuln>

<vuln vid="8ec7d426-055d-46bc-8f5a-a9d73a5a71ab">
 <topic>minio -- Server Side Request Forgery</topic>
 <affects>
 <package>
	<name>minio</name>
	<range><lt>2021.01.30.00.20.58</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Minio developers report:
	<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q">
	 Thanks to @phith0n from our community upon a code review, discovered an SSRF (Server Side Request Forgery) in our Browser API implementation. We have not observed this report/attack in the wild or reported elsewhere in the community at large.
	 All users are advised to upgrade ASAP.
	 The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (path traversal etc.).
	 In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like HTTP enabled databases, or perform post requests towards internal services which are not intended to be exposed.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q</url>
 </references>
 <dates>
 <discovery>2021-01-29</discovery>
 <entry>2021-01-31</entry>
 </dates>
 </vuln>

<vuln vid="5d91370b-61fd-11eb-b87a-901b0ef719ab">
 <topic>FreeBSD -- Xen guests can triger backend Out Of Memory</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.2</ge><lt>12.2_3</lt></range>
	<range><ge>12.1</ge><lt>12.1_13</lt></range>
	<range><ge>11.4</ge><lt>11.4_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Some OSes (including Linux, FreeBSD, and NetBSD) are processing watch
	events using a single thread. If the events are received faster than
	the thread is able to handle, they will get queued.
	As the queue is unbound, a guest may be able to trigger a OOM in
	the backend.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-29568</cvename>
 <freebsdsa>SA-21:02.xenoom</freebsdsa>
 </references>
 <dates>
 <discovery>2021-01-29</discovery>
 <entry>2021-01-29</entry>
 </dates>
 </vuln>

<vuln vid="a9c6e9be-61fb-11eb-b87a-901b0ef719ab">
 <topic>FreeBSD -- Uninitialized kernel stack leaks in several file systems</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.2</ge><lt>12.2_3</lt></range>
	<range><ge>12.1</ge><lt>12.1_13</lt></range>
	<range><ge>11.4</ge><lt>11.4_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Several file systems were not properly initializing the d_off field
	of the dirent structures returned by VOP_READDIR. In particular,
	tmpfs(5), smbfs(5), autofs(5) and mqueuefs(5) were failing to do so.
	As a result, eight uninitialized kernel stack bytes may be leaked to
	userspace by these file systems. This problem is not present in
	FreeBSD 11.
	Additionally, msdosfs(5) was failing to zero-fill a pair of padding
	fields in the dirent structure, resulting in a leak of three
	uninitialized bytes.
	<h1>Impact:</h1>
	Kernel stack disclosures may leak sensitive information which could
	be used to compromise the security of the system.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-25578</cvename>
 <cvename>CVE-2020-25579</cvename>
 <freebsdsa>SA-21:01.fsdisclosure</freebsdsa>
 </references>
 <dates>
 <discovery>2021-01-29</discovery>
 <entry>2021-01-29</entry>
 </dates>
 </vuln>

<vuln vid="13ca36b8-6141-11eb-8a36-7085c2fb2c14">
 <topic>pngcheck -- Buffer-overrun vulnerability</topic>
 <affects>
 <package>
	<name>pngcheck</name>
	<range><lt>3.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The libpng project reports:
	<blockquote cite="http://www.libpng.org/pub/png/apps/pngcheck.html">
	 pngcheck versions 3.0.0 and earlier have a pair of buffer-overrun
	 bugs related to the sPLT and PPLT chunks (the latter is a MNG-only
	 chunk, but it gets noticed even in PNG files if the -s option is used).
	 Both bugs are fixed in version 3.0.1, released on 24 January 2021.
	 Again, while all known vulnerabilities are fixed in this version,
	 the code is quite crufty, so it would be safest to assume there are
	 still some problems hidden in there. As always, use at your own risk.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.libpng.org/pub/png/apps/pngcheck.html</url>
 </references>
 <dates>
 <discovery>2021-01-24</discovery>
 <entry>2021-01-28</entry>
 </dates>
 </vuln>

<vuln vid="f3cf4b33-6013-11eb-9a0e-206a8a720317">
 <topic>sudo -- Multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>sudo</name>
 <range><lt>1.9.5p2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Todd C. Miller reports:
 <blockquote cite="https://www.sudo.ws/stable.html#1.9.5p2">
	 When invoked as sudoedit, the same set of command line options
	 are now accepted as for sudo -e. The -H and -P options are now
	 rejected for sudoedit and sudo -e which matches the sudo 1.7
	 behavior. This is part of the fix for CVE-2021-3156.
	 Fixed a potential buffer overflow when unescaping backslashes in
	 the command's arguments. Normally, sudo escapes special characters
	 when running a command via a shell (sudo -s or sudo -i). However,
	 it was also possible to run sudoedit with the -s or -i flags in
	 which case no escaping had actually been done, making a buffer
	 overflow possible. This fixes CVE-2021-3156.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://www.sudo.ws/stable.html#1.9.5p2</url>
 <cvename>CVE-2021-3156</cvename>
 </references>
 <dates>
 <discovery>2021-01-26</discovery>
 <entry>2021-01-26</entry>
 </dates>
 </vuln>

<vuln vid="fb67567a-5d95-11eb-a955-08002728f74c">
 <topic>pysaml2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py36-pysaml2</name>
	<name>py37-pysaml2</name>
	<name>py38-pysaml2</name>
	<name>py39-pysaml2</name>
	<range><lt>6.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	pysaml2 Releases:
	<blockquote cite="https://github.com/IdentityPython/pysaml2/releases">
	 Fix processing of invalid SAML XML documents - CVE-2021-21238
	 Fix unspecified xmlsec1 key-type preference - CVE-2021-21239
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/IdentityPython/pysaml2/releases</url>
 <url>https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-f4g9-h89h-jgv9</url>
 <url>https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-5p3x-r448-pc62</url>
 <cvename>CVE-2021-21238</cvename>
 <cvename>CVE-2021-21239</cvename>
 </references>
 <dates>
 <discovery>2021-01-20</discovery>
 <entry>2021-01-26</entry>
 </dates>
 </vuln>

<vuln vid="425f2143-8876-4b0a-af84-e0238c5c2062">
 <topic>jenkins -- Arbitrary file read vulnerability in workspace browsers</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.276</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.263.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2021-01-26/">
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-2197 / CVE-2021-21615</h5>
	 Arbitrary file read vulnerability in workspace browsers
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.jenkins.io/security/advisory/2021-01-26/</url>
 </references>
 <dates>
 <discovery>2021-01-26</discovery>
 <entry>2021-01-26</entry>
 </dates>
 </vuln>

<vuln vid="387bbade-5d1d-11eb-bf20-4437e6ad11c4">
 <topic>mutt -- denial of service</topic>
 <affects>
 <package>
	<name>mutt</name>
	<range><lt>2.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tavis Ormandy reports:
	<blockquote cite="https://gitlab.com/muttmua/mutt/-/issues/323">
	 
	 rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a
	 denial of service (mailbox unavailability) by sending email messages
	 with sequences of semicolon characters in RFC822 address fields
	 (aka terminators of empty groups). A small email message from the
	 attacker can cause large memory consumption, and the victim
	 may then be unable to see email messages from other persons.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://gitlab.com/muttmua/mutt/-/issues/323</url>
 <cvename>CVE-2021-3181</cvename>
 </references>
 <dates>
 <discovery>2021-01-17</discovery>
 <entry>2021-01-23</entry>
 </dates>
 </vuln>

<vuln vid="31344707-5d87-11eb-929d-d4c9ef517024">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql56-client</name>
	<range><lt>5.6.51</lt></range>
 </package>
 <package>
	<name>mysql57-client</name>
	<range><lt>5.7.33</lt></range>
 </package>
 <package>
	<name>mysql80-client</name>
	<range><lt>8.0.23</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.51</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.33</lt></range>
 </package>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujan2021.html#AppendixMSQL">
	 This Critical Patch Update contains 34 new security patches for
	 Oracle MySQL Server and 4 for MySQL Client. 
	 The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
	 MySQL is 6.8.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/security-alerts/cpujan2021.html#AppendixMSQL</url>
 <url>CVE-2021-2046</url>
 <url>CVE-2021-2020</url>
 <url>CVE-2021-2024</url>
 <url>CVE-2021-2011</url>
 <url>CVE-2021-2006</url>
 <url>CVE-2021-2048</url>
 <url>CVE-2021-2028</url>
 <url>CVE-2021-2122</url>
 <url>CVE-2021-2058</url>
 <url>CVE-2021-2001</url>
 <url>CVE-2021-2016</url>
 <url>CVE-2021-2021</url>
 <url>CVE-2021-2030</url>
 <url>CVE-2021-2031</url>
 <url>CVE-2021-2036</url>
 <url>CVE-2021-2055</url>
 <url>CVE-2021-2060</url>
 <url>CVE-2021-2070</url>
 <url>CVE-2021-2076</url>
 <url>CVE-2021-2065</url>
 <url>CVE-2021-2014</url>
 <url>CVE-2021-2002</url>
 <url>CVE-2021-2012</url>
 <url>CVE-2021-2009</url>
 <url>CVE-2021-2072</url>
 <url>CVE-2021-2081</url>
 <url>CVE-2021-2022</url>
 <url>CVE-2021-2038</url>
 <url>CVE-2021-2061</url>
 <url>CVE-2021-2056</url>
 <url>CVE-2021-2087</url>
 <url>CVE-2021-2088</url>
 <url>CVE-2021-2032</url>
 <url>CVE-2021-2010</url>
 <url>CVE-2021-1998</url>
 <url>CVE-2021-2007</url>
 <url>CVE-2021-2019</url>
 <url>CVE-2021-2042</url>
 </references>
 <dates>
 <discovery>2021-01-23</discovery>
 <entry>2021-01-23</entry>
 </dates>
 </vuln>

<vuln vid="4ed0e43c-5cef-11eb-bafd-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>88.0.4324.96</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html">
	 This release contains 36 security fixes, including:
	 <ul>
	 <li>[1137179] Critical CVE-2021-21117: Insufficient policy
	 enforcement in Cryptohome. Reported by Rory McNamara on
	 2020-10-10</li>
	 <li>[1161357] High CVE-2021-21118: Insufficient data validation in
	 V8. Reported by Tyler Nighswander (@tylerni7) of Theori on
	 2020-12-23</li>
	 <li>[1160534] High CVE-2021-21119: Use after free in Media. Reported
	 by Anonymous on 2020-12-20</li>
	 <li>[1160602] High CVE-2021-21120: Use after free in WebSQL.
	 Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha
	 Lab on 2020-12-21</li>
	 <li>[1161143] High CVE-2021-21121: Use after free in Omnibox.
	 Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2020-12-22</li>
	 <li>[1162131] High CVE-2021-21122: Use after free in Blink. Reported
	 by Renata Hodovan on 2020-12-28</li>
	 <li>[1137247] High CVE-2021-21123: Insufficient data validation in
	 File System API. Reported by Maciej Pulikowski on 2020-10-11</li>
	 <li>[1131346] High CVE-2021-21124: Potential user after free in
	 Speech Recognizer. Reported by Chaoyang Ding(@V4kst1z) from
	 Codesafe Team of Legendsec at Qi'anxin Group on 2020-09-23</li>
	 <li>[1152327] High CVE-2021-21125: Insufficient policy enforcement
	 in File System API. Reported by Ron Masas (Imperva) on
	 2020-11-24</li>
	 <li>[1163228] High CVE-2020-16044: Use after free in WebRTC.
	 Reported by Ned Williamson of Project Zero on 2021-01-05</li>
	 <li>[1108126] Medium CVE-2021-21126: Insufficient policy enforcement
	 in extensions. Reported by David Erceg on 2020-07-22</li>
	 <li>[1115590] Medium CVE-2021-21127: Insufficient policy enforcement
	 in extensions. Reported by Jasminder Pal Singh, Web Services Point
	 WSP, Kotkapura on 2020-08-12</li>
	 <li>[1138877] Medium CVE-2021-21128: Heap buffer overflow in Blink.
	 Reported by Liang Dong on 2020-10-15</li>
	 <li>[1140403] Medium CVE-2021-21129: Insufficient policy enforcement
	 in File System API. Reported by Maciej Pulikowski on
	 2020-10-20</li>
	 <li>[1140410] Medium CVE-2021-21130: Insufficient policy enforcement
	 in File System API. Reported by Maciej Pulikowski on
	 2020-10-20</li>
	 <li>[1140417] Medium CVE-2021-21131: Insufficient policy enforcement
	 in File System API. Reported by Maciej Pulikowski on
	 2020-10-20</li>
	 <li>[1128206] Medium CVE-2021-21132: Inappropriate implementation in
	 DevTools. Reported by David Erceg on 2020-09-15</li>
	 <li>[1157743] Medium CVE-2021-21133: Insufficient policy enforcement
	 in Downloads. Reported by wester0x01
	 (https://twitter.com/wester0x01) on 2020-12-11</li>
	 <li>[1157800] Medium CVE-2021-21134: Incorrect security UI in Page
	 Info. Reported by wester0x01 (https://twitter.com/wester0x01) on
	 2020-12-11</li>
	 <li>[1157818] Medium CVE-2021-21135: Inappropriate implementation in
	 Performance API. Reported by ndevtk on 2020-12-11</li>
	 <li>[1038002] Low CVE-2021-21136: Insufficient policy enforcement in
	 WebView. Reported by Shiv Sahni, Movnavinothan V and Imdad
	 Mohammed on 2019-12-27</li>
	 <li>[1093791] Low CVE-2021-21137: Inappropriate implementation in
	 DevTools. Reported by bobblybear on 2020-06-11</li>
	 <li>[1122487] Low CVE-2021-21138: Use after free in DevTools.
	 Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec
	 at Qi'anxin Group on 2020-08-27</li>
	 <li>[1136327] Low CVE-2021-21140: Uninitialized Use in USB. Reported
	 by David Manouchehri on 2020-10-08</li>
	 <li>[1140435] Low CVE-2021-21141: Insufficient policy enforcement in
	 File System API. Reported by Maciej Pulikowski on 2020-10-20</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-16044</cvename>
 <cvename>CVE-2021-21117</cvename>
 <cvename>CVE-2021-21118</cvename>
 <cvename>CVE-2021-21119</cvename>
 <cvename>CVE-2021-21120</cvename>
 <cvename>CVE-2021-21121</cvename>
 <cvename>CVE-2021-21122</cvename>
 <cvename>CVE-2021-21123</cvename>
 <cvename>CVE-2021-21124</cvename>
 <cvename>CVE-2021-21125</cvename>
 <cvename>CVE-2021-21126</cvename>
 <cvename>CVE-2021-21127</cvename>
 <cvename>CVE-2021-21128</cvename>
 <cvename>CVE-2021-21129</cvename>
 <cvename>CVE-2021-21130</cvename>
 <cvename>CVE-2021-21131</cvename>
 <cvename>CVE-2021-21132</cvename>
 <cvename>CVE-2021-21133</cvename>
 <cvename>CVE-2021-21134</cvename>
 <cvename>CVE-2021-21135</cvename>
 <cvename>CVE-2021-21136</cvename>
 <cvename>CVE-2021-21137</cvename>
 <cvename>CVE-2021-21138</cvename>
 <cvename>CVE-2021-21139</cvename>
 <cvename>CVE-2021-21140</cvename>
 <cvename>CVE-2021-21141</cvename>
 <url>https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html</url>
 </references>
 <dates>
 <discovery>2021-01-19</discovery>
 <entry>2021-01-22</entry>
 </dates>
 </vuln>

<vuln vid="35aef72c-5c8e-11eb-8309-4ccc6adda413">
 <topic>chocolate-doom -- Arbitrary code execution</topic>
 <affects>
 <package>
	<name>chocolate-doom</name>
	<range><lt>3.0.1</lt></range>
 </package>
 <package>
	<name>crispy-doom</name>
	<range><lt>5.9.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michal Dardas from LogicalTrust reports:
	<blockquote cite="https://github.com/chocolate-doom/chocolate-doom/issues/1293">
	 
	 The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate
	 the user-controlled num_players value, leading to a buffer overflow. A
	 malicious user can overwrite the server's stack.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/chocolate-doom/chocolate-doom/issues/1293</url>
 <cvename>CVE-2020-14983</cvename>
 </references>
 <dates>
 <discovery>2020-06-22</discovery>
 <entry>2021-01-22</entry>
 </dates>
 </vuln>

<vuln vid="13c54e6d-5c45-11eb-b4e2-001b217b3468">
 <topic>nokogiri -- Security vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-nokogiri</name>
	<name>rubygem-nokogiri18</name>
	<range><lt>1.11.0.rc3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nokogiri reports:
	<blockquote cite="https://nokogiri.org/CHANGELOG.html">
	 In Nokogiri versions &lt;= 1.11.0.rc3, XML Schemas parsed by Nokogiri::XML::Schema were trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nokogiri.org/CHANGELOG.html</url>
 <cvename>CVE-2020-26247</cvename>
 </references>
 <dates>
 <discovery>2021-01-22</discovery>
 <entry>2021-01-22</entry>
 </dates>
 </vuln>

<vuln vid="5b5cf6e5-5b51-11eb-95ac-7f9491278677">
 <topic>dnsmasq -- DNS cache poisoning, and DNSSEC buffer overflow, vulnerabilities</topic>
 <affects>
 <package>
	<name>dnsmasq</name>
	<range><lt>2.83</lt></range>
 </package>
 <package> 
	<name>dnsmasq-devel</name>
	<range><lt>2.83</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Kelley reports:
	<blockquote cite="http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014599.html">
	 
	 There are broadly two sets of problems. The first is subtle errors
	 in dnsmasq's protections against the chronic weakness of the DNS
	 protocol to cache-poisoning attacks; the Birthday attack, Kaminsky,
	 etc.[...]
	 
	 
	 the second set of errors is a good old fashioned buffer overflow in
	 dnsmasq's DNSSEC code. If DNSSEC validation is enabled, an
	 installation is at risk.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014599.html</url>
 <url>https://www.jsof-tech.com/disclosures/dnspooq/</url>
 <cvename>CVE-2020-25684</cvename>
 <cvename>CVE-2020-25685</cvename>
 <cvename>CVE-2020-25686</cvename>
 <cvename>CVE-2020-25681</cvename>
 <cvename>CVE-2020-25682</cvename>
 <cvename>CVE-2020-25683</cvename>
 <cvename>CVE-2020-25687</cvename>
 </references>
 <dates>
 <discovery>2020-09-16</discovery> 
 <entry>2021-01-20</entry>
 </dates>
 </vuln>

<vuln vid="6a4805d5-5aaf-11eb-a21d-79f5bc5ef6a9">
 <topic>go -- cmd/go: packages using cgo can cause arbitrary code execution at build time; crypto/elliptic: incorrect operations on the P-224 curve</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.15.7,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/43783">
	 The go command may execute arbitrary code at build time when cgo is
	 in use on Windows. This may occur when running "go get", or
	 any other command that builds code. Only users who build untrusted
	 code (and don't execute it) are affected. In addition to Windows
	 users, this can also affect Unix users who have "." listed
	 explicitly in their PATH and are running "go get" or build
	 commands outside of a module or with module mode disabled.
	</blockquote>
	<blockquote cite="https://github.com/golang/go/issues/43786">
	 The P224() Curve implementation can in rare circumstances generate
	 incorrect outputs, including returning invalid points from
	 ScalarMult. The crypto/x509 and golang.org/x/crypto/ocsp (but not
	 crypto/tls) packages support P-224 ECDSA keys, but they are not
	 supported by publicly trusted certificate authorities. No other
	 standard library or golang.org/x/crypto package supports or uses the
	 P-224 curve.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2021-3115</cvename>
 <url>http://golang.org/issue/43783</url>
 <cvename>CVE-2021-3114</cvename>
 <url>http://golang.org/issue/43786</url>
 </references>
 <dates>
 <discovery>2021-01-13</discovery>
 <entry>2021-01-19</entry>
 </dates>
 </vuln>

<vuln vid="8899298f-5a92-11eb-8558-3085a9a47796">
 <topic>cloud-init -- Wrong access permissions of authorized keys</topic>
 <affects>
 <package>
 <name>cloud-init</name>
 <range><ge>20.4</ge><lt>20.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cloud-init reports:
	<blockquote cite="https://bugs.launchpad.net/cloud-init/+bug/1911680">
	 cloud-init release 20.4.1 is now available. This is a hotfix
	 release, that contains a single patch to address a security issue in
	 cloud-init 20.4.

Briefly, for users who provide more than one unique SSH key to
	 cloud-init and have a shared AuthorizedKeysFile configured in
	 sshd_config, cloud-init 20.4 started writing all of these keys to such a
	 file, granting all such keys SSH access as root.

It's worth restating this implication: if you are using the default
	 AuthorizedKeysFile setting in /etc/ssh/sshd_config, as most will be,
	 then you are _not_ affected by this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.launchpad.net/cloud-init/+bug/1911680</url>
 </references>
 <dates>
 <discovery>2021-01-14</discovery>
 <entry>2021-01-19</entry>
 </dates>
 </vuln>

<vuln vid="abed4ff0-7da1-4236-880d-de33e4895315">
 <topic>moinmoin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moinmoin</name>
	<range><lt>1.9.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MoinMoin reports:
	<blockquote cite="https://github.com/moinwiki/moin-1.9/blob/1.9.11/docs/CHANGES#L13">
	<ul>
	 <li>Security fix for CVE-2020-25074: fix remote code execution via cache action</li>
	 <li>Security fix for CVE-2020-15275: fix malicious SVG attachment causing stored XSS vulnerability</li>
	</ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/moinwiki/moin-1.9/blob/1.9.11/docs/CHANGES#L13</url>
 <cvename>CVE-2020-25074</cvename>
 <cvename>CVE-2020-15275</cvename>
 </references>
 <dates>
 <discovery>2020-11-08</discovery>
 <entry>2021-01-18</entry>
 </dates>
 </vuln>

<vuln vid="62642942-590f-11eb-a0dc-8c164582fbac">
 <topic>Ghostscript -- SAFER Sandbox Breakout</topic>
 <affects>
 <package>
	<name>ghostscript9-agpl-base</name>
	<range><ge>9.50</ge><lt>9.52_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2020-15900">
	 A memory corruption issue was found in Artifex
	 Ghostscript 9.50 and 9.52. Use of a non-standard
	 PostScript operator can allow overriding of file access
	 controls. The 'rsearch' calculation for the 'post' size
	 resulted in a size that was too large, and could underflow
	 to max uint32_t. This was fixed in commit
	 5d499272b95a6b890a1397e11d20937de000d31b.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-15900</url>
 </references>
 <dates>
 <discovery>2020-07-28</discovery>
 <entry>2021-01-17</entry>
 </dates>
 </vuln>

<vuln vid="08b553ed-537a-11eb-be6e-0022489ad614">
 <topic>Node.js -- January 2021 Security Releases</topic>
 <affects>
 <package>
	<name>node10</name>
	<range><lt>10.23.1</lt></range>
 </package>
 <package>
	<name>node12</name>
	<range><lt>12.20.1</lt></range>
 </package>
 <package>
	<name>node14</name>
	<range><lt>14.15.4</lt></range>
 </package>
 <package>
	<name>node</name>
	<range><lt>15.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/">
	 <h1>use-after-free in TLSWrap (High) (CVE-2020-8265)</h1>
	 Affected Node.js versions are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.
	 <h1>HTTP Request Smuggling in nodejs (Low) (CVE-2020-8287)</h1>
	 Affected versions of Node.js allow two copies of a header field in a http request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.
	 <h1>OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)</h1>
	 iThis is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20201208.txt.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/</url>
 <url>https://www.openssl.org/news/secadv/20201208.txt</url>
 <cvename>CVE-2020-8265</cvename>
 <cvename>CVE-2020-8287</cvename>
 <cvename>CVE-2020-1971</cvename>
 </references>
 <dates>
 <discovery>2021-01-04</discovery>
 <entry>2021-01-14</entry>
 </dates>
 </vuln>

<vuln vid="0a8ebf4a-5660-11eb-b4e2-001b217b3468">
 <topic>Gitlab -- vulnerability</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.7.0</ge><lt>13.7.4</lt></range>
	<range><ge>13.6.0</ge><lt>13.6.5</lt></range>
	<range><ge>12.2</ge><lt>13.5.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GitLab Team reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/01/14/critical-security-release-gitlab-13-7-4-released/">
	 Ability to steal a user's API access token through GitLab Pages
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2021/01/14/critical-security-release-gitlab-13-7-4-released/</url>
 </references>
 <dates>
 <discovery>2021-01-14</discovery>
 <entry>2021-01-14</entry>
 </dates>
 </vuln>

<vuln vid="6d554d6e-5638-11eb-9d36-5404a68ad561">
 <topic>wavpack -- integer overflow in pack_utils.c</topic>
 <affects>
 <package>
	<name>wavpack</name>
	<range><lt>5.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The wavpack project reports:
	<blockquote cite="https://github.com/dbry/WavPack/blob/733616993d53cc1f9a7ffb88a858447ba51eb0ee/ChangeLog">
	 src/pack_utils.c
	 - issue #91: fix integer overflows resulting in buffer overruns (CVE-2020-35738)
	 - sanitize configuration parameters better (improves clarity and aids debugging)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/dbry/WavPack/blob/733616993d53cc1f9a7ffb88a858447ba51eb0ee/ChangeLog</url>
 <cvename>CVE-2020-35738</cvename>
 </references>
 <dates>
 <discovery>2020-12-29</discovery>
 <entry>2021-01-14</entry>
 </dates>
 </vuln>

<vuln vid="d6f76976-e86d-4f9a-9362-76c849b10db2">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.275</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.263.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2021-01-13/">
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-1452 / CVE-2021-21602</h5>
	 Arbitrary file read vulnerability in workspace browsers
	 <h5>(High) SECURITY-1889 / CVE-2021-21603</h5>
	 XSS vulnerability in notification bar
	 <h5>(High) SECURITY-1923 / CVE-2021-21604</h5>
	 Improper handling of REST API XML deserialization errors
	 <h5>(High) SECURITY-2021 / CVE-2021-21605</h5>
	 Path traversal vulnerability in agent names
	 <h5>(Medium) SECURITY-2023 / CVE-2021-21606</h5>
	 Arbitrary file existence check in file fingerprints
	 <h5>(Medium) SECURITY-2025 / CVE-2021-21607</h5>
	 Excessive memory allocation in graph URLs leads to denial of service
	 <h5>(High) SECURITY-2035 / CVE-2021-21608</h5>
	 Stored XSS vulnerability in button labels
	 <h5>(Low) SECURITY-2047 / CVE-2021-21609</h5>
	 Missing permission check for paths with specific prefix
	 <h5>(High) SECURITY-2153 / CVE-2021-21610</h5>
	 Reflected XSS vulnerability in markup formatter preview
	 <h5>(High) SECURITY-2171 / CVE-2021-21611</h5>
	 Stored XSS vulnerability on new item page
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.jenkins.io/security/advisory/2021-01-13/</url>
 </references>
 <dates>
 <discovery>2021-01-13</discovery>
 <entry>2021-01-13</entry>
 </dates>
 </vuln>

<vuln vid="1f655433-551b-11eb-9cda-589cfc0f81b0">
 <topic>phpmyfaq -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><le>3.0.6</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpmyfaq developers report:
	<blockquote cite="https://www.phpmyfaq.de/security/advisory-2020-12-23">
	 phpMyFAQ does not implement sufficient checks to avoid XSS
	 injection for displaying tags. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyfaq.de/security/advisory-2020-12-23</url>
 </references>
 <dates>
 <discovery>2020-12-23</discovery>
 <entry>2021-01-12</entry>
 </dates>
 </vuln>

<vuln vid="6193b3f6-548c-11eb-ba01-206a8a720317">
 <topic>sudo -- Potential information leak in sudoedit</topic>
 <affects>
 <package>
 <name>sudo</name>
 <range><lt>1.9.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Todd C. Miller reports:
 <blockquote cite="https://www.sudo.ws/stable.html#1.9.5">
	 A potential information leak in sudoedit that could be used to
	 test for the existence of directories not normally accessible to
	 the user in certain circumstances. When creating a new file,
	 sudoedit checks to make sure the parent directory of the new file
	 exists before running the editor. However, a race condition exists
	 if the invoking user can replace (or create) the parent directory.
	 If a symbolic link is created in place of the parent directory,
	 sudoedit will run the editor as long as the target of the link
	 exists.If the target of the link does not exist, an error message
	 will be displayed. The race condition can be used to test for the
	 existence of an arbitrary directory. However, it _cannot_ be used
	 to write to an arbitrary location.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://www.sudo.ws/stable.html#1.9.5</url>
 <cvename>CVE-2021-23239</cvename>
 </references>
 <dates>
 <discovery>2021-01-11</discovery>
 <entry>2021-01-11</entry>
 </dates>
 </vuln>

<vuln vid="a3cef1e6-51d8-11eb-9b8d-08002728f74c">
 <topic>CairoSVG -- Regular Expression Denial of Service vulnerability</topic>
 <affects>
 <package>
	<name>py36-cairosvg</name>
	<name>py37-cairosvg</name>
	<name>py38-cairosvg</name>
	<name>py39-cairosvg</name>
	<range><ge>2.0.0</ge><lt>2.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CairoSVG security advisories:
	<blockquote cite="https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf">
	 When processing SVG files, the python package CairoSVG uses two regular
	 expressions which are vulnerable to Regular Expression Denial of Service
	 (REDoS).
	 If an attacker provides a malicious SVG, it can make cairosvg get stuck
	 processing the file for a very long time.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf</url>
 </references>
 <dates>
 <discovery>2020-12-30</discovery>
 <entry>2021-01-10</entry>
 </dates>
 </vuln>

<vuln vid="a2a2b34d-52b4-11eb-87cb-001b217b3468">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.7.0</ge><lt>13.7.2</lt></range>
	<range><ge>13.6.0</ge><lt>13.6.4</lt></range>
	<range><ge>12.2</ge><lt>13.5.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2-released/">
	 Ability to steal a user's API access token through GitLab Pages
	 Prometheus denial of service via HTTP request with custom method
	 Unauthorized user is able to access private repository information under specific conditions
	 Regular expression denial of service in NuGet API
	 Regular expression denial of service in package uploads
	 Update curl dependency
	 CVE-2019-3881 mitigation
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2-released/</url>
 <cvename>CVE-2021-22166</cvename>
 <cvename>CVE-2020-26414</cvename>
 <cvename>CVE-2019-3881</cvename>
 </references>
 <dates>
 <discovery>2021-01-07</discovery>
 <entry>2021-01-09</entry>
 </dates>
 </vuln>

<vuln vid="d153c4d2-50f8-11eb-8046-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>87.0.4280.141</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html">
	 This release includes 16 security fixes, including:
	 <ul>
	 <li>[1148749] High CVE-2021-21106: Use after free in autofill.
	 Reported by Weipeng Jiang (@Krace) from Codesafe Team of
	 Legendsec at Qi'anxin Group on 2020-11-13</li>
	 <li>[1153595] High CVE-2021-21107: Use after free in drag and
	 drop. Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2020-11-30</li>
	 <li>[1155426] High CVE-2021-21108: Use after free in media.
	 Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2020-12-04</li>
	 <li>[1152334] High CVE-2021-21109: Use after free in payments.
	 Reported by Rong Jian and Guang Gong of 360 Alpha Lab on
	 2020-11-24</li>
	 <li>[1152451] High CVE-2021-21110: Use after free in safe
	 browsing. Reported by Anonymous on 2020-11-24</li>
	 <li>[1149125] High CVE-2021-21111: Insufficient policy enforcement
	 in WebUI. Reported by Alesandro Ortiz on 2020-11-15</li>
	 <li>[1151298] High CVE-2021-21112: Use after free in Blink.
	 Reported by YoungJoo Lee(@ashuu_lee) of Raon Whitehat on
	 2020-11-20</li>
	 <li>[1155178] High CVE-2021-21113: Heap buffer overflow in Skia.
	 Reported by tsubmunu on 2020-12-03</li>
	 <li>[1148309] High CVE-2020-16043: Insufficient data validation in
	 networking. Reported by Samy Kamkar, Ben Seri at Armis, Gregory
	 Vishnepolsky at Armis on 2020-11-12</li>
	 <li>[1150065] High CVE-2021-21114: Use after free in audio.
	 Reported by Man Yue Mo of GitHub Security Lab on 2020-11-17</li>
	 <li>[1157790] High CVE-2020-15995: Out of bounds write in V8.
	 Reported by Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu
	 Lab on 2020-12-11</li>
	 <li>[1157814] High CVE-2021-21115: Use after free in safe browsing.
	 Reported by Leecraso and Guang Gong of 360 Alpha Lab on
	 2020-12-11</li>
	 <li>[1151069] Medium CVE-2021-21116: Heap buffer overflow in audio.
	 Reported by Alison Huffman, Microsoft Browser Vulnerability
	 Research on 2020-11-19</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-15995</cvename>
 <cvename>CVE-2020-16043</cvename>
 <cvename>CVE-2021-21106</cvename>
 <cvename>CVE-2021-21107</cvename>
 <cvename>CVE-2021-21108</cvename>
 <cvename>CVE-2021-21109</cvename>
 <cvename>CVE-2021-21110</cvename>
 <cvename>CVE-2021-21111</cvename>
 <cvename>CVE-2021-21112</cvename>
 <cvename>CVE-2021-21113</cvename>
 <cvename>CVE-2021-21114</cvename>
 <cvename>CVE-2021-21115</cvename>
 <cvename>CVE-2021-21116</cvename>
 <url>https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2021-01-06</discovery>
 <entry>2021-01-07</entry>
 </dates>
 </vuln>

<vuln vid="bd98066d-4ea4-11eb-b412-e86a64caca56">
 <topic>mail/dovecot -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><lt>2.3.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aki Tuomi reports:
	<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html">
	 When imap hibernation is active, an attacker can cause Dovecot to
	 discover file system directory structure and access other users'
	 emails using specially crafted command.
	 The attacker must have valid credentials to access the
	 mail server.
	</blockquote>
	<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html">
	 Mail delivery / parsing crashed when the 10 000th MIME part was
	 message/rfc822 (or if parent was multipart/digest). This happened
	 due to earlier MIME parsing changes for CVE-2020-12100.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://dovecot.org/pipermail/dovecot-news/2021-January/000448.html</url>
 <cvename>CVE-2020-24386</cvename>
 <cvename>CVE-2020-25275</cvename>
 </references>
 <dates>
 <discovery>2020-08-17</discovery>
 <entry>2021-01-04</entry>
 </dates>
 </vuln>

<vuln vid="2739b88b-4b88-11eb-a4c0-08002734b9ed">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.13.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.13.1:
	<blockquote cite="https://blog.gitea.io/2020/12/gitea-1.13.1-is-released/">
	 <ul>
	 <li>Hide private participation in Orgs</li>
	 <li>Fix escaping issue in diff</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.13.1</url>
 <freebsdpr>ports/252310</freebsdpr>
 </references>
 <dates>
 <discovery>2020-12-15</discovery>
 <entry>2020-12-31</entry>
 </dates>
 </vuln>

<vuln vid="53e9efa1-4be7-11eb-8558-3085a9a47796">
 <topic>InspIRCd websocket module double free vulnerability</topic>
 <affects>
 <package>
	<name>inspircd</name>
	<range><lt>3.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The InspIRCd development team reports:
	<blockquote cite="https://docs.inspircd.org/security/2020-02/">
	 The websocket module before v3.8.1 contains a double free
	 vulnerability. When combined with a HTTP reverse proxy this
	 vulnerability can be used by any user who is [GKZ]-lined to remotely
	 crash an InspIRCd server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.inspircd.org/security/2020-02/</url>
 </references>
 <dates>
 <discovery>2020-02-01</discovery>
 <entry>2021-01-01</entry>
 </dates>
 </vuln>

<vuln vid="fbcba194-ac7d-11ea-8b5e-b42e99a1b9c3">
 <topic>Intel CPU issues</topic>
 <affects>
 <package>
	<name>devcpu-data</name>
	<range><lt>1.31</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Intel reports:
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00320.html">
	 Intel CPUs suffer Special Register Buffer Data Sampling vulnerability
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://software.intel.com/security-software-guidance/insights/processors-affected-special-register-buffer-data-sampling</url>
 <cvename>CVE-2020-0543</cvename>
 </references>
 <dates>
 <discovery>2020-06-09</discovery>
 <entry>2020-12-28</entry>
 </dates>
 </vuln>

<vuln vid="6adf6ce0-44a6-11eb-95b7-001999f8d30b">
 <topic>asterisk -- Remote crash in res_pjsip_diversion</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.38.1</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><lt>16.15.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><lt>18.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 AST-2020-003: A crash can occur in Asterisk when a SIP
	 message is received that has a History-Info header, which
	 contains a tel-uri.
	 AST-2020-004: A crash can occur in Asterisk when a SIP
	 181 response is received that has a Diversion header,
	 which contains a tel-uri.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2020-003.html</url>
 <url>https://downloads.asterisk.org/pub/security/AST-2020-004.html</url>
 </references>
 <dates>
 <discovery>2020-12-02</discovery>
 <entry>2020-12-22</entry>
 </dates>
 </vuln>

<vuln vid="eb2845c4-43ce-11eb-aba5-00a09858faf5">
 <topic>postsrsd -- Denial of service vulnerability</topic>
 <affects>
 <package>
	<name>postsrsd</name>
	<range><lt>1.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	postsrsd developer reports:
	<blockquote cite="https://github.com/roehling/postsrsd/commit/4733fb11f6bec6524bb8518c5e1a699288c26bac">
	 PostSRSd could be tricked into consuming a lot of CPU time with
	 an SRS address that has an excessively long time stamp tag.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-35573</cvename>
 <url>https://github.com/roehling/postsrsd/commit/4733fb11f6bec6524bb8518c5e1a699288c26bac</url>
 <url>https://github.com/roehling/postsrsd/releases/tag/1.10</url>
 </references>
 <dates>
 <discovery>2020-12-12</discovery>
 <entry>2020-12-21</entry>
 </dates>
 </vuln>

<vuln vid="61d89849-43cb-11eb-aba5-00a09858faf5">
 <topic>powerdns -- Various issues in GSS-TSIG support</topic>
 <affects>
 <package>
	<name>powerdns</name>
	<range><lt>4.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS developers report:
	<blockquote cite="https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-06.html">
	 A remote, unauthenticated attacker can trigger a race condition
	 leading to a crash, or possibly arbitrary code execution, by sending crafted queries with a GSS-TSIG signature.
	 A remote, unauthenticated attacker can cause a denial of service by
	 sending crafted queries with a GSS-TSIG signature.
	 A remote, unauthenticated attacker might be able to cause a double-free,
	 leading to a crash or possibly arbitrary code execution by sending crafted queries with a GSS-TSIG signature.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-24696</cvename>
 <cvename>CVE-2020-24697</cvename>
 <cvename>CVE-2020-24698</cvename>
 <url>https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-06.html</url>
 </references>
 <dates>
 <discovery>2020-08-27</discovery>
 <entry>2020-12-21</entry>
 </dates>
 </vuln>

<vuln vid="cc1fd3da-b8fd-4f4d-a092-c38541c0f993">
 <topic>vault -- User Enumeration via LDAP auth</topic>
 <affects>
 <package>
	<name>vault</name>
	<range><lt>1.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Vault developers report:
	<blockquote cite="https://discuss.hashicorp.com/t/hcsec-2020-25-vault-s-ldap-auth-method-allows-user-enumeration/18984">
	 Vault allowed enumeration of users via the LDAP auth method. This vulnerability, was fixed in Vault 1.6.1 and 1.5.6.
	 An external party reported that they were able to enumerate LDAP users via error messages returned by Vault’s LDAP auth method
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-35177</cvename>
 <url>https://discuss.hashicorp.com/t/hcsec-2020-25-vault-s-ldap-auth-method-allows-user-enumeration/18984</url>
 </references>
 <dates>
 <discovery>2020-12-16</discovery>
 <entry>2020-12-17</entry>
 </dates>
 </vuln>

<vuln vid="85349584-3ba4-11eb-919d-08002728f74c">
 <topic>jasper -- heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>jasper</name>
	<range><lt>2.0.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	JasPer NEWS:
	<blockquote cite="https://github.com/jasper-software/jasper/blob/master/NEWS">
	 Fix CVE-2020-27828, heap-overflow in cp_create() in jpc_enc.c.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-27828</cvename>
 <url>https://github.com/jasper-software/jasper/blob/master/NEWS</url>
 <url>https://github.com/jasper-software/jasper/issues/252</url>
 </references>
 <dates>
 <discovery>2020-12-08</discovery>
 <entry>2020-12-13</entry>
 </dates>
 </vuln>

<vuln vid="cfa0be42-3cd7-11eb-9de7-641c67a117d8">
 <topic>py-matrix-synapse -- DoS on Federation API</topic>
 <affects>
 <package>
	<name>py36-matrix-synapse</name>
	<name>py37-matrix-synapse</name>
	<name>py38-matrix-synapse</name>
	<name>py39-matrix-synapse</name>
	<range><lt>1.23.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers reports:
	<blockquote cite="https://github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mm">
	 A malicious or poorly-implemented homeserver can inject malformed events
	 into a room by specifying a different room id in the path of a /send_join,
	 /send_leave, /invite or /exchange_third_party_invite request.
	 This can lead to a denial of service in which future events will not be
	 correctly sent to other servers over federation.
	 This affects any server which accepts federation requests from untrusted
	 servers.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-26257</cvename>
 <url>https://github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mm</url>
 <freebsdpr>ports/251768</freebsdpr>
 </references>
 <dates>
 <discovery>2020-12-09</discovery>
 <entry>2020-12-13</entry>
 </dates>
 </vuln>

<vuln vid="fdc49972-3ca7-11eb-929d-d4c9ef517024">
 <topic>p11-kit -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>p11-kit</name>
	<range><lt>0.23.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The p11-glue project reports:
	<blockquote cite="https://lists.freedesktop.org/archives/p11-glue/2020-December/000712.html">
	 CVE-2020-29363: Out-of-bounds write in
	 p11_rpc_buffer_get_byte_array_value function A heap-based buffer
	 overflow has been discovered in the RPC protocol used by p11-kit
	 server/remote commands and the client library. When the remote
	 entity supplies a serialized byte array in a CK_ATTRIBUTE, the
	 receiving entity may not allocate sufficient length for the buffer
	 to store the deserialized value.
	 CVE-2020-29362: Out-of-bounds read in p11_rpc_buffer_get_byte_array
	 function A heap-based buffer over-read has been discovered in
	 the RPC protocol used by thep11-kit server/remote commands and the
	 client library. When the remote entity supplies a byte array through
	 a serialized PKCS#11 function call, the receiving entity may allow
	 the reading of up to 4 bytes of memory past the heap
	 allocation.
	 CVE-2020-29361: Integer overflow when allocating memory for arrays
	 of attributes and object identifiers Multiple integer overflows
	 have been discovered in the array allocations in the p11-kit library
	 and the p11-kit list command, where overflow checks are missing
	 before calling realloc or calloc.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.freedesktop.org/archives/p11-glue/2020-December/000712.html</url>
 <cvename>CVE-2020-29361</cvename>
 <cvename>CVE-2020-29362</cvename>
 <cvename>CVE-2020-29363</cvename>
 </references>
 <dates>
 <discovery>2020-12-12</discovery>
 <entry>2020-12-12</entry>
 </dates>
 </vuln>

<vuln vid="388ebb5b-3c95-11eb-929d-d4c9ef517024">
 <topic>Unbound/NSD -- Denial of service vulnerability</topic>
 <affects>
 <package>
	<name>unbound</name>
	<range><lt>1.13.0</lt></range>
 </package>
 <package>
	<name>nsd</name>
	<range><lt>4.3.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NLNetLabs reports:
	<blockquote cite="https://nlnetlabs.nl/downloads/unbound/CVE-2020-28935.txt">
	 Unbound and NSD when writing the PID file would not check if an
	 existing file was a symlink. This could allow for a local symlink \
	 attack if an attacker has access to the user Unbound/NSD runs as.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nlnetlabs.nl/downloads/unbound/CVE-2020-28935.txt</url>
 <cvename>CVE-2020-28935</cvename>
 </references>
 <dates>
 <discovery>2020-12-01</discovery>
 <entry>2020-12-12</entry>
 </dates>
 </vuln>

<vuln vid="88dfd92f-3b9c-11eb-929d-d4c9ef517024">
 <topic>LibreSSL -- NULL pointer dereference</topic>
 <affects>
 <package>
	<name>libressl</name>
	<range><gt>3.2.0</gt><lt>3.2.3</lt></range>
	<range><lt>3.1.5</lt></range>
 </package>
 <package>
	<name>libressl-devel</name>
	<range><lt>3.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The LibreSSL project reports:
	<blockquote cite="https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.3-relnotes.txt">
	 Malformed ASN.1 in a certificate revocation list or a timestamp
	 response token can lead to a NULL pointer dereference.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.3-relnotes.txt</url>
 </references>
 <dates>
 <discovery>2020-12-08</discovery>
 <entry>2020-12-11</entry>
 <modified>2020-12-12</modified>
 </dates>
 </vuln>

<vuln vid="b3695b08-3b3a-11eb-af2a-080027dbe4b7">
 <topic>glpi -- Public GLPIKEY can be used to decrypt any data</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>9.4.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5248">
	 GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-j222-j9mf-h6j9</url>
 <url>https://github.com/glpi-project/glpi/commit/efd14468c92c4da43333aa9735e65fd20cbc7c6c</url>
 <cvename>CVE-2020-5248</cvename>
 </references>
 <dates>
 <discovery>2020-01-02</discovery>
 <entry>2020-01-02</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="695b2310-3b3a-11eb-af2a-080027dbe4b7">
 <topic>glpi -- Insecure Direct Object Reference on ajax/getDropdownValue.php</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>9.5.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27663">
	 In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-pqfv-4pvr-55r4</url>
 <cvename>CVE-2020-27663</cvename>
 </references>
 <dates>
 <discovery>2020-10-22</discovery>
 <entry>2020-10-22</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="190176ce-3b3a-11eb-af2a-080027dbe4b7">
 <topic>glpi -- Insecure Direct Object Reference on ajax/comments.ph</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>9.5.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27662">
	 In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-wq38-gwxp-8p5p</url>
 <cvename>CVE-2020-27662</cvename>
 </references>
 <dates>
 <discovery>2020-10-22</discovery>
 <entry>2020-10-22</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="6a467439-3b38-11eb-af2a-080027dbe4b7">
 <topic>glpi -- Any CalDAV calendars is read-only for every authenticated user</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>9.5.0,1</ge><lt>9.5.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26212">
	 In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of every other user, even admin ones. This issue is fixed in version 9.5.3. As a workaround, one can remove the caldav.php file to block access to CalDAV server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw3-87hr-5wgx</url>
 <url>https://github.com/glpi-project/glpi/commit/527280358ec78988ac57e9809d2eb21fcd74caf7</url>
 <url>https://github.com/glpi-project/glpi/releases/tag/9.5.3</url>
 <cvename>CVE-2020-26212</cvename>
 </references>
 <dates>
 <discovery>2020-10-01</discovery>
 <entry>2020-10-01</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="0ba61fcc-3b38-11eb-af2a-080027dbe4b7">
 <topic>glpi -- SQL Injection in Search API</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>9.1,1</ge><lt>9.5.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15226">
	 In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it is also possible to utilise a UNION SELECT query to reflect sensitive information such as the current database version, or database user. The most likely scenario for this vulnerability is with someone who has an API account to the system. The issue is patched in version 9.5.2. A proof-of-concept with technical details is available in the linked advisory.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/commit/3dc4475c56b241ad659cc5c7cb5fb65727409cf0</url>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-jwpv-7m4h-5gvc</url>
 <cvename>CVE-2020-15226</cvename>
 </references>
 <dates>
 <discovery>2020-06-25</discovery>
 <entry>2020-06-25</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="5acd95db-3b16-11eb-af2a-080027dbe4b7">
 <topic>glpi -- leakage issue with knowledge base</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>9.5.0,1</ge><lt>9.5.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15217">
	 In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/commit/39e25591efddc560e3679ab07e443ee6198705e2</url>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-x9hg-j29f-wvvv</url>
 <cvename>CVE-2020-15217</cvename>
 </references>
 <dates>
 <discovery>2020-06-25</discovery>
 <entry>2020-06-25</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="09eef008-3b16-11eb-af2a-080027dbe4b7">
 <topic>glpi -- Unauthenticated Stored XSS</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>9.5.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15177">
	 In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api`. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication is not required to perform these changes,anyone could point these fields at malicious websites or form input in a way to trigger XSS. Leveraging JavaScript it's possible to steal cookies, perform actions as the user, etc. The issue is patched in version 9.5.2.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/commit/a8109d4ee970a222faf48cf48fae2d2f06465796</url>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-prvh-9m4h-4m79</url>
 <cvename>CVE-2020-15177</cvename>
 </references>
 <dates>
 <discovery>2020-06-25</discovery>
 <entry>2020-06-25</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="b7abdb0f-3b15-11eb-af2a-080027dbe4b7">
 <topic>glpi -- Multiple SQL Injections Stemming From isNameQuoted()</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>9.5.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15176">
	 In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/commit/f021f1f365b4acea5066d3e57c6d22658cf32575</url>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-x93w-64x9-58qw</url>
 <cvename>CVE-2020-15176</cvename>
 </references>
 <dates>
 <discovery>2020-06-25</discovery>
 <entry>2020-06-25</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="675e5098-3b15-11eb-af2a-080027dbe4b7">
 <topic>glpi -- Unauthenticated File Deletion</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>9.5.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15175">
	 In GLPI before version 9.5.2, the pluginimage.send.php endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in /files/. Some of the sensitive information that is compromised are the user sessions, logs, and more. An attacker would be able to get the Administrators session token and use that to authenticate. The issue is patched in version 9.5.2.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-rm52-jx9h-rwcp</url>
 <url>https://github.com/glpi-project/glpi/commit/6ca9a0e77299a755c356d758344a23278df67f65</url>
 <cvename>CVE-2020-15175</cvename>
 </references>
 <dates>
 <discovery>2020-06-25</discovery>
 <entry>2020-06-25</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="7f163c81-3b12-11eb-af2a-080027dbe4b7">
 <topic>glpi -- SQL injection for all usages of "Clone" feature</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>9.5.0,1</ge><lt>9.5.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15108">
	 In glpi before 9.5.1, there is a SQL injection for all usages of "Clone" feature. This has been fixed in 9.5.1.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-qv6w-68gq-wx2v</url>
 <url>https://github.com/glpi-project/glpi/commit/a4baa64114eb92fd2adf6056a36e0582324414ba</url>
 <url>https://github.com/glpi-project/glpi/pull/6684</url>
 <cvename>CVE-2020-15108</cvename>
 </references>
 <dates>
 <discovery>2020-06-25</discovery>
 <entry>2020-06-25</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="07aecafa-3b12-11eb-af2a-080027dbe4b7">
 <topic>glpi -- Reflexive XSS in Dropdown menus</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>9.4.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11062">
	 In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type. This has been fixed in version 9.4.6.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-3xxh-f5p2-jg3h</url>
 <url>https://github.com/glpi-project/glpi/commit/5e1c52c5e8a30ceb4e9572964da7ed89ddfb1aaf</url>
 <cvename>CVE-2020-11062</cvename>
 </references>
 <dates>
 <discovery>2020-03-30</discovery>
 <entry>2020-03-30</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="832fd11b-3b11-11eb-af2a-080027dbe4b7">
 <topic>glpi -- Remote Code Execution (RCE) via the backup functionality</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>9.4.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11060">
	 In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-cvvq-3fww-5v6f</url>
 <url>https://github.com/glpi-project/glpi/commit/ad748d59c94da177a3ed25111c453902396f320c</url>
 <cvename>CVE-2020-11060</cvename>
 </references>
 <dates>
 <discovery>2020-03-30</discovery>
 <entry>2020-03-30</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="27a230a2-3b11-11eb-af2a-080027dbe4b7">
 <topic>glpi -- multiple related stored XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>9.4.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11036">
	 In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "alert(1)" reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by an outside party through the following steps: 1. Create a user with the surname `" onmouseover="alert(document.cookie)` and an empty first name. 2. With this user, create a ticket 3. As an administrator (or other privileged user) open the created ticket 4. On the "last update" field, put your mouse on the name of the user 5. The XSS fires This is fixed in version 9.4.6.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385</url>
 <url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/</url>
 <url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/</url>
 <cvename>CVE-2020-11036</cvename>
 </references>
 <dates>
 <discovery>2020-03-30</discovery>
 <entry>2020-03-30</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="b64edef7-3b10-11eb-af2a-080027dbe4b7">
 <topic>glpi -- weak csrf tokens</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>0.83.3,1</ge><lt>9.4.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11035">
	 In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-w7q8-58qp-vmpf</url>
 <url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/</url>
 <url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/</url>
 <cvename>CVE-2020-11035</cvename>
 </references>
 <dates>
 <discovery>2020-03-30</discovery>
 <entry>2020-03-30</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="3a63f478-3b10-11eb-af2a-080027dbe4b7">
 <topic>glpi -- bypass of the open redirect protection</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>9.4.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11034">
	 In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in version 9.4.6.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg</url>
 <url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/</url>
 <url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/</url>
 <cvename>CVE-2020-11034</cvename>
 </references>
 <dates>
 <discovery>2020-03-30</discovery>
 <entry>2020-03-30</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="aec9cbe0-3b0f-11eb-af2a-080027dbe4b7">
 <topic>glpi -- able to read any token through API user endpoint</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><ge>9.1,1</ge><lt>9.4.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11033">
	 In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All api_tokens which can be used to do privileges escalations or read/update/delete data normally non accessible to the current user. - All personal_tokens can display another users planning. Exploiting this vulnerability requires the api to be enabled, a technician account. It can be mitigated by adding an application token. This is fixed in version 9.4.6.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-rf54-3r4w-4h55</url>
 <url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/</url>
 <url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/</url>
 <cvename>CVE-2020-11033</cvename>
 </references>
 <dates>
 <discovery>2020-03-30</discovery>
 <entry>2020-03-30</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="b3aae7ea-3aef-11eb-af2a-080027dbe4b7">
 <topic>glpi -- SQL injection for all helpdesk instances</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>9.4.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11032">
	 In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-344w-34h9-wwhh</url>
 <cvename>CVE-2020-11032</cvename>
 </references>
 <dates>
 <discovery>2020-03-30</discovery>
 <entry>2020-03-30</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="0309c898-3aed-11eb-af2a-080027dbe4b7">
 <topic>glpi -- Improve encryption algorithm</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>9.5.0,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11031">
	 In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library chosen is sodium.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-7xwm-4vjr-jvqh</url>
 <url>https://github.com/glpi-project/glpi/commit/f1ae6c8481e5c19a6f1801a5548cada45702e01a#diff-b5d0ee8c97c7abd7e3fa29b9a27d1780</url>
 <url>https://github.com/glpi-project/glpi/commit/f1ae6c8481e5c19a6f1801a5548cada45702e01a#diff-b5d0ee8c97c7abd7e3fa29b9a27d1780</url>
 <cvename>CVE-2020-11031</cvename>
 </references>
 <dates>
 <discovery>2020-03-30</discovery>
 <entry>2020-03-30</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="d3f60db0-3aea-11eb-af2a-080027dbe4b7">
 <topic>glpi -- Account takeover vulnerability</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>9.4.4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14666">
	 GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14666</url>
 <url>https://github.com/glpi-project/glpi/security/advisories/GHSA-47hq-pfrr-jh5q</url>
 <url>https://www.tarlogic.com/advisories/Tarlogic-2019-GPLI-Account-Takeover.txt</url>
 <cvename>CVE-2019-14666</cvename>
 </references>
 <dates>
 <discovery>2019-08-05</discovery>
 <entry>2019-08-05</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="3c77f139-3a09-11eb-929d-d4c9ef517024">
 <topic>cURL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><gt>4.0</gt><lt>7.74.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports:
	<blockquote cite="https://curl.se/docs/security.html">
	 Trusting FTP PASV responses (CVE-2020-8284)
	 FTP wildcard stack overflow (CVE-2020-8285)
	 Inferior OCSP verification (CVE-2020-8286)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.se/docs/security.html</url>
 <cvename>CVE-2020-8284</cvename>
 <cvename>CVE-2020-8285</cvename>
 <cvename>CVE-2020-8286</cvename>
 </references>
 <dates>
 <discovery>2020-12-09</discovery>
 <entry>2020-12-09</entry>
 </dates>
 </vuln>

<vuln vid="1d56cfc5-3970-11eb-929d-d4c9ef517024">
 <topic>OpenSSL -- NULL pointer de-reference</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><ge>1.0.2,1</ge><lt>1.1.1i,1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.2</ge><lt>12.2_2</lt></range>
	<range><ge>12.1</ge><lt>12.1_12</lt></range>
	<range><ge>11.4</ge><lt>11.4_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20201208.txt">
	 EDIPARTYNAME NULL pointer de-reference (High)
	 The X.509 GeneralName type is a generic type for representing
	 different types of names. One of those name types is known as
	 EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which
	 compares different instances of a GENERAL_NAME to see if they
	 are equal or not. This function behaves incorrectly when both
	 GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer
	 dereference and a crash may occur leading to a possible denial
	 of service attack.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20201208.txt</url>
 <cvename>CVE-2020-1971</cvename>
 <freebsdsa>SA-20:33.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2020-12-08</discovery>
 <entry>2020-12-08</entry>
 <modified>2020-12-15</modified>
 </dates>
 </vuln>

<vuln vid="5d5e5cda-38e6-11eb-bbbf-001b217b3468">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.6.0</ge><lt>13.6.2</lt></range>
	<range><ge>13.5.0</ge><lt>13.5.5</lt></range>
	<range><ge>12.2</ge><lt>13.4.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/12/07/security-release-gitlab-13-6-2-released/">
	 XSS in Zoom Meeting URL
	 Limited Information Disclosure in Private Profile
	 User email exposed via GraphQL endpoint
	 Group and project membership potentially exposed via GraphQL
	 Search terms logged in search parameter in rails logs
	 Un-authorised access to feature flag user list
	 A specific query on the explore page causes statement timeouts
	 Exposure of starred projects on private user profiles
	 Uncontrolled Resource Consumption in any Markdown field using Mermaid
	 Former group members able to view updates to confidential epics
	 Update GraphicsMagick dependency
	 Update GnuPG dependency
	 Update libxml dependency
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/12/07/security-release-gitlab-13-6-2-released/</url>
 <cvename>CVE-2020-26407</cvename>
 <cvename>CVE-2020-26408</cvename>
 <cvename>CVE-2020-13357</cvename>
 <cvename>CVE-2020-26411</cvename>
 <cvename>CVE-2020-26409</cvename>
 </references>
 <dates>
 <discovery>2020-12-07</discovery>
 <entry>2020-12-07</entry>
 </dates>
 </vuln>

<vuln vid="8d17229f-3054-11eb-a455-ac1f6b16e566">
 <topic>consul -- Fix Consul Connect CA private key configuration</topic>
 <affects>
 <package>
	<name>consul</name>
	<range><lt>1.9.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hashicorp reports:
	<blockquote cite="https://github.com/hashicorp/consul/blob/master/CHANGELOG.md">
	 Increase the permissions to read from the
	 /connect/ca/configuration endpoint to operator:write.
	 Previously Connect CA configuration, including the private
	 key, set via this endpoint could be read back by an operator
	 with operator:read privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/hashicorp/consul/blob/master/CHANGELOG.md</url>
 <cvename>CVE-2020-28053</cvename>
 </references>
 <dates>
 <discovery>2020-11-02</discovery>
 <entry>2020-12-06</entry>
 </dates>
 </vuln>

<vuln vid="01ffd06a-36ed-11eb-b655-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>87.0.4280.88</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html">
	 This release contains 8 security fixes, including:
	 <ul>
	 <li>[1142331] High CVE-2020-16037: Use after free in clipboard.
	 Reported by Ryoya Tsukasaki on 2020-10-26</li>
	 <li>[1138683] High CVE-2020-16038: Use after free in media.
	 Reported by Khalil Zhani on 2020-10-14</li>
	 <li>[1149177] High CVE-2020-16039: Use after free in extensions.
	 Reported by Anonymous on 2020-11-15</li>
	 <li>[1150649] High CVE-2020-16040: Insufficient data validation in
	 V8. Reported by Lucas Pinheiro, Microsoft Browser Vulnerability
	 Research on 2020-11-19</li>
	 <li>[1151865] Medium CVE-2020-16041: Out of bounds read in
	 networking. Reported by Sergei Glazunov and Mark Brand of Google
	 Project Zero on 2020-11-23</li>
	 <li>[1151890] Medium CVE-2020-16042: Uninitialized Use in V8.
	 Reported by André Bargull on 2020-11-2</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-16037</cvename>
 <cvename>CVE-2020-16038</cvename>
 <cvename>CVE-2020-16039</cvename>
 <cvename>CVE-2020-16040</cvename>
 <cvename>CVE-2020-16041</cvename>
 <cvename>CVE-2020-16042</cvename>
 <url>https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2020-12-02</discovery>
 <entry>2020-12-05</entry>
 </dates>
 </vuln>

<vuln vid="b99492b2-362b-11eb-9f86-08002734b9ed">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.13.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.13.0:
	<blockquote cite="https://blog.gitea.io/2020/12/gitea-1.13.0-is-released/">
	 <ul>
	 <li>Add Allow-/Block-List for Migrate and Mirrors</li>
	 <li>Prevent git operations for inactive users</li>
	 <li>Disallow urlencoded new lines in git protocol paths if there is a port</li>
	 <li>Mitigate Security vulnerability in the git hook feature</li>
	 <li>Disable DSA ssh keys by default </li>
	 <li>Set TLS minimum version to 1.2</li>
	 <li>Use argon as default password hash algorithm</li>
	 <li>Escape failed highlighted files</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.13.0</url>
 <freebsdpr>ports/251577</freebsdpr>
 </references>
 <dates>
 <discovery>2020-12-01</discovery>
 <entry>2020-12-04</entry>
 </dates>
 </vuln>

<vuln vid="e2748c9d-3483-11eb-b87a-901b0ef719ab">
 <topic>FreeBSD -- Multiple vulnerabilities in rtsold</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.2</ge><lt>12.2_1</lt></range>
	<range><ge>12.1</ge><lt>12.1_11</lt></range>
	<range><ge>11.4</ge><lt>11.4_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Two bugs exist in rtsold(8)'s RDNSS and DNSSL option handling.
	First, rtsold(8) failed to perform sufficient bounds checking on the
	extent of the option. In particular, it does not verify that the
	option does not extend past the end of the received packet before
	processing its contents. The kernel currently ignores such
	malformed packets but still passes them to userspace programs.
	Second, when processing a DNSSL option, rtsold(8) decodes domain
	name labels per an encoding specified in RFC 1035 in which the first
	octet of each label contains the label's length. rtsold(8) did not
	validate label lengths correctly and could overflow the destination
	buffer.
	<h1>Impact:</h1>
	It is believed that these bugs could be exploited to gain remote
	code execution within the rtsold(8) daemon, which runs as root.
	Note that rtsold(8) only processes messages received from hosts
	attached to the same physical link as the interface(s) on which
	rtsold(8) is listening.
	In FreeBSD 12.2 rtsold(8) runs in a Capsicum sandbox, limiting the
	scope of a compromised rtsold(8) process.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-25577</cvename>
 <freebsdsa>SA-20:32.rtsold</freebsdsa>
 </references>
 <dates>
 <discovery>2020-12-01</discovery>
 <entry>2020-12-02</entry>
 </dates>
 </vuln>

<vuln vid="8eed0c5c-3482-11eb-b87a-901b0ef719ab">
 <topic>FreeBSD -- ICMPv6 use-after-free in error message handling</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.2</ge><lt>12.2_1</lt></range>
	<range><ge>12.1</ge><lt>12.1_11</lt></range>
	<range><ge>11.4</ge><lt>11.4_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When an ICMPv6 error message is received, the FreeBSD ICMPv6 stack
	may extract information from the message to hand to upper-layer
	protocols. As a part of this operation, it may parse IPv6 header
	options from a packet embedded in the ICMPv6 message.
	The handler for a routing option caches a pointer into the packet
	buffer holding the ICMPv6 message. However, when processing
	subsequent options the packet buffer may be freed, rendering the
	cached pointer invalid. The network stack may later dereference the
	pointer, potentially triggering a use-after-free.
	<h1>Impact:</h1>
	A remote host may be able to trigger a read of freed kernel memory.
	This may trigger a kernel panic if the address had been unmapped.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7469</cvename>
 <freebsdsa>SA-20:31.icmp6</freebsdsa>
 </references>
 <dates>
 <discovery>2020-12-01</discovery>
 <entry>2020-12-02</entry>
 </dates>
 </vuln>

<vuln vid="76c8b690-340b-11eb-a2b7-54e1ad3d6335">
 <topic>xorg-server -- Multiple input validation failures in X server XKB extension</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<range><lt>1.20.9_1,1</lt></range>
 </package>
 <package>
	<name>xephyr</name>
	<range><lt>1.20.9_1,1</lt></range>
 </package>
 <package>
	<name>xorg-vfbserver</name>
	<range><lt>1.20.9_1,1</lt></range>
 </package>
 <package>
	<name>xorg-nestserver</name>
	<range><lt>1.20.9_1,1</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>1.20.9_2,1</lt></range>
 </package>
 <package>
	<name>xorg-dmx</name>
	<range><lt>1.20.9_1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The X.org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2020-December/003066.html">
	 These issues can lead to privileges elevations for authorized
	 clients on systems where the X server is running privileged.
	 Insufficient checks on the lengths of the XkbSetMap request can
	 lead to out of bounds memory accesses in the X server.
	 Insufficient checks on input of the XkbSetDeviceInfo request can
	 lead to a buffer overflow on the head in the X server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.x.org/archives/xorg-announce/2020-December/003066.html</url>
 <cvename>CVE-2020-14360</cvename>
 <cvename>CVE-2020-25712</cvename>
 </references>
 <dates>
 <discovery>2020-12-01</discovery>
 <entry>2020-12-01</entry>
 </dates>
 </vuln>

<vuln vid="618010ff-3044-11eb-8112-000c292ee6b8">
 <topic>nomad -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>nomad</name>
	<range><lt>0.12.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The HashiCorp team reports:
	<blockquote cite="https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md">
	 <ul>
	 <li>artifact: Fixed a bug where interpolation can be used in the
	 artifact destination field to write artifact payloads outside
	 the allocation directory.</li>
	 <li>template: Fixed a bug where interpolation can be used in the
	 template source and destination fields to read or write files
	 outside the allocation directory even when disable_file_sandbox
	 was set to false (the default).</li>
	 <li>template: Fixed a bug where the disable_file_sandbox
	 configuration was only respected for the template file function
	 and not the template source and destination fields.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md</url>
 <cvename>CVE-2020-27195</cvename>
 </references>
 <dates>
 <discovery>2020-10-21</discovery>
 <entry>2020-11-27</entry>
 </dates>
 </vuln>

<vuln vid="55facdb0-2c24-11eb-9aac-08002734b9ed">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.12.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.12.6:
	<blockquote cite="https://blog.gitea.io/2020/11/gitea-1.12.6-is-released/">
	 <ul>
	 <li>Prevent git operations for inactive users</li>
	 <li>Disallow urlencoded new lines in git protocol paths if there is a port</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>Disallow urlencoded new lines in git protocol paths if there is a port</url>
 <freebsdpr>ports/251296</freebsdpr>
 </references>
 <dates>
 <discovery>2020-11-16</discovery>
 <entry>2020-11-21</entry>
 </dates>
 </vuln>

<vuln vid="ad792169-2aa4-11eb-ab71-0022489ad614">
 <topic>Node.js -- November 2020 Security Releases</topic>
 <affects>
 <package>
	<name>node</name>
	<range><lt>15.2.1</lt></range>
 </package>
 <package>
	<name>node14</name>
	<range><lt>14.15.1</lt></range>
 </package>
 <package>
	<name>node12</name>
	<range><lt>12.19.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/">
	 Updates are now available for v12.x, v14.x and v15.x Node.js release lines for the following issues.
	 <h1>Denial of Service through DNS request (CVE-2020-8277)</h1>
	 A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of service by getting the application to resolve a DNS record with a larger number of responses.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/</url>
 <cvename>CVE-2020-8277</cvename>
 </references>
 <dates>
 <discovery>2020-11-16</discovery>
 <entry>2020-11-21</entry>
 </dates>
 </vuln>

<vuln vid="dc132c91-2b71-11eb-8cfd-4437e6ad11c4">
 <topic>mutt -- authentication credentials being sent over an unencrypted connection</topic>
 <affects>
 <package>
	<name>mutt</name>
	<range><lt>2.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kevin J. McCarthy reports:
	<blockquote cite="https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59a">
	 Mutt had incorrect error handling when initially connecting to an IMAP
	 server, which could result in an attempt to authenticate without enabling TLS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-28896</cvename>
 <url>https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59a</url>
 </references>
 <dates>
 <discovery>2020-11-20</discovery>
 <entry>2020-11-20</entry>
 </dates>
 </vuln>

<vuln vid="040707f9-0b2a-11eb-8834-00155d01f202">
 <topic>mozjpeg -- heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file</topic>
 <affects>
 <package>
	<name>mozjpeg</name>
	<range><lt>4.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NIST reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2020-13790">
	<ul>
	 <li>Heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.</li>
	</ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-13790</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13790</url>
 </references>
 <dates>
 <discovery>2020-06-03</discovery>
 <entry>2020-10-10</entry>
 </dates>
 </vuln>

<vuln vid="23a667c7-0b28-11eb-8834-00155d01f202">
 <topic>libjpeg-turbo -- Issue in the PPM reader causing a buffer overrun in cjpeg, TJBench, or the tjLoadImage() function.</topic>
 <affects>
 <package>
	<name>libjpeg-turbo</name>
	<range><lt>2.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libjpeg-turbo releases reports:
	<blockquote cite="https://github.com/libjpeg-turbo/libjpeg-turbo/releases/tag/2.0.5">
	 This release fixes the following security issue:
	 <ul>
	 <li>Heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-13790</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13790</url>
 </references>
 <dates>
 <discovery>2020-06-03</discovery>
 <entry>2020-10-10</entry>
 </dates>
 </vuln>

<vuln vid="19259833-26b1-11eb-a239-1c697a013f4b">
 <topic>mantis -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mantis-php72</name>
	<name>mantis-php73</name>
	<name>mantis-php74</name>
	<name>mantis-php80</name>
	<range><lt>2.24.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mantis 2.24.3 release reports:
	<blockquote cite="https://mantisbt.org/bugs/changelog_page.php?project=mantisbt&amp;version=2.24.3">
	 This release fixes 3 security issues:
	 <ul>
	 <li>0027039: CVE-2020-25781: Access to private bug note attachments</li>
	 <li>0027275: CVE-2020-25288: HTML Injection on bug_update_page.php</li>
	 <li>0027304: CVE-2020-25830: HTML Injection in bug_actiongroup_page.php</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/251141</freebsdpr>
 <cvename>CVE-2020-25781</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25781</url>
 <cvename>CVE-2020-25288</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25288</url>
 <cvename>CVE-2020-25830</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25830</url>
 </references>
 <dates>
 <discovery>2020-09-13</discovery>
 <entry>2020-11-14</entry>
 <modified>2020-11-15</modified>
 </dates>
 </vuln>

<vuln vid="db4b2f27-252a-11eb-865c-00155d646400">
 <topic>go -- math/big: panic during recursive division of very large numbers; cmd/go: arbitrary code execution at build time through cgo</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.15.5,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/42552">
	 A number of math/big.Int methods (Div, Exp, DivMod, Quo, Rem,
	 QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD) can panic
	 when provided crafted large inputs. For the panic to happen,
	 the divisor or modulo argument must be larger than 3168 bits
	 (on 32-bit architectures) or 6336 bits (on 64-bit architectures).
	 Multiple math/big.Rat methods are similarly affected.
	</blockquote>
	<blockquote cite="https://github.com/golang/go/issues/42556">
	 The go command may execute arbitrary code at build time when
	 cgo is in use. This may occur when running go get on a malicious
	 package, or any other command that builds untrusted code. This
	 can be caused by a malicious gcc flags specified via a #cgo
	 directive.
	</blockquote>
	<blockquote cite="https://github.com/golang/go/issues/42559">
	 The go command may execute arbitrary code at build time when
	 cgo is in use. This may occur when running go get on a malicious
	 package, or any other command that builds untrusted code. This
	 can be caused by malicious unquoted symbol names.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-28362</cvename>
 <url>https://github.com/golang/go/issues/42552</url>
 <cvename>CVE-2020-28367</cvename>
 <url>https://github.com/golang/go/issues/42556</url>
 <cvename>CVE-2020-28366</cvename>
 <url>https://github.com/golang/go/issues/42559</url>
 </references>
 <dates>
 <discovery>2020-11-09</discovery>
 <entry>2020-11-12</entry>
 </dates>
 </vuln>

<vuln vid="50259d8b-243e-11eb-8bae-b42e99975750">
 <topic>salt -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py36-salt</name>
	<name>py37-salt</name>
	<name>py38-salt</name>
	<range><ge>3002</ge><lt>3002.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SaltStack reports multiple security vulnerabilities in Salt 3002:
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/3002.1.html">
	 <ul>
	 <li>CVE-2020-16846: Prevent shell injections in netapi ssh client.</li>
	 <li>CVE-2020-17490: Prevent creating world readable private keys with the tls execution module.</li>
	 <li>CVE-2020-25592: Properly validate eauth credentials and tokens along with their ACLs.
	 Prior to this change eauth was not properly validated when calling Salt ssh via the salt-api.
	 Any value for 'eauth' or 'token' would allow a user to bypass authentication and make calls
	 to Salt ssh.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.saltstack.com/en/latest/topics/releases/3002.1.html</url>
 <cvename>CVE-2020-16846</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-16846</url>
 <cvename>CVE-2020-17490</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-17490</url>
 <cvename>CVE-2020-25592</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-25592</url>
 </references>
 <dates>
 <discovery>2020-11-06</discovery>
 <entry>2020-11-12</entry>
 </dates>
 </vuln>

<vuln vid="4f15ca7b-23ae-11eb-9f59-1c1b0d9ea7e6">
 <topic>Apache OpenOffice -- Unrestricted actions leads to arbitrary code execution in crafted documents</topic>
 <affects>
 <package>
	<name>apache-openoffice</name>
	<range><lt>4.1.8</lt></range>
 </package>
 <package>
	<name>apache-openoffice-devel</name>
	<range><lt>4.2.1602022694,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Openofffice project reports:
	<blockquote cite="https://www.openoffice.org/security/cves/CVE-2020-13958.html">
	 <h1>CVE-2020-13958 Unrestricted actions leads to arbitrary code execution in crafted documents</h1>
	 <h2>Description</h2>
	 A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the document event handler and other hyperlinks require a control-click.
	 <h2>Severity: Low</h2>
	 There are no known exploits of this vulnerability. A proof-of-concept demonstration exists.
	 Thanks to the reporter for discovering this issue.
	 <h2>Acknowledgments</h2>
	 The Apache OpenOffice Security Team would like to thank Imre Rad for discovering and reporting this attack vector.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openoffice.org/security/cves/CVE-2020-13958.html</url>
 <cvename>CVE-2020-13958</cvename>
 </references>
 <dates>
 <discovery>2020-04-28</discovery>
 <entry>2020-11-10</entry>
 </dates>
 </vuln>

<vuln vid="07c7ae7a-224b-11eb-aa6e-e0d55e2a8bf9">
 <topic>raptor2 -- buffer overflow</topic>
 <affects>
 <package>
	<name>raptor2</name>
	<range><lt>2.0.15_16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18926">
	 
	 raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer, leading to heap-based buffer overflows (sometimes seen in raptor_qname_format_as_xml).
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18926</url>
 <url>https://github.com/LibreOffice/core/blob/master/external/redland/raptor/0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch.1</url>
 <cvename>CVE-2017-18926</cvename>
 </references>
 <dates>
 <discovery>2017-04-16</discovery>
 <entry>2020-11-09</entry>
 </dates>
 </vuln>

<vuln vid="cf39ddf8-21be-11eb-8b47-641c67a117d8">
 <topic>jupyter notebook -- open redirect vulnerability</topic>
 <affects>
 <package>
	<name>py37-notebook</name>
	<name>py38-notebook</name>
	<name>py39-notebook</name>
	<range><lt>6.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jupyter reports:
	<blockquote cite="https://jupyter-notebook.readthedocs.io/en/stable/changelog.html#release-6-1-5">
	 6.1.5 is a security release, fixing one vulnerability:
	 Fix open redirect vulnerability GHSA-c7vm-f5p4-8fqh (CVE to be assigned)
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://jupyter-notebook.readthedocs.io/en/stable/changelog.html#release-6-1-5</url>
 <url>https://github.com/jupyter/notebook/blob/6.1.5/docs/source/changelog.rst</url>
 </references>
 <dates>
 <discovery>2020-10-15</discovery>
 <entry>2020-11-08</entry>
 </dates>
 </vuln>

<vuln vid="29b7f0be-1fb7-11eb-b9d4-001999f8d30b">
 <topic>asterisk -- Outbound INVITE loop on challenge with different nonce</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.37.1</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><lt>16.14.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><lt>18.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 If Asterisk is challenged on an outbound INVITE and
	 the nonce is changed in each response, Asterisk will
	 continually send INVITEs in a loop. This causes Asterisk
	 to consume more and more memory since the transaction
	 will never terminate (even if the call is hung up),
	 ultimately leading to a restart or shutdown of Asterisk.
	 Outbound authentication must be configured on the endpoint
	 for this to occur.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2020-002.html</url>
 </references>
 <dates>
 <discovery>2020-11-05</discovery>
 <entry>2020-11-05</entry>
 </dates>
 </vuln>

<vuln vid="972fe546-1fb6-11eb-b9d4-001999f8d30b">
 <topic>asterisk -- Remote crash in res_pjsip_session</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.37.1</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><lt>16.14.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><lt>18.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 Upon receiving a new SIP Invite, Asterisk did not
	 return the created dialog locked or referenced. This
	 caused a gap between the creation of the dialog object,
	 and its next use by the thread that created it. Depending
	 upon some off nominal circumstances, and timing it was
	 possible for another thread to free said dialog in this
	 gap. Asterisk could then crash when the dialog object,
	 or any of its dependent objects were de-referenced, or
	 accessed next by the initial creation thread.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2020-001.html</url>
 </references>
 <dates>
 <discovery>2020-11-05</discovery>
 <entry>2020-11-05</entry>
 </dates>
 </vuln>

<vuln vid="3ec6ab59-1e0c-11eb-a428-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>86.0.4240.183</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html">
	 This release contains 10 security fixes, including:
	 <ul>
	 <li>[1138911] High CVE-2020-16004: Use after free in user interface.
	 Reported by Leecraso and Guang Gong of 360 Alpha Lab working with
	 360 BugCloud on 2020-10-15</li>
	 <li>[1139398] High CVE-2020-16005: Insufficient policy enforcement
	 in ANGLE. Reported by Jaehun Jeong (@n3sk) of Theori on
	 2020-10-16</li>
	 <li>[1133527] High CVE-2020-16006: Inappropriate implementation in
	 V8. Reported by Bill Parks on 2020-09-29</li>
	 <li>[1125018] High CVE-2020-16007: Insufficient data validation in
	 installer. Reported by Abdelhamid Naceri (halov) on
	 2020-09-04</li>
	 <li>[1134107] High CVE-2020-16008: Stack buffer overflow in WebRTC.
	 Reported by Tolya Korniltsev on 2020-10-01</li>
	 <li>[1143772] High CVE-2020-16009: Inappropriate implementation in
	 V8. Reported by Clement Lecigne of Google's Threat Analysis Group
	 and Samuel Groß of Google Project Zero on 2020-10-29</li>
	 <li>[1144489] High CVE-2020-16011: Heap buffer overflow in UI on
	 Windows. Reported by Sergei Glazunov of Google Project Zero on
	 2020-11-01</li>
	 </ul>
	 There are reports that an exploit for CVE-2020-16009 exists in the
	 wild.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-16004</cvename>
 <cvename>CVE-2020-16005</cvename>
 <cvename>CVE-2020-16006</cvename>
 <cvename>CVE-2020-16007</cvename>
 <cvename>CVE-2020-16008</cvename>
 <cvename>CVE-2020-16009</cvename>
 <cvename>CVE-2020-16011</cvename>
 <url>https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2020-11-02</discovery>
 <entry>2020-11-03</entry>
 </dates>
 </vuln>

<vuln vid="174e466b-1d48-11eb-bd0f-001b217b3468">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.5.0</ge><lt>13.5.2</lt></range>
	<range><ge>13.4.0</ge><lt>13.4.5</lt></range>
	<range><ge>8.8.9</ge><lt>13.3.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/11/02/security-release-gitlab-13-5-2-released/">
	 Path Traversal in LFS Upload
	 Path traversal allows saving packages in arbitrary location
	 Kubernetes agent API leaks private repos
	 Terraform state deletion API exposes object storage URL
	 Stored-XSS in error message of build-dependencies
	 Git credentials persisted on disk
	 Potential Denial of service via container registry
	 Info leak when group is transferred from private to public group
	 Limited File Disclosure Via Multipart Bypass
	 Unauthorized user is able to access scheduled pipeline variables and values
	 CSRF in runner administration page allows an attacker to pause/resume runners
	 Regex backtracking attack in path parsing of Advanced Search result
	 Bypass of required CODEOWNERS approval
	 SAST CiConfiguration information visible without permissions
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/11/02/security-release-gitlab-13-5-2-released/</url>
 <cvename>CVE-2020-13355</cvename>
 <cvename>CVE-2020-26405</cvename>
 <cvename>CVE-2020-13358</cvename>
 <cvename>CVE-2020-13359</cvename>
 <cvename>CVE-2020-13340</cvename>
 <cvename>CVE-2020-13353</cvename>
 <cvename>CVE-2020-13354</cvename>
 <cvename>CVE-2020-13352</cvename>
 <cvename>CVE-2020-13356</cvename>
 <cvename>CVE-2020-13351</cvename>
 <cvename>CVE-2020-13350</cvename>
 <cvename>CVE-2020-13349</cvename>
 <cvename>CVE-2020-13348</cvename>
 </references>
 <dates>
 <discovery>2020-11-02</discovery>
 <entry>2020-11-02</entry>
 </dates>
 </vuln>

<vuln vid="11325357-1d3c-11eb-ab74-4c72b94353b5">
 <topic>wordpress -- multiple issues</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>5.5.2,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>zh_CN-wordpress</name>
	<name>zh_TW-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<range><lt>5.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wordpress developers reports:
	<blockquote cite="https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/">
	 Ten security issues affect WordPress versions 5.5.1 and earlier. If you havent yet updated to 5.5,
	 all WordPress versions since 3.7 have also been updated to fix the following security issues:
	 -Props to Alex Concha of the WordPress Security Team for their work in hardening deserialization requests.
	 -Props to David Binovec on a fix to disable spam embeds from disabled sites on a multisite network.
	 -Thanks to Marc Montas from Sucuri for reporting an issue that could lead to XSS from global variables.
	 -Thanks to Justin Tran who reported an issue surrounding privilege escalation in XML-RPC. He also found and disclosed an issue around privilege escalation around post commenting via XML-RPC.
	 -Props to Omar Ganiev who reported a method where a DoS attack could lead to RCE.
	 -Thanks to Karim El Ouerghemmi from RIPS who disclosed a method to store XSS in post slugs.
	 -Thanks to Slavco for reporting, and confirmation from Karim El Ouerghemmi, a method to bypass protected meta that could lead to arbitrary file deletion.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2020-10-29</discovery>
 <entry>2020-11-02</entry>
 </dates>
 </vuln>

<vuln vid="9ca85b7c-1b31-11eb-8762-005056a311d1">
 <topic>samba -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>samba410</name>
	<range><le>4.10.18</le></range>
 </package>
 <package>
	<name>samba411</name>
	<range><lt>4.11.15</lt></range>
 </package>
 <package>
	<name>samba412</name>
	<range><lt>4.12.9</lt></range>
 </package>
 <package>
	<name>samba413</name>
	<range><lt>4.13.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="https://www.samba.org/samba/history/security.html">
	 <ul>
	 <li>CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify</li>
	 <li>CVE-2020-14323: Unprivileged user can crash winbind</li>
	 <li>CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/security/CVE-2020-14318.html</url>
 <url>https://www.samba.org/samba/security/CVE-2020-14323.html</url>
 <url>https://www.samba.org/samba/security/CVE-2020-14383.html</url>
 <cvename>CVE-2020-14318</cvename>
 <cvename>CVE-2020-14323</cvename>
 <cvename>CVE-2020-14383</cvename>
 </references>
 <dates>
 <discovery>2020-10-29</discovery>
 <entry>2020-10-30</entry>
 </dates>
 </vuln>

<vuln vid="8827134c-1a8f-11eb-9bb0-08002725d892">
 <topic>tmux -- stack overflow in CSI parsing</topic>
 <affects>
 <package>
	<name>tmux</name>
	<range><lt>3.1c</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nicholas Marriott reports:
	<blockquote cite="https://groups.google.com/g/tmux-users/c/DGfmsD9CM00/m/Six6uZG0AQAJ">
	 tmux has a stack overflow in CSI parsing.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://groups.google.com/g/tmux-users/c/DGfmsD9CM00/m/Six6uZG0AQAJ</url>
 <url>https://marc.info/?l=openbsd-announce&amp;m=160399126725142&amp;w=2</url>
 </references>
 <dates>
 <discovery>2020-10-29</discovery>
 <entry>2020-10-30</entry>
 </dates>
 </vuln>

<vuln vid="94ffc0d9-1915-11eb-b809-b42e991fc52e">
 <topic>motion -- Denial of Service</topic>
 <affects>
 <package>
	<name>motion</name>
	<range><ge>3.2</ge><lt>4.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cxsecurity.com reports:
	<blockquote cite="https://cxsecurity.com/cveshow/CVE-2020-26566/">
	 A Denial of Service condition in Motion-Project Motion 3.2 through
	 4.3.1 allows remote unauthenticated users to cause a webu.c
	 segmentation fault and kill the main process via a crafted HTTP
	 request
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve-search.iicrai.org/cve/CVE-2020-26566</url>
 </references>
 <dates>
 <discovery>2020-10-05</discovery>
 <entry>2020-10-28</entry>
 </dates>
 </vuln>

<vuln vid="458df97f-1440-11eb-aaec-e0d55e2a8bf9">
 <topic>freetype2 -- heap buffer overlfow</topic>
 <affects>
 <package>
	<name>freetype2</name>
	<range><lt>2.10.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The freetype project reports:
	<blockquote cite="https://sourceforge.net/projects/freetype/files/freetype2/2.10.4/">
	 A heap buffer overflow has been found in the handling of embedded
	 PNG bitmaps, introduced in FreeType version 2.6.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://sourceforge.net/projects/freetype/files/freetype2/2.10.4/</url>
 <cvename>CVE-2020-15999</cvename>
 </references>
 <dates>
 <discovery>2020-10-20</discovery>
 <entry>2020-10-22</entry>
 </dates>
 </vuln>

<vuln vid="4fba07ca-13aa-11eb-b31e-d4c9ef517024">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.26</lt></range>
 </package>
 <package>
	<name>mariadb104-server</name>
	<range><lt>10.4.16</lt></range>
 </package>
 <package>
	<name>mariadb105-server</name>
	<range><lt>10.5.7</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.50</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.32</lt></range>
 </package>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpuoct2020.html#AppendixMSQL">
	 This Critical Patch Update contains 48 new security patches for
	 Oracle MySQL.
	 The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
	 MySQL is 8.
	 NOTE: MariaDB only contains CVE-2020-14812 CVE-2020-14765
	 CVE-2020-14776 and CVE-2020-14789
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/security-alerts/cpuoct2020.html#AppendixMSQL</url>
 <cvename>CVE-2020-14878</cvename>
 <cvename>CVE-2020-14828</cvename>
 <cvename>CVE-2020-14775</cvename>
 <cvename>CVE-2020-14765</cvename>
 <cvename>CVE-2020-14769</cvename>
 <cvename>CVE-2020-14830</cvename>
 <cvename>CVE-2020-14836</cvename>
 <cvename>CVE-2020-14846</cvename>
 <cvename>CVE-2020-14800</cvename>
 <cvename>CVE-2020-14827</cvename>
 <cvename>CVE-2020-14760</cvename>
 <cvename>CVE-2020-14776</cvename>
 <cvename>CVE-2020-14821</cvename>
 <cvename>CVE-2020-14829</cvename>
 <cvename>CVE-2020-14848</cvename>
 <cvename>CVE-2020-14852</cvename>
 <cvename>CVE-2020-14814</cvename>
 <cvename>CVE-2020-14789</cvename>
 <cvename>CVE-2020-14804</cvename>
 <cvename>CVE-2020-14812</cvename>
 <cvename>CVE-2020-14773</cvename>
 <cvename>CVE-2020-14777</cvename>
 <cvename>CVE-2020-14785</cvename>
 <cvename>CVE-2020-14793</cvename>
 <cvename>CVE-2020-14794</cvename>
 <cvename>CVE-2020-14809</cvename>
 <cvename>CVE-2020-14837</cvename>
 <cvename>CVE-2020-14839</cvename>
 <cvename>CVE-2020-14845</cvename>
 <cvename>CVE-2020-14861</cvename>
 <cvename>CVE-2020-14866</cvename>
 <cvename>CVE-2020-14868</cvename>
 <cvename>CVE-2020-14888</cvename>
 <cvename>CVE-2020-14891</cvename>
 <cvename>CVE-2020-14893</cvename>
 <cvename>CVE-2020-14786</cvename>
 <cvename>CVE-2020-14790</cvename>
 <cvename>CVE-2020-14844</cvename>
 <cvename>CVE-2020-14799</cvename>
 <cvename>CVE-2020-14869</cvename>
 <cvename>CVE-2020-14672</cvename>
 <cvename>CVE-2020-14870</cvename>
 <cvename>CVE-2020-14867</cvename>
 <cvename>CVE-2020-14873</cvename>
 <cvename>CVE-2020-14838</cvename>
 <cvename>CVE-2020-14860</cvename>
 <cvename>CVE-2020-14791</cvename>
 <cvename>CVE-2020-14771</cvename>
 </references>
 <dates>
 <discovery>2020-10-20</discovery>
 <entry>2020-10-21</entry>
 <modified>2020-11-07</modified>
 </dates>
 </vuln>

<vuln vid="f4722927-1375-11eb-8711-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>86.0.4240.111</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html">
	 This release includes 5 security fixes:
	 <ul>
	 <li>[1125337] High CVE-2020-16000: Inappropriate implementation in
	 Blink. Reported by amaebi_jp on 2020-09-06</li>
	 <li>[1135018] High CVE-2020-16001: Use after free in media.
	 Reported by Khalil Zhani on 2020-10-05</li>
	 <li>[1137630] High CVE-2020-16002: Use after free in PDFium.
	 Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec
	 at Qi'anxin Group on 2020-10-13</li>
	 <li>[1139963] High CVE-2020-15999: Heap buffer overflow in
	 Freetype. Reported by Sergei Glazunov of Google Project Zero on
	 2020-10-19</li>
	 <li>[1134960] Medium CVE-2020-16003: Use after free in printing.
	 Reported by Khalil Zhani on 2020-10-04</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-15999</cvename>
 <cvename>CVE-2020-16000</cvename>
 <cvename>CVE-2020-16001</cvename>
 <cvename>CVE-2020-16002</cvename>
 <cvename>CVE-2020-16003</cvename>
 <url>https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html</url>
 </references>
 <dates>
 <discovery>2020-10-20</discovery>
 <entry>2020-10-21</entry>
 </dates>
 </vuln>

<vuln vid="a6860b11-0dee-11eb-94ff-6805ca2fa271">
 <topic>powerdns-recursor -- cache pollution</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><ge>4.3.0</ge><lt>4.3.5</lt></range>
	<range><ge>4.2.0</ge><lt>4.2.5</lt></range>
	<range><ge>4.1.0</ge><lt>4.1.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.3.html#change-4.3.5">
	 CVE-2020-25829: An issue has been found in PowerDNS Recursor where a
	 remote attacker can cause the cached records for a given name to be
	 updated to the ‘Bogus’ DNSSEC validation state, instead of their actual
	 DNSSEC ‘Secure’ state, via a DNS ANY query. This results in a denial
	 of service for installations that always validate (dnssec=validate)
	 and for clients requesting validation when on-demand validation is
	 enabled (dnssec=process).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-07.html</url>
 <cvename>CVE-2020-25829</cvename>
 </references>
 <dates>
 <discovery>2020-10-13</discovery>
 <entry>2020-10-14</entry>
 </dates>
 </vuln>

<vuln vid="a2565962-1156-11eb-9c9c-d4c9ef517024">
 <topic>MariaDB -- Undisclosed vulnerability</topic>
 <affects>
 <package>
	<name>mariadb103-client</name>
	<range><lt>10.3.25</lt></range>
 </package>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.25</lt></range>
 </package>
 <package>
	<name>mariadb104-client</name>
	<range><lt>10.4.15</lt></range>
 </package>
 <package>
	<name>mariadb104-server</name>
	<range><lt>10.4.15</lt></range>
 </package>
 <package>
	<name>mariadb105-client</name>
	<range><lt>10.5.6</lt></range>
 </package>
 <package>
	<name>mariadb105-server</name>
	<range><lt>10.5.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MariaDB project reports:
	<blockquote cite="https://mariadb.com/kb/en/mariadb-1056-release-notes/">
	 Details of this vulnerability have not yet been disclosed
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mariadb.com/kb/en/mariadb-1056-release-notes/</url>
 <url>https://mariadb.com/kb/en/mariadb-10415-release-notes/</url>
 <url>https://mariadb.com/kb/en/mariadb-10325-release-notes/</url>
 <cvename>CVE-2020-15180</cvename>
 </references>
 <dates>
 <discovery>2020-10-07</discovery>
 <entry>2020-10-18</entry>
 </dates>
 </vuln>

<vuln vid="5f39d80f-107c-11eb-8b47-641c67a117d8">
 <topic>py-matrix-synapse -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>py36-matrix-synapse</name>
	<name>py37-matrix-synapse</name>
	<name>py38-matrix-synapse</name>
	<name>py39-matrix-synapse</name>
	<range><lt>1.21.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers reports:
	<blockquote cite="https://github.com/matrix-org/synapse/security/advisories/GHSA-3x8c-fmpc-5rmq">
	 The fallback authentication endpoint served via Synapse were vulnerable
	 to cross-site scripting (XSS) attacks. The impact depends on the
	 configuration of the domain that Synapse is deployed on, but may allow
	 access to cookies and other browser data, CSRF vulnerabilities, and
	 access to other resources served on the same domain or parent domains.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-26891</cvename>
 <url>https://github.com/matrix-org/synapse/security/advisories/GHSA-3x8c-fmpc-5rmq</url>
 <url>https://github.com/matrix-org/synapse/releases/tag/v1.21.2</url>
 <freebsdpr>ports/249948</freebsdpr>
 </references>
 <dates>
 <discovery>2020-10-01</discovery>
 <entry>2020-10-17</entry>
 </dates>
 </vuln>

<vuln vid="95d9d986-1078-11eb-ab74-4c72b94353b5">
 <topic>drupal -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.72</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/project/drupal/releases/7.73">
	 The Drupal AJAX API does not disable JSONP by default, which can
	 lead to cross-site scripting.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/sa-core-2020-007</url>
 </references>
 <dates>
 <discovery>2020-09-16</discovery>
 <entry>2020-10-17</entry>
 </dates>
 </vuln>

<vuln vid="42926d7b-0da3-11eb-8dbd-6451062f0f7a">
 <topic>Flash Player -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>32.0.0.445</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb20-58.html">
	 <ul>
	 <li>This update resolves a NULL pointer dereference vulnerability
	 that could lead to arbitrary code execution (CVE-2020-9746).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-9746</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb20-58.html</url>
 </references>
 <dates>
 <discovery>2020-10-13</discovery>
 <entry>2020-10-13</entry>
 </dates>
 </vuln>

<vuln vid="95f306a6-0aee-11eb-add4-08002728f74c">
 <topic>Rails -- Possible XSS vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-actionpack60</name>
	<range><lt>6.0.3.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails blog:
	<blockquote cite="https://weblog.rubyonrails.org/2020/10/7/Rails-6-0-3-4-has-been-released/">
	 Rails version 6.0.3.4 has been released! This version is a security
	 release and addresses one possible XSS attack vector in Actionable
	 Exceptions.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://weblog.rubyonrails.org/2020/10/7/Rails-6-0-3-4-has-been-released/</url>
 <cvename>CVE-2020-8264</cvename>
 </references>
 <dates>
 <discovery>2020-10-07</discovery>
 <entry>2020-10-10</entry>
 </dates>
 </vuln>

<vuln vid="b07bdd3c-0809-11eb-a3a4-0019dbb15b3f">
 <topic>Payara -- path trasversal flaw via either loc/con parameters in Eclipse Mojarra</topic>
 <affects>
 <package>
	<name>payara</name>
	<range><lt>5.201</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Payara Releases reports:
	<blockquote cite="https://docs.payara.fish/community/docs/5.2020.4/security/security-fix-list.html">
	 The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases:
	 <ul>
	 <li>CVE-2020-6950 Eclipse Mojarra vulnerable to path trasversal flaw via either loc/con parameters</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-6950</cvename>
 <url>https://docs.payara.fish/community/docs/5.2020.4/security/security-fix-list.html</url>
 </references>
 <dates>
 <discovery>2020-01-13</discovery>
 <entry>2020-10-06</entry>
 </dates>
 </vuln>

<vuln vid="bd159669-0808-11eb-a3a4-0019dbb15b3f">
 <topic>Payara -- A Polymorphic Typing issue in FasterXML jackson-databind</topic>
 <affects>
 <package>
	<name>payara</name>
	<range><lt>5.193</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Payara Releases reports:
	<blockquote cite="https://docs.payara.fish/community/docs/5.193/security/security-fix-list.html">
	 The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases:
	 <ul>
	 <li>CVE-2019-12086 A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-12086</cvename>
 <url>https://docs.payara.fish/community/docs/5.193/security/security-fix-list.html</url>
 </references>
 <dates>
 <discovery>2019-05-17</discovery>
 <entry>2020-10-06</entry>
 </dates>
 </vuln>

<vuln vid="71c71ce0-0805-11eb-a3a4-0019dbb15b3f">
 <topic>payara -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>payara</name>
	<range><lt>5.191</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Payara Releases reports:
	<blockquote cite="https://docs.payara.fish/community/docs/5.191/security/security-fix-list.html">
	 The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases:
	 <ul>
	 <li>CVE-2018-14721 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks</li>
	 <li>CVE-2018-14720 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct external XML entity (XXE) attacks</li>
	 <li>CVE-2018-14719 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code</li>
	 <li>CVE-2018-14718 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code</li>
	 <li>CVE-2018-14371 Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-14721</cvename>
 <cvename>CVE-2018-14720</cvename>
 <cvename>CVE-2018-14719</cvename>
 <cvename>CVE-2018-14718</cvename>
 <cvename>CVE-2018-14371</cvename>
 <url>https://docs.payara.fish/community/docs/5.191/security/security-fix-list.html</url>
 </references>
 <dates>
 <discovery>2019-02-01</discovery>
 <entry>2020-10-06</entry>
 </dates>
 </vuln>

<vuln vid="769a4f60-9056-4c27-89a1-1758a59a21f8">
 <topic>zeek -- Vulnerability due to memory leak</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>3.0.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jon Siwek of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v3.0.11">
	 This release fixes the following security issue:
	 <ul>
	 <li>A memory leak in multipart MIME code has potential
	 for remote exploitation and cause for Denial of Service
	 via resource exhaustion.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v3.0.11</url>
 </references>
 <dates>
 <discovery>2020-09-29</discovery>
 <entry>2020-10-07</entry>
 </dates>
 </vuln>

<vuln vid="64988354-0889-11eb-a01b-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>86.0.4240.75</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html">
	 This release contains 35 security fixes, including:
	 <ul>
	 <li>[1127322] Critical CVE-2020-15967: Use after free in payments.
	 Reported by Man Yue Mo of GitHub Security Lab on 2020-09-11</li>
	 <li>[1126424] High CVE-2020-15968: Use after free in Blink.
	 Reported by Anonymous on 2020-09-09</li>
	 <li>[1124659] High CVE-2020-15969: Use after free in WebRTC.
	 Reported by Anonymous on 2020-09-03</li>
	 <li>[1108299] High CVE-2020-15970: Use after free in NFC. Reported
	 by Man Yue Mo of GitHub Security Lab on 2020-07-22</li>
	 <li>[1114062] High CVE-2020-15971: Use after free in printing.
	 Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on
	 2020-08-07</li>
	 <li>[1115901] High CVE-2020-15972: Use after free in audio.
	 Reported by Anonymous on 2020-08-13</li>
	 <li>[1133671] High CVE-2020-15990: Use after free in autofill.
	 Reported by Rong Jian and Guang Gong of Alpha Lab, Qihoo 360 on
	 2020-09-30</li>
	 <li>[1133688] High CVE-2020-15991: Use after free in password
	 manager. Reported by Rong Jian and Guang Gong of Alpha Lab, Qihoo
	 360 on 2020-09-30</li>
	 <li>[1106890] Medium CVE-2020-15973: Insufficient policy
	 enforcement in extensions. Reported by David Erceg on
	 2020-07-17</li>
	 <li>[1104103] Medium CVE-2020-15974: Integer overflow in Blink.
	 Reported by Juno Im (junorouse) of Theori on 2020-07-10</li>
	 <li>[1110800] Medium CVE-2020-15975: Integer overflow in
	 SwiftShader. Reported by Anonymous on 2020-07-29</li>
	 <li>[1123522] Medium CVE-2020-15976: Use after free in WebXR.
	 Reported by YoungJoo Lee (@ashuu_lee) of Raon Whitehat on
	 2020-08-31</li>
	 <li>[1083278] Medium CVE-2020-6557: Inappropriate implementation
	 in networking. Reported by Matthias Gierlings and Marcus Brinkmann
	 (NDS Ruhr-University Bochum) on 2020-05-15</li>
	 <li>[1097724] Medium CVE-2020-15977: Insufficient data validation
	 in dialogs. Reported by Narendra Bhati (@imnarendrabhati) on
	 2020-06-22</li>
	 <li>[1116280] Medium CVE-2020-15978: Insufficient data validation
	 in navigation. Reported by Luan Herrera (@lbherrera_) on
	 2020-08-14</li>
	 <li>[1127319] Medium CVE-2020-15979: Inappropriate implementation
	 in V8. Reported by Avihay Cohen (@SeraphicAlgorithms) on
	 2020-09-11</li>
	 <li>[1092453] Medium CVE-2020-15980: Insufficient policy
	 enforcement in Intents. Reported by Yongke Wang (@Rudykewang) and
	 Aryb1n (@aryb1n) of Tencent Security Xuanwu Lab on 2020-06-08</li>
	 <li>[1123023] Medium CVE-2020-15981: Out of bounds read in audio.
	 Reported by Christoph Guttandin on 2020-08-28</li>
	 <li>[1039882] Medium CVE-2020-15982: Side-channel information
	 leakage in cache. Reported by Luan Herrera (@lbherrera_) on
	 2020-01-07</li>
	 <li>[1076786] Medium CVE-2020-15983: Insufficient data validation
	 in webUI. Reported by Jun Kokatsu, Microsoft Browser Vulnerability
	 Research on 2020-04-30</li>
	 <li>[1080395] Medium CVE-2020-15984: Insufficient policy
	 enforcement in Omnibox. Reported by Rayyan Bijoora on
	 2020-05-07</li>
	 <li>[1099276] Medium CVE-2020-15985: Inappropriate implementation
	 in Blink. Reported by Abdulrahman Alqabandi, Microsoft Browser
	 Vulnerability Research on 2020-06-25</li>
	 <li>[1100247] Medium CVE-2020-15986: Integer overflow in media.
	 Reported by Mark Brand of Google Project Zero on 2020-06-29</li>
	 <li>[1127774] Medium CVE-2020-15987: Use after free in WebRTC.
	 Reported by Philipp Hancke on 2020-09-14</li>
	 <li>[1110195] Medium CVE-2020-15992: Insufficient policy
	 enforcement in networking. Reported by Alison Huffman, Microsoft
	 Browser Vulnerability Research on 2020-07-28</li>
	 <li>[1092518] Low CVE-2020-15988: Insufficient policy enforcement
	 in downloads. Reported by Samuel Attard on 2020-06-08</li>
	 <li>[1108351] Low CVE-2020-15989: Uninitialized Use in PDFium.
	 Reported by Gareth Evans (Microsoft) on 2020-07-22</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-6557</cvename>
 <cvename>CVE-2020-15967</cvename>
 <cvename>CVE-2020-15968</cvename>
 <cvename>CVE-2020-15969</cvename>
 <cvename>CVE-2020-15970</cvename>
 <cvename>CVE-2020-15971</cvename>
 <cvename>CVE-2020-15972</cvename>
 <cvename>CVE-2020-15973</cvename>
 <cvename>CVE-2020-15974</cvename>
 <cvename>CVE-2020-15975</cvename>
 <cvename>CVE-2020-15976</cvename>
 <cvename>CVE-2020-15977</cvename>
 <cvename>CVE-2020-15978</cvename>
 <cvename>CVE-2020-15979</cvename>
 <cvename>CVE-2020-15980</cvename>
 <cvename>CVE-2020-15981</cvename>
 <cvename>CVE-2020-15982</cvename>
 <cvename>CVE-2020-15983</cvename>
 <cvename>CVE-2020-15984</cvename>
 <cvename>CVE-2020-15985</cvename>
 <cvename>CVE-2020-15986</cvename>
 <cvename>CVE-2020-15987</cvename>
 <cvename>CVE-2020-15988</cvename>
 <cvename>CVE-2020-15989</cvename>
 <cvename>CVE-2020-15990</cvename>
 <cvename>CVE-2020-15991</cvename>
 <cvename>CVE-2020-15992</cvename>
 <url>https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2020-10-06</discovery>
 <entry>2020-10-07</entry>
 </dates>
 </vuln>

<vuln vid="cff0b2e2-0716-11eb-9e5d-08002728f74c">
 <topic>libexif -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libexif</name>
	<range><lt>0.6.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Release notes:
	<blockquote cite="https://github.com/libexif/libexif/blob/master/NEWS">
	 Lots of fixes exposed by fuzzers like AFL, ClusterFuzz, OSSFuzz and others:
	 CVE-2016-6328: fixed integer overflow when parsing maker notes
	 CVE-2017-7544: fixed buffer overread
	 CVE-2018-20030: Fix for recursion DoS
	 CVE-2019-9278: replaced integer overflow checks the compiler could optimize away by safer constructs
	 CVE-2020-0093: read overflow
	 CVE-2020-12767: fixed division by zero 
	 CVE-2020-13112: Various buffer overread fixes due to integer overflows in maker notes
	 CVE-2020-13113: Potential use of uninitialized memory 
	 CVE-2020-13114: Time consumption DoS when parsing canon array markers
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/libexif/libexif/blob/master/NEWS</url>
 <url>CVE-2016-6328</url>
 <url>CVE-2017-7544</url>
 <url>CVE-2018-20030</url>
 <url>CVE-2019-9278</url>
 <url>CVE-2020-0093</url>
 <url>CVE-2020-12767</url>
 <url>CVE-2020-13112</url>
 <url>CVE-2020-13113</url>
 <url>CVE-2020-13114</url>
 </references>
 <dates>
 <discovery>2020-05-18</discovery>
 <entry>2020-10-05</entry>
 </dates>
 </vuln>

<vuln vid="c71ed065-0600-11eb-8758-e0d55e2a8bf9">
 <topic>kdeconnect -- packet manipulation can be exploited in a Denial of Service attack</topic>
 <affects>
 <package>
	<name>kdeconnect-kde</name>
	<range><le>20.08.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Albert Astals Cid reports:
	<blockquote cite="https://kde.org/info/security/advisory-20201002-1.txt">
	 <h3>KDE Project Security Advisory</h3>
	 <table>
	 <tr>
	 <td>Title</td>
	 <td>KDE Connect: packet manipulation can be exploited in a Denial of Service attack</td>
	 </tr>
	 <tr>
	 <td>Risk Rating</td>
	 <td>Important</td>
	 </tr>
	 <tr>
	 <td>CVE</td>
	 <td>CVE-2020-26164</td>
	 </tr>
	 <tr>
	 <td>Versions</td>
	 <td>kdeconnect &lt;= 20.08.1</td>
	 </tr>
	 <tr>
	 <td>Author</td>
	 <td>Albert Vaca Cintora &lt;albertvaka@gmail.com&gt;</td>
	 </tr>
	 <tr>
	 <td>Date</td>
	 <td>2 October 2020</td>
	 </tr>
	 </table>
	 <h3>Overview</h3>
	 
	 An attacker on your local network could send maliciously crafted
	 packets to other hosts running kdeconnect on the network, causing
	 them to use large amounts of CPU, memory or network connections,
	 which could be used in a Denial of Service attack within the
	 network.

<h3>Impact</h3>
	 
	 Computers that run kdeconnect are susceptible to DoS attacks from
	 the local network.

<h3>Workaround</h3>
	 
	 We advise you to stop KDE Connect when on untrusted networks like
	 those on airports or conferences.
	 
	 
	 Since kdeconnect is dbus activated it is relatively hard to make
	 sure it stays stopped so the brute force approach is to uninstall
	 the kdeconnect package from your system and then run
	 
	 <pre>
	 kquitapp5 kdeconnectd
	 </pre>
	 
	 Just install the package again once you're back in a trusted
	 network.
	 
	 <h3>Solution</h3>
	 
	 KDE Connect 20.08.2 patches several code paths that could result
	 in a DoS.
	 
	 You can apply these patches on top of 20.08.1:
	 <ul>
	 <li>
	 https://invent.kde.org/network/kdeconnect-kde/-/commit/f183b5447bad47655c21af87214579f03bf3a163
	 </li>
	 <li>
	 https://invent.kde.org/network/kdeconnect-kde/-/commit/b279c52101d3f7cc30a26086d58de0b5f1c547fa
	 </li>
	 <li>
	 https://invent.kde.org/network/kdeconnect-kde/-/commit/d35b88c1b25fe13715f9170f18674d476ca9acdc
	 </li>
	 <li>
	 https://invent.kde.org/network/kdeconnect-kde/-/commit/b496e66899e5bc9547b6537a7f44ab44dd0aaf38
	 </li>
	 <li>
	 https://invent.kde.org/network/kdeconnect-kde/-/commit/5310eae85dbdf92fba30375238a2481f2e34943e
	 </li>
	 <li>
	 https://invent.kde.org/network/kdeconnect-kde/-/commit/721ba9faafb79aac73973410ee1dd3624ded97a5
	 </li>
	 <li>
	 https://invent.kde.org/network/kdeconnect-kde/-/commit/ae58b9dec49c809b85b5404cee17946116f8a706
	 </li>
	 <li>
	 https://invent.kde.org/network/kdeconnect-kde/-/commit/66c768aa9e7fba30b119c8b801efd49ed1270b0a
	 </li>
	 <li>
	 https://invent.kde.org/network/kdeconnect-kde/-/commit/85b691e40f525e22ca5cc4ebe79c361d71d7dc05
	 </li>
	 <li>
	 https://invent.kde.org/network/kdeconnect-kde/-/commit/48180b46552d40729a36b7431e97bbe2b5379306
	 </li>
	 </ul>
	 <h3>Credits</h3>
	 
	 Thanks Matthias Gerstner and the openSUSE security team for
	 reporting the issue.
	 
	 
	 Thanks to Aleix Pol, Nicolas Fella and Albert Vaca Cintora for the
	 patches.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://kde.org/info/security/advisory-20201002-1.txt</url>
 <cvename>CVE-2020-26164</cvename>
 </references>
 <dates>
 <discovery>2020-10-02</discovery>
 <entry>2020-10-04</entry>
 </dates>
 </vuln>

<vuln vid="a23871f6-059b-11eb-8758-e0d55e2a8bf9">
 <topic>upnp -- denial of service (crash)</topic>
 <affects>
 <package>
	<name>upnp</name>
	<range><lt>1.12.1_1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13848">
	 Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13848</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13848</url>
 <url>https://github.com/pupnp/pupnp/issues/177</url>
 <url>https://github.com/pupnp/pupnp/commit/c805c1de1141cb22f74c0d94dd5664bda37398e0</url>
 <cvename>CVE-2020-13848</cvename>
 </references>
 <dates>
 <discovery>2020-06-04</discovery>
 <entry>2020-10-03</entry>
 </dates>
 </vuln>

<vuln vid="a3495e61-047f-11eb-86ea-001b217b3468">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.4.0</ge><lt>13.4.2</lt></range>
	<range><ge>13.3.0</ge><lt>13.3.7</lt></range>
	<range><ge>7.12</ge><lt>13.2.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/10/01/security-release-13-4-2-release/">
	 Potential Denial Of Service Via Update Release Links API
	 Insecure Storage of Session Key In Redis
	 Improper Access Expiration Date Validation
	 Cross-Site Scripting in Multiple Pages
	 Unauthorized Users Can View Custom Project Template
	 Cross-Site Scripting in SVG Image Preview
	 Incomplete Handling in Account Deletion
	 Insufficient Rate Limiting at Re-Sending Confirmation Email
	 Improper Type Check in GraphQL
	 To-dos Are Not Redacted When Membership Changes
	 Guest users can modify confidentiality attribute
	 Command injection on runner host
	 Insecure Runner Configuration in Kubernetes Environments
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/10/01/security-release-13-4-2-release/</url>
 <cvename>CVE-2020-13333</cvename>
 <cvename>CVE-2020-13332</cvename>
 <cvename>CVE-2020-13335</cvename>
 <cvename>CVE-2020-13334</cvename>
 <cvename>CVE-2020-13327</cvename>
 </references>
 <dates>
 <discovery>2020-10-01</discovery>
 <entry>2020-10-02</entry>
 </dates>
 </vuln>

<vuln vid="2eec1e85-faf3-11ea-8ac0-4437e6ad11c4">
 <topic>tt-rss -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>tt-rss</name>
	<range><lt>g20200919</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	tt-rss project reports:
	<blockquote cite="https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799">
	 The cached_url feature mishandles JavaScript inside an SVG document.
	 imgproxy in plugins/af_proxy_http/init.php mishandles $_REQUEST["url"] in an error message.
	 It does not validate all URLs before requesting them.
	</blockquote>
	<blockquote cite="https://community.tt-rss.org/t/replace-php-gettext/2889">
	 Allows remote attackers to execute arbitrary PHP code via a crafted plural forms header.
	</blockquote>
 </body>
 </description>
 <references>
	<url>https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799</url>
	<url>https://community.tt-rss.org/t/replace-php-gettext/2889</url>
	<cvename>CVE-2020-25789</cvename>
	<cvename>CVE-2020-25788</cvename>
	<cvename>CVE-2020-25787</cvename>
	<cvename>CVE-2016-6175</cvename>
 </references>
 <dates>
 <discovery>2020-09-15</discovery>
 <entry>2020-09-20</entry>
 </dates>
 </vuln>

<vuln vid="6d5f1b0b-b865-48d5-935b-3fb6ebb425fc">
 <topic>Apache Ant leaks sensitive information via the java.io.tmpdir</topic>
 <affects>
 <package>
	<name>apache-ant</name>
	<range><ge>1.1</ge><lt>1.10.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache reports:
	<blockquote cite="https://issues.apache.org/jira/browse/RAT-269?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel">
	 Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the
	 default temporary directory identified by the Java
	 system property java.io.tmpdir for several tasks and
	 may thus leak sensitive information. The fixcrlf and
	 replaceregexp tasks also copy files from the temporary
	 directory back into the build tree allowing an attacker
	 to inject modified source files into the build
	 process.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://issues.apache.org/jira/browse/RAT-269?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel</url>
 <cvename>CVE-2020-1945</cvename>
 </references>
 <dates>
 <discovery>2020-05-14</discovery>
 <entry>2020-09-28</entry>
 </dates>
 </vuln>

<vuln vid="b371db92-fe34-11ea-b90e-6805ca2fa271">
 <topic>powerdns -- Leaking uninitialised memory through crafted zone records</topic>
 <affects>
 <package>
	<name>powerdns</name>
	<range><ge>4.3.0</ge><lt>4.3.1</lt></range>
	<range><ge>4.2.0</ge><lt>4.2.3</lt></range>
	<range><ge>4.1.0</ge><lt>4.1.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports
	<blockquote cite="https://doc.powerdns.com/authoritative/changelog/4.3.html#change-4.3.1">
	 CVE-2020-17482: An issue has been found in PowerDNS Authoritative
	 Server before 4.3.1 where an authorized user with the
	 ability to insert crafted records into a zone might
	 be able to leak the content of uninitialized memory.
	 Such a user could be a customer inserting data via a
	 control panel, or somebody with access to the REST
	 API. Crafted records cannot be inserted via AXFR.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-05.html</url>
 <cvename>CVE-2020-17482</cvename>
 </references>
 <dates>
 <discovery>2020-09-22</discovery>
 <entry>2020-09-24</entry>
 </dates>
 </vuln>

<vuln vid="e68d3db1-fd04-11ea-a67f-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>85.0.4183.121</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop_21.html">
	 This release fixes 10 security issues, including:
	 <ul>
	 <li>[1100136] High CVE-2020-15960: Out of bounds read in storage.
	 Reported by Anonymous on 2020-06-28</li>

<li>[1114636] High CVE-2020-15961: Insufficient policy
	 enforcement in extensions. Reported by David Erceg on
	 2020-08-10</li>

<li>[1121836] High CVE-2020-15962: Insufficient policy
	 enforcement in serial. Reported by Leecraso and Guang Gong of 360
	 Alpha Lab working with 360 BugCloud on 2020-08-26</li>

<li>[1113558] High CVE-2020-15963: Insufficient policy
	 enforcement in extensions. Reported by David Erceg on
	 2020-08-06</li>

<li>[1126249] High CVE-2020-15965: Out of bounds write in V8.
	 Reported by Lucas Pinheiro, Microsoft Browser Vulnerability
	 Research on 2020-09-08</li>

<li>[1113565] Medium CVE-2020-15966: Insufficient policy
	 enforcement in extensions. Reported by David Erceg on
	 2020-08-06</li>

<li>[1121414] Low CVE-2020-15964: Insufficient data validation in
	 media. Reported by Woojin Oh(@pwn_expoit) of STEALIEN on
	 2020-08-25</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-15960</cvename>
 <cvename>CVE-2020-15961</cvename>
 <cvename>CVE-2020-15962</cvename>
 <cvename>CVE-2020-15963</cvename>
 <cvename>CVE-2020-15964</cvename>
 <cvename>CVE-2020-15965</cvename>
 <cvename>CVE-2020-15966</cvename>
 <url>https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop_21.html</url>
 </references>
 <dates>
 <discovery>2020-09-21</discovery>
 <entry>2020-09-22</entry>
 </dates>
 </vuln>

<vuln vid="f5abafc0-fcf6-11ea-8758-e0d55e2a8bf9">
 <topic>libxml -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.9.10_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE mitre reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-20388">
	 <h3>CVE-2019-20388</h3>
	 
	 xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
	 
	 <h3>CVE-2020-7595</h3>
	 
	 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
	 
	 <h3>CVE-2020-24977</h3>
	 
	 GNOME project libxml2 v2.9.10 and earlier have a global buffer over-read vulnerability in xmlEncodeEntitiesInternal
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-20388</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-7595</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-24977</url>
 </references>
 <dates>
 <discovery>2020-01-21</discovery>
 <entry>2020-09-22</entry>
 </dates>
 </vuln>

<vuln vid="2327234d-fc4b-11ea-adef-641c67a117d8">
 <topic>py-matrix-synapse -- malformed events may prevent users from joining federated rooms</topic>
 <affects>
 <package>
	<name>py36-matrix-synapse</name>
	<name>py37-matrix-synapse</name>
	<name>py38-matrix-synapse</name>
	<range><lt>1.19.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <h1>Problem Description:</h1>
 Affected Synapse versions assume that all events have an "origin" field set. If an event
 without the "origin" field is sent into a federated room, servers not already joined to
 the room will be unable to do so due to failing to fetch the malformed event.
 <h1>Impact:</h1>
 An attacker could cause a denial of service by deliberately sending a malformed event
 into a room, thus preventing new servers (and thus their users) from joining the
 room.
 </body>
 </description>
 <references>
 <url>https://github.com/matrix-org/synapse/issues/8319</url>
 <url>https://github.com/matrix-org/synapse/pull/8324</url>
 <url>https://github.com/matrix-org/synapse/blob/v1.19.3/CHANGES.md</url>
 </references>
 <dates>
 <discovery>2020-09-16</discovery>
 <entry>2020-09-21</entry>
 </dates>
 </vuln>

<vuln vid="2cb21232-fb32-11ea-a929-a4bf014bf5f7">
 <topic>Python -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python35</name>
	<range><lt>3.5.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python reports:
	<blockquote cite="https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-10">
	 bpo-39603: Prevent http header injection by rejecting control characters in http.client.putrequest(…).
	 bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded (CVE-2020-15523).
	 bpo-41004: CVE-2020-14422: The __hash__() methods of ipaddress.IPv4Interface and ipaddress.IPv6Interface incorrectly generated constant hash values of 32 and 128 respectively. This resulted in always causing hash collisions. The fix uses hash() to generate hash values for the tuple of (address, mask length, network address).
	 bpo-39073: Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.
	 bpo-38576: Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. Such potentially malicious header injection URLs now cause a InvalidURL to be raised.
	 bpo-39503: CVE-2020-8492: The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager.
	 bpo-38945: Newline characters have been escaped when performing uu encoding to prevent them from overflowing into to content section of the encoded file. This prevents malicious or accidental modification of data during the decoding process.
	 bpo-38804: Fixes a ReDoS vulnerability in http.cookiejar. Patch by Ben Caller.
	 bpo-39017: Avoid infinite loop when reading specially crafted TAR files using the tarfile module (CVE-2019-20907).
	 bpo-41183: Use 3072 RSA keys and SHA-256 signature for test certs and keys.
	 bpo-39503: AbstractBasicAuthHandler of urllib.request now parses all WWW-Authenticate HTTP headers and accepts multiple challenges per header: use the realm of the first Basic challenge.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-15523</cvename>
 <cvename>CVE-2020-14422</cvename>
 <cvename>CVE-2019-18348</cvename>
 <cvename>CVE-2020-8492</cvename>
 <cvename>CVE-2019-20907</cvename>
 </references>
 <dates>
 <discovery>2020-08-19</discovery>
 <entry>2020-09-20</entry>
 </dates>
 </vuln>

<vuln vid="24ace516-fad7-11ea-8d8c-005056a311d1">
 <topic>samba -- Unauthenticated domain takeover via netlogon</topic>
 <affects>
 <package>
	<name>samba410</name>
	<range><lt>4.10.18</lt></range>
 </package>
 <package>
	<name>samba411</name>
	<range><lt>4.11.13</lt></range>
 </package>
 <package>
	<name>samba412</name>
	<range><lt>4.12.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="https://www.samba.org/samba/security/CVE-2020-1472.html">
	 An unauthenticated attacker on the network can gain
	 administrator access by exploiting a netlogon protocol flaw.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/security/CVE-2020-1472.html</url>
 <cvename>CVE-2020-1472</cvename>
 </references>
 <dates>
 <discovery>2020-01-01</discovery>
 <entry>2020-09-20</entry>
 </dates>
 </vuln>

<vuln vid="eeec4e6f-fa71-11ea-9bb7-d4c9ef517024">
 <topic>Nextcloud -- Password share by mail not hashed</topic>
 <affects>
 <package>
	<name>nextcloud</name>
	<range><lt>19.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Nextcloud project reports:
	<blockquote cite="https://nextcloud.com/security/advisory/?id=NC-SA-2020-026">
	 NC-SA-2020-026 (low): Password of share by mail is not hashed when
	 given on the create share call 
	 A logic error in Nextcloud Server 19.0.0 caused a plaintext storage
	 of the share password when it was given on the initial create API
	 call.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nextcloud.com/security/advisory/?id=NC-SA-2020-026</url>
 <cvename>CVE-2020-8183</cvename>
 </references>
 <dates>
 <discovery>2020-06-04</discovery>
 <entry>2020-09-19</entry>
 </dates>
 </vuln>

<vuln vid="efd03116-c2a9-11ea-82bc-b42e99a1b9c3">
 <topic>webkit2-gtk3 -- multible vulnerabilities</topic>
 <affects>
 <package>
	<name>webkit2-gtk3</name>
	<range><lt>2.28.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The WebKitGTK project reports vulnerabilities:
	<blockquote cite="https://webkitgtk.org/security/WSA-2020-0006.html">
	 <ul>
 <li>CVE-2020-9802: Processing maliciously crafted web content may lead to arbitrary code execution.</li>
 <li>CVE-2020-9803: Processing maliciously crafted web content may lead to arbitrary code execution.</li>
 <li>CVE-2020-9805: Processing maliciously crafted web content may lead to universal cross site scripting.</li>
 <li>CVE-2020-9806: Processing maliciously crafted web content may lead to arbitrary code execution.</li>
 <li>CVE-2020-9807: Processing maliciously crafted web content may lead to arbitrary code execution.</li>
 <li>CVE-2020-9843: Processing maliciously crafted web content may lead to a cross site scripting attack.</li>
 <li>CVE-2020-9850: A remote attacker may be able to cause arbitrary code execution.</li>
 <li>CVE-2020-13753: CLONE_NEWUSER could potentially be used to confuse xdg- desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal’s input buffer.</li>
 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://webkitgtk.org/security/WSA-2020-0006.html</url>
 <cvename>CVE-2020-9802</cvename>
 <cvename>CVE-2020-9803</cvename>
 <cvename>CVE-2020-9805</cvename>
 <cvename>CVE-2020-9806</cvename>
 <cvename>CVE-2020-9807</cvename>
 <cvename>CVE-2020-9843</cvename>
 <cvename>CVE-2020-9850</cvename>
 <cvename>CVE-2020-13753</cvename>
 </references>
 <dates>
 <discovery>2020-07-10</discovery>
 <entry>2020-07-10</entry>
 </dates>
 </vuln>

<vuln vid="4ca5894c-f7f1-11ea-8ff8-0022489ad614">
 <topic>Node.js -- September 2020 Security Releases</topic>
 <affects>
 <package>
	<name>node</name>
	<range><lt>14.11.0</lt></range>
 </package>
 <package>
	<name>node12</name>
	<range><lt>12.18.4</lt></range>
 </package>
 <package>
	<name>node10</name>
	<range><lt>10.22.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/">
	 Updates are now available for v10,x, v12.x and v14.x Node.js release lines for the following issues.
	 <h1>HTTP Request Smuggling due to CR-to-Hyphen conversion (High) (CVE-2020-8201)</h1>
	 Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This can lead to HTTP Request Smuggling as it is a non-standard interpretation of the header.
	 Impacts:
	 <ul>
	 <li>All versions of the 14.x and 12.x releases line</li>
	 </ul>
	 <h1>Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests (Critical) (CVE-2020-8251)</h1>
	 Node.js is vulnerable to HTTP denial of service (DOS) attacks based on delayed requests submission which can make the server unable to accept new connections. The fix a new http.Server option called requestTimeout with a default value of 0 which means it is disabled by default. This should be set when Node.js is used as an edge server, for more details refer to the documentation.
	 Impacts:
	 <ul>
	 <li>All versions of the 14.x release line</li>
	 </ul>
	 <h1>fs.realpath.native on may cause buffer overflow (Medium) (CVE-2020-8252)</h1>
	 libuv's realpath implementation incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
	 Impacts:
	 <ul>
	 <li>All versions of the 10.x release line</li>
	 <li>All versions of the 12.x release line</li>
	 <li>All versions of the 14.x release line before 14.9.0</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/</url>
 <cvename>CVE-2020-8201</cvename>
 <cvename>CVE-2020-8251</cvename>
 <cvename>CVE-2020-8252</cvename>
 </references>
 <dates>
 <discovery>2020-09-08</discovery>
 <entry>2020-09-16</entry>
 </dates>
 </vuln>

<vuln vid="6d334fdb-f7e7-11ea-88f8-901b0ef719ab">
 <topic>FreeBSD -- ftpd privilege escalation via ftpchroot feature</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.1</ge><lt>12.1_10</lt></range>
	<range><ge>11.4</ge><lt>11.4_4</lt></range>
	<range><ge>11.3</ge><lt>11.3_14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A ftpd(8) bug in the implementation of the file system sandbox, combined
	with capabilities available to an authenticated FTP user, can be used to
	escape the file system restriction configured in ftpchroot(5).
	Moreover, the bug allows a malicious client to gain root privileges.
	<h1>Impact:</h1>
	A malicious FTP user can gain privileged access to an affected system.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7468</cvename>
 <freebsdsa>SA-20:30.ftpd</freebsdsa>
 </references>
 <dates>
 <discovery>2020-09-15</discovery>
 <entry>2020-09-16</entry>
 </dates>
 </vuln>

<vuln vid="e73c688b-f7e6-11ea-88f8-901b0ef719ab">
 <topic>FreeBSD -- bhyve SVM guest escape</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_10</lt></range>
	<range><ge>11.4</ge><lt>11.4_4</lt></range>
	<range><ge>11.3</ge><lt>11.3_14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A number of AMD virtualization instructions operate on host physical
	addresses, are not subject to nested page table translation, and guest use of
	these instructions was not trapped.
	<h1>Impact:</h1>
	From kernel mode a malicious guest can write to arbitrary host memory (with
	some constraints), affording the guest full control of the host.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7467</cvename>
 <freebsdsa>SA-20:29.bhyve_svm</freebsdsa>
 </references>
 <dates>
 <discovery>2020-09-15</discovery>
 <entry>2020-09-16</entry>
 </dates>
 </vuln>

<vuln vid="2c5b9cd7-f7e6-11ea-88f8-901b0ef719ab">
 <topic>FreeBSD -- bhyve privilege escalation via VMCS access</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_10</lt></range>
	<range><ge>11.4</ge><lt>11.4_4</lt></range>
	<range><ge>11.3</ge><lt>11.3_14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	AMD and Intel CPUs support hardware virtualization using specialized data
	structures that control various aspects of guest operation. These are the
	Virtual Machine Control Structure (VMCS) on Intel CPUs, and the Virtual
	Machine Control Block (VMCB) on AMD CPUs. Insufficient access controls allow
	root users, including those running in a jail, to change these data
	structures.
	<h1>Impact:</h1>
	An attacker with host root access (including to a jailed bhyve instance) can
	use this vulnerability to achieve kernel code execution.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-24718</cvename>
 <freebsdsa>SA-20:28.bhyve_vmcs</freebsdsa>
 </references>
 <dates>
 <discovery>2020-09-15</discovery>
 <entry>2020-09-16</entry>
 </dates>
 </vuln>

<vuln vid="bb53af7b-f7e4-11ea-88f8-901b0ef719ab">
 <topic>FreeBSD -- ure device driver susceptible to packet-in-packet attack</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_10</lt></range>
	<range><ge>11.4</ge><lt>11.4_4</lt></range>
	<range><ge>11.3</ge><lt>11.3_14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A programming error in the ure(4) device driver caused some Realtek USB
	Ethernet interfaces to incorrectly report packets with more than 2048 bytes
	in a single USB transfer as having a length of only 2048 bytes.
	An adversary can exploit this to cause the driver to misinterpret part of the
	payload of a large packet as a separate packet, and thereby inject packets
	across security boundaries such as VLANs.
	<h1>Impact:</h1>
	An attacker that can send large frames (larger than 2048 bytes in size) to be
	received by the host (be it VLAN, or non-VLAN tagged packet), can inject
	arbitrary packets to be received and processed by the host. This includes
	spoofing packets from other hosts, or injecting packets to other VLANs than
	the host is on.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7464</cvename>
 <freebsdsa>SA-20:27.ure</freebsdsa>
 </references>
 <dates>
 <discovery>2020-09-15</discovery>
 <entry>2020-09-16</entry>
 </dates>
 </vuln>

<vuln vid="7b630362-f468-11ea-a96c-08002728f74c">
 <topic>Rails -- Potential XSS vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-actionview52</name>
	<range><lt>5.2.4.4</lt></range>
 </package>
 <package>
	<name>rubygem-actionview60</name>
	<range><lt>6.0.3.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails blog:
	<blockquote cite="https://weblog.rubyonrails.org/2020/9/10/Rails-5-2-4-4-and-6-0-3-3-have-been-released/">
	 Rails 5.2.4.4 and 6.0.3.3 have been released! These releases contain an
	 important security fix, so please upgrade when you can.
	 Both releases contain the following fix: [CVE-2020-15169] Potential XSS
	 vulnerability in Action View
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://weblog.rubyonrails.org/2020/9/10/Rails-5-2-4-4-and-6-0-3-3-have-been-released/</url>
 <url>https://groups.google.com/forum/#!topic/rubyonrails-security/b-C9kSGXYrc</url>
 <url>https://github.com/rails/rails/blob/5-2-stable/actionview/CHANGELOG.md</url>
 <url>https://github.com/rails/rails/blob/6-0-stable/actionview/CHANGELOG.md</url>
 <cvename>CVE-2020-15169</cvename>
 </references>
 <dates>
 <discovery>2020-09-09</discovery>
 <entry>2020-09-12</entry>
 </dates>
 </vuln>

<vuln vid="2c92fdd3-896c-4a5a-a0d8-52acee69182d">
 <topic>zeek -- Various vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>3.0.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jon Siwek of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v3.0.10">
	 This release fixes the following security issue:
	 <ul>
	 <li>The AYIYA and GTPv1 parsing/decapsulation logic may
	 leak memory -- These leaks have potential for remote
	 exploitation to cause Denial of Service via resource
	 exhaustion.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v3.0.10</url>
 </references>
 <dates>
 <discovery>2020-08-28</discovery>
 <entry>2020-09-09</entry>
 </dates>
 </vuln>

<vuln vid="bed5d41a-f2b4-11ea-a878-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>85.0.4183.102</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop.html">
	 This release contains 5 security fixes:
	 <ul>
	 <li>[1116304] High CVE-2020-6573: Use after free in video. Reported
	 by Leecraso and Guang Gong of 360 Alpha Lab working with 360
	 BugCloud on 2020-08-14</li>
	 <li>[1102196] High CVE-2020-6574: Insufficient policy
	 enforcement in installer. Reported by CodeColorist of
	 Ant-Financial LightYear Labs on 2020-07-05</li>
	 <li>[1081874] High CVE-2020-6575: Race in Mojo. Reported by
	 Microsoft on 2020-05-12</li>
	 <li>[1111737] High CVE-2020-6576: Use after free in offscreen
	 canvas. Reported by Looben Yang on 2020-07-31</li>
	 <li>[1122684] High CVE-2020-15959: Insufficient policy enforcement
	 in networking. Reported by Eric Lawrence of Microsoft on
	 2020-08-27</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-6573</cvename>
 <cvename>CVE-2020-6574</cvename>
 <cvename>CVE-2020-6575</cvename>
 <cvename>CVE-2020-6576</cvename>
 <cvename>CVE-2020-15969</cvename>
 <url>https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2020-09-08</discovery>
 <entry>2020-09-09</entry>
 </dates>
 </vuln>

<vuln vid="cd97c7ca-f079-11ea-9c31-001b216d295b">
 <topic>Multi-link PPP protocol daemon MPD5 remotely exploitable crash</topic>
 <affects>
 <package>
	<name>mpd5</name>
	<range><lt>5.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Version 5.9 contains security fix for L2TP clients and servers.
	Insufficient validation of incoming L2TP control packet
	specially crafted by unauthenticated user might lead to unexpected
	termination of the process. The problem affects mpd versions
	since 4.0 that brought in initial support for L2TP.
	Installations not using L2TP clients nor L2TP server configuration were not affected.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7465</cvename>
 <cvename>CVE-2020-7466</cvename>
 <url>http://mpd.sourceforge.net/doc5/mpd4.html#4</url>
 </references>
 <dates>
 <discovery>2020-09-04</discovery>
 <entry>2020-09-06</entry>
 <modified>2020-09-07</modified>
 </dates>
 </vuln>

<vuln vid="bcdeb6d2-f02d-11ea-838a-0011d823eebd">
 <topic>Mbed TLS -- Local side channel attack on RSA and static Diffie-Hellman</topic>
 <affects>
 <package>
	<name>mbedtls</name>
	<range><lt>2.16.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Manuel Pégourié-Gonnard reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-2">
	 An attacker with access to precise enough timing and memory access
	 information (typically an untrusted operating system attacking a
	 secure enclave such as SGX or the TrustZone secure world) can
	 recover the private keys used in RSA or static (finite-field)
	 Diffie-Hellman operations.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-2</url>
 </references>
 <dates>
 <discovery>2020-09-01</discovery>
 <entry>2020-09-06</entry>
 </dates>
 </vuln>

<vuln vid="4c69240f-f02c-11ea-838a-0011d823eebd">
 <topic>Mbed TLS -- Local side channel attack on classical CBC decryption in (D)TLS</topic>
 <affects>
 <package>
	<name>mbedtls</name>
	<range><lt>2.16.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Manuel Pégourié-Gonnard reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-1">
	 When decrypting/authenticating (D)TLS record in a connection using
	 a CBC ciphersuite without the Encrypt-then-Mac extension RFC 7366,
	 Mbed TLS used dummy rounds of the compression function associated
	 with the hash used for HMAC in order to hide the length of the
	 padding to remote attackers, as recommended in the original Lucky
	 Thirteen paper.
	 A local attacker who is able to observe the state of the cache
	 could monitor the presence of mbedtls_md_process() in the cache in
	 order to determine when the actual computation ends and when the
	 dummy rounds start. This is a reliable target as it's always called
	 at least once, in response to a previous attack. The attacker can
	 then continue with one of many well-documented Lucky 13
	 variants.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-1</url>
 <cvename>CVE-2020-16150</cvename>
 </references>
 <dates>
 <discovery>2020-09-01</discovery>
 <entry>2020-09-06</entry>
 </dates>
 </vuln>

<vuln vid="2272e6f1-f029-11ea-838a-0011d823eebd">
 <topic>GnuTLS -- null pointer dereference</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>3.6.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GnuTLS project reports:
	<blockquote cite="https://gnutls.org/security-new.html#GNUTLS-SA-2020-09-04">
	 It was found by oss-fuzz that the server sending a
	 "no_renegotiation" alert in an unexpected timing, followed by an
	 invalid second handshake can cause a TLS 1.3 client to crash via a
	 null-pointer dereference. The crash happens in the application's
	 error handling path, where the gnutls_deinit function is called
	 after detecting a handshake failure.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://gnutls.org/security-new.html#GNUTLS-SA-2020-09-04</url>
 <cvename>CVE-2020-24659</cvename>
 </references>
 <dates>
 <discovery>2020-09-04</discovery>
 <entry>2020-09-06</entry>
 </dates>
 </vuln>

<vuln vid="002432c8-ef6a-11ea-ba8f-08002728f74c">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py35-django22</name>
	<name>py36-django22</name>
	<name>py37-django22</name>
	<name>py38-django22</name>
	<range><lt>2.2.16</lt></range>
 </package>
 <package>
	<name>py36-django30</name>
	<name>py37-django30</name>
	<name>py38-django30</name>
	<range><lt>3.0.10</lt></range>
 </package>
 <package>
	<name>py36-django31</name>
	<name>py37-django31</name>
	<name>py38-django31</name>
	<range><lt>3.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django Release notes:
	<blockquote cite="https://docs.djangoproject.com/en/3.1/releases/3.1.1/">
	 CVE-2020-24583: Incorrect permissions on intermediate-level directories
	 on Python 3.7+
	 On Python 3.7+, FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied
	 to intermediate-level directories created in the process of uploading
	 files and to intermediate-level collected static directories when using
	 the collectstatic management command.
	 CVE-2020-24584: Permission escalation in intermediate-level directories
	 of the file system cache on Python 3.7+
	 On Python 3.7+, the intermediate-level directories of the file system
	 cache had the system's standard umask rather than 0o077 (no group or
	 others permissions).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.djangoproject.com/en/2.2/releases/2.2.16/</url>
 <url>https://docs.djangoproject.com/en/3.0/releases/3.0.10/</url>
 <url>https://docs.djangoproject.com/en/3.1/releases/3.1.1/</url>
 <cvename>CVE-2020-24583</cvename>
 <cvename>CVE-2020-24584</cvename>
 </references>
 <dates>
 <discovery>2020-09-01</discovery>
 <entry>2020-09-05</entry>
 </dates>
 </vuln>

<vuln vid="f9fa7adc-ee51-11ea-a240-002590acae31">
 <topic>gnupg -- AEAD key import overflow</topic>
 <affects>
 <package>
	<name>gnupg</name>
	<range><ge>2.2.21</ge><lt>2.2.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Importing an OpenPGP key having a preference list for AEAD algorithms
	will lead to an array overflow and thus often to a crash or other
	undefined behaviour.

Importing an arbitrary key can often easily be triggered by an attacker
	and thus triggering this bug. Exploiting the bug aside from crashes is
	not trivial but likely possible for a dedicated attacker. The major
	hurdle for an attacker is that only every second byte is under their
	control with every first byte having a fixed value of 0x04.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-25125</cvename>
 <url>https://dev.gnupg.org/T5050</url>
 </references>
 <dates>
 <discovery>2020-09-03</discovery>
 <entry>2020-09-03</entry>
 </dates>
 </vuln>

<vuln vid="762b7d4a-ec19-11ea-88f8-901b0ef719ab">
 <topic>FreeBSD -- dhclient heap overflow</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.1</ge><lt>12.1_9</lt></range>
	<range><ge>11.4</ge><lt>11.4_3</lt></range>
	<range><ge>11.3</ge><lt>11.3_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When parsing option 119 data, dhclient(8) computes the uncompressed domain
	list length so that it can allocate an appropriately sized buffer to store
	the uncompressed list. The code to compute the length failed to handle
	certain malformed input, resulting in a heap overflow when the uncompressed
	list is copied into in inadequately sized buffer.
	<h1>Impact:</h1>
	The heap overflow could in principle be exploited to achieve remote code
	execution. The affected process runs with reduced privileges in a Capsicum
	sandbox, limiting the immediate impact of an exploit. However, it is
	possible the bug could be combined with other vulnerabilities to escape the
	sandbox.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7461</cvename>
 <freebsdsa>SA-20:26.dhclient</freebsdsa>
 </references>
 <dates>
 <discovery>2020-09-02</discovery>
 <entry>2020-09-02</entry>
 </dates>
 </vuln>

<vuln vid="77b877aa-ec18-11ea-88f8-901b0ef719ab">
 <topic>FreeBSD -- SCTP socket use-after-free bug</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_9</lt></range>
	<range><ge>11.4</ge><lt>11.4_3</lt></range>
	<range><ge>11.3</ge><lt>11.3_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to improper handling in the kernel, a use-after-free bug can be triggered
	by sending large user messages from multiple threads on the same socket.
	<h1>Impact:</h1>
	Triggering the use-after-free situation may result in unintended kernel
	behaviour including a kernel panic.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7463</cvename>
 <freebsdsa>SA-20:25.sctp</freebsdsa>
 </references>
 <dates>
 <discovery>2020-09-02</discovery>
 <entry>2020-09-02</entry>
 </dates>
 </vuln>

<vuln vid="74bbde13-ec17-11ea-88f8-901b0ef719ab">
 <topic>FreeBSD -- IPv6 Hop-by-Hop options use-after-free bug</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.3</ge><lt>11.3_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to improper mbuf handling in the kernel, a use-after-free bug might be
	triggered by sending IPv6 Hop-by-Hop options over the loopback interface.
	<h1>Impact:</h1>
	Triggering the use-after-free situation may result in unintended kernel
	behaviour including a kernel panic.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7462</cvename>
 <freebsdsa>SA-20:24.ipv6</freebsdsa>
 </references>
 <dates>
 <discovery>2020-09-02</discovery>
 <entry>2020-09-02</entry>
 </dates>
 </vuln>

<vuln vid="1fb13175-ed52-11ea-8b93-001b217b3468">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.3.0</ge><lt>13.3.4</lt></range>
	<range><ge>13.2.0</ge><lt>13.2.8</lt></range>
	<range><ge>0</ge><lt>13.1.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/09/02/security-release-gitlab-13-3-3-released/">
	 Vendor Cross-Account Assume-Role Attack
	 Stored XSS on the Vulnerability Page
	 Outdated Job Token Can Be Reused to Access Unauthorized Resources
	 File Disclosure Via Workhorse File Upload Bypass
	 Unauthorized Maintainer Can Edit Group Badge
	 Denial of Service Within Wiki Functionality
	 Sign-in Vulnerable to Brute-force Attacks
	 Invalidated Session Allows Account Access With an Old Password
	 GitLab Omniauth Endpoint Renders User Controlled Messages
	 Blind SSRF Through Repository Mirroring
	 Information Disclosure Through Incorrect Group Permission Verifications
	 No Rate Limit on GitLab Webhook Feature
	 GitLab Session Revocation Feature Does Not Invalidate All Sessions
	 OAuth Authorization Scope for an External Application Can Be Changed Without User Consent
	 Unauthorized Maintainer Can Delete Repository
	 Improper Verification of Deploy-Key Leads to Access Restricted Repository
	 Disabled Repository Still Accessible With a Deploy-Token
	 Duplicated Secret Code Generated by 2 Factor Authentication Mechanism
	 Lack of Validation Within Project Invitation Flow
	 Current Sessions Not Invalidated Upon Enabling 2 Factor Authentication
	 Users Without 2 Factor Authentication Can Be Blocked Accessing GitLab
	 Lack of Upper Bound Check Leading to Possible Denial of Service
	 2 Factor Authentication for Groups Was Not Enforced Within API Endpoint
	 GitLab Runner Denial of Service via CI Jobs
	 Update jQuery Dependency
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/09/02/security-release-gitlab-13-3-3-released/</url>
 <cvename>CVE-2020-13318</cvename>
 <cvename>CVE-2020-13301</cvename>
 <cvename>CVE-2020-13284</cvename>
 <cvename>CVE-2020-13298</cvename>
 <cvename>CVE-2020-13313</cvename>
 <cvename>CVE-2020-13311</cvename>
 <cvename>CVE-2020-13289</cvename>
 <cvename>CVE-2020-13302</cvename>
 <cvename>CVE-2020-13314</cvename>
 <cvename>CVE-2020-13309</cvename>
 <cvename>CVE-2020-13287</cvename>
 <cvename>CVE-2020-13306</cvename>
 <cvename>CVE-2020-13299</cvename>
 <cvename>CVE-2020-13300</cvename>
 <cvename>CVE-2020-13317</cvename>
 <cvename>CVE-2020-13303</cvename>
 <cvename>CVE-2020-13316</cvename>
 <cvename>CVE-2020-13304</cvename>
 <cvename>CVE-2020-13305</cvename>
 <cvename>CVE-2020-13307</cvename>
 <cvename>CVE-2020-13308</cvename>
 <cvename>CVE-2020-13315</cvename>
 <cvename>CVE-2020-13297</cvename>
 <cvename>CVE-2020-13310</cvename>
 <cvename>CVE-2020-11022</cvename>
 </references>
 <dates>
 <discovery>2020-09-02</discovery>
 <entry>2020-09-02</entry>
 </dates>
 </vuln>

<vuln vid="67b050ae-ec82-11ea-9071-10c37b4ac2ea">
 <topic>go -- net/http/cgi, net/http/fcgi: Cross-Site Scripting (XSS) when Content-Type is not specified</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.14.8,1</lt></range>
	<range><ge>1.15,1</ge><lt>1.15.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/40928">
	 When a Handler does not explicitly set the Content-Type header, both
	 CGI implementations default to “text/html”. If an attacker can make
	 a server generate content under their control (e.g. a JSON
	 containing user data or an uploaded image file) this might be
	 mistakenly returned by the server as “text/html”. If a victim visits
	 such a page they could get the attacker's code executed in the
	 context of the server origin. If an attacker can make a server
	 generate content under their control (e.g. a JSON containing user
	 data or an uploaded image file) this might be mistakenly returned by
	 the server as “text/html”. If a victim visits such a page they could
	 get the attacker's code executed in the context of the server
	 origin.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-24553</cvename>
 <url>https://github.com/golang/go/issues/40928</url>
 </references>
 <dates>
 <discovery>2020-08-20</discovery>
 <entry>2020-09-01</entry>
 </dates>
 </vuln>

<vuln vid="38fdf07b-e8ec-11ea-8bbe-e0d55e2a8bf9">
 <topic>ark -- extraction outside of extraction directory</topic>
 <affects>
 <package>
	<name>ark</name>
	<range><lt>20.08.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Albert Astals Cid reports:
	<blockquote cite="https://kde.org/info/security/advisory-20200827-1.txt">
	 <h3>Overview</h3>
	 A maliciously crafted TAR archive containing symlink entries
	 would install files anywhere in the user's home directory upon extraction.
	 <h3>Proof of concept</h3>
	 For testing, an example of malicious archive can be found at
	 <a href="https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.tar">dirsymlink.tar</a>
	 
	 <h3>Impact</h3>
	 Users can unwillingly install files like a modified .bashrc, or a malicious
	 script placed in ~/.config/autostart.
	 <h3>Workaround</h3>
	 Before extracting a downloaded archive using the Ark GUI, users should inspect it
	 to make sure it doesn't contain symlink entries pointing outside the extraction folder.
	 The 'Extract' context menu from the Dolphin file manager shouldn't be used.
	 <h3>Solution</h3>
	 Ark 20.08.1 skips maliciously crafted symlinks when extracting TAR archives.
	 Alternatively, <a href="https://invent.kde.org/utilities/ark/-/commit/8bf8c5ef07b0ac5e914d752681e470dea403a5bd">8bf8c5ef07b0ac5e914d752681e470dea403a5bd</a> can be applied to previous releases.
	 <h3>Credits</h3>
	 Thanks to Fabian Vogt for reporting this issue and for fixing it.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://kde.org/info/security/advisory-20200827-1.txt</url>
 <cvename>CVE-2020-24654</cvename>
 </references>
 <dates>
 <discovery>2020-08-27</discovery>
 <entry>2020-08-28</entry>
 </dates>
 </vuln>

<vuln vid="ee261034-b95e-4479-b947-08b0877e029f">
 <topic>php72 -- use of freed hash key</topic>
 <affects>
 <package>
	<name>php72</name>
	<range><lt>7.2.33</lt></range>
 </package>
 <package>
	<name>php73</name>
	<range><lt>7.3.21</lt></range>
 </package>
 <package>
	<name>php74</name>
	<range><lt>7.4.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	grigoritchy at gmail dot com reports:
	<blockquote cite="https://bugs.php.net/bug.php?id=79797">
	 The phar_parse_zipfile function had use-after-free
	 vulnerability because of mishandling of the actual_alias
	 variable.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7068</url>
 <cvename>CVE-2020-7068</cvename>
 </references>
 <dates>
 <discovery>2020-07-06</discovery>
 <entry>2020-08-27</entry>
 </dates>
 </vuln>

<vuln vid="d73bc4e6-e7c4-11ea-a878-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>85.0.4183.83</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_25.html">
	 This update includes 20 security fixes, including:
	 <ul>
	 <li>[1109120] High CVE-2020-6558: Insufficient policy
	 enforcement in iOS. Reported by Alison Huffman, Microsoft Browser
	 Vulnerability Research on 2020-07-24</li>
	 <li>[1116706] High CVE-2020-6559: Use after free in presentation
	 API. Reported by Liu Wei and Wu Zekai of Tencent Security Xuanwu
	 Lab on 2020-08-15</li>
	 <li>[1108181] Medium CVE-2020-6560: Insufficient policy
	 enforcement in autofill. Reported by Nadja Ungethuem from
	 www.unnex.de on 2020-07-22</li>
	 <li>[932892] Medium CVE-2020-6561: Inappropriate implementation
	 in Content Security Policy. Reported by Rob Wu on 2019-02-16</li>
	 <li>[1086845] Medium CVE-2020-6562: Insufficient policy
	 enforcement in Blink. Reported by Masato Kinugawa on
	 2020-05-27</li>
	 <li>[1104628] Medium CVE-2020-6563: Insufficient policy
	 enforcement in intent handling. Reported by Pedro Oliveira on
	 2020-07-12</li>
	 <li>[841622] Medium CVE-2020-6564: Incorrect security UI in
	 permissions. Reported by Khalil Zhani on 2018-05-10</li>
	 <li>[1029907] Medium CVE-2020-6565: Incorrect security UI in
	 Omnibox. Reported by Khalil Zhani on 2019-12-02</li>
	 <li>[1065264] Medium CVE-2020-6566: Insufficient policy
	 enforcement in media. Reported by Jun Kokatsu, Microsoft Browser
	 Vulnerability Research on 2020-03-27</li>
	 <li>[937179] Low CVE-2020-6567: Insufficient validation of
	 untrusted input in command line handling. Reported by Joshua
	 Graham of TSS on 2019-03-01</li>
	 <li>[1092451] Low CVE-2020-6568: Insufficient policy enforcement
	 in intent handling. Reported by Yongke Wang(@Rudykewang) and
	 Aryb1n(@aryb1n) of Tencent Security Xuanwu Lab on 2020-06-08</li>
	 <li>[995732] Low CVE-2020-6569: Integer overflow in WebUSB.
	 Reported by guaixiaomei on 2019-08-20</li>
	 <li>[1084699] Low CVE-2020-6570: Side-channel information leakage
	 in WebRTC. Reported by Signal/Tenable on 2020-05-19</li>
	 <li>[1085315] Low CVE-2020-6571: Incorrect security UI in Omnibox.
	 Reported by Rayyan Bijoora on 2020-05-21</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-6558</cvename>
 <cvename>CVE-2020-6559</cvename>
 <cvename>CVE-2020-6560</cvename>
 <cvename>CVE-2020-6561</cvename>
 <cvename>CVE-2020-6562</cvename>
 <cvename>CVE-2020-6563</cvename>
 <cvename>CVE-2020-6564</cvename>
 <cvename>CVE-2020-6565</cvename>
 <cvename>CVE-2020-6566</cvename>
 <cvename>CVE-2020-6567</cvename>
 <cvename>CVE-2020-6568</cvename>
 <cvename>CVE-2020-6569</cvename>
 <cvename>CVE-2020-6570</cvename>
 <cvename>CVE-2020-6571</cvename>
 <url>https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_25.html</url>
 </references>
 <dates>
 <discovery>2020-08-25</discovery>
 <entry>2020-08-26</entry>
 </dates>
 </vuln>

<vuln vid="6842ac7e-d250-11ea-b9b7-08002728f74c">
 <topic>jasper -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jasper</name>
	<range><lt>2.0.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	JasPer NEWS:
	<blockquote cite="https://github.com/jasper-software/jasper/blob/master/NEWS">
	 - Fix CVE-2018-9154
	 - Fix CVE-2018-19541
	 - Fix CVE-2016-9399, CVE-2017-13751
	 - Fix CVE-2018-19540
	 - Fix CVE-2018-9055
	 - Fix CVE-2017-13748
	 - Fix CVE-2017-5503, CVE-2017-5504, CVE-2017-5505
	 - Fix CVE-2018-9252
	 - Fix CVE-2018-19139
	 - Fix CVE-2018-19543, CVE-2017-9782
	 - Fix CVE-2018-20570
	 - Fix CVE-2018-20622
	 - Fix CVE-2016-9398
	 - Fix CVE-2017-14132
	 - Fix CVE-2017-5499
	 - Fix CVE-2018-18873
	 - Fix CVE-2017-13750
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/jasper-software/jasper/blob/master/NEWS</url>
 <cvename>CVE-2018-9154</cvename>
 <cvename>CVE-2018-19541</cvename>
 <cvename>CVE-2016-9399</cvename>
 <cvename>CVE-2017-13751</cvename>
 <cvename>CVE-2018-19540</cvename>
 <cvename>CVE-2018-9055</cvename>
 <cvename>CVE-2017-13748</cvename>
 <cvename>CVE-2017-5503</cvename>
 <cvename>CVE-2017-5504</cvename>
 <cvename>CVE-2017-5505</cvename>
 <cvename>CVE-2018-9252</cvename>
 <cvename>CVE-2018-19139</cvename>
 <cvename>CVE-2018-19543</cvename>
 <cvename>CVE-2017-9782</cvename>
 <cvename>CVE-2018-20570</cvename>
 <cvename>CVE-2018-20622</cvename>
 <cvename>CVE-2016-9398</cvename>
 <cvename>CVE-2017-14132</cvename>
 <cvename>CVE-2017-5499</cvename>
 <cvename>CVE-2018-18873</cvename>
 <cvename>CVE-2017-13750</cvename>
 </references>
 <dates>
 <discovery>2020-07-28</discovery>
 <entry>2020-08-25</entry>
 <modified>2020-09-05</modified>
 </dates>
 </vuln>

<vuln vid="ffa15b3b-e6f6-11ea-8cbf-54e1ad3d6335">
 <topic>xorg-server -- Multiple input validation failures in X server extensions</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<range><lt>1.20.8_4,1</lt></range>
 </package>
 <package>
	<name>xephyr</name>
	<range><lt>1.20.8_4,1</lt></range>
 </package>
 <package>
	<name>xorg-vfbserver</name>
	<range><lt>1.20.8_4,1</lt></range>
 </package>
 <package>
	<name>xorg-nestserver</name>
	<range><lt>1.20.8_4,1</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>1.20.8_4,1</lt></range>
 </package>
 <package>
	<name>xorg-dmx</name>
	<range><lt>1.20.8_4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The X.org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2020-August/003058.html">
	 All theses issuses can lead to local privileges elevation on
	 systems where the X server is running privileged.
	 The handler for the XkbSetNames request does not validate the
	 request length before accessing its contents.
	 An integer underflow exists in the handler for the
	 XIChangeHierarchy request.
	 An integer underflow exist in the handler for the XkbSelectEvents
	 request.
	 An integer underflow exist in the handler for the CreateRegister
	 request of the X record extension.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-14345</cvename>
 <cvename>CVE-2020-14346</cvename>
 <cvename>CVE-2020-14361</cvename>
 <cvename>CVE-2020-14362</cvename>
 <url>https://lists.x.org/archives/xorg-announce/2020-August/003058.html</url>
 </references>
 <dates>
 <discovery>2020-08-25</discovery>
 <entry>2020-08-25</entry>
 </dates>
 </vuln>

<vuln vid="8da79498-e6f6-11ea-8cbf-54e1ad3d6335">
 <topic>libX11 -- Doublefree in locale handlng code</topic>
 <affects>
 <package>
	<name>libX11</name>
	<range><lt>1.6.12,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The X.org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2020-August/003056.html">
	 There is an integer overflow and a double free vulnerability in
	 the way LibX11 handles locales. The integer overflow is a necessary
	 precursor to the double free.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-14363</cvename>
 <url>https://lists.x.org/archives/xorg-announce/2020-August/003056.html</url>
 </references>
 <dates>
 <discovery>2020-08-25</discovery>
 <entry>2020-08-25</entry>
 <modified>2020-11-15</modified>
 </dates>
 </vuln>

<vuln vid="719f06af-e45e-11ea-95a1-c3b8167b8026">
 <topic>chrony &lt;= 3.5.1 data corruption through symlink vulnerability writing the pidfile</topic>
 <affects>
 <package>
	<name>chrony</name>
	<range><lt>3.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Miroslav Lichvar reports:
	<blockquote cite="https://listengine.tuxfamily.org/chrony.tuxfamily.org/chrony-announce/2020/08/msg00000.html">
	 chrony-3.5.1 [...] fixes a security issue in writing of the pidfile.
	 When chronyd is configured to save the pidfile in a directory where the
	 chrony user has write permissions (e.g. /var/run/chrony - the default
	 since chrony-3.4), an attacker that compromised the chrony user account
	 could create a symbolic link at the location of the pidfile to make
	 chronyd starting with root privileges follow the symlink and write its
	 process ID to a file for which the chrony user doesn't have write
	 permissions, causing a denial of service, or data loss.
	 This issue was reported by Matthias Gerstner of SUSE.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://listengine.tuxfamily.org/chrony.tuxfamily.org/chrony-announce/2020/08/msg00000.html</url>
 <cvename>CVE-2020-14367</cvename>
 </references>
 <dates>
 <discovery>2020-08-06</discovery>
 <entry>2020-08-22</entry>
 </dates>
 </vuln>

<vuln vid="2ed7e8db-e234-11ea-9392-002590bc43be">
 <topic>sysutils/openzfs-kmod -- critical permissions issues</topic>
 <affects>
 <package>
	<name>openzfs-kmod</name>
	<range><lt>2020081800</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Andrew Walker reports:
	<blockquote cite="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=248787">
	 <h5>Issue 1:</h5>
	 
	 Users are always granted permissions to cd into a directory. The
	 check for whether execute is present on directories is a de-facto
	 no-op. This cannot be mitigated without upgrading. Even setting
	 an explicit "deny - execute" NFSv4 ACE will be bypassed.
	 
	 <h5>Issue 2:</h5>
	 
	 All ACEs for the owner_group (group@) and regular groups
	 (group:&lt;foo&gt;) are granted the current user. This means that
	 POSIX mode 770 is de-facto 777, and the below ACL is also de-facto
	 777 because the groupmember check for builtin_administrators
	 returns True.
	 
	 <pre>
root@TESTBOX[~]# getfacl testfile
# file: testfile
# owner: root
# group: wheel
group:builtin_administrators:rwxpDdaARWcCos:-------:allow
	 </pre>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/248787</freebsdpr>
 <url>https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f</url>
 <url>https://reviews.freebsd.org/D26107</url>
 </references>
 <dates>
 <discovery>2020-08-13</discovery>
 <entry>2020-08-20</entry>
 </dates>
 </vuln>

<vuln vid="fbca6863-e2ad-11ea-9d39-00a09858faf5">
 <topic>textproc/elasticsearch6 -- field disclosure flaw</topic>
 <affects>
 <package>
	<name>elasticsearch6</name>
	<range><lt>6.8.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Elastic reports:
	<blockquote cite="https://discuss.elastic.co/t/elastic-stack-7-9-0-and-6-8-12-security-update/245456">
	A field disclosure flaw was found in Elasticsearch when running
	 a scrolling search with Field Level Security. If a user runs
	 the same query another more privileged user recently ran,
	 the scrolling search can leak fields that should be hidden.
	 This could result in an attacker gaining additional permissions
	 against a restricted index.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7019</cvename>
 <url>https://discuss.elastic.co/t/elastic-stack-7-9-0-and-6-8-12-security-update/245456</url>
 <url>https://github.com/elastic/elasticsearch/pull/39490</url>
 </references>
 <dates>
 <discovery>2020-08-19</discovery>
 <entry>2020-08-20</entry>
 </dates>
 </vuln>

<vuln vid="08de38d2-e2d0-11ea-9538-0c9d925bbbc0">
 <topic>adns -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>adns</name>
	<range><lt>1.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ian Jackson and the adns project reports:
	<blockquote cite="https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html">
	Vulnerable applications: all adns callers.
	 Exploitable by: the local recursive resolver.
	 Likely worst case: Remote code execution.
	Vulnerable applications: those that make SOA queries.
	 Exploitable by: upstream DNS data sources.
	 Likely worst case: DoS (crash of the adns-using application)
	Vulnerable applications: those that use adns_qf_quoteok_query.
	 Exploitable by: sources of query domain names.
	 Likely worst case: DoS (crash of the adns-using application)
	Vulnerable applications: adnshost.
	 Exploitable by: code responsible for framing the input.
	 Likely worst case: DoS (adnshost crashes at EOF).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html</url>
 <cvename>CVE-2017-9103</cvename>
 <cvename>CVE-2017-9104</cvename>
 <cvename>CVE-2017-9105</cvename>
 <cvename>CVE-2017-9106</cvename>
 <cvename>CVE-2017-9107</cvename>
 <cvename>CVE-2017-9108</cvename>
 <cvename>CVE-2017-9109</cvename>
 </references>
 <dates>
 <discovery>2017-05-21</discovery>
 <entry>2020-08-20</entry>
 </dates>
 </vuln>

<vuln vid="f60561e7-e23e-11ea-be64-507b9d01076a">
 <topic>Icinga Web 2 -- directory traversal vulnerability</topic>
 <affects>
 <package>
	<name>icingaweb2</name>
	<range><le>2.8.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Icinga development team reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24368">
	 CVE-2020-24368
	 
	 Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a
	 Directory Traversal vulnerability which allows an attacker to access
	 arbitrary files that are readable by the process running Icinga Web
	 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://icinga.com/2020/08/19/icinga-web-security-release-v2-6-4-v2-7-4-and-v2-8-2/</url>
 <cvename>CVE-2020-24368</cvename>
 </references>
 <dates>
 <discovery>2020-08-19</discovery>
 <entry>2020-08-19</entry>
 </dates>
 </vuln>

<vuln vid="b905dff4-e227-11ea-b0ea-08002728f74c">
 <topic>curl -- expired pointer dereference vulnerability</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.29.0</ge><lt>7.72.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	curl security problems:
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	 CVE-2020-8231: wrong connect-only connection
	 An application that performs multiple requests with libcurl's multi API
	 and sets the CURLOPT_CONNECT_ONLY option, might in rare circumstances
	 experience that when subsequently using the setup connect-only transfer,
	 libcurl will pick and use the wrong connection - and instead pick
	 another one the application has created since then.
	 CURLOPT_CONNECT_ONLY is the option to tell libcurl to not perform an
	 actual transfer, only connect. When that operation is completed, libcurl
	 remembers which connection it used for that transfer and "easy handle".
	 It remembers the connection using a pointer to the internal connectdata
	 struct in memory.
	 If more transfers are then done with the same multi handle before the
	 connect-only connection is used, leading to the initial connect-only
	 connection to get closed (for example due to idle time-out) while also
	 new transfers (and connections) are setup, such a new connection might
	 end up getting the exact same memory address as the now closed
	 connect-only connection.
	 If after those operations, the application then wants to use the
	 original transfer's connect-only setup to for example use
	 curl_easy_send() to send raw data over that connection, libcurl could
	 erroneously find an existing connection still being alive at the address
	 it remembered since before even though this is now a new and different
	 connection.
	 The application could then accidentally send data over that connection
	 which wasn't at all intended for that recipient, entirely unknowingly.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/security.html</url>
 <url>https://curl.haxx.se/docs/CVE-2020-8231.html</url>
 <cvename>CVE-2020-8231</cvename>
 </references>
 <dates>
 <discovery>2020-08-19</discovery>
 <entry>2020-08-19</entry>
 </dates>
 </vuln>

<vuln vid="3fcb70a4-e22d-11ea-98b2-080027846a02">
 <topic>Python -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>python37</name>
 <range><lt>3.7.9</lt></range>
 </package>
 <package>
 <name>python36</name>
 <range><lt>3.6.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Python reports:
 <blockquote cite="https://docs.python.org/release/3.7.9/whatsnew/changelog.html#changelog">
	 bpo-29778: Ensure python3.dll is loaded from correct locations when
	 Python is embedded (CVE-2020-15523).
	 bpo-41004: CVE-2020-14422: The __hash__() methods of ipaddress.IPv4Interface
	 and ipaddress.IPv6Interface incorrectly generated constant hash values
	 of 32 and 128 respectively. This resulted in always causing hash collisions.
	 The fix uses hash() to generate hash values for the tuple of (address, mask
	 length, network address).
	 bpo-39603: Prevent http header injection by rejecting control characters
	 in http.client.putrequest(...).
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.python.org/release/3.7.9/whatsnew/changelog.html#changelog</url>
 <url>https://docs.python.org/release/3.6.12/whatsnew/changelog.html#changelog</url>
 <cvename>CVE-2020-14422</cvename>
 <cvename>CVE-2020-15523</cvename>
 </references>
 <dates>
 <discovery>2020-06-17</discovery>
 <entry>2020-08-19</entry>
 </dates>
 </vuln>

<vuln vid="e37a0a7b-e1a7-11ea-9538-0c9d925bbbc0">
 <topic>security/trousers -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>trousers</name>
	<range><lt>0.3.14_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	the TrouSerS project reports reports:
	<blockquote cite="https://sourceforge.net/p/trousers/trousers/ci/e74dd1d96753b0538192143adf58d04fcd3b242b/">
	 If the tcsd daemon is started with root privileges, it fails to
	 drop the root gid after it is no longer needed.
	 If the tcsd daemon is started with root privileges, the tss user
	 has read and write access to the /etc/tcsd.conf file.
	 If the tcsd daemon is started with root privileges, the creation
	 of the system.data file is prone to symlink attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://sourceforge.net/p/trousers/trousers/ci/e74dd1d96753b0538192143adf58d04fcd3b242b/</url>
 <url>https://www.openwall.com/lists/oss-security/2020/05/20/3</url>
 <cvename>CVE-2020-24330</cvename>
 <cvename>CVE-2020-24331</cvename>
 <cvename>CVE-2020-24332</cvename>
 </references>
 <dates>
 <discovery>2020-05-20</discovery>
 <entry>2020-08-18</entry>
 </dates>
 </vuln>

<vuln vid="64575bb6-e188-11ea-beed-e09467587c17">
 <topic>chromium -- heap buffer overflow</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>84.0.4147.135</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_18.html">
	 This release contains one security fix:
	 <ul>
	 <li>[1115345] High CVE-2020-6556: Heap buffer overflow in
	 SwiftShader. Reported by Alison Huffman, Microsoft Browser
	 Vulnerability Research on 2020-08-12</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-6556</cvename>
 <url>https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_18.html</url>
 </references>
 <dates>
 <discovery>2020-08-18</discovery>
 <entry>2020-08-18</entry>
 </dates>
 </vuln>

<vuln vid="f20eb9a4-dfea-11ea-a9b8-9c5c8e84d621">
 <topic>ceph14 -- HTTP header injection via CORS ExposeHeader tag</topic>
 <affects>
 <package>
 <name>ceph14</name>
 <range><lt>14.2.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Red Hat bugzilla reports:
 <blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10753">
 A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway).
	The vulnerability is related to the injection of HTTP headers via a CORS
	ExposeHeader tag. The newline character in the ExposeHeader tag in the
	CORS configuration file generates a header injection in the response
	when the CORS request is made.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10753</url>
 <cvename>CVE-2020-10753</cvename>
 <freebsdpr>ports/248673</freebsdpr>
 </references>
 <dates>
 <discovery>2020-05-27</discovery>
 <entry>2020-08-16</entry>
 </dates>
 </vuln>

<vuln vid="09ea1b08-1d3e-4bf2-91a1-d6573f4da3d8">
 <topic>jenkins -- Buffer corruption in bundled Jetty</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.243</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.235.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2020-08-17/">
	 <h1>Description</h1>
	 <h5>(Critical) SECURITY-1983 / CVE-2019-17638</h5>
	 Buffer corruption in bundled Jetty
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-17638</cvename>
 <url>https://www.jenkins.io/security/advisory/2020-08-17/</url>
 </references>
 <dates>
 <discovery>2020-08-17</discovery>
 <entry>2020-08-17</entry>
 </dates>
 </vuln>

<vuln vid="085399ab-dfd7-11ea-96e4-80ee73bc7b66">
 <topic>net/rsync -- multiple zlib issues</topic>
 <affects>
 <package>
	<name>rsync</name>
	<range><lt>3.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	rsync developers reports:
	<blockquote cite="https://download.samba.org/pub/rsync/NEWS#3.2.0">
	 Various zlib fixes, including security fixes for CVE-2016-9843, CVE-2016-9842, CVE-2016-9841, and CVE-2016-9840
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://download.samba.org/pub/rsync/NEWS#3.2.0</url>
 <cvename>CVE-2016-9843</cvename>
 <cvename>CVE-2016-9842</cvename>
 <cvename>CVE-2016-9841</cvename>
 <cvename>CVE-2016-9840</cvename>
 </references>
 <dates>
 <discovery>2020-06-19</discovery>
 <entry>2020-08-16</entry>
 </dates>
 </vuln>

<vuln vid="a23ebf36-e8b6-4665-b0f3-4c977f9a145c">
 <topic>security/py-ecdsa -- multiple issues</topic>
 <affects>
 <package>
	<name>py27-ecdsa</name>
	<range><le>0.13.3</le></range>
 </package>
 <package>
	<name>py37-ecdsa</name>
	<range><le>0.13.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	py-ecdsa developers report:
	<blockquote cite="https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3">
	 Fix CVE-2019-14853 - possible DoS caused by malformed signature decoding.
	 Fix CVE-2019-14859 - signature malleability caused by insufficient checks of DER encoding
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3</url>
 <cvename>CVE-2019-14853</cvename>
 <cvename>CVE-2019-14859</cvename>
 </references>
 <dates>
 <discovery>2019-10-07</discovery>
 <entry>2020-08-16</entry>
 </dates>
 </vuln>

<vuln vid="b8ea5b66-deff-11ea-adef-641c67a117d8">
 <topic>snmptt -- malicious shell code</topic>
 <affects>
 <package>
	<name>snmptt</name>
	<range><lt>1.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Snmptt reports:
	<blockquote cite="http://snmptt.sourceforge.net/changelog.shtml">
	 Fixed a security issue with EXEC / PREXEC / unknown_trap_exec that could
	 allow malicious shell code to be executed.
	 Fixed a bug with EXEC / PREXEC / unknown_trap_exec that caused commands to be
	 run as root instead of the user defined in daemon_uid.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://snmptt.sourceforge.net/changelog.shtml</url>
 <freebsdpr>ports/248162</freebsdpr>
 </references>
 <dates>
 <discovery>2020-07-23</discovery>
 <entry>2020-08-15</entry>
 </dates>
 </vuln>

<vuln vid="87a07de1-e55e-4d51-bb64-8d117829a26a">
 <topic>mail/dovecot -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><lt>2.3.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aki Tuomi reports:
	<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html">
	 Parsing mails with a large number of MIME parts could
 have resulted in excessive CPU usage or a crash due to running out of
 stack memory..
	</blockquote>
	<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html">
	 Dovecot's NTLM implementation does not correctly check
 message buffer size, which leads to reading past allocation which can
	 lead to crash
	</blockquote>
	<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html">
	 lmtp/submission: Issuing the RCPT command with an
 address that has the empty quoted string as local-part causes the lmtp
 service to crash.
	</blockquote>
	<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html">
	 Dovecot's RPA mechanism implementation accepts
 zero-length message, which leads to assert-crash later on.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html</url>
 <cvename>CVE-2020-12100</cvename>
 <cvename>CVE-2020-12673</cvename>
 <cvename>CVE-2020-10967</cvename>
 <cvename>CVE-2020-12674</cvename>
 </references>
 <dates>
 <discovery>2020-04-23</discovery>
 <entry>2020-08-13</entry>
 </dates>
 </vuln>

<vuln vid="b1d6b383-dd51-11ea-a688-7b12871ef3ad">
 <topic>ilmbase, openexr -- v2.5.3 is a patch release with various bug/security fixes</topic>
 <affects>
 <package>
	<name>ilmbase</name>
	<range><lt>2.5.3</lt></range>
 </package>
 <package>
	<name>openexr</name>
	<range><lt>2.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cary Phillips reports:
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.3">
	 v2.5.3 - Patch release with various bug/security fixes [...]:
	 <ul><li>Various sanitizer/fuzz-identified issues related to handling of invalid input</li></ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.3</url>
 </references>
 <dates>
 <discovery>2020-07-13</discovery> 
 <entry>2020-08-13</entry>
 </dates>
 </vuln>

<vuln vid="eef0d2d9-78c0-441e-8b03-454c5baebe20">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.252</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.235.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2020-08-12/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-1955 / CVE-2020-2229</h5>
	 Stored XSS vulnerability in help icons
	 <h5>(High) SECURITY-1957 / CVE-2020-2230</h5>
	 Stored XSS vulnerability in project naming strategy
	 <h5>(High) SECURITY-1960 / CVE-2020-2231</h5>
	 Stored XSS vulnerability in 'Trigger builds remotely'
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-2229</cvename>
 <cvename>CVE-2020-2230</cvename>
 <cvename>CVE-2020-2231</cvename>
 <url>https://www.jenkins.io/security/advisory/2020-08-12/</url>
 </references>
 <dates>
 <discovery>2020-08-12</discovery>
 <entry>2020-08-12</entry>
 </dates>
 </vuln>

<vuln vid="1110e286-dc08-11ea-beed-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>84.0.4147.125</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html">
	 This release contains 15 security fixes, including:
	 <ul>
	 <li>[1107433] High CVE-2020-6542: Use after free in ANGLE.
	 Reported by Piotr Bania of Cisco Talos on 2020-07-20</li>
	 <li>[1104046] High CVE-2020-6543: Use after free in task
	 scheduling. Reported by Looben Yang on 2020-07-10</li>
	 <li>[1108497] High CVE-2020-6544: Use after free in media. Reported
	 by Tim Becker of Theori on 2020-07-22</li>
	 <li>[1095584] High CVE-2020-6545: Use after free in audio. Reported
	 by Anonymous on 2020-06-16</li>
	 <li>[1100280] High CVE-2020-6546: Inappropriate implementation in
	 installer. Reported by Andrew Hess (any1) on 2020-06-29</li>
	 <li>[1102153] High CVE-2020-6547: Incorrect security UI in media.
	 Reported by David Albert on 2020-07-05</li>
	 <li>[1103827] High CVE-2020-6548: Heap buffer overflow in Skia.
	 Reported by Choongwoo Han, Microsoft Browser Vulnerability
	 Research on 2020-07-09</li>
	 <li>[1105426] High CVE-2020-6549: Use after free in media. Reported
	 by Sergei Glazunov of Google Project Zero on 2020-07-14</li>
	 <li>[1106682] High CVE-2020-6550: Use after free in IndexedDB.
	 Reported by Sergei Glazunov of Google Project Zero on
	 2020-07-17</li>
	 <li>[1107815] High CVE-2020-6551: Use after free in WebXR. Reported
	 by Sergei Glazunov of Google Project Zero on 2020-07-21</li>
	 <li>[1108518] High CVE-2020-6552: Use after free in Blink. Reported
	 by Tim Becker of Theori on 2020-07-22</li>
	 <li>[1111307] High CVE-2020-6553: Use after free in offline mode.
	 Reported by Alison Huffman, Microsoft Browser Vulnerability
	 Research on 2020-07-30</li>
	 <li>[1094235] Medium CVE-2020-6554: Use after free in extensions.
	 Reported by Anonymous on 2020-06-12</li>
	 <li>[1105202] Medium CVE-2020-6555: Out of bounds read in WebGL.
	 Reported by Marcin Towalski of Cisco Talos on 2020-07-13</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-6542</cvename>
 <cvename>CVE-2020-6543</cvename>
 <cvename>CVE-2020-6544</cvename>
 <cvename>CVE-2020-6545</cvename>
 <cvename>CVE-2020-6546</cvename>
 <cvename>CVE-2020-6547</cvename>
 <cvename>CVE-2020-6548</cvename>
 <cvename>CVE-2020-6549</cvename>
 <cvename>CVE-2020-6550</cvename>
 <cvename>CVE-2020-6551</cvename>
 <cvename>CVE-2020-6552</cvename>
 <cvename>CVE-2020-6553</cvename>
 <cvename>CVE-2020-6554</cvename>
 <cvename>CVE-2020-6555</cvename>
 <url>https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2020-08-10</discovery>
 <entry>2020-08-11</entry>
 </dates>
 </vuln>

<vuln vid="10e3ed8a-db7f-11ea-8bdf-643150d3111d">
 <topic>puppetdb -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>puppetdb5</name>
	<range><lt>5.2.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Puppetlabs reports:
	<blockquote cite="https://puppet.com/security/cve/jackson-july-2020-security-fixes/">
	 In June 2020, jackson-databind published security updates addressing several CVEs. Previous releases of PuppetDB contain a vulnerable version of jackson.core:jackson-databind. PuppetDB 5.2.18 contains an updated version of jackson-databind that has patched the vulnerabilities.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://puppet.com/security/cve/jackson-july-2020-security-fixes/</url>
 <cvename>CVE-2020-9548</cvename>
 <cvename>CVE-2020-14062</cvename>
 <cvename>CVE-2020-14060</cvename>
 <cvename>CVE-2020-14061</cvename>
 <cvename>CVE-2020-14195</cvename>
 </references>
 <dates>
 <discovery>2020-07-23</discovery>
 <entry>2020-08-11</entry>
 </dates>
 </vuln>

<vuln vid="6b6de127-db0b-11ea-ba1e-1c39475b9f84">
 <topic>bftpd -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bftpd</name>
	<range><lt>5.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bftpd project reports:
	<blockquote cite="http://bftpd.sourceforge.net/news.html">
	 Bftpd is vulnerable to out of bounds memory access, file descriptor leak and a potential buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://bftpd.sourceforge.net/news.html</url>
 </references>
 <dates>
 <discovery>2020-04-16</discovery>
 <entry>2020-08-10</entry>
 </dates>
 </vuln>

<vuln vid="6fd773d3-bc5a-11ea-b38d-f0def1d0c3ea">
 <topic>trafficserver -- resource consumption</topic>
 <affects>
 <package>
	<name>trafficserver</name>
	<range><lt>8.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bryan Call reports:
	<blockquote cite="https://lists.apache.org/thread.html/rf7f86917f42fdaf904d99560cba0c016e03baea6244c47efeb60ecbe%40%3Cdev.trafficserver.apache.org%3E">
	 ATS is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9494</url>
 <cvename>CVE-2020-9494</cvename>
 </references>
 <dates>
 <discovery>2020-06-24</discovery>
 <entry>2020-07-02</entry>
 </dates>
 </vuln>

<vuln vid="76700d2f-d959-11ea-b53c-d4c9ef517024">
 <topic>Apache httpd -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.46</lt></range>
 </package>
 <package>
	<name>mod_http2</name>
	<range><lt>1.15.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd projec reports:
	<blockquote cite="https://downloads.apache.org/httpd/CHANGES_2.4.46">
	 <ul>
	 <li>mod_http2: Important: Push Diary Crash on Specifically
	 Crafted HTTP/2 Header (CVE-2020-9490) 
	 A specially crafted value for the 'Cache-Digest' header in a HTTP/2
	 request would result in a crash when the server actually tries to
	 HTTP/2 PUSH a resource afterwards.</li>
	 <li>mod_proxy_uwsgi: Moderate: mod_proxy_uwsgi buffer overflow
	 (CVE-2020-11984) 
	 info disclosure and possible RCE</li>
	 <li>mod_http2: Moderate: Push Diary Crash on Specifically Crafted
	 HTTP/2 Header (CVE-2020-11993) 
	 When trace/debug was enabled for the HTTP/2 module and on certain
	 traffic edge patterns, logging statements were made on the wrong
	 connection, causing concurrent use of memory pools.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.apache.org/httpd/CHANGES_2.4.46</url>
 <url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
 <cvename>CVE-2020-9490</cvename>
 <cvename>CVE-2020-11984</cvename>
 <cvename>CVE-2020-11993</cvename>
 </references>
 <dates>
 <discovery>2020-08-07</discovery>
 <entry>2020-08-08</entry>
 <modified>2020-08-08</modified>
 </dates>
 </vuln>

<vuln vid="bc7aff8c-d806-11ea-a5aa-0800272260e5">
 <topic>go -- encoding/binary: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.14.7,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/40618">
	 Certain invalid inputs to ReadUvarint or ReadVarint could cause
	 those functions to read an unlimited number of bytes from the
	 ByteReader argument before returning an error. This could lead to
	 processing more input than expected when the caller is reading
	 directly from the network and depends on ReadUvarint and ReadVarint
	 only consuming a small, bounded number of bytes, even from invalid
	 inputs.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-16845</cvename>
 <url>https://github.com/golang/go/issues/40618</url>
 </references>
 <dates>
 <discovery>2020-08-06</discovery>
 <entry>2020-08-06</entry>
 </dates>
 </vuln>

<vuln vid="a003b74f-d7b3-11ea-9df1-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><lt>13.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/">
	 Arbitrary File Read when Moving an Issue
	 Memory Exhaustion via Excessive Logging of Invite Email Error
	 Denial of Service Through Project Import Feature
	 User Controlled Git Configuration Settings Resulting in SSRF
	 Stored XSS in Issue Reference Number Tooltip
	 Stored XSS in Issues List via Milestone Title
	 Improper Access Control After Group Transfer
	 Bypass Email Verification Required for OAuth Flow
	 Confusion When Using Hexadecimal Branch Names
	 Insufficient OAuth Revocation
	 Improper Access Control for Project Sharing
	 Stored XSS in Jobs Page
	 Improper Access Control of Applications Page
	 SSRF into Shared Runner
	 Update Kramdown Gem
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/</url>
 <cvename>CVE-2020-10977</cvename>
 <cvename>CVE-2020-13280</cvename>
 <cvename>CVE-2020-13281</cvename>
 <cvename>CVE-2020-14001</cvename>
 </references>
 <dates>
 <discovery>2020-08-05</discovery>
 <entry>2020-08-06</entry>
 <modified>2020-08-25</modified>
 </dates>
 </vuln>

<vuln vid="8db74c04-d794-11ea-88f8-901b0ef719ab">
 <topic>FreeBSD -- sendmsg(2) privilege escalation</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_8</lt></range>
	<range><ge>11.4</ge><lt>11.4_2</lt></range>
	<range><ge>11.3</ge><lt>11.3_12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When handling a 32-bit sendmsg(2) call, the compat32 subsystem copies the
	control message to be transmitted (if any) into kernel memory, and adjusts
	alignment of control message headers. The code which performs this work
	contained a time-of-check to time-of-use (TOCTOU) vulnerability which allows a
	malicious userspace program to modify control message headers after they were
	validated by the kernel.
	<h1>Impact:</h1>
	The TOCTOU bug can be exploited by an unprivileged malicious userspace program
	to trigger privilege escalation.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7460</cvename>
 <freebsdsa>SA-20:23.sendmsg</freebsdsa>
 </references>
 <dates>
 <discovery>2020-08-05</discovery>
 <entry>2020-08-06</entry>
 </dates>
 </vuln>

<vuln vid="9eb01384-d793-11ea-88f8-901b0ef719ab">
 <topic>FreeBSD -- Potential memory corruption in USB network device drivers</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_8</lt></range>
	<range><ge>11.4</ge><lt>11.4_2</lt></range>
	<range><ge>11.3</ge><lt>11.3_12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A missing length validation code common to these three drivers means that a
	malicious USB device could write beyond the end of an allocated network
	packet buffer.
	<h1>Impact:</h1>
	An attacker with physical access to a USB port and the ability to bring a
	network interface up may be able to use a specially crafted USB device to
	gain kernel or user-space code execution.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7459</cvename>
 <freebsdsa>SA-20:21.usb_net</freebsdsa>
 </references>
 <dates>
 <discovery>2020-08-05</discovery>
 <entry>2020-08-06</entry>
 </dates>
 </vuln>

<vuln vid="eab964f8-d632-11ea-9172-4c72b94353b5">
 <topic>typo3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>typo3-9-php72</name>
	<name>typo3-9-php73</name>
	<name>typo3-9-php74</name>
	<range><lt>9.5.20</lt></range>
 </package>
 <package>
	<name>typo3-10-php72</name>
	<name>typo3-10-php73</name>
	<name>typo3-10-php74</name>
	<range><lt>10.4.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Typo3 Team reports:
	<blockquote cite="https://typo3.org/article/typo3-1046-and-9520-security-releases-published">
	 In case an attacker manages to generate a valid cryptographic message authentication
	 code (HMAC-SHA1) - either by using a different existing vulnerability or in case the
	 internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a
	 TYPO3 installation. This includes the possibility to fetch typo3conf/LocalConfiguration.php
	 which again contains the encryptionKey as well as credentials of the database management
	 system being used.
	 In case a database server is directly accessible either via internet or in a shared hosting
	 network, this allows to completely retrieve, manipulate or delete database contents.
	 This includes creating an administration user account - which can be used to trigger remote
	 code execution by injecting custom extensions.
	 It has been discovered that an internal verification mechanism can be used to generate
	 arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic
	 message authentication code (HMAC-SHA1) and can lead to various attack chains as described
	 below.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://typo3.org/article/typo3-1046-and-9520-security-releases-published</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2020-007</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2020-008</url>
 <cvename>CVE-2020-15098</cvename>
 <cvename>CVE-2020-15099</cvename>
 </references>
 <dates>
 <discovery>2020-07-28</discovery>
 <entry>2020-08-04</entry>
 </dates>
 </vuln>

<vuln vid="3c7ba82a-d3fb-11ea-9aba-0c9d925bbbc0">
 <topic>xorg-server -- Pixel Data Uninitialized Memory Information Disclosure</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<range><lt>1.20.8_3,1</lt></range>
 </package>
 <package>
	<name>xephyr</name>
	<range><lt>1.20.8_3,1</lt></range>
 </package>
 <package>
	<name>xorg-vfbserver</name>
	<range><lt>1.20.8_3,1</lt></range>
 </package>
 <package>
	<name>xorg-nestserver</name>
	<range><lt>1.20.8_3,1</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>1.20.8_3,1</lt></range>
 </package>
 <package>
	<name>xorg-dmx</name>
	<range><lt>1.20.8_3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The X.org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2020-July/003051.html">
	 Allocation for pixmap data in AllocatePixmap() does not initialize
	 the memory in xserver, it leads to leak uninitialize heap memory to
	 clients. When the X server runs with elevated privileges.
	 This flaw can lead to ASLR bypass, which when combined with other
	 flaws (known/unknown) could lead to lead to privilege elevation in
	 the client.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.x.org/archives/xorg-announce/2020-July/003051.html</url>
 <cvename>CVE-2020-14347</cvename>
 </references>
 <dates>
 <discovery>2020-07-31</discovery>
 <entry>2020-08-01</entry>
 </dates>
 </vuln>

<vuln vid="6faa7feb-d3fa-11ea-9aba-0c9d925bbbc0">
 <topic>libX11 -- Heap corruption in the X input method client in libX11</topic>
 <affects>
 <package>
	<name>libX11</name>
	<range><lt>1.6.9_3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The X.org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2020-July/003050.html">
	 The X Input Method (XIM) client implementation in libX11 has some
	 integer overflows and signed/unsigned comparison issues that can
	 lead to heap corruption when handling malformed messages from an
	 input method.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.x.org/archives/xorg-announce/2020-July/003050.html</url>
 <cvename>CVE-2020-14344</cvename>
 </references>
 <dates>
 <discovery>2020-07-31</discovery>
 <entry>2020-08-01</entry>
 </dates>
 </vuln>

<vuln vid="7d7221ee-d334-11ea-bc50-080027846a02">
 <topic>Python -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python38</name>
	<range><lt>3.8.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python reports:
	<blockquote cite="https://docs.python.org/3/whatsnew/changelog.html#python-3-8-5-final">
	 bpo-41304: Fixes python3x._pth being ignored on Windows, caused by the fix for
	 bpo-29778 (CVE-2020-15801).
	 bpo-39603: Prevent http header injection by rejecting control characters in
	 http.client.putreques().
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.python.org/3/whatsnew/changelog.html#python-3-8-5-final</url>
 <cvename>CVE-2020-15801</cvename>
 </references>
 <dates>
 <discovery>2020-02-11</discovery>
 <entry>2020-07-31</entry>
 </dates>
 </vuln>

<vuln vid="d1ef1138-d273-11ea-a757-e0d55e2a8bf9">
 <topic>ark -- directory traversal</topic>
 <affects>
 <package>
	<name>ark</name>
	 <range><lt>20.04.2_1</lt></range>
	 <range><eq>20.04.3</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	KDE Project Security Advisory reports:
	<blockquote cite="https://kde.org/info/security/advisory-20200730-1.txt">
	 <h3>KDE Project Security Advisory</h3>
	 <table>
	 <tr>
	 <td>Title:</td>
	 <td>Ark: maliciously crafted archive can install files outside the extraction directory.</td>
	 </tr>
	 <tr>
	 <td>Risk Rating:</td>
	 <td>Important</td>
	 </tr>
	 <tr>
	 <td>CVE:</td>
	 <td>CVE-2020-16116</td>
	 </tr>
	 <tr>
	 <td>Versions:</td>
	 <td>ark &lt;= 20.04.3</td>
	 </tr>
	 <tr>
	 <td>Author:</td>
	 <td>Elvis Angelaccio &lt;elvis.angelaccio@kde.org&gt;</td>
	 </tr>
	 <tr>
	 <td>Date:</td>
	 <td>30 July 2020</td>
	 </tr>
	 </table>
	 <h3>Overview</h3>
	 A maliciously crafted archive with "../" in the file paths
		would install files anywhere in the user's home directory upon extraction.

<h3>Proof of concept</h3>
	 For testing, an example of malicious archive can be found at
	 https://github.com/jwilk/traversal-archives/releases/download/0/relative2.zip

<h3>Impact</h3>
	 Users can unwillingly install files like a modified .bashrc, or a malicious
	 script placed in ~/.config/autostart

<h3>Workaround</h3>
	 Users should not use the 'Extract' context menu from the Dolphin file manager.
	 Before extracting a downloaded archive using the Ark GUI, users should inspect it
	 to make sure it doesn't contain entries with "../" in the file path.

<h3>Solution</h3>
	 Ark 20.08.0 prevents loading of malicious archives and shows a warning message
	 to the users.

Alternatively,
	 https://invent.kde.org/utilities/ark/-/commit/0df592524fed305d6fbe74ddf8a196bc9ffdb92f
	 can be applied to previous releases.

<h3>Credits</h3>
	 Thanks to Dominik Penner for finding and reporting this issue and thanks to
	 Elvis Angelaccio and Albert Astals Cid for fixing it.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-16116</cvename>
 <url>https://kde.org/info/security/advisory-20200730-1.txt</url>
 </references>
 <dates>
 <discovery>2020-07-30</discovery>
 <entry>2020-07-30</entry>
 </dates>
 </vuln>

<vuln vid="9a447f78-d0f8-11ea-9837-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>84.0.4147.105</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html">
	 This update contains 8 security fixes, including:
	 <ul>
	 <li>[1105318] High CVE-2020-6537: Type Confusion in V8. Reported by
	 Alphalaab on 2020-07-14</li>
	 <li>[1096677] High CVE-2020-6538: Inappropriate implementation in
	 WebView. Reported by Yongke Wang(@Rudykewang) and Aryb1n(@aryb1n)
	 of Tencent Security Xuanwu Lab on 2020-06-18</li>
	 <li>[1104061] High CVE-2020-6532: Use after free in SCTP. Reported
	 by Anonymous on 2020-07-09</li>
	 <li>[1105635] High CVE-2020-6539: Use after free in CSS. Reported
	 by Oriol Brufau on 2020-07-14</li>
	 <li>[1105720] High CVE-2020-6540: Heap buffer overflow in Skia.
	 Reported by Zhen Zhou of NSFOCUS Security Team on 2020-07-15</li>
	 <li>[1106773] High CVE-2020-6541: Use after free in WebUSB. Reported
	 by Sergei Glazunov of Google Project Zero on 2020-07-17</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-6532</cvename>
 <cvename>CVE-2020-6537</cvename>
 <cvename>CVE-2020-6538</cvename>
 <cvename>CVE-2020-6539</cvename>
 <cvename>CVE-2020-6540</cvename>
 <cvename>CVE-2020-6541</cvename>
 <url>https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html</url>
 </references>
 <dates>
 <discovery>2020-07-27</discovery>
 <entry>2020-07-28</entry>
 </dates>
 </vuln>

<vuln vid="086c96cd-d0cb-11ea-b922-5404a68ad561">
 <topic>libsndfile -- out-of-bounds read memory access</topic>
 <affects>
 <package>
	<name>libsndfile</name>
	<range><lt>1.0.29.p.20200620</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RedHat reports:
	 <blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3832">
	 It was discovered the fix for CVE-2018-19758 was not complete and
	 still allows a read beyond the limits of a buffer in
	 wav_write_header() function in wav.c. A local attacker may use
	 this flaw to make the application crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3832</url>
 </references>
 <dates>
 <discovery>2019-02-14</discovery>
 <entry>2020-07-28</entry>
 </dates>
 </vuln>

<vuln vid="a955cdb7-d089-11ea-8c6f-080027eedc6a">
 <topic>FreeRDP -- Integer overflow in RDPEGFX channel</topic>
 <affects>
 <package>
	<name>freerdp</name>
	<range><lt>2.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bernhard Miklautz reports:
	<blockquote cite="https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4r38-6hq7-j3j9">
 <ul>
	 <li>
	 Integer overflow due to missing input sanitation in rdpegfx channel
	</li>
	<li>All FreeRDP clients are affected</li>
	<li>
	 The input rectangles from the server are not checked against local
	 surface coordinates and blindly accepted. A malicious server can send
	 data that will crash the client later on (invalid length arguments to
	 a memcpy)
	</li>
 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://www.freerdp.com/2020/07/20/2_2_0-released</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15103</url>
 <cvename>CVE-2020-15103</cvename>
 </references>
 <dates>
 <discovery>2020-06-25</discovery>
 <entry>2020-07-28</entry>
 </dates>
 </vuln>

<vuln vid="e333084c-9588-4eee-8bdc-323e02cb4fe0">
 <topic>zeek -- Various vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>3.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jon Siwek of Corelight reports:
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v3.0.8">
	 This release fixes the following security issues:
	 <ul>
	 <li>Fix potential DNS analyzer stack overflow</li>
	 <li>Fix potential NetbiosSSN analyzer stack overflow</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/releases/tag/v3.0.8</url>
 </references>
 <dates>
 <discovery>2020-07-28</discovery>
 <entry>2020-07-28</entry>
 </dates>
 </vuln>

<vuln vid="cd2dc126-cfe4-11ea-9172-4c72b94353b5">
 <topic>Cacti -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>1.2.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cacti developers reports:
	<blockquote cite="https://www.cacti.net/release_notes.php?version=1.2.13">
	 Multiple fixes for bundled jQuery to prevent
	 code exec (CVE-2020-11022, CVE-2020-11023).
	 PHPMail contains a escaping bug
	 (CVE-2020-13625).
	 SQL Injection via color.php in Cacti
	 (CVE-2020-14295).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.cacti.net/release_notes.php?version=1.2.13</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13625</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14295</url>
 <cvename>CVE-2020-11022</cvename>
 <cvename>CVE-2020-11023</cvename>
 <cvename>CVE-2020-13625</cvename>
 <cvename>CVE-2020-14295</cvename>
 </references>
 <dates>
 <discovery>2020-07-15</discovery>
 <entry>2020-07-27</entry>
 </dates>
 </vuln>

<vuln vid="e1d3a580-cd8b-11ea-bad0-08002728f74c">
 <topic>Wagtail -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>py36-wagtail</name>
	<name>py37-wagtail</name>
	<name>py38-wagtail</name>
	<range><ge>2.8.0</ge><lt>2.9.3</lt></range>
	<range><lt>2.7.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitHub Advisory Database:
	<blockquote cite="https://github.com/advisories/GHSA-2473-9hgq-j7xw">
	 When a form page type is made available to Wagtail editors through the
	 wagtail.contrib.forms app, and the page template is built using
	 Django's standard form rendering helpers such as form.as_p (as directed
	 in the documentation), any HTML tags used within a form field's help
	 text will be rendered unescaped in the page. Allowing HTML within help
	 text is an intentional design decision by Django; however, as a matter
	 of policy Wagtail does not allow editors to insert arbitrary HTML by
	 default, as this could potentially be used to carry out cross-site
	 scripting attacks, including privilege escalation. This functionality
	 should therefore not have been made available to editor-level users.
	 The vulnerability is not exploitable by an ordinary site visitor
	 without access to the Wagtail admin.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/advisories/GHSA-2473-9hgq-j7xw</url>
 <cvename>CVE-2020-15118</cvename>
 </references>
 <dates>
 <discovery>2020-07-20</discovery>
 <entry>2020-07-24</entry>
 </dates>
 </vuln>

<vuln vid="456375e1-cd09-11ea-9172-4c72b94353b5">
 <topic>pango -- buffer overflow</topic>
 <affects>
 <package>
	<name>pango</name>
	<range><lt>1.42.4_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010238">
	 Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is:
	 The heap based buffer overflow can be used to get code execution. The component is:
	 function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop
	 condition. The attack vector is: Bug can be used when application pass invalid utf-8
	 strings to functions like pango_itemize.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010238</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-1010238</url>
 <cvename>CVE-2019-1010238</cvename>
 </references>
 <dates>
 <discovery>2019-07-19</discovery>
 <entry>2020-07-23</entry>
 <modified>2020-09-26</modified>
 </dates>
 </vuln>

<vuln vid="6a72eff7-ccd6-11ea-9172-4c72b94353b5">
 <topic>Apache Tomcat -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>tomcat7</name>
	<range><lt>7.0.105</lt></range>
 </package>
 <package>
	<name>tomcat85</name>
	<range><lt>8.5.57</lt></range>
 </package>
 <package>
	<name>tomcat9</name>
	<range><lt>9.0.37</lt></range>
 </package>
 <package>
	<name>tomcat-devel</name>
	<range><lt>10.0.0.M7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation reports:
	 An h2c direct connection did not release the HTTP/1.1 processor after
	 the upgrade to HTTP/2. If a sufficient number of such requests were
	 made, an OutOfMemoryException could occur leading to a denial of service.
	 The payload length in a WebSocket frame was not correctly validated.
	 Invalid payload lengths could trigger an infinite loop. Multiple
	 requests with invalid payload lengths could lead to a denial of service.
	 A specially crafted sequence of HTTP/2 requests could trigger high CPU
	 usage for several seconds. If a sufficient number of such requests were
	 made on concurrent HTTP/2 connections, the server could become unresponsive.
	</body>
 </description>
 <references>
 <url>https://tomcat.apache.org/security-7.html</url>
 <url>https://tomcat.apache.org/security-8.html</url>
 <url>https://tomcat.apache.org/security-9.html</url>
 <url>https://tomcat.apache.org/security-10.html</url>
 <cvename>CVE-2020-11996</cvename>
 <cvename>CVE-2020-13934</cvename>
 <cvename>CVE-2020-13935</cvename>
 </references>
 <dates>
 <discovery>2020-07-05</discovery>
 <entry>2020-07-23</entry>
 <modified>2020-07-23</modified>
 </dates>
 </vuln>

<vuln vid="a9eeb3a3-ca5e-11ea-930b-080027846a02">
 <topic>Python -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python38</name>
	<range><lt>3.8.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python reports:
	<blockquote cite="https://docs.python.org/3/whatsnew/changelog.html#python-3-8-4-final">
	 bpo-41162:Audit hooks are now cleared later during finalization to avoid missing
	 events.
	 bpo-29778:Ensure python3.dll is loaded from correct locations when Python is
	 embedded.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.python.org/3/whatsnew/changelog.html#python-3-8-4-final</url>
 <cvename>CVE-2020-15523</cvename>
 </references>
 <dates>
 <discovery>2020-06-29</discovery>
 <entry>2020-07-20</entry>
 </dates>
 </vuln>

<vuln vid="1e7b316b-c6a8-11ea-a7d5-001999f8d30b">
 <topic>VirtualBox -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>virtualbox-ose</name>
	<range><ge>5.2</ge><lt>5.2.44</lt></range>
	<range><ge>6.0</ge><lt>6.0.24</lt></range>
	<range><ge>6.1</ge><lt>6.1.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujul2020.html">
	 Vulnerabilities in VirtualBox core can allow users
	 with logon access to the infrastructure where Oracle VM
	 VirtualBox executes to compromise Oracle VM VirtualBox.
	 Successful attacks of these vulnerabilities can result
	 in unauthorized access to critical data, access to all
	 Oracle VM VirtualBox accessible data, unauthorized ability
	 to cause a hang or frequently repeatable crash (complete
	 DOS) or takeover of Oracle VM VirtualBox.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/security-alerts/cpujul2020.html</url>
 <cvename>CVE-2020-14628</cvename>
 <cvename>CVE-2020-14629</cvename>
 <cvename>CVE-2020-14646</cvename>
 <cvename>CVE-2020-14647</cvename>
 <cvename>CVE-2020-14648</cvename>
 <cvename>CVE-2020-14649</cvename>
 <cvename>CVE-2020-14650</cvename>
 <cvename>CVE-2020-14673</cvename>
 <cvename>CVE-2020-14674</cvename>
 <cvename>CVE-2020-14675</cvename>
 <cvename>CVE-2020-14676</cvename>
 <cvename>CVE-2020-14677</cvename>
 <cvename>CVE-2020-14694</cvename>
 <cvename>CVE-2020-14695</cvename>
 <cvename>CVE-2020-14698</cvename>
 <cvename>CVE-2020-14699</cvename>
 <cvename>CVE-2020-14700</cvename>
 <cvename>CVE-2020-14703</cvename>
 <cvename>CVE-2020-14704</cvename>
 <cvename>CVE-2020-14707</cvename>
 <cvename>CVE-2020-14711</cvename>
 <cvename>CVE-2020-14712</cvename>
 <cvename>CVE-2020-14713</cvename>
 <cvename>CVE-2020-14714</cvename>
 <cvename>CVE-2020-14715</cvename>
 </references>
 <dates>
 <discovery>2020-07-14</discovery>
 <entry>2020-07-19</entry>
 </dates>
 </vuln>

<vuln vid="f7a02651-c798-11ea-81d6-6805cabe6ebb">
 <topic>clamav -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.102.4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Micah Snyder reports:
	<blockquote cite="https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html">
	 <dl>
	 <dt>CVE-2020-3350</dt>
	 <dd>
	 Fixed a vulnerability a malicious user could exploit to replace
	 a scan target's directory with a symlink to another path to trick
	 clamscan, clamdscan, or clamonacc into removing or moving a different
	 file (such as a critical system file). The issue would affect users
	 that use the --move or --remove options for clamscan, clamdscan and
	 clamonacc.
	 </dd>
	 <dt>CVE-2020-3327</dt>
	 <dd>
	 Fixed a vulnerability in the ARJ archive-parsing module in ClamAV
	 0.102.3 that could cause a denial-of-service (DoS) condition.
	 Improper bounds checking resulted in an out-of-bounds read that could
	 cause a crash. The previous fix for this CVE in version 0.102.3 was
	 incomplete. This fix correctly resolves the issue.
	 </dd>
	 <dt>CVE-2020-3481</dt>
	 <dd>
	 Fixed a vulnerability in the EGG archive module in ClamAV 0.102.0
	 - 0.102.3 that could cause a denial-of-service (DoS) condition.
	 Improper error handling could cause a crash due to a NULL pointer
	 dereference. This vulnerability is mitigated for those using the
	 official ClamAV signature databases because the file type signatures
	 in daily.cvd will not enable the EGG archive parser in affected
	 versions.
	 </dd>
	 </dl>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html</url>
 <cvename>CVE-2020-3350</cvename>
 <cvename>CVE-2020-3327</cvename>
 <cvename>CVE-2020-3481</cvename>
 </references>
 <dates>
 <discovery>2020-07-16</discovery>
 <entry>2020-07-16</entry>
 </dates>
 </vuln>

<vuln vid="714e6c35-c75b-11ea-aa29-d74973d1f9f3">
 <topic>OpenEXR/ilmbase 2.5.2 -- patch release with various bug/security fixes</topic>
 <affects>
 <package>
	<name>ilmbase</name>
	<range><lt>2.5.2</lt></range>
 </package>
 <package>
	<name>openexr</name>
	<range><lt>2.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cary Phillips reports:
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.2">
	 openexr 2.5.2 [is a p]atch release with various bug/security and build/install fixes:
	 <ul>
	 <li>Invalid input could cause a heap-use-after-free error in DeepScanLineInputFile::DeepScanLineInputFile()</li>
	 <li>Invalid chunkCount attributes could cause heap buffer overflow in getChunkOffsetTableSize()</li>
	 <li>Invalid tiled input file could cause invalid memory access TiledInputFile::TiledInputFile()</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.2</url>
 </references>
 <dates>
 <discovery>2020-05-18</discovery>
 <entry>2020-07-16</entry>
 </dates>
 </vuln>

<vuln vid="870d59b0-c6c4-11ea-8015-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>84.0.4147.89</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html">
	 This update contains 38 security fixes, including:
	 <ul>
	 <li>[1103195] Critical CVE-2020-6510: Heap buffer overflow in
	 background fetch. Reported by Leecraso and Guang Gong of 360
	 Alpha Lab working with 360 BugCloud on 2020-07-08</li>
	 <li>[1074317] High CVE-2020-6511: Side-channel information leakage
	 in content security policy. Reported by Mikhail Oblozhikhin on
	 2020-04-24</li>
	 <li>[1084820] High CVE-2020-6512: Type Confusion in V8. Reported by
	 nocma, leogan, cheneyxu of WeChat Open Platform Security Team on
	 2020-05-20</li>
	 <li>[1091404] High CVE-2020-6513: Heap buffer overflow in PDFium.
	 Reported by Aleksandar Nikolic of Cisco Talos on 2020-06-04</li>
	 <li>[1076703] High CVE-2020-6514: Inappropriate implementation in
	 WebRTC. Reported by Natalie Silvanovich of Google Project Zero on
	 2020-04-30</li>
	 <li>[1082755] High CVE-2020-6515: Use after free in tab strip.
	 Reported by DDV_UA on 2020-05-14</li>
	 <li>[1092449] High CVE-2020-6516: Policy bypass in CORS. Reported by
	 Yongke Wang(@Rudykewang) and Aryb1n(@aryb1n) of Tencent Security
	 Xuanwu Lab on 2020-06-08</li>
	 <li>[1095560] High CVE-2020-6517: Heap buffer overflow in history.
	 Reported by ZeKai Wu (@hellowuzekai) of Tencent Security Xuanwu
	 Lab on 2020-06-16</li>
	 <li>[986051] Medium CVE-2020-6518: Use after free in developer
	 tools. Reported by David Erceg on 2019-07-20</li>
	 <li>[1064676] Medium CVE-2020-6519: Policy bypass in CSP. Reported
	 by Gal Weizman (@WeizmanGal) of PerimeterX on 2020-03-25</li>
	 <li>[1092274] Medium CVE-2020-6520: Heap buffer overflow in Skia.
	 Reported by Zhen Zhou of NSFOCUS Security Team on 2020-06-08</li>
	 <li>[1075734] Medium CVE-2020-6521: Side-channel information leakage
	 in autofill. Reported by Xu Lin (University of Illinois at
	 Chicago), Panagiotis Ilia (University of Illinois at Chicago),
	 Jason Polakis (University of Illinois at Chicago) on
	 2020-04-27</li>
	 <li>[1052093] Medium CVE-2020-6522: Inappropriate implementation in
	 external protocol handlers. Reported by Eric Lawrence of Microsoft
	 on 2020-02-13</li>
	 <li>[1080481] Medium CVE-2020-6523: Out of bounds write in Skia.
	 Reported by Liu Wei and Wu Zekai of Tencent Security Xuanwu Lab on
	 2020-05-08</li>
	 <li>[1081722] Medium CVE-2020-6524: Heap buffer overflow in
	 WebAudio. Reported by Sung Ta (@Mipu94) of SEFCOM Lab, Arizona
	 State University on 2020-05-12</li>
	 <li>[1091670] Medium CVE-2020-6525: Heap buffer overflow in Skia.
	 Reported by Zhen Zhou of NSFOCUS Security Team on 2020-06-05</li>
	 <li>[1074340] Low CVE-2020-6526: Inappropriate implementation in
	 iframe sandbox. Reported by Jonathan Kingston on 2020-04-24</li>
	 <li>[992698] Low CVE-2020-6527: Insufficient policy enforcement in
	 CSP. Reported by Zhong Zhaochen of andsecurity.cn on
	 2019-08-10</li>
	 <li>[1063690] Low CVE-2020-6528: Incorrect security UI in basic
	 auth. Reported by Rayyan Bijoora on 2020-03-22</li>
	 <li>[978779] Low CVE-2020-6529: Inappropriate implementation in
	 WebRTC. Reported by kaustubhvats7 on 2019-06-26</li>
	 <li>[1016278] Low CVE-2020-6530: Out of bounds memory access in
	 developer tools. Reported by myvyang on 2019-10-21</li>
	 <li>[1042986] Low CVE-2020-6531: Side-channel information leakage in
	 scroll to text. Reported by Jun Kokatsu, Microsoft Browser
	 Vulnerability Research on 2020-01-17</li>
	 <li>[1069964] Low CVE-2020-6533: Type Confusion in V8. Reported by
	 Avihay Cohen @ SeraphicAlgorithms on 2020-04-11</li>
	 <li>[1072412] Low CVE-2020-6534: Heap buffer overflow in WebRTC.
	 Reported by Anonymous on 2020-04-20</li>
	 <li>[1073409] Low CVE-2020-6535: Insufficient data validation in
	 WebUI. Reported by Jun Kokatsu, Microsoft Browser Vulnerability
	 Research on 2020-04-22</li>
	 <li>[1080934] Low CVE-2020-6536: Incorrect security UI in PWAs.
	 Reported by Zhiyang Zeng of Tencent security platform department
	 on 2020-05-09</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-6510</cvename>
 <cvename>CVE-2020-6511</cvename>
 <cvename>CVE-2020-6512</cvename>
 <cvename>CVE-2020-6513</cvename>
 <cvename>CVE-2020-6514</cvename>
 <cvename>CVE-2020-6515</cvename>
 <cvename>CVE-2020-6516</cvename>
 <cvename>CVE-2020-6517</cvename>
 <cvename>CVE-2020-6518</cvename>
 <cvename>CVE-2020-6519</cvename>
 <cvename>CVE-2020-6520</cvename>
 <cvename>CVE-2020-6521</cvename>
 <cvename>CVE-2020-6522</cvename>
 <cvename>CVE-2020-6523</cvename>
 <cvename>CVE-2020-6524</cvename>
 <cvename>CVE-2020-6525</cvename>
 <cvename>CVE-2020-6526</cvename>
 <cvename>CVE-2020-6527</cvename>
 <cvename>CVE-2020-6528</cvename>
 <cvename>CVE-2020-6529</cvename>
 <cvename>CVE-2020-6530</cvename>
 <cvename>CVE-2020-6531</cvename>
 <cvename>CVE-2020-6533</cvename>
 <cvename>CVE-2020-6534</cvename>
 <cvename>CVE-2020-6535</cvename>
 <cvename>CVE-2020-6536</cvename>
 <url>https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2020-07-14</discovery>
 <entry>2020-07-15</entry>
 </dates>
 </vuln>

<vuln vid="1ddab5cb-14c9-4632-959f-802c412a9593">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.245</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.235.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://www.jenkins.io/security/advisory/2020-07-15/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-1868 / CVE-2020-2220</h5>
	 Stored XSS vulnerability in job build time trend
	 <h5>(High) SECURITY-1901 / CVE-2020-2221</h5>
	 Stored XSS vulnerability in upstream cause
	 <h5>(High) SECURITY-1902 / CVE-2020-2222</h5>
	 Stored XSS vulnerability in 'keep forever' badge icons
	 <h5>(High) SECURITY-1945 / CVE-2020-2223</h5>
	 Stored XSS vulnerability in console links
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-2220</cvename>
 <cvename>CVE-2020-2221</cvename>
 <cvename>CVE-2020-2222</cvename>
 <cvename>CVE-2020-2223</cvename>
 <url>https://www.jenkins.io/security/advisory/2020-07-15/</url>
 </references>
 <dates>
 <discovery>2020-07-15</discovery>
 <entry>2020-07-15</entry>
 </dates>
 </vuln>

<vuln vid="0ed71663-c369-11ea-b53c-d4c9ef517024">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql56-client</name>
	<range><lt>5.6.49</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.49</lt></range>
 </package>
 <package>
	<name>mysql57-client</name>
	<range><lt>5.7.31</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.31</lt></range>
 </package>
 <package>
	<name>mysql80-client</name>
	<range><lt>8.0.21</lt></range>
 </package>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujul2020.html">
	 This Critical Patch Update contains 40 new security patches for
	 Oracle MySQL. 6 of these vulnerabilities may be remotely exploitable
	 without authentication, i.e., may be exploited over a network without
	 requiring user credentials.
	 The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle
	 MySQL is 9.8.
	 This Pre-Release Announcement provides advance information about the
	 Oracle Critical Patch Update for July 2020, which will be released on
	 Tuesday, July 14, 2020.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/security-alerts/cpujul2020.html</url>
 </references>
 <dates>
 <discovery>2020-07-07</discovery>
 <entry>2020-07-11</entry>
 </dates>
 </vuln>

<vuln vid="c11ee146-c266-11ea-8659-901b0ef719ab">
 <topic>FreeBSD -- IPv6 socket option race condition and use after free</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_7</lt></range>
	<range><ge>11.4</ge><lt>11.4_1</lt></range>
	<range><ge>11.3</ge><lt>11.3_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The IPV6_2292PKTOPTIONS set handler was missing synchronization,
	so racing accesses could modify freed memory.
	<h1>Impact:</h1>
	A malicious user application could trigger memory corruption, leading
	to privilege escalation.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7457</cvename>
 <freebsdsa>SA-20:20.ipv6</freebsdsa>
 </references>
 <dates>
 <discovery>2020-07-09</discovery>
 <entry>2020-07-10</entry>
 </dates>
 </vuln>

<vuln vid="f8b46415-c264-11ea-8659-901b0ef719ab">
 <topic>FreeBSD -- posix_spawnp(3) buffer overflow</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.4</ge><lt>11.4_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	posix_spawnp spawns a new thread with a limited stack allocated on the heap
	before delegating to execvp for the final execution within that thread.
	execvp would previously make unbounded allocations on the stack, directly
	proportional to the length of the user-controlled PATH environment variable.
	<h1>Impact:</h1>
	Long values in the user-controlled PATH environment variable cause
	posix_spawnp to write beyond the end of stack that was allocated, ultimately
	overflowing the heap-allocated stack with a direct copy of the value stored
	in PATH.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7458</cvename>
 <freebsdsa>SA-20:18.posix_spawnp</freebsdsa>
 </references>
 <dates>
 <discovery>2020-07-09</discovery>
 <entry>2020-07-10</entry>
 </dates>
 </vuln>

<vuln vid="198a120d-c22d-11ea-9172-4c72b94353b5">
 <topic>mybb -- multible vulnerabilities</topic>
 <affects>
 <package>
	<name>mybb</name>
	<range><lt>1.8.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mybb Team reports:
	<blockquote cite="https://blog.mybb.com/2019/12/30/mybb-1-8-22-released-security-maintenance-release/">
	 High risk: Installer RCE on settings file write
	 Medium risk: Arbitrary upload paths and Local File Inclusion RCE
	 Medium risk: XSS via insufficient HTML sanitization of Blog feed and Extend data
	 Low risk: Open redirect on login
	 Low risk: SCEditor reflected XSS
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.mybb.com/2019/12/30/mybb-1-8-22-released-security-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2019-12-30</discovery>
 <entry>2020-07-09</entry>
 </dates>
 </vuln>

<vuln vid="20b46222-c12b-11ea-abe8-08002728f74c">
 <topic>kramdown -- template option vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-kramdown</name>
	<range><lt>2.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	kramdown news:
	<blockquote cite="https://kramdown.gettalong.org/news.html">
	 CVE-2020-14001 is addressed to avoid problems when using the
	 {::options /} extension together with the 'template' option.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://kramdown.gettalong.org/news.html</url>
 <cvename>CVE-2020-14001</cvename>
 </references>
 <dates>
 <discovery>2020-06-28</discovery>
 <entry>2020-07-08</entry>
 </dates>
 </vuln>

<vuln vid="c685edd9-c045-11ea-8898-001cc0382b2f">
 <topic>Mbed TLS -- Side-channel attack on ECC key import and validation</topic>
 <affects>
 <package>
	<name>mbedtls</name>
	<range><lt>2.16.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Manuel Pégourié-Gonnard reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-07">
	 The scalar multiplication function in Mbed TLS accepts a random
	 number generator (RNG) as an optional argument and, if provided,
	 uses it to protect against some attacks.
	 It is the caller's responsibility to provide a RNG if protection
	 against side-channel attacks is desired; however two groups of
	 functions in Mbed TLS itself fail to pass a RNG:
	 <ol>
	 <li>mbedtls_pk_parse_key() and mbedtls_pk_parse_keyfile()</li>
	 <li>mbedtls_ecp_check_pub_priv() and mbedtls_pk_check_pair()</li>
	 </ol>
	 When those functions are called, scalar multiplication is computed
	 without randomisation, a number of old and new attacks apply,
	 allowing a powerful local attacker to fully recover the private
	 key.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-07</url>
 </references>
 <dates>
 <discovery>2020-07-01</discovery>
 <entry>2020-07-07</entry>
 </dates>
 </vuln>

<vuln vid="f7a97d43-c039-11ea-a051-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.1.0</ge><lt>13.1.3</lt></range>
	<range><ge>13.0.0</ge><lt>13.0.9</lt></range>
	<range><ge>0</ge><lt>12.10.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/07/06/critical-security-release-gitlab-13-1-3-released/">
	 Workhorse bypass allows files in /tmp to be read via Maven Repository APIs
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/07/06/critical-security-release-gitlab-13-1-3-released/</url>
 <cvename>CVE-2020-15525</cvename>
 </references>
 <dates>
 <discovery>2020-07-06</discovery>
 <entry>2020-07-07</entry>
 </dates>
 </vuln>

<vuln vid="33c05d57-bf6e-11ea-ba1e-0800273f78d3">
 <topic>Python -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python37</name>
	<range><lt>3.7.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python reports:
	<blockquote cite="https://docs.python.org/3.7/whatsnew/changelog.html#changelog">
	 The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient
	 regular expression which can be exploited by an attacker to cause a denial of service.
	 Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben
	 Caller and Matt Schwager.
	 Disallow control characters in hostnames in http.client, addressing CVE-2019-18348.
	 Such potentially malicious header injection URLs now cause a InvalidURL to be raised.
	 Disallow CR or LF in email.headerregistry.Address arguments to guard against header
	 injection attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.python.org/3.7/whatsnew/changelog.html#changelog</url>
 <cvename>CVE-2019-18348</cvename>
 <cvename>CVE-2020-8492</cvename>
 </references>
 <dates>
 <discovery>2019-10-24</discovery>
 <entry>2020-07-06</entry>
 </dates>
 </vuln>

<vuln vid="ae599263-bca2-11ea-b78f-b42e99a1b9c3">
 <topic>samba -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>samba410</name>
	<range><lt>4.10.17</lt></range>
 </package>
 <package>
	<name>samba411</name>
	<range><lt>4.11.11</lt></range>
 </package>
 <package>
	<name>samba412</name>
	<range><lt>4.12.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="https://www.samba.org/samba/history/security.html">
	 Four vulnerabilities were fixed in samba:
	 <ul>
	 <li>CVE-2020-10730: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results</li>
	 <li>CVE-2020-10745: Parsing and packing of NBT and DNS packets can consume excessive CPU in the AD DC (only)</li>
	 <li>CVE-2020-10760: LDAP Use-after-free in Samba AD DC Global Catalog with paged_results and VLV</li>
	 <li>CVE-2020-14303: Empty UDP packet DoS in Samba AD DC nbtd</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/security/CVE-2020-10730.html</url>
 <url>https://www.samba.org/samba/security/CVE-2020-10745.html</url>
 <url>https://www.samba.org/samba/security/CVE-2020-10760.html</url>
 <url>https://www.samba.org/samba/security/CVE-2020-14303.html</url>
 <cvename>CVE-2020-10730</cvename>
 <cvename>CVE-2020-10745</cvename>
 <cvename>CVE-2020-10760</cvename>
 <cvename>CVE-2020-14303</cvename>
 </references>
 <dates>
 <discovery>2020-07-02</discovery>
 <entry>2020-07-02</entry>
 </dates>
 </vuln>

<vuln vid="4344861a-be0b-11ea-9172-4c72b94353b5">
 <topic>Anydesk -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>anydesk</name>
	<range><lt>5.5.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Anydesk reports:
	<blockquote cite="https://download.anydesk.com/changelog.txt">
	 AnyDesk before 5.5.3 on Linux and FreeBSD has a format string
	 vulnerability that can be exploited for remote code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13160</url>
 <cvename>CVE-2020-13160</cvename>
 </references>
 <dates>
 <discovery>2020-06-10</discovery>
 <entry>2020-07-04</entry>
 </dates>
 </vuln>

<vuln vid="d9f686f3-fde0-48dc-ab0a-01c2fe3e0529">
 <topic>py-matrix-synapse -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py36-matrix-synapse</name>
	<name>py37-matrix-synapse</name>
	<name>py38-matrix-synapse</name>
	<range><lt>1.15.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://github.com/matrix-org/synapse/releases/tag/v1.15.2">
	 Due to the two security issues highlighted below, server administrators are encouraged to update Synapse. We are not aware of these vulnerabilities being exploited in the wild.
	 <ul>
	 <li>A malicious homeserver could force Synapse to reset the state in a room to a small subset of the correct state. This affects all Synapse deployments which federate with untrusted servers.</li>
	 <li>HTML pages served via Synapse were vulnerable to clickjacking attacks. This predominantly affects homeservers with single-sign-on enabled, but all server administrators are encouraged to upgrade.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/matrix-org/synapse/releases/tag/v1.15.2</url>
 </references>
 <dates>
 <discovery>2020-07-02</discovery>
 <entry>2020-07-03</entry>
 </dates>
 </vuln>

<vuln vid="27616957-b084-11ea-937b-b42e99a1b9c3">
 <topic>dbus file descriptor leak</topic>
 <affects>
	<package>
 <name>dbus</name>
 <range><lt>1.12.18</lt></range>
	</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
 GitHub Security Lab reports:
 <blockquote cite="https://gitlab.freedesktop.org/dbus/dbus/-/issues/294">
	D-Bus has a file descriptor leak, which can lead to denial of service when the dbus-daemon runs out of file descriptors.
	An unprivileged local attacker can use this to attack the system dbus-daemon, leading to denial of service for all users of the machine.
 </blockquote>
	</body>
 </description>
 <references>
	<url>https://gitlab.freedesktop.org/dbus/dbus/-/issues/294</url>
	<url>https://www.openwall.com/lists/oss-security/2020/06/04/3</url>
	<cvename>CVE-2020-12049</cvename>
 </references>
 <dates>
	<discovery>2020-04-09</discovery>
	<entry>2020-07-03</entry>
 </dates>
 </vuln>

<vuln vid="0a305431-bc98-11ea-a051-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.1.0</ge><lt>13.1.2</lt></range>
	<range><ge>13.0.0</ge><lt>13.0.8</lt></range>
	<range><ge>0</ge><lt>12.10.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/">
	 Missing Permission Check on Time Tracking
	 Cross-Site Scripting in PyPi Files API
	 Insecure Authorization Check on Private Project Security Dashboard
	 Cross-Site Scripting in References
	 Cross-Site Scripting in Group Names
	 Cross-Site Scripting in Blob Viewer
	 Cross-Site Scripting in Error Tracking
	 Insecure Authorisation Check on Creation and Deletion of Deploy Tokens
	 User Name Format Restiction Bypass
	 Denial of Service in Issue Comments
	 Cross-Site Scripting in Wiki Pages
	 Private Merge Request Updates Leaked via Todos
	 Private User Activity Leaked via API
	 Cross-Site Scripting in Bitbucket Import Feature
	 Github Project Restriction Bypass
	 Update PCRE Dependency
	 Update Kaminari Gem
	 Cross-Site Scripting in User Profile
	 Update Xterm.js
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/</url>
 <cvename>CVE-2020-14155</cvename>
 <cvename>CVE-2020-11082</cvename>
 <cvename>CVE-2019-0542</cvename>
 </references>
 <dates>
 <discovery>2020-07-01</discovery>
 <entry>2020-07-02</entry>
 </dates>
 </vuln>

<vuln vid="fce7a6e7-bc5d-11ea-b38d-f0def1d0c3ea">
 <topic>coturn -- information leakage</topic>
 <affects>
 <package>
	<name>coturn</name>
	<range><lt>4.5.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Felix Dörre reports:
	<blockquote cite="https://github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm">
	 The issue is that STUN/TURN response buffer is not initialized properly. (CWE 665)
	 This is a leak of information between different client connections. One client (an attacker)
	 could use their connection to intelligently query coturn to get interesting bytes in the
	 padding bytes from the connection of another client.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/coturn/coturn/commit/fdf7065d0f8e676feaf6734e86370f6dadfb8eec</url>
 <cvename>CVE-2020-4067</cvename>
 </references>
 <dates>
 <discovery>2020-06-30</discovery>
 <entry>2020-07-02</entry>
 </dates>
 </vuln>

<vuln vid="641cd669-bc37-11ea-babf-6805ca2fa271">
 <topic>powerdns-recursor -- access restriction bypass</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><ge>4.3.0</ge><lt>4.3.2</lt></range>
	<range><ge>4.2.0</ge><lt>4.2.3</lt></range>
	<range><ge>4.1.0</ge><lt>4.1.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.3.html#change-4.3.2">
	 CVE-2020-14196: An issue has been found in PowerDNS Recursor where the ACL applied to the internal
	 web server via webserver-allow-from is not properly enforced, allowing a remote attacker to send
	 HTTP queries to the internal web server, bypassing the restriction.

In the default configuration the API webserver is not enabled. Only installations using a
	 non-default value for webserver and webserver-address are affected.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://doc.powerdns.com/recursor/security-advisories/index.html</url>
 <cvename>CVE-2020-14196</cvename>
 </references>
 <dates>
 <discovery>2020-07-01</discovery>
 <entry>2020-07-02</entry>
 </dates>
 </vuln>

<vuln vid="b51d5391-bb76-11ea-9172-4c72b94353b5">
 <topic>drupal -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.72</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/project/drupal/releases/7.72">
	 The Drupal core Form API does not properly handle certain form input
	 from cross-site requests, which can lead to other vulnerabilities.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/sa-core-2020-004</url>
 </references>
 <dates>
 <discovery>2020-06-17</discovery>
 <entry>2020-07-01</entry>
 </dates>
 </vuln>

<vuln vid="2675f0db-baa5-11ea-aa12-80ee73419af3">
 <topic>xrdp -- Local users can perform a buffer overflow attack against the xrdp-sesman service and then inpersonate it</topic>
 <affects>
 <package>
	<name>xrdp</name>
	<range><lt>0.9.13.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ashley Newson reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044">
	 The xrdp-sesman service can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j9fv-6fwf-p3g4</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044</url>
 <cvename>CVE-2020-4044</cvename>
 </references>
 <dates>
 <discovery>2020-06-02</discovery>
 <entry>2020-06-30</entry>
 </dates>
 </vuln>

<vuln vid="d0be8e1f-b19a-11ea-94aa-b827eb2f57d4">
 <topic>MongoDB -- Ensure RoleGraph can serialize authentication restrictions to BSON</topic>
 <affects>
 <package>
	<name>mongodb36</name>
	<range><lt>3.6.18</lt></range>
 </package>
 <package>
	<name>mongodb40</name>
	<range><lt>4.0.15</lt></range>
 </package>
 <package>
	<name>mongodb42</name>
	<range><lt>4.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-45472">
	 Improper serialization of MongoDB Server's internal authorization state permits a user with valid credentials to bypass IP source address protection mechanisms following administrative action.
	 Credit 
Discovered by Tony Yesudas.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7921</cvename>
 </references>
 <dates>
 <discovery>2020-01-10</discovery>
 <entry>2020-06-29</entry>
 </dates>
 </vuln>

<vuln vid="4200d5f5-b985-11ea-b08a-f8b156b6dcc8">
 <topic>libvorbis -- two vulnerabilities</topic>
 <affects>
 <package>
	<name>libvorbis</name>
	<range><lt>1.3.6_1,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Two vulnerabilities were fixed in the upstream repository:
	<ul>
	 <li>The bark_noise_hybridmp function allows remote attackers
	 to cause a denial of service (out-of-bounds access and
	 application crash) or possibly have unspecified other
	 impact via a crafted file.</li>
	 <li>mapping0_forward does not validate the number of
	 channels, which allows remote attackers to cause a denial
	 of service (heap-based buffer overflow or over-read) or
	 possibly have unspecified other impact via a crafted
	 file.</li>
	</ul>
 </body>
 </description>
 <references>
 <url>https://www.openwall.com/lists/oss-security/2017/09/21/2</url>
 <cvename>CVE-2017-14160</cvename>
 <url>https://gitlab.xiph.org/xiph/vorbis/-/issues/2335</url>
 <cvename>CVE-2018-10392</cvename>
 </references>
 <dates>
 <discovery>2017-09-21</discovery>
 <entry>2020-06-28</entry>
 </dates>
 </vuln>

<vuln vid="6190c0cd-b945-11ea-9401-2dcf562daa69">
 <topic>PuTTY -- Release 0.74 fixes two security vulnerabilities</topic>
 <affects>
 <package>
	<name>putty</name>
	<range><lt>0.74</lt></range>
 </package>
 <package>
	<name>putty-gtk2</name>
	<range><lt>0.74</lt></range>
 </package>
 <package>
	<name>putty-nogtk</name>
	<range><lt>0.74</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Tatham reports:
	<blockquote cite="https://lists.tartarus.org/pipermail/putty-announce/2020/000030.html">
	 [Release 0.74] fixes the following security issues:
	 <ul><li>New configuration option to disable PuTTY's default policy of
	 changing its host key algorithm preferences to prefer keys it
	 already knows. (There is a theoretical information leak in this
	 policy.) [CVE-2020-14002]</li>
	 <li>In some situations an SSH server could cause PuTTY to access freed
	 mdmory by pretending to accept an SSH key and then refusing the
	 actual signature. It can only happen if you're using an SSH agent.</li>
	</ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.tartarus.org/pipermail/putty-announce/2020/000030.html</url>
 <url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-dynamic-hostkey-info-leak.html</url>
 <url>https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/</url>
 <cvename>CVE-2020-14002</cvename>
 <url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-keylist-used-after-free.html</url>
 </references>
 <dates>
 <discovery>2020-06-27</discovery>
 <entry>2020-06-28</entry>
 </dates>
 </vuln>

<vuln vid="6a5d15b6-b661-11ea-8015-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>83.0.4103.116</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop_22.html">
	 This update includes 2 security fixes, including:
	 <ul>
	 <li>[1092308] High CVE-2020-6509: Use after free in extensions.
	 Reported by Anonymous on 2020-06-08</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-6509</cvename>
 <url>https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop_22.html</url>
 </references>
 <dates>
 <discovery>2020-06-22</discovery>
 <entry>2020-06-24</entry>
 </dates>
 </vuln>

<vuln vid="29b13a34-b1d2-11ea-a11c-4437e6ad11c4">
 <topic>Machine-in-the-middle response injection attack when using STARTTLS with IMAP, POP3, and SMTP</topic>
 <affects>
 <package>
	<name>mutt</name>
	<range><le>1.14.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mutt 1.14.4 updates:
	<blockquote cite="https://gitlab.com/muttmua/mutt/-/commit/c547433cdf2e79191b15c6932c57f1472bfb5ff4">
	CVE-2020-14954 - Machine-in-the-middle response injection attack when using STARTTLS with IMAP, POP3, and SMTP
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-14954</cvename>
 <url>https://gitlab.com/muttmua/mutt/-/commit/c547433cdf2e79191b15c6932c57f1472bfb5ff4</url>
 </references>
 <dates>
 <discovery>2020-06-16</discovery>
 <entry>2020-06-24</entry>
 </dates>
 </vuln>

<vuln vid="5b397852-b1d0-11ea-a11c-4437e6ad11c4">
 <topic>IMAP fcc/postpone machine-in-the-middle attack</topic>
 <affects>
 <package>
	<name>mutt</name>
	<range><le>1.14.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mutt 1.14.3 updates:
	<blockquote cite="https://github.com/muttmua/mutt/commit/3e88866dc60b5fa6aaba6fd7c1710c12c1c3cd01">
	CVE-2020-14093 - IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/muttmua/mutt/commit/3e88866dc60b5fa6aaba6fd7c1710c12c1c3cd01</url>
 <cvename>CVE-2020-14093</cvename>
 </references>
 <dates>
 <discovery>2020-06-14</discovery>
 <entry>2020-06-24</entry>
 </dates>
 </vuln>

<vuln vid="6bff5ca6-b61a-11ea-aef4-08002728f74c">
 <topic>curl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.20.0</ge><lt>7.71.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	curl security problems:
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	 CVE-2020-8169: Partial password leak over DNS on HTTP redirect
	 libcurl can be tricked to prepend a part of the password to the
	 host name before it resolves it, potentially leaking the partial
	 password over the network and to the DNS server(s).
	 libcurl can be given a username and password for HTTP
	 authentication when requesting an HTTP resource - used for HTTP
	 Authentication such as Basic, Digest, NTLM and similar. The
	 credentials are set, either together with CURLOPT_USERPWD or
	 separately with CURLOPT_USERNAME and CURLOPT_PASSWORD. Important
	 detail: these strings are given to libcurl as plain C strings and
	 they are not supposed to be URL encoded.
	 In addition, libcurl also allows the credentials to be set in the
	 URL, using the standard RFC 3986 format:
	 http://user:password@host/path. In this case, the name and password
	 are URL encoded as that's how they appear in URLs.
	 If the options are set, they override the credentials set in the
	 URL.
	 Internally, this is handled by storing the credentials in the "URL
	 object" so that there is only a single set of credentials stored
	 associated with this single URL.
	 When libcurl handles a relative redirect (as opposed to an
	 absolute URL redirect) for an HTTP transfer, the server is only
	 sending a new path to the client and that path is applied on to the
	 existing URL. That "applying" of the relative path on top of an
	 absolute URL is done by libcurl first generating a full absolute
	 URL out of all the components it has, then it applies the redirect
	 and finally it deconstructs the URL again into its separate
	 components.
	 This security vulnerability originates in the fact that curl did
	 not correctly URL encode the credential data when set using one of
	 the curl_easy_setopt options described above. This made curl
	 generate a badly formatted full URL when it would do a redirect and
	 the final re-parsing of the URL would then go bad and wrongly
	 consider a part of the password field to belong to the host name.
	 The wrong host name would then be used in a name resolve lookup,
	 potentially leaking the host name + partial password in clear text
	 over the network (if plain DNS was used) and in particular to the
	 used DNS server(s).
	 CVE-2020-8177: curl overwrite local file with -J
	 curl can be tricked by a malicious server to overwrite a local
	 file when using -J (--remote-header-name) and -i (--include) in the
	 same command line.
	 The command line tool offers the -J option that saves a remote
	 file using the file name present in the Content-Disposition:
	 response header. curl then refuses to overwrite an existing local
	 file using the same name, if one already exists in the current
	 directory.
	 The -J flag is designed to save a response body, and so it doesn't
	 work together with -i and there's logic that forbids it. However,
	 the check is flawed and doesn't properly check for when the options
	 are used in the reversed order: first using -J and then -i were
	 mistakenly accepted.
	 The result of this mistake was that incoming HTTP headers could
	 overwrite a local file if one existed, as the check to avoid the
	 local file was done first when body data was received, and due to
	 the mistake mentioned above, it could already have received and
	 saved headers by that time.
	 The saved file would only get response headers added to it, as it
	 would abort the saving when the first body byte arrives. A
	 malicious server could however still be made to send back virtually
	 anything as headers and curl would save them like this, until the
	 first CRLF-CRLF sequence appears.
	 (Also note that -J needs to be used in combination with -O to have
	 any effect.)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/security.html</url>
 <url>https://curl.haxx.se/docs/CVE-2020-8169.html</url>
 <url>https://curl.haxx.se/docs/CVE-2020-8177.html</url>
 <cvename>CVE-2020-8169</cvename>
 <cvename>CVE-2020-8177</cvename>
 </references>
 <dates>
 <discovery>2020-06-24</discovery>
 <entry>2020-06-24</entry>
 </dates>
 </vuln>

<vuln vid="ce0c8590-b628-11ea-9d28-3c970ee9157c">
 <topic>CUPS -- memory corruption</topic>
 <affects>
 <package>
	<name>cups</name>
	<range><lt>2.3.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apple reports:
	<blockquote cite="https://github.com/apple/cups/releases/tag/v2.3.3">
	 <ul>
	 <li>CVE-2019-8842: The ippReadIO function may under-read an
	 extension.</li>
	 <li>CVE-2020-3898: The ppdOpen function did not handle invalid UI
	 constraint. ppdcSource::get_resolution function did not handle
	 invalid resolution strings. An application may be able to gain
	 elevated privileges.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/apple/cups/releases/tag/v2.3.3</url>
 <url>https://support.apple.com/en-us/HT211100</url>
 <cvename>CVE-2019-8842</cvename>
 <cvename>CVE-2020-3898</cvename>
 </references>
 <dates>
 <discovery>2020-04-28</discovery>
 <entry>2020-06-24</entry>
 </dates>
 </vuln>

<vuln vid="feb8afdc-b3e5-11ea-9df5-08002728f74c">
 <topic>Rails -- permission vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-actionpack60</name>
	<range><lt>6.0.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails blog:
	<blockquote cite="https://weblog.rubyonrails.org/2020/6/17/Rails-6-0-3-2-has-been-released/">
	 Rails 6.0.3.2 has been released! This version of Rails contains an
	 important security patch, and you should upgrade! The release contains
	 only one patch that addresses CVE-2020-8185.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://weblog.rubyonrails.org/2020/6/17/Rails-6-0-3-2-has-been-released/</url>
 <url>https://github.com/rails/rails/blob/6-0-stable/actionpack/CHANGELOG.md</url>
 <url>https://groups.google.com/forum/#!topic/rubyonrails-security/pAe9EV8gbM0</url>
 <cvename>CVE-2020-8185</cvename>
 </references>
 <dates>
 <discovery>2020-06-17</discovery>
 <entry>2020-06-22</entry>
 </dates>
 </vuln>

<vuln vid="77896891-b08a-11ea-937b-b42e99a1b9c3">
 <topic>vlc heap-based buffer overflow</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><lt>3.0.11,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Thomas Guillem reports:
	<blockquote cite="http://git.videolan.org/?p=vlc/vlc-3.0.git;a=commit;h=d5c43c21c747ff30ed19fcca745dea3481c733e0">
	 A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11
 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13428</url>
 <cvename>CVE-2020-13428</cvename>
 </references>
 <dates>
 <discovery>2020-05-27</discovery>
 <entry>2020-06-17</entry>
 </dates>
 </vuln>

<vuln vid="f28476f7-b166-11ea-8775-507b9d01076a">
 <topic>Several issues in Lynis</topic>
 <affects>
 <package>
	<name>lynis</name>
	<range><ge>2.0.0</ge><le>2.7.5</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	lynis update:
	This release resolves two security issues
	<ul>
	 <li>CVE-2020-13882 - Discovered by Sander Bos, code submission by Katarina Durechova</li>
	 <li>CVE-2019-13033 - Discovered by Sander Bos</li>
	</ul>
 </body>
 </description>
 <references>
 <url>https://github.com/CISOfy/lynis/blob/master/CHANGELOG.md#security-issues</url>
 </references>
 <dates>
 <discovery>2020-06-18</discovery>
 <entry>2020-06-18</entry>
 </dates>
 </vuln>

<vuln vid="f00d1873-b138-11ea-8659-901b0ef719ab">
 <topic>BIND -- Remote Denial of Service vulnerability</topic>
 <affects>
 <package>
	<name>bind911</name>
	<range><ge>9.11.14</ge><lt>9.11.20</lt></range>
 </package>
 <package>
	<name>bind916</name>
	<range><ge>9.16.0</ge><lt>9.16.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/docs/cve-2020-8619">
	 The asterisk character ("*") is allowed in DNS zone files, where
	 it is most commonly present as a wildcard at a terminal node of
	 the Domain Name System graph. However, the RFCs do not require
	 and BIND does not enforce that an asterisk character be present
	 only at a terminal node.
	 A problem can occur when an asterisk is present in an empty
	 non-terminal location within the DNS graph. If such a node exists,
	 after a series of queries, named can reach an inconsistent state
	 that results in the failure of an assertion check in rbtdb.c,
	 followed by the program exiting due to the assertion failure.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-8619</cvename>
 <url>https://kb.isc.org/docs/cve-2020-8619</url>
 </references>
 <dates>
 <discovery>2020-06-17</discovery>
 <entry>2020-06-18</entry>
 </dates>
 </vuln>

<vuln vid="75d72e03-b137-11ea-8659-901b0ef719ab">
 <topic>BIND -- Remote Denial of Service vulnerability</topic>
 <affects>
 <package>
	<name>bind916</name>
	<range><ge>9.16.0</ge><lt>9.16.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/docs/cve-2020-8618">
	 An assertion check in BIND (that is meant to prevent going beyond
	 the end of a buffer when processing incoming data) can be
	 incorrectly triggered by a large response during zone transfer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-8618</cvename>
 <url>https://kb.isc.org/docs/cve-2020-8618</url>
 </references>
 <dates>
 <discovery>2020-06-17</discovery>
 <entry>2020-06-18</entry>
 </dates>
 </vuln>

<vuln vid="96fb446d-ac7b-11ea-8b5e-b42e99a1b9c3">
 <topic>LibreOffice Security Advisory</topic>
 <affects>
 <package>
	<name>libreoffice</name>
	<range><lt>6.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	LibreOffice reports:
	<blockquote cite="https://www.libreoffice.org/about-us/security/advisories/">
	 Two flaws were found in LibreOffice:
 <ul>
 <li>CVE-2020-12802: remote graphics contained in docx format retrieved in 'stealth mode'</li>
 <li>CVE-2020-12803: XForms submissions could overwrite local files</li>
 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.libreoffice.org/about-us/security/advisories/CVE-2020-12802</url>
 <url>https://www.libreoffice.org/about-us/security/advisories/cve-2020-12803</url>
 <cvename>CVE-2020-12802</cvename>
 <cvename>CVE-2020-12803</cvename>
 </references>
 <dates>
 <discovery>2020-06-08</discovery>
 <entry>2020-06-12</entry>
 </dates>
 </vuln>

<vuln vid="c4ac9c79-ab37-11ea-8b5e-b42e99a1b9c3">
 <topic>several security issues in sqlite3</topic>
 <affects>
 <package>
	<name>sqlite3</name>
	<range><lt>3.32.2,1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.1</ge><lt>12.1_8</lt></range>
	<range><ge>11.4</ge><lt>11.4_2</lt></range>
	<range><ge>11.3</ge><lt>11.3_12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	sqlite3 update:
	Various security issues could be used by an attacker to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.
	<ul>
	 <li>CVE-2020-11655: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.</li>
	 <li>CVE-2020-13434: SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.</li>
	 <li>CVE-2020-13435: SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.</li>
	 <li>CVE-2020-13630: ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.</li>
	 <li>CVE-2020-13631: SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.</li>
	 <li>CVE-2020-13632: ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.</li>
	</ul>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-11655</url>
 <cvename>CVE-2020-11655</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13434</url>
 <cvename>CVE-2020-13434</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13435</url>
 <cvename>CVE-2020-13435</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13630</url>
 <cvename>CVE-2020-13630</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13631</url>
 <cvename>CVE-2020-13631</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13632</url>
 <cvename>CVE-2020-13632</cvename>
 <freebsdsa>SA-20:22.sqlite</freebsdsa>
 </references>
 <dates>
 <discovery>2020-05-25</discovery>
 <entry>2020-06-10</entry>
 <modified>2020-08-06</modified>
 </dates>
 </vuln>

<vuln vid="11fcfa8f-ac64-11ea-9dab-000d3ab229d6">
 <topic>Node.js -- June 2020 Security Releases</topic>
 <affects>
 <package>
	<name>node</name>
	<range><lt>14.4.0</lt></range>
 </package>
 <package>
	<name>node12</name>
	<range><lt>12.18.0</lt></range>
 </package>
 <package>
	<name>node10</name>
	<range><lt>10.21.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/">
	 Updates are now available for all supported Node.js release lines for the following issues.
 <h1>TLS session reuse can lead to host certificate verification bypass (High) (CVE-2020-8172)</h1>
 The 'session' event could be emitted before the 'secureConnect' event. It should not be, because the
 connection may fail to be authorized. If it was saved an authorized connection could be established
 later with the session ticket. Note that the https agent caches sessions, so is vulnerable to this.
 The 'session' event will now only be emitted after the 'secureConnect' event, and only for authorized
 connections.
 <h1>HTTP/2 Large Settings Frame DoS (Low) (CVE-2020-11080)</h1>
 Receiving unreasonably large HTTP/2 SETTINGS frames can consume 100% CPU to process all the settings,
 blocking all other activities until complete.
 The HTTP/2 session frame is limited to 32 settings by default. This can be configured if necessary
 using the maxSettings option.
 <h1>napi_get_value_string_*() allows various kinds of memory corruption (High) (CVE-2020-8174)</h1>
 Calling napi_get_value_string_latin1(), napi_get_value_string_utf8(), or napi_get_value_string_utf16()
 with a non-NULL buf, and a bufsize of 0 will cause the entire string value to be written to buf,
 probably overrunning the length of the buffer.
 A exploit has not been reported and it may be difficult but the following is suggested:
 <ul>
 <li>All users of LTS Node.js versions should update to the versions announced in this security post.
	This will address the issue for any non pre-built add-on.</li>
 <li>Maintainers who support EOL Node.js versions and/or build against a version of Node.js that did not
	support N-API internally should update to use the new versions of node-addon-api 1.x and 2.x that
	will be released soon after this announcement.</li>
 </ul>
 <h1>ICU-20958 Prevent SEGV_MAPERR in append (High) (CVE-2020-10531)</h1>
 An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An
 integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend()
 function in common/unistr.cpp.
 Fix was applied to 10.x in an abundance of caution, even though there is no known way to trigger the
 overflow in 10.x.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/</url>
 <cvename>CVE-2020-8174</cvename>
 <cvename>CVE-2020-8172</cvename>
 <cvename>CVE-2020-10531</cvename>
 <cvename>CVE-2020-11080</cvename>
 </references>
 <dates>
 <discovery>2020-06-02</discovery>
 <entry>2020-06-12</entry>
 </dates>
 </vuln>

<vuln vid="045e46e8-abe6-11ea-99cb-10bf48e1088e">
 <topic>tcpreplay -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>tcpreplay</name>
	<range><lt>4.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	fklassen on Github reports:
	<blockquote cite="https://github.com/appneta/tcpreplay/releases/tag/v4.3.2">
	 This release fixes the following security issues:
	 <ul>
	 <li>memory access in do_checksum()</li>
	 <li>NULL pointer dereference get_layer4_v6()</li>
	 <li>NULL pointer dereference get_ipv6_l4proto()</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/appneta/tcpreplay/releases/tag/v4.3.2</url>
 <cvename>CVE-2019-8381</cvename>
 <cvename>CVE-2019-8376</cvename>
 <cvename>CVE-2019-8377</cvename>
 </references>
 <dates>
 <discovery>2019-03-12</discovery>
 <entry>2020-06-11</entry>
 </dates>
 </vuln>

<vuln vid="10a24ce0-ab68-11ea-b9b8-641c67a117d8">
 <topic>znc -- Authenticated users can trigger an application crash</topic>
 <affects>
 <package>
	<name>znc</name>
	<range><ge>1.8.0</ge><lt>1.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13775">
	 ZNC 1.8.0 up to 1.8.1-rc1 allows attackers to trigger an application
	 crash (with a NULL pointer dereference) if echo-message is not enabled
	 and there is no network.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-13775</cvename>
 <url>https://wiki.znc.in/ChangeLog/1.8.1</url>
 </references>
 <dates>
 <discovery>2020-06-02</discovery>
 <entry>2020-06-10</entry>
 </dates>
 </vuln>

<vuln vid="2a3588b4-ab12-11ea-a051-001b217b3468">
 <topic>NPM -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>npm</name>
	<range><lt>6.13.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NPM reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/">
	 Global node_modules Binary Overwrite
	 Symlink reference outside of node_modules
	 Arbitrary File Write
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/</url>
 <cvename>CVE-2019-16775</cvename>
 <cvename>CVE-2019-16776</cvename>
 <cvename>CVE-2019-16777</cvename>
 </references>
 <dates>
 <discovery>2019-12-18</discovery>
 <entry>2020-06-10</entry>
 </dates>
 </vuln>

<vuln vid="329ecd60-aaf7-11ea-8659-10bf48e1088e">
 <topic>libadplug -- Various vulnerabilities</topic>
 <affects>
 <package>
	<name>libadplug</name>
	<range><lt>2.3.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Malvineous on Github reports:
	<blockquote cite="https://github.com/adplug/adplug/releases/tag/adplug-2.3.3">
	 This release fixes the following security issues:
	 <ul>
	 <li>buffer overflow in .bmf</li>
	 <li>buffer overflow in .dtm</li>
	 <li>buffer overflow in .mkj</li>
	 <li>buffer overflow in .a2m</li>
	 <li>buffer overflow in .rad</li>
	 <li>buffer overflow in .mtk</li>
	 <li>double free and OOB reads in .u6m</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/adplug/adplug/releases/tag/adplug-2.3.3</url>
 <cvename>CVE-2019-14690</cvename>
 <cvename>CVE-2019-14691</cvename>
 <cvename>CVE-2019-14692</cvename>
 <cvename>CVE-2019-14732</cvename>
 <cvename>CVE-2019-14733</cvename>
 <cvename>CVE-2019-14734</cvename>
 <cvename>CVE-2019-15151</cvename>
 </references>
 <dates>
 <discovery>2020-06-08</discovery>
 <entry>2020-06-10</entry>
 </dates>
 </vuln>

<vuln vid="9f7ae7ea-da93-4f86-b257-ba76707f6d5d">
 <topic>zeek -- Various vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>3.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jon Siwek of Corelight reports:
	<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/v3.0.7/NEWS">
	 This release fixes the following security issues:
	 <ul>
	 <li>
	 Fix potential stack overflow in NVT analyzer</li>
	 <li>
	 Fix NVT analyzer memory leak from multiple telnet authn name options</li>
	 <li>
	 Fix multiple content-transfer-encoding headers causing a memory leak</li>
	 <li>
	 Fix potential leak of Analyzers added to tree during Analyzer::Done</li>
	 <li>
	 Prevent IP fragment reassembly on packets without minimal IP header</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://raw.githubusercontent.com/zeek/zeek/v3.0.7/NEWS</url>
 </references>
 <dates>
 <discovery>2020-05-04</discovery>
 <entry>2020-06-10</entry>
 </dates>
 </vuln>

<vuln vid="196b31b8-aa9a-11ea-a59a-6451062f0f7a">
 <topic>Flash Player -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>32.0.0.387</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb20-30.html">
	 <ul>
	 <li>This update resolves a use-after-free vulnerability that
	 could lead to arbitrary code execution (CVE-2020-9633).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-9633</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb20-30.html</url>
 </references>
 <dates>
 <discovery>2020-06-09</discovery>
 <entry>2020-06-09</entry>
 </dates>
 </vuln>

<vuln vid="32c92a75-aa71-11ea-92ab-00163e433440">
 <topic>FreeBSD -- USB HID descriptor parsing error</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_6</lt></range>
	<range><ge>11.3</ge><lt>11.3_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	If the push/pop level of the USB HID state is not restored within
	the processing of the same HID item, an invalid memory location may be
	used for subsequent HID item processing.
	<h1>Impact:</h1>
	An attacker with physical access to a USB port may be able to use a
	specially crafted USB device to gain kernel or user-space code execution.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7456</cvename>
 <freebsdsa>SA-20:17.usb</freebsdsa>
 </references>
 <dates>
 <discovery>2020-06-03</discovery>
 <entry>2020-06-09</entry>
 </dates>
 </vuln>

<vuln vid="669f3fe8-a07a-11ea-b83e-f0def1f5c5a2">
 <topic>FreeRDP -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>freerdp</name>
	<range><lt>2.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The FreeRDP changelog reports 14 CVEs addressed after 2.0.0-rc4
 </body>
 </description>
 <references>
 <url>https://github.com/FreeRDP/FreeRDP/blob/2.1.1/ChangeLog</url>
 <cvename>CVE-2020-11521</cvename>
 <cvename>CVE-2020-11522</cvename>
 <cvename>CVE-2020-11523</cvename>
 <cvename>CVE-2020-11524</cvename>
 <cvename>CVE-2020-11525</cvename>
 <cvename>CVE-2020-11526</cvename>
 <cvename>CVE-2020-11039</cvename>
 <cvename>CVE-2020-11038</cvename>
 <cvename>CVE-2020-11043</cvename>
 <cvename>CVE-2020-11040</cvename>
 <cvename>CVE-2020-11041</cvename>
 <cvename>CVE-2020-11019</cvename>
 <cvename>CVE-2020-11017</cvename>
 <cvename>CVE-2020-11018</cvename>
 </references>
 <dates>
 <discovery>2020-04-10</discovery>
 <entry>2020-05-28</entry>
 </dates>
 </vuln>

<vuln vid="a2caf7bd-a719-11ea-a857-e09467587c17">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>83.0.4103.97</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop.html">
	 This update includes 5 security fixes. Below, we highlight fixes
	 that were contributed by external researchers.
	 <ul>
	 <li>[1082105] High CVE-2020-6493: Use after free in
	 WebAuthentication. Reported by Anonymous on 2020-05-13</li>
	 <li>[1083972] High CVE-2020-6494: Incorrect security UI in payments.
	 Reported by Juho Nurminen on 2020-05-18</li>
	 <li>[1072116] High CVE-2020-6495: Insufficient policy enforcement in
	 developer tools. Reported by David Erceg on 2020-04-18</li>
	 <li>[1085990] High CVE-2020-6496: Use after free in payments.
	 Reported by Khalil Zhani on 2020-05-24</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-6493</cvename>
 <cvename>CVE-2020-6494</cvename>
 <cvename>CVE-2020-6495</cvename>
 <cvename>CVE-2020-6496</cvename>
 <url>https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2020-06-03</discovery>
 <entry>2020-06-05</entry>
 </dates>
 </vuln>

<vuln vid="40bfab16-a68b-11ea-9ea5-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.0.0</ge><lt>13.0.4</lt></range>
	<range><ge>12.10.0</ge><lt>12.10.9</lt></range>
	<range><ge>10.6.0</ge><lt>12.9.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/06/03/critical-security-release-13-0-4-released/">
	 CI Token Access Control
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/06/03/critical-security-release-13-0-4-released/</url>
 </references>
 <dates>
 <discovery>2020-06-03</discovery>
 <entry>2020-06-04</entry>
 </dates>
 </vuln>

<vuln vid="597d02ce-a66c-11ea-af32-080027846a02">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py36-django22</name>
	<name>py37-django22</name>
	<name>py38-django22</name>
	<range><lt>2.2.13</lt></range>
 </package>
 <package>
	<name>py36-django30</name>
	<name>py37-django30</name>
	<name>py38-django30</name>
	<range><lt>3.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django security release reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2020/jun/03/security-releases/">
	 CVE-2020-13254: Potential data leakage via malformed memcached keys
	 In cases where a memcached backend does not perform key validation, passing
	 malformed cache keys could result in a key collision, and potential data leakage.
	 In order to avoid this vulnerability, key validation is added to the memcached
	 cache backends.
	 CVE-2020-13596: Possible XSS via admin ForeignKeyRawIdWidget
	 Query parameters for the admin ForeignKeyRawIdWidget were not properly URL
	 encoded, posing an XSS attack vector. ForeignKeyRawIdWidget now ensures query
	 parameters are correctly URL encoded.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2020/jun/03/security-releases/</url>
 <cvename>CVE-2020-13254</cvename>
 <cvename>CVE-2020-13596</cvename>
 </references>
 <dates>
 <discovery>2020-06-01</discovery>
 <entry>2020-06-04</entry>
 </dates>
 </vuln>

<vuln vid="ced2d47e-8469-11ea-a283-b42e99a1b9c3">
 <topic>malicious URLs may present credentials to wrong server</topic>
 <affects>
 <package>
	<name>git</name>
	<range><ge>2.26.0</ge><lt>2.26.1</lt></range>
	<range><ge>2.25.0</ge><lt>2.25.3</lt></range>
	<range><ge>2.24.0</ge><lt>2.24.2</lt></range>
	<range><ge>2.23.0</ge><lt>2.23.2</lt></range>
	<range><ge>2.22.0</ge><lt>2.22.3</lt></range>
	<range><ge>2.21.0</ge><lt>2.21.2</lt></range>
	<range><ge>2.20.0</ge><lt>2.20.3</lt></range>
	<range><ge>2.19.0</ge><lt>2.19.4</lt></range>
	<range><ge>2.18.0</ge><lt>2.18.3</lt></range>
	<range><ge>0</ge><lt>2.17.4</lt></range>
 </package>
 <package>
	<name>git-lite</name>
	<range><ge>2.26.0</ge><lt>2.26.1</lt></range>
	<range><ge>2.25.0</ge><lt>2.25.3</lt></range>
	<range><ge>2.24.0</ge><lt>2.24.2</lt></range>
	<range><ge>2.23.0</ge><lt>2.23.2</lt></range>
	<range><ge>2.22.0</ge><lt>2.22.3</lt></range>
	<range><ge>2.21.0</ge><lt>2.21.2</lt></range>
	<range><ge>2.20.0</ge><lt>2.20.3</lt></range>
	<range><ge>2.19.0</ge><lt>2.19.4</lt></range>
	<range><ge>2.18.0</ge><lt>2.18.3</lt></range>
	<range><ge>0</ge><lt>2.17.4</lt></range>
 </package>
 <package>
	<name>git-gui</name>
	<range><ge>2.26.0</ge><lt>2.26.1</lt></range>
	<range><ge>2.25.0</ge><lt>2.25.3</lt></range>
	<range><ge>2.24.0</ge><lt>2.24.2</lt></range>
	<range><ge>2.23.0</ge><lt>2.23.2</lt></range>
	<range><ge>2.22.0</ge><lt>2.22.3</lt></range>
	<range><ge>2.21.0</ge><lt>2.21.2</lt></range>
	<range><ge>2.20.0</ge><lt>2.20.3</lt></range>
	<range><ge>2.19.0</ge><lt>2.19.4</lt></range>
	<range><ge>2.18.0</ge><lt>2.18.3</lt></range>
	<range><ge>0</ge><lt>2.17.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	git security advisory reports:
	<blockquote cite="https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q">
	 Git uses external "credential helper" programs to store and retrieve passwords or
	 other credentials from secure storage provided by the operating system.
	 Specially-crafted URLs that contain an encoded newline can inject unintended values
	 into the credential helper protocol stream, causing the credential helper to retrieve
	 the password for one server for an HTTP request being made to another
	 server, resulting in credentials for the former being sent to the
	 latter.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q</url>
 <cvename>CVE-2020-5260</cvename>
 </references>
 <dates>
 <discovery>2020-04-14</discovery>
 <entry>2020-04-22</entry>
 </dates>
 </vuln>

<vuln vid="67765237-8470-11ea-a283-b42e99a1b9c3">
 <topic>malicious URLs can cause git to send a stored credential to wrong server</topic>
 <affects>
 <package>
	<name>git</name>
	<range><ge>2.26.0</ge><lt>2.26.2</lt></range>
	<range><ge>2.25.0</ge><lt>2.25.4</lt></range>
	<range><ge>2.24.0</ge><lt>2.24.3</lt></range>
	<range><ge>2.23.0</ge><lt>2.23.3</lt></range>
	<range><ge>2.22.0</ge><lt>2.22.4</lt></range>
	<range><ge>2.21.0</ge><lt>2.21.3</lt></range>
	<range><ge>2.20.0</ge><lt>2.20.4</lt></range>
	<range><ge>2.19.0</ge><lt>2.19.5</lt></range>
	<range><ge>2.18.0</ge><lt>2.18.4</lt></range>
	<range><ge>0</ge><lt>2.17.5</lt></range>
 </package>
 <package>
	<name>git-lite</name>
	<range><ge>2.26.0</ge><lt>2.26.2</lt></range>
	<range><ge>2.25.0</ge><lt>2.25.4</lt></range>
	<range><ge>2.24.0</ge><lt>2.24.3</lt></range>
	<range><ge>2.23.0</ge><lt>2.23.3</lt></range>
	<range><ge>2.22.0</ge><lt>2.22.4</lt></range>
	<range><ge>2.21.0</ge><lt>2.21.3</lt></range>
	<range><ge>2.20.0</ge><lt>2.20.4</lt></range>
	<range><ge>2.19.0</ge><lt>2.19.5</lt></range>
	<range><ge>2.18.0</ge><lt>2.18.4</lt></range>
	<range><ge>0</ge><lt>2.17.5</lt></range>
 </package>
 <package>
	<name>git-gui</name>
	<range><ge>2.26.0</ge><lt>2.26.2</lt></range>
	<range><ge>2.25.0</ge><lt>2.25.4</lt></range>
	<range><ge>2.24.0</ge><lt>2.24.3</lt></range>
	<range><ge>2.23.0</ge><lt>2.23.3</lt></range>
	<range><ge>2.22.0</ge><lt>2.22.4</lt></range>
	<range><ge>2.21.0</ge><lt>2.21.3</lt></range>
	<range><ge>2.20.0</ge><lt>2.20.4</lt></range>
	<range><ge>2.19.0</ge><lt>2.19.5</lt></range>
	<range><ge>2.18.0</ge><lt>2.18.4</lt></range>
	<range><ge>0</ge><lt>2.17.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	git security advisory reports:
	<blockquote cite="https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7">
	 Git uses external "credential helper" programs to store and retrieve passwords or
	 other credentials from secure storage provided by the operating system. Specially-crafted
	 URLs that are considered illegal as of the recently published Git versions can cause Git
	 to send a "blank" pattern to helpers, missing hostname and protocol fields. Many helpers
	 will interpret this as matching any URL, and will return some unspecified stored password,
	 leaking the password to an attacker's server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7</url>
 <cvename>CVE-2020-11008</cvename>
 </references>
 <dates>
 <discovery>2020-04-20</discovery>
 <entry>2020-04-22</entry>
 </dates>
 </vuln>

<vuln vid="ef5b4f5f-a658-11ea-80d7-001cc0382b2f">
 <topic>GnuTLS -- flaw in TLS session ticket key construction</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>3.6.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GnuTLS project reports:
	<blockquote cite="https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03">
	 It was found that GnuTLS 3.6.4 introduced a regression in the TLS
	 protocol implementation. This caused the TLS server to not securely
	 construct a session ticket encryption key considering the
	 application supplied secret, allowing a MitM attacker to bypass
	 authentication in TLS 1.3 and recover previous conversations in TLS
	 1.2.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03</url>
 <cvename>CVE-2020-13777</cvename>
 </references>
 <dates>
 <discovery>2020-06-03</discovery>
 <entry>2020-06-04</entry>
 </dates>
 </vuln>

<vuln vid="ca8327f7-a5a5-11ea-a860-08002728f74c">
 <topic>websocket-extensions -- ReDoS vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-websocket-extensions</name>
	<range><lt>0.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Changelog:
	<blockquote cite="https://github.com/faye/websocket-extensions-ruby/blob/master/CHANGELOG.md#015--2020-06-02">
	 Remove a ReDoS vulnerability in the header parser (CVE-2020-7663)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/faye/websocket-extensions-ruby/blob/master/CHANGELOG.md</url>
 <url>https://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a8131892418838b</url>
 <cvename>CVE-2020-7663</cvename>
 </references>
 <dates>
 <discovery>2020-06-02</discovery>
 <entry>2020-06-03</entry>
 </dates>
 </vuln>

<vuln vid="4bb56d2f-a5b0-11ea-a860-08002728f74c">
 <topic>nghttp2 -- DoS vulnerability</topic>
 <affects>
 <package>
	<name>nghttp2</name>
	<name>libnghttp2</name>
	<range><lt>1.41.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	nghttp2 security advisories:
	<blockquote cite="https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr">
	 The overly large HTTP/2 SETTINGS frame payload causes denial of service.
	 The proof of concept attack involves a malicious client constructing a
	 SETTINGS frame with a length of 14,400 bytes (2400 individual settings
	 entries) over and over again. The attack causes the CPU to spike at 100%.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr</url>
 <cvename>CVE-2020-11080</cvename>
 </references>
 <dates>
 <discovery>2020-06-02</discovery>
 <entry>2020-06-03</entry>
 </dates>
 </vuln>

<vuln vid="1650cee2-a320-11ea-a090-08002734b9ed">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.11.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.11.6:
	<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.11.6">
	 <ul>
	 <li>Fix missing authorization check on pull for public repos of private/limited org (#11656) (#11683)</li>
	 <li>Use session for retrieving org teams (#11438) (#11439)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.11.6</url>
 <freebsdpr>ports/246892</freebsdpr>
 </references>
 <dates>
 <discovery>2020-03-01</discovery>
 <entry>2020-05-31</entry>
 </dates>
 </vuln>

<vuln vid="4e6875a2-a126-11ea-b385-08002728f74c">
 <topic>kaminari -- potential XSS vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-kaminari-core</name>
	<range><lt>1.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kaminari Security Advisories:
	<blockquote cite="https://github.com/kaminari/kaminari/security/advisories/GHSA-r5jw-62xg-j433">
	 There was a vulnerability in versions of Kaminari that would allow an
	 attacker to inject arbitrary code into pages with pagination links.
	 The 1.2.1 gem including the patch has already been released.
	 All past released versions are affected by this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/kaminari/kaminari/security/advisories/GHSA-r5jw-62xg-j433</url>
 <url>https://github.com/kaminari/kaminari/blob/master/CHANGELOG.md#121</url>
 <url>https://github.com/kaminari/kaminari/pull/1020</url>
 <cvename>CVE-2020-11082</cvename>
 </references>
 <dates>
 <discovery>2020-04-22</discovery>
 <entry>2020-05-28</entry>
 </dates>
 </vuln>

<vuln vid="28481349-7e20-4f80-ae1e-e6bf48d4f17c">
 <topic>Sane -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>sane-backends</name>
	<range><lt>1.0.30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Sane Project reports:
	<blockquote cite="https://gitlab.com/sane-project/backends/-/releases/1.0.30">
	 epson2: fixes CVE-2020-12867 (GHSL-2020-075) and several memory management issues found while addressing that CVE
	 epsonds: addresses out-of-bound memory access issues to fix CVE-2020-12862 (GHSL-2020-082) and CVE-2020-12863 (GHSL-2020-083), addresses a buffer overflow fixing CVE-2020-12865 (GHSL-2020-084) and disables network autodiscovery to mitigate CVE-2020-12866 (GHSL-2020-079), CVE-2020-12861 (GHSL-2020-080) and CVE-2020-12864 (GHSL-2020-081). Note that this backend does not support network scanners to begin with.
	 magicolor: fixes a floating point exception and uninitialized data read
	 fixes an overflow in sanei_tcp_read()
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://gitlab.com/sane-project/backends/-/releases/1.0.30</url>
 <cvename>CVE-2020-12861</cvename>
 <cvename>CVE-2020-12862</cvename>
 <cvename>CVE-2020-12863</cvename>
 <cvename>CVE-2020-12864</cvename>
 <cvename>CVE-2020-12865</cvename>
 <cvename>CVE-2020-12866</cvename>
 <cvename>CVE-2020-12867</cvename>
 </references>
 <dates>
 <discovery>2020-05-17</discovery>
 <entry>2020-05-28</entry>
 </dates>
 </vuln>

<vuln vid="69cf62a8-a0aa-11ea-9ea5-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>13.0.0</ge><lt>13.0.1</lt></range>
	<range><ge>12.10.0</ge><lt>12.10.7</lt></range>
	<range><ge>12.9.0</ge><lt>12.9.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/05/27/security-release-13-0-1-released/">
	 User Email Verification Bypass
	 OAuth Flow Missing Email Verification Checks
	 Notification Email Verification Bypass
	 Undisclosed Vulnerability on a Third-Party Rendering Engine
	 Group Sign-Up Restriction Bypass
	 Mirror Project Owner Impersonation
	 Missing Permission Check on Fork Relation Creation
	 Cross-Site Scripting in Repository Files API
	 Kubernetes Cluster Token Disclosure
	 Object Storage File Enumeration
	 Insecure Authorization Check on Project Deploy Keys
	 Cross-Site Scripting on Metrics Dashboard
	 Denial of Service on Custom Dashboards
	 Client-Side Code Injection through Mermaid Markup
	 Cross-Site Scripting on Static Site Editor
	 Disclosure of Amazon EKS Credentials
	 Denial of Service on Workhorse
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/05/27/security-release-13-0-1-released/</url>
 </references>
 <dates>
 <discovery>2020-05-27</discovery>
 <entry>2020-05-28</entry>
 </dates>
 </vuln>

<vuln vid="9908a1cc-35ad-424d-be0b-7e56abd5931a">
 <topic>sympa -- Denial of service caused by malformed CSRF token</topic>
 <affects>
 <package>
	<name>sympa</name>
	<range><lt>6.2.54</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Javier Moreno discovered a vulnerability in Sympa web
	 interface that can cause denial of service (DoS) attack.
	By submitting requests with malformed parameters, this
	 flaw allows to create junk files in Sympa's directory
	 for temporary files. And particularly by tampering token
	 to prevent CSRF, it allows to originate exessive
	 notification messages to listmasters.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-9369</cvename>
 <url>https://sympa-community.github.io/security/2020-001.html</url>
 </references>
 <dates>
 <discovery>2020-02-24</discovery>
 <entry>2020-05-22</entry>
 </dates>
 </vuln>

<vuln vid="61bc44ce-9f5a-11ea-aff3-f8b156c2bfe9">
 <topic>sympa - Security flaws in setuid wrappers</topic>
 <affects>
 <package>
	<name>sympa</name>
	<range><lt>6.2.56</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A vulnerability has been discovered in Sympa web interface
	by which attacker can execute arbitrary code with root privileges.
	Sympa uses two sorts of setuid wrappers:
	<ul>
	 <li>FastCGI wrappers</li>
	 <li>newaliases wrapper</li>
	</ul>
	The FastCGI wrappers wwsympa-wrapper.fcgi and
	sympa_soap_server-wrapper.fcgi were used to make the web
	interface running under privileges of a dedicated user.
	The newaliases wrapper (sympa_newaliases-wrapper) allows
	Sympa to update the alias database with root privileges.
	Since these setuid wrappers did not clear environment variables,
	if environment variables like PERL5LIB were injected,
	forged code might be loaded and executed under privileges of setuid-ed
	users.
 </body>
 </description>
 <references>
 <url>https://sympa-community.github.io/security/2020-002.html</url>
 </references>
 <dates>
 <discovery>2020-05-24</discovery>
 <entry>2020-05-26</entry>
 </dates>
 </vuln>

<vuln vid="f9c5a410-9b4e-11ea-ac3f-6805ca2fa271">
 <topic>powerdns-recursor -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><ge>4.3.0</ge><lt>4.3.1</lt></range>
	<range><ge>4.2.0</ge><lt>4.2.2</lt></range>
	<range><ge>4.1.0</ge><lt>4.1.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.3.html#change-4.3.1">
	 CVE-2020-10995: An issue in the DNS protocol has been found that allow malicious parties to use
	 recursive DNS services to attack third party authoritative name servers. The attack uses a crafted
	 reply by an authoritative name server to amplify the resulting traffic between the recursive and
	 other authoritative name servers. Both types of service can suffer degraded performance as an effect.
	 CVE-2020-12244: An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in
	 the answer section of a NXDOMAIN response lacking an SOA were not properly validated in
	 SyncRes::processAnswer. This would allow an attacker in position of man-in-the-middle to send a
	 NXDOMAIN answer for a name that does exist, bypassing DNSSEC validation.
	 CVE-2020-10030: An issue has been found in PowerDNS Authoritative Server allowing an attacker
	 with enough privileges to change the system's hostname to cause disclosure of uninitialized memory
	 content via a stack-based out-of-bounds read. It only occurs on systems where gethostname() does
	 not null-terminate the returned string if the hostname is larger than the supplied buffer. Linux
	 systems are not affected because the buffer is always large enough. OpenBSD systems are not affected
	 because the returned hostname is always null-terminated. Under some conditions this issue can lead
	 to the writing of one null-byte out-of-bounds on the stack, causing a denial of service or possibly
	 arbitrary code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://doc.powerdns.com/recursor/security-advisories/index.html</url>
 <cvename>CVE-2020-10995</cvename>
 <cvename>CVE-2020-12244</cvename>
 <cvename>CVE-2020-10030</cvename>
 </references>
 <dates>
 <discovery>2020-05-19</discovery>
 <entry>2020-05-26</entry>
 <modified>2020-05-29</modified>
 </dates>
 </vuln>

<vuln vid="38c676bd-9def-11ea-a94c-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>83.0.4103.61</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html">
	 This release includes 38 security fixes, including CVEs
	 CVE-2020-6465 through CVE-2020-6491.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-6465</cvename>
 <cvename>CVE-2020-6466</cvename>
 <cvename>CVE-2020-6467</cvename>
 <cvename>CVE-2020-6468</cvename>
 <cvename>CVE-2020-6469</cvename>
 <cvename>CVE-2020-6470</cvename>
 <cvename>CVE-2020-6471</cvename>
 <cvename>CVE-2020-6472</cvename>
 <cvename>CVE-2020-6473</cvename>
 <cvename>CVE-2020-6474</cvename>
 <cvename>CVE-2020-6475</cvename>
 <cvename>CVE-2020-6476</cvename>
 <cvename>CVE-2020-6477</cvename>
 <cvename>CVE-2020-6478</cvename>
 <cvename>CVE-2020-6479</cvename>
 <cvename>CVE-2020-6480</cvename>
 <cvename>CVE-2020-6481</cvename>
 <cvename>CVE-2020-6482</cvename>
 <cvename>CVE-2020-6483</cvename>
 <cvename>CVE-2020-6484</cvename>
 <cvename>CVE-2020-6485</cvename>
 <cvename>CVE-2020-6486</cvename>
 <cvename>CVE-2020-6487</cvename>
 <cvename>CVE-2020-6488</cvename>
 <cvename>CVE-2020-6489</cvename>
 <cvename>CVE-2020-6490</cvename>
 <cvename>CVE-2020-6491</cvename>
 <url>https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html</url>
 </references>
 <dates>
 <discovery>2020-05-19</discovery>
 <entry>2020-05-24</entry>
 </dates>
 </vuln>

<vuln vid="436d7f93-9cf0-11ea-82b8-4c72b94353b5">
 <topic>piwigo -- Multible Vulnerabilities</topic>
 <affects>
 <package>
	<name>piwigo</name>
	<range><lt>2.10.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Piwigo reports:
	<blockquote cite="https://www.piwigo.org/release-2.10.2">
	 Piwigo 2.10.1 is affected by stored XSS
	 via the Group Name Field to the group_list page.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-8089</url>
 <cvename>CVE-2020-8089</cvename>
 </references>
 <dates>
 <discovery>2020-02-07</discovery>
 <entry>2020-05-23</entry>
 </dates>
 </vuln>

<vuln vid="676ca486-9c1e-11ea-8b5e-b42e99a1b9c3">
 <topic>Apache Tomcat Remote Code Execution via session persistence</topic>
 <affects>
 <package>
	<name>tomcat7</name>
	<range><lt>7.0.104</lt></range>
 </package>
 <package>
	<name>tomcat85</name>
	<range><lt>8.5.55</lt></range>
 </package>
 <package>
	<name>tomcat9</name>
	<range><lt>9.0.35</lt></range>
 </package>
 <package>
	<name>tomcat-devel</name>
	<range><lt>10.0.0.M5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation reports:
	 Under certain circumstances an attacker will be able to trigger remote code execution via deserialization of the file under their control
 </body>
 </description>
 <references>
 <url>http://tomcat.apache.org/security-7.html</url>
 <url>http://tomcat.apache.org/security-8.html</url>
 <url>http://tomcat.apache.org/security-9.html</url>
 <url>http://tomcat.apache.org/security-10.html</url>
 <cvename>CVE-2020-9484</cvename>
 </references>
 <dates>
 <discovery>2020-05-12</discovery>
 <entry>2020-05-22</entry>
 </dates>
 </vuln>

<vuln vid="a2cb7c31-9c79-11ea-a9c2-d05099c0ae8c">
 <topic>unbound -- mutliple vulnerabilities</topic>
 <affects>
 <package>
	<name>unbound</name>
	<range><lt>1.10.1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.1</ge><lt>12.1_7</lt></range>
	<range><ge>11.4</ge><lt>11.4_1</lt></range>
	<range><ge>11.3</ge><lt>11.3_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NLNetLabs reports:
	<blockquote cite="https://lists.nlnetlabs.nl/pipermail/unbound-users/2020-May/006833.html">
	 This release fixes CVE-2020-12662 and CVE-2020-12663.
	 Bug Fixes:
	 <ul>
	 <li>CVE-2020-12662 Unbound can be tricked into
	 amplifying an incoming query into a large
	 number of queries directed to a target.</li>
	 <li>CVE-2020-12663 Malformed answers from
	 upstream name servers can be used to make
	 Unbound unresponsive.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.nlnetlabs.nl/pipermail/unbound-users/2020-May/006833.html</url>
 <cvename>CVE-2020-12662</cvename>
 <cvename>CVE-2020-12663</cvename>
 <freebsdsa>SA-20:19.unbound</freebsdsa>
 </references>
 <dates>
 <discovery>2020-05-19</discovery>
 <entry>2020-05-22</entry>
 <modified>2020-07-10</modified>
 </dates>
 </vuln>

<vuln vid="c5ec57a9-9c2b-11ea-82b8-4c72b94353b5">
 <topic>drupal -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.70</lt></range>
 </package>
 <package>
	<name>drupal8</name>
	<range><lt>8.8.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/project/drupal/releases/7.70">
	 The jQuery project released version 3.5.0, and as part of that,
	 disclosed two security vulnerabilities that affect all prior versions.
	 As mentioned in the jQuery blog, both are: ... Security issues in
	 jQuerys DOM manipulation methods, as in .html(), .append(), and the others.
	 Security advisories for both of these issues have been published on GitHub.
	 Drupal 7 has an Open Redirect vulnerability.
	 For example, a user could be tricked into visiting a specially crafted link
	 which would redirect them to an arbitrary external URL. The vulnerability is
	 caused by insufficient validation of the destination query parameter in the
	 drupal_goto() function.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/sa-core-2020-002</url>
 <url>https://www.drupal.org/sa-core-2020-003</url>
 </references>
 <dates>
 <discovery>2020-05-20</discovery>
 <entry>2020-05-22</entry>
 </dates>
 </vuln>

<vuln vid="4d11d37e-9a8d-11ea-b9b8-641c67a117d8">
 <topic>Zabbix -- Remote code execution</topic>
 <affects>
 <package>
	<name>zabbix3-server</name>
	<name>zabbix3-proxy</name>
	<range><lt>3.0.31</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Zabbix reports:
	<blockquote cite="https://www.zabbix.com/rn/rn3.0.31">
	 Fixed security vulnerability cve-2020-11800 (remote code execution).
	 (ZBX-17600)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-11800</cvename>
 <url>https://www.zabbix.com/rn/rn3.0.31</url>
 <url>https://support.zabbix.com/browse/ZBX-17600</url>
 </references>
 <dates>
 <discovery>2020-04-15</discovery>
 <entry>2020-05-20</entry>
 </dates>
 </vuln>

<vuln vid="85fca718-99f6-11ea-bf1d-08002728f74c">
 <topic>Rails -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-actionpack52</name>
	<name>rubygem-actionview52</name>
	<name>rubygem-activestorage52</name>
	<name>rubygem-activesupport52</name>
	<range><lt>5.2.4.3</lt></range>
 </package>
 <package>
	<name>rubygem-actionpack60</name>
	<name>rubygem-actionview60</name>
	<name>rubygem-activestorage60</name>
	<name>rubygem-activesupport60</name>
	<range><lt>6.0.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails blog:
	<blockquote cite="https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/">
	 Hi everyone! Rails 5.2.4.3 and 6.0.3.1 have been released! These releases contain important security fixes, so please upgrade when you can.
	 Both releases contain the following fixes:
	 CVE-2020-8162: Circumvention of file size limits in ActiveStorage
	 CVE-2020-8164: Possible Strong Parameters Bypass in ActionPack
	 CVE-2020-8165: Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
	 CVE-2020-8166: Ability to forge per-form CSRF tokens given a global CSRF token
	 CVE-2020-8167: CSRF Vulnerability in rails-ujs
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/</url>
 <url>https://groups.google.com/forum/#!topic/rubyonrails-security/PjU3946mreQ</url>
 <url>https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY</url>
 <url>https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c</url>
 <url>https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw</url>
 <url>https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0</url>
 <cvename>CVE-2020-8162</cvename>
 <cvename>CVE-2020-8164</cvename>
 <cvename>CVE-2020-8165</cvename>
 <cvename>CVE-2020-8166</cvename>
 <cvename>CVE-2020-8167</cvename>
 </references>
 <dates>
 <discovery>2020-05-18</discovery>
 <entry>2020-05-19</entry>
 </dates>
 </vuln>

<vuln vid="37d106a8-15a4-483e-8247-fcb68b16eaf8">
 <topic>Dovecot -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><lt>2.3.10.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aki Tuomi reports:
	<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-May/000438.html">
	 Vulnerability Details:
	Sending malformed NOOP command causes crash in submission, submission-login or
	lmtp service.

Risk:
	Remote attacker can keep submission-login service down, causing denial of
	service attack. For lmtp the risk is neglible, as lmtp is usually behind a
	trusted MTA.

Steps to reproduce:
	Send ``NOOP EE"FY`` to submission port, or similarly malformed command.
	 Vulnerability Details:

Sending command followed by sufficient number of newlines triggers a
	use-after-free bug that might crash submission-login, submission or
	lmtp service.

Risk:

Remote attacker can keep submission-login service down, causing denial
	of service attack. For lmtp the risk is neglible, as lmtp is usually
	behind a trusted MTA.

Steps to reproduce:

This can be currently reproduced with ASAN or Valgrind. Reliable way to
	crash has not yet been discovered.
	
	Vulnerability Details:
	Sending mail with empty quoted localpart causes submission or lmtp component
	to crash.

Risk:
	Malicious actor can cause denial of service to mail delivery by repeatedly
	sending mails with bad sender or recipient address.

Steps to reproduce:
	Send mail with envelope sender or recipient as &lt;""@example.org&gt;.

Workaround:
	For submission there is no workaround, but triggering the bug requires valid
	credentials.
	For lmtp, one can implement sufficient filtering on MTA level to prevent mails
	 with such addresses from ending up in LMTP delivery.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://dovecot.org/pipermail/dovecot-news/2020-May/000438.html</url>
 <cvename>CVE-2020-10957</cvename>
 <cvename>CVE-2020-10958</cvename>
 <cvename>CVE-2020-10967</cvename>
 </references>
 <dates>
 <discovery>2020-04-02</discovery>
 <entry>2020-05-18</entry>
 </dates>
 </vuln>

<vuln vid="91ce95d5-cd15-4105-b942-af5ccc7144c1">
 <topic>clamav -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.102.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Micah Snyder reports:
	<blockquote cite="https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html">
	 CVE-2020-3327: Fixed a vulnerability in the ARJ archive-parsing module
	 in ClamAV 0.102.2 that could cause a denial-of-service condition.
	 Improper bounds checking of an unsigned variable results in an
	 out-of-bounds read which causes a crash. Special thanks to Daehui Chang
	 and Fady Othman for helping identify the ARJ parsing vulnerability.
	 
	 CVE-2020-3341: Fixed a vulnerability in the PDF-parsing module in ClamAV
	 0.101 - 0.102.2 that could cause a denial-of-service condition. Improper
	 size checking of a buffer used to initialize AES decryption routines
	 results in an out-of-bounds read, which may cause a crash. OSS-Fuzz
	 discovered this vulnerability.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html</url>
 <cvename>CVE-2020-3327</cvename>
 <cvename>CVE-2020-3341</cvename>
 </references>
 <dates>
 <discovery>2020-05-12</discovery>
 <entry>2020-05-14</entry>
 </dates>
 </vuln>

<vuln vid="ce6db19b-976e-11ea-93c4-08002728f74c">
 <topic>Rails -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-actionview4</name>
	<range><lt>4.2.11.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails blog:
	<blockquote cite="https://weblog.rubyonrails.org/2020/5/16/rails-4-2-11-3-has-been-released/">
	 Due to an unfortunate oversight, Rails 4.2.11.2 has a missing constant
	 error. To address this Rails 4.2.11.3 has been released.
	 The original announcement for CVE-2020-8163 has a follow-up message
	 with an updated patch if you’re unable to use the gems.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://weblog.rubyonrails.org/2020/5/16/rails-4-2-11-3-has-been-released/</url>
 <url>https://groups.google.com/forum/#!topic/rubyonrails-security/hWuKcHyoKh0</url>
 <cvename>CVE-2020-8163</cvename>
 </references>
 <dates>
 <discovery>2020-05-15</discovery>
 <entry>2020-05-16</entry>
 </dates>
 </vuln>

<vuln vid="6bf55af9-973b-11ea-9f2c-38d547003487">
 <topic>salt -- multiple vulnerabilities in salt-master process</topic>
 <affects>
 <package>
	<name>py27-salt</name>
	<name>py32-salt</name>
	<name>py33-salt</name>
	<name>py34-salt</name>
	<name>py35-salt</name>
	<name>py36-salt</name>
	<name>py37-salt</name>
	<name>py38-salt</name>
	<range><lt>2019.2.4</lt></range>
	<range><ge>3000</ge><lt>3000.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	F-Secure reports:
	<blockquote cite="https://labs.f-secure.com/advisories/saltstack-authorization-bypass">
	 <h3>CVE-2020-11651 - Authentication bypass vulnerabilities</h3>
	 The ClearFuncs class processes unauthenticated requests and
	 unintentionally exposes the _send_pub() method, which can be used to
	 queue messages directly on the master publish server. Such messages
	 can be used to trigger minions to run arbitrary commands as root.
	 The ClearFuncs class also exposes the method _prep_auth_info(),
	 which returns the "root key" used to authenticate commands from the
	 local root user on the master server. This "root key" can then be
	 used to remotely call administrative commands on the master server.
	 This unintentional exposure provides a remote un-authenticated
	 attacker with root-equivalent access to the salt master.
	 
	 <h3>CVE-2020-11652 - Directory traversal vulnerabilities</h3>
	 The wheel module contains commands used to read and write files
	 under specific directory paths. The inputs to these functions are
	 concatenated with the target directory and the resulting path is not
	 canonicalized, leading to an escape of the intended path restriction.
	 The get_token() method of the salt.tokens.localfs class (which is
	 exposed to unauthenticated requests by the ClearFuncs class) fails
	 to sanitize the token input parameter which is then used as a
	 filename, allowing insertion of ".." path elements and thus reading
	 of files outside of the intended directory. The only restriction is
	 that the file has to be deserializable by salt.payload.Serial.loads().
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-11651</cvename>
 <cvename>CVE-2020-11652</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-11651</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-11652</url>
 <url>https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html</url>
 <url>https://labs.f-secure.com/advisories/saltstack-authorization-bypass</url>
 <url>https://blog.f-secure.com/new-vulnerabilities-make-exposed-salt-hosts-easy-targets/</url>
 <url>https://www.tenable.com/blog/cve-2020-11651-cve-2020-11652-critical-salt-framework-vulnerabilities-exploited-in-the-wild</url>
 </references>
 <dates>
 <discovery>2020-04-30</discovery>
 <entry>2020-05-16</entry>
 </dates>
 </vuln>

<vuln vid="abc3ef37-95d4-11ea-9004-25fadb81abf4">
 <topic>json-c -- integer overflow and out-of-bounds write via a large JSON file</topic>
 <affects>
 <package>
	<name>json-c</name>
	<range><lt>0.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tobias Stöckmann reports:
	<blockquote cite="https://github.com/json-c/json-c/pull/592">
	 
	 I have discovered a way to trigger an out of boundary write while
	 parsing a huge json file through a malicious input source. It can be
	 triggered if an attacker has control over the input stream or if a
	 huge load during filesystem operations can be triggered.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/json-c/json-c/pull/592</url>
 <url>https://github.com/json-c/json-c/pull/599</url>
 <cvename>CVE-2020-12762</cvename>
 </references>
 <dates>
 <discovery>2020-05-02</discovery>
 <entry>2020-05-14</entry>
 <modified>2020-05-17</modified>
 </dates>
 </vuln>

<vuln vid="59fabdf2-9549-11ea-9448-08002728f74c">
 <topic>typo3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>typo3-9-php72</name>
	<name>typo3-9-php73</name>
	<name>typo3-9-php74</name>
	<range><lt>9.5.17</lt></range>
 </package>
 <package>
	<name>typo3-10-php72</name>
	<name>typo3-10-php73</name>
	<name>typo3-10-php74</name>
	<range><lt>10.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Typo3 News:
	<blockquote cite="https://typo3.org/article/typo3-1042-and-9517-security-releases-published">
	 CVE-2020-11063: TYPO3-CORE-SA-2020-001: Information Disclosure in
	 Password Reset
	 It has been discovered that time-based attacks can be used with the
	 password reset functionality for backend users. This allows an attacker
	 to verify whether a backend user account with a given email address
	 exists or not.
	 
	 CVE-2020-11064: TYPO3-CORE-SA-2020-002: Cross-Site Scripting in Form
	 Engine
	 It has been discovered that HTML placeholder attributes containing
	 data of other database records are vulnerable to cross-site scripting. A
	 valid backend user account is needed to exploit this vulnerability.
	 
	 CVE-2020-11065: TYPO3-CORE-SA-2020-003: Cross-Site Scripting in Link
	 Handling
	 It has been discovered that link tags generated by typolink
	 functionality are vulnerable to cross-site scripting - properties being
	 assigned as HTML attributes have not been parsed correctly.
	 
	 CVE-2020-11066: TYPO3-CORE-SA-2020-004: Class destructors causing
	 side-effects when being unserialized
	 Calling unserialize() on malicious user-submitted content can result
	 in the following scenarios:
	 - trigger deletion of arbitrary directory in file system (if writable
	 for web server)
	 - trigger message submission via email using identity of web site
	 (mail relay)
	 Another insecure deserialization vulnerability is required to actually
	 exploit mentioned aspects.
	 
	 CVE-2020-11067: TYPO3-CORE-SA-2020-005: Insecure Deserialization in
	 Backend User Settings
	 It has been discovered that backend user settings (in $BE_USER-&gt;uc) are
	 vulnerable to insecure deserialization. In combination with
	 vulnerabilities of 3rd party components this can lead to remote code
	 execution. A valid backend user account is needed to exploit this
	 vulnerability.
	 
	 CVE-2020-11069: TYPO3-CORE-SA-2020-006: Same-Site Request Forgery to
	 Backend User Interface
	 It has been discovered that the backend user interface and install tool
	 are vulnerable to same-site request forgery. A backend user can be
	 tricked into interacting with a malicious resource an attacker
	 previously managed to upload to the web server - scripts are then
	 executed with the privileges of the victims’ user session.
	 In a worst case scenario new admin users can be created which can
	 directly be used by an attacker. The vulnerability is basically a
	 cross-site request forgery (CSRF) triggered by a cross-site scripting
	 vulnerability (XSS) - but happens on the same target host - thus, it’
	 actually a same-site request forgery (SSRF).
	 Malicious payload such as HTML containing JavaScript might be provided
	 by either an authenticated backend user or by a non-authenticated user
	 using a 3rd party extension - e.g. file upload in a contact form with
	 knowing the target location.
	 The attacked victim requires an active and valid backend or install
	 tool user session at the time of the attack to be successful.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://typo3.org/article/typo3-1042-and-9517-security-releases-published</url>
 <url>https://get.typo3.org/release-notes/9.5.17</url>
 <url>https://get.typo3.org/release-notes/10.4.2</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2020-001</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2020-002</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2020-003</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2020-004</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2020-005</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2020-006</url>
 <cvename>CVE-2020-11063</cvename>
 <cvename>CVE-2020-11064</cvename>
 <cvename>CVE-2020-11065</cvename>
 <cvename>CVE-2020-11066</cvename>
 <cvename>CVE-2020-11067</cvename>
 <cvename>CVE-2020-11069</cvename>
 </references>
 <dates>
 <discovery>2020-05-12</discovery>
 <entry>2020-05-13</entry>
 </dates>
 </vuln>

<vuln vid="0bfcae0b-947f-11ea-92ab-00163e433440">
 <topic>FreeBSD -- Insufficient cryptodev MAC key length check</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Requests to create cryptography sessions using a MAC did not validate the
	user-supplied MAC key length. The cryptodev module allocates a buffer whose
	size is this user-suppled length.
	<h1>Impact:</h1>
	An unprivileged process can trigger a kernel panic.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-15879</cvename>
 <freebsdsa>SA-20:15.cryptodev</freebsdsa>
 </references>
 <dates>
 <discovery>2020-01-20</discovery>
 <entry>2020-05-12</entry>
 </dates>
 </vuln>

<vuln vid="9f15c2da-947e-11ea-92ab-00163e433440">
 <topic>FreeBSD -- Use after free in cryptodev module</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_5</lt></range>
	<range><ge>11.3</ge><lt>11.3_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A race condition permitted a data structure in the kernel to be used
	after it was freed by the cryptodev module.
	<h1>Impact:</h1>
	An unprivileged process can overwrite arbitrary kernel memory.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-15879</cvename>
 <freebsdsa>SA-20:15.cryptodev</freebsdsa>
 </references>
 <dates>
 <discovery>2020-01-20</discovery>
 <entry>2020-05-12</entry>
 </dates>
 </vuln>

<vuln vid="253486f5-947d-11ea-92ab-00163e433440">
 <topic>FreeBSD -- Improper checking in SCTP-AUTH shared key update</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.3</ge><lt>11.3_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The SCTP layer does improper checking when an application tries to update
	a shared key. Therefore an unprivileged local user can trigger a use-after-
	free situation, for example by specific sequences of updating shared keys and
	closing the SCTP association.
	<h1>Impact:</h1>
	Triggering the use-after-free situation may result in unintended kernel
	behaviour including a kernel panic.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-15878</cvename>
 <freebsdsa>SA-20:14.sctp</freebsdsa>
 </references>
 <dates>
 <discovery>2019-09-19</discovery>
 <entry>2020-05-12</entry>
 </dates>
 </vuln>

<vuln vid="78992249-947c-11ea-92ab-00163e433440">
 <topic>FreeBSD -- Memory disclosure vulnerability in libalias</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_5</lt></range>
	<range><ge>11.4</ge><lt>11.4_1</lt></range>
	<range><ge>11.3</ge><lt>11.3_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The FTP packet handler in libalias incorrectly calculates some packet
	lengths. This may result in disclosing small amounts of memory from the
	kernel (for the in-kernel NAT implementation) or from the process space for
	natd (for the userspace implementation).
	<h1>Impact:</h1>
	A malicious attacker could send specially constructed packets that exploit the
	erroneous calculation allowing the attacker to disclose small amount of memory
	either from the kernel (for the in-kernel NAT implementation) or from the
	process space for natd (for the userspace implementation).
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7455</cvename>
 <freebsdsa>SA-20:13.libalias</freebsdsa>
 </references>
 <dates>
 <discovery>2020-05-12</discovery>
 <entry>2020-05-12</entry>
 </dates>
 </vuln>

<vuln vid="30ce591c-947b-11ea-92ab-00163e433440">
 <topic>FreeBSD -- Insufficient packet length validation in libalias</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_5</lt></range>
	<range><ge>11.4</ge><lt>11.4_1</lt></range>
	<range><ge>11.3</ge><lt>11.3_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	libalias(3) packet handlers do not properly validate the packet length before
	accessing the protocol headers. As a result, if a libalias(3) module does
	not properly validate the packet length before accessing the protocol header,
	it is possible for an out of bound read or write condition to occur.
	<h1>Impact:</h1>
	A malicious attacker could send specially constructed packets that exploit
	the lack of validation allowing the attacker to read or write memory either
	from the kernel (for the in-kernel NAT implementation) or from the process
	space for natd (for the userspace implementation).
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7454</cvename>
 <freebsdsa>SA-20:12.libalias</freebsdsa>
 </references>
 <dates>
 <discovery>2020-05-12</discovery>
 <entry>2020-05-12</entry>
 </dates>
 </vuln>

<vuln vid="452d16bb-920d-11ea-9d20-18a6f7016652">
 <topic>qutebrowser -- Reloading page with certificate errors shows a green URL</topic>
 <affects>
 <package>
	<name>qutebrowser</name>
	<range><lt>1.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Qutebrowser developers report:
	<blockquote cite="https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-4rcq-jv2f-898j">
	 After a certificate error was overridden by the user,
	 qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg).
	 However, when the affected website was subsequently loaded again,
	 the URL was mistakenly displayed as green (colors.statusbar.url.success_https).
	 While the user already has seen a certificate error prompt at this point
	 (or set content.ssl_strict to false which is not recommended),
	 this could still provide a false sense of security.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-4rcq-jv2f-898j</url>
 <url>https://github.com/qutebrowser/qutebrowser/issues/5403</url>
 <cvename>CVE-2020-11054</cvename>
 </references>
 <dates>
 <discovery>2020-05-02</discovery>
 <entry>2020-05-09</entry>
 </dates>
 </vuln>

<vuln vid="ca595a25-91d8-11ea-b470-080027846a02">
 <topic>Python -- CRLF injection via the host part of the url passed to urlopen()</topic>
 <affects>
 <package>
	<name>python27</name>
	<range><lt>2.7.18</lt></range>
 </package>
 <package>
	<name>python38</name>
	<range><lt>3.8.3</lt></range>
 </package>
 <package>
	<name>python37</name>
	<range><le>3.7.7</le></range>
 </package>
 <package>
	<name>python36</name>
	<range><lt>3.6.10</lt></range>
 </package>
 <package>
	<name>python35</name>
	<range><le>3.5.9_4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18348">
	 An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x
	 through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as
	 demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in
	 the host component of a URL) followed by an HTTP header.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18348</url>
 <url>https://bugs.python.org/issue38576</url>
 <cvename>CVE-2019-18348</cvename>
 </references>
 <dates>
 <discovery>2019-10-24</discovery>
 <entry>2020-05-09</entry>
 <modified>2020-06-13</modified>
 </dates>
 </vuln>

<vuln vid="d222241d-91cc-11ea-82b8-4c72b94353b5">
 <topic>glpi -- stored XSS</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>9.4.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Corporation reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13239">
	 inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/glpi-project/glpi/commit/c2aa7a7cd6af28be3809acc7e7842d2d2008c0fb</url>
 <url>https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_stored_XSS.pdf</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13239</url>
 <cvename>CVE-2019-13239</cvename>
 </references>
 <dates>
 <discovery>2019-02-25</discovery>
 <entry>2020-05-09</entry>
 <modified>2024-04-25</modified>
 </dates>
 </vuln>

<vuln vid="1a6b7641-aed2-4ba1-96f4-c282d5b09c37">
 <topic>zeek -- Various vulnerabilities</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>3.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jon Siwek of Corelight reports:
	<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/v3.0.6/NEWS">
	 This release fixes the following security issues:
	 <ul>
	 <li>
	 Fix buffer over-read in Ident analyzer </li>
	 <li>
	 Fix SSL scripting error leading to uninitialized field
	 access and memory leak </li>
	 <li>
	 Fix POP3 analyzer global buffer over-read </li>
	 <li>
	 Fix potential stack overflows due to use of
	 Variable-Length-Arrays </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://raw.githubusercontent.com/zeek/zeek/v3.0.6/NEWS</url>
 </references>
 <dates>
 <discovery>2020-05-06</discovery>
 <entry>2020-05-06</entry>
 </dates>
 </vuln>

<vuln vid="d5fead4f-8efa-11ea-a5c8-08002728f74c">
 <topic>Wagtail -- potential timing attack vulnerability</topic>
 <affects>
 <package>
	<name>py35-wagtail</name>
	<name>py36-wagtail</name>
	<name>py37-wagtail</name>
	<name>py38-wagtail</name>
	<range><lt>2.7.3</lt></range>
	<range><ge>2.8</ge><lt>2.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wagtail release notes:
	<blockquote cite="https://docs.wagtail.io/en/latest/releases/2.8.2.html">
	 CVE-2020-11037: Potential timing attack on password-protected private pages
	 This release addresses a potential timing attack on pages or documents
	 that have been protected with a shared password through Wagtail's
	 "Privacy" controls. This password check is performed through a
	 character-by-character string comparison, and so an attacker who is
	 able to measure the time taken by this check to a high degree of
	 accuracy could potentially use timing differences to gain knowledge of
	 the password. (This is understood to be feasible on a local network, but
	 not on the public internet.)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.wagtail.io/en/latest/releases/2.8.2.html</url>
 <url>https://github.com/wagtail/wagtail/security/advisories/GHSA-jjjr-3jcw-f8v6</url>
 <cvename>CVE-2020-11037</cvename>
 </references>
 <dates>
 <discovery>2020-05-04</discovery>
 <entry>2020-05-05</entry>
 </dates>
 </vuln>

<vuln vid="88760f4d-8ef7-11ea-a66d-4b2ef158be83">
 <topic>mailman -- arbitrary content injection vulnerability via options or private archive login pages</topic>
 <affects>
 <package>
	<name>mailman</name>
	<range><lt>2.1.30_4</lt></range>
	<range><ge>2.1.31</ge><lt>2.1.33</lt></range>
 </package>
 <package>
	<name>mailman-with-htdig</name>
	<range><lt>2.1.30_4</lt></range>
	<range><ge>2.1.31</ge><lt>2.1.33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mark Sapiro reports:
	<blockquote cite="https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/1845/NEWS#L8">
	 A content injection vulnerability via the options login page has
	 been discovered and reported by Vishal Singh.
	 
	</blockquote>
	<blockquote cite="https://bugs.launchpad.net/mailman/+bug/1873722">
	 
	 An issue similar to CVE-2018-13796 exists at different endpoint &amp; param. It can lead to a phishing attack.
	 
	</blockquote>
	<blockquote cite="https://bugs.launchpad.net/mailman/+bug/1877379">
	 
	 (added 2020-05-07) This is essentially the same as
	 https://bugs.launchpad.net/mailman/+bug/1873722 except the vector is
	 the private archive login page and the attack only succeeds if the
	 list's roster visibility (private_roster) setting is 'Anyone'.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/1845/NEWS#L8</url>
 <url>https://bugs.launchpad.net/mailman/+bug/1873722</url>
 <url>https://bugs.launchpad.net/mailman/+bug/1877379</url>
 <url>https://mail.python.org/archives/list/mailman-developers@python.org/thread/SYBIZ3MNSQZLKN6PVKO7ZKR7QMOBMS45/</url>
 <cvename>CVE-2018-13796</cvename>
 </references>
 <dates>
 <discovery>2020-04-20</discovery>
 <entry>2020-05-07</entry>
 </dates>
 </vuln>

<vuln vid="cd864f1a-8e5a-11ea-b5b4-641c67a117d8">
 <topic>cacti -- XSS exposure</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>1.2.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cacti developer reports:
	<blockquote cite="https://sourceforge.net/p/cacti/mailman/message/37000502/">
	 Lack of escaping of color items can lead to XSS exposure.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://sourceforge.net/p/cacti/mailman/message/37000502/</url>
 <url>https://github.com/Cacti/cacti/blob/release/1.2.12/CHANGELOG</url>
 <cvename>CVE-2020-7106</cvename>
 <freebsdpr>ports/246164</freebsdpr>
 </references>
 <dates>
 <discovery>2020-04-16</discovery>
 <entry>2020-05-04</entry>
 </dates>
 </vuln>

<vuln vid="57c1c2ee-7914-11ea-90bf-0800276545c1">
 <topic>Squid -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>4.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Squid developers reports:
	<blockquote cite="http://lists.squid-cache.org/pipermail/squid-announce/2020-February/000107.html">
	 Improper Input Validation issues in HTTP Request
	 processing (CVE-2020-8449, CVE-2020-8450).
	 Information Disclosure issue in FTP Gateway
	 (CVE-2019-12528).
	 Buffer Overflow issue in ext_lm_group_acl helper
	 (CVE-2020-8517).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.squid-cache.org/pipermail/squid-announce/2020-February/000107.html</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-8449</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-8450</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-12528</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-8517</url>
 <cvename>CVE-2020-8449</cvename>
 <cvename>CVE-2020-8450</cvename>
 <cvename>CVE-2019-12528</cvename>
 <cvename>CVE-2020-8517</cvename>
 <freebsdpr>ports/244026</freebsdpr>
 </references>
 <dates>
 <discovery>2020-02-10</discovery>
 <entry>2020-04-07</entry>
 </dates>
 </vuln>

<vuln vid="d3f3e818-8d10-11ea-8668-e0d55e2a8bf9">
 <topic>taglib -- heap-based buffer over-read via a crafted audio file</topic>
 <affects>
 <package>
	<name>taglib</name>
	<range><lt>1.12.b.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Webin security lab - dbapp security Ltd reports:
	<blockquote cite="https://seclists.org/fulldisclosure/2018/May/49">
	 The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted audio file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://seclists.org/fulldisclosure/2018/May/49</url>
 <cvename>CVE-2018-11439</cvename>
 </references>
 <dates>
 <discovery>2018-05-28</discovery>
 <entry>2020-05-03</entry>
 </dates>
 </vuln>

<vuln vid="e8483115-8b8e-11ea-bdcf-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.10.0</ge><lt>12.10.2</lt></range>
	<range><ge>12.9.0</ge><lt>12.9.5</lt></range>
	<range><ge>8.4.0</ge><lt>12.8.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/04/30/security-release-12-10-2-released/">
	 Path Traversal in NuGet Package Registry
	 Workhorse Bypass Leads to File Disclosure
	 OAuth Application Client Secrets Revealed
	 Code Owners Approval Rules Are Not Updated for Existing Merge Requests When Source Branch Changes
	 Code Owners Protection Not Enforced from Web UI
	 Repository Mirror Passwords Exposed To Maintainers
	 Admin Audit Log Page Denial of Service
	 Private Project ID Revealed Through Group API
	 Elasticsearch Credentials Logged to ELK
	 GitHub Personal Access Token Exposed on Integrations Page
	 Update Nokogiri dependency
	 Update OpenSSL Dependency
	 Update git
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/04/30/security-release-12-10-2-released/</url>
 <cvename>CVE-2020-12448</cvename>
 <cvename>CVE-2020-10187</cvename>
 <cvename>CVE-2020-7595</cvename>
 <cvename>CVE-2020-1967</cvename>
 <cvename>CVE-2020-11008</cvename>
 </references>
 <dates>
 <discovery>2020-04-30</discovery>
 <entry>2020-05-01</entry>
 </dates>
 </vuln>

<vuln vid="4a10902f-8a48-11ea-8668-e0d55e2a8bf9">
 <topic>vlc -- Multiple vulnerabilities fixed in VLC media player</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><lt>3.0.10,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	VideoLAN reports:
	<blockquote cite="https://www.videolan.org/security/sb-vlc309.html">
	 <h3>Details</h3>
	 A remote user could:
	 <ul>
	 <li> Create a specifically crafted image file that could trigger an out of bounds read </li>
	 <li> Send a specifically crafter request to the microdns service discovery, potentially triggering various memory management issues</li>
	 </ul>
	<h3>Impact</h3>
 
If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user.
	
	 While these issues in themselves are most likely to just crash the player, we can't exclude that they could be combined to leak user informations or remotely execute code. ASLR and DEP help reduce the likelyness of code execution, but may be bypassed.
	
	 We have not seen exploits performing code execution through these vulnerabilities
	 CVE-2019-19721 affects VLC 3.0.8 and earlier, and only reads 1 byte out of bound
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.videolan.org/security/sb-vlc309.html</url>
 </references>
 <dates>
 <discovery>2020-04-01</discovery>
 <entry>2020-04-29</entry>
 </dates>
 </vuln>

<vuln vid="3c7911c9-8a29-11ea-8d8c-005056a311d1">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba410</name>
	<range><lt>4.10.15</lt></range>
 </package>
 <package>
	<name>samba411</name>
	<range><lt>4.11.8</lt></range>
 </package>
 <package>
	<name>samba412</name>
	<range><lt>4.12.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="https://www.samba.org/samba/history/samba-4.12.2.html">
	 CVE-2020-10700
	 A client combining the 'ASQ' and 'Paged Results' LDAP controls can cause a
	 use-after-free in Samba's AD DC LDAP server.
	 CVE-2020-10704
	 A deeply nested filter in an un-authenticated LDAP search can exhaust the
	 LDAP server's stack memory causing a SIGSEGV.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/history/samba-4.12.2.html</url>
 <cvename>CVE-2020-10700</cvename>
 <cvename>CVE-2020-10704</cvename>
 </references>
 <dates>
 <discovery>2020-04-29</discovery>
 <entry>2020-04-29</entry>
 </dates>
 </vuln>

<vuln vid="5b6bc863-89dc-11ea-af8b-00155d0a0200">
 <topic>ceph14 -- multiple security issues</topic>
 <affects>
 <package>
	<name>ceph14</name>
	<range><gt>14.1.1</gt><lt>14.2.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RedHat reports:
	<blockquote cite="https://access.redhat.com/security/cve/cve-2020-1759">
	 ceph: secure mode of msgr2 breaks both confidentiality and integrity aspects for long-lived sessions.
	</blockquote>
	<blockquote cite="https://access.redhat.com/security/cve/cve-2020-1760">
	 ceph: header-splitting in RGW GetObject has a possible XSS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-1759</cvename>
 <url>https://www.openwall.com/lists/oss-security/2020/04/07/2</url>
 <cvename>CVE-2020-1760</cvename>
 <url>https://www.openwall.com/lists/oss-security/2020/04/07/1</url>
 </references>
 <dates>
 <discovery>2020-04-07</discovery>
 <entry>2020-04-14</entry>
 </dates>
 </vuln>

<vuln vid="c7617931-8985-11ea-93ef-b42e99a1b9c3">
 <topic>nested filters leads to stack overflow</topic>
 <affects>
 <package>
	<name>openldap24-server</name>
	<range><lt>2.4.50</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Howard Chu reports:
	<blockquote cite="https://bugs.openldap.org/show_bug.cgi?id=9202">
	 nested filters leads to stack overflow
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.openldap.org/show_bug.cgi?id=9202</url>
 <cvename>CVE-2020-12243</cvename>
 </references>
 <dates>
 <discovery>2020-04-28</discovery>
 <entry>2020-04-28</entry>
 </dates>
 </vuln>

<vuln vid="aae8fecf-888e-11ea-9714-08002718de91">
 <topic>py-yaml -- FullLoader (still) exploitable for arbitrary command execution</topic>
 <affects>
 <package>
	<name>py27-yaml</name>
	<name>py35-yaml</name>
	<name>py36-yaml</name>
	<name>py37-yaml</name>
	<name>py38-yaml</name>
	<range><lt>5.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Riccardo Schirone (https://github.com/ret2libc) reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1807367">
	 In FullLoader python/object/new constructor, implemented by
	 construct_python_object_apply, has support for setting the
	 state of a deserialized instance through the set_python_instance_state
	 method. After setting the state, some operations are performed
	 on the instance to complete its initialization, however it is
	 possible for an attacker to set the instance' state in such a way
	 that arbitrary code is executed by the FullLoader.
	 This patch tries to block such attacks in FullLoader by
	 preventing set_python_instance_state from setting arbitrar
	 properties. It implements a blacklist that includes extend method
	 (called by construct_python_object_apply) and all special
	 methods (e.g. __set__, __setitem__, etc.).
	 Users who need special attributes being set in the state of a
	 deserialized object can still do it through the UnsafeLoader, which
	 however should not be used on untrusted input. Additionally, they can
	 subclass FullLoader and redefine state_blacklist_regexp to include the
	 additional attributes they need, passing the subclassed loader to
	 yaml.load.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1807367</url>
 <url>https://github.com/yaml/pyyaml/pull/386</url>
 <cvename>CVE-2020-1747</cvename>
 <freebsdpr>ports/245937</freebsdpr>
 </references>
 <dates>
 <discovery>2020-03-02</discovery>
 <entry>2020-04-27</entry>
 <modified>2020-04-29</modified>
 </dates>
 </vuln>

<vuln vid="4c52ec3c-86f3-11ea-b5b4-641c67a117d8">
 <topic>py-bleach -- regular expression denial-of-service</topic>
 <affects>
 <package>
	<name>py27-bleach</name>
	<name>py35-bleach</name>
	<name>py36-bleach</name>
	<name>py37-bleach</name>
	<name>py38-bleach</name>
	<range><lt>3.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bleach developers reports:
	<blockquote cite="https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm">
	 bleach.clean behavior parsing style attributes could result in a
	 regular expression denial of service (ReDoS).
	 Calls to bleach.clean with an allowed tag with an allowed style
	 attribute are vulnerable to ReDoS. For example, bleach.clean(...,
	 attributes={'a': ['style']}).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1623633</url>
 <cvename>CVE-2020-6817</cvename>
 <freebsdpr>ports/245943</freebsdpr>
 </references>
 <dates>
 <discovery>2019-03-09</discovery>
 <entry>2020-04-26</entry>
 </dates>
 </vuln>

<vuln vid="21d59ea3-8559-11ea-a5e2-d4c9ef517024">
 <topic>MySQL Server -- Multiple vulerabilities</topic>
 <affects>
 <package>
	<name>mariadb101-server</name>
	<range><lt>10.1.45</lt></range>
 </package>
 <package>
	<name>mariadb102-server</name>
	<range><lt>10.2.32</lt></range>
 </package>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.23</lt></range>
 </package>
 <package>
	<name>mariadb104-server</name>
	<range><lt>10.4.13</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.48</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.30</lt></range>
 </package>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.20</lt></range>
 </package>
 <package>
	<name>percona55-server</name>
	<range><lt>5.5.68</lt></range>
 </package>
 <package>
	<name>percona56-server</name>
	<range><lt>5.6.48</lt></range>
 </package>
 <package>
	<name>percona57-server</name>
	<range><lt>5.7.30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujan2020.html#AppendixMSQL">
	 This Critical Patch Update contains 45 new security patches for
	 Oracle MySQL. 9 of these vulnerabilities may be remotely exploitable
	 without authentication, i.e., may be exploited over a network without
	 requiring user credentials.
	 MariaDB reports 4 of these vulnerabilities exist in their software
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/security-alerts/cpujan2020.html</url>
 <cvename>CVE-2019-5482</cvename>
 <cvename>CVE-2019-15601</cvename>
 <cvename>CVE-2020-2780</cvename>
 <cvename>CVE-2020-2790</cvename>
 <cvename>CVE-2020-2768</cvename>
 <cvename>CVE-2020-2804</cvename>
 <cvename>CVE-2020-2760</cvename>
 <cvename>CVE-2020-2806</cvename>
 <cvename>CVE-2020-2762</cvename>
 <cvename>CVE-2020-2814</cvename>
 <cvename>CVE-2020-2893</cvename>
 <cvename>CVE-2020-2895</cvename>
 <cvename>CVE-2020-2898</cvename>
 <cvename>CVE-2020-2903</cvename>
 <cvename>CVE-2020-2896</cvename>
 <cvename>CVE-2020-2770</cvename>
 <cvename>CVE-2020-2765</cvename>
 <cvename>CVE-2020-2892</cvename>
 <cvename>CVE-2020-2897</cvename>
 <cvename>CVE-2020-2923</cvename>
 <cvename>CVE-2020-2924</cvename>
 <cvename>CVE-2020-2901</cvename>
 <cvename>CVE-2020-2928</cvename>
 <cvename>CVE-2020-2904</cvename>
 <cvename>CVE-2020-2925</cvename>
 <cvename>CVE-2020-2759</cvename>
 <cvename>CVE-2020-2763</cvename>
 <cvename>CVE-2020-2761</cvename>
 <cvename>CVE-2020-2774</cvename>
 <cvename>CVE-2020-2853</cvename>
 <cvename>CVE-2020-2779</cvename>
 <cvename>CVE-2020-2812</cvename>
 <cvename>CVE-2019-1547</cvename>
 <cvename>CVE-2020-2926</cvename>
 <cvename>CVE-2020-2921</cvename>
 <cvename>CVE-2020-2930</cvename>
 </references>
 <dates>
 <discovery>2020-04-14</discovery>
 <entry>2020-04-23</entry>
 <modified>2020-05-16</modified>
 </dates>
 </vuln>

<vuln vid="622b5c47-855b-11ea-a5e2-d4c9ef517024">
 <topic>MySQL Client -- Multiple vulerabilities</topic>
 <affects>
 <package>
	<name>mysql56-client</name>
	<range><lt>5.6.48</lt></range>
 </package>
 <package>
	<name>mysql57-client</name>
	<range><lt>5.7.30</lt></range>
 </package>
 <package>
	<name>mysql80-client</name>
	<range><lt>8.0.20</lt></range>
 </package>
 <package>
	<name>mysql-connector-c</name>
	<range><lt>8.0.20</lt></range>
 </package>
 <package>
	<name>mysql-connector-c++</name>
	<range><lt>8.0.20</lt></range>
 </package>
 <package>
	<name>mysql-connector-java</name>
	<range><lt>8.0.20</lt></range>
 </package>
 <package>
	<name>percona55-client</name>
	<range><lt>5.5.68</lt></range>
 </package>
 <package>
	<name>percona56-client</name>
	<range><lt>5.6.48</lt></range>
 </package>
 <package>
	<name>percona57-client</name>
	<range><lt>5.7.30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujan2020.html#AppendixMSQL">
	 This Critical Patch Update contains 45 new security patches for
	 Oracle MySQL. 9 of these vulnerabilities may be remotely exploitable
	 without authentication, i.e., may be exploited over a network without
	 requiring user credentials.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/security-alerts/cpujan2020.html</url>
 <cvename>CVE-2020-2752</cvename>
 <cvename>CVE-2020-2934</cvename>
 <cvename>CVE-2020-2875</cvename>
 <cvename>CVE-2020-2922</cvename>
 <cvename>CVE-2020-2933</cvename>
 </references>
 <dates>
 <discovery>2020-04-14</discovery>
 <entry>2020-04-23</entry>
 </dates>
 </vuln>

<vuln vid="afa018d9-8557-11ea-a5e2-d4c9ef517024">
 <topic>Nextcloud -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>nextcloud</name>
	<range><lt>18.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nextcloud reports:
	<blockquote cite="https://nextcloud.com/security/advisories/">
	 XSS in Files PDF viewer (NC-SA-2020-019)
	 Missing ownership check on remote wipe endpoint (NC-SA-2020-018)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nextcloud.com/security/advisories/</url>
 <url>https://nextcloud.com/security/advisory/?id=NC-SA-2020-018</url>
 <url>https://nextcloud.com/security/advisory/?id=NC-SA-2020-019</url>
 </references>
 <dates>
 <discovery>2020-03-18</discovery>
 <entry>2020-04-23</entry>
 </dates>
 </vuln>

<vuln vid="a27b0bb6-84fc-11ea-b5b4-641c67a117d8">
 <topic>Python -- Regular Expression DoS attack against client</topic>
 <affects>
 <package>
	<name>python38</name>
	<range><lt>3.8.3</lt></range>
 </package>
 <package>
	<name>python37</name>
	<range><le>3.7.7</le></range>
 </package>
 <package>
	<name>python36</name>
	<range><lt>3.6.10</lt></range>
 </package>
 <package>
	<name>python35</name>
	<range><le>3.5.9_4</le></range>
 </package>
 <package>
	<name>python27</name>
	<range><lt>2.7.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ben Caller and Matt Schwager reports:
	<blockquote cite="https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html">
	 Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7
	 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct
	 Regular Expression Denial of Service (ReDoS) attacks against a client
	 because of urllib.request.AbstractBasicAuthHandler catastrophic
	 backtracking.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html</url>
 <url>https://bugs.python.org/issue39503</url>
 <cvename>CVE-2020-8492</cvename>
 <freebsdpr>ports/245819</freebsdpr>
 </references>
 <dates>
 <discovery>2019-11-17</discovery>
 <entry>2020-04-23</entry>
 <modified>2020-06-13</modified>
 </dates>
 </vuln>

<vuln vid="8d85d600-84a9-11ea-97b9-08002728f74c">
 <topic>Wagtail -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>py35-wagtail</name>
	<name>py36-wagtail</name>
	<name>py37-wagtail</name>
	<name>py38-wagtail</name>
	<range><lt>2.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wagtail release notes:
	<blockquote cite="https://docs.wagtail.io/en/latest/releases/2.7.2.html">
	 CVE-2020-11001: Possible XSS attack via page revision comparison view
	 This release addresses a cross-site scripting (XSS) vulnerability on
	 the page revision comparison view within the Wagtail admin interface. A
	 user with a limited-permission editor account for the Wagtail admin
	 could potentially craft a page revision history that, when viewed by a
	 user with higher privileges, could perform actions with that user
	 credentials. The vulnerability is not exploitable by an ordinary site
	 visitor without access to the Wagtail admin.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.wagtail.io/en/latest/releases/2.7.2.html</url>
 <url>https://github.com/advisories/GHSA-v2wc-pfq2-5cm6</url>
 <cvename>CVE-2020-11001</cvename>
 </references>
 <dates>
 <discovery>2020-04-03</discovery>
 <entry>2020-04-22</entry>
 </dates>
 </vuln>

<vuln vid="0f798bd6-8325-11ea-9a78-08002728f74c">
 <topic>libntlm -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>libntlm</name>
	<range><lt>1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-17455">
	 Libntlm through 1.5 relies on a fixed buffer size for
	 tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse
	 read and write operations, as demonstrated by a stack-based buffer
	 over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM
	 request.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://gitlab.com/jas/libntlm/-/issues/2</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-17455</url>
 <cvename>CVE-2019-17455</cvename>
 </references>
 <dates>
 <discovery>2019-10-08</discovery>
 <entry>2020-04-21</entry>
 </dates>
 </vuln>

<vuln vid="012809ce-83f3-11ea-92ab-00163e433440">
 <topic>OpenSSL remote denial of service vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.1</ge><lt>12.1_4</lt></range>
 </package>
 <package>
	<name>openssl</name>
	<range><ge>1.1.1,1</ge><lt>1.1.1g,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Server or client applications that call the SSL_check_chain()
	function during or after a TLS 1.3 handshake may crash due to a NULL
	pointer dereference as a result of incorrect handling of the
	"signature_algorithms_cert" TLS extension. The crash occurs if an
	invalid or unrecognized signature algorithm is received from the
	peer.
	<h1>Impact:</h1>
	A malicious peer could exploit the NULL pointer dereference crash,
	causing a denial of service attack.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-1967</cvename>
 <freebsdsa>SA-20:11.openssl</freebsdsa>
 <url>https://www.openssl.org/news/secadv/20200421.txt</url>
 </references>
 <dates>
 <discovery>2020-04-21</discovery>
 <entry>2020-04-21</entry>
 <modified>2020-04-22</modified>
 </dates>
 </vuln>

<vuln vid="33edcc56-83f2-11ea-92ab-00163e433440">
 <topic>FreeBSD -- ipfw invalid mbuf handling</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_4</lt></range>
	<range><ge>11.3</ge><lt>11.3_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Incomplete packet data validation may result in accessing
	out-of-bounds memory (CVE-2019-5614) or may access memory after it has
	been freed (CVE-2019-15874).
	<h1>Impact:</h1>
	Access to out of bounds or freed mbuf data can lead to a kernel panic or
	other unpredictable results.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5614</cvename>
 <cvename>CVE-2019-15874</cvename>
 <freebsdsa>SA-20:10.ipfw</freebsdsa>
 </references>
 <dates>
 <discovery>2020-04-21</discovery>
 <entry>2020-04-21</entry>
 </dates>
 </vuln>

<vuln vid="9fbaefb3-837e-11ea-b5b4-641c67a117d8">
 <topic>py-twisted -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-twisted</name>
	<name>py35-twisted</name>
	<name>py36-twisted</name>
	<name>py37-twisted</name>
	<name>py38-twisted</name>
	<range><lt>20.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Twisted developers reports:
	<blockquote cite="https://github.com/twisted/twisted/blob/twisted-20.3.0/NEWS.rst">
	All HTTP clients in twisted.web.client now raise a ValueError when
	called with a method and/or URL that contain invalid characters. This
	mitigates CVE-2019-12387. Thanks to Alex Brasetvik for reporting this
	vulnerability.
	The HTTP/2 server implementation now enforces TCP flow control on
	control frame messages and times out clients that send invalid data
	without reading responses. This closes CVE-2019-9512 (Ping Flood),
	CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood). Thanks
	to Jonathan Looney and Piotr Sikora.
	twisted.web.http was subject to several request smuggling attacks.
	Requests with multiple Content-Length headers were allowed
	(CVE-2020-10108, thanks to Jake Miller from Bishop Fox and ZeddYu Lu
	for reporting this) and now fail with a 400; requests with a
	Content-Length header and a Transfer-Encoding header honored the first
	header (CVE-2020-10109, thanks to Jake Miller from Bishop Fox for
	reporting this) and now fail with a 400; requests whose
	Transfer-Encoding header had a value other than "chunked" and
	"identity" (thanks to ZeddYu Lu) were allowed and now fail with a 400.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/twisted/twisted/blob/twisted-20.3.0/NEWS.rst</url>
 <cvename>CVE-2019-12387</cvename>
 <cvename>CVE-2019-9512</cvename>
 <cvename>CVE-2019-9514</cvename>
 <cvename>CVE-2019-9515</cvename>
 <cvename>CVE-2020-10108</cvename>
 <cvename>CVE-2020-10109</cvename>
 <freebsdpr>ports/245252</freebsdpr>
 </references>
 <dates>
 <discovery>2019-03-01</discovery>
 <entry>2020-04-21</entry>
 </dates>
 </vuln>

<vuln vid="3d7dfd63-823b-11ea-b3a8-240a644dd835">
 <topic>Client/server denial of service when handling AES-CTR ciphers</topic>
 <affects>
 <package>
	<name>libssh</name>
	<range><ge>0.8.0</ge><lt>0.8.9</lt></range>
	<range><ge>0.9.0</ge><lt>0.9.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The libssh team reports (originally reported by Yasheng Yang from
	Google):
	<blockquote cite="https://www.libssh.org/security/advisories/CVE-2020-1730.txt">
	 A malicious client or server could crash the counterpart implemented
	 with libssh AES-CTR ciphers are used and don't get fully initialized. It
	 will crash when it tries to cleanup the AES-CTR ciphers when closing the
	 connection.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.libssh.org/security/advisories/CVE-2020-1730.txt"</url>
 <cvename>CVE-2020-1730</cvename>
 </references>
 <dates>
 <discovery>2020-01-25</discovery>
 <entry>2020-04-19</entry>
 </dates>
 </vuln>

<vuln vid="e418b8f0-9abb-420b-a7f1-1d8231b352e2">
 <topic>webkit2-gtk3 -- Denial of service</topic>
 <affects>
 <package>
	<name>webkit2-gtk3</name>
	<range><lt>2.28.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The WebKitGTK project reports the following vulnerability.
	<blockquote cite="https://webkitgtk.org/security/WSA-2020-0004.html">
	 Processing maliciously crafted web content may lead to arbitrary code execution or application crash (denial of service). Description: A memory corruption issue (use-after-free) was addressed with improved memory handling.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://webkitgtk.org/security/WSA-2020-0004.html</url>
 <cvename>CVE-2020-11793</cvename>
 </references>
 <dates>
 <discovery>2020-04-16</discovery>
 <entry>2020-04-18</entry>
 </dates>
 </vuln>

<vuln vid="e24fd421-8128-11ea-aa57-000ffec73f06">
 <topic>drupal -- Drupal Core - Moderately critical - Third-party library</topic>
 <affects>
 <package>
	<name>drupal8</name>
	<range><lt>8.8.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/sa-core-2020-001">
	 The Drupal project uses the third-party library CKEditor, which has
	 released a security improvement that is needed to protect some
	 Drupal configurations.
	 Vulnerabilities are possible if Drupal is configured to use the
	 WYSIWYG CKEditor for your site's users. An attacker that can createor
	 edit content may be able to exploit this Cross Site Scripting (XSS)
	 vulnerability to target users with access to the WYSIWYG CKEditor,
	 and this may include site admins with privileged access.
	 The latest versions of Drupal update CKEditor to 4.14 to mitigate
	 the vulnerabilities.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/sa-core-2020-001</url>
 </references>
 <dates>
 <discovery>2020-03-18</discovery>
 <entry>2020-04-17</entry>
 </dates>
 </vuln>

<vuln vid="ae2e7871-80f6-11ea-bafd-815569f3852d">
 <topic>ansible - Vault password leak from temporary file</topic>
 <affects>
 <package>
	<name>ansible</name>
	<range><lt>2.8.9</lt></range>
 </package>
 <package>
	<name>ansible27</name>
	<range><lt>2.7.17</lt></range>
 </package>
 <package>
	<name>ansible26</name>
	<range><lt>2.7.17</lt></range>
 </package>
 <package>
	<name>ansible25</name>
	<range><lt>2.7.17</lt></range>
 </package>
 <package>
	<name>ansible24</name>
	<range><lt>2.7.17</lt></range>
 </package>
 <package>
	<name>ansible23</name>
	<range><lt>2.7.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Borja Tarraso reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1740">
	A flaw was found in Ansible Engine when using Ansible Vault for editing
	 encrypted files. When a user executes "ansible-vault edit", another user
	 on the same computer can read the old and new secret, as it is created in
	 a temporary file with mkstemp and the returned file descriptor is closed
	 and the method write_data is called to write the existing secret in the
	 file. This method will delete the file before recreating it insecurely.
	 All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1740</url>
 <url>https://github.com/ansible/ansible/issues/67798</url>
 <cvename>CVE-2020-1740</cvename>
 </references>
 <dates>
 <discovery>2020-02-12</discovery>
 <entry>2020-04-17</entry>
 </dates>
 </vuln>

<vuln vid="67dbeeb6-80f4-11ea-bafd-815569f3852d">
 <topic>ansible - subversion password leak from PID</topic>
 <affects>
 <package>
	<name>ansible</name>
	<range><lt>2.8.9</lt></range>
 </package>
 <package>
	<name>ansible27</name>
	<range><lt>2.7.17</lt></range>
 </package>
 <package>
	<name>ansible26</name>
	<range><lt>2.7.17</lt></range>
 </package>
 <package>
	<name>ansible25</name>
	<range><lt>2.7.17</lt></range>
 </package>
 <package>
	<name>ansible24</name>
	<range><lt>2.7.17</lt></range>
 </package>
 <package>
	<name>ansible23</name>
	<range><lt>2.7.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Borja Tarraso reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1739">
	 A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5
	 and prior when a password is set with the argument "password" of svn module,
	 it is used on svn command line, disclosing to other users within the same
	 node. An attacker could take advantage by reading the cmdline file from that
	 particular PID on the procfs.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1739</url>
 <url>https://github.com/ansible/ansible/issues/67797</url>
 <url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/</url>
 <url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/</url>
 <url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/</url>
 <cvename>CVE-2020-1739</cvename>
 </references>
 <dates>
 <discovery>2020-02-12</discovery>
 <entry>2020-04-17</entry>
 </dates>
 </vuln>

<vuln vid="0899c0d3-80f2-11ea-bafd-815569f3852d">
 <topic>ansible - win_unzip path normalization</topic>
 <affects>
 <package>
	<name>ansible</name>
	<range><lt>2.8.9</lt></range>
 </package>
 <package>
	<name>ansible27</name>
	<range><lt>2.7.17</lt></range>
 </package>
 <package>
	<name>ansible26</name>
	<range><lt>2.7.17</lt></range>
 </package>
 <package>
	<name>ansible25</name>
	<range><lt>2.7.17</lt></range>
 </package>
 <package>
	<name>ansible24</name>
	<range><lt>2.7.17</lt></range>
 </package>
 <package>
	<name>ansible23</name>
	<range><lt>2.7.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Borja Tarraso reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737">
	 A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and
	 prior when using the Extract-Zip function from the win_unzip module as the
	 extracted file(s) are not checked if they belong to the destination folder. An
	 attacker could take advantage of this flaw by crafting an archive anywhere in
	 the file system, using a path traversal. This issue is fixed in 2.10.
	</blockquote>
 </body>
 </description>
 <references>
	 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737</url>
	 <url>https://github.com/ansible/ansible/issues/67795</url>
	 <url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/</url>
	 <url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/</url>
	 <url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/</url>
	 <cvename>CVE-2020-1737</cvename>
 </references>
 <dates>
 <discovery>2020-02-12</discovery>
 <entry>2020-04-17</entry>
 </dates>
 </vuln>

<vuln vid="25efe05c-7ffc-11ea-b594-3065ec8fd3ec">
 <topic>chromium -- use after free</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>81.0.4044.113</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_15.html">
	 [1067851] Critical CVE-2020-6457: Use after free in speech
	 recognizer. Reported by Leecraso and Guang Gong of Alpha Lab, Qihoo
	 360 on 2020-04-04
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_15.html</url>
 <cvename>CVE-2020-6457</cvename>
 </references>
 <dates>
 <discovery>2020-04-15</discovery>
 <entry>2020-04-16</entry>
 </dates>
 </vuln>

<vuln vid="8604121c-7fc2-11ea-bcac-7781e90b0c8f">
 <topic>openvpn -- illegal client float can break VPN session for other users</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><lt>2.4.8_3</lt></range>
 </package>
 <package>
	<name>openvpn-mbedtls</name>
	<range><lt>2.4.8_3</lt></range>
 </package>
 <package>
	<name>openvpn-devel</name>
	<range><lt>202016</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Lev Stipakov and Gert Doering report:
	<blockquote cite="https://github.com/OpenVPN/openvpn/commit/f7b318f811bb43c0d3aa7f337ec6242ed2c33881">
	 There is a time frame between allocating peer-id and initializing data
	 channel key (which is performed on receiving push request or on async
	 push-reply) in which the existing peer-id float checks do not work right.
	 If a "rogue" data channel packet arrives during that time frame from
	 another address and with same peer-id, this would cause client to float
	 to that new address.
	 The net effect of this behaviour is that the VPN session for the
	 "victim client" is broken. Since the "attacker client" does not have
	 suitable keys, it can not inject or steal VPN traffic from the other
	 session. The time window is small and it can not be used to attack
	 a specific client's session, unless some other way is found to make it
	 disconnect and reconnect first.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/OpenVPN/openvpn/commit/f7b318f811bb43c0d3aa7f337ec6242ed2c33881</url>
 <url>https://sourceforge.net/p/openvpn/openvpn/ci/f7b318f811bb43c0d3aa7f337ec6242ed2c33881/</url>
 <url>https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19720.html</url>
 <url>https://community.openvpn.net/openvpn/ticket/1272</url>
 <url>https://patchwork.openvpn.net/patch/1077/</url>
 <cvename>CVE-2020-11810</cvename>
 </references>
 <dates>
 <discovery>2020-04-13</discovery>
 <entry>2020-04-16</entry>
 </dates>
 </vuln>

<vuln vid="bf1f47c4-7f1b-11ea-bf94-001cc0382b2f">
 <topic>Mbed TLS -- Side channel attack on ECDSA</topic>
 <affects>
 <package>
	<name>mbedtls</name>
	<range><lt>2.16.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Manuel Pégourié-Gonnard reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-04">
	 An attacker with access to precise enough timing and memory access
	 information (typically an untrusted operating system attacking a
	 secure enclave such as SGX or the TrustZone secure world) can fully
	 recover an ECDSA private key after observing a number of signature
	 operations.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-04</url>
 <cvename>CVE-2020-10932</cvename>
 </references>
 <dates>
 <discovery>2020-04-14</discovery>
 <entry>2020-04-15</entry>
 </dates>
 </vuln>

<vuln vid="570706ff-7ee0-11ea-bd0b-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.9.0</ge><lt>12.9.3</lt></range>
	<range><ge>12.8.0</ge><lt>12.8.9</lt></range>
	<range><ge>0</ge><lt>12.7.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released/">
	 NuGet Package and File Disclosure through GitLab Workhorse
	 Job Artifact Uploads and File Disclosure through GitLab Workhorse
	 Incorrect membership following group removal
	 Logging of Praefect tokens
	 Update Rack dependency
	 Update OpenSSL dependency
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released/</url>
 <cvename>CVE-2020-11505</cvename>
 <cvename>CVE-2020-11506</cvename>
 <cvename>CVE-2020-11649</cvename>
 <cvename>CVE-2020-16782</cvename>
 </references>
 <dates>
 <discovery>2020-04-14</discovery>
 <entry>2020-04-15</entry>
 </dates>
 </vuln>

<vuln vid="f59c4c53-c55f-43fe-9920-82b9d1ea9c3d">
 <topic>zeek -- Remote crash vulnerability</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>3.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jon Siwek of Corelight reports:
	<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/e059d4ec2e689b3c8942f4aa08b272f24ed3f612/NEWS">
	 This release fixes the following security issue:
	 <ul>
	 <li>
	 An attacker can crash Zeek remotely via crafted packet
	 sequence. </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://raw.githubusercontent.com/zeek/zeek/e059d4ec2e689b3c8942f4aa08b272f24ed3f612/NEWS</url>
 </references>
 <dates>
 <discovery>2020-04-14</discovery>
 <entry>2020-04-14</entry>
 </dates>
 </vuln>

<vuln vid="6e3b700a-7ca3-11ea-b594-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>81.0.4044.92</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html">
	 This updates includes 32 security fixes, including:
	 <ul>
	 <li>[1019161] High CVE-2020-6454: Use after free in extensions.
	 Reported by Leecraso and Guang Gong of Alpha Lab, Qihoo 360 on
	 2019-10-29</li>
	 <li>[1043446] High CVE-2020-6423: Use after free in audio.
	 Reported by Anonymous on 2020-01-18</li>
	 <li>[1059669] High CVE-2020-6455: Out of bounds read in WebSQL.
	 Reported by Nan Wang(@eternalsakura13) and Guang Gong of Alpha Lab,
	 Qihoo 360 on 2020-03-09</li>
	 <li>[1031479] Medium CVE-2020-6430: Type Confusion in V8.
	 Reported by Avihay Cohen @ SeraphicAlgorithms on 2019-12-06</li>
	 <li>[1040755] Medium CVE-2020-6456: Insufficient validation of
	 untrusted input in clipboard. Reported by Michał Bentkowski of
	 Securitum on 2020-01-10</li>
	 <li>[852645] Medium CVE-2020-6431: Insufficient policy
	 enforcement in full screen. Reported by Luan Herrera (@lbherrera_)
	 on 2018-06-14</li>
	 <li>[965611] Medium CVE-2020-6432: Insufficient policy
	 enforcement in navigations. Reported by David Erceg on
	 2019-05-21</li>
	 <li>[1043965] Medium CVE-2020-6433: Insufficient policy
	 enforcement in extensions. Reported by David Erceg on
	 2020-01-21</li>
	 <li>[1048555] Medium CVE-2020-6434: Use after free in devtools.
	 Reported by HyungSeok Han (DaramG) of Theori on 2020-02-04</li>
	 <li>[1032158] Medium CVE-2020-6435: Insufficient policy
	 enforcement in extensions. Reported by Sergei Glazunov of Google
	 Project Zero on 2019-12-09</li>
	 <li>[1034519] Medium CVE-2020-6436: Use after free in window
	 management. Reported by Igor Bukanov from Vivaldi on 2019-12-16</li>
	 <li>[639173] Low CVE-2020-6437: Inappropriate implementation in
	 WebView. Reported by Jann Horn on 2016-08-19</li>
	 <li>[714617] Low CVE-2020-6438: Insufficient policy enforcement in
	 extensions. Reported by Ng Yik Phang on 2017-04-24</li>
	 <li>[868145] Low CVE-2020-6439: Insufficient policy enforcement in
	 navigations. Reported by remkoboonstra on 2018-07-26</li>
	 <li>[894477] Low CVE-2020-6440: Inappropriate implementation in
	 extensions. Reported by David Erceg on 2018-10-11</li>
	 <li>[959571] Low CVE-2020-6441: Insufficient policy enforcement in
	 omnibox. Reported by David Erceg on 2019-05-04</li>
	 <li>[1013906] Low CVE-2020-6442: Inappropriate implementation in
	 cache. Reported by B@rMey on 2019-10-12</li>
	 <li>[1040080] Low CVE-2020-6443: Insufficient data validation in
	 developer tools. Reported by @lovasoa (Ophir LOJKINE) on
	 2020-01-08</li>
	 <li>[922882] Low CVE-2020-6444: Uninitialized Use in WebRTC.
	 Reported by mlfbrown on 2019-01-17</li>
	 <li>[933171] Low CVE-2020-6445: Insufficient policy enforcement in
	 trusted types. Reported by Jun Kokatsu, Microsoft Browser
	 Vulnerability Research on 2019-02-18</li>
	 <li>[933172] Low CVE-2020-6446: Insufficient policy enforcement in
	 trusted types. Reported by Jun Kokatsu, Microsoft Browser
	 Vulnerability Research on 2019-02-18</li>
	 <li>[991217] Low CVE-2020-6447: Inappropriate implementation in
	 developer tools. Reported by David Erceg on 2019-08-06</li>
	 <li>[1037872] Low CVE-2020-6448: Use after free in V8. Reported by
	 Guang Gong of Alpha Lab, Qihoo 360 on 2019-12-26</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-6423</cvename>
 <cvename>CVE-2020-6430</cvename>
 <cvename>CVE-2020-6431</cvename>
 <cvename>CVE-2020-6432</cvename>
 <cvename>CVE-2020-6433</cvename>
 <cvename>CVE-2020-6434</cvename>
 <cvename>CVE-2020-6435</cvename>
 <cvename>CVE-2020-6436</cvename>
 <cvename>CVE-2020-6437</cvename>
 <cvename>CVE-2020-6438</cvename>
 <cvename>CVE-2020-6439</cvename>
 <cvename>CVE-2020-6440</cvename>
 <cvename>CVE-2020-6441</cvename>
 <cvename>CVE-2020-6442</cvename>
 <cvename>CVE-2020-6443</cvename>
 <cvename>CVE-2020-6444</cvename>
 <cvename>CVE-2020-6445</cvename>
 <cvename>CVE-2020-6446</cvename>
 <cvename>CVE-2020-6447</cvename>
 <cvename>CVE-2020-6448</cvename>
 <cvename>CVE-2020-6454</cvename>
 <cvename>CVE-2020-6455</cvename>
 <cvename>CVE-2020-6456</cvename>
 <url>https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html</url>
 </references>
 <dates>
 <discovery>2020-04-07</discovery>
 <entry>2020-04-12</entry>
 </dates>
 </vuln>

<vuln vid="9cb57a06-7517-11ea-b594-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>80.0.3987.162</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_31.html">
	 This update contains 8 security fixes.
	 <ul>
	 <li>[1062247] High CVE-2020-6450: Use after free in WebAudio.
	 Reported by Man Yue Mo of Semmle Security Research Team on
	 2020-03-17</li>
	 <li>[1061018] High CVE-2020-6451: Use after free in WebAudio.
	 Reported by Man Yue Mo of Semmle Security Research Team on
	 2020-03-12</li>
	 <li>[1059764] High CVE-2020-6452: Heap buffer overflow in media
	 Reported by asnine on 2020-03-09</li>
	 <li>[1066247] Various fixes from internal audits, fuzzing and other
	 initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_31.html</url>
 <cvename>CVE-2020-6450</cvename>
 <cvename>CVE-2020-6451</cvename>
 <cvename>CVE-2020-6452</cvename>
 </references>
 <dates>
 <discovery>2020-03-31</discovery>
 <entry>2020-04-02</entry>
 </dates>
 </vuln>

<vuln vid="7f829d44-7509-11ea-b47c-589cfc0f81b0">
 <topic>HAproxy -- serious vulnerability affecting the HPACK decoder used for HTTP/2</topic>
 <affects>
 <package>
	<name>haproxy</name>
	<range><ge>2.0.0</ge><lt>2.0.14</lt></range>
 </package>
 <package>
	<name>haproxy18</name>
	<range><ge>1.8.0</ge><lt>1.8.25</lt></range>
 </package>
 <package>
	<name>haproxy19</name>
	<range><ge>1.9.0</ge><lt>1.9.15</lt></range>
 </package>
 <package>
	<name>haproxy21</name>
	<range><ge>2.1.0</ge><lt>2.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The HAproxy Project reports:
	<blockquote cite="https://www.mail-archive.com/haproxy@formilux.org/msg36876.html">
	 The main driver for this release is that it contains a fix for a serious
	 vulnerability that was responsibly reported last week by Felix Wilhelm
	 from Google Project Zero, affecting the HPACK decoder used for HTTP/2.
	 CVE-2020-11100 was assigned to this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-11100</cvename>
 <url>https://www.mail-archive.com/haproxy@formilux.org/msg36876.html</url>
 <url>https://www.mail-archive.com/haproxy@formilux.org/msg36877.html</url>
 <url>https://www.mail-archive.com/haproxy@formilux.org/msg36878.html</url>
 <url>https://www.mail-archive.com/haproxy@formilux.org/msg36879.html</url>
 </references>
 <dates>
 <discovery>2020-04-02</discovery>
 <entry>2020-04-02</entry>
 </dates>
 </vuln>

<vuln vid="b360b120-74b1-11ea-a84a-4c72b94353b5">
 <topic>Apache -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.43</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache Team reports:
	<blockquote cite="https://downloads.apache.org/httpd/CHANGES_2.4.43">
	 <h1>SECURITY: CVE-2020-1934</h1>
	 mod_proxy_ftp: Use of uninitialized value with malicious backend FTP
	 server.
	 <h1>SECURITY: CVE-2020-1927</h1>
	 rewrite, core: Set PCRE_DOTALL flag by default to avoid unpredictable
	 matches and substitutions with encoded line break characters.
	 The fix for CVE-2019-10098 was not effective.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.apache.org/httpd/CHANGES_2.4.43</url>
 <cvename>CVE-2020-1934</cvename>
 <cvename>CVE-2020-1927</cvename>
 </references>
 <dates>
 <discovery>2020-04-01</discovery>
 <entry>2020-04-02</entry>
 </dates>
 </vuln>

<vuln vid="e2b564fc-7462-11ea-af63-38d547003487">
 <topic>cacti -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>1.2.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Cacti developers reports:
	<blockquote cite="https://github.com/Cacti/cacti/releases/tag/release%2F1.2.10">
	 When guest users have access to realtime graphs, remote code
	 could be executed (CVE-2020-8813).
	 Lack of escaping on some pages can lead to XSS exposure
	 (CVE-2020-7106).
	 Remote Code Execution due to input validation failure in
	 Performance Boost Debug Log (CVE-2020-7237).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/Cacti/cacti/releases/tag/release%2F1.2.10</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-8813</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-7106</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2020-7237</url>
 <cvename>CVE-2020-8813</cvename>
 <cvename>CVE-2020-7106</cvename>
 <cvename>CVE-2020-7237</cvename>
 <freebsdpr>ports/245198</freebsdpr>
 </references>
 <dates>
 <discovery>2020-02-04</discovery>
 <entry>2020-04-02</entry>
 </dates>
 </vuln>

<vuln vid="d887b3d9-7366-11ea-b81a-001cc0382b2f">
 <topic>GnuTLS -- flaw in DTLS protocol implementation</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>3.6.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GnuTLS project reports:
	<blockquote cite="https://gnutls.org/security-new.html#GNUTLS-SA-2020-03-31">
	 It was found that GnuTLS 3.6.3 introduced a regression in the DTLS
	 protocol implementation. This caused the DTLS client to not
	 contribute any randomness to the DTLS negotiation breaking the
	 security guarantees of the DTLS protocol.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://gnutls.org/security-new.html#GNUTLS-SA-2020-03-31</url>
 <cvename>CVE-2020-11501</cvename>
 </references>
 <dates>
 <discovery>2020-03-31</discovery>
 <entry>2020-03-31</entry>
 </dates>
 </vuln>

<vuln vid="d331f691-71f4-11ea-8bb5-6cc21735f730">
 <topic>PostgresSQL -- ALTER ... DEPENDS ON EXTENSION is missing authorization checks</topic>
 <affects>
 <package>
	<name>postgresql12-server</name>
	<range><lt>12.2</lt></range>
 </package>
 <package>
	<name>postgresql11-server</name>
	<range><lt>11.7</lt></range>
 </package>
 <package>
	<name>postgresql10-server</name>
	<range><lt>10.12</lt></range>
 </package>
 <package>
	<name>postgresql96-server</name>
	<range><lt>9.6.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/about/news/2011/">
	 
	 Versions Affected: 9.6 - 12
	 
	 
	 The ALTER ... DEPENDS ON EXTENSION sub-commands do not perform
	 authorization checks, which can allow an unprivileged user to drop
	 any function, procedure, materialized view, index, or trigger under
	 certain conditions. This attack is possible if an administrator has
	 installed an extension and an unprivileged user can CREATE, or an
	 extension owner either executes DROP EXTENSION predictably or can be
	 convinced to execute DROP EXTENSION.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.postgresql.org/about/news/1960/</url>
 <cvename>CVE-2020-1720</cvename>
 </references>
 <dates>
 <discovery>2020-02-13</discovery>
 <entry>2020-03-29</entry>
 </dates>
 </vuln>

<vuln vid="090763f6-7030-11ea-93dd-080027846a02">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki131</name>
	<range><lt>1.31.7</lt></range>
 </package>
 <package>
	<name>mediawiki133</name>
	<range><lt>1.33.3</lt></range>
 </package>
 <package>
	<name>mediawiki134</name>
	<range><lt>1.34.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawiki reports:
	<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-March/000247.html">
	 Security fixes:
	 T246602:jquery.makeCollapsible allows applying event handler to any CSS
	 selector.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-March/000247.html</url>
 </references>
 <dates>
 <discovery>2020-03-02</discovery>
 <entry>2020-03-27</entry>
 </dates>
 </vuln>

<vuln vid="08fba28b-6f9f-11ea-bd0b-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.9.0</ge><lt>12.9.1</lt></range>
	<range><ge>12.8.0</ge><lt>12.8.8</lt></range>
	<range><ge>0</ge><lt>12.7.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/">
	 Arbitrary File Read when Moving an Issue
	 Path Traversal in NPM Package Registry
	 SSRF on Project Import
	 External Users Can Create Personal Snippet
	 Triggers Decription Can be Updated by Other Maintainers in Project
	 Information Disclosure on Confidential Issues Moved to Private Programs
	 Potential DoS in Repository Archive Download
	 Blocked Users Can Still Pull/Push Docker Images
	 Repository Mirroring not Disabled when Feature not Activated
	 Vulnerability Feedback Page Was Leaking Information on Vulnerabilities
	 Stored XSS Vulnerability in Admin Feature
	 Upload Feature Allowed a User to Read Unauthorized Exported Files
	 Unauthorized Users Are Able to See CI Metrics
	 Last Pipeline Status of a Merge Request Leaked
	 Blind SSRF on FogBugz
	 Update Nokogiri dependency
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/</url>
 <cvename>CVE-2020-10953</cvename>
 <cvename>CVE-2020-10956</cvename>
 <cvename>CVE-2020-10954</cvename>
 <cvename>CVE-2020-10952</cvename>
 <cvename>CVE-2020-10955</cvename>
 <cvename>CVE-2020-9795</cvename>
 </references>
 <dates>
 <discovery>2020-03-26</discovery>
 <entry>2020-03-26</entry>
 </dates>
 </vuln>

<vuln vid="40194e1c-6d89-11ea-8082-80ee73419af3">
 <topic>rubygem-json -- Unsafe Objection Creation Vulnerability in JSON (Additional fix)</topic>
 <affects>
 <package>
	<name>rubygem-json</name>
	<range><lt>2.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/">
	 When parsing certain JSON documents, the json gem (including the
	 one bundled with Ruby) can be coerced into creating arbitrary objects
	 in the target system.
	 This is the same issue as CVE-2013-0269. The previous fix was incomplete,
	 which addressed JSON.parse(user_input), but didn’t address some other
	 styles of JSON parsing including JSON(user_input) and
	 JSON.parse(user_input, nil).
	 See CVE-2013-0269 in detail. Note that the issue was exploitable to
	 cause a Denial of Service by creating many garbage-uncollectable
	 Symbol objects, but this kind of attack is no longer valid because
	 Symbol objects are now garbage-collectable. However, creating arbitrary
	 bjects may cause severe security consequences depending upon the
	 application code.
	 Please update the json gem to version 2.3.0 or later. You can use
	 gem update json to update it. If you are using bundler, please add
	 gem "json", "&gt;= 2.3.0" to your Gemfile.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/</url>
 <cvename>CVE-2020-10663</cvename>
 </references>
 <dates>
 <discovery>2020-03-19</discovery>
 <entry>2020-03-26</entry>
 <modified>2020-04-02</modified>
 </dates>
 </vuln>

<vuln vid="5bf6ed6d-9002-4f43-ad63-458f59e45384">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><le>2.227</le></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><le>2.204.5</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://jenkins.io/security/advisory/2020-03-25/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-1774 / CVE-2020-2160</h5>
	 CSRF protection for any URL could be bypassed
	 <h5>(Medium) SECURITY-1781 / CVE-2020-2161</h5>
	 Stored XSS vulnerability in label expression validation
	 <h5>(Medium) SECURITY-1793 / CVE-2020-2162</h5>
	 Stored XSS vulnerability in file parameters
	 <h5>(Medium) SECURITY-1796 / CVE-2020-2163</h5>
	 Stored XSS vulnerability in list view column headers
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-2160</cvename>
 <cvename>CVE-2020-2161</cvename>
 <cvename>CVE-2020-2162</cvename>
 <cvename>CVE-2020-2163</cvename>
 <url>https://jenkins.io/security/advisory/2020-03-25/</url>
 </references>
 <dates>
 <discovery>2020-03-25</discovery>
 <entry>2020-03-25</entry>
 </dates>
 </vuln>

<vuln vid="97fcc60a-6ec0-11ea-a84a-4c72b94353b5">
 <topic>phpMyAdmin -- SQL injection</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<name>phpMyAdmin-php72</name>
	<name>phpMyAdmin-php73</name>
	<name>phpMyAdmin-php74</name>
	<name>phpMyAdmin5</name>
	<name>phpMyAdmin5-php72</name>
	<name>phpMyAdmin5-php73</name>
	<name>phpMyAdmin5-php74</name>
	<range><lt>4.9.5</lt></range>
	<range><ge>5.0</ge><lt>5.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpMyAdmin Team reports:
	<blockquote cite="https://www.phpmyadmin.net/news/2020/3/21/phpmyadmin-495-and-502-are-released/">
	 PMASA-2020-2 SQL injection vulnerability in the user accounts page, particularly when changing a password
	 PMASA-2020-3 SQL injection vulnerability relating to the search feature
	 PMASA-2020-4 SQL injection and XSS having to do with displaying results
	 Removing of the "options" field for the external transformation
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/news/2020/3/21/phpmyadmin-495-and-502-are-released/</url>
 </references>
 <dates>
 <discovery>2020-03-21</discovery>
 <entry>2020-03-25</entry>
 </dates>
 </vuln>

<vuln vid="36def7ba-6d2b-11ea-b115-643150d3111d">
 <topic>puppetserver and puppetdb -- Puppet Server and PuppetDB may leak sensitive information via metrics API</topic>
 <affects>
 <package>
	<name>puppetdb5</name>
	<range><lt>5.2.13</lt></range>
 </package>
 <package>
	<name>puppetdb6</name>
	<range><lt>6.9.1</lt></range>
 </package>
 <package>
	<name>puppetserver5</name>
	<range><lt>5.3.12</lt></range>
 </package>
 <package>
	<name>puppetserver6</name>
	<range><lt>6.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Puppetlabs reports:
	<blockquote cite="https://puppet.com/security/cve/CVE-2020-7943/">
	 Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network.
	 PE 2018.1.13 &amp; 2019.4.0, Puppet Server 6.9.1 &amp; 5.3.12, and PuppetDB 6.9.1 &amp; 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7943</cvename>
 <url>https://puppet.com/security/cve/CVE-2020-7943/</url>
 </references>
 <dates>
 <discovery>2020-03-10</discovery>
 <entry>2020-03-23</entry>
 </dates>
 </vuln>

<vuln vid="77687355-52aa-11ea-b115-643150d3111d">
 <topic>puppet6 -- Arbitrary Catalog Retrieval</topic>
 <affects>
 <package>
	<name>puppet6</name>
	<range><lt>6.13.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Puppetlabs reports:
	<blockquote cite="https://puppet.com/security/cve/CVE-2020-7942/">
	 Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master.
	 Puppet 6.13.0 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7942</cvename>
 <url>https://puppet.com/security/cve/CVE-2020-7942/</url>
 </references>
 <dates>
 <discovery>2020-02-18</discovery>
 <entry>2020-03-23</entry>
 </dates>
 </vuln>

<vuln vid="6b90acba-6a0a-11ea-92ab-00163e433440">
 <topic>FreeBSD -- Kernel memory disclosure with nested jails</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_3</lt></range>
	<range><ge>11.3</ge><lt>11.3_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A missing NUL-termination check for the jail_set(2) configration
	option "osrelease" may return more bytes when reading the jail
	configuration back with jail_get(2) than were originally set.
	<h1>Impact:</h1>
	For jails with a non-default setting of children.max &gt; 0 ("nested
	jails") a superuser inside a jail can create a jail and may be able to
	read and take advantage of exposed kernel memory.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7453</cvename>
 <freebsdsa>SA-20:08.jail</freebsdsa>
 </references>
 <dates>
 <discovery>2020-03-19</discovery>
 <entry>2020-03-19</entry>
 </dates>
 </vuln>

<vuln vid="0cc7e547-6a0a-11ea-92ab-00163e433440">
 <topic>FreeBSD -- Incorrect user-controlled pointer use in epair</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_3</lt></range>
	<range><ge>11.3</ge><lt>11.3_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Incorrect use of a potentially user-controlled pointer in the kernel
	allowed vnet jailed users to panic the system and potentially execute
	aribitrary code in the kernel.
	<h1>Impact:</h1>
	Users with root level access (or the PRIV_NET_IFCREATE privilege)
	can panic the system, or potentially escape the jail or execute
	arbitrary code with kernel priviliges.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7452</cvename>
 <freebsdsa>SA-20:07.epair</freebsdsa>
 </references>
 <dates>
 <discovery>2020-03-19</discovery>
 <entry>2020-03-19</entry>
 </dates>
 </vuln>

<vuln vid="b2b83761-6a09-11ea-92ab-00163e433440">
 <topic>FreeBSD -- Insufficient ixl(4) ioctl(2) privilege checking</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The driver-specific ioctl(2) command handlers in ixl(4) failed to
	check whether the caller has sufficient privileges to perform the
	corresponding operation.
	<h1>Impact:</h1>
	The ixl(4) handler permits unprivileged users to trigger updates to
	the device's non-volatile memory (NVM).
 </body>
 </description>
 <references>
 <cvename>CVE-2019-15877</cvename>
 <freebsdsa>SA-20:06.if_ixl_ioctl</freebsdsa>
 </references>
 <dates>
 <discovery>2020-03-19</discovery>
 <entry>2020-03-19</entry>
 </dates>
 </vuln>

<vuln vid="3c10ccdf-6a09-11ea-92ab-00163e433440">
 <topic>FreeBSD -- Insufficient oce(4) ioctl(2) privilege checking</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_3</lt></range>
	<range><ge>11.3</ge><lt>11.3_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The driver-specific ioctl(2) command handlers in oce(4) failed to
	check whether the caller has sufficient privileges to perform the
	corresponding operation.
	<h1>Impact:</h1>
	The oce(4) handler permits unprivileged users to send passthrough
	commands to device firmware.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-15876</cvename>
 <freebsdsa>SA-20:05.if_oce_ioctl</freebsdsa>
 </references>
 <dates>
 <discovery>2020-03-19</discovery>
 <entry>2020-03-19</entry>
 </dates>
 </vuln>

<vuln vid="0e06013e-6a06-11ea-92ab-00163e433440">
 <topic>FreeBSD -- TCP IPv6 SYN cache kernel information disclosure</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_3</lt></range>
	<range><ge>11.3</ge><lt>11.3_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When a TCP server transmits or retransmits a TCP SYN-ACK segment
	over IPv6, the Traffic Class field is not initialized. This also
	applies to challenge ACK segments, which are sent in response to
	received RST segments during the TCP connection setup phase.
	<h1>Impact:</h1>
	For each TCP SYN-ACK (or challenge TCP-ACK) segment sent over IPv6,
	one byte of kernel memory is transmitted over the network.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7451</cvename>
 <freebsdsa>SA-20:04.tcp</freebsdsa>
 </references>
 <dates>
 <discovery>2020-03-19</discovery>
 <entry>2020-03-19</entry>
 </dates>
 </vuln>

<vuln vid="3d19c776-68e7-11ea-91db-0050562a4d7b">
 <topic>www/py-bleach -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-bleach</name>
	<name>py35-bleach</name>
	<name>py36-bleach</name>
	<name>py37-bleach</name>
	<name>py38-bleach</name>
	<range><lt>3.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote>
	 * ``bleach.clean`` behavior parsing embedded MathML and SVG content
		with RCDATA tags did not match browser behavior and could result in
		a mutation XSS.
	 
	 Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or
		``svg`` tags and one or more of the RCDATA tags ``script``,
		``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or
		``xmp`` in the allowed tags whitelist were vulnerable to a mutation
		XSS.
	 
	 * ``bleach.clean`` behavior parsing ``noscript`` tags did not match
		browser behavior.
	 
	 Calls to ``bleach.clean`` allowing ``noscript`` and one or more of
		the raw text tags (``title``, ``textarea``, ``script``, ``style``,
		``noembed``, ``noframes``, ``iframe``, and ``xmp``) were vulnerable
		to a mutation XSS.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1615315</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1621692</url>
 </references>
 <dates>
 <discovery>2020-02-13</discovery>
 <entry>2020-03-18</entry>
 </dates>
 </vuln>

<vuln vid="4ae135f7-85cd-4c32-ad94-358271b31f7f">
 <topic>zeek -- potential denial of service issues</topic>
 <affects>
 <package>
	<name>zeek</name>
	<range><lt>3.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jon Siwek of Corelight reports:
	<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/9dda3602a760f00d9532c6314ea79108106033fa/NEWS">
	 This release addresses the following security issues:
	 <ul>
	 <li>
	 Potential Denial of Service due to memory leak in DNS
	 TSIG message parsing. </li>
	 <li>
	 Potential Denial of Service due to memory leak (or assertion
	 when compiling with assertions enabled) when receiving a
	 second SSH KEX message after a first. </li>
	 <li>
	 Potential Denial of Service due to buffer read overflow
	 and/or memory leaks in Kerberos analyzer. The buffer
	 read overflow could occur when the Kerberos message
	 indicates it contains an IPv6 address, but does not send
	 enough data to parse out a full IPv6 address. A memory
	 leak could occur when processing KRB_KDC_REQ KRB_KDC_REP
	 messages for message types that do not match a known/expected
	 type. </li>
	 <li>
	 Potential Denial of Service when sending many zero-length
	 SSL/TLS certificate data. Such messages underwent the
	 full Zeek file analysis treatment which is expensive (and
	 meaninguless here) compared to how cheaply one can "create"
	 or otherwise indicate many zero-length contained in an
	 SSL message. </li>
	 <li>
	 Potential Denial of Service due to buffer read overflow
	 in SMB transaction data string handling. The length of
	 strings being parsed from SMB messages was trusted to be
	 whatever the message claimed instead of the actual length
	 of data found in the message. </li>
	 <li>
	 Potential Denial of Service due to null pointer dereference
	 in FTP ADAT Base64 decoding. </li>
	 <li>
	 Potential Denial of Service due buffer read overflow in
	 FTP analyzer word/whitespace handling. This typically
	 won't be a problem in most default deployments of Zeek
	 since the FTP analyzer receives data from a ContentLine
	 (NVT) support analyzer which first null-terminates the
	 buffer used for further FTP parsing. </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zeek/zeek/blob/9dda3602a760f00d9532c6314ea79108106033fa/NEWS</url>
 </references>
 <dates>
 <discovery>2020-02-25</discovery>
 <entry>2020-03-15</entry>
 </dates>
 </vuln>

<vuln vid="c3600a64-64ea-11ea-bdff-e0d55e2a8bf9">
 <topic>Okular -- Local binary execution via action links</topic>
 <affects>
 <package>
	<name>okular</name>
	<range><lt>19.12.3_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Albert Astals Cid:
	<blockquote cite="https://kde.org/info/security/advisory-20200312-1.txt">
	 Okular can be tricked into executing local binaries via specially crafted
	 PDF files.
	 This binary execution can require almost no user interaction.
	 No parameters can be passed to those local binaries.
	 We have not been able to identify any binary that will cause actual damage,
	 be it in the hardware or software level, when run without parameters.

We remain relatively confident that for this issue to do any actual damage,
it has to run a binary specially crafted. That binary must have been deployed
to the user system via another method, be it the user downloading it directly
as an email attachment, webpage download, etc. or by the system being already
compromised.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://kde.org/info/security/advisory-20200312-1.txt</url>
 </references>
 <dates>
 <discovery>2020-03-12</discovery>
 <entry>2020-03-13</entry>
 </dates>
 </vuln>

<vuln vid="9a09eaa2-6448-11ea-abb7-001b217b3468">
 <topic>Gitlab -- Vulnerability</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.8.0</ge><lt>12.8.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/03/11/critical-security-release-gitlab-12-dot-8-dot-6-released/">
	 Email Confirmation not Required on Sign-up
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/03/11/critical-security-release-gitlab-12-dot-8-dot-6-released/</url>
 </references>
 <dates>
 <discovery>2020-03-11</discovery>
 <entry>2020-03-12</entry>
 </dates>
 </vuln>

<vuln vid="1685144e-63ff-11ea-a93a-080027846a02">
 <topic>Django -- potential SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>py27-django111</name>
	<name>py35-django111</name>
	<name>py36-django111</name>
	<name>py37-django111</name>
	<name>py38-django111</name>
	<range><lt>1.11.29</lt></range>
 </package>
 <package>
	<name>py35-django22</name>
	<name>py36-django22</name>
	<name>py37-django22</name>
	<name>py38-django22</name>
	<range><lt>2.2.11</lt></range>
 </package>
 <package>
	<name>py36-django30</name>
	<name>py37-django30</name>
	<name>py38-django30</name>
	<range><lt>3.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE CVE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9402">
	 Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4
	 allows SQL Injection if untrusted data is used as a tolerance parameter
	 in GIS functions and aggregates on Oracle. By passing a suitably crafted
	 tolerance to GIS functions and aggregates on Oracle, it was possible to
	 break escaping and inject malicious SQL.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9402</url>
 <url>https://www.djangoproject.com/weblog/2020/mar/04/security-releases/</url>
 <cvename>CVE-2020-9402</cvename>
 </references>
 <dates>
 <discovery>2020-02-25</discovery>
 <entry>2020-03-12</entry>
 </dates>
 </vuln>

<vuln vid="1afe9552-5ee3-11ea-9b6d-901b0e934d69">
 <topic>py-matrix-synapse -- users of single-sign-on are vulnerable to phishing</topic>
 <affects>
 <package>
	<name>py35-matrix-synapse</name>
	<name>py36-matrix-synapse</name>
	<name>py37-matrix-synapse</name>
	<range><lt>1.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://github.com/matrix-org/synapse/releases/tag/v1.11.1">
	 [The 1.11.1] release includes a security fix impacting installations using Single Sign-On (i.e. SAML2 or CAS) for authentication. Administrators of such installations are encouraged to upgrade as soon as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/matrix-org/synapse/releases/tag/v1.11.1</url>
 </references>
 <dates>
 <discovery>2020-03-03</discovery>
 <entry>2020-03-11</entry>
 </dates>
 </vuln>

<vuln vid="0032400f-624f-11ea-b495-000d3ab229d6">
 <topic>Node.js -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>node</name>
	<range><lt>13.8.0</lt></range>
 </package>
 <package>
	<name>node12</name>
	<range><lt>12.15.0</lt></range>
 </package>
 <package>
	<name>node10</name>
	<range><lt>10.19.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/">
	 Updates are now available for all active Node.js release lines for the following issues.
	 <h1>HTTP request smuggling using malformed Transfer-Encoding header (Critical) (CVE-2019-15605)HTTP request smuggling using malformed Transfer-Encoding header (Critical) (CVE-2019-15605)</h1>
	 Affected Node.js versions can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system.
	 <h1>HTTP header values do not have trailing OWS trimmed (High) (CVE-2019-15606)</h1>
	 Optional whitespace should be trimmed from HTTP header values. Its presence may allow attackers to bypass security checks based on HTTP header values.
	 <h1>Remotely trigger an assertion on a TLS server with a malformed certificate string (High) (CVE-2019-15604)</h1>
	 Connecting to a NodeJS TLS server with a client certificate that has a type 19 string in its subjectAltName will crash the TLS server if it tries to read the peer certificate.
	 <h1>Strict HTTP header parsing (None)</h1>
	 Increase the strictness of HTTP header parsing. There are no known vulnerabilities addressed, but lax HTTP parsing has historically been a source of problems. Some commonly used sites are known to generate invalid HTTP headers, a --insecure-http-parser CLI option or insecureHTTPParser http option can be used if necessary for interoperability, but is not recommended.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/</url>
 <cvename>CVE-2019-15605</cvename>
 <cvename>CVE-2019-15606</cvename>
 <cvename>CVE-2019-15604</cvename>
 </references>
 <dates>
 <discovery>2020-02-06</discovery>
 <entry>2020-03-09</entry>
 </dates>
 </vuln>

<vuln vid="be088777-6085-11ea-8609-08002731610e">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.11.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports for release 1.11.0:
	<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.11.0">
	 <ul>
	 <li>Never allow an empty password to validate (#9682) (#9683)</li>
	 <li>Prevent redirect to Host (#9678) (#9679)</li>
	 <li>Swagger hide search field (#9554)</li>
	 <li>Add "search" to reserved usernames (#9063)</li>
	 <li>Switch to fomantic-ui (#9374)</li>
	 <li>Only serve attachments when linked to issue/release and if accessible by user (#9340)</li>
	 </ul>
	</blockquote>
	The Gitea Team reports for release 1.11.2:
	<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.11.2">
	 <ul>
	 <li>Ensure only own addresses are updated (#10397) (#10399)</li>
	 <li>Logout POST action (#10582) (#10585)</li>
	 <li>Org action fixes and form cleanup (#10512) (#10514)</li>
	 <li>Change action GETs to POST (#10462) (#10464)</li>
	 <li>Fix admin notices (#10480) (#10483)</li>
	 <li>Change admin dashboard to POST (#10465) (#10466)</li>
	 <li>Update markbates/goth (#10444) (#10445)</li>
	 <li>Update crypto vendors (#10385) (#10398)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.io/2020/02/gitea-1.11.0-is-released/</url>
 <url>https://blog.gitea.io/2020/03/gitea-1.11.2-is-released/</url>
 <freebsdpr>ports/244025</freebsdpr>
 </references>
 <dates>
 <discovery>2019-11-18</discovery>
 <entry>2020-03-07</entry>
 </dates>
 </vuln>

<vuln vid="8c98e643-6008-11ea-af63-38d547003487">
 <topic>salt -- salt-api vulnerability</topic>
 <affects>
 <package>
	<name>py27-salt</name>
	<name>py32-salt</name>
	<name>py33-salt</name>
	<name>py34-salt</name>
	<name>py35-salt</name>
	<name>py36-salt</name>
	<name>py37-salt</name>
	<name>py38-salt</name>
	<range><lt>2019.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SaltStack reports:
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html">
	 With the Salt NetAPI enabled in addition to having a SSH roster
	 defined, unauthenticated access is possible when specifying the
	 client as SSH.
	 Additionally, when the raw_shell option is specified any arbitrary
	 command may be run on the Salt master when specifying SSH options.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-17361</cvename>
 <url>https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-17361</url>
 </references>
 <dates>
 <discovery>2020-01-15</discovery>
 <entry>2020-03-07</entry>
 </dates>
 </vuln>

<vuln vid="62f2182c-5f7a-11ea-abb7-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.8.0</ge><lt>12.8.2</lt></range>
	<range><ge>12.7.0</ge><lt>12.7.7</lt></range>
	<range><ge>0</ge><lt>12.6.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/">
	 Directory Traversal to Arbitrary File Read
	 Account Takeover Through Expired Link
	 Server Side Request Forgery Through Deprecated Service
	 Group Two-Factor Authentication Requirement Bypass
	 Stored XSS in Merge Request Pages
	 Stored XSS in Merge Request Submission Form
	 Stored XSS in File View
	 Stored XSS in Grafana Integration
	 Contribution Analytics Exposed to Non-members
	 Incorrect Access Control in Docker Registry via Deploy Tokens
	 Denial of Service via Permission Checks
	 Denial of Service in Design For Public Issue
	 Incorrect Access Control via LFS Import
	 Unescaped HTML in Header
	 Private Merge Request Titles Leaked via Widget
	 Project Namespace Exposed via Vulnerability Feedback Endpoint
	 Denial of Service Through Recursive Requests
	 Project Authorization Not Being Updated
	 Incorrect Permission Level For Group Invites
	 Disclosure of Private Group Epic Information
	 User IP Address Exposed via Badge images
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/</url>
 <cvename>CVE-2020-8113</cvename>
 </references>
 <dates>
 <discovery>2020-03-04</discovery>
 <entry>2020-03-06</entry>
 </dates>
 </vuln>

<vuln vid="591a706b-5cdc-11ea-9a0a-206a8a720317">
 <topic>ntp -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.3</ge><lt>11.3_7</lt></range>
	<range><ge>12.1</ge><lt>12.1_3</lt></range>
 </package>
 <package>
	<name>ntp</name>
	<range><lt>4.2.8p14</lt></range>
 </package>
 <package>
	<name>ntp-devel</name>
	<range><le>4.3.99_6</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	nwtime.org reports:
	<blockquote cite="https://support.ntp.org/bin/view/Main/SecurityNotice">
	 Three ntp vulnerabilities, Depending on configuration, may have
	 little impact up to termination of the ntpd process.
	 NTP Bug 3610: Process_control() should exit earlier on short
	 packets. On systems that override the default and enable ntpdc
	 (mode 7) fuzz testing detected that a short packet will cause
	 ntpd to read uninitialized data.
	 NTP Bug 3596: An unauthenticated unmonitored ntpd is vulnerable
	 to attack on IPv4 with highly predictable transmit timestamps. An
	 off-path attacker who can query time from the victim's ntp which
	 receives time from an unauthenticated time source must be able to
	 send from a spoofed IPv4 address of upstream ntp server and and
	 the victim must be able to process a large number of packets with
	 the spoofed IPv4 address of the upstream server. After eight or
	 more successful attacks in a row the attacker can either modify
	 the victim's clock by a small amount or cause ntpd to terminate.
	 The attack is especially effective when unusually short poll
	 intervals have been configured.
	 NTP Bug 3592: The fix for https://bugs.ntp.org/3445 introduced
	 a bug such that a ntp can be prevented from initiating a time
	 volley to its peer resulting in a DoS.
	 All three NTP bugs may result in DoS or terimation of the ntp
	 daemon.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-20:09.ntp</freebsdsa>
 </references>
 <dates>
 <discovery>2019-05-30</discovery>
 <entry>2020-03-03</entry>
 </dates>
 </vuln>

<vuln vid="b66583ae-5aee-4cd5-bb31-b2d397f8b6b3">
 <topic>librsvg2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>librsvg2</name>
	<range><lt>2.40.21</lt></range>
 </package>
 <package>
	<name>librsvg2-rust</name>
	<range><ge>2.41.0</ge><lt>2.46.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Librsvg2 developers reports:
	<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2020-February/msg00133.htmlE">
	 Backport the following fixes from 2.46.x:
	 Librsvg now has limits on the number of loaded XML elements,
	 and the number of referenced elements within an SVG document. This
	 is to mitigate malicious SVGs which try to consume all memory, and
	 those which try to consume an exponential amount of CPU time.
	 Fix stack exhaustion with circular references in &lt;use&gt; elements.
	 Fix a denial-of-service condition from exponential explosion
	 of rendered elements, through nested use of SVG &lt;use&gt; elements in
	 malicious SVGs. This is similar to the XML "billion laughs attack"
	 but for SVG instancing.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mail.gnome.org/archives/ftp-release-list/2020-February/msg00133.html</url>
 <cvename>CVE-2019-20446</cvename>
 </references>
 <dates>
 <discovery>2020-02-26</discovery>
 <entry>2020-03-02</entry>
 </dates>
 </vuln>

<vuln vid="d37407bd-5c5f-11ea-bb2a-8c164582fbac">
 <topic>TiMidity++ -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>timidity++</name>
	<range><lt>2.15.0</lt></range>
 </package>
 <package>
	<name>timidity++-emacs</name>
	<range><lt>2.15.0</lt></range>
 </package>
 <package>
	<name>timidity++-gtk</name>
	<range><lt>2.15.0</lt></range>
 </package>
 <package>
	<name>timidity++-motif</name>
	<range><lt>2.15.0</lt></range>
 </package>
 <package>
	<name>timidity++-slang</name>
	<range><lt>2.15.0</lt></range>
 </package>
 <package>
	<name>timidity++-tcltk</name>
	<range><lt>2.15.0</lt></range>
 </package>
 <package>
	<name>timidity++-xaw</name>
	<range><lt>2.15.0</lt></range>
 </package>
 <package>
	<name>timidity++-xskin</name>
	<range><lt>2.15.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	qflb.wu of DBAPPSecurity reports:
	<blockquote cite="https://seclists.org/fulldisclosure/2017/Jul/83">
	 Ihe insert_note_steps function in readmidi.c in TiMidity++ 2.14.0
	 can cause a denial of service(divide-by-zero error and application
	 crash) via a crafted mid file.
	 The resample_gauss function in resample.c in TiMidity++ 2.14.0
	 can cause a denial of service(heap-buffer-overflow) via a crafted
	 mid file.
	 The play_midi function in playmidi.c in TiMidity++ 2.14.0 can
	 cause a denial of service(large loop and CPU consumption) via
	 a crafted mid file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://seclists.org/fulldisclosure/2017/Jul/83</url>
 <cvename>CVE-2017-11546</cvename>
 <cvename>CVE-2017-11547</cvename>
 <cvename>CVE-2017-11549</cvename>
 </references>
 <dates>
 <discovery>2017-07-31</discovery>
 <entry>2020-03-02</entry>
 </dates>
 </vuln>

<vuln vid="e59cb761-5ad8-11ea-abb7-001b217b3468">
 <topic>Solr -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache-solr</name>
	<range><lt>8.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Community reports:
	<blockquote cite="https://lucene.apache.org/solr/security.html">
	 8.1.1 and 8.2.0 users check ENABLE_REMOTE_JMX_OPTS setting
	 Apache Solr RCE vulnerability due to bad config default
	 Apache Solr RCE through VelocityResponseWriter
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lucene.apache.org/solr/security.html</url>
 <cvename>CVE-2019-17558</cvename>
 </references>
 <dates>
 <discovery>2019-12-30</discovery>
 <entry>2020-02-29</entry>
 </dates>
 </vuln>

<vuln vid="f0683976-5779-11ea-8a77-1c872ccb1e42">
 <topic>OpenSMTPd -- LPE and RCE in OpenSMTPD's default install</topic>
 <affects>
 <package>
	<name>opensmtpd</name>
	<range><lt>6.6.4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSMTPD developers reports:
	<blockquote cite="https://opensmtpd.org/security.html">
	 An out of bounds read in smtpd allows an attacker to inject arbitrary
	 commands into the envelope file which are then executed as root.
	 Separately, missing privilege revocation in smtpctl allows arbitrary
	 commands to be run with the _smtpq group.
	 An unprivileged local attacker can read the first line of an arbitrary
	 file (for example, root's password hash in /etc/master.passwd) or the
	 entire contents of another user's file (if this file and
	 /var/spool/smtpd/ are on the same filesystem).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-8793</cvename>
 <url>https://www.openwall.com/lists/oss-security/2020/02/24/4</url>
 <cvename>CVE-2020-8794</cvename>
 <url>https://www.openwall.com/lists/oss-security/2020/02/24/5</url>
 </references>
 <dates>
 <discovery>2020-02-22</discovery>
 <entry>2020-02-24</entry>
 <modified>2020-02-27</modified>
 </dates>
 </vuln>

<vuln vid="056ea107-5729-11ea-a2f3-001cc0382b2f">
 <topic>Mbed TLS -- Cache attack against RSA key import in SGX</topic>
 <affects>
 <package>
	<name>mbedtls</name>
	<range><lt>2.16.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Janos Follath reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-02">
	 If Mbed TLS is running in an SGX enclave and the adversary has
	 control of the main operating system, they can launch a side
	 channel attack to recover the RSA private key when it is being
	 imported.
	 The attack only requires access to fine grained measurements to
	 cache usage. Therefore the attack might be applicable to a scenario
	 where Mbed TLS is running in TrustZone secure world and the
	 attacker controls the normal world or possibly when Mbed TLS is
	 part of a hypervisor and the adversary has full control of a guest
	 OS.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-02</url>
 </references>
 <dates>
 <discovery>2020-02-18</discovery>
 <entry>2020-02-24</entry>
 </dates>
 </vuln>

<vuln vid="b70b880f-5727-11ea-a2f3-001cc0382b2f">
 <topic>Mbed TLS -- Side channel attack on ECDSA</topic>
 <affects>
 <package>
	<name>mbedtls</name>
	<range><lt>2.16.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Janos Follath reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12">
	 Our bignum implementation is not constant time/constant trace, so
	 side channel attacks can retrieve the blinded value, factor it (as
	 it is smaller than RSA keys and not guaranteed to have only large
	 prime factors), and then, by brute force, recover the key.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12</url>
 <cvename>CVE-2019-18222</cvename>
 </references>
 <dates>
 <discovery>2019-10-25</discovery>
 <entry>2020-02-24</entry>
 </dates>
 </vuln>

<vuln vid="8e3f1812-54d9-11ea-8d49-d4c9ef517024">
 <topic>WeeChat -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>weechat</name>
	<range><lt>2.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The WeeChat project reports:
	<blockquote cite="https://weechat.org/doc/security/">
	 Buffer overflow when receiving a malformed IRC message 324 (channel
	 mode). (CVE-2020-8955)
	 Buffer overflow when a new IRC message 005 is received with longer
	 nick prefixes.
	 Crash when receiving a malformed IRC message 352 (WHO).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://weechat.org/doc/security/</url>
 <cvename>CVE-2020-8955</cvename>
 </references>
 <dates>
 <discovery>2020-02-20</discovery>
 <entry>2020-02-21</entry>
 </dates>
 </vuln>

<vuln vid="1cb0af4e-d641-4f99-9432-297a89447a97">
 <topic>webkit-gtk3 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>webkit2-gtk3</name>
	<range><lt>2.26.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The WebKitGTK project reports multiple vulnerabilities.
 </body>
 </description>
 <references>
 <url>https://webkitgtk.org/security/WSA-2020-0002.html</url>
 <cvename>CVE-2020-3862</cvename>
 <cvename>CVE-2020-3864</cvename>
 <cvename>CVE-2020-3865</cvename>
 <cvename>CVE-2020-3867</cvename>
 <cvename>CVE-2020-3868</cvename>
 </references>
 <dates>
 <discovery>2020-02-14</discovery>
 <entry>2020-02-19</entry>
 </dates>
 </vuln>

<vuln vid="6025d173-4279-11ea-b184-f8b156ac3ff9">
 <topic>FreeBSD -- kernel stack data disclosure</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_2</lt></range>
	<range><ge>12.0</ge><lt>12.0_13</lt></range>
	<range><ge>11.3</ge><lt>11.3_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to incorrect initialization of a stack data structure, up to 20
	bytes of kernel data stored previously stored on the stack will be
	exposed to a crashing user process.
	<h1>Impact:</h1>
	Sensitive kernel data may be disclosed.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-15875</cvename>
 <freebsdsa>SA-20:03.thrmisc</freebsdsa>
 </references>
 <dates>
 <discovery>2020-01-28</discovery>
 <entry>2020-01-29</entry>
 </dates>
 </vuln>

<vuln vid="5797c807-4279-11ea-b184-f8b156ac3ff9">
 <topic>FreeBSD -- Missing IPsec anti-replay window check</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A missing check means that an attacker can reinject an old packet and
	it will be accepted and processed by the IPsec endpoint.
	<h1>Impact:</h1>
	The impact depends on the higher-level protocols in use over IPsec.
	For example, an attacker who can capture and inject packets could
	cause an action that was intentionally performed once to be repeated.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5613</cvename>
 <freebsdsa>SA-20:02.ipsec</freebsdsa>
 </references>
 <dates>
 <discovery>2020-01-28</discovery>
 <entry>2020-01-29</entry>
 </dates>
 </vuln>

<vuln vid="22b41bc5-4279-11ea-b184-f8b156ac3ff9">
 <topic>FreeBSD -- libfetch buffer overflow</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.1</ge><lt>12.1_2</lt></range>
	<range><ge>12.0</ge><lt>12.0_13</lt></range>
	<range><ge>11.3</ge><lt>11.3_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A programming error allows an attacker who can specify a URL with a
	username and/or password components to overflow libfetch(3) buffers.
	<h1>Impact:</h1>
	An attacker in control of the URL to be fetched (possibly via HTTP
	redirect) may cause a heap buffer overflow, resulting in program
	misbehavior or malicious code execution.
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7450</cvename>
 <freebsdsa>SA-20:01.libfetch</freebsdsa>
 </references>
 <dates>
 <discovery>2020-01-28</discovery>
 <entry>2020-01-29</entry>
 </dates>
 </vuln>

<vuln vid="1ece5591-4ea9-11ea-86f0-001b217b3468">
 <topic>Gitlab -- Vulnerability</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.7.0</ge><lt>12.7.6</lt></range>
	<range><ge>12.6.0</ge><lt>12.6.7</lt></range>
	<range><ge>12.5.0</ge><lt>12.5.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/02/13/critical-security-release-gitlab-12-dot-7-dot-6-released/">
	 Incorrect membership handling of group sharing feature
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/02/13/critical-security-release-gitlab-12-dot-7-dot-6-released/</url>
 <cvename>CVE-2020-8795</cvename>
 </references>
 <dates>
 <discovery>2020-02-13</discovery>
 <entry>2020-02-13</entry>
 </dates>
 </vuln>

<vuln vid="74db0d02-b140-4c32-aac6-1f1e81e1ad30">
 <topic>dovecot -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><lt>2.3.9.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aki Tuomi reports:
	<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-February/000431.html">
	 lib-smtp doesn't handle truncated command parameters properly, resulting
in infinite loop taking 100% CPU for the process. This happens for LMTP
(where it doesn't matter so much) and also for submission-login where
unauthenticated users can trigger it. 
	</blockquote>
	Aki also reports:
	<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-February/000430.html">
	 Snippet generation crashes if:

message is large enough that message-parser returns multiple body
blocks
 The first block(s) don't contain the full snippet (e.g. full of
whitespace)
 input ends with '&gt;'
	
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://dovecot.org/pipermail/dovecot-news/2020-February/000430.html</url>
 <url>https://dovecot.org/pipermail/dovecot-news/2020-February/000431.html</url>
 <cvename>CVE-2020-7046</cvename>
 <cvename>CVE-2020-7967</cvename>
 </references>
 <dates>
 <discovery>2020-01-14</discovery>
 <entry>2020-02-13</entry>
 </dates>
 </vuln>

<vuln vid="9d6a48a7-4dad-11ea-8a1d-7085c25400ea">
 <topic>grub2-bhyve -- multiple privilege escalations</topic>
 <affects>
 <package>
	<name>grub2-bhyve</name>
	<range><lt>0.40_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Reno Robert reports:
	
	<blockquote cite="https://www.voidsecurity.in/">
	 FreeBSD uses a two-process model for running a VM. For booting non-FreeBSD
	 guests, a modified grub-emu is used (grub-bhyve). Grub-bhyve executes command
	 from guest grub.cfg file. This is a security problem because grub was never
	 written to handle inputs from OS as untrusted. In the current design, grub
	 and guest OS works across trust boundaries. This exposes a grub to untrusted
	 inputs from guest.
	 
	 grub-bhyve (emu) is built without SDL graphics support which reduces lot of
	 gfx attack surface, however font loading code is still accessible. Guest can
	 provide arbitrary font file, which is parsed by grub-bhyve running as root.
	 
	 In grub-core/font/font.c, <code>read_section_as_string()</code> allocates
	 <code>section-&gt;length + 1</code> bytes of memory. However, untrusted
	 <code>section-&gt;length</code> is an unsigned 32-bit number, and the result can
	 overflow to <code>malloc(0)</code>. This can result in a controlled buffer
	 overflow via the 'loadfont' command in a guest VM grub2.cfg, eventually leading
	 to privilege escalation from guest to host.
	 
	</blockquote>
	Reno Robert also reports:
	
	<blockquote cite="https://www.voidsecurity.in/">
	 GRUB supports commands to read and write addresses of choice. In
	 grub-bhyve, these commands provide a way to write to arbitrary virtual
	 addresses within the grub-bhyve process. This is another way for a guest
	 grub2.cfg, run by the host, to eventually escalate privileges.
	 
	</blockquote>
	These vulnerabilities are mitigated by disabling the 'loadfont', 'write_dword',
	 'read_dword', 'inl', 'outl', and other width variants of the same functionality in
	 grub2-bhyve.
	
	There is also work in progress to sandbox the grub-bhyve utility such that
	 an escaped guest ends up with nobody:nobody in a Capsium sandbox. It is not
	 included in 0.40_8.
	
 </body>
 </description>
 <references>
 
 <url>https://www.voidsecurity.in/</url>
 </references>
 <dates>
 
 <discovery>2019-12-09</discovery>
 <entry>2020-02-12</entry>
 </dates>
 </vuln>

<vuln vid="00f30cba-4d23-11ea-86ba-641c67a117d8">
 <topic>libexif -- privilege escalation</topic>
 <affects>
 <package>
	<name>libexif</name>
	<range><lt>0.6.21_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9278">
	 In libexif, there is a possible out of bounds write due to an integer overflow.
 This could lead to remote escalation of privilege in the media content provider
 with no additional execution privileges needed. User interaction is needed for
 exploitation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-9278</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9278</url>
 <url>https://security-tracker.debian.org/tracker/CVE-2019-9278</url>
 <url>https://seclists.org/bugtraq/2020/Feb/9</url>
 <url>https://github.com/libexif/libexif/issues/26</url>
 </references>
 <dates>
 <discovery>2019-02-06</discovery>
 <entry>2020-02-11</entry>
 </dates>
 </vuln>

<vuln vid="d460b640-4cdf-11ea-a59e-6451062f0f7a">
 <topic>Flash Player -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>32.0.0.330</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb20-06.html">
	 <ul>
	 <li>This update resolves a type confusion vulnerability that
	 could lead to arbitrary code execution (CVE-2020-3757).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-3757</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb20-06.html</url>
 </references>
 <dates>
 <discovery>2020-02-11</discovery>
 <entry>2020-02-11</entry>
 </dates>
 </vuln>

<vuln vid="c1202de8-4b29-11ea-9673-4c72b94353b5">
 <topic>NGINX -- HTTP request smuggling</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><lt>1.16.1_11,2</lt></range>
 </package>
 <package>
	<name>nginx-devel</name>
	<range><lt>1.17.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NGINX Team reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20372">
	 NGINX before 1.17.7, with certain error_page configurations, allows HTTP
	 request smuggling, as demonstrated by the ability of an attacker to read
	 unauthorized web pages in environments where NGINX is being fronted by a
	 load balancer.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20372</url>
 <cvename>CVE-2019-20372</cvename>
 </references>
 <dates>
 <discovery>2019-12-10</discovery>
 <entry>2020-02-09</entry>
 </dates>
 </vuln>

<vuln vid="8b20d716-49df-11ea-9f7b-206a8a720317">
 <topic>ksh93 -- certain environment variables interpreted as arithmetic expressions on startup, leading to code injection</topic>
 <affects>
 <package>
	<name>ksh93</name>
	<range><ge>2020.0.0</ge><lt>2020.0.1_1,1</lt></range>
 </package>
 <package>
	<name>ksh93-devel</name>
	<range><lt>2020.02.07</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Upstream ksh93 maintainer Siteshwar Vashisht reports:
	<blockquote cite="https://access.redhat.com/security/cve/CVE-2019-14868">
	 A flaw was found in the way ksh evaluates certain environment
	 variables. An attacker could use this flaw to override or bypass
	 environment restrictions to execute shell commands. Services and
	 applications that allow remote unauthenticated attackers to
	 provide one of those environment variables could allow them to
	 exploit this issue remotely.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1757324</url>
 <url>https://access.redhat.com/security/cve/CVE-2019-14868</url>
 <url>https://access.redhat.com/errata/RHSA-2020:0431</url>
 </references>
 <dates>
 <discovery>2019-10-01</discovery>
 <entry>2020-02-07</entry>
 </dates>
 </vuln>

<vuln vid="e7bc2b99-485a-11ea-bff9-9c5c8e75236a">
 <topic>clamav -- Denial-of-Service (DoS) vulnerability</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.102.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Micah Snyder	 reports:
	<blockquote cite="https://blog.clamav.net/2020/02/clamav-01022-security-patch-released.html">
	 A denial-of-service (DoS) condition may occur when using the optional
	 credit card data-loss-prevention (DLP) feature. Improper bounds checking of
	 an unsigned variable resulted in an out-of-bounds read, which causes a crash.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.clamav.net/2020/02/clamav-01022-security-patch-released.html</url>
 <cvename>CVE-2020-3123</cvename>
 </references>
 <dates>
 <discovery>2020-02-05</discovery>
 <entry>2020-02-05</entry>
 </dates>
 </vuln>

<vuln vid="5a45649a-4777-11ea-bdec-08002728f74c">
 <topic>Django -- potential SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>py27-django111</name>
	<name>py35-django111</name>
	<name>py36-django111</name>
	<name>py37-django111</name>
	<name>py38-django111</name>
	<range><lt>1.11.28</lt></range>
 </package>
 <package>
	<name>py35-django22</name>
	<name>py36-django22</name>
	<name>py37-django22</name>
	<name>py38-django22</name>
	<range><lt>2.2.10</lt></range>
 </package>
 <package>
	<name>py36-django30</name>
	<name>py37-django30</name>
	<name>py38-django30</name>
	<range><lt>3.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE CVE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7471">
	 Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3
	 allows SQL Injection if untrusted data is used as a StringAgg delimiter
	 (e.g., in Django applications that offer downloads of data as a series
	 of rows with a user-specified column delimiter). By passing a suitably
	 crafted delimiter to a contrib.postgres.aggregates.StringAgg instance,
	 it was possible to break escaping and inject malicious SQL.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7471</url>
 <url>https://docs.djangoproject.com/en/1.11/releases/1.11.28/</url>
 <url>https://docs.djangoproject.com/en/2.2/releases/2.2.10/</url>
 <url>https://docs.djangoproject.com/en/3.0/releases/3.0.3/</url>
 <cvename>CVE-2020-7471</cvename>
 </references>
 <dates>
 <discovery>2020-02-03</discovery>
 <entry>2020-02-04</entry>
 </dates>
 </vuln>

<vuln vid="cb0183bb-45f6-11ea-a1c7-b499baebfeaf">
 <topic>MariaDB -- Vulnerability in C API</topic>
 <affects>
 <package>
	<name>mariadb55-client</name>
	<range><lt>5.5.67</lt></range>
 </package>
 <package>
	<name>mariadb55-server</name>
	<range><lt>5.5.67</lt></range>
 </package>
 <package>
	<name>mariadb101-client</name>
	<range><lt>10.1.44</lt></range>
 </package>
 <package>
	<name>mariadb101-server</name>
	<range><lt>10.1.44</lt></range>
 </package>
 <package>
	<name>mariadb102-client</name>
	<range><lt>10.2.31</lt></range>
 </package>
 <package>
	<name>mariadb102-server</name>
	<range><lt>10.2.31</lt></range>
 </package>
 <package>
	<name>mariadb103-client</name>
	<range><lt>10.3.22</lt></range>
 </package>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.22</lt></range>
 </package>
 <package>
	<name>mariadb104-client</name>
	<range><lt>10.4.12</lt></range>
 </package>
 <package>
	<name>mariadb104-server</name>
	<range><lt>10.4.12</lt></range>
 </package>
 <package>
	<name>mariadb-connector-c</name>
	<range><lt>3.1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MariaDB reports:
	<blockquote cite="https://mariadb.com/kb/en/security/">
	 Difficult to exploit vulnerability allows unauthenticated attacker
	 with network access via multiple protocols to compromise MySQL Client.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mariadb.com/kb/en/security/</url>
 <url>https://mariadb.com/kb/en/mdb-5567-rn/</url>
 <url>https://mariadb.com/kb/en/mdb-10412-rn/</url>
 <url>https://mariadb.com/kb/en/mdb-10322-rn/</url>
 <url>https://mariadb.com/kb/en/mdb-10231-rn/</url>
 <url>https://mariadb.com/kb/en/mdb-10144-rn/</url>
 <url>https://mariadb.com/kb/en/mariadb-connector-c-317-release-notes/</url>
 <cvename>CVE-2020-2574</cvename>
 </references>
 <dates>
 <discovery>2020-01-28</discovery>
 <entry>2020-02-02</entry>
 </dates>
 </vuln>

<vuln vid="1e7fa41b-f6ca-4fe8-bd46-0e176b42b14f">
 <topic>libssh -- Unsanitized location in scp could lead to unwanted command execution</topic>
 <affects>
 <package>
	<name>libssh</name>
	<range><ge>0.4.0</ge><lt>0.8.8</lt></range>
	<range><ge>0.9.0</ge><lt>0.9.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The libssh team reports:
	<blockquote cite="https://www.libssh.org/security/advisories/CVE-2019-14889.txt">
	 In an environment where a user is only allowed to copy files and
	 not to execute applications, it would be possible to pass a location
	 which contains commands to be executed in additon.
	 When the libssh SCP client connects to a server, the scp
	 command, which includes a user-provided path, is executed
	 on the server-side. In case the library is used in a way
	 where users can influence the third parameter of
	 ssh_scp_new(), it would become possible for an attacker to
	 inject arbitrary commands, leading to a compromise of the
	 remote target.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.libssh.org/security/advisories/CVE-2019-14889.txt</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-14889</url>
 <cvename>CVE-2019-14889</cvename>
 </references>
 <dates>
 <discovery>2019-11-14</discovery>
 <entry>2020-02-02</entry>
 </dates>
 </vuln>

<vuln vid="c86bfee3-4441-11ea-8be3-54e1ad3d6335">
 <topic>spamassassin -- Nefarious rule configuration files can run system commands</topic>
 <affects>
 <package>
	<name>spamassassin</name>
	<range><lt>3.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache SpamAssassin project reports:
	<blockquote cite="https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202001.mbox/%3c0a91e67a-3190-36e5-41e9-d3553743bcd2@apache.org%3e">
	 A nefarious rule configuration (.cf) files can be configured to
	 run system commands. This issue is less stealthy and attempts to
	 exploit the issue will throw warnings.
	 Thanks to Damian Lukowski at credativ for reporting the issue
	 ethically. With this bug unpatched, exploits can be injected in a
	 number of scenarios though doing so remotely is difficult. In
	 addition to upgrading to SA 3.4.4, we again recommend that users
	 should only use update channels or 3rd party .cf files from trusted
	 places.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202001.mbox/%3c0a91e67a-3190-36e5-41e9-d3553743bcd2@apache.org%3e</url>
 <url>https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202001.mbox/%3ccdae17ce-acde-6060-148a-6dc5f45ee728@apache.org%3e</url>
 <cvename>CVE-2020-1930</cvename>
 <cvename>CVE-2020-1931</cvename>
 </references>
 <dates>
 <discovery>2020-01-28</discovery>
 <entry>2020-01-31</entry>
 </dates>
 </vuln>

<vuln vid="b4e5f782-442d-11ea-9ba9-206a8a720317">
 <topic>sudo -- Potential bypass of Runas user restrictions</topic>
 <affects>
 <package>
 <name>sudo</name>
 <range><lt>1.8.31</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Todd C. Miller reports:
 <blockquote cite="https://www.sudo.ws/alerts/pwfeedback.html">
	 Sudo's pwfeedback option can be used to provide visual feedback
	 when the user is inputting their password. For each key press,
	 an asterisk is printed. This option was added in response to
	 user confusion over how the standard Password: prompt disables
	 the echoing of key presses. While pwfeedback is not enabled by
	 default in the upstream version of sudo, some systems, such as
	 Linux Mint and Elementary OS, do enable it in their default
	 sudoers files.
	 Due to a bug, when the pwfeedback option is enabled in the
	 sudoers file, a user may be able to trigger a stack-based buffer
	 overflow. This bug can be triggered even by users not listed in
	 the sudoers file. There is no impact unless pwfeedback has been
	 enabled.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://www.sudo.ws/alerts/pwfeedback.html</url>
 <cvename>CVE-2019-18634</cvename>
 </references>
 <dates>
 <discovery>2020-01-30</discovery>
 <entry>2020-01-30</entry>
 </dates>
 </vuln>

<vuln vid="c5bd9068-440f-11ea-9cdb-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.7.0</ge><lt>12.7.4</lt></range>
	<range><ge>12.6.0</ge><lt>12.6.6</lt></range>
	<range><ge>5.3</ge><lt>12.5.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/">
	 Path Traversal to Arbitrary File Read
	 User Permissions Not Validated in ProjectExportWorker
	 XSS Vulnerability in File API
	 Package and File Disclosure through GitLab Workhorse
	 XSS Vulnerability in Create Groups
	 Issue and Merge Request Activity Counts Exposed
	 Email Confirmation Bypass Using AP
	 Disclosure of Forked Private Project Source Code
	 Private Project Names Exposed in GraphQL queries
	 Disclosure of Issues and Merge Requests via Todos
	 Denial of Service via AsciiDoc
	 Last Pipeline Status Exposed
	 Arbitrary Change of Pipeline Status
	 Grafana Token Displayed in Plaintext
	 Update excon gem
	 Update rdoc gem
	 Update rack-cors gem
	 Update rubyzip gem
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/</url>
 <cvename>CVE-2020-7966</cvename>
 <cvename>CVE-2020-8114</cvename>
 <cvename>CVE-2020-7973</cvename>
 <cvename>CVE-2020-6833</cvename>
 <cvename>CVE-2020-7971</cvename>
 <cvename>CVE-2020-7967</cvename>
 <cvename>CVE-2020-7972</cvename>
 <cvename>CVE-2020-7968</cvename>
 <cvename>CVE-2020-7979</cvename>
 <cvename>CVE-2020-7969</cvename>
 <cvename>CVE-2020-7978</cvename>
 <cvename>CVE-2020-7974</cvename>
 <cvename>CVE-2020-7977</cvename>
 <cvename>CVE-2020-7976</cvename>
 <cvename>CVE-2019-16779</cvename>
 <cvename>CVE-2019-18978</cvename>
 <cvename>CVE-2019-16892</cvename>
 </references>
 <dates>
 <discovery>2020-01-30</discovery>
 <entry>2020-01-31</entry>
 </dates>
 </vuln>

<vuln vid="08f5c27d-4326-11ea-af8b-00155d0a0200">
 <topic>OpenSMTPd -- critical LPE / RCE vulnerability</topic>
 <affects>
 <package>
	<name>opensmtpd</name>
	<range><ge>6.4.0,1</ge><lt>6.6.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSMTPD developers report:
	<blockquote cite="https://opensmtpd.org/security.html">
	 An incorrect check allows an attacker to trick mbox delivery
	 into executing arbitrary commands as root and lmtp delivery
	 into executing arbitrary commands as an unprivileged user
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-7247</cvename>
 <url>https://www.openwall.com/lists/oss-security/2020/01/28/3</url>
 </references>
 <dates>
 <discovery>2020-01-28</discovery>
 <entry>2020-01-29</entry>
 </dates>
 </vuln>

<vuln vid="a250539d-d1d4-4591-afd3-c8bdfac335d8">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><le>2.219</le></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><le>2.204.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://jenkins.io/security/advisory/2020-01-29/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-1682 / CVE-2020-2099</h5>
	 Inbound TCP Agent Protocol/3 authentication bypass
	 <h5>(Medium) SECURITY-1641 / CVE-2020-2100</h5>
	 Jenkins vulnerable to UDP amplification reflection attack
	 <h5>(Medium) SECURITY-1659 / CVE-2020-2101</h5>
	 Non-constant time comparison of inbound TCP agent connection secret
	 <h5>(Medium) SECURITY-1660 / CVE-2020-2102</h5>
	 Non-constant time HMAC comparison
	 <h5>(Medium) SECURITY-1695 / CVE-2020-2103</h5>
	 Diagnostic page exposed session cookies
	 <h5>(Medium) SECURITY-1650 / CVE-2020-2104</h5>
	 Memory usage graphs accessible to anyone with Overall/Read
	 <h5>(Low) SECURITY-1704 / CVE-2020-2105</h5>
	 Jenkins REST APIs vulnerable to clickjacking
	 <h5>(Medium) SECURITY-1680 / CVE-2020-2106</h5>
	 Stored XSS vulnerability in Code Coverage API Plugin
	 <h5>(Medium) SECURITY-1565 / CVE-2020-2107</h5>
	 Fortify Plugin stored credentials in plain text
	 <h5>(High) SECURITY-1719 / CVE-2020-2108</h5>
	 XXE vulnerability in WebSphere Deployer Plugin
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2020-2099</cvename>
 <cvename>CVE-2020-2100</cvename>
 <cvename>CVE-2020-2101</cvename>
 <cvename>CVE-2020-2102</cvename>
 <cvename>CVE-2020-2103</cvename>
 <cvename>CVE-2020-2104</cvename>
 <cvename>CVE-2020-2105</cvename>
 <cvename>CVE-2020-2106</cvename>
 <cvename>CVE-2020-2107</cvename>
 <cvename>CVE-2020-2108</cvename>
 <url>https://jenkins.io/security/advisory/2020-01-29/</url>
 </references>
 <dates>
 <discovery>2020-01-29</discovery>
 <entry>2020-01-29</entry>
 </dates>
 </vuln>

<vuln vid="2af10639-4299-11ea-aab1-98fa9bfec35a">
 <topic>pkg -- vulnerability in libfetch</topic>
 <affects>
 <package>
	<name>pkg</name>
	<range><lt>1.12.0_1</lt></range>
 </package>
 <package>
	<name>pkg-devel</name>
	<range><lt>1.12.99_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A programming error allows an attacker who can specify a URL with a username
	 and/or password components to overflow libfetch(3) buffers.
 </body>
 </description>
 <references>
 <freebsdsa>SA-20:01.libfetch</freebsdsa>
 <cvename>CVE-2020-7450</cvename>
 </references>
 <dates>
 <discovery>2020-01-28</discovery>
 <entry>2020-01-29</entry>
 </dates>
 </vuln>

<vuln vid="5f0dd349-40a2-11ea-8d8c-005056a311d1">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba410</name>
	<range><lt>4.10.12</lt></range>
 </package>
 <package>
	<name>samba411</name>
	<range><lt>4.11.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="https://www.samba.org/samba/history/samba-4.10.12.html">
	 CVE-2019-14902
	 The implementation of ACL inheritance in the Samba AD DC was not complete,
	 and so absent a 'full-sync' replication, ACLs could get out of sync between
	 domain controllers.
	 CVE-2019-14907
	 When processing untrusted string input Samba can read past the end of the
	 allocated buffer when printing a "Conversion error" message to the logs.
	 CVE-2019-19344
	 During DNS zone scavenging (of expired dynamic entries) there is a read of
	 memory after it has been freed.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/history/samba-4.10.12.html</url>
 <cvename>CVE-2019-14902</cvename>
 <cvename>CVE-2019-14907</cvename>
 <cvename>CVE-2019-19344</cvename>
 </references>
 <dates>
 <discovery>2020-01-14</discovery>
 <entry>2020-01-27</entry>
 </dates>
 </vuln>

<vuln vid="dc8cff4c-4063-11ea-8a94-3497f6939fdd">
 <topic>webkit-gtk3 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>webkit2-gtk3</name>
	<range><lt>2.26.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The WebKitGTK project reports multiple vulnerabilities.
 </body>
 </description>
 <references>
 <url>https://webkitgtk.org/security/WSA-2020-0001.html</url>
 <cvename>CVE-2019-8835</cvename>
 <cvename>CVE-2019-8844</cvename>
 <cvename>CVE-2019-8846</cvename>
 </references>
 <dates>
 <discovery>2020-01-23</discovery>
 <entry>2020-01-26</entry>
 </dates>
 </vuln>

<vuln vid="0700e76c-3eb0-11ea-8478-3085a9a95629">
 <topic>Pillow -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-pillow</name>
	<name>py35-pillow</name>
	<name>py36-pillow</name>
	<name>py37-pillow</name>
	<name>py38-pillow</name>
	<range><lt>6.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pillow developers report:
	<blockquote cite="https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html">
	 
	 This release addresses several security problems, as well as
	 addressing CVE-2019-19911.
	 
	 CVE-2019-19911 is regarding FPX images. If an image reports that it
	 has a large number of bands, a large amount of resources will be
	 used when trying to process the image. This is fixed by limiting the
	 number of bands to those usable by Pillow.
	 
	 Buffer overruns were found when processing an SGI, PCX or FLI image.
	 Checks have been added to prevent this.
	 
	 Overflow checks have been added when calculating the size of a
	 memory block to be reallocated in the processing of a TIFF image.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html</url>
 <cvename>CVE-2019-19911</cvename>
 <cvename>CVE-2020-5310</cvename>
 <cvename>CVE-2020-5311</cvename>
 <cvename>CVE-2020-5312</cvename>
 <cvename>CVE-2020-5313</cvename>
 <freebsdpr>ports/243336</freebsdpr>
 </references>
 <dates>
 <discovery>2019-12-19</discovery>
 <entry>2020-01-24</entry>
 </dates>
 </vuln>

<vuln vid="a512a412-3a33-11ea-af63-0800274e5f20">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.10.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.10.3">
	 <ul>
	 <li>Hide credentials when submitting migration</li>
	 <li>Never allow an empty password to validate</li>
	 <li>Prevent redirect to Host</li>
	 <li>Hide public repos owned by private orgs</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.10.3</url>
 <freebsdpr>ports/243437</freebsdpr>
 </references>
 <dates>
 <discovery>2019-11-22</discovery>
 <entry>2020-01-18</entry>
 </dates>
 </vuln>

<vuln vid="a6cf65ad-37d2-11ea-a1c7-b499baebfeaf">
 <topic>MySQL -- Multiple vulerabilities</topic>
 <affects>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.47</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.29</lt></range>
 </package>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.19</lt></range>
 </package>
 <package>
	<name>percona55-server</name>
	<range><lt>5.5.67</lt></range>
 </package>
 <package>
	<name>percona56-server</name>
	<range><lt>5.6.47</lt></range>
 </package>
 <package>
	<name>percona57-server</name>
	<range><lt>5.7.29</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpujan2020.html#AppendixMSQL">
	 This Critical Patch Update contains 17 new security fixes for
	 Oracle MySQL. 5 of these vulnerabilities may be remotely exploitable
	 without authentication, i.e., may be exploited over a network without
	 requiring user credentials.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/security-alerts/cpujan2020.html</url>
 <cvename>CVE-2019-1547</cvename>
 <cvename>CVE-2020-2579</cvename>
 <cvename>CVE-2020-2686</cvename>
 <cvename>CVE-2020-2627</cvename>
 <cvename>CVE-2020-2570</cvename>
 <cvename>CVE-2020-2573</cvename>
 <cvename>CVE-2020-2574</cvename>
 <cvename>CVE-2020-2577</cvename>
 <cvename>CVE-2020-2589</cvename>
 <cvename>CVE-2020-2580</cvename>
 <cvename>CVE-2020-2588</cvename>
 <cvename>CVE-2020-2660</cvename>
 <cvename>CVE-2020-2679</cvename>
 <cvename>CVE-2020-2584</cvename>
 <cvename>CVE-2020-2694</cvename>
 <cvename>CVE-2020-2572</cvename>
 <cvename>CVE-2019-8457</cvename>
 </references>
 <dates>
 <discovery>2020-01-14</discovery>
 <entry>2020-01-15</entry>
 <modified>2020-02-02</modified>
 </dates>
 </vuln>

<vuln vid="d2c2c815-3793-11ea-8be3-54e1ad3d6335">
 <topic>drm graphics drivers -- potential information disclusure via local access</topic>
 <affects>
 <package>
	<name>drm-fbsd11.2-kmod</name>
	<range><lt>4.11.g20200115</lt></range>
 </package>
 <package>
	<name>drm-fbsd12.0-kmod</name>
	<range><lt>4.16.g20200115</lt></range>
 </package>
 <package>
	<name>drm-current-kmod</name>
	<range><lt>4.16.g20200115</lt></range>
 </package>
 <package>
	<name>drm-devel-kmod</name>
	<range><lt>5.0.g20200115</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Intel reports:
	<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00314.html">
	 .A potential security vulnerability in Intel(R) Processor Graphics
	 may allow information disclosure. Intel is releasing software
	 updates to mitigate this potential vulnerability.
	 Description: Insufficient control flow in certain data
	 structures for some Intel(R) Processors with Intel(R) Processor
	 Graphics may allow an unauthenticated user to potentially enable
	 information disclosure via local access.
	 This patch provides mitigation for Gen9 hardware only. Patches
	 for Gen7 and Gen7.5 will be provided later. Note that Gen8 is not
	 impacted due to a previously implemented workaround. The mitigation
	 involves using an existing hardware feature to forcibly clear down
	 all EU state at each context switch.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00314.html</url>
 <cvename>CVE-2019-14615</cvename>
 </references>
 <dates>
 <discovery>2020-01-14</discovery>
 <entry>2020-01-15</entry>
 </dates>
 </vuln>

<vuln vid="2bab995f-36d4-11ea-9dad-002590acae31">
 <topic>Template::Toolkit -- Directory traversal on write</topic>
 <affects>
 <package>
	<name>p5-Template-Toolkit</name>
	<range><lt>3.004</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Art Manion and Will Dormann report:
	<blockquote cite="https://www.kb.cert.org/vuls/id/619785/">
	 
	 By using an older and less-secure form of open(), it is
	 possible for untrusted template files to cause reads/writes
	 outside of the template directories. This vulnerability is
	 a component of the recent Citrix exploit.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.kb.cert.org/vuls/id/619785/</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19781</url>
 <cvename>CVE-2019-19781</cvename>
 </references>
 <dates>
 <discovery>2019-12-13</discovery>
 <entry>2020-01-14</entry>
 </dates>
 </vuln>

<vuln vid="f929b172-369e-11ea-9cdb-001b217b3468">
 <topic>Gitlab -- Private objects exposed through project import</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.6.0</ge><lt>12.6.4</lt></range>
	<range><ge>12.5.0</ge><lt>12.5.7</lt></range>
	<range><ge>8.9.0</ge><lt>12.4.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/releases/2020/01/13/critical-security-release-gitlab-12-dot-6-dot-4-released/">
	 Private objects exposed through project importi
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/releases/2020/01/13/critical-security-release-gitlab-12-dot-6-dot-4-released/</url>
 <cvename>CVE-2020-6832</cvename>
 </references>
 <dates>
 <discovery>2020-01-13</discovery>
 <entry>2020-01-14</entry>
 </dates>
 </vuln>

<vuln vid="8b61308b-322a-11ea-b34b-1de6fb24355d">
 <topic>e2fsprogs -- rehash.c/pass 3a mutate_name() code execution vulnerability</topic>
 <affects>
 <package>
	<name>e2fsprogs</name>
	<range><lt>1.45.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Lilith of Cisco Talos reports:
	<blockquote cite="https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973">
	 
	 A code execution vulnerability exists in the directory rehashing
	 functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4
	 directory can cause an out-of-bounds write on the stack, resulting
	 in code execution. An attacker can corrupt a partition to trigger
	 this vulnerability.
	 
	</blockquote>
	Theodore Y. Ts'o reports:
	<blockquote cite="http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.5">
	 
	 E2fsprogs 1.45.5 [...:] Fix a potential out of bounds write when
	 checking a maliciously corrupted file system. This is probably not
	 exploitable on 64-bit platforms, but may be exploitable on 32-bit
	 binaries depending on how the compiler lays out the stack variables.
	 (Addresses CVE-2019-5188)
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973</url>
 <url>http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.5</url>
 <cvename>CVE-2019-5188</cvename>
 </references>
 <dates>
 <discovery>2019-12-18</discovery>
 <entry>2020-01-08</entry>
 </dates>
 </vuln>

<vuln vid="16aed7b7-344a-11ea-9cdb-001b217b3468">
 <topic>phpMyAdmin -- SQL injection</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<name>phpMyAdmin-php72</name>
	<name>phpMyAdmin-php73</name>
	<name>phpMyAdmin-php74</name>
	<name>phpMyAdmin5</name>
	<name>phpMyAdmin5-php72</name>
	<name>phpMyAdmin5-php73</name>
	<name>phpMyAdmin5-php74</name>
	<range><lt>4.9.4</lt></range>
	<range><ge>5.0.0</ge><lt>5.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2020-1/">
	 A SQL injection flaw has been discovered in the user accounts page
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2020-1/</url>
 <cvename>CVE-2020-5504</cvename>
 </references>
 <dates>
 <discovery>2020-01-05</discovery>
 <entry>2020-01-11</entry>
 </dates>
 </vuln>

<vuln vid="86224a04-26de-11ea-97f2-001a8c5c04b6">
 <topic>cacti -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>1.2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cacti developers reports:
	<blockquote cite="https://github.com/Cacti/cacti/releases/tag/release%2F1.2.8">
	 
	 When viewing graphs, some input variables are not properly checked
	 (SQL injection possible).
	 
	 
	 Multiple instances of lib/functions.php are affected by unsafe
	 deserialization of user-controlled data to populate arrays. An
	 authenticated attacker could use this to influence object data
	 values and control actions taken by Cacti or potentially cause
	 memory corruption in the PHP module.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/Cacti/cacti/releases/tag/release%2F1.2.8</url>
 <cvename>CVE-2019-17357</cvename>
 <cvename>CVE-2019-17358</cvename>
 <freebsdpr>ports/242834</freebsdpr>
 </references>
 <dates>
 <discovery>2019-10-12</discovery>
 <entry>2020-01-06</entry>
 </dates>
 </vuln>

<vuln vid="01bde18a-2e09-11ea-a935-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.6.0</ge><lt>12.6.2</lt></range>
	<range><ge>12.5.0</ge><lt>12.5.6</lt></range>
	<range><ge>5.1.0</ge><lt>12.4.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GitLab Team reports:
	<blockquote cite="https://about.gitlab.com/blog/2020/01/02/security-release-gitlab-12-6-2-released/">
	 Group Maintainers Can Update/Delete Group Runners Using API
	 GraphQL Queries Can Hang the Application
	 Unauthorized Users Have Access to Milestones of Releases
	 Private Group Name Revealed Through Protected Tags API
	 Users Can Publish Reviews on Locked Merge Requests
	 DoS in the Issue and Commit Comments Pages
	 Project Name Disclosed Through Unsubscribe Link
	 Private Project Name Disclosed Through Notification Settings
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/blog/2020/01/02/security-release-gitlab-12-6-2-released/</url>
 <cvename>CVE-2019-20144</cvename>
 <cvename>CVE-2019-20146</cvename>
 <cvename>CVE-2019-20143</cvename>
 <cvename>CVE-2019-20147</cvename>
 <cvename>CVE-2019-20145</cvename>
 <cvename>CVE-2019-20142</cvename>
 <cvename>CVE-2019-20148</cvename>
 <cvename>CVE-2020-5197</cvename>
 </references>
 <dates>
 <discovery>2020-01-02</discovery>
 <entry>2020-01-03</entry>
 </dates>
 </vuln>

<vuln vid="66e4dc99-28b3-11ea-8dde-08002728f74c">
 <topic>rack -- information leak / session hijack vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-rack</name>
	<range><ge>2.0.0</ge><lt>2.0.8,3</lt></range>
 </package>
 <package>
	<name>rubygem-rack16</name>
	<range><ge>1.6.0</ge><lt>1.6.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	National Vulnerability Database:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-16782">
	 There's a possible information leak / session hijack vulnerability in
	 Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12
	 and 2.0.8. Attackers may be able to find and hijack sessions by using
	 timing attacks targeting the session id. Session ids are usually stored
	 and indexed in a database that uses some kind of scheme for speeding up
	 lookups of that session id. By carefully measuring the amount of time
	 it takes to look up a session, an attacker may be able to find a valid
	 session id and hijack the session. The session id itself may be
	 generated randomly, but the way the session is indexed by the backing
	 store does not use a secure comparison.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-16782</url>
 <url>https://github.com/rack/rack/blob/master/CHANGELOG.md</url>
 <cvename>CVE-2019-16782</cvename>
 </references>
 <dates>
 <discovery>2019-12-08</discovery>
 <entry>2019-12-29</entry>
 </dates>
 </vuln>

<vuln vid="e4d9dffb-2a32-11ea-9693-e1b3f6feec79">
 <topic>OpenEXR -- heap buffer overflow, and out-of-memory bugs</topic>
 <affects>
 <package>
	<name>ilmbase</name>
	<range><lt>2.3.0_4</lt></range>
 </package>
 <package>
	<name>openexr</name>
	<range><lt>2.3.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cary Phillips reports:
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.0">
	 OpenEXR (IlmBase) v2.4.0 fixes the following security vulnerabilities:
	 <ul>
	 <li>CVE-2018-18444 Issue #351 Out of Memory</li>
	 <li>CVE-2018-18443 Issue #350 heap-buffer-overflow</li>
	 </ul>
	 The relevant patches have been backported to the FreeBSD ports.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.0</url>
 <url>https://github.com/AcademySoftwareFoundation/openexr/issues/350</url>
 <url>https://github.com/AcademySoftwareFoundation/openexr/issues/351</url>
 <cvename>CVE-2018-18443</cvename>
 <cvename>CVE-2018-18444</cvename>
 </references>
 <dates>
 <discovery>2018-10-17</discovery>
 <entry>2019-12-29</entry>
 </dates>
 </vuln>

<vuln vid="7b97b32e-27c4-11ea-9673-4c72b94353b5">
 <topic>wordpress -- multiple issues</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>5.3.1,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>zh_CN-wordpress</name>
	<name>zh_TW-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<range><lt>5.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wordpress developers reports:
	<blockquote cite="https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/">
	 Four security issues affect WordPress versions 5.3 and earlier; version 5.3.1 fixes them, so youll want to upgrade.
	 If you havent yet updated to 5.3, there are also updated versions of 5.2 and earlier that fix the security issues.
	 -Props to Daniel Bachhuber for finding an issue where an unprivileged user could make a post sticky via the REST API.
	 -Props to Simon Scannell of RIPS Technologies for finding and disclosing an issue where cross-site scripting (XSS)
	 could be stored in well-crafted links.
	 -Props to the WordPress.org Security Team for hardening wp_kses_bad_protocol() to ensure that it is aware of the named
	 colon attribute.
	 -Props to Nguyen The Duc for discovering a stored XSS vulnerability using block editor content.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2019-12-13</discovery>
 <entry>2019-12-26</entry>
 </dates>
 </vuln>

<vuln vid="1c9178aa-2709-11ea-9673-4c72b94353b5">
 <topic>typo3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>typo3-8</name>
	<range><lt>8.7.30</lt></range>
 </package>
 <package>
	<name>typo3-9</name>
	<range><lt>9.5.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Typo3 core team reports:
	<blockquote cite="https://typo3.org/article/typo3-10-2-1-9-5-12-and-8-7-30-security-releases-published">
	 It has been discovered that the output of field validation errors in the Form Framework is vulnerable
	 to cross-site scripting.
	 It has been discovered that t3:// URL handling and typolink functionality are vulnerable to cross-site
	 scripting. Not only regular backend forms are affected but also frontend extensions which use the rendering
	 with typolink.
	 It has been discovered that the output table listing in the Files backend module is vulnerable to cross-site
	 scripting when a file extension contains malicious sequences. Access to the file system of the server - either
	 directly or through synchronization - is required to exploit the vulnerability.
	 It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable
	 to directory traversal. Admin privileges are required in order to exploit this vulnerability. Since TYPO3 v9 LTS,
	 System Maintainer privileges are required as well.
	 Failing to properly escape user submitted content, class QueryGenerator is vulnerable to SQL injection.
	 Having system extension ext:lowlevel installed and a valid backend user having administrator privileges are
	 required to exploit this vulnerability.
	 It has been discovered that classes QueryGenerator and QueryView are vulnerable to insecure deserialization.
	 Requirements for successfully exploiting this vulnerability (one of the following):
	 - having system extension ext:lowlevel (Backend Module: DB Check) installed and valid backend user having
	 administrator privileges
	 - having system extension ext:sys_action installed and valid backend user having limited privileges
	 TYPO3 allows to upload files either in the backend user interface as well as in custom developed extensions.
	 To reduce the possibility to upload potential malicious code TYPO3 uses the fileDenyPattern to deny e.g. user
	 submitted PHP scripts from being persisted. Besides that it is possible for any editor to upload file assets
	 using the file module (fileadmin) or changing their avatar image shown in the TYPO3 backend.

Per default TYPO3 allows to upload and store HTML and SVG files as well using the mentioned functionalities.
	    Custom extension implementations probably would also accept those files when only the fileDenyPattern is evaluated.

Since HTML and SVG files - which might contain executable JavaScript code per W3C standard - could be directly
	    displayed in web clients, the whole web application is exposed to be vulnerable concerning Cross-Site Scripting.
	    Currently the following scenarios are known - given an authenticated regular editor is able to upload files using
	    the TYPO3 backend:
	    - directly target a potential victim to a known public resource in a URL, e.g. /fileadmin/malicious.svg or
	    /fileadmin/malicious.html
	    - using the TypoScript content object “SVG” (implemented in class ScalableVectorGraphicsContentObject)
	    having renderMode set to inline for SVG files (available since TYPO3 v9.0)
	    - custom implementations that directly output and render markup of HTML and SVG files

SVG files that are embedded using an img src=”malicious.svg” tag are not vulnerable since potential
	 scripts are not executed in these scenarios (see https://www.w3.org/wiki/SVG_Security). The icon API of TYPO3
	 is not scope of this announcement since SVG icons need to be registered using an individual implementation,
	 which is not considered as user submitted content.
	 It has been discovered that request handling in Extbase can be vulnerable to insecure deserialization.
	 User submitted payload has to be signed with a corresponding HMAC-SHA1 using the sensitive TYPO3 encryptionKey
	 as secret - invalid or unsigned payload is not deserialized.

However, since sensitive information could have been leaked by accident (e.g. in repositories or in commonly
	      known and unprotected backup files), there is the possibility that attackers know the private encryptionKey
	      and are able to calculate the required HMAC-SHA1 to allow a malicious payload to be deserialized.

Requirements for successfully exploiting this vulnerability (all of the following):
	 - rendering at least one Extbase plugin in the frontend
	 - encryptionKey has been leaked (from LocalConfiguration.php or corresponding .env file). 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2019-021/</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2019-022/</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2019-023/</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2019-024/</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2019-025/</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2019-026/</url>
 <url>https://typo3.org/security/advisory/typo3-psa-2019-010/</url>
 <url>https://typo3.org/security/advisory/typo3-psa-2019-011/</url>
 </references>
 <dates>
 <discovery>2019-12-17</discovery>
 <entry>2019-12-25</entry>
 </dates>
 </vuln>

<vuln vid="ad3451b9-23e0-11ea-8b36-f1925a339a82">
 <topic>e2fsprogs -- maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck</topic>
 <affects>
 <package>
	<name>e2fsprogs</name>
	<range><lt>1.45.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ted Y. Ts'o reports:
	<blockquote cite="http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.4">
	 A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.4</url>
 <cvename>CVE-2019-5094</cvename>
 </references>
 <dates>
 <discovery>2019-09-23</discovery>
 <entry>2019-12-21</entry>
 </dates>
 </vuln>

<vuln vid="3da0352f-2397-11ea-966e-000ffec0b3e1">
 <topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.69</lt></range>
 </package>
 <package>
	<name>drupal8</name>
	<range><lt>8.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/sa-core-2019-009">
	 A visit to install.php can cause cached data to become corrupted.
	 This could cause a site to be impaired until caches are rebuilt.
	</blockquote>
	<blockquote cite="https://www.drupal.org/sa-core-2019-010">
	 Drupal 8 core's file_save_upload() function does not strip the
	 leading and trailing dot ('.') from filenames, like Drupal 7 did.
	 Users with the ability to upload files with any extension in
	 conjunction with contributed modules may be able to use this to
	 upload system files such as .htaccess in order to bypass protections
	 afforded by Drupal's default .htaccess file. After this fix,
	 file_save_upload() now trims leading and trailing dots from filenames.
	 
	</blockquote>
	<blockquote cite="https://www.drupal.org/sa-core-2019-011">
	 The Media Library module has a security vulnerability whereby it
	 doesn't sufficiently restrict access to media items in certain
	 configurations.
	 
	</blockquote>
	<blockquote cite="https://www.drupal.org/sa-core-2019-012">
	 The Drupal project uses the third-party library Archive_Tar, which
	 has released a security-related feature that impacts some Drupal
	 configurations. Multiple vulnerabilities are possible if Drupal is
	 configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and
	 processes them. The latest versions of Drupal update Archive_Tar to
	 1.4.9 to mitigate the file processing vulnerabilities.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/sa-core-2019-009</url>
 <url>https://www.drupal.org/sa-core-2019-010</url>
 <url>https://www.drupal.org/sa-core-2019-011</url>
 <url>https://www.drupal.org/sa-core-2019-012</url>
 </references>
 <dates>
 <discovery>2019-12-18</discovery>
 <entry>2019-12-21</entry>
 </dates>
 </vuln>

<vuln vid="ed8cbad5-21a8-11ea-9b6d-901b0e934d69">
 <topic>py-matrix-synapse -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py35-matrix-synapse</name>
	<name>py36-matrix-synapse</name>
	<name>py37-matrix-synapse</name>
	<range><lt>1.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://github.com/matrix-org/synapse/releases/tag/v1.7.1">
	 The [synapse 1.7.1] release includes several security fixes as well
	 as a fix to a bug exposed by the security fixes. All previous releases
	 of Synapse are affected. Administrators are encouraged to upgrade as
	 soon as possible.
	 <ul>
	 <li>Fix a bug which could cause room events to be incorrectly authorized
	 using events from a different room.</li>
	 <li>Fix a bug causing responses to the /context client endpoint to not
	 use the pruned version of the event.</li>
	 <li>Fix a cause of state resets in room versions 2 onwards.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/matrix-org/synapse/releases/tag/v1.7.1</url>
 </references>
 <dates>
 <discovery>2019-12-18</discovery>
 <entry>2019-12-18</entry>
 </dates>
 </vuln>

<vuln vid="d778ddb0-2338-11ea-a1c7-b499baebfeaf">
 <topic>OpenSSL -- Overflow vulnerability</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2u,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20191206.txt">
	 rsaz_512_sqr overflow bug on x86_64 (CVE-2019-1551) (Low) 
	 There is an overflow bug in the x64_64 Montgomery squaring procedure
	 used in exponentiation with 512-bit moduli. No EC algorithms are
	 affected. Analysis suggests that attacks against 2-prime RSA1024,
	 3-prime RSA1536, and DSA1024 as a result of this defect would be very
	 difficult to perform and are not believed likely. Attacks against
	 DH512 are considered just feasible. However, for an attack the target
	 would have to re-use the DH512 private key, which is not recommended
	 anyway. Also applications directly using the low level API BN_mod_exp
	 may be affected if they use BN_FLG_CONSTTIME.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20191206.txt</url>
 <cvename>CVE-2019-1551</cvename>
 </references>
 <dates>
 <discovery>2019-12-06</discovery>
 <entry>2019-12-20</entry>
 </dates>
 </vuln>

<vuln vid="70111759-1dae-11ea-966a-206a8a720317">
 <topic>spamassassin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>spamassassin</name>
	<range><lt>3.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	the Apache Spamassassin project reports:
	<blockquote cite="https://www.cybersecurity-help.cz/vdb/SB2019121311">
	 An input validation error of user-supplied input parsing
	 multipart emails. Specially crafted emails can consume all
	 resources on the system.
	 A local user is able to execute arbitrary shell commands
	 through specially crafted nefarious CF files.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.cybersecurity-help.cz/vdb/SB2019121311</url>
	<cvename>CVE-2019-12420</cvename>
	<cvename>CVE-2018-11805</cvename>
 </references>
 <dates>
 <discovery>2019-12-11</discovery>
 <entry>2019-12-13</entry>
 </dates>
 </vuln>

<vuln vid="1edae47e-1cdd-11ea-8c2a-08002743b791">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba48</name>
	<range><ge>4.8.0</ge></range>
 </package>
 <package>
	<name>samba410</name>
	<range><lt>4.10.11</lt></range>
 </package>
 <package>
	<name>samba411</name>
	<range><lt>4.11.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="https://www.samba.org/samba/history/samba-4.10.11.html">
	 CVE-2019-14861:
	 An authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name.
	 CVE-2019-14870:
	 The DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/history/samba-4.10.11.html</url>
 <cvename>CVE-2019-14861</cvename>
 <cvename>CVE-2019-14870</cvename>
 </references>
 <dates>
 <discovery>2019-12-10</discovery>
 <entry>2019-12-12</entry>
 </dates>
 </vuln>

<vuln vid="b7dc4dde-2e48-43f9-967a-c68461537cf2">
 <topic>dovecot -- null pointer deref in notify with empty headers</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><ge>2.3.9</ge><lt>2.3.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aki Tuomi reports
	<blockquote cite="https://dovecot.org/pipermail/dovecot/2019-December/117894.html">
	 Mail with group address as sender will cause a signal 11 crash in push
 notification drivers. Group address as recipient can cause crash in some
 drivers.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://dovecot.org/pipermail/dovecot/2019-December/117894.html</url>
 <cvename>CVE-2019-19722</cvename>
 </references>
 <dates>
 <discovery>2019-12-10</discovery>
 <entry>2019-12-13</entry>
 </dates>
 </vuln>

<vuln vid="21944144-1b90-11ea-a2d4-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.5.0</ge><lt>12.5.4</lt></range>
	<range><ge>12.4.0</ge><lt>12.4.6</lt></range>
	<range><ge>10.5.0</ge><lt>12.3.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/blog/2019/12/10/critical-security-release-gitlab-12-5-4-released/">
	 Path traversal with potential remote code execution
	 Disclosure of private code via Elasticsearch integration
	 Update Git dependency
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/blog/2019/12/10/critical-security-release-gitlab-12-5-4-released/</url>
 <cvename>CVE-2019-19628</cvename>
 <cvename>CVE-2019-19629</cvename>
 <cvename>CVE-2019-19604</cvename>
 </references>
 <dates>
 <discovery>2019-12-10</discovery>
 <entry>2019-12-10</entry>
 </dates>
 </vuln>

<vuln vid="22ae307a-1ac4-11ea-b267-001cc0382b2f">
 <topic>Ghostscript -- Security bypass vulnerabilities</topic>
 <affects>
 <package>
	<name>ghostscript9-agpl-base</name>
	<name>ghostscript9-agpl-x11</name>
	<range><lt>9.50</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cedric Buissart (Red Hat) reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14811">
	 A flaw was found in, ghostscript versions prior to 9.50, in the
	 .pdf_hook_DSC_Creator procedure where it did not properly secure
	 its privileged calls, enabling scripts to bypass `-dSAFER`
	 restrictions. A specially crafted PostScript file could disable
	 security protection and then have access to the file system, or
	 execute arbitrary commands.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14812">
	 A flaw was found in all ghostscript versions 9.x before 9.50, in
	 the .setuserparams2 procedure where it did not properly secure its
	 privileged calls, enabling scripts to bypass `-dSAFER`
	 restrictions. A specially crafted PostScript file could disable
	 security protection and then have access to the file system, or
	 execute arbitrary commands.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14813">
	 A flaw was found in ghostscript, versions 9.x before 9.50, in the
	 setsystemparams procedure where it did not properly secure its
	 privileged calls, enabling scripts to bypass `-dSAFER`
	 restrictions. A specially crafted PostScript file could disable
	 security protection and then have access to the file system, or
	 execute arbitrary commands.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14817">
	 A flaw was found in, ghostscript versions prior to 9.50, in the
	 .pdfexectoken and other procedures where it did not properly secure
	 its privileged calls, enabling scripts to bypass `-dSAFER`
	 restrictions. A specially crafted PostScript file could disable
	 security protection and then have access to the file system, or
	 execute arbitrary commands.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-14811</cvename>
 <cvename>CVE-2019-14812</cvename>
 <cvename>CVE-2019-14813</cvename>
 <cvename>CVE-2019-14817</cvename>
 </references>
 <dates>
 <discovery>2019-08-20</discovery>
 <entry>2019-12-09</entry>
 </dates>
 </vuln>

<vuln vid="ca3fe5b3-185e-11ea-9673-4c72b94353b5">
 <topic>phpmyadmin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><lt>4.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	the phpmyadmin team reports:
	<blockquote cite="https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/">
	 This security fix is part of an ongoing effort to improve the security of the Designer feature
	 and is designated PMASA-2019-5. There is also an improvement for how we sanitize git version
	 information shown on the home page.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/</url>
 </references>
 <dates>
 <discovery>2019-11-22</discovery>
 <entry>2019-12-06</entry>
 </dates>
 </vuln>

<vuln vid="4e3fa78b-1577-11ea-b66e-080027bdabe8">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py35-django21</name>
	<name>py36-django21</name>
	<name>py37-django21</name>
	<name>py38-django21</name>
	<range><lt>2.1.15</lt></range>
 </package>
 <package>
	<name>py35-django22</name>
	<name>py36-django22</name>
	<name>py37-django22</name>
	<name>py38-django22</name>
	<range><lt>2.2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django release reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2019/dec/02/security-releases/">
	 CVE-2019-19118: Privilege escalation in the Django admin.
	 Since Django 2.1, a Django model admin displaying a parent model with related
	 model inlines, where the user has view-only permissions to a parent model but
	 edit permissions to the inline model, would display a read-only view of the parent
	 model but editable forms for the inline.
	 Submitting these forms would not allow direct edits to the parent model, but would
	 trigger the parent model's save() method, and cause pre and post-save signal handlers
	 to be invoked. This is a privilege escalation as a user who lacks permission to edit
	 a model should not be able to trigger its save-related signals.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2019/dec/02/security-releases/</url>
 <cvename>CVE-2019-19118</cvename>
 </references>
 <dates>
 <discovery>2019-11-25</discovery>
 <entry>2019-12-03</entry>
 </dates>
 </vuln>

<vuln vid="9c36d41c-11df-11ea-9b6d-901b0e934d69">
 <topic>py-matrix-synapse -- incomplete cleanup of 3rd-party-IDs on user deactivation</topic>
 <affects>
 <package>
	<name>py35-matrix-synapse</name>
	<name>py36-matrix-synapse</name>
	<name>py37-matrix-synapse</name>
	<range><lt>1.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://github.com/matrix-org/synapse/releases/tag/v1.6.1">
	 Clean up local threepids from user on account deactivation.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/matrix-org/synapse/releases/tag/v1.6.1</url>
 <url>https://github.com/matrix-org/synapse/pull/6426</url>
 </references>
 <dates>
 <discovery>2019-11-28</discovery>
 <entry>2019-11-28</entry>
 </dates>
 </vuln>

<vuln vid="42675046-fa70-11e9-ba4e-901b0e934d69">
 <topic>py-matrix-synapse -- missing signature checks on some federation APIs</topic>
 <affects>
 <package>
	<name>py35-matrix-synapse</name>
	<name>py36-matrix-synapse</name>
	<name>py37-matrix-synapse</name>
	<range><lt>1.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://github.com/matrix-org/synapse/pull/6262">
	 Make sure that [...] events sent over /send_join, /send_leave, and
	 /invite, are correctly signed and come from the expected servers.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/matrix-org/synapse/pull/6262</url>
 <url>https://github.com/matrix-org/synapse/releases/tag/v1.5.0</url>
 </references>
 <dates>
 <discovery>2019-10-29</discovery>
 <entry>2019-10-29</entry>
 </dates>
 </vuln>

<vuln vid="4ce7c28a-11ac-11ea-b537-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.5.0</ge><lt>12.5.2</lt></range>
	<range><ge>12.4.0</ge><lt>12.4.5</lt></range>
	<range><ge>11.9.0</ge><lt>12.3.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-2-released/">
	 Unauthorized access to grafana metrics
	 Update Mattermost dependency
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-2-released/</url>
 <cvename>CVE-2019-19262</cvename>
 </references>
 <dates>
 <discovery>2019-11-27</discovery>
 <entry>2019-11-28</entry>
 </dates>
 </vuln>

<vuln vid="1aa7a094-1147-11ea-b537-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.5.0</ge><lt>12.5.1</lt></range>
	<range><ge>12.4.0</ge><lt>12.4.4</lt></range>
	<range><lt>12.3.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/">
	 Path traversal with potential remote code execution
	 Private objects exposed through project import
	 Disclosure of notes via Elasticsearch integration
	 Disclosure of comments via Elasticsearch integration
	 DNS Rebind SSRF in various chat notifications
	 Disclosure of vulnerability status in dependency list
	 Disclosure of commit count in Cycle Analytics
	 Exposure of related branch names
	 Tags pushes from blocked users
	 Branches and Commits exposed to Guest members via integration
	 IDOR when adding users to protected environments
	 Former project members able to access repository information
	 Unauthorized access to grafana metrics
	 Todos created for former project members
	 Update Mattermost dependency
	 Disclosure of AWS secret keys on certain Admin pages
	 Stored XSS in Group and User profile fields
	 Forked project information disclosed via Project API
	 Denial of Service in the issue and commit comment pages
	 Tokens stored in plaintext
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/</url>
 <cvename>CVE-2019-19088</cvename>
 <cvename>CVE-2019-19309</cvename>
 <cvename>CVE-2019-19086</cvename>
 <cvename>CVE-2019-19087</cvename>
 <cvename>CVE-2019-19261</cvename>
 <cvename>CVE-2019-19256</cvename>
 <cvename>CVE-2019-19254</cvename>
 <cvename>CVE-2019-19257</cvename>
 <cvename>CVE-2019-19263</cvename>
 <cvename>CVE-2019-19258</cvename>
 <cvename>CVE-2019-19259</cvename>
 <cvename>CVE-2019-19260</cvename>
 <cvename>CVE-2019-19262</cvename>
 <cvename>CVE-2019-19255</cvename>
 <cvename>CVE-2019-19310</cvename>
 <cvename>CVE-2019-19311</cvename>
 <cvename>CVE-2019-19312</cvename>
 <cvename>CVE-2019-19313</cvename>
 <cvename>CVE-2019-19314</cvename>
 </references>
 <dates>
 <discovery>2019-11-27</discovery>
 <entry>2019-11-27</entry>
 </dates>
 </vuln>

<vuln vid="3e748551-c732-45f6-bd88-928da16f23a8">
 <topic>webkit2-gtk3 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>webkit2-gtk3</name>
	<range><lt>2.26.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The WebKitGTK project reports multiple vulnerabilities.
 </body>
 </description>
 <references>
 <url>https://webkitgtk.org/security/WSA-2019-0006.html</url>
 <cvename>CVE-2019-8710</cvename>
 <cvename>CVE-2019-8743</cvename>
 <cvename>CVE-2019-8764</cvename>
 <cvename>CVE-2019-8765</cvename>
 <cvename>CVE-2019-8766</cvename>
 <cvename>CVE-2019-8782</cvename>
 <cvename>CVE-2019-8783</cvename>
 <cvename>CVE-2019-8808</cvename>
 <cvename>CVE-2019-8811</cvename>
 <cvename>CVE-2019-8812</cvename>
 <cvename>CVE-2019-8813</cvename>
 <cvename>CVE-2019-8814</cvename>
 <cvename>CVE-2019-8815</cvename>
 <cvename>CVE-2019-8816</cvename>
 <cvename>CVE-2019-8819</cvename>
 <cvename>CVE-2019-8820</cvename>
 <cvename>CVE-2019-8821</cvename>
 <cvename>CVE-2019-8822</cvename>
 <cvename>CVE-2019-8823</cvename>
 </references>
 <dates>
 <discovery>2019-11-08</discovery>
 <entry>2019-11-27</entry>
 </dates>
 </vuln>

<vuln vid="87270ba5-03d3-11ea-b81f-3085a9a95629">
 <topic>urllib3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-urllib3</name>
	<name>py35-urllib3</name>
	<name>py36-urllib3</name>
	<name>py37-urllib3</name>
	<name>py38-urllib3</name>
	<range><lt>1.24.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NIST reports: (by search in the range 2018/01/01 - 2019/11/10):
	<blockquote cite="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&amp;results_type=overview&amp;query=urllib3&amp;search_type=all&amp;pub_start_date=01%2F01%2F2018&amp;pub_end_date=11%2F10%2F2019">
	 urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
	 In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
	 The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/search/results?form_type=Advanced&amp;results_type=overview&amp;query=urllib3&amp;search_type=all&amp;pub_start_date=01%2F01%2F2018&amp;pub_end_date=11%2F10%2F2019</url>
 <cvename>CVE-2018-20060</cvename>
 <cvename>CVE-2019-11236</cvename>
 <cvename>CVE-2019-11324</cvename>
 <freebsdpr>ports/229322</freebsdpr>
 </references>
 <dates>
 <discovery>2018-12-11</discovery>
 <entry>2019-11-26</entry>
 </dates>
 </vuln>

<vuln vid="fbe10a8a-05a1-11ea-9dfa-f8b156ac3ff9">
 <topic>FreeBSD -- Intel CPU Microcode Update</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_1</lt></range>
	<range><ge>12.0</ge><lt>12.0_12</lt></range>
	<range><ge>11.3</ge><lt>11.3_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Starting with version 1.26, the devcpu-data port/package includes
	updates and mitigations for the following technical and security
	advisories (depending on CPU model).
	Intel TSX Updates (TAA) CVE-2019-11135 Voltage Modulation
	Vulnerability CVE-2019-11139 MD_CLEAR Operations
	CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2018-11091
	TA Indirect Sharing CVE-2017-5715 EGETKEY CVE-2018-12126
	CVE-2018-12127 CVE-2018-12130 CVE-2018-11091 JCC SKX102
	 Erratum 
	Updated microcode includes mitigations for
	CPU issues, but may also cause a performance regression due
	to the JCC erratum mitigation. Please visit
	http://www.intel.com/benchmarks for further information.
	
	Please visit http://www.intel.com/security for
	detailed information on these advisories as well as a list of
	CPUs that are affected.
	Operating a CPU without the latest microcode may result in erratic or
	unpredictable behavior, including system crashes and lock ups.
	Certain issues listed in this advisory may result in the leakage of
	privileged system information to unprivileged users. Please refer to
	the security advisories listed above for detailed information.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-11135</cvename>
 <cvename>CVE-2019-11139</cvename>
 <cvename>CVE-2018-12126</cvename>
 <cvename>CVE-2018-12127</cvename>
 <cvename>CVE-2018-12130</cvename>
 <cvename>CVE-2018-11091</cvename>
 <cvename>CVE-2017-5715</cvename>
 <freebsdsa>SA-19:26.mcu</freebsdsa>
 </references>
 <dates>
 <discovery>2019-11-14</discovery>
 <entry>2019-11-25</entry>
 </dates>
 </vuln>

<vuln vid="edc0bf7e-05a1-11ea-9dfa-f8b156ac3ff9">
 <topic>FreeBSD -- Machine Check Exception on Page Size Change</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.1</ge><lt>12.1_1</lt></range>
	<range><ge>12.0</ge><lt>12.0_12</lt></range>
	<range><ge>11.3</ge><lt>11.3_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Intel discovered a previously published erratum on some Intel
	platforms can be exploited by malicious software to potentially cause
	a denial of service by triggering a machine check that will crash or
	hang the system.
	Malicious guest operating systems may be able to crash the host.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-12207</cvename>
 <freebsdsa>SA-19:25.mcepsc</freebsdsa>
 </references>
 <dates>
 <discovery>2019-11-14</discovery>
 <entry>2019-11-25</entry>
 </dates>
 </vuln>

<vuln vid="6ade62d9-0f62-11ea-9673-4c72b94353b5">
 <topic>clamav -- Denial-of-Service (DoS) vulnerability</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.102.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Micah Snyder reports:
	<blockquote cite="https://blog.clamav.net/2019/11/clamav-01021-and-01015-patches-have.html">
	 A Denial-of-Service (DoS) vulnerability may occur when scanning a specially crafted email
	 file as a result of excessively long scan times. The issue is resolved by implementing
	 several maximums in parsing MIME messages and by optimizing use of memory allocation.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.clamav.net/2019/11/clamav-01021-and-01015-patches-have.html</url>
 <cvename>CVE-2019-15961</cvename>
 </references>
 <dates>
 <discovery>2019-09-06</discovery>
 <entry>2019-11-25</entry>
 </dates>
 </vuln>

<vuln vid="ffc80e58-0dcb-11ea-9673-4c72b94353b5">
 <topic>unbound -- parsing vulnerability</topic>
 <affects>
 <package>
	<name>unbound</name>
	<range><lt>1.9.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Unbound Security Advisories:
	<blockquote cite="https://nlnetlabs.nl/projects/unbound/security-advisories/#vulnerability-in-ipsec-module">
	 Recent versions of Unbound contain a vulnerability that can cause shell
	 code execution after receiving a specially crafted answer. This issue
	 can only be triggered if unbound was compiled with --enable-ipsecmod
	 support, and ipsecmod is enabled and used in the configuration.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nlnetlabs.nl/projects/unbound/security-advisories/#vulnerability-in-ipsec-module</url>
 <cvename>CVE-2019-18934</cvename>
 </references>
 <dates>
 <discovery>2019-11-19</discovery>
 <entry>2019-11-23</entry>
 </dates>
 </vuln>

<vuln vid="b12a341a-0932-11ea-bf09-080027e0baa0">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.9.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports:
	<blockquote cite="https://blog.gitea.io/2019/11/gitea-1.10.0-is-released/">
	 This release contains five security fixes, so we recommend updating:
	 <ul>
	 <li>Fix issue with user.fullname</li>
	 <li>Ignore mentions for users with no access</li>
	 <li>Be more strict with git arguments</li>
	 <li>Extract the username and password from the mirror url</li>
	 <li>Reserve .well-known username</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.io/2019/11/gitea-1.10.0-is-released/</url>
 <freebsdpr>ports/241981</freebsdpr>
 </references>
 <dates>
 <discovery>2019-11-17</discovery>
 <entry>2019-11-22</entry>
 </dates>
 </vuln>

<vuln vid="94c6951a-0d04-11ea-87ca-001999f8d30b">
 <topic>asterisk -- Re-invite with T.38 and malformed SDP causes crash</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.29.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 If Asterisk receives a re-invite initiating T.38 faxing
	 and has a port of 0 and no c line in the SDP, a crash
	 will occur.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2019-008.html</url>
 <cvename>CVE-2019-18976</cvename>
 </references>
 <dates>
 <discovery>2019-11-07</discovery>
 <entry>2019-11-22</entry>
 </dates>
 </vuln>

<vuln vid="49b61ab6-0d04-11ea-87ca-001999f8d30b">
 <topic>asterisk -- AMI user could execute system commands</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.29.2</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><lt>16.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 A remote authenticated Asterisk Manager Interface (AMI)
	 user without system authorization could use a specially
	 crafted Originate AMI request to execute arbitrary system
	 commands.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2019-007.html</url>
 <cvename>CVE-2019-18610</cvename>
 </references>
 <dates>
 <discovery>2019-10-10</discovery>
 <entry>2019-11-22</entry>
 </dates>
 </vuln>

<vuln vid="a8d94711-0d03-11ea-87ca-001999f8d30b">
 <topic>asterisk -- SIP request can change address of a SIP peer</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.29.2</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><lt>16.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 A SIP request can be sent to Asterisk that can change
	 a SIP peers IP address. A REGISTER does not need to occur,
	 and calls can be hijacked as a result. The only thing
	 that needs to be known is the peers name; authentication
	 details such as passwords do not need to be known. This
	 vulnerability is only exploitable when the nat option is
	 set to the default, or auto_force_rport.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2019-006.html</url>
 <cvename>CVE-2019-18790</cvename>
 </references>
 <dates>
 <discovery>2019-10-17</discovery>
 <entry>2019-11-22</entry>
 </dates>
 </vuln>

<vuln vid="ecb7fdec-0b82-11ea-874d-0c9d925bbbc0">
 <topic>drm graphics drivers -- Local privilege escalation and denial of service</topic>
 <affects>
 <package>
	<name>drm-current-kmod</name>
	<range><lt>4.16.g20191120</lt></range>
 </package>
 <package>
	<name>drm-devel-kmod</name>
	<range><lt>5.0.g20191120</lt></range>
 </package>
 <package>
	<name>drm-fbsd12.0-kmod</name>
	<range><lt>4.16.g20191120</lt></range>
 </package>
 <package>
	<name>drm-fbsd11.2-kmod</name>
	<range><lt>4.11.g20191204</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Intel reports:
	<blockquote cite="https://blogs.intel.com/technology/2019/11/ipas-november-2019-intel-platform-update-ipu">
	 As part of IPU 2019.2, INTEL-SA-00242 advises that insufficient
	 access control may allow an authenticated user to potentially
	 enable escalation of privilege via local access.
	 INTEL-SA-00260 advises that insufficient access control may
	 allow an authenticated user to potentially enable denial of
	 service via local access.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blogs.intel.com/technology/2019/11/ipas-november-2019-intel-platform-update-ipu</url>
 <url>https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00242.html</url>
 <url>https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00260.html</url>
 <cvename>CVE-2019-0154</cvename>
 <cvename>CVE-2019-11112</cvename>
 </references>
 <dates>
 <discovery>2019-11-12</discovery>
 <entry>2019-11-20</entry>
 <modified>2019-12-04</modified>
 </dates>
 </vuln>

<vuln vid="620685d6-0aa3-11ea-9673-4c72b94353b5">
 <topic>squid -- Vulnerable to HTTP Digest Authentication</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>4.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid Team reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2019_11.txt">
	 Problem Description: Due to incorrect data management Squid is
	 vulnerable to a information disclosure when processing HTTP Digest
	 Authentication.
	 Severity: Nonce tokens contain the raw byte value of a pointer which sits
	 within heap memory allocation. This information reduces ASLR protections
	 and may aid attackers isolating memory areas to target for remote code
	 execution attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.squid-cache.org/Advisories/SQUID-2019_11.txt</url>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18679</url>
 <cvename>CVE-2019-18679</cvename>
 </references>
 <dates>
 <discovery>2019-11-05</discovery>
 <entry>2019-11-19</entry>
 </dates>
 </vuln>

<vuln vid="f04f840d-0840-11ea-8d66-75d3253ef913">
 <topic>libidn2 -- roundtrip check vulnerability</topic>
 <affects>
 <package>
	<name>libidn2</name>
	<range><lt>2.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE list:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12290">
	 GNU libidn2 before 2.2.0 fails to perform the roundtrip checks
	 specified in RFC3490 Section 4.2 when converting A-labels to U-labels.
	 This makes it possible in some circumstances for one domain to
	 impersonate another. By creating a malicious domain that matches a
	 target domain except for the inclusion of certain punycoded Unicode
	 characters (that would be discarded when converted first to a Unicode
	 label and then back to an ASCII label), arbitrary domains can be
	 impersonated.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://gitlab.com/libidn/libidn2/blob/master/NEWS</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12290</url>
 <cvename>CVE-2019-12290</cvename>
 </references>
 <dates>
 <discovery>2019-11-14</discovery>
 <entry>2019-11-18</entry>
 <modified>2020-06-24</modified>
 </dates>
 </vuln>

<vuln vid="f59af308-07f3-11ea-8c56-f8b156b6dcc8">
 <topic>GNU cpio -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gcpio</name>
	<range><lt>2.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sergey Poznyakoff reports:
	<blockquote cite="https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00000.html">
	 This stable release fixes several potential vulnerabilities
	 CVE-2015-1197: cpio, when using the --no-absolute-filenames
	 option, allows local users to write to arbitrary files
	 via a symlink attack on a file in an archive.
	 CVE-2016-2037: The cpio_safer_name_suffix function in
	 util.c allows remote attackers to cause a denial of service
	 (out-of-bounds write) via a crafted cpio file.
	 CVE-2019-14866: Improper input validation when writing
	 tar header fields leads to unexpected tar generation.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00000.html</url>
 <cvename>CVE-2015-1197</cvename>
 <cvename>CVE-2016-2037</cvename>
 <cvename>CVE-2019-14866</cvename>
 </references>
 <dates>
 <discovery>2019-11-06</discovery>
 <entry>2019-11-15</entry>
 </dates>
 </vuln>

<vuln vid="b48e7b14-052a-11ea-a1de-53b029d2b061">
 <topic>libmad -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libmad</name>
	<range><lt>0.15.1b_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	National Vulnerability Database:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-8372">
	 CVE-2017-8372: The mad_layer_III function in layer3.c in Underbit MAD
	 libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a
	 denial of service (assertion failure and application exit) via a crafted
	 audio file.
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-8373">
	 CVE-2017-8373: The mad_layer_III function in layer3.c in Underbit MAD
	 libmad 0.15.1b allows remote attackers to cause a denial of service
	 (heap-based buffer overflow and application crash) or possibly have
	 unspecified other impact via a crafted audio file.
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-8374">
	 CVE-2017-8374: The mad_bit_skip function in bit.c in Underbit MAD
	 libmad 0.15.1b allows remote attackers to cause a denial of service
	 (heap-based buffer over-read and application crash) via a crafted audio
	 file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508133#15</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-8372</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-8373</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-8374</url>
 <url>https://blogs.gentoo.org/ago/2017/04/30/libmad-assertion-failure-in-layer3-c/</url>
 <url>https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_layer_iii-layer3-c/</url>
 <url>https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_bit_skip-bit-c/</url>
 <cvename>CVE-2017-8372</cvename>
 <cvename>CVE-2017-8373</cvename>
 <cvename>CVE-2017-8374</cvename>
 </references>
 <dates>
 <discovery>2017-04-30</discovery>
 <entry>2019-11-13</entry>
 </dates>
 </vuln>

<vuln vid="88d00176-058e-11ea-bd1c-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>78.0.3904.97</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2019/11/stable-channel-update-for-desktop.html">
	 Four security issues were fixed, including:
	 <ul>
	 <li>[1021723] Various fixes from internal audits, fuzzing and other
	 initiatives</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://chromereleases.googleblog.com/2019/11/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2019-11-06</discovery>
 <entry>2019-11-12</entry>
 </dates>
 </vuln>

<vuln vid="459df1ba-051c-11ea-9673-4c72b94353b5">
 <topic>wordpress -- multiple issues</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>5.2.4,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>zh_CN-wordpress</name>
	<name>zh_TW-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<range><lt>5.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wordpress developers reports:
	<blockquote cite="https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/">
	 Props to Evan Ricafort for finding an issue where stored XSS (cross-site scripting)
	 could be added via the Customizer.
	 rops to J.D. Grimes who found and disclosed a method of viewing unauthenticated posts.
	 Props to Weston Ruter for finding a way to create a stored XSS to inject Javascript
	 into style tags.
	 rops to David Newman for highlighting a method to poison the cache of JSON GET requests
	 via the Vary: Origin header.
	 Props to Eugene Kolodenker who found a server-side request forgery in the way that URLs
	 are validated.
	 Props to Ben Bidner of the WordPress Security Team who discovered issues related to
	 referrer validation in the admin.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/</url>
 </references>
 <dates>
 <discovery>2019-10-14</discovery>
 <entry>2019-11-12</entry>
 </dates>
 </vuln>

<vuln vid="b2f9573a-008c-11ea-9801-10c37b4ac2ea">
 <topic>nexus2-oss -- Multiple vulerabilities</topic>
 <affects>
 <package>
	<name>nexus2-oss</name>
	<range><lt>2.14.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sonatype reports:
	<blockquote cite="https://help.sonatype.com/repomanager2/release-notes/2019-release-notes#id-2019ReleaseNotes-RepositoryManager2.14.15">
	 Several RCE vulnerabilities have been found and corrected in 2.14.15:
	 CVE-2019-16530: An attacker with elevated privileges can upload a
	 specially crafted file. That file can contain commands that will
	 be executed on the system, with the same privileges as the user
	 running the server.
	 CVE-2019-15893: A Remote Code Execution vulnerability has been
	 discovered in Nexus Repository Manager requiring immediate
	 action. The vulnerability allows for an attacker with
	 administrative access to NXRM to create repostories that can
	 grant access to read/execute system data outside the scope of
	 NXRM.
	 CVE-2019-5475: A vulnerability has been found that can allow
	 user's with administrative privileges to run processes on the
	 target server, that the nxrm os user has access to.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-16530</cvename>
 <cvename>CVE-2019-15893</cvename>
 <cvename>CVE-2019-5475</cvename>
 </references>
 <dates>
 <discovery>2019-09-19</discovery>
 <entry>2019-11-07</entry>
 </dates>
 </vuln>

<vuln vid="6a7c2ab0-00dd-11ea-83ce-705a0f828759">
 <topic>php -- env_path_info underflow in fpm_main.c can lead to RCE</topic>
 <affects>
 <package>
	<name>php71</name>
	<range><lt>7.1.33</lt></range>
 </package>
 <package>
	<name>php72</name>
	<range><lt>7.2.24</lt></range>
 </package>
 <package>
	<name>php73</name>
	<range><lt>7.3.11</lt></range>
 </package>
 <package>
	<name>php74</name>
	<range><lt>7.4.0.rc5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP project reports:
	<blockquote cite="https://www.php.net/archive/2019.php#2019-10-24-2">
	 The PHP development team announces the immediate availability of PHP 7.3.11. This is a security release which also contains several bug fixes.
	</blockquote>
 <blockquote cite="https://www.php.net/archive/2019.php#2019-10-24-1">
	 The PHP development team announces the immediate availability of PHP 7.2.24. This is a security release which also contains several bug fixes.
	</blockquote>
 <blockquote cite="https://www.php.net/archive/2019.php#2019-10-24-3">
	 The PHP development team announces the immediate availability of PHP 7.1.33. This is a security release which also contains several bug fixes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-11043</cvename>
 <url>https://www.php.net/archive/2019.php#2019-10-24-1</url>
 <url>https://www.php.net/archive/2019.php#2019-10-24-2</url>
 <url>https://www.php.net/archive/2019.php#2019-10-24-3</url>
 </references>
 <dates>
 <discovery>2019-10-24</discovery>
 <entry>2019-11-06</entry>
 </dates>
 </vuln>

<vuln vid="c32285fe-fde4-11e9-9525-000c29c4dc65">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki131</name>
	<range><lt>1.31.5</lt></range>
 </package>
 <package>
	<name>mediawiki132</name>
	<range><lt>1.32.5</lt></range>
 </package>
 <package>
	<name>mediawiki133</name>
	<range><lt>1.33.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawiki reports:
	<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-October/000236.html">
	 Security fixes:
	 T230402, CVE-2019-16738 SECURITY: Add permission check for suppressed account
	 to Special:Redirect.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-16738</cvename>
 <url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-October/000236.html</url>
 </references>
 <dates>
 <discovery>2019-08-13</discovery>
 <entry>2019-11-03</entry>
 </dates>
 </vuln>

<vuln vid="fc91f2ef-fd7b-11e9-a1c7-b499baebfeaf">
 <topic>MySQL -- Multiple vulerabilities</topic>
 <affects>
 <package>
	<name>mariadb55-server</name>
	<range><lt>5.5.66</lt></range>
 </package>
 <package>
	<name>mariadb101-server</name>
	<range><lt>10.1.42</lt></range>
 </package>
 <package>
	<name>mariadb102-server</name>
	<range><lt>10.2.28</lt></range>
 </package>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.19</lt></range>
 </package>
 <package>
	<name>mariadb104-server</name>
	<range><lt>10.4.9</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.46</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.28</lt></range>
 </package>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.18</lt></range>
 </package>
 <package>
	<name>percona55-server</name>
	<range><lt>5.5.66</lt></range>
 </package>
 <package>
	<name>percona56-server</name>
	<range><lt>5.6.46</lt></range>
 </package>
 <package>
	<name>percona57-server</name>
	<range><lt>5.7.28</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/security-alerts/cpuoct2019.html">
	 This Critical Patch Update contains 31 new security fixes for
	 Oracle MySQL. 6 of these vulnerabilities may be remotely exploitable
	 without authentication, i.e., may be exploited over a network without
	 requiring user credentials.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/security-alerts/cpuoct2019.html</url>
 <cvename>CVE-2019-5443</cvename>
 <cvename>CVE-2019-1543</cvename>
 <cvename>CVE-2019-3011</cvename>
 <cvename>CVE-2019-2966</cvename>
 <cvename>CVE-2019-2967</cvename>
 <cvename>CVE-2019-2974</cvename>
 <cvename>CVE-2019-2946</cvename>
 <cvename>CVE-2019-3004</cvename>
 <cvename>CVE-2019-2914</cvename>
 <cvename>CVE-2019-2969</cvename>
 <cvename>CVE-2019-2991</cvename>
 <cvename>CVE-2019-2920</cvename>
 <cvename>CVE-2019-2993</cvename>
 <cvename>CVE-2019-2922</cvename>
 <cvename>CVE-2019-2923</cvename>
 <cvename>CVE-2019-2924</cvename>
 <cvename>CVE-2019-2963</cvename>
 <cvename>CVE-2019-2968</cvename>
 <cvename>CVE-2019-3003</cvename>
 <cvename>CVE-2019-2997</cvename>
 <cvename>CVE-2019-2948</cvename>
 <cvename>CVE-2019-2950</cvename>
 <cvename>CVE-2019-2982</cvename>
 <cvename>CVE-2019-2998</cvename>
 <cvename>CVE-2019-2960</cvename>
 <cvename>CVE-2019-2957</cvename>
 <cvename>CVE-2019-2938</cvename>
 <cvename>CVE-2019-3018</cvename>
 <cvename>CVE-2019-3009</cvename>
 <cvename>CVE-2019-2910</cvename>
 <cvename>CVE-2019-2911</cvename>
 </references>
 <dates>
 <discovery>2019-10-15</discovery>
 <entry>2019-11-02</entry>
 </dates>
 </vuln>

<vuln vid="381deebb-f5c9-11e9-9c4f-74d435e60b7c">
 <topic>file -- Heap buffer overflow possible</topic>
 <affects>
 <package>
	<name>file</name>
	<range><lt>5.37</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mitre reports
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18218">
	 cdf_read_property_info in cdf.c in file through 5.37 does not
	 restrict the number of CDF_VECTOR elements, which allows a heap-based
	 buffer overflow (4-byte out-of-bounds write).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16780</url>
 <url>https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84</url>
 </references>
 <dates>
 <discovery>2019-08-26</discovery>
 <entry>2019-11-02</entry>
 </dates>
 </vuln>

<vuln vid="92243b6a-5775-4aea-8727-a938058df5ba">
 <topic>webkit2-gtk3 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>webkit2-gtk3</name>
	<range><lt>2.26.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The WebKitGTK project reports multiple vulnerabilities.
 </body>
 </description>
 <references>
 <url>https://webkitgtk.org/security/WSA-2019-0005.html</url>
 <cvename>CVE-2019-8625</cvename>
 <cvename>CVE-2019-8674</cvename>
 <cvename>CVE-2019-8707</cvename>
 <cvename>CVE-2019-8719</cvename>
 <cvename>CVE-2019-8720</cvename>
 <cvename>CVE-2019-8726</cvename>
 <cvename>CVE-2019-8733</cvename>
 <cvename>CVE-2019-8735</cvename>
 <cvename>CVE-2019-8763</cvename>
 <cvename>CVE-2019-8768</cvename>
 <cvename>CVE-2019-8769</cvename>
 <cvename>CVE-2019-8771</cvename>
 </references>
 <dates>
 <discovery>2019-10-29</discovery>
 <entry>2019-10-31</entry>
 </dates>
 </vuln>

<vuln vid="fd10aa77-fb5e-11e9-af7b-0800274e5f20">
 <topic>gitea -- information disclosure</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.9.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/issues/8303">
	 When a comment in an issue or PR mentions a user using
	 @username, the mentioned user receives a mail notification even if
	 they don't have permission to see the originating repository.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.9.5</url>
 <url>https://blog.gitea.io/2019/10/gitea-1.9.5-is-released/</url>
 </references>
 <dates>
 <discovery>2019-09-27</discovery>
 <entry>2019-10-30</entry>
 </dates>
 </vuln>

<vuln vid="50a1bbc9-fb80-11e9-9e70-005056a311d1">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba48</name>
	<range><le>4.8.12</le></range>
 </package>
 <package>
	<name>samba410</name>
	<range><lt>4.10.10</lt></range>
 </package>
 <package>
	<name>samba411</name>
	<range><lt>4.11.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The samba project reports:
	<blockquote cite="https://www.samba.org/samba/security/CVE-2019-10218.html">
	 Malicious servers can cause Samba client code to return filenames containing
	 path separators to calling code.
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2019-14833.html">
	 When the password contains multi-byte (non-ASCII) characters, the check
	 password script does not receive the full password string.
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2019-14847.html">
	 Users with the "get changes" extended access right can crash the AD DC LDAP
	 server by requesting an attribute using the range= syntax.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/security/CVE-2019-10218.html</url>
 <cvename>CVE-2019-10218</cvename>
 <url>https://www.samba.org/samba/security/CVE-2019-14833.html</url>
 <cvename>CVE-2019-14833</cvename>
 <url>https://www.samba.org/samba/security/CVE-2019-14847.html</url>
 <cvename>CVE-2019-14847</cvename>
 </references>
 <dates>
 <discovery>2019-09-29</discovery>
 <entry>2019-10-29</entry>
 </dates>
 </vuln>

<vuln vid="6eddfa51-fb44-11e9-86e9-001b217b3468">
 <topic>Gitlab -- Disclosure Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.4.0</ge><lt>12.4.1</lt></range>
	<range><ge>12.3.0</ge><lt>12.3.6</lt></range>
	<range><ge>0</ge><lt>12.2.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/">
	 Source branch of a MR could be removed by an unauthorised user
	 Private group members could be listed
	 Disclosure of System Notes via Elasticsearch integration
	 Disclosure of Private Comments via Elasticsearch integration
	 Confirm existence of private repositories
	 Private group membership could be disclosed
	 Disclosure of Project Labels
	 Disclosure of Private Project Path and Labels
	 Uncontrolled Resource Consumption due to Nested GraphQL Queries
	 Improper access control on comments
	 Sentry Token Access Control
	 Authorisation check for Project Transfer option
	 XSS in Wiki Pages Using RDoc
	 Untrusted Input could be used for Internal Redirect
	 Access control for protected environments
	 Private Sub Group path Disclosure
	 Disclosure of Group Packages List
	 Private Repository Name Disclosure
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/</url>
 <cvename>CVE-2019-18446</cvename>
 <cvename>CVE-2019-18447</cvename>
 <cvename>CVE-2019-18460</cvename>
 <cvename>CVE-2019-18456</cvename>
 <cvename>CVE-2019-18448</cvename>
 <cvename>CVE-2019-18449</cvename>
 <cvename>CVE-2019-18450</cvename>
 <cvename>CVE-2019-18452</cvename>
 <cvename>CVE-2019-18455</cvename>
 <cvename>CVE-2019-18453</cvename>
 <cvename>CVE-2019-18457</cvename>
 <cvename>CVE-2019-18458</cvename>
 <cvename>CVE-2019-18454</cvename>
 <cvename>CVE-2019-18451</cvename>
 <cvename>CVE-2019-18459</cvename>
 <cvename>CVE-2019-18461</cvename>
 <cvename>CVE-2019-18463</cvename>
 <cvename>CVE-2019-18462</cvename>
 </references>
 <dates>
 <discovery>2019-10-30</discovery>
 <entry>2019-10-30</entry>
 </dates>
 </vuln>

<vuln vid="53b3474c-f680-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- Reference count overflow in mqueue filesystem 32-bit compat</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_10</lt></range>
	<range><ge>11.3</ge><lt>11.3_3</lt></range>
	<range><ge>11.2</ge><lt>11.2_14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	System calls operating on file descriptors obtain a
	reference to relevant struct file which due to a programming
	error was not always put back, which in turn could be used
	to overflow the counter of affected struct file.
	<h1>Impact:</h1>
	A local user can use this flaw to obtain access to files,
	directories, sockets, etc., opened by processes owned by
	other users. If obtained struct file represents a directory
	from outside of user's jail, it can be used to access files
	outside of the jail. If the user in question is a jailed
	root they can obtain root privileges on the host system.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5603</cvename>
 <freebsdsa>SA-19:24.mqueuefs</freebsdsa>
 </references>
 <dates>
 <discovery>2019-08-20</discovery>
 <entry>2019-10-24</entry>
 </dates>
 </vuln>

<vuln vid="5027b62e-f680-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- kernel memory disclosure from /dev/midistat</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_10</lt></range>
	<range><ge>11.3</ge><lt>11.3_3</lt></range>
	<range><ge>11.2</ge><lt>11.2_14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The kernel driver for /dev/midistat implements a handler
	for read(2). This handler is not thread-safe, and a
	multi-threaded program can exploit races in the handler to
	cause it to copy out kernel memory outside the boundaries
	of midistat's data buffer.
	<h1>Impact:</h1>
	The races allow a program to read kernel memory within
	a 4GB window centered at midistat's data buffer. The buffer
	is allocated each time the device is opened, so an attacker
	is not limited to a static 4GB region of memory.
	On 32-bit platforms, an attempt to trigger the race may
	cause a page fault in kernel mode, leading to a panic.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5612</cvename>
 <freebsdsa>SA-19:23.midi</freebsdsa>
 </references>
 <dates>
 <discovery>2019-08-20</discovery>
 <entry>2019-10-24</entry>
 </dates>
 </vuln>

<vuln vid="4d3d4f64-f680-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- IPv6 remote Denial-of-Service</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_10</lt></range>
	<range><ge>11.3</ge><lt>11.3_3</lt></range>
	<range><ge>11.2</ge><lt>11.2_14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due do a missing check in the code of m_pulldown(9) data
	returned may not be contiguous as requested by the caller.
	<h1>Impact:</h1>
	Extra checks in the IPv6 code catch the error condition
	and trigger a kernel panic leading to a remote DoS
	(denial-of-service) attack with certain Ethernet interfaces.
	At this point it is unknown if any other than the IPv6 code
	paths can trigger a similar condition.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5611</cvename>
 <freebsdsa>SA-19:22.mbuf</freebsdsa>
 </references>
 <dates>
 <discovery>2019-08-20</discovery>
 <entry>2019-10-24</entry>
 </dates>
 </vuln>

<vuln vid="499b22a3-f680-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- Insufficient validation of guest-supplied data (e1000 device)</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_9</lt></range>
	<range><ge>11.3</ge><lt>11.3_2</lt></range>
	<range><ge>11.2</ge><lt>11.2_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The e1000 network adapters permit a variety of modifications
	to an Ethernet packet when it is being transmitted. These
	include the insertion of IP and TCP checksums, insertion
	of an Ethernet VLAN header, and TCP segmentation offload
	("TSO"). The e1000 device model uses an on-stack buffer to
	generate the modified packet header when simulating these
	modifications on transmitted packets.
	When TCP segmentation offload is requested for a transmitted
	packet, the e1000 device model used a guest-provided value
	to determine the size of the on-stack buffer without
	validation. The subsequent header generation could overflow
	an incorrectly sized buffer or indirect a pointer composed
	of stack garbage.
	<h1>Impact:</h1>
	A misbehaving bhyve guest could overwrite memory in the
	bhyve process on the host.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5609</cvename>
 <freebsdsa>SA-19:21.bhyve</freebsdsa>
 </references>
 <dates>
 <discovery>2019-08-06</discovery>
 <entry>2019-10-24</entry>
 </dates>
 </vuln>

<vuln vid="45a95fdd-f680-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- Insufficient message length validation in bsnmp library</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.0</ge><lt>12.0_9</lt></range>
	<range><ge>11.3</ge><lt>11.3_2</lt></range>
	<range><ge>11.2</ge><lt>11.2_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A function extracting the length from type-length-value
	encoding is not properly validating the submitted length.
	<h1>Impact:</h1>
	A remote user could cause, for example, an out-of-bounds
	read, decoding of unrelated data, or trigger a crash of the
	software such as bsnmpd resulting in a denial of service.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5610</cvename>
 <freebsdsa>SA-19:20.bsnmp</freebsdsa>
 </references>
 <dates>
 <discovery>2019-08-06</discovery>
 <entry>2019-10-24</entry>
 </dates>
 </vuln>

<vuln vid="41d2f3e6-f680-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- ICMPv6 / MLDv2 out-of-bounds memory access</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_9</lt></range>
	<range><ge>11.3</ge><lt>11.3_2</lt></range>
	<range><ge>11.2</ge><lt>11.2_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The ICMPv6 input path incorrectly handles cases where
	an MLDv2 listener query packet is internally fragmented
	across multiple mbufs.
	<h1>Impact:</h1>
	A remote attacker may be able to cause an out-of-bounds
	read or write that may cause the kernel to attempt to access
	an unmapped page and subsequently panic.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5608</cvename>
 <freebsdsa>SA-19:19.mldv2</freebsdsa>
 </references>
 <dates>
 <discovery>2019-08-06</discovery>
 <entry>2019-10-24</entry>
 </dates>
 </vuln>

<vuln vid="3c7edc7a-f680-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- Multiple vulnerabilities in bzip2</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.0</ge><lt>12.0_9</lt></range>
	<range><ge>11.3</ge><lt>11.3_2</lt></range>
	<range><ge>11.2</ge><lt>11.2_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The decompressor used in bzip2 contains a bug which can
	lead to an out-of-bounds write when processing a specially
	crafted bzip2(1) file.
	bzip2recover contains a heap use-after-free bug which
	can be triggered when processing a specially crafted bzip2(1)
	file.
	<h1>Impact:</h1>
	An attacker who can cause maliciously crafted input to
	be processed may trigger either of these bugs. The bzip2recover
	bug may cause a crash, permitting a denial-of-service. The
	bzip2 decompressor bug could potentially be exploited to
	execute arbitrary code.
	Note that some utilities, including the tar(1) archiver
	and the bspatch(1) binary patching utility (used in portsnap(8)
	and freebsd-update(8)) decompress bzip2(1)-compressed data
	internally; system administrators should assume that their
	systems will at some point decompress bzip2(1)-compressed
	data even if they never explicitly invoke the bunzip2(1)
	utility.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3189</cvename>
 <cvename>CVE-2019-1290</cvename>
 <freebsdsa>SA-19:18.bzip2</freebsdsa>
 </references>
 <dates>
 <discovery>2019-08-06</discovery>
 <entry>2019-10-24</entry>
 </dates>
 </vuln>

<vuln vid="2d4076eb-f679-11e9-a87f-a4badb2f4699">
 <topic>varnish -- Information Disclosure Vulnerability</topic>
 <affects>
 <package>
	<name>varnish6</name>
	<range><lt>6.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Varnish Software reports:
	<blockquote cite="https://varnish-cache.org/security/VSV00004.html#vsv00004">
	 A bug has been discovered in Varnish Cache where we fail to
	 clear a pointer between the handling of one client requests and the next
	 on the same connection. This can under specific circumstances lead to
	 information being leaked from the connection workspace.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://varnish-cache.org/security/VSV00004.html#vsv00004</url>
 </references>
 <dates>
 <discovery>2019-10-21</discovery>
 <entry>2019-10-24</entry>
 </dates>
 </vuln>

<vuln vid="3a1474ba-f646-11e9-b0af-b888e347c638">
 <topic>sudo -- Potential bypass of Runas user restrictions</topic>
 <affects>
 <package>
 <name>sudo</name>
 <range><lt>1.8.28</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Todd C. Miller reports:
 <blockquote cite="https://www.sudo.ws/alerts/minus_1_uid.html">
	 When sudo is configured to allow a user to run commands as an
	 arbitrary user via the ALL keyword in a Runas specification, it
	 is possible to run commands as root by specifying the user ID -1
	 or 4294967295.
	 This can be used by a user with sufficient sudo privileges to
	 run commands as root even if the Runas specification explicitly
	 disallows root access as long as the ALL keyword is listed first
	 in the Runas specification.
	 Log entries for commands run this way will list the target user
	 as 4294967295 instead of root. In addition, PAM session modules
	 will not be run for the command.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://www.sudo.ws/alerts/minus_1_uid.html</url>
 <cvename>CVE-2019-14287</cvename>
 </references>
 <dates>
 <discovery>2019-10-15</discovery>
 <entry>2019-10-24</entry>
 </dates>
 </vuln>

<vuln vid="a90d040e-f5b0-11e9-acc4-4576b265fda6">
 <topic>Loofah -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-loofah</name>
	<range><lt>2.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitHub issue:
	<blockquote cite="https://github.com/flavorjones/loofah/issues/171">
	 This issue has been created for public disclosure of an XSS
	 vulnerability that was responsibly reported by
	 https://hackerone.com/vxhex
	 In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in
	 sanitized output when a crafted SVG element is republished.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/flavorjones/loofah/releases</url>
 <url>https://github.com/flavorjones/loofah/issues/171</url>
 <cvename>CVE-2019-15587</cvename>
 </references>
 <dates>
 <discovery>2019-10-22</discovery>
 <entry>2019-10-23</entry>
 </dates>
 </vuln>

<vuln vid="9b7491fb-f253-11e9-a50c-000c29c4dc65">
 <topic>python 3.7 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python37</name>
	<range><lt>3.7.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python changelog:
	<blockquote cite="https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-5-final">
	 bpo-38243: Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering
	 the document page as HTML.
	 bpo-38174: Update vendorized expat library version to 2.2.8, which resolves
	 CVE-2019-15903.
	 bpo-37764: Fixes email._header_value_parser.get_unstructured going into an infinite
	 loop for a specific case in which the email header does not have trailing whitespace,
	 and the case in which it contains an invalid encoded word.
	 bpo-37461: Fix an infinite loop when parsing specially crafted email headers.
	 bpo-34155: Fix parsing of invalid email addresses with more than one @
	 (e.g. a@b@c.com.) to not return the part before 2nd @ as valid email address.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-5-final</url>
 <cvename>CVE-2019-15903</cvename>
 </references>
 <dates>
 <discovery>2019-09-14</discovery>
 <entry>2019-10-19</entry>
 </dates>
 </vuln>

<vuln vid="998ca824-ef55-11e9-b81f-3085a9a95629">
 <topic>Pillow -- Allocation of resources without limits or throttling</topic>
 <affects>
 <package>
	<name>py27-pillow</name>
	<name>py35-pillow</name>
	<name>py36-pillow</name>
	<name>py37-pillow</name>
	<range><lt>6.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16865">
	 An issue was discovered in Pillow before 6.2.0. When reading specially
	 crafted invalid image files, the library can either allocate very large
	 amounts of memory or take an extremely long period of time to process
	 the image.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/python-pillow/Pillow/issues/4123</url>
 <cvename>CVE-2019-16865</cvename>
 <freebsdpr>ports/241268</freebsdpr>
 </references>
 <dates>
 <discovery>2019-09-24</discovery>
 <entry>2019-10-15</entry>
 </dates>
 </vuln>

<vuln vid="fd2e0ca8-e3ae-11e9-8af7-08002720423d">
 <topic>mongodb -- Bump Windows package dependencies</topic>
 <affects>
 <package>
	<name>mongodb34</name>
	<range><lt>3.4.22</lt></range>
 </package>
 <package>
	<name>mongodb36</name>
	<range><lt>3.6.14</lt></range>
 </package>
 <package>
	<name>mongodb40</name>
	<range><lt>4.0.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Rich Mirch reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-42233">
	 An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server versions less than 4.0.11, 3.6.14, and 3.4.22 to run attacker defined code as the user running the utility.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-2390</cvename>
 <url>https://jira.mongodb.org/browse/SERVER-42233</url>
 </references>
 <dates>
 <discovery>2019-08-06</discovery>
 <entry>2019-09-30</entry>
 </dates>
 </vuln>

<vuln vid="273c6c43-e3ad-11e9-8af7-08002720423d">
 <topic>mongodb -- Our init scripts check /proc/[pid]/stat should validate that `(${procname})` is the process' command name.</topic>
 <affects>
 <package>
	<name>mongodb34</name>
	<range><lt>3.4.22</lt></range>
 </package>
 <package>
	<name>mongodb36</name>
	<range><lt>3.6.14</lt></range>
 </package>
 <package>
	<name>mongodb40</name>
	<range><lt>4.0.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sicheng Liu of Beijing DBSEC Technology Co., Ltd reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-40563">
	 Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-2389</cvename>
 <url>https://jira.mongodb.org/browse/SERVER-40563</url>
 </references>
 <dates>
 <discovery>2019-08-06</discovery>
 <entry>2019-09-30</entry>
 </dates>
 </vuln>

<vuln vid="880bca8f-e201-11e9-8af7-08002720423d">
 <topic>mongodb -- Attach IDs to users</topic>
 <affects>
 <package>
	<name>mongodb34</name>
	<range><lt>3.4.22</lt></range>
 </package>
 <package>
	<name>mongodb36</name>
	<range><lt>3.6.13</lt></range>
 </package>
 <package>
	<name>mongodb40</name>
	<range><lt>4.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitch Wasson of Cisco's Advanced Malware Protection Group reports:
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-38984">
	 After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-2386</cvename>
 <url>https://jira.mongodb.org/browse/SERVER-38984</url>
 </references>
 <dates>
 <discovery>2019-08-06</discovery>
 <entry>2019-09-28</entry>
 </dates>
 </vuln>

<vuln vid="c360d057-ea8b-11e9-859b-b885849ded8e">
 <topic>mod_perl2 -- execute arbitrary Perl code</topic>
 <affects>
 <package>
	<name>ap24-mod_perl2</name>
	<range><lt>2.0.11,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mod_perl2 2.0.11 fixes Arbitrary Perl code execution in the context
	of the user account via a user-owned .htaccess.
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2011-2767">
	mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary
	 Perl code by placing it in a user-owned .htaccess file, because
	 (contrary to the documentation) there is no configuration option
	 that permits Perl code for the administrator's control of HTTP
	 request processing without also permitting unprivileged users
	 to run Perl code in the context of the user account that runs
	 Apache HTTP Server processes.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2767</url>
 <url>https://www.securityfocus.com/bid/105195</url>
 <url>https://access.redhat.com/errata/RHSA-2018:2826</url>
 <url>https://bugs.debian.org/644169</url>
 <url>https://usn.ubuntu.com/3825-2/</url>
 </references>
 <dates>
 <discovery>2011-07-19</discovery>
 <entry>2019-10-09</entry>
 </dates>
 </vuln>

<vuln vid="791e8f79-e7d1-11e9-8b31-206a8a720317">
 <topic>Xpdf -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>xpdf</name>
	<range><lt>4.02,1</lt></range>
 </package>
 <package>
	<name>xpdf4</name>
	<range><lt>4.02,1</lt></range>
 </package>
 <package>
	<name>xpdf3</name>
	<range><lt>3.04_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Xpdf 4.02 fixes two vulnerabilities. Both fixes have been
	 backported to 3.04.
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-9877">
	 An invalid memory access vulnerability in TextPage::findGaps()
	 in Xpdf 4.01 through a crafted PDF document can cause a
	 segfault.
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-16927">
	 An out of bounds write exists in TextPage::findGaps() of
	 Xpdf 4.01.01 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-9877</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-16927</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9877</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1692</url>
 </references>
 <dates>
 <discovery>2019-10-01</discovery>
 <entry>2019-10-06</entry>
 </dates>
 </vuln>

<vuln vid="108a4be3-e612-11e9-9963-5f1753e0aca0">
 <topic>unbound -- parsing vulnerability</topic>
 <affects>
 <package>
	<name>unbound</name>
	<range><ge>1.7.1</ge><lt>1.9.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Unbound Security Advisories:
	<blockquote cite="https://www.nlnetlabs.nl/projects/unbound/security-advisories/#vulnerability-in-parsing-notify-queries">
	 Due to an error in parsing NOTIFY queries, it is possible for Unbound
	 to continue processing malformed queries and may ultimately result in a
	 pointer dereference in uninitialized memory. This results in a crash of
	 the Unbound daemon.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.nlnetlabs.nl/projects/unbound/security-advisories/#vulnerability-in-parsing-notify-queries</url>
 <cvename>CVE-2019-16866</cvename>
 </references>
 <dates>
 <discovery>2019-10-03</discovery>
 <entry>2019-10-03</entry>
 </dates>
 </vuln>

<vuln vid="f7fcb75c-e537-11e9-863e-b9b7af01ba9e">
 <topic>ruby -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>2.4.0,1</ge><lt>2.4.9,1</lt></range>
	<range><ge>2.5.0,1</ge><lt>2.5.7,1</lt></range>
	<range><ge>2.6.0,1</ge><lt>2.6.5,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby news:
	<blockquote cite="https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-6-5-released/">
	 This release includes security fixes. Please check the topics below for
	 details.
	 CVE-2019-15845: A NUL injection vulnerability of File.fnmatch and
	 File.fnmatch?
	 A NUL injection vulnerability of Ruby built-in methods (File.fnmatch
	 and File.fnmatch?) was found. An attacker who has the control of the
	 path pattern parameter could exploit this vulnerability to make path
	 matching pass despite the intention of the program author.
	 CVE-2019-16201: Regular Expression Denial of Service vulnerability of
	 WEBrick's Digest access authentication
	 Regular expression denial of service vulnerability of WEBrick's Digest
	 authentication module was found. An attacker can exploit this
	 vulnerability to cause an effective denial of service against a WEBrick
	 service.
	 CVE-2019-16254: HTTP response splitting in WEBrick (Additional fix)
	 There is an HTTP response splitting vulnerability in WEBrick bundled
	 with Ruby.
	 CVE-2019-16255: A code injection vulnerability of Shell#[] and
	 Shell#test
	 A code injection vulnerability of Shell#[] and Shell#test in a standard
	 library (lib/shell.rb) was found.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-6-5-released/</url>
 <url>https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-5-7-released/</url>
 <url>https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-4-8-released/</url>
 <url>https://www.ruby-lang.org/en/news/2019/10/02/ruby-2-4-9-released/</url>
 <url>https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/</url>
 <url>https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/</url>
 <url>https://www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/</url>
 <url>https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255/</url>
 <cvename>CVE-2019-15845</cvename>
 <cvename>CVE-2019-16201</cvename>
 <cvename>CVE-2019-16254</cvename>
 <cvename>CVE-2019-16255</cvename>
 </references>
 <dates>
 <discovery>2019-10-01</discovery>
 <entry>2019-10-02</entry>
 </dates>
 </vuln>

<vuln vid="0762fa72-e530-11e9-86e9-001b217b3468">
 <topic>Gitlab -- Disclosure Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.3.0</ge><lt>12.3.3</lt></range>
	<range><ge>12.2.0</ge><lt>12.2.7</lt></range>
	<range><ge>8.17.0</ge><lt>12.1.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/10/02/security-release-gitlab-12-dot-3-dot-3-released/">
	 Disclosure of Private Code, Merge Requests and Commits via Elasticsearch integration
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/10/02/security-release-gitlab-12-dot-3-dot-3-released/</url>
 </references>
 <dates>
 <discovery>2019-10-02</discovery>
 <entry>2019-10-02</entry>
 </dates>
 </vuln>

<vuln vid="b17c86b9-e52e-11e9-86e9-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.3.0</ge><lt>12.3.2</lt></range>
	<range><ge>12.2.0</ge><lt>12.2.6</lt></range>
	<range><ge>7.12.0</ge><lt>12.1.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GitLab Team reports:
	<blockquote cite="https://about.gitlab.com/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/">
	 XSS in Markdown Preview Using Mermaid
	 Bypass Email Verification using Salesforce Authentication
	 Account Takeover using SAML
	 Uncontrolled Resource Consumption in Markdown using Mermaid
	 Disclosure of Private Project Path and Labels
	 Disclosure of Assignees via Milestones
	 Disclosure of Project Path via Unsubscribe Link
	 Disclosure of Project Milestones via Groups
	 Disclosure of Private System Notes via GraphQL
	 GIT Command Injection via API
	 Bypass User Blocking via CI/CD token
	 IDOR Adding Groups to Protected Environments
	 Disclosure of Group Membership via Merge Request Approval Rules
	 Disclosure of Head Pipeline via Blocking Merge Request Feature
	 Grafana update
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/</url>
 <cvename>CVE-2019-19039</cvename>
 </references>
 <dates>
 <discovery>2019-09-30</discovery>
 <entry>2019-10-02</entry>
 </dates>
 </vuln>

<vuln vid="ed18aa92-e4f4-11e9-b6fa-3085a9a95629">
 <topic>cacti -- Authenticated users may bypass authorization checks</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>1.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cacti developers reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16723">
	 In Cacti through 1.2.6, authenticated users may bypass authorization checks
	 (for viewing a graph) via a direct graph_json.php request with a modified
	 local_graph_id parameter.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-16723</cvename>
 <url>https://github.com/Cacti/cacti/releases/tag/release%2F1.2.7</url>
 </references>
 <dates>
 <discovery>2019-09-23</discovery>
 <entry>2019-10-02</entry>
 </dates>
 </vuln>

<vuln vid="e917caba-e291-11e9-89f1-152fed202bb7">
 <topic>Exim -- heap-based buffer overflow in string_vformat leading to RCE</topic>
 <affects>
 <package>
	<name>exim</name>
	<range><ge>4.92</ge><lt>4.92.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Exim developers team report:
	<blockquote cite="https://lists.exim.org/lurker/message/20190927.032457.c1044d4c.en.html">
	 There is a heap overflow in string_vformat().Using a EHLO message, remote code
execution seems to be possible.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openwall.com/lists/oss-security/2019/09/28/1</url>
 </references>
 <dates>
 <discovery>2019-09-28</discovery>
 <entry>2019-09-29</entry>
 </dates>
 </vuln>

<vuln vid="a92dcc5c-e05c-11e9-b589-10c37b4ac2ea">
 <topic>go -- invalid headers are normalized, allowing request smuggling</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.13.1,1</lt></range>
 </package>
 <package>
	<name>go-devel</name>
	<range><lt>g20190925</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Go project reports:
	<blockquote cite="https://github.com/golang/go/issues/34540">
	 net/http (through net/textproto) used to accept and normalize invalid
	 HTTP/1.1 headers with a space before the colon, in violation of RFC 7230.
	 If a Go server is used behind a reverse proxy that accepts and forwards
	 but doesn't normalize such invalid headers, the reverse proxy and the
	 server can interpret the headers differently. This can lead to filter
	 bypasses or request smuggling, the latter if requests from separate clients
	 are multiplexed onto the same connection by the proxy. Such invalid headers
	 are now rejected by Go servers, and passed without normalization to Go
	 client applications.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-16276</cvename>
 <url>https://github.com/golang/go/issues/34540</url>
 </references>
 <dates>
 <discovery>2019-09-25</discovery>
 <entry>2019-09-26</entry>
 </dates>
 </vuln>

<vuln vid="81fcc2f9-e15a-11e9-abbf-800dd28b22bd">
 <topic>mantis -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mantis-php71</name>
	<name>mantis-php72</name>
	<name>mantis-php73</name>
	<name>mantis-php74</name>
	<range><lt>2.22.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mantis developers report:
	<blockquote cite="https://mantisbt.org/bugs/changelog_page.php?project=mantisbt&amp;version=2.22.1">
	 CVE-2019-15715: [Admin Required - Post Authentication] Command Execution / Injection Vulnerability
	 CVE-2019-8331: In Bootstrap before 3.4.1, XSS is possible in the tooltip or popover data-template attribute
	 Missing integrity hashes for CSS resources from CDNs
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mantisbt.org/bugs/changelog_page.php?project=mantisbt&amp;version=2.22.1</url>
 <cvename>CVE-2019-15715</cvename>
 <cvename>CVE-2019-8331</cvename>
 </references>
 <dates>
 <discovery>2019-08-28</discovery>
 <entry>2019-09-27</entry>
 </dates>
 </vuln>

<vuln vid="9720bb39-f82a-402f-9fe4-e2c875bdda83">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><le>2.196</le></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><le>2.176.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://jenkins.io/security/advisory/2019-09-25/">
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-1498 / CVE-2019-10401</h5>
	 Stored XSS vulnerability in expandable textbox form control
	 <h5>(Medium) SECURITY-1525 / CVE-2019-10402</h5>
	 XSS vulnerability in combobox form control
	 <h5>(Medium) SECURITY-1537 (1) / CVE-2019-10403</h5>
	 Stored XSS vulnerability in SCM tag action tooltip
	 <h5>(Medium) SECURITY-1537 (2) / CVE-2019-10404</h5>
	 Stored XSS vulnerability in queue item tooltip
	 <h5>(Medium) SECURITY-1505 / CVE-2019-10405</h5>
	 Diagnostic web page exposed Cookie HTTP header
	 <h5>(Medium) SECURITY-1471 / CVE-2019-10406</h5>
	 XSS vulnerability in Jenkins URL setting
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-10401</cvename>
 <cvename>CVE-2019-10402</cvename>
 <cvename>CVE-2019-10403</cvename>
 <cvename>CVE-2019-10404</cvename>
 <cvename>CVE-2019-10405</cvename>
 <cvename>CVE-2019-10406</cvename>
 <url>https://jenkins.io/security/advisory/2019-09-25/</url>
 </references>
 <dates>
 <discovery>2019-09-25</discovery>
 <entry>2019-09-25</entry>
 </dates>
 </vuln>

<vuln vid="20b92374-d62a-11e9-af73-001b217e4ee5">
 <topic>ISC KEA -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>kea</name>
	<range><lt>1.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Internet Systems Consortium, Inc. reports:
	<blockquote cite="https://gitlab.isc.org/isc-projects/kea/issues">
	 A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate (CVE-2019-6472) [Medium]
	 An invalid hostname option can cause the kea-dhcp4 server to terminate (CVE-2019-6473) [Medium]
	 An oversight when validating incoming client requests can lead to a situation where the Kea server 
	 will exit when trying to restart (CVE-2019-6474) [Medium]
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://gitlab.isc.org/isc-projects/kea/issues</url>
 <cvename>CVE-2019-6472</cvename>
 <cvename>CVE-2019-6473</cvename>
 <cvename>CVE-2019-6474</cvename>
 </references>
 <dates>
 <discovery>2019-08-28</discovery>
 <entry>2019-09-20</entry>
 </dates>
 </vuln>

<vuln vid="6856d798-d950-11e9-aae4-f079596b62f9">
 <topic>expat2 -- Fix extraction of namespace prefixes from XML names</topic>
 <affects>
 <package>
	<name>expat</name>
	<range><lt>2.2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	expat project reports:
	<blockquote cite="https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes">
	 
	 Fix heap overflow triggered by
	 XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber),
	 and deny internal entities closing the doctype
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes</url>
 </references>
 <dates>
 <discovery>2019-09-13</discovery>
 <entry>2019-09-17</entry>
 </dates>
 </vuln>

<vuln vid="b2789b2d-d521-11e9-86e9-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.2.0</ge><lt>12.2.5</lt></range>
	<range><ge>12.1.0</ge><lt>12.1.9</lt></range>
	<range><ge>11.6.0</ge><lt>12.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/09/10/critical-security-release-gitlab-12-dot-2-dot-5-released/">
	Project Template Functionality Could Be Used to Access Restricted Project Data
	Security Enhancements in GitLab Pages
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/09/10/critical-security-release-gitlab-12-dot-2-dot-5-released/</url>
 <cvename>CVE-2019-16170</cvename>
 </references>
 <dates>
 <discovery>2019-09-10</discovery>
 <entry>2019-09-12</entry>
 </dates>
 </vuln>

<vuln vid="1c948fd3-dac0-11e9-81b2-0011d823eebd">
 <topic>Mbed TLS -- Side channel attack on deterministic ECDSA</topic>
 <affects>
 <package>
	<name>mbedtls</name>
	<range><lt>2.16.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Janos Follath reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10">
	 Mbed TLS does not have a constant-time/constant-trace arithmetic
	 library and uses blinding to protect against side channel
	 attacks.
	 In the ECDSA signature routine previous Mbed TLS versions used the
	 same RNG object for generating the ephemeral key pair and for
	 generating the blinding values. The deterministic ECDSA function
	 reused this by passing the RNG object created from the private key
	 and the message to be signed as prescribed by RFC 6979. This meant
	 that the same RNG object was used whenever the same message was
	 signed, rendering the blinding ineffective.
	 If the victim can be tricked to sign the same message repeatedly,
	 the private key may be recoverable through side channels.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10</url>
 </references>
 <dates>
 <discovery>2019-09-06</discovery>
 <entry>2019-09-19</entry>
 </dates>
 </vuln>

<vuln vid="55571619-454e-4769-b1e5-28354659e152">
 <topic>bro -- invalid memory access or heap buffer over-read</topic>
 <affects>
 <package>
	<name>bro</name>
	<range><lt>2.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jon Siwek of Corelight reports:
	<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/3b5a9f88ece1d274edee897837e280ef751bde94/NEWS">
	 This is a security patch release to address a potential
	 Denial of Service vulnerability:
	 <ul>
	 <li>
	 The NTLM analyzer did not properly handle AV Pair sequences
	 that were either empty or unterminated, resulting in
	 invalid memory access or heap buffer over-read. The NTLM
	 analyzer is enabled by default and used in the analysis
	 of SMB, DCE/RPC, and GSSAPI protocols.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://raw.githubusercontent.com/zeek/zeek/3b5a9f88ece1d274edee897837e280ef751bde94/NEWS</url>
 </references>
 <dates>
 <discovery>2019-08-28</discovery>
 <entry>2019-09-17</entry>
 </dates>
 </vuln>

<vuln vid="c5bd8a25-99a6-11e9-a598-f079596b62f9">
 <topic>expat2 -- Fix extraction of namespace prefixes from XML names</topic>
 <affects>
 <package>
	<name>expat</name>
	<range><lt>2.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	expat project reports:
	<blockquote cite="https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes">
	 
	 XML names with multiple colons could end up in the
	 wrong namespace, and take a high amount of RAM and CPU
	 resources while processing, opening the door to
	 use for denial-of-service attacks
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes</url>
 </references>
 <dates>
 <discovery>2019-06-19</discovery>
 <entry>2019-09-16</entry>
 </dates>
 </vuln>

<vuln vid="9fb4e57b-d65a-11e9-8a5f-e5c82b486287">
 <topic>curl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.19.4</ge><lt>7.66.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	curl security problems:
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	 CVE-2019-5481: FTP-KRB double-free
	 libcurl can be told to use kerberos over FTP to a server, as set with
	 the CURLOPT_KRBLEVEL option.
	 During such kerberos FTP data transfer, the server sends data to curl
	 in blocks with the 32 bit size of each block first and then that amount
	 of data immediately following.
	 A malicious or just broken server can claim to send a very large block
	 and if by doing that it makes curl's subsequent call to realloc() to
	 fail, curl would then misbehave in the exit path and double-free the
	 memory.
	 In practical terms, an up to 4 GB memory area may very well be fine to
	 allocate on a modern 64 bit system but on 32 bit systems it will fail.
	 Kerberos FTP is a rarely used protocol with curl. Also, Kerberos
	 authentication is usually only attempted and used with servers that the
	 client has a previous association with.
	 CVE-2019-5482: TFTP small blocksize heap buffer overflow
	 libcurl contains a heap buffer overflow in the function
	 (tftp_receive_packet()) that receives data from a TFTP server. It can
	 call recvfrom() with the default size for the buffer rather than with
	 the size that was used to allocate it. Thus, the content that might
	 overwrite the heap memory is controlled by the server.
	 This flaw is only triggered if the TFTP server sends an OACK without
	 the BLKSIZE option, when a BLKSIZE smaller than 512 bytes was requested
	 by the TFTP client. OACK is a TFTP extension and is not used by all
	 TFTP servers.
	 Users choosing a smaller block size than default should be rare as the
	 primary use case for changing the size is to make it larger.
	 It is rare for users to use TFTP across the Internet. It is most
	 commonly used within local networks. TFTP as a protocol is always
	 inherently insecure.
	 This issue was introduced by the add of the TFTP BLKSIZE option
	 handling. It was previously incompletely fixed by an almost identical
	 issue called CVE-2019-5436.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/security.html</url>
 <url>https://curl.haxx.se/docs/CVE-2019-5481.html</url>
 <url>https://curl.haxx.se/docs/CVE-2019-5482.html</url>
 <cvename>CVE-2019-5481</cvename>
 <cvename>CVE-2019-5482</cvename>
 </references>
 <dates>
 <discovery>2019-09-11</discovery>
 <entry>2019-09-14</entry>
 </dates>
 </vuln>

<vuln vid="9e0c6f7a-d46d-11e9-a1c7-b499baebfeaf">
 <topic>OpenSSL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2t,1</lt></range>
 </package>
 <package>
	<name>openssl111</name>
	<range><lt>1.1.1d</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20190910.txt">
	 ECDSA remote timing attack (CVE-2019-1547) [Low]
	 Fork Protection (CVE-2019-1549) [Low] 
	 (OpenSSL 1.1.1 only)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20190910.txt</url>
 <cvename>CVE-2019-1547</cvename>
 <cvename>CVE-2019-1549</cvename>
 </references>
 <dates>
 <discovery>2019-09-10</discovery>
 <entry>2019-09-11</entry>
 </dates>
 </vuln>

<vuln vid="c6f19fe6-d42a-11e9-b4f9-6451062f0f7a">
 <topic>Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>32.0.0.255</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb19-46.html">
	 <ul>
	 <li>This update resolves a same origin method execution
	 vulnerability that could lead to arbitrary code execution
	 (CVE-2019-8069).</li>
	 <li>This update resolves a use-after-free vulnerability that
	 could lead to arbitrary code execution (CVE-2019-8070).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-8069</cvename>
 <cvename>CVE-2019-8070</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb19-46.html</url>
 </references>
 <dates>
 <discovery>2019-09-10</discovery>
 <entry>2019-09-10</entry>
 </dates>
 </vuln>

<vuln vid="a8d87c7a-d1b1-11e9-a616-0992a4564e7c">
 <topic>oniguruma -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>oniguruma</name>
	<range><lt>6.9.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13224">
	 
	 A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe().
	 
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13225">
	 A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression.
	 Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-13224</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13224</url>
 <url>https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55</url>
 <cvename>CVE-2019-13225</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13225</url>
 <url>https://github.com/kkos/oniguruma/commit/c509265c5f6ae7264f7b8a8aae1cfa5fc59d108c</url>
 </references>
 <dates>
 <discovery>2019-07-03</discovery>
 <entry>2019-09-07</entry>
 </dates>
 </vuln>

<vuln vid="10e1d580-d174-11e9-a87f-a4badb2f4699">
 <topic>xymon-server -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xymon-server</name>
	<range><lt>4.3.29</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Japheth Cleaver reports:
	<blockquote cite="https://lists.xymon.com/archive/2019-July/046570.html">
	 Several buffer overflows were reported by University of
	 Cambridge Computer Security Incident Response Team.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.xymon.com/archive/2019-July/046570.html</url>
 <cvename>CVE-2019-13451</cvename>
 <cvename>CVE-2019-13452</cvename>
 <cvename>CVE-2019-13455</cvename>
 <cvename>CVE-2019-13273</cvename>
 <cvename>CVE-2019-13274</cvename>
 <cvename>CVE-2019-13484</cvename>
 <cvename>CVE-2019-13485</cvename>
 <cvename>CVE-2019-13486</cvename>
 </references>
 <dates>
 <discovery>2019-07-23</discovery>
 <entry>2019-09-07</entry>
 </dates>
 </vuln>

<vuln vid="8a9f86de-d080-11e9-9051-4c72b94353b5">
 <topic>wordpress -- multiple issues</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>5.2.3,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>zh_CN-wordpress</name>
	<name>zh_TW-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<range><lt>5.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wordpress developers reports:
	<blockquote cite="https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/">
	 Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues.
	 The first, a cross-site scripting (XSS) vulnerability found in post previews by contributors.
	 The second was a cross-site scripting vulnerability in stored comments.
	 Props to Tim Coen for disclosing an issue where validation and sanitization
	 of a URL could lead to an open redirect.
	 Props to Anshul Jain for disclosing reflected cross-site scripting during media uploads.
	 Props to Zhouyuan Yang of Fortinets FortiGuard Labs who disclosed a vulnerability
	 for cross-site scripting (XSS) in shortcode previews.
	 Props to Ian Dunn of the Core Security Team for finding and disclosing a case where
	 reflected cross-site scripting could be found in the dashboard.
	 Props to Soroush Dalilifrom NCC Group for disclosing an issue with URL
	 sanitization that can lead to cross-site scripting (XSS) attacks.
	 In addition to the above changes, we are also updating jQuery on older versions of WordPress.
	 This change was added in 5.2.1 and is now being brought to older versions.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2019-09-05</discovery>
 <entry>2019-09-06</entry>
 </dates>
 </vuln>

<vuln vid="61db9b88-d091-11e9-8d41-97657151f8c2">
 <topic>Exim -- RCE with root privileges in TLS SNI handler</topic>
 <affects>
 <package>
	<name>exim</name>
	<range><lt>4.92.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Exim developers report:
	<blockquote cite="https://git.exim.org/exim.git/blob/2600301ba6dbac5c9d640c87007a07ee6dcea1f4:/doc/doc-txt/cve-2019-15846/cve.txt">
	 If your Exim server accepts TLS connections, it is vulnerable. This does
	 not depend on the TLS libray, so both, GnuTLS and OpenSSL are affected.
	 The vulnerability is exploitable by sending a SNI ending in a
backslash-null sequence during the initial TLS handshake. The exploit
exists as a POC. For more details see the document qualys.mbx
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://git.exim.org/exim.git/blob_plain/2600301ba6dbac5c9d640c87007a07ee6dcea1f4:/doc/doc-txt/cve-2019-15846/cve.txt</url>
 </references>
 <dates>
 <discovery>2019-09-02</discovery>
 <entry>2019-09-06</entry>
 </dates>
 </vuln>

<vuln vid="7d53d8da-d07a-11e9-8f1a-001999f8d30b">
 <topic>asterisk -- Remote Crash Vulnerability in audio transcoding</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.28.1</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><lt>16.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 When audio frames are given to the audio transcoding
	 support in Asterisk the number of samples are examined
	 and as part of this a message is output to indicate that
	 no samples are present. A change was done to suppress
	 this message for a particular scenario in which the message
	 was not relevant. This change assumed that information
	 about the origin of a frame will always exist when in
	 reality it may not.
	 This issue presented itself when an RTP packet containing
	 no audio (and thus no samples) was received. In a particular
	 transcoding scenario this audio frame would get turned
	 into a frame with no origin information. If this new frame
	 was then given to the audio transcoding support a crash
	 would occur as no samples and no origin information would
	 be present. The transcoding scenario requires the genericplc
	 option to be set to enabled (the default) and a transcoding
	 path from the source format into signed linear and then
	 from signed linear into another format.
	 Note that there may be other scenarios that have not
	 been found which can cause an audio frame with no origin
	 to be given to the audio transcoding support and thus
	 cause a crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2019-005.html</url>
 <cvename>CVE-2019-15639</cvename>
 </references>
 <dates>
 <discovery>2019-08-07</discovery>
 <entry>2019-09-06</entry>
 </dates>
 </vuln>

<vuln vid="d94c08d2-d079-11e9-8f1a-001999f8d30b">
 <topic>asterisk -- Crash when negotiating for T.38 with a declined stream</topic>
 <affects>
 <package>
	<name>asterisk15</name>
	<range><lt>15.7.4</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><lt>16.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 When Asterisk sends a re-invite initiating T.38 faxing,
	 and the endpoint responds with a declined media stream a
	 crash will then occur in Asterisk.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2019-004.html</url>
 <cvename>CVE-2019-15297</cvename>
 </references>
 <dates>
 <discovery>2019-08-05</discovery>
 <entry>2019-09-06</entry>
 </dates>
 </vuln>

<vuln vid="145a3e17-cea2-11e9-81e2-005056a311d1">
 <topic>samba -- combination of parameters and permissions can allow user to escape from the share path definition</topic>
 <affects>
 <package>
	<name>samba410</name>
	<range><lt>4.10.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The samba project reports:
	<blockquote cite="https://www.samba.org/samba/security/CVE-2019-10197.html">
	 On a Samba SMB server for all versions of Samba from 4.9.0 clients are
	 able to escape outside the share root directory if certain
	 configuration parameters set in the smb.conf file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-10197</cvename>
 <url>https://www.samba.org/samba/security/CVE-2019-10197.html</url>
 </references>
 <dates>
 <discovery>2019-09-01</discovery>
 <entry>2019-09-03</entry>
 </dates>
 </vuln>

<vuln vid="05463e0a-abd3-4fa4-bd5f-cd5ed132d4c6">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>69.0,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.2.14</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.53.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><ge>61.0,1</ge><lt>68.1.0,1</lt></range>
	<range><lt>60.9.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><ge>61.0,2</ge><lt>68.1.0,2</lt></range>
	<range><lt>60.9.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><ge>61.0</ge><lt>68.1.0</lt></range>
	<range><lt>60.9.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-25/">
	 CVE-2019-11751: Malicious code execution through command line parameters
	 CVE-2019-11746: Use-after-free while manipulating video
	 CVE-2019-11744: XSS by breaking out of title and textarea elements using innerHTML
	 CVE-2019-11742: Same-origin policy violation with SVG filters and canvas to steal cross-origin images
	 CVE-2019-11736: File manipulation and privilege escalation in Mozilla Maintenance Service
	 CVE-2019-11753: Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location
	 CVE-2019-11752: Use-after-free while extracting a key value in IndexedDB
	 CVE-2019-9812: Sandbox escape through Firefox Sync
	 CVE-2019-11741: Isolate addons.mozilla.org and accounts.firefox.com
	 CVE-2019-11743: Cross-origin access to unload event attributes
	 CVE-2019-11748: Persistence of WebRTC permissions in a third party context
	 CVE-2019-11749: Camera information available without prompting using getUserMedia
	 CVE-2019-5849: Out-of-bounds read in Skia
	 CVE-2019-11750: Type confusion in Spidermonkey
	 CVE-2019-11737: Content security policy directives ignore port and path if host is a wildcard
	 CVE-2019-11738: Content security policy bypass through hash-based sources in directives
	 CVE-2019-11747: 'Forget about this site' removes sites from pre-loaded HSTS list
	 CVE-2019-11734: Memory safety bugs fixed in Firefox 69
	 CVE-2019-11735: Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1
	 CVE-2019-11740: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-11734</cvename>
 <cvename>CVE-2019-11735</cvename>
 <cvename>CVE-2019-11736</cvename>
 <cvename>CVE-2019-11737</cvename>
 <cvename>CVE-2019-11738</cvename>
 <cvename>CVE-2019-11740</cvename>
 <cvename>CVE-2019-11741</cvename>
 <cvename>CVE-2019-11742</cvename>
 <cvename>CVE-2019-11743</cvename>
 <cvename>CVE-2019-11744</cvename>
 <cvename>CVE-2019-11746</cvename>
 <cvename>CVE-2019-11747</cvename>
 <cvename>CVE-2019-11748</cvename>
 <cvename>CVE-2019-11749</cvename>
 <cvename>CVE-2019-11750</cvename>
 <cvename>CVE-2019-11751</cvename>
 <cvename>CVE-2019-11752</cvename>
 <cvename>CVE-2019-11753</cvename>
 <cvename>CVE-2019-5849</cvename>
 <cvename>CVE-2019-9812</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2019-25/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2019-26/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2019-27/</url>
 </references>
 <dates>
 <discovery>2019-09-03</discovery>
 <entry>2019-09-03</entry>
 </dates>
 </vuln>

<vuln vid="ce231189-ce56-11e9-9fa0-0050569f0b83">
 <topic>www/varnish6 -- Denial of Service</topic>
 <affects>
 <package>
	<name>varnish6</name>
	<range><lt>6.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Varnish Team reports:
	<blockquote cite="https://varnish-cache.org/security/VSV00003.html">
	 A failure in HTTP/1 parsing can allow a remote attacker to trigger
	 an assertion in varnish, restarting the daemon and clearing the cache.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://varnish-cache.org/security/VSV00003.html</url>
 </references>
 <dates>
 <discovery>2019-09-02</discovery>
 <entry>2019-09-03</entry>
 </dates>
 </vuln>

<vuln vid="c9c6c2f8-cd54-11e9-af89-080027ef1a23">
 <topic>libgcrypt -- ECDSA timing attack</topic>
 <affects>
 <package>
	<name>libgcrypt</name>
	<range><lt>1.8.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GnuPG reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13627">
	 Mitigate an ECDSA timing attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-13627</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13627</url>
 </references>
 <dates>
 <discovery>2019-08-29</discovery>
 <entry>2019-09-02</entry>
 </dates>
 </vuln>

<vuln vid="e45c3669-caf2-11e9-851a-dcf3aaa3f3ff">
 <topic>webkit2-gtk3 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>webkit2-gtk3</name>
	<range><lt>2.24.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The WebKitGTK project reports many vulnerabilities,
	including several arbitrary code execution vulnerabilities.
 </body>
 </description>
 <references>
 <url>https://webkitgtk.org/security/WSA-2019-0004.html</url>
 <cvename>CVE-2019-8644</cvename>
 <cvename>CVE-2019-8649</cvename>
 <cvename>CVE-2019-8658</cvename>
 <cvename>CVE-2019-8666</cvename>
 <cvename>CVE-2019-8669</cvename>
 <cvename>CVE-2019-8671</cvename>
 <cvename>CVE-2019-8672</cvename>
 <cvename>CVE-2019-8673</cvename>
 <cvename>CVE-2019-8676</cvename>
 <cvename>CVE-2019-8677</cvename>
 <cvename>CVE-2019-8678</cvename>
 <cvename>CVE-2019-8679</cvename>
 <cvename>CVE-2019-8680</cvename>
 <cvename>CVE-2019-8681</cvename>
 <cvename>CVE-2019-8683</cvename>
 <cvename>CVE-2019-8684</cvename>
 <cvename>CVE-2019-8686</cvename>
 <cvename>CVE-2019-8687</cvename>
 <cvename>CVE-2019-8688</cvename>
 <cvename>CVE-2019-8689</cvename>
 <cvename>CVE-2019-8690</cvename>
 </references>
 <dates>
 <discovery>2019-08-29</discovery>
 <entry>2019-08-30</entry>
 </dates>
 </vuln>

<vuln vid="b68cc195-cae7-11e9-86e9-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.2.0</ge><lt>12.2.3</lt></range>
	<range><ge>12.1.0</ge><lt>12.1.8</lt></range>
	<range><ge>0.0.0</ge><lt>12.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/">
	 Kubernetes Integration Server-Side Request Forgery
	 Server-Side Request Forgery in Jira Integration
	 Improved Protection Against Credential Stuffing Attacks
	 Markdown Clientside Resource Exhaustion
	 Pipeline Status Disclosure
	 Group Runner Authorization Issue
	 CI Metrics Disclosure
	 User IP Disclosed by Embedded Image and Media
	 Label Description HTML Injection
	 IDOR in Epic Notes API
	 Push Rule Bypass
	 Project Visibility Restriction Bypass
	 Merge Request Discussion Restriction Bypass
	 Disclosure of Merge Request IDs
	 Weak Authentication In Certain Account Actions
	 Disclosure of Commit Title and Comments
	 Stored XSS via Markdown
	 EXIF Geolocation Data Exposure
	 Multiple SSRF Regressions on Gitaly
	 Default Branch Name Exposure
	 Potential Denial of Service via CI Pipelines
	 Privilege Escalation via Logrotate
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/</url>
 <cvename>CVE-2019-15728</cvename>
 <cvename>CVE-2019-15730</cvename>
 <cvename>CVE-2019-15722</cvename>
 <cvename>CVE-2019-15729</cvename>
 <cvename>CVE-2019-15721</cvename>
 <cvename>CVE-2019-15727</cvename>
 <cvename>CVE-2019-15726</cvename>
 <cvename>CVE-2019-15724</cvename>
 <cvename>CVE-2019-15725</cvename>
 <cvename>CVE-2019-15723</cvename>
 <cvename>CVE-2019-15732</cvename>
 <cvename>CVE-2019-15731</cvename>
 <cvename>CVE-2019-15738</cvename>
 <cvename>CVE-2019-15737</cvename>
 <cvename>CVE-2019-15734</cvename>
 <cvename>CVE-2019-15739</cvename>
 <cvename>CVE-2019-15740</cvename>
 <cvename>CVE-2019-15733</cvename>
 <cvename>CVE-2019-15736</cvename>
 <cvename>CVE-2019-15741</cvename>
 </references>
 <dates>
 <discovery>2019-08-29</discovery>
 <entry>2019-08-30</entry>
 </dates>
 </vuln>

<vuln vid="ed8d5535-ca78-11e9-980b-999ff59c22ea">
 <topic>RDoc -- multiple jQuery vulnerabilities</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>2.4.0,1</ge><lt>2.4.7,1</lt></range>
	<range><ge>2.5.0,1</ge><lt>2.5.6,1</lt></range>
	<range><ge>2.6.0,1</ge><lt>2.6.3,1</lt></range>
 </package>
 <package>
	<name>rubygem-rdoc</name>
	<range><lt>6.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby news:
	<blockquote cite="https://www.ruby-lang.org/en/news/2019/08/28/multiple-jquery-vulnerabilities-in-rdoc/">
	 There are multiple vulnerabilities about Cross-Site Scripting (XSS) in
	 jQuery shipped with RDoc which bundled in Ruby. All Ruby users are
	 recommended to update Ruby to the latest release which includes the
	 fixed version of RDoc.
	 The following vulnerabilities have been reported.
	 CVE-2012-6708
	 CVE-2015-9251
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.ruby-lang.org/en/news/2019/08/28/multiple-jquery-vulnerabilities-in-rdoc/</url>
 <cvename>CVE-2012-6708</cvename>
 <cvename>CVE-2015-9251</cvename>
 </references>
 <dates>
 <discovery>2019-08-28</discovery>
 <entry>2019-08-29</entry>
 <modified>2019-08-31</modified>
 </dates>
 </vuln>

<vuln vid="abaaecda-ea16-43e2-bad0-d34a9ac576b1">
 <topic>Dovecot -- improper input validation</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><lt>2.3.7.2</lt></range>
 </package>
 <package>
	<name>dovecot-pigeonhole</name>
	<range><lt>0.5.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aki Tuomi reports:
	<blockquote cite="https://dovecot.org/pipermail/dovecot/2019-August/116874.html">
	 Vulnerability Details:

IMAP and ManageSieve protocol parsers do not properly handle NUL byte
when scanning data in quoted strings, leading to out of bounds heap
memory writes.

Risk:

This vulnerability allows for out-of-bounds writes to objects stored on
the heap up to 8096 bytes in pre-login phase, and 65536 bytes post-login
phase, allowing sufficiently skilled attacker to perform complicated
attacks that can lead to leaking private information or remote code
execution. Abuse of this bug is very difficult to observe, as it does
not necessarily cause a crash. Attempts to abuse this bug are not
directly evident from logs.

	</blockquote>
 </body>
 </description>
 <references>
 <url>https://dovecot.org/pipermail/dovecot/2019-August/116874.html</url>
 <cvename>CVE-2019-11500</cvename>
 </references>
 <dates>
 <discovery>2019-04-13</discovery>
 <entry>2019-08-28</entry>
 </dates>
 </vuln>

<vuln vid="7a7891fc-6318-447a-ba45-31d525ec11a0">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><le>2.191</le></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><le>2.176.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://jenkins.io/security/advisory/2019-08-28/">
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-1453 / CVE-2019-10383</h5>
	 Stored XSS vulnerability in update center
	 <h5>(High) SECURITY-1491 / CVE-2019-10384</h5>
	 CSRF protection tokens for anonymous users did not expire in some circumstances
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-10383</cvename>
 <cvename>CVE-2019-10384</cvename>
 <url>https://jenkins.io/security/advisory/2019-08-28/</url>
 </references>
 <dates>
 <discovery>2019-08-28</discovery>
 <entry>2019-08-28</entry>
 </dates>
 </vuln>

<vuln vid="0f31b4e9-c827-11e9-9626-589cfc01894a">
 <topic>Mozilla -- Stored passwords in 'Saved Logins' can be copied without master password entry</topic>
 <affects>
 <package>
	<name>cliqz</name>
	<range><lt>1.28.2</lt></range>
 </package>
 <package>
	<name>firefox</name>
	<range><lt>68.0.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/">
	 <h1>CVE-2019-11733: Stored passwords in 'Saved Logins' can
	 be copied without master password entry</h1>
	 When a master password is set, it is required to be
	 entered again before stored passwords can be accessed in the 'Saved
	 Logins' dialog. It was found that locally stored passwords can be
	 copied to the clipboard thorough the 'copy password' context menu item
	 without re-entering the master password if the master password had
	 been previously entered in the same session, allowing for potential
	 theft of stored passwords.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.mozilla.org/security/advisories/mfsa2019-24/</url>
 <cvename>CVE-2019-11733</cvename>
 </references>
 <dates>
 <discovery>2019-08-14</discovery>
 <entry>2019-08-28</entry>
 </dates>
 </vuln>

<vuln vid="72a5579e-c765-11e9-8052-0028f8d09152">
 <topic>h2o -- multiple HTTP/2 vulnerabilities</topic>
 <affects>
 <package>
	<name>h2o-devel</name>
	<range><lt>2.3.0.b2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jonathon Loomey of Netflix reports:
	<blockquote cite="https://www.kb.cert.org/vuls/id/605641/">
	 HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion
	 Recently, a series of DoS attack vulnerabilities have been reported on a broad range of HTTP/2 stacks. Among the vulnerabilities, H2O is exposed to the following:
	 <ul>
 <li>CVE-2019-9512 "Ping Flood": The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
 <li>CVE-2019-9514 "Reset Flood": The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.</li>
 <li>CVE-2019-9515 "Settings Flood": The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/h2o/h2o/issues/2090</url>
 <url>https://www.kb.cert.org/vuls/id/605641/</url>
 <cvename>CVE-2019-9512</cvename>
 <cvename>CVE-2019-9514</cvename>
 <cvename>CVE-2019-9515</cvename>
 </references>
 <dates>
 <discovery>2019-08-13</discovery>
 <entry>2019-08-25</entry>
 </dates>
 </vuln>

<vuln vid="73b1e734-c74e-11e9-8052-0028f8d09152">
 <topic>h2o -- multiple HTTP/2 vulnerabilities</topic>
 <affects>
 <package>
	<name>h2o</name>
	<range><lt>2.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jonathon Loomey of Netflix reports:
	<blockquote cite="https://www.kb.cert.org/vuls/id/605641/">
	 HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion
	 Recently, a series of DoS attack vulnerabilities have been reported on a broad range of HTTP/2 stacks. Among the vulnerabilities, H2O is exposed to the following:
	 <ul>
 <li>CVE-2019-9512 "Ping Flood": The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
 <li>CVE-2019-9514 "Reset Flood": The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.</li>
 <li>CVE-2019-9515 "Settings Flood": The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/h2o/h2o/issues/2090</url>
 <url>https://www.kb.cert.org/vuls/id/605641/</url>
 <cvename>CVE-2019-9512</cvename>
 <cvename>CVE-2019-9514</cvename>
 <cvename>CVE-2019-9515</cvename>
 </references>
 <dates>
 <discovery>2019-08-13</discovery>
 <entry>2019-08-25</entry>
 </dates>
 </vuln>

<vuln vid="e7392840-c520-11e9-a4ef-0800274e5f20">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports:
	<blockquote cite="https://blog.gitea.io/2019/08/gitea-1.9.2-is-released/">
	 This release contains two security fixes, so we highly recommend updating.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.9.2</url>
 <url>https://blog.gitea.io/2019/08/gitea-1.9.2-is-released/</url>
 </references>
 <dates>
 <discovery>2019-08-22</discovery>
 <entry>2019-08-22</entry>
 </dates>
 </vuln>

<vuln vid="dbd1f627-c43b-11e9-a923-9c5c8e75236a">
 <topic>clamav -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.101.4,1</lt></range>
 </package>
 <package>
	<name>clamav-milter</name>
	<range><lt>0.101.4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Micah Snyder reports:
	<blockquote cite="https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.html">
	 <ul>
	 <li>An out of bounds write was possible within ClamAV&amp;s NSIS bzip2 library when attempting decompression in cases where the number of selectors exceeded the max limit set by the library (CVE-2019-12900). The issue has been resolved by respecting that limit.</li>
	 <li> The zip bomb vulnerability mitigated in 0.101.3 has been assigned the CVE identifier CVE-2019-12625. Unfortunately, a workaround for the zip-bomb mitigation was immediately identified. To remediate the zip-bomb scan time issue, a scan time limit has been introduced in 0.101.4. This limit now resolves ClamAV's vulnerability to CVE-2019-12625.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.html</url>
 <cvename>CVE-2019-12625</cvename>
 <cvename>CVE-2019-12900</cvename>
 </references>
 <dates>
 <discovery>2019-08-21</discovery>
 <entry>2019-08-21</entry>
 </dates>
 </vuln>

<vuln vid="c97a940b-c392-11e9-bb38-000d3ab229d6">
 <topic>Node.js -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>node</name>
	<range><lt>12.8.1</lt></range>
 </package>
 <package>
	<name>node10</name>
	<range><lt>10.16.3</lt></range>
 </package>
 <package>
	<name>node8</name>
	<range><lt>8.16.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Node.js reports:
 <blockquote cite="https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/">
 Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for more information.
 Updates are now available for all active Node.js release lines, including Linux ARMv6 builds for Node.js 8.x (which had been delayed).
 We recommend that all Node.js users upgrade to a version listed below as soon as possible.
 <h1>Vulnerabilities Fixed</h1>
 Impact: All versions of Node.js 8 (LTS "Carbon"), Node.js 10 (LTS "Dubnium"), and Node.js 12 (Current) are vulnerable to the following:
 <ul>
 <li>CVE-2019-9511 "Data Dribble": The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
 <li>CVE-2019-9512 "Ping Flood": The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
 <li>CVE-2019-9513 "Resource Loop": The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU, potentially leading to a denial of service.</li>
 <li>CVE-2019-9514 "Reset Flood": The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.</li>
 <li>CVE-2019-9515 "Settings Flood": The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
 <li>CVE-2019-9516 "0-Length Headers Leak": The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory, potentially leading to a denial of service.</li>
 <li>CVE-2019-9517 "Internal Data Buffering": The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both, potentially leading to a denial of service.</li>
 <li>CVE-2019-9518 "Empty Frames Flood": The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU, potentially leading to a denial of service. (Discovered by Piotr Sikora of Google)</li>
 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/</url>
 <cvename>CVE-2019-9511</cvename>
 <cvename>CVE-2019-9512</cvename>
 <cvename>CVE-2019-9513</cvename>
 <cvename>CVE-2019-9514</cvename>
 <cvename>CVE-2019-9515</cvename>
 <cvename>CVE-2019-9516</cvename>
 <cvename>CVE-2019-9517</cvename>
 <cvename>CVE-2019-9518</cvename>
 </references>
 <dates>
 <discovery>2019-08-16</discovery>
 <entry>2019-08-21</entry>
 </dates>
 </vuln>

<vuln vid="795442e7-c355-11e9-8224-5404a68ad561">
 <topic>vlc -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><lt>3.0.8,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The VLC project reports:
	<blockquote cite="https://www.videolan.org/developers/vlc-branch/NEWS">
	 Security:
	 * Fix a buffer overflow in the MKV demuxer (CVE-2019-14970)
	 * Fix a read buffer overflow in the avcodec decoder (CVE-2019-13962)
	 * Fix a read buffer overflow in the FAAD decoder
	 * Fix a read buffer overflow in the OGG demuxer (CVE-2019-14437, CVE-2019-14438)
	 * Fix a read buffer overflow in the ASF demuxer (CVE-2019-14776)
	 * Fix a use after free in the MKV demuxer (CVE-2019-14777, CVE-2019-14778)
	 * Fix a use after free in the ASF demuxer (CVE-2019-14533)
	 * Fix a couple of integer underflows in the MP4 demuxer (CVE-2019-13602)
	 * Fix a null dereference in the dvdnav demuxer
	 * Fix a null dereference in the ASF demuxer (CVE-2019-14534)
	 * Fix a null dereference in the AVI demuxer
	 * Fix a division by zero in the CAF demuxer (CVE-2019-14498)
	 * Fix a division by zero in the ASF demuxer (CVE-2019-14535)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.videolan.org/developers/vlc-branch/NEWS</url>
 <cvename>CVE-2019-13602</cvename>
 <cvename>CVE-2019-13962</cvename>
 <cvename>CVE-2019-14437</cvename>
 <cvename>CVE-2019-14438</cvename>
 <cvename>CVE-2019-14498</cvename>
 <cvename>CVE-2019-14533</cvename>
 <cvename>CVE-2019-14534</cvename>
 <cvename>CVE-2019-14535</cvename>
 <cvename>CVE-2019-14776</cvename>
 <cvename>CVE-2019-14777</cvename>
 <cvename>CVE-2019-14778</cvename>
 <cvename>CVE-2019-14970</cvename>
 </references>
 <dates>
 <discovery>2019-07-14</discovery>
 <entry>2019-08-20</entry>
 </dates>
 </vuln>

<vuln vid="56778a31-c2a1-11e9-9051-4c72b94353b5">
 <topic>nsd -- Stack-based Buffer Overflow</topic>
 <affects>
 <package>
	<name>nsd</name>
	<range><lt>4.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Frederic Cambus reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-13207">
	 nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer
	 Overflow in the dname_concatenate() function in dname.c.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-13207</url>
 <url>https://github.com/NLnetLabs/nsd/issues/20</url>
 <cvename>CVE-2019-13207</cvename>
 </references>
 <dates>
 <discovery>2019-07-28</discovery>
 <entry>2019-08-19</entry>
 </dates>
 </vuln>

<vuln vid="ece65d3b-c20c-11e9-8af4-bcaec55be5e5">
 <topic>webmin -- unauthenticated remote code execution</topic>
 <affects>
 <package>
	<name>webmin</name>
	<range><lt>1.930</lt></range>
 </package>
 <package>
	<name>usermin</name>
	<range><lt>1.780</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Joe Cooper reports:
	<blockquote cite="https://virtualmin.com/node/66890">
	 I've rolled out Webmin version 1.930 and Usermin version 1.780
	 for all repositories. This release includes several security
	 fixes, including one potentially serious one caused by malicious
	 code inserted into Webmin and Usermin at some point on our build
	 infrastructure. We're still investigating how and when, but the
	 exploitable code has never existed in our github repositories, so
	 we've rebuilt from git source on new infrastructure (and checked
	 to be sure the result does not contain the malicious code).

I don't have a changelog for these releases yet, but I wanted
	 to announce them immediately due to the severity of this issue.
	 To exploit the malicious code, your Webmin installation must have
	 Webmin -&gt; Webmin Configuration -&gt; Authentication -&gt; Password
	 expiry policy set to Prompt users with expired passwords to enter
	 a new one. This option is not set by default, but if it is set,
	 it allows remote code execution.

This release addresses CVE-2019-15107, which was disclosed
	 earlier today. It also addresses a handful of XSS issues that we
	 were notified about, and a bounty was awarded to the researcher
	 (a different one) who found them.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://virtualmin.com/node/66890</url>
 <cvename>CVE-2019-15107</cvename>
 </references>
 <dates>
 <discovery>2019-08-17</discovery>
 <entry>2019-08-17</entry>
 </dates>
 </vuln>

<vuln vid="3b2ee737-c12d-11e9-aabc-0800274e5f20">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.9.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports:
	<blockquote cite="https://blog.gitea.io/2019/08/gitea-1.9.1-is-released/">
	 This release contains two security fixes, so we highly recommend updating.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.io/2019/08/gitea-1.9.1-is-released/</url>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.9.1</url>
 </references>
 <dates>
 <discovery>2019-07-31</discovery>
 <entry>2019-07-31</entry>
 </dates>
 </vuln>

<vuln vid="d905b219-c1ca-11e9-8c46-0c9d925bbbc0">
 <topic>xdm -- remote denial of service</topic>
 <affects>
 <package>
	<name>xdm</name>
	<range><lt>1.1.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	nvd.nist.gov reports
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2013-2179">
	 X.Org xdm 1.1.10, 1.1.11, and possibly other versions,
	 when performing authentication using certain implementations of
	 the crypt API function that can return NULL, allows remote
	 attackers to cause a denial of service (NULL pointer dereference
	 and crash) by attempting to log into an account whose password
	 field contains invalid characters, as demonstrated using the crypt
	 function from glibc 2.17 and later with (1) the "!" character in
	 the salt portion of a password field or (2) a password that has
	 been encrypted using DES or MD5 in FIPS-140 mode.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2013-2179</url>
 <cvename>CVE-2013-2179</cvename>
 </references>
 <dates>
 <discovery>2013-06-07</discovery>
 <entry>2019-08-18</entry>
 </dates>
 </vuln>

<vuln vid="d51b52cf-c199-11e9-b13f-001b217b3468">
 <topic>Libgit2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libgit2</name>
	<range><lt>0.28.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Git community reports:
	<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.28.3">
	 A carefully constructed commit object with a very large number
of parents may lead to potential out-of-bounds writes or
potential denial of service.
	 The ProgramData configuration file is always read for compatibility
with Git for Windows and Portable Git installations. The ProgramData
location is not necessarily writable only by administrators, so we
now ensure that the configuration file is owned by the administrator
or the current user.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/libgit2/libgit2/releases/tag/v0.28.3</url>
 </references>
 <dates>
 <discovery>2019-08-13</discovery>
 <entry>2019-08-18</entry>
 </dates>
 </vuln>

<vuln vid="caf545f2-c0d9-11e9-9051-4c72b94353b5">
 <topic>Apache -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.41</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Team reports:
	<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.4">
	 <h1>SECURITY: CVE-2019-10081</h1>
	 mod_http2: HTTP/2 very early pushes, for example configured with "H2PushResource",
	 could lead to an overwrite of memory in the pushing request's pool,
	 leading to crashes. The memory copied is that of the configured push
	 link header values, not data supplied by the client.
	 <h1>SECURITY: CVE-2019-9517</h1>
	 mod_http2: a malicious client could perform a DoS attack by flooding
	 a connection with requests and basically never reading responses
	 on the TCP connection. Depending on h2 worker dimensioning, it was
	 possible to block those with relatively few connections.
	 <h1>SECURITY: CVE-2019-10098</h1>
	 rewrite, core: Set PCRE_DOTALL flag by default to avoid unpredictable
	 matches and substitutions with encoded line break characters.
	 <h1>SECURITY: CVE-2019-10092</h1>
	 Remove HTML-escaped URLs from canned error responses to prevent misleading
	 text/links being displayed via crafted links.
	 <h1>SECURITY: CVE-2019-10097</h1>
	 mod_remoteip: Fix stack buffer overflow and NULL pointer deference
	 when reading the PROXY protocol header.
	 <h1>CVE-2019-10082</h1>
	 mod_http2: Using fuzzed network input, the http/2 session
	 handling could be made to read memory after being freed,
	 during connection shutdown.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.apache.org/dist/httpd/CHANGES_2.4</url>
 <cvename>CVE-2019-10081</cvename>
 <cvename>CVE-2019-9517</cvename>
 <cvename>CVE-2019-10098</cvename>
 <cvename>CVE-2019-10092</cvename>
 <cvename>CVE-2019-10082</cvename>
 </references>
 <dates>
 <discovery>2019-08-14</discovery>
 <entry>2019-08-17</entry>
 </dates>
 </vuln>

<vuln vid="121fec01-c042-11e9-a73f-b36f5969f162">
 <topic>nghttp2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libnghttp2</name>
	<name>nghttp2</name>
	<range><lt>1.39.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	nghttp2 GitHub releases:
	<blockquote cite="https://github.com/nghttp2/nghttp2/releases">
	 This release fixes CVE-2019-9511 "Data Dribble" and CVE-2019-9513
	 "Resource Loop" vulnerability in nghttpx and nghttpd. Specially crafted
	 HTTP/2 frames cause Denial of Service by consuming CPU time. Check out
	 https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
	 for details. For nghttpx, additionally limiting inbound traffic by
	 --read-rate and --read-burst options is quite effective against this
	 kind of attack.
	 CVE-2019-9511 "Data Dribble": The attacker requests a large amount of
	 data from a specified resource over multiple streams. They manipulate
	 window size and stream priority to force the server to queue the data in
	 1-byte chunks. Depending on how efficiently this data is queued, this
	 can consume excess CPU, memory, or both, potentially leading to a
	 denial of service.
	 CVE-2019-9513 "Ping Flood": The attacker sends continual pings to an
	 HTTP/2 peer, causing the peer to build an internal queue of responses.
	 Depending on how efficiently this data is queued, this can consume
	 excess CPU, memory, or both, potentially leading to a denial of service.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/nghttp2/nghttp2/releases</url>
 <url>https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md</url>
 <cvename>CVE-2019-9511</cvename>
 <cvename>CVE-2019-9513</cvename>
 </references>
 <dates>
 <discovery>2019-08-13</discovery>
 <entry>2019-08-16</entry>
 </dates>
 </vuln>

<vuln vid="60e991ac-c013-11e9-b662-001cc0382b2f">
 <topic>CUPS -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cups</name>
	<range><lt>2.2.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apple reports:
	<blockquote cite="https://github.com/apple/cups/releases/tag/v2.2.12">
	 <ul>
	 <li>CVE-2019-8696 and CVE-2019-8675: SNMP buffer overflows.</li>
	 <li>IPP buffer overflow.</li>
	 <li>Memory disclosure in the scheduler.</li>
	 <li>DoS issues in the scheduler.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/apple/cups/releases/tag/v2.2.12</url>
 <cvename>CVE-2019-8675</cvename>
 <cvename>CVE-2019-8696</cvename>
 </references>
 <dates>
 <discovery>2019-08-15</discovery>
 <entry>2019-08-16</entry>
 </dates>
 </vuln>

<vuln vid="41f4baac-bf77-11e9-8d2f-5404a68ad561">
 <topic>traefik -- Denial of service in HTTP/2</topic>
 <affects>
 <package>
	<name>traefik</name>
	<range><lt>1.7.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The traefik project reports:
	<blockquote cite="https://github.com/containous/traefik/releases/tag/v1.7.14">
	 Update of dependency to go go1.12.8 resolves potential HTTP/2
	 denial of service in traefik.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/containous/traefik/releases/tag/v1.7.14</url>
 <cvename>CVE-2019-9512</cvename>
 <cvename>CVE-2019-9514</cvename>
 </references>
 <dates>
 <discovery>2019-08-13</discovery>
 <entry>2019-08-15</entry>
 </dates>
 </vuln>

<vuln vid="87679fcb-be60-11e9-9051-4c72b94353b5">
 <topic>NGINX -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><lt>1.16.1,2</lt></range>
 </package>
 <package>
	<name>nginx-devel</name>
	<range><lt>1.17.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NGINX Team reports:
	<blockquote cite="http://nginx.org/en/security_advisories.html">
	 Several security issues were identified in nginx HTTP/2
	 implementation which might cause excessive memory consumption
	 and CPU usage (CVE-2019-9511, CVE-2019-9513, CVE-2019-9516).
	 The issues affect nginx compiled with the ngx_http_v2_module (not
	 compiled by default) if the http2 option of the listen directive
	 is used in a configuration file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://nginx.org/en/security_advisories.html</url>
 <cvename>CVE-2019-9511</cvename>
 <cvename>CVE-2019-9513</cvename>
 <cvename>CVE-2019-9516</cvename>
 </references>
 <dates>
 <discovery>2019-08-13</discovery>
 <entry>2019-08-14</entry>
 <modified>2019-08-14</modified>
 </dates>
 </vuln>

<vuln vid="0569146e-bdef-11e9-bd31-8de4a4470bbb">
 <topic>Nokogiri -- injection vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-nokogiri</name>
	<range><lt>1.10.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nokogiri GitHub release:
	<blockquote cite="https://github.com/sparklemotion/nokogiri/releases">
	 A command injection vulnerability in Nokogiri v1.10.3 and earlier
	 allows commands to be executed in a subprocess by Ruby's Kernel.open
	 method. Processes are vulnerable only if the undocumented method
	 Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.
	 This vulnerability appears in code generated by the Rexical gem
	 versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate
	 lexical scanner code for parsing CSS queries. The underlying
	 vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to
	 this version of Rexical in Nokogiri v1.10.4.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/sparklemotion/nokogiri/releases</url>
 <url>https://github.com/sparklemotion/nokogiri/issues/1915</url>
 <cvename>CVE-2019-5477</cvename>
 </references>
 <dates>
 <discovery>2019-08-11</discovery>
 <entry>2019-08-13</entry>
 </dates>
 </vuln>

<vuln vid="ddd48087-bd86-11e9-b13f-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.1.0</ge><lt>12.1.6</lt></range>
	<range><ge>12.0.0</ge><lt>12.0.6</lt></range>
	<range><ge>10.0.0</ge><lt>11.11.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/">
	 Insecure Authentication Methods Disabled for Grafana By Default
	 Multiple Command-Line Flag Injection Vulnerabilities
	 Insecure Cookie Handling on GitLab Pages
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/</url>
 <cvename>CVE-2019-14943</cvename>
 <cvename>CVE-2019-14944</cvename>
 <cvename>CVE-2019-14942</cvename>
 </references>
 <dates>
 <discovery>2019-08-12</discovery>
 <entry>2019-08-13</entry>
 </dates>
 </vuln>

<vuln vid="f5f0a640-bae8-11e9-bb3a-001e2a3f778d">
 <topic>KDE Frameworks -- malicious .desktop files execute code</topic>
 <affects>
 <package>
	<name>kf5-kconfig</name>
	<range><lt>5.60.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The KDE Community has released a security announcement:
	<blockquote cite="https://kde.org/info/security/advisory-20190807-1.txt">
	 The syntax Key[$e]=$(shell command) in *.desktop files, .directory files, and configuration files
(typically found in ~/.config) was an intentional feature of KConfig, to allow flexible configuration.
This could however be abused by malicious people to make the users install such files and get code
executed even without intentional action by the user.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-14744</cvename>
 <url>https://kde.org/info/security/advisory-20190807-1.txt</url>
 </references>
 <dates>
 <discovery>2019-08-07</discovery>
 <entry>2019-08-09</entry>
 </dates>
 </vuln>

<vuln vid="7f7d6412-bae5-11e9-be92-3085a9a95629">
 <topic>doas -- Prevent passing of environment variables</topic>
 <affects>
 <package>
	<name>doas</name>
	<range><lt>6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jesse Smith (upstream author of the doas program) reported:
	<blockquote cite="https://github.com/slicer69/doas/releases/tag/6.1">
	 Previous versions of "doas" transferred most environment variables, such
	 as USER, HOME, and PATH from the original user to the target user.

Passing these variables could cause files in the wrong path or
	 home directory to be read (or written to), which resulted in potential
	 security problems.
	 Many thanks to Sander Bos for reporting this issue and explaining
	 how it can be exploited.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist msgid="2a5cda45ef35e885c9a8b1e@tedunangst.com">https://marc.info/?l=openbsd-tech&amp;m=156105665713340&amp;w=2</mlist>
 <url>https://github.com/slicer69/doas/releases/tag/6.1</url>
 </references>
 <dates>
 <discovery>2019-08-03</discovery>
 <entry>2019-08-09</entry>
 <modified>2019-08-15</modified>
 </dates>
 </vuln>

<vuln vid="f56669f5-d799-4ff5-9174-64a6d571c451">
 <topic>bro -- Null pointer dereference and Signed integer overflow</topic>
 <affects>
 <package>
	<name>bro</name>
	<range><lt>2.6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jon Siwek of Corelight reports:
	<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/1d874e5548a58b3b8fd2a342fe4aa0944e779809/NEWS">
	 This is a security patch release to address potential
	 Denial of Service vulnerabilities:
	 <ul>
	 <li>
	 Null pointer dereference in the RPC analysis code. RPC
	 analyzers (e.g. MOUNT or NFS) are not enabled in the
	 default configuration.</li>

<li>
	 Signed integer overflow in BinPAC-generated parser code.
	 The result of this is Undefined Behavior with respect to
	 the array bounds checking conditions that BinPAC generates,
	 so it's unpredictable what an optimizing compiler may
	 actually do under the assumption that signed integer
	 overlows should never happen. The specific symptom which
	 lead to finding this issue was with the PE analyzer causing
	 out-of-memory crashes due to large allocations that were
	 otherwise prevented when the array bounds checking logic
	 was changed to prevent any possible signed integer overlow.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://raw.githubusercontent.com/zeek/zeek/1d874e5548a58b3b8fd2a342fe4aa0944e779809/NEWS</url>
 </references>
 <dates>
 <discovery>2019-06-22</discovery>
 <entry>2019-08-09</entry>
 </dates>
 </vuln>

<vuln vid="9de4c1c1-b9ee-11e9-82aa-6cc21735f730">
 <topic>PostgresSQL -- TYPE in pg_temp execute arbitrary SQL during `SECURITY DEFINER` execution</topic>
 <affects>
 <package>
	<name>postgresql11-server</name>
	<range><lt>11.5</lt></range>
 </package>
 <package>
	<name>postgresql10-server</name>
	<range><lt>10.10</lt></range>
 </package>
 <package>
	<name>postgresql96-server</name>
	<range><lt>9.6.15</lt></range>
 </package>
 <package>
	<name>postgresql95-server</name>
	<range><lt>9.5.19</lt></range>
 </package>
 <package>
	<name>postgresql94-server</name>
	<range><lt>9.4.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/about/news/1960/">
	 
	 Versions Affected: 9.4 - 11
	 
	 
	 Given a suitable `SECURITY DEFINER` function, an attacker can execute arbitrary
	 SQL under the identity of the function owner. An attack requires `EXECUTE`
	 permission on the function, which must itself contain a function call having
	 inexact argument type match. For example, `length('foo'::varchar)` and
	 `length('foo')` are inexact, while `length('foo'::text)` is exact.
	 As part of exploiting this vulnerability, the attacker uses `CREATE DOMAIN`
	 to create a type in a `pg_temp` schema. The attack pattern and fix are similar
	 to that for CVE-2007-2138.
	 
	 
	 Writing `SECURITY DEFINER` functions continues to require following
	 the considerations noted in the documentation:
	 
	 
	 https://www.postgresql.org/docs/devel/sql-createfunction.html#SQL-CREATEFUNCTION-SECURITY
	 
	</blockquote>
	<blockquote cite="https://www.postgresql.org/about/news/1960/">
	 
	 Versions Affected: 11
	 
	 
	 In a database containing hypothetical, user-defined hash equality operators,
	 an attacker could read arbitrary bytes of server memory. For an attack to
	 become possible, a superuser would need to create unusual operators.
	 It is possible for operators not purpose-crafted for attack to have
	 the properties that enable an attack, but we are not aware of specific examples.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.postgresql.org/about/news/1960/</url>
 <cvename>CVE-2019-10208</cvename>
 <cvename>CVE-2019-10209</cvename>
 </references>
 <dates>
 <discovery>2019-08-08</discovery>
 <entry>2019-08-08</entry>
 </dates>
 </vuln>

<vuln vid="6e65dfea-b614-11e9-a3a2-1506e15611cc">
 <topic>Django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-django111</name>
	<name>py35-django111</name>
	<name>py36-django111</name>
	<name>py37-django111</name>
	<range><lt>1.11.23</lt></range>
 </package>
 <package>
	<name>py27-django21</name>
	<name>py35-django21</name>
	<name>py36-django21</name>
	<name>py37-django21</name>
	<range><lt>2.1.11</lt></range>
 </package>
 <package>
	<name>py27-django22</name>
	<name>py35-django22</name>
	<name>py36-django22</name>
	<name>py37-django22</name>
	<range><lt>2.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django release notes:
	<blockquote cite="https://docs.djangoproject.com/en/1.11/releases/1.11.23/">
	 CVE-2019-14232: Denial-of-service possibility in
	 django.utils.text.Truncator
	 If django.utils.text.Truncator's chars() and words() methods were
	 passed the html=True argument, they were extremely slow to evaluate
	 certain inputs due to a catastrophic backtracking vulnerability in a
	 regular expression. The chars() and words() methods are used to
	 implement the truncatechars_html and truncatewords_html template
	 filters, which were thus vulnerable
	 The regular expressions used by Truncator have been simplified in
	 order to avoid potential backtracking issues. As a consequence, trailing
	 punctuation may now at times be included in the truncated output.
	 CVE-2019-14233: Denial-of-service possibility in strip_tags()
	 Due to the behavior of the underlying HTMLParser,
	 django.utils.html.strip_tags() would be extremely slow to evaluate
	 certain inputs containing large sequences of nested incomplete HTML
	 entities. The strip_tags() method is used to implement the corresponding
	 striptags template filter, which was thus also vulnerable.
	 strip_tags() now avoids recursive calls to HTMLParser when progress
	 removing tags, but necessarily incomplete HTML entities, stops being
	 made.
	 Remember that absolutely NO guarantee is provided about the results of
	 strip_tags() being HTML safe. So NEVER mark safe the result of a
	 strip_tags() call without escaping it first, for example with
	 django.utils.html.escape().
	 CVE-2019-14234: SQL injection possibility in key and index lookups for
	 JSONField/HStoreField
	 Key and index lookups for JSONField and key lookups for HStoreField
	 were subject to SQL injection, using a suitably crafted dictionary,
	 with dictionary expansion, as the **kwargs passed to QuerySet.filter().
	 CVE-2019-14235: Potential memory exhaustion in
	 django.utils.encoding.uri_to_iri()
	 If passed certain inputs, django.utils.encoding.uri_to_iri() could lead
	 to significant memory usage due to excessive recursion when
	 re-percent-encoding invalid UTF-8 octet sequences.
	 uri_to_iri() now avoids recursion when re-percent-encoding invalid
	 UTF-8 octet sequences.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.djangoproject.com/en/1.11/releases/1.11.23/</url>
 <url>https://docs.djangoproject.com/en/2.1/releases/2.1.11/</url>
 <url>https://docs.djangoproject.com/en/2.2/releases/2.2.4/</url>
 <cvename>CVE-2019-14232</cvename>
 <cvename>CVE-2019-14233</cvename>
 <cvename>CVE-2019-14234</cvename>
 <cvename>CVE-2019-14235</cvename>
 </references>
 <dates>
 <discovery>2019-08-01</discovery>
 <entry>2019-08-03</entry>
 </dates>
 </vuln>

<vuln vid="e7b69694-b3b5-11e9-9bb6-0800274e5f20">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.9.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea Team reports:
	<blockquote cite="https://blog.gitea.io/2019/07/gitea-1.9.0-is-released/">
	 This version of Gitea contains security fixes that could not be
	 backported to 1.8. For this reason, we strongly recommend updating.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.io/2019/07/gitea-1.9.0-is-released/</url>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.9.0</url>
 </references>
 <dates>
 <discovery>2019-07-31</discovery>
 <entry>2019-07-31</entry>
 </dates>
 </vuln>

<vuln vid="0d3f99f7-b30c-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- File description reference count leak</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_8</lt></range>
	<range><ge>11.2</ge><lt>11.2_12</lt></range>
	<range><ge>11.3</ge><lt>11.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	If a process attempts to transmit rights over a UNIX-domain
	socket and an error causes the attempt to fail, references
	acquired on the rights are not released and are leaked.
	This bug can be used to cause the reference counter to wrap
	around and free the corresponding file structure.
	<h1>Impact:</h1>
	A local user can exploit the bug to gain root privileges
	or escape from a jail.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5607</cvename>
 <freebsdsa>SA-19:17.fd</freebsdsa>
 </references>
 <dates>
 <discovery>2019-07-24</discovery>
 <entry>2019-07-30</entry>
 </dates>
 </vuln>

<vuln vid="edf064fb-b30b-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- Bhyve out-of-bounds read in XHCI device</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_8</lt></range>
	<range><ge>11.2</ge><lt>11.2_12</lt></range>
	<range><ge>11.3</ge><lt>11.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The pci_xhci_device_doorbell() function does not validate
	the 'epid' and 'streamid' provided by the guest, leading
	to an out-of-bounds read.
	<h1>Impact:</h1>
	A misbehaving bhyve guest could crash the system or
	access memory that it should not be able to.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5604</cvename>
 <freebsdsa>SA-19:16.bhyve</freebsdsa>
 </references>
 <dates>
 <discovery>2019-07-24</discovery>
 <entry>2019-07-30</entry>
 </dates>
 </vuln>

<vuln vid="deb6e164-b30b-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- Reference count overflow in mqueue filesystem</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_8</lt></range>
	<range><ge>11.2</ge><lt>11.2_12</lt></range>
	<range><ge>11.3</ge><lt>11.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	System calls operating on file descriptors obtain a
	reference to relevant struct file which due to a programming
	error was not always put back, which in turn could be used
	to overflow the counter of affected struct file.
	<h1>Impact:</h1>
	A local user can use this flaw to obtain access to files,
	directories, sockets etc. opened by processes owned by other
	users. If obtained struct file represents a directory from
	outside of user's jail, it can be used to access files
	outside of the jail. If the user in question is a jailed
	root they can obtain root privileges on the host system.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5603</cvename>
 <freebsdsa>SA-19:15.mqueuefs</freebsdsa>
 </references>
 <dates>
 <discovery>2019-07-24</discovery>
 <entry>2019-07-30</entry>
 </dates>
 </vuln>

<vuln vid="6b856e00-b30a-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- Kernel memory disclosure in freebsd32_ioctl</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.2</ge><lt>11.2_12</lt></range>
	<range><ge>11.3</ge><lt>11.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to insufficient initialization of memory copied to
	userland in the components listed above small amounts of
	kernel memory may be disclosed to userland processes.
	<h1>Impact:</h1>
	A user who can invoke 32-bit FreeBSD ioctls may be able
	to read the contents of small portions of kernel memory.
	Such memory might contain sensitive information, such
	as portions of the file cache or terminal buffers. This
	information might be directly useful, or it might be leveraged
	to obtain elevated privileges in some way; for example, a
	terminal buffer might include a user-entered password.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5605</cvename>
 <freebsdsa>SA-19:14.freebsd32</freebsdsa>
 </references>
 <dates>
 <discovery>2019-07-24</discovery>
 <entry>2019-07-30</entry>
 </dates>
 </vuln>

<vuln vid="5721ae65-b30a-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- pts(4) write-after-free</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_8</lt></range>
	<range><ge>11.2</ge><lt>11.2_12</lt></range>
	<range><ge>11.3</ge><lt>11.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The code which handles a close(2) of a descriptor created
	by posix_openpt(2) fails to undo the configuration which
	causes SIGIO to be raised. This bug can lead to a
	write-after-free of kernel memory.
	<h1>Impact:</h1>
	The bug permits malicious code to trigger a write-after-free,
	which may be used to gain root privileges or escape a
	jail.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5606</cvename>
 <freebsdsa>SA-19:13.pts</freebsdsa>
 </references>
 <dates>
 <discovery>2019-07-24</discovery>
 <entry>2019-07-30</entry>
 </dates>
 </vuln>

<vuln vid="39f6cbff-b30a-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- telnet(1) client multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.0</ge><lt>12.0_8</lt></range>
	<range><ge>11.2</ge><lt>11.2_12</lt></range>
	<range><ge>11.3</ge><lt>11.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Insufficient validation of environment variables in the
	telnet client supplied in FreeBSD can lead to stack-based
	buffer overflows. A stack- based overflow is present in the
	handling of environment variables when connecting via the
	telnet client to remote telnet servers.
	This issue only affects the telnet client. Inbound telnet
	sessions to telnetd(8) are not affected by this issue.
	<h1>Impact:</h1>
	These buffer overflows may be triggered when connecting
	to a malicious server, or by an active attacker in the
	network path between the client and server. Specially crafted
	TELNET command sequences may cause the execution of arbitrary
	code with the privileges of the user invoking telnet(1).
 </body>
 </description>
 <references>
 <cvename>CVE-2019-0053</cvename>
 <freebsdsa>SA-19:12.telnet</freebsdsa>
 </references>
 <dates>
 <discovery>2019-07-24</discovery>
 <entry>2019-07-30</entry>
 </dates>
 </vuln>

<vuln vid="14a3b376-b30a-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- Privilege escalation in cd(4) driver</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_7</lt></range>
	<range><ge>11.2</ge><lt>11.2_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	To implement one particular ioctl, the Linux emulation
	code used a special interface present in the cd(4) driver
	which allows it to copy subchannel information directly to
	a kernel address. This interface was erroneously made
	accessible to userland, allowing users with read access to
	a cd(4) device to arbitrarily overwrite kernel memory when
	some media is present in the device.
	<h1>Impact:</h1>
	A user in the operator group can make use of this interface
	to gain root privileges on a system with a cd(4) device
	when some media is present in the device.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5602</cvename>
 <freebsdsa>SA-19:11.cd_ioctl</freebsdsa>
 </references>
 <dates>
 <discovery>2019-07-02</discovery>
 <entry>2019-07-30</entry>
 </dates>
 </vuln>

<vuln vid="ff82610f-b309-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- Kernel stack disclosure in UFS/FFS</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_7</lt></range>
	<range><ge>11.2</ge><lt>11.2_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A bug causes up to three bytes of kernel stack memory
	to be written to disk as uninitialized directory entry
	padding. This data can be viewed by any user with read
	access to the directory. Additionally, a malicious user
	with write access to a directory can cause up to 254 bytes
	of kernel stack memory to be exposed.
	<h1>Impact:</h1>
	Some amount of the kernel stack is disclosed and written
	out to the filesystem.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5601</cvename>
 <freebsdsa>SA-19:10.ufs</freebsdsa>
 </references>
 <dates>
 <discovery>2019-07-02</discovery>
 <entry>2019-07-30</entry>
 </dates>
 </vuln>

<vuln vid="f62bba56-b309-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- iconv buffer overflow</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.0</ge><lt>12.0_7</lt></range>
	<range><ge>11.2</ge><lt>11.2_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	With certain inputs, iconv may write beyond the end of
	the output buffer.
	<h1>Impact:</h1>
	Depending on the way in which iconv is used, an attacker
	may be able to create a denial of service, provoke incorrect
	program behavior, or induce a remote code execution. iconv
	is a libc library function and the nature of possible attacks
	will depend on the way in which iconv is used by applications
	or daemons.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5600</cvename>
 <freebsdsa>SA-19:09.iconv</freebsdsa>
 </references>
 <dates>
 <discovery>2019-07-02</discovery>
 <entry>2019-07-30</entry>
 </dates>
 </vuln>

<vuln vid="c294c2e6-b309-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- Resource exhaustion in non-default RACK TCP stack</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	While processing acknowledgements, the RACK code uses
	several linked lists to maintain state entries. A malicious
	attacker can cause the lists to grow unbounded. This can
	cause an expensive list traversal on every packet being
	processed, leading to resource exhaustion and a denial of
	service.
	<h1>Impact:</h1>
	An attacker with the ability to send specially crafted
	TCP traffic to a victim system can degrade network performance
	and/or consume excessive CPU by exploiting the inefficiency
	of traversing the potentially very large RACK linked lists
	with relatively small bandwidth cost.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5599</cvename>
 <freebsdsa>SA-19:08.rack</freebsdsa>
 </references>
 <dates>
 <discovery>2019-06-19</discovery>
 <entry>2019-07-30</entry>
 </dates>
 </vuln>

<vuln vid="a633651b-b309-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- Microarchitectural Data Sampling (MDS)</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_5</lt></range>
	<range><ge>11.2</ge><lt>11.2_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	On some Intel processors utilizing speculative execution
	a local process may be able to infer stale information from
	microarchitectural buffers to obtain a memory disclosure.
	<h1>Impact:</h1>
	An attacker may be able to read secret data from the
	kernel or from a process when executing untrusted code (for
	example, in a web browser).
 </body>
 </description>
 <references>
 <cvename>CVE-2018-1212</cvename>
 <cvename>CVE-2018-1213</cvename>
 <cvename>CVE-2019-1109</cvename>
 <freebsdsa>SA-19:07.mds</freebsdsa>
 </references>
 <dates>
 <discovery>2019-05-14</discovery>
 <entry>2019-07-30</entry>
 </dates>
 </vuln>

<vuln vid="59c5f255-b309-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- ICMP/ICMP6 packet filter bypass in pf</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_4</lt></range>
	<range><ge>11.2</ge><lt>11.2_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	States in pf(4) let ICMP and ICMP6 packets pass if they
	have a packet in their payload matching an existing condition.
	pf(4) does not check if the outer ICMP or ICMP6 packet has
	the same destination IP as the source IP of the inner
	protocol packet.
	<h1>Impact:</h1>
	A maliciously crafted ICMP/ICMP6 packet could bypass the
	packet filter rules and be passed to a host that would
	otherwise be unavailable.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5598</cvename>
 <freebsdsa>SA-19:06.pf</freebsdsa>
 </references>
 <dates>
 <discovery>2019-05-14</discovery>
 <entry>2019-07-30</entry>
 </dates>
 </vuln>

<vuln vid="3d02520d-b309-11e9-a87f-a4badb2f4699">
 <topic>FreeBSD -- IPv6 fragment reassembly panic in pf(4)</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_4</lt></range>
	<range><ge>11.2</ge><lt>11.2_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A bug in the pf(4) IPv6 fragment reassembly logic
	incorrectly uses the last extension header offset from the
	last received packet instead of from the first packet.
	<h1>Impact:</h1>
	Malicious IPv6 packets with different IPv6 extensions
	could cause a kernel panic or potentially a filtering rule
	bypass.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5597</cvename>
 <freebsdsa>SA-19:05.pf</freebsdsa>
 </references>
 <dates>
 <discovery>2019-05-14</discovery>
 <entry>2019-07-30</entry>
 </dates>
 </vuln>

<vuln vid="1cd89254-b2db-11e9-8001-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.1.0</ge><lt>12.1.2</lt></range>
	<range><ge>12.0.0</ge><lt>12.0.4</lt></range>
	<range><ge>8.9.0</ge><lt>11.11.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/">
	 GitHub Integration SSRF
	 Trigger Token Impersonation
	 Build Status Disclosure
	 SSRF Mitigation Bypass
	 Information Disclosure New Issue ID
	 IDOR Label Name Enumeration
	 Persistent XSS Wiki Pages
	 User Revokation Bypass with Mattermost Integration
	 Arbitrary File Upload via Import Project Archive
	 Information Disclosure Vulnerability Feedback
	 Persistent XSS via Email
	 Denial Of Service Epic Comments
	 Email Verification Bypass
	 Override Merge Request Approval Rules
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/</url>
 </references>
 <dates>
 <discovery>2019-07-29</discovery>
 <entry>2019-07-30</entry>
 </dates>
 </vuln>

<vuln vid="38d2df4d-b143-11e9-87e7-901b0e934d69">
 <topic>py-matrix-synapse -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-matrix-synapse</name>
	<name>py35-matrix-synapse</name>
	<name>py36-matrix-synapse</name>
	<name>py37-matrix-synapse</name>
	<range><lt>1.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	<blockquote cite="https://matrix.org/blog/2019/07/26/critical-security-update-synapse-1-2-1-released">
	 The matrix team releases Synapse 1.2.1 as a critical security update. It contains patches relating to redactions and event federation:
	 <ul>
	 <li>Prevent an attack where a federated server could send redactions for arbitrary events in v1 and v2 rooms.</li>
	 <li>Prevent a denial-of-service attack where cycles of redaction events would make Synapse spin infinitely.</li>
	 <li>Prevent an attack where users could be joined or parted from public rooms without their consent.</li>
	 <li>Fix a vulnerability where a federated server could spoof read-receipts from users on other servers. </li>
	 <li>It was possible for a room moderator to send a redaction for an m.room.create event, which would downgrade the room to version 1.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://matrix.org/blog/2019/07/26/critical-security-update-synapse-1-2-1-released</url>
 <url>https://github.com/matrix-org/synapse/releases/tag/v1.2.1</url>
 </references>
 <dates>
 <discovery>2019-07-26</discovery>
 <entry>2019-07-28</entry>
 </dates>
 </vuln>

<vuln vid="3e0da406-aece-11e9-8d41-97657151f8c2">
 <topic>Exim -- RCE in ${sort} expansion</topic>
 <affects>
 <package>
	<name>exim</name>
	<range><ge>4.85</ge><lt>4.92.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Exim team report:
	<blockquote cite="https://www.exim.org/static/doc/security/CVE-2019-13917.txt">
	 
	 A local or remote attacker can execute programs with root privileges - if you've an unusual configuration.
	 
	 
	 If your configuration uses the ${sort } expansion for items that can be controlled by an attacker (e.g. $local_part, $domain). The default config, as shipped by the Exim developers, does not contain ${sort }.
	 
	 
	 The vulnerability is exploitable either remotely or locally and could
be used to execute other programs with root privilege. The ${sort }
expansion re-evaluates its items.
	 
	 
	 Exim 4.92.1 is not vulnerable.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-13917</cvename>
 <url>https://www.exim.org/static/doc/security/CVE-2019-13917.txt</url>
 </references>
 <dates>
 <discovery>2019-07-18</discovery>
 <entry>2019-07-25</entry>
 <modified>2019-07-26</modified>
 </dates>
 </vuln>

<vuln vid="198e6220-ac8b-11e9-a1c7-b499baebfeaf">
 <topic>MySQL -- Multiple vulerabilities</topic>
 <affects>
 <package>
	<name>mariadb55-server</name>
	<range><lt>5.5.65</lt></range>
 </package>
 <package>
	<name>mariadb101-server</name>
	<range><lt>10.1.41</lt></range>
 </package>
 <package>
	<name>mariadb102-server</name>
	<range><lt>10.2.26</lt></range>
 </package>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.17</lt></range>
 </package>
 <package>
	<name>mariadb104-server</name>
	<range><lt>10.4.7</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.45</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.27</lt></range>
 </package>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.17</lt></range>
 </package>
 <package>
	<name>percona55-server</name>
	<range><lt>5.5.65</lt></range>
 </package>
 <package>
	<name>percona56-server</name>
	<range><lt>5.6.45</lt></range>
 </package>
 <package>
	<name>percona57-server</name>
	<range><lt>5.7.27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html">
	 This Critical Patch Update contains 45 new security fixes for
	 Oracle MySQL. 4 of these vulnerabilities may be remotely exploitable
	 without authentication, i.e., may be exploited over a network without
	 requiring user credentials.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html</url>
 <cvename>CVE-2019-2730</cvename>
 <cvename>CVE-2019-2731</cvename>
 <cvename>CVE-2019-2737</cvename>
 <cvename>CVE-2019-2738</cvename>
 <cvename>CVE-2019-2739</cvename>
 <cvename>CVE-2019-2740</cvename>
 <cvename>CVE-2019-2741</cvename>
 <cvename>CVE-2019-2743</cvename>
 <cvename>CVE-2019-2746</cvename>
 <cvename>CVE-2019-2747</cvename>
 <cvename>CVE-2019-2752</cvename>
 <cvename>CVE-2019-2755</cvename>
 <cvename>CVE-2019-2757</cvename>
 <cvename>CVE-2019-2758</cvename>
 <cvename>CVE-2019-2774</cvename>
 <cvename>CVE-2019-2778</cvename>
 <cvename>CVE-2019-2780</cvename>
 <cvename>CVE-2019-2784</cvename>
 <cvename>CVE-2019-2785</cvename>
 <cvename>CVE-2019-2789</cvename>
 <cvename>CVE-2019-2791</cvename>
 <cvename>CVE-2019-2795</cvename>
 <cvename>CVE-2019-2796</cvename>
 <cvename>CVE-2019-2797</cvename>
 <cvename>CVE-2019-2798</cvename>
 <cvename>CVE-2019-2800</cvename>
 <cvename>CVE-2019-2801</cvename>
 <cvename>CVE-2019-2802</cvename>
 <cvename>CVE-2019-2803</cvename>
 <cvename>CVE-2019-2805</cvename>
 <cvename>CVE-2019-2808</cvename>
 <cvename>CVE-2019-2810</cvename>
 <cvename>CVE-2019-2811</cvename>
 <cvename>CVE-2019-2812</cvename>
 <cvename>CVE-2019-2814</cvename>
 <cvename>CVE-2019-2815</cvename>
 <cvename>CVE-2019-2819</cvename>
 <cvename>CVE-2019-2822</cvename>
 <cvename>CVE-2019-2826</cvename>
 <cvename>CVE-2019-2830</cvename>
 <cvename>CVE-2019-2834</cvename>
 <cvename>CVE-2019-2879</cvename>
 <cvename>CVE-2019-3822</cvename>
 </references>
 <dates>
 <discovery>2019-07-16</discovery>
 <entry>2019-07-22</entry>
 </dates>
 </vuln>

<vuln vid="19d648e0-ab69-11e9-bfef-000ffec0b3e1">
 <topic>drupal -- Drupal core - Access bypass</topic>
 <affects>
 <package>
	<name>drupal8</name>
	<range><lt>8.7.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/SA-CORE-2019-008">
	 In Drupal 8.7.4, when the experimental Workspaces module is enabled,
	 an access bypass condition is created.
	 This can be mitigated by disabling the Workspaces module. It does
	 not affect any release other than Drupal 8.7.4.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/SA-CORE-2019-008</url>
 </references>
 <dates>
 <discovery>2019-07-17</discovery>
 <entry>2019-07-21</entry>
 </dates>
 </vuln>

<vuln vid="5914705c-ab03-11e9-a4f9-080027ac955c">
 <topic>PuTTY 0.72 -- buffer overflow in SSH-1 and integer overflow in SSH client</topic>
 <affects>
 <package>
	<name>putty</name> <range><lt>0.72</lt></range>
	</package><package>
	<name>putty-gtk2</name> <range><lt>0.72</lt></range>
	</package><package>
	<name>putty-nogtk</name> <range><lt>0.72</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Tatham reports:
	<blockquote cite="https://lists.tartarus.org/pipermail/putty-announce/2019/000028.html">
	 Vulnerabilities fixed in this release include:
	 <ul>
	 <li>A malicious SSH-1 server could trigger a buffer overrun by sending
	 extremely short RSA keys, or certain bad packet length fields.
	 Either of these could happen before host key verification, so even
	 if you trust the server you *intended* to connect to, you would
	 still be at risk.
	 
	 (However, the SSH-1 protocol is obsolete, and recent versions of
	 PuTTY do not try it by default, so you are only at risk if you work
	 with old servers and have explicitly configured SSH-1.)</li>
	 <li>If a malicious process found a way to impersonate Pageant, then it
	 could cause an integer overflow in any of the SSH client tools
	 (PuTTY, Plink, PSCP, PSFTP) which accessed the malicious Pageant.</li>
	 </ul>
	 Other security-related bug fixes include:
	 <ul>
	 <li>The 'trust sigil' system introduced in PuTTY 0.71 to protect
	 against server spoofing attacks had multiple bugs. Trust sigils
	 were not turned off after login in the SSH-1 and Rlogin protocols,
	 and not turned back on if you used the Restart Session command.
	 Both are now fixed.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.tartarus.org/pipermail/putty-announce/2019/000028.html</url>
 </references>
 <dates>
 <discovery>2019-07-14</discovery>
 <entry>2019-07-20</entry>
 </dates>
 </vuln>

<vuln vid="df3db21d-1a4d-4c78-acf7-4639e5a795e0">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.186</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.176.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://jenkins.io/security/advisory/2019-07-17/">
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-1424 / CVE-2019-10352</h5>
	 Arbitrary file write vulnerability using file parameter definitions
	 <h5>(High) SECURITY-626 / CVE-2019-10353</h5>
	 CSRF protection tokens did not expire
	 <h5>(Medium) SECURITY-534 / CVE-2019-10354</h5>
	 Unauthorized view fragment access
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-10352</cvename>
 <cvename>CVE-2019-10353</cvename>
 <cvename>CVE-2019-10354</cvename>
 <url>https://jenkins.io/security/advisory/2019-07-17/</url>
 </references>
 <dates>
 <discovery>2019-07-17</discovery>
 <entry>2019-07-17</entry>
 </dates>
 </vuln>

<vuln vid="93167bef-9752-11e9-b61c-b885849ded8e">
 <topic>libxslt -- security framework bypass</topic>
 <affects>
 <package>
	<name>libxslt</name>
	<range><lt>1.1.33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre report:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068">
	 libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068</url>
 </references>
 <dates>
 <discovery>2019-04-10</discovery>
 <entry>2019-07-16</entry>
 </dates>
 </vuln>

<vuln vid="818b2bcb-a46f-11e9-bed9-001999f8d30b">
 <topic>asterisk -- Remote crash vulnerability with MESSAGE messages</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.27.1</lt></range>
 </package>
 <package>
	<name>asterisk15</name>
	<range><lt>15.7.3</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><lt>16.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 A specially crafted SIP in-dialog MESSAGE message can cause Asterisk to crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2019-002.html</url>
 <cvename>CVE-2019-12827</cvename>
 </references>
 <dates>
 <discovery>2019-06-13</discovery>
 <entry>2019-07-12</entry>
 </dates>
 </vuln>

<vuln vid="e9d2e981-a46d-11e9-bed9-001999f8d30b">
 <topic>asterisk -- Remote Crash Vulnerability in chan_sip channel driver</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.27.1</lt></range>
 </package>
 <package>
	<name>asterisk15</name>
	<range><lt>15.7.3</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><lt>16.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 When T.38 faxing is done in Asterisk a T.38 reinvite
	 may be sent to an endpoint to switch it to T.38. If the
	 endpoint responds with an improperly formatted SDP answer
	 including both a T.38 UDPTL stream and an audio or video
	 stream containing only codecs not allowed on the SIP peer
	 or user a crash will occur. The code incorrectly assumes
	 that there will be at least one common codec when T.38
	 is also in the SDP answer.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2019-003.html</url>
 <cvename>CVE-2019-13161</cvename>
 </references>
 <dates>
 <discovery>2019-06-28</discovery>
 <entry>2019-07-12</entry>
 </dates>
 </vuln>

<vuln vid="a449c604-a43a-11e9-b422-fcaa147e860e">
 <topic>python 3.7 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python37</name>
	<range><lt>3.7.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python changelog:
	<blockquote cite="https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-4-final">
	 bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with additional text
	 after the address and only quad-dotted notation without trailing whitespaces. Some
	 inet_aton() implementations ignore whitespace and all data after whitespace, e.g.'127.0.0.1
	 whatever'.
	 bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file:// and
	 local_file:// URL schemes in URLopener().open() and URLopener().retrieve() of
	 urllib.request.
	 bpo-36742: Fixes mishandling of pre-normalization characters in urlsplit().
	 bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded whitespace
	 or control characters through into the underlying http client request. Such potentially
	 malicious header injection URLs now cause an http.client.InvalidURL exception to be
	 raised.
	 bpo-33529: Prevent fold function used in email header encoding from entering infinite
	 loop when there are too many non-ASCII characters in a header.
	 bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and if the PATH
	 environment variable is not set. Remove also the current directory from posixpath.defpath.
	 On Unix, shutil.which() and the subprocess module no longer search the executable in the
	 current directory if the PATH environment variable is not set.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-4-final</url>
 <cvename>CVE-2019-9740</cvename>
 <cvename>CVE-2019-9948</cvename>
 </references>
 <dates>
 <discovery>2019-03-13</discovery>
 <entry>2019-07-12</entry>
 </dates>
 </vuln>

<vuln vid="0592f49f-b3b8-4260-b648-d1718762656c">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>68.0_4,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.2.12</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.53.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>60.8.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>60.8.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>60.8.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/">
	 CVE-2019-9811: Sandbox escape via installation of malicious language pack
	 CVE-2019-11711: Script injection within domain through inner window reuse
	 CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects
	 CVE-2019-11713: Use-after-free with HTTP/2 cached stream
	 CVE-2019-11714: NeckoChild can trigger crash when accessed off of main thread
	 CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault
	 CVE-2019-11715: HTML parsing error can contribute to content XSS
	 CVE-2019-11716: globalThis not enumerable until accessed
	 CVE-2019-11717: Caret character improperly escaped in origins
	 CVE-2019-11718: Activity Stream writes unsanitized content to innerHTML
	 CVE-2019-11719: Out-of-bounds read when importing curve25519 private key
	 CVE-2019-11720: Character encoding XSS vulnerability
	 CVE-2019-11721: Domain spoofing through unicode latin 'kra' character
	 CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin
	 CVE-2019-11723: Cookie leakage during add-on fetching across private browsing boundaries
	 CVE-2019-11724: Retired site input.mozilla.org has remote troubleshooting permissions
	 CVE-2019-11725: Websocket resources bypass safebrowsing protections
	 CVE-2019-11727: PKCS#1 v1.5 signatures can be used for TLS 1.3
	 CVE-2019-11728: Port scanning through Alt-Svc header
	 CVE-2019-11710: Memory safety bugs fixed in Firefox 68
	 CVE-2019-11709: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-11709</cvename>
 <cvename>CVE-2019-11710</cvename>
 <cvename>CVE-2019-11711</cvename>
 <cvename>CVE-2019-11712</cvename>
 <cvename>CVE-2019-11713</cvename>
 <cvename>CVE-2019-11714</cvename>
 <cvename>CVE-2019-11715</cvename>
 <cvename>CVE-2019-11716</cvename>
 <cvename>CVE-2019-11717</cvename>
 <cvename>CVE-2019-11718</cvename>
 <cvename>CVE-2019-11719</cvename>
 <cvename>CVE-2019-11720</cvename>
 <cvename>CVE-2019-11721</cvename>
 <cvename>CVE-2019-11723</cvename>
 <cvename>CVE-2019-11724</cvename>
 <cvename>CVE-2019-11725</cvename>
 <cvename>CVE-2019-11727</cvename>
 <cvename>CVE-2019-11728</cvename>
 <cvename>CVE-2019-11729</cvename>
 <cvename>CVE-2019-11730</cvename>
 <cvename>CVE-2019-9811</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2019-21/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2019-22/</url>
 </references>
 <dates>
 <discovery>2019-07-09</discovery>
 <entry>2019-07-09</entry>
 <modified>2019-07-23</modified>
 </dates>
 </vuln>

<vuln vid="23f65f58-a261-11e9-b444-002590acae31">
 <topic>GnuPG -- denial of service</topic>
 <affects>
 <package>
	<name>gnupg</name>
	<range><lt>2.2.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	From the GnuPG 2.2.17 changelog:
	<blockquote cite="https://dev.gnupg.org/T4606">
	 gpg: Ignore all key-signatures received from keyservers. This
 change is required to mitigate a DoS due to keys flooded with
 faked key-signatures.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://dev.gnupg.org/T4606</url>
 <url>https://dev.gnupg.org/T4607</url>
 </references>
 <dates>
 <discovery>2019-07-03</discovery>
 <entry>2019-07-09</entry>
 </dates>
 </vuln>

<vuln vid="18ed9650-a1d6-11e9-9b17-fcaa147e860e">
 <topic>python 3.6 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python36</name>
	<range><lt>3.6.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python changelog:
	<blockquote cite="https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-9-final">
	 bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file://
	 and local_file:// URL schemes in URLopener().open() and URLopener().retrieve()
	 of urllib.request.
	 bpo-36742: Fixes mishandling of pre-normalization characters in urlsplit().
	 bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded
	 whitespace or control characters through into the underlying http client
	 request. Such potentially malicious header injection URLs now cause an
	 http.client.InvalidURL exception to be raised.
	 bpo-36216: Changes urlsplit() to raise ValueError when the URL contains
	 characters that decompose under IDNA encoding (NFKC-normalization) into
	 characters that affect how the URL is parsed.
	 bpo-33529: Prevent fold function used in email header encoding from
	 entering infinite loop when there are too many non-ASCII characters in
	 a header.
	 bpo-35121: Don't send cookies of domain A without Domain attribute to
	 domain B when domain A is a suffix match of domain B while using a cookiejar
	 with http.cookiejar.DefaultCookiePolicy policy. Patch by Karthikeyan
	 Singaravelan.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-9-final</url>
 <cvename>CVE-2019-9948</cvename>
 <cvename>CVE-2019-9740</cvename>
 </references>
 <dates>
 <discovery>2019-03-13</discovery>
 <entry>2019-07-08</entry>
 </dates>
 </vuln>

<vuln vid="3dd46e05-9fb0-11e9-bf65-00012e582166">
 <topic>webkit2-gtk3 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>webkit2-gtk3</name>
	<range><lt>2.24.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The WebKitGTK project reports many vulnerabilities,
	including several arbitrary code execution vulnerabilities.
 </body>
 </description>
 <references>
 <url>https://webkitgtk.org/security/WSA-2019-0002.html</url>
 <cvename>CVE-2019-6201</cvename>
 <cvename>CVE-2019-6251</cvename>
 <cvename>CVE-2019-7285</cvename>
 <cvename>CVE-2019-7292</cvename>
 <cvename>CVE-2019-8503</cvename>
 <cvename>CVE-2019-8506</cvename>
 <cvename>CVE-2019-8515</cvename>
 <cvename>CVE-2019-8518</cvename>
 <cvename>CVE-2019-8523</cvename>
 <cvename>CVE-2019-8524</cvename>
 <cvename>CVE-2019-8535</cvename>
 <cvename>CVE-2019-8536</cvename>
 <cvename>CVE-2019-8544</cvename>
 <cvename>CVE-2019-8551</cvename>
 <cvename>CVE-2019-8558</cvename>
 <cvename>CVE-2019-8559</cvename>
 <cvename>CVE-2019-8563</cvename>
 <cvename>CVE-2019-11070</cvename>
 <url>https://webkitgtk.org/security/WSA-2019-0003.html</url>
 <cvename>CVE-2019-6237</cvename>
 <cvename>CVE-2019-8571</cvename>
 <cvename>CVE-2019-8583</cvename>
 <cvename>CVE-2019-8584</cvename>
 <cvename>CVE-2019-8586</cvename>
 <cvename>CVE-2019-8587</cvename>
 <cvename>CVE-2019-8594</cvename>
 <cvename>CVE-2019-8595</cvename>
 <cvename>CVE-2019-8596</cvename>
 <cvename>CVE-2019-8597</cvename>
 <cvename>CVE-2019-8601</cvename>
 <cvename>CVE-2019-8607</cvename>
 <cvename>CVE-2019-8608</cvename>
 <cvename>CVE-2019-8609</cvename>
 <cvename>CVE-2019-8610</cvename>
 <cvename>CVE-2019-8615</cvename>
 <cvename>CVE-2019-8611</cvename>
 <cvename>CVE-2019-8619</cvename>
 <cvename>CVE-2019-8622</cvename>
 <cvename>CVE-2019-8623</cvename>
 </references>
 <dates>
 <discovery>2019-04-10</discovery>
 <entry>2019-07-06</entry>
 </dates>
 </vuln>

<vuln vid="3c5a4fe0-9ebb-11e9-9169-fcaa147e860e">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki131</name>
	<range><lt>1.31.3</lt></range>
 </package>
 <package>
	<name>mediawiki132</name>
	<range><lt>1.32.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawiki reports:
	<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-June/000230.html">
	 Security fixes:
	 T197279, CVE-2019-12468: Directly POSTing to Special:ChangeEmail would allow
	 for bypassing reauthentication, allowing for potential account takeover.
	 T204729, CVE-2019-12473: Passing invalid titles to the API could cause a DoS
	 by querying the entire `watchlist` table.
	 T207603, CVE-2019-12471: Loading user JavaScript from a non-existent account
	 allows anyone to create the account, and XSS the users' loading that script.
	 T208881: blacklist CSS var().
	 T199540, CVE-2019-12472: It is possible to bypass the limits on IP range
	 blocks (`$wgBlockCIDRLimit`) by using the API.
	 T212118, CVE-2019-12474: Privileged API responses that include whether a
	 recent change has been patrolled may be cached publicly.
	 T209794, CVE-2019-12467: A spammer can use Special:ChangeEmail to send out
	 spam with no rate limiting or ability to block them.
	 T25227, CVE-2019-12466: An account can be logged out without using a token(CRRF)
	 T222036, CVE-2019-12469: Exposed suppressed username or log in Special:EditTags.
	 T222038, CVE-2019-12470: Exposed suppressed log in RevisionDelete page.
	 T221739, CVE-2019-11358: Fix potential XSS in jQuery.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-11358</cvename>
 <cvename>CVE-2019-12466</cvename>
 <cvename>CVE-2019-12467</cvename>
 <cvename>CVE-2019-12468</cvename>
 <cvename>CVE-2019-12469</cvename>
 <cvename>CVE-2019-12470</cvename>
 <cvename>CVE-2019-12471</cvename>
 <cvename>CVE-2019-12472</cvename>
 <cvename>CVE-2019-12473</cvename>
 <cvename>CVE-2019-12474</cvename>
 <url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-June/000230.html</url>
 </references>
 <dates>
 <discovery>2019-04-23</discovery>
 <entry>2019-07-05</entry>
 </dates>
 </vuln>

<vuln vid="b79ec16b-9da7-11e9-a0ea-a92fe7db4867">
 <topic>ettercap -- out-of-bound read vulnerability</topic>
 <affects>
 <package>
	<name>ettercap</name>
	<range><lt>0.8.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ettercap GitHub issue:
	<blockquote cite="https://github.com/Ettercap/ettercap/issues/782">
	 Etterfilter results in an invalid read of 8 bytes when parsing a crafted file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/Ettercap/ettercap/issues/782</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-6430</url>
 <cvename>CVE-2017-6430</cvename>
 </references>
 <dates>
 <discovery>2019-07-01</discovery>
 <entry>2019-07-03</entry>
 </dates>
 </vuln>

<vuln vid="4ea507d1-9da8-11e9-a759-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>12.0.0</ge><lt>12.0.3</lt></range>
	<range><ge>11.11.0</ge><lt>11.11.5</lt></range>
	<range><ge>8.3.0</ge><lt>11.10.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/">
	 Ability to Write a Note to a Private Snippet
	 Recent Pipeline Information Disclosed to Unauthorised Users
	 Resource Exhaustion Attack
	 Error Caused by Encoded Characters in Comments
	 Authorization Issues in GraphQL
	 Number of Merge Requests was Accessible
	 Enabling One of the Service Templates Could Cause Resource Depletion
	 Broken Access Control for the Content of Personal Snippets
	 Decoding Color Codes Caused Resource Depletion
	 Merge Request Template Name Disclosure
	 SSRF Vulnerability in Project GitHub Integration
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/</url>
 <cvename>CVE-2019-13001</cvename>
 <cvename>CVE-2019-13002</cvename>
 <cvename>CVE-2019-13003</cvename>
 <cvename>CVE-2019-13004</cvename>
 <cvename>CVE-2019-13005</cvename>
 <cvename>CVE-2019-13006</cvename>
 <cvename>CVE-2019-13007</cvename>
 <cvename>CVE-2019-13009</cvename>
 <cvename>CVE-2019-13010</cvename>
 <cvename>CVE-2019-13011</cvename>
 <cvename>CVE-2019-13121</cvename>
 </references>
 <dates>
 <discovery>2019-07-03</discovery>
 <entry>2019-07-03</entry>
 </dates>
 </vuln>

<vuln vid="3394bc2b-9da4-11e9-951e-14dae9d5a9d2">
 <topic>SDL2_image -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>sdl2_image</name>
	<range><lt>2.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SDL_image developers report:
	<blockquote cite="https://www.libsdl.org/projects/SDL_image/">
	 Fixed a number of security issues:
	 <ul>
	 <li>TALOS-2019-0820</li>
	 <li>TALOS-2019-0821</li>
	 <li>TALOS-2019-0841</li>
	 <li>TALOS-2019-0842</li>
	 <li>TALOS-2019-0843</li>
	 <li>TALOS-2019-0844</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0820</url>
 <url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0821</url>
 <url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0841</url>
 <url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0842</url>
 <url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0843</url>
 <url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0844</url>
 <cvename>CVE-2019-5051</cvename>
 <cvename>CVE-2019-5052</cvename>
 <cvename>CVE-2019-5057</cvename>
 <cvename>CVE-2019-5058</cvename>
 <cvename>CVE-2019-5059</cvename>
 <cvename>CVE-2019-5060</cvename>
 </references>
 <dates>
 <discovery>2019-07-02</discovery>
 <entry>2019-07-03</entry>
 </dates>
 </vuln>

<vuln vid="475f952c-9b29-11e9-a8a5-6805ca0b38e8">
 <topic>irssi -- Use after free when sending SASL login to the server</topic>
 <affects>
 <package>
	<name>irssi</name>
	<range><lt>1.2.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Irssi reports:
	<blockquote cite="https://irssi.org/security/irssi_sa_2019_06.txt">
	 Use after free when sending SASL login to the server found by ilbelkyr. (CWE-416, CWE-825)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://irssi.org/security/irssi_sa_2019_06.txt</url>
 <cvename>CVE-2019-13045</cvename>
 </references>
 <dates>
 <discovery>2019-06-29</discovery>
 <entry>2019-07-01</entry>
 </dates>
 </vuln>

<vuln vid="b805d7b4-9c0c-11e9-97f0-000c29e96db4">
 <topic>Django -- Incorrect HTTP detection with reverse-proxy connecting via HTTPS</topic>
 <affects>
 <package>
	<name>py27-django111</name>
	<name>py35-django111</name>
	<name>py36-django111</name>
	<name>py37-django111</name>
	<range><lt>1.11.22</lt></range>
 </package>
 <package>
	<name>py35-django21</name>
	<name>py36-django21</name>
	<name>py37-django21</name>
	<range><lt>2.1.10</lt></range>
 </package>
 <package>
	<name>py35-django22</name>
	<name>py36-django22</name>
	<name>py37-django22</name>
	<range><lt>2.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django security releases issued:
	<blockquote cite="https://www.djangoproject.com/weblog/2019/jul/01/security-releases/">
	 When deployed behind a reverse-proxy connecting to Django via HTTPS,
	 django.http.HttpRequest.scheme would incorrectly detect client requests
	 made via HTTP as using HTTPS. This entails incorrect results for is_secure(),
	 and build_absolute_uri(), and that HTTP requests would not be redirected to
	 HTTPS in accordance with SECURE_SSL_REDIRECT.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-12781</cvename>
 <url>https://www.djangoproject.com/weblog/2019/jul/01/security-releases/</url>
 </references>
 <dates>
 <discovery>2019-07-01</discovery>
 <entry>2019-07-01</entry>
 </dates>
 </vuln>

<vuln vid="4b6cb45d-881e-447a-a4e0-c97a954ea758">
 <topic>bzip2 -- multiple issues</topic>
 <affects>
 <package>
	<name>bzip2</name>
	<range><lt>1.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	bzip2 developers reports:
	<blockquote cite="https://gitlab.com/federicomenaquintero/bzip2/blob/master/NEWS">
	 CVE-2016-3189 - Fix use-after-free in bzip2recover (Jakub Martisko)
	 CVE-2019-12900 - Detect out-of-range nSelectors in corrupted files (Albert Astals Cid). Found through fuzzing karchive.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://gitlab.com/federicomenaquintero/bzip2/blob/master/NEWS</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1319648</url>
 <cvename>CVE-2016-3189</cvename>
 <cvename>CVE-2019-12900</cvename>
 </references>
 <dates>
 <discovery>2019-06-23</discovery>
 <entry>2019-06-30</entry>
 </dates>
 </vuln>

<vuln vid="1c21f6a3-9415-11e9-95ec-6805ca2fa271">
 <topic>powerdns -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>powerdns</name>
 <range><lt>4.1.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 PowerDNS Team reports:
 <blockquote cite="https://doc.powerdns.com/authoritative/changelog/4.1.html#change-4.1.10">
	 CVE-2019-10162: An issue has been found in PowerDNS Authoritative Server allowing an authorized user to
	 cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The
	 issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while
	 looking up the NS/A/AAAA records it is about to use for an outgoing notify.
	 CVE-2019-10163: An issue has been found in PowerDNS Authoritative Server allowing a remote, authorized
	 master server to cause a high CPU load or even prevent any further updates to any slave zone by sending
	 a large number of NOTIFY messages. Note that only servers configured as slaves are affected by this issue.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://doc.powerdns.com/authoritative/changelog/4.1.html#change-4.1.10</url>
 <cvename>CVE-2019-10162</cvename>
 <cvename>CVE-2019-10163</cvename>
 </references>
 <dates>
 <discovery>2019-06-21</discovery>
 <entry>2019-06-21</entry>
 </dates>
 </vuln>

<vuln vid="5e35cfba-9994-11e9-b07f-df5abf8b84d6">
 <topic>TYPO3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>typo3-8-php71</name>
	<name>typo3-8-php72</name>
	<name>typo3-8-php73</name>
	<range><lt>8.7.27</lt></range>
 </package>
 <package>
	<name>typo3-9-php71</name>
	<name>typo3-9-php72</name>
	<name>typo3-9-php73</name>
	<range><lt>9.5.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	TYPO3 news:
	<blockquote cite="https://typo3.org/article/typo3-958-and-8727-security-releases-published/">
	 Please read the corresponding Security Advisories for details.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://typo3.org/article/typo3-958-and-8727-security-releases-published/</url>
 <url>https://get.typo3.org/release-notes/8.7.27</url>
 <url>https://get.typo3.org/release-notes/9.5.8</url>
 <cvename>CVE-2019-10912</cvename>
 <cvename>CVE-2019-12747</cvename>
 <cvename>CVE-2019-12748</cvename>
 </references>
 <dates>
 <discovery>2019-06-28</discovery>
 <entry>2019-06-28</entry>
 </dates>
 </vuln>

<vuln vid="245629d4-991e-11e9-82aa-6cc21735f730">
 <topic>PostgreSQL -- Stack-based buffer overflow via setting a password</topic>
 <affects>
 <package>
	<name>postgresql11-server</name>
	<range><lt>11.4</lt></range>
 </package>
 <package>
	<name>postgresql10-server</name>
	<range><lt>10.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/about/news/1949/">
	 
	 An authenticated user could create a stack-based buffer overflow
	 by changing their own password to a purpose-crafted value. In addition
	 to the ability to crash the PostgreSQL server, this could be further
	 exploited to execute arbitrary code as the PostgreSQL operating system account.
	 
	 
	 Additionally, a rogue server could send a specifically crafted
	 message during the SCRAM authentication process and cause a libpq-enabled client
	 to either crash or execute arbitrary code as the client's operating system account.
	 
	 
	 This issue is fixed by upgrading and restarting your PostgreSQL
	 server as well as your libpq installations. All users running
	 PostgreSQL 10, 11, and 12 beta are encouraged to upgrade as soon as possible.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.postgresql.org/about/news/1949/</url>
 <cvename>CVE-2019-10164</cvename>
 </references>
 <dates>
 <discovery>2019-06-20</discovery>
 <entry>2019-06-27</entry>
 </dates>
 </vuln>

<vuln vid="6f15730d-94ea-11e9-a83e-641c67a117d8">
 <topic>znc -- privilege escalation</topic>
 <affects>
 <package>
	<name>znc</name>
	<range><lt>1.7.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12816">
	 Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated
	 non-admin users to escalate privileges and execute arbitrary
	 code by loading a module with a crafted name.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-12816</cvename>
 <url>https://wiki.znc.in/ChangeLog/1.7.4</url>
 </references>
 <dates>
 <discovery>2019-06-13</discovery>
 <entry>2019-06-22</entry>
 </dates>
 </vuln>

<vuln vid="49beb00f-a6e1-4a42-93df-9cb14b4c2bee">
 <topic>Mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>thunderbird</name>
	<range><lt>thunderbird-60.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-20/">
	 <h1>CVE-2019-11707: Type confusion in Array.pop</h1>
	 A type confusion vulnerability can occur when manipulating
	 JavaScript objects due to issues in Array.pop. This can allow
	 for an exploitable crash. We are aware of targeted attacks in
	 the wild abusing this flaw.
	 <h1>CVE-2019-11708: sandbox escape using Prompt:Open</h1>
	 Insufficient vetting of parameters passed with the
	 Prompt:Open IPC message between child and parent processes can
	 result in the non-sandboxed parent process opening web content
	 chosen by a compromised child process. When combined with
	 additional vulnerabilities this could result in executing
	 arbitrary code on the user's computer.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-20/</url>
 <cvename>CVE-2019-11707</cvename>
 <cvename>CVE-2019-11708</cvename>
 </references>
 <dates>
 <discovery>2019-06-20</discovery>
 <entry>2019-06-21</entry>
 </dates>
 </vuln>

<vuln vid="39bc2294-ff32-4972-9ecb-b9f40b4ccb74">
 <topic>Mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>67.0.4,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.2.12</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>60.7.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/">
	 <h1>CVE-2019-11708: sandbox escape using Prompt:Open</h1>
	 Insufficient vetting of parameters passed with the
	 Prompt:Open IPC message between child and parent processes
	 can result in the non-sandboxed parent process opening web
	 content chosen by a compromised child process. When combined
	 with additional vulnerabilities this could result in executing
	 arbitrary code on the user's computer.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/</url>
 <cvename>CVE-2019-11708</cvename>
 </references>
 <dates>
 <discovery>2019-06-20</discovery>
 <entry>2019-06-21</entry>
 <modified>2019-07-09</modified>
 </dates>
 </vuln>

<vuln vid="98f1241f-8c09-4237-ad0d-67fb4158ea7a">
 <topic>Mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>thunderbird</name>
	<range><lt>60.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/">
	 <h1>CVE-2019-11703: Heap buffer overflow in icalparser.c</h1>
	 A flaw in Thunderbird's implementation of iCal causes a heap
	 buffer overflow in parser_get_next_char when processing certain
	 email messages, resulting in a potentially exploitable crash.
	 <h1>CVE-2019-11704: Heap buffer overflow in icalvalue.c</h1>
	 A flaw in Thunderbird's implementation of iCal causes a heap
	 buffer overflow in icalmemory_strdup_and_dequote when processing
	 certain email messages, resulting in a potentially exploitable
	 crash.
	 <h1>CVE-2019-11705: Stack buffer overflow in icalrecur.c</h1>
	 A flaw in Thunderbird's implementation of iCal causes a stack
	 buffer overflow in icalrecur_add_bydayrules when processing
	 certain email messages, resulting in a potentially exploitable
	 crash.
	 <h1>CVE-2019-11706: Type confusion in icalproperty.c</h1>
	 A flaw in Thunderbird's implementation of iCal causes a type
	 confusion in icaltimezone_get_vtimezone_properties when
	 processing certain email messages, resulting in a crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/</url>
 <cvename>CVE-2019-11703</cvename>
 <cvename>CVE-2019-11704</cvename>
 <cvename>CVE-2019-11705</cvename>
 <cvename>CVE-2019-11706</cvename>
 </references>
 <dates>
 <discovery>2019-06-13</discovery>
 <entry>2019-06-21</entry>
 </dates>
 </vuln>

<vuln vid="5b218581-9372-11e9-8fc4-5404a68ad561">
 <topic>vlc -- Double free in Matroska demuxer</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><lt>3.0.7.1,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The VLC project reports:
	<blockquote cite="http://git.videolan.org/?p=vlc.git;a=commit;h=81023659c7de5ac2637b4a879195efef50846102">
	 mkv: Fix potential double free
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-12874</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12874</url>
 <url>http://git.videolan.org/?p=vlc.git;a=commit;h=81023659c7de5ac2637b4a879195efef50846102</url>
 </references>
 <dates>
 <discovery>2019-05-20</discovery>
 <entry>2019-06-20</entry>
 </dates>
 </vuln>

<vuln vid="f2144530-936f-11e9-8fc4-5404a68ad561">
 <topic>vlc -- Buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><lt>3.0.7,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	zhangyang reports:
	<blockquote cite="https://hackerone.com/reports/484398">
	 The ReadFrame function in the avi.c file uses a variable i_width_bytes,
	 which is obtained directly from the file. It is a signed integer.
	 It does not do a strict check before the memory operation(memmove, memcpy),
	 which may cause a buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5439</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5439</url>
 <url>https://hackerone.com/reports/484398</url>
 </references>
 <dates>
 <discovery>2019-01-23</discovery>
 <entry>2019-06-20</entry>
 </dates>
 </vuln>

<vuln vid="0cea6e0a-7a39-4dac-b3ec-dbc13d404f76">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>67.0.3,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.2.11</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>60.7.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/">
	 <h1>CVE-2019-11707: Type confusion in Array.pop</h1>
	 A type confusion vulnerability can occur when
	 manipulating JavaScript objects due to issues in
	 Array.pop. This can allow for an exploitable crash. We are
	 aware of targeted attacks in the wild abusing this flaw.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-11707</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2019-18/</url>
 </references>
 <dates>
 <discovery>2019-06-18</discovery>
 <entry>2019-06-19</entry>
 <modified>2019-06-20</modified>
 </dates>
 </vuln>

<vuln vid="9c9023ff-9057-11e9-b764-00505632d232">
 <topic>netatalk3 -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>netatalk3</name>
	<range><lt>3.1.12,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NIST reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-1160">
	 Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2018-1160</url>
 <url>https://medium.com/tenable-techblog/exploiting-an-18-year-old-bug-b47afe54172</url>
 </references>
 <dates>
 <discovery>2018-11-10</discovery>
 <entry>2019-06-16</entry>
 </dates>
 </vuln>

<vuln vid="82c07dfa-9016-11e9-af2f-712c38aa3e4c">
 <topic>GraphicsMagick -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>GraphicsMagick</name>
	<range><lt>1.3.32,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GraphicsMagick News:
	<blockquote cite="http://www.graphicsmagick.org/NEWS.html">
	 Read "Security Fixes:" section for details.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.graphicsmagick.org/NEWS.html</url>
 </references>
 <dates>
 <discovery>2019-06-15</discovery>
 <entry>2019-06-16</entry>
 </dates>
 </vuln>

<vuln vid="d4fc4599-8f75-11e9-8d9f-3065ec8fd3ec">
 <topic>chromium -- use after free</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>75.0.3770.90</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop_13.html">
	 [961413] High CVE-2019-5842: Use-after-free in Blink. Reported by BUGFENSE Anonymous Bug Bounties https://bugfense.io on 2019-05-09
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop_13.html</url>
 <cvename>CVE-2019-5842</cvename>
 </references>
 <dates>
 <discovery>2019-05-09</discovery>
 <entry>2019-06-15</entry>
 </dates>
 </vuln>

<vuln vid="a5681027-8e03-11e9-85f4-6805ca0b3d42">
 <topic>phpMyAdmin -- CSRF vulnerability in login form</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<name>phpMyAdmin-php56</name>
	<name>phpMyAdmin-php70</name>
	<name>phpMyAdmin-php71</name>
	<name>phpMyAdmin-php72</name>
	<range><lt>4.9.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2019-4/">
	 <h3>Summary</h3>
	 CSRF vulnerability in login form

<h3>Description</h3>
	 A vulnerability was found that allows an attacker to
	 trigger a CSRF attack against a phpMyAdmin user. The
	 attacker can trick the user, for instance through a broken
	 <code>&lt;img&gt;</code> tag pointing at the victim's
	 phpMyAdmin database, and the attacker can potentially
	 deliver a payload (such as a specific INSERT or DELETE
	 statement) through the victim.

<h3>Severity</h3>
	 We consider this vulnerability to be severe.

<h3>Mitigation factor</h3> Only the 'cookie'
	 auth_type is affected; users can temporary use
	 phpMyAdmin's http authentication as a workaround.

</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2019-4/</url>
 <cvename>CVE-2019-12616</cvename>
 </references>
 <dates>
 <discovery>2019-06-04</discovery>
 <entry>2019-06-13</entry>
 </dates>
 </vuln>

<vuln vid="bbdb9713-8e09-11e9-87bc-002590acae31">
 <topic>Vim/NeoVim -- Security vulnerability</topic>
 <affects>
 <package>
	<name>vim</name>
	<name>vim-console</name>
	<name>vim-tiny</name>
	<range><lt>8.1.1365</lt></range>
 </package>
 <package>
	<name>neovim</name>
	<range><lt>0.3.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Security releases for Vim/NeoVim:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-12735">
	 Sandbox escape allows for arbitrary code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-12735</url>
 </references>
 <dates>
 <discovery>2019-05-22</discovery>
 <entry>2019-06-13</entry>
 </dates>
 </vuln>

<vuln vid="13960f55-8d35-11e9-9ba0-4c72b94353b5">
 <topic>mybb -- vulnerabilities</topic>
 <affects>
 <package>
	<name>mybb</name>
	<range><lt>1.8.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mybb Team reports:
	<blockquote cite="https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/">
	 High risk: Theme import stylesheet name RCE
	 High risk: Nested video MyCode persistent XSS
	 Medium risk: Find Orphaned Attachments reflected XSS
	 Medium risk: Post edit reflected XSS
	 Medium risk: Private Messaging folders SQL injection
	 Low risk: Potential phar deserialization through Upload Path
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2019-06-10</discovery>
 <entry>2019-06-12</entry>
 </dates>
 </vuln>

<vuln vid="ab099d2c-8c8c-11e9-8ba7-6451062f0f7a">
 <topic>Flash Player -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>32.0.0.207</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb19-30.html">
	 <ul>
	 <li>This update resolves a use-after-free vulnerability that
	 could lead to arbitrary code execution (CVE-2019-7845).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-7845</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb19-30.html</url>
 </references>
 <dates>
 <discovery>2019-06-11</discovery>
 <entry>2019-06-11</entry>
 </dates>
 </vuln>

<vuln vid="9b8a52fc-89c1-11e9-9ba0-4c72b94353b5">
 <topic>drupal -- Drupal core - Moderately critical</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.67</lt></range>
 </package>
 <package>
	<name>drupal8</name>
	<range><lt>8.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/SA-CORE-2019-007">
	 CVE-2019-11831: By-passing protection of Phar Stream Wrapper Interceptor.
	 In order to intercept file invocations like file_exists or stat on compromised Phar archives
	 the base name has to be determined and checked before allowing to be handled by PHP
	 Phar stream handling.
	 The current implementation is vulnerable to path traversal leading to scenarios where the
	 Phar archive to be assessed is not the actual (compromised) file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/SA-CORE-2019-007</url>
 </references>
 <dates>
 <discovery>2019-05-08</discovery>
 <entry>2019-06-08</entry>
 </dates>
 </vuln>

<vuln vid="45bea6b5-8855-11e9-8d41-97657151f8c2">
 <topic>Exim -- RCE in deliver_message() function</topic>
 <affects>
 <package>
	<name>exim</name>
	<range><ge>4.87</ge><lt>4.92</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Exim team and Qualys report:
	<blockquote cite="https://www.exim.org/static/doc/security/CVE-2019-10149.txt">
	 
	 We received a report of a possible remote exploit. Currently there is no evidence of an active use of this exploit.
	 
	 
	 A patch exists already, is being tested, and backported to all
	 versions we released since (and including) 4.87.
	 
	 
	 The severity depends on your configuration. It depends on how close to
	 the standard configuration your Exim runtime configuration is. The
	 closer the better.
	 
	 
	 Exim 4.92 is not vulnerable.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-10149</cvename>
 <url>https://www.exim.org/static/doc/security/CVE-2019-10149.txt</url>
 </references>
 <dates>
 <discovery>2019-05-27</discovery>
 <entry>2019-06-06</entry>
 </dates>
 </vuln>

<vuln vid="ffc73e87-87f0-11e9-ad56-fcaa147e860e">
 <topic>Django -- AdminURLFieldWidget XSS</topic>
 <affects>
 <package>
	<name>py27-django111</name>
	<name>py35-django111</name>
	<name>py36-django111</name>
	<name>py37-django111</name>
	<range><lt>1.11.21</lt></range>
 </package>
 <package>
	<name>py35-django21</name>
	<name>py36-django21</name>
	<name>py37-django21</name>
	<range><lt>2.1.9</lt></range>
 </package>
 <package>
	<name>py35-django22</name>
	<name>py36-django22</name>
	<name>py37-django22</name>
	<range><lt>2.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django security releases issued:
	<blockquote cite="https://www.djangoproject.com/weblog/2019/jun/03/security-releases/">
	 The clickable "Current URL" link generated by AdminURLFieldWidget displayed the
	 provided value without validating it as a safe URL. Thus, an unvalidated value stored
	 in the database, or a value provided as a URL query parameter payload, could result
	 in an clickable JavaScript link..
	 jQuery before 3.4.0, mishandles jQuery.extend(true, {}, ...) because of Object.prototype
	 pollution. If an unsanitized source object contained an enumerable __proto__ property,
	 it could extend the native Object.prototype.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-12308</cvename>
 <cvename>CVE-2019-11358</cvename>
 <url>https://www.djangoproject.com/weblog/2019/jun/03/security-releases/</url>
 </references>
 <dates>
 <discovery>2019-06-03</discovery>
 <entry>2019-06-06</entry>
 </dates>
 </vuln>

<vuln vid="4091069e-860b-11e9-a05f-001b217b3468">
 <topic>Gitlab -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.11.0</ge><lt>11.11.1</lt></range>
	<range><ge>11.10.0</ge><lt>11.10.5</lt></range>
	<range><ge>6.8.0</ge><lt>11.9.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/">
	 Remote Command Execution Vulnerability on Repository Download Feature
	 Confidential Issue Titles Revealed to Restricted Users on Unsubscribe
	 Disclosure of Milestone Metadata through the Search API
	 Private Project Discovery via Comment Links
	 Metadata of Confidential Issues Disclosed to Restricted Users
	 Mandatory External Authentication Provider Sign-In Restrictions Bypass
	 Internal Projects Allowed to Be Created on in Private Groups
	 Server-Side Request Forgery Through DNS Rebinding
	 Stored Cross-Site Scripting on Wiki Pages
	 Stored Cross-Site Scripting on Notes
	 Repository Password Disclosed on Import Error Page
	 Protected Branches Restriction Rules Bypass
	 Stored Cross-Site Scripting Vulnerability on Child Epics
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/</url>
 <cvename>CVE-2019-12430</cvename>
 <cvename>CVE-2019-12432</cvename>
 <cvename>CVE-2019-12431</cvename>
 <cvename>CVE-2019-12434</cvename>
 <cvename>CVE-2019-12429</cvename>
 <cvename>CVE-2019-12428</cvename>
 <cvename>CVE-2019-12433</cvename>
 <cvename>CVE-2019-12443</cvename>
 <cvename>CVE-2019-12444</cvename>
 <cvename>CVE-2019-12445</cvename>
 <cvename>CVE-2019-12446</cvename>
 <cvename>CVE-2019-12441</cvename>
 <cvename>CVE-2019-12442</cvename>
 </references>
 <dates>
 <discovery>2019-06-03</discovery>
 <entry>2019-06-03</entry>
 </dates>
 </vuln>

<vuln vid="ada8db8a-8471-11e9-8170-0050562a4d7b">
 <topic>buildbot -- OAuth Authentication Vulnerability</topic>
 <affects>
 <package>
	<name>py27-buildbot</name>
	<name>py35-buildbot</name>
	<name>py36-buildbot</name>
	<name>py37-buildbot</name>
	<range><lt>2.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication">
	 Buildbot accepted user-submitted authorization token from OAuth and used
	 it to authenticate user.
	 The vulnerability can lead to malicious attackers to authenticate as legitimate users
	 of a Buildbot instance without knowledge of the victim's login credentials on certain
	 scenarios.
	 If an attacker has an application authorized to access data of another user at the
	 same Identity Provider as the used by the Buildbot instance, then he can acquire a token
	 to access the data of that user, supply the token to the Buildbot instance and successfully
	 login as the victim.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication</url>
 <url>https://github.com/buildbot/buildbot/pull/4763</url>
 <cvename>CVE-2019-12300</cvename>
 </references>
 <dates>
 <discovery>2019-05-07</discovery>
 <entry>2019-06-01</entry>
 </dates>
 </vuln>

<vuln vid="177fa455-48fc-4ded-ba1b-9975caa7f62a">
 <topic>bro -- Unsafe integer conversions can cause unintentional code paths to be executed</topic>
 <affects>
 <package>
	<name>bro</name>
	<range><lt>2.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jon Siwek of Corelight reports:
	<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/bb979702cf9a2fa67b8d1a1c7f88d0b56c6af104/NEWS">
	 The following Denial of Service vulnerabilities are addressed:
	 <ul>
	 <li>Integer type mismatches in BinPAC-generated parser code
	 and Bro analyzer code may allow for crafted packet data
	 to cause unintentional code paths in the analysis logic
	 to be taken due to unsafe integer conversions causing the
	 parser and analysis logic to each expect different fields
	 to have been parsed. One such example, reported by Maksim
	 Shudrak, causes the Kerberos analyzer to dereference a
	 null pointer. CVE-2019-12175 was assigned for this issue.</li>

<li>The Kerberos parser allows for several fields to be left
	 uninitialized, but they were not marked with an &amp;optional
	 attribute and several usages lacked existence checks.
	 Crafted packet data could potentially cause an attempt
	 to access such uninitialized fields, generate a runtime
	 error/exception, and leak memory. Existence checks and
	 &amp;optional attributes have been added to the relevent
	 Kerberos fields.</li>

<li>BinPAC-generated protocol parsers commonly contain fields
	 whose length is derived from other packet input, and for
	 those that allow for incremental parsing, BinPAC did not
	 impose a limit on how large such a field could grow,
	 allowing for remotely-controlled packet data to cause
	 growth of BinPAC's flowbuffer bounded only by the numeric
	 limit of an unsigned 64-bit integer, leading to memory
	 exhaustion. There is now a generalized limit for how
	 large flowbuffers are allowed to grow, tunable by setting
	 "BinPAC::flowbuffer_capacity_max".</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-12175</cvename>
 </references>
 <dates>
 <discovery>2019-05-29</discovery>
 <entry>2019-05-31</entry>
 </dates>
 </vuln>

<vuln vid="183d700e-ec70-487e-a9c4-632324afa934">
 <topic>ImageMagick -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ImageMagick7</name>
	<range><lt>7.0.8.47</lt></range>
 </package>
 <package>
	<name>ImageMagick7-nox11</name>
	<range><lt>7.0.8.47</lt></range>
 </package>
 <package>
	<name>ImageMagick6</name>
	<range><lt>6.9.10.47,1</lt></range>
 </package>
 <package>
	<name>ImageMagick6-nox11</name>
	<range><lt>6.9.10.47,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cvedetails.com reports:
	<blockquote cite="https://www.cvedetails.com/vulnerability-list/vendor_id-1749/Imagemagick.html">
	 CVE-2019-7175: In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.
	 CVE-2019-7395: In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c.
	 CVE-2019-7396: In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c.
	 CVE-2019-7397: In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.
	 CVE-2019-7398: In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.
	 CVE-2019-9956: In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.
	 CVE-2019-10131: An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.
	 CVE-2019-10649: In ImageMagick 7.0.8-36 Q16, there is a memory leak in the function SVGKeyValuePairs of coders/svg.c, which allows an attacker to cause a denial of service via a crafted image file.
	 CVE-2019-10650: In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file.
	 CVE-2019-10714: LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.
	 CVE-2019-11470: The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
	 CVE-2019-11472: ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first.
	 CVE-2019-11597: In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file.
	 CVE-2019-11598: In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.cvedetails.com/vulnerability-list/vendor_id-1749/Imagemagick.html</url>
 <cvename>CVE-2019-7175</cvename>
 <cvename>CVE-2019-7395</cvename>
 <cvename>CVE-2019-7396</cvename>
 <cvename>CVE-2019-7397</cvename>
 <cvename>CVE-2019-7398</cvename>
 <cvename>CVE-2019-9956</cvename>
 <cvename>CVE-2019-10131</cvename>
 <cvename>CVE-2019-10649</cvename>
 <cvename>CVE-2019-10650</cvename>
 <cvename>CVE-2019-10714</cvename>
 <cvename>CVE-2019-11470</cvename>
 <cvename>CVE-2019-11472</cvename>
 <cvename>CVE-2019-11597</cvename>
 <cvename>CVE-2019-11598</cvename>
 </references>
 <dates>
 <discovery>2019-03-07</discovery>
 <entry>2019-05-30</entry>
 <modified>2019-06-17</modified>
 </dates>
 </vuln>

<vuln vid="10fd731c-8088-11e9-b6ae-001871ec5271">
 <topic>cyrus-imapd -- buffer overrun in httpd</topic>
 <affects>
 <package>
	<name>cyrus-imapd30</name>
	<range><ge>3.0.0</ge><lt>3.0.10</lt></range>
 </package>
 <package>
	<name>cyrus-imapd25</name>
	<range><ge>2.5.0</ge><lt>2.5.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cyrus IMAP 3.0.10 Release Notes states:
	<blockquote cite="https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.10.html">
	 Fixed CVE-2019-11356: buffer overrun in httpd
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-11356</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11356</url>
 </references>
 <dates>
 <discovery>2019-04-19</discovery>
 <entry>2019-05-27</entry>
 </dates>
 </vuln>

<vuln vid="3ba87032-7fbd-11e9-8a5f-c85b76ce9b5a">
 <topic>serendipity -- XSS</topic>
 <affects>
 <package>
	<name>serendipity</name>
	<range><lt>2.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11870">
	 Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.s9y.org/archives/282-Serendipity-2.1.5-released.html</url>
 <cvename>CVE-2019-11870</cvename>
 </references>
 <dates>
 <discovery>2019-05-01</discovery>
 <entry>2019-05-26</entry>
 </dates>
 </vuln>

<vuln vid="36b905ad-7fbb-11e9-8a5f-c85b76ce9b5a">
 <topic>sqlite3 -- use after free</topic>
 <affects>
 <package>
	<name>sqlite3</name>
	<range><eq>3.26.0</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5018">
	 An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://talosintelligence.com/vulnerability_reports/TALOS-2019-0777</url>
 <cvename>CVE-2019-5018</cvename>
 </references>
 <dates>
 <discovery>2019-05-09</discovery>
 <entry>2019-05-26</entry>
 </dates>
 </vuln>

<vuln vid="3b903bf3-7f94-11e9-8a5f-c85b76ce9b5a">
 <topic>suricata -- buffer over-read</topic>
 <affects>
 <package>
	<name>suricata</name>
	<range><lt>4.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10053">
	 An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then the program runs into a heap-based buffer over-read. This occurs because the erroneous search for \r results in an integer underflow.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/</url>
 <cvename>CVE-2019-10053</cvename>
 </references>
 <dates>
 <discovery>2019-03-15</discovery>
 <entry>2019-05-26</entry>
 <modified>2019-05-26</modified>
 </dates>
 </vuln>

<vuln vid="dd343a2b-7ee7-11e9-a290-8ddc52868fa9">
 <topic>curl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.19.4</ge><lt>7.65.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	curl security problems:
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	 CVE-2019-5435: Integer overflows in curl_url_set()
	 libcurl contains two integer overflows in the curl_url_set()
	 function that if triggered, can lead to a too small buffer
	 allocation and a subsequent heap buffer overflow.
	 The flaws only exist on 32 bit architectures and require
	 excessive string input lengths.
	 CVE-2019-5436: TFTP receive buffer overflow
	 libcurl contains a heap buffer overflow in the function
	 (tftp_receive_packet()) that recevives data from a TFTP server. It
	 calls recvfrom() with the default size for the buffer rather than
	 with the size that was used to allocate it. Thus, the content that
	 might overwrite the heap memory is entirely controlled by the server.
	 The flaw exists if the user selects to use a "blksize" of 504 or
	 smaller (default is 512). The smaller size that is used, the larger
	 the possible overflow becomes.
	 Users chosing a smaller size than default should be rare as the
	 primary use case for changing the size is to make it larger.
	 It is rare for users to use TFTP across the Internet. It is most
	 commonly used within local networks.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/security.html</url>
 <url>https://curl.haxx.se/docs/CVE-2019-5435.html</url>
 <url>https://curl.haxx.se/docs/CVE-2019-5436.html</url>
 <cvename>CVE-2019-5435</cvename>
 <cvename>CVE-2019-5436</cvename>
 </references>
 <dates>
 <discovery>2019-05-22</discovery>
 <entry>2019-05-25</entry>
 <modified>2019-05-26</modified>
 </dates>
 </vuln>

<vuln vid="8d2af843-7d8e-11e9-8464-c85b76ce9b5a">
 <topic>OCaml -- Multiple Security Vulnerabilities</topic>
 <affects>
 <package>
	<name>ocaml</name>
	<range><lt>4.03.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="INSERT URL HERE">
	 OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2015-8869</url>
 <url>https://github.com/ocaml/ocaml/commit/659615c7b100a89eafe6253e7a5b9d84d0e8df74#diff-a97df53e3ebc59bb457191b496c90762</url>
 <cvename>CVE-2015-8869</cvename>
 </references>
 <dates>
 <discovery>2016-06-13</discovery>
 <entry>2019-05-23</entry>
 <modified>2019-05-26</modified>
 </dates>
 </vuln>

<vuln vid="44b6dfbf-4ef7-4d52-ad52-2b1b05d81272">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>67.0,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.2.10</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.53.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>60.7.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>60.7.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>60.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/">
	 CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS
	 CVE-2019-9816: Type confusion with object groups and UnboxedObjects
	 CVE-2019-9817: Stealing of cross-domain images using canvas
	 CVE-2019-9818: Use-after-free in crash generation server
	 CVE-2019-9819: Compartment mismatch with fetch API
	 CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell
	 CVE-2019-9821: Use-after-free in AssertWorkerThread
	 CVE-2019-11691: Use-after-free in XMLHttpRequest
	 CVE-2019-11692: Use-after-free removing listeners in the event listener manager
	 CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux
	 CVE-2019-7317: Use-after-free in png_image_free of libpng library
	 CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox
	 CVE-2019-11695: Custom cursor can render over user interface outside of web content
	 CVE-2019-11696: Java web start .JNLP files are not recognized as executable files for download prompts
	 CVE-2019-11697: Pressing key combinations can bypass installation prompt delays and install extensions
	 CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks
	 CVE-2019-11700: res: protocol can be used to open known local files
	 CVE-2019-11699: Incorrect domain name highlighting during page navigation
	 CVE-2019-11701: webcal: protocol default handler loads vulnerable web page
	 CVE-2019-9814: Memory safety bugs fixed in Firefox 67
	 CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-9815</cvename>
 <cvename>CVE-2019-9816</cvename>
 <cvename>CVE-2019-9817</cvename>
 <cvename>CVE-2019-9818</cvename>
 <cvename>CVE-2019-9819</cvename>
 <cvename>CVE-2019-9820</cvename>
 <cvename>CVE-2019-9821</cvename>
 <cvename>CVE-2019-11691</cvename>
 <cvename>CVE-2019-11692</cvename>
 <cvename>CVE-2019-11693</cvename>
 <cvename>CVE-2019-7317</cvename>
 <cvename>CVE-2019-11694</cvename>
 <cvename>CVE-2019-11695</cvename>
 <cvename>CVE-2019-11696</cvename>
 <cvename>CVE-2019-11697</cvename>
 <cvename>CVE-2019-11698</cvename>
 <cvename>CVE-2019-11700</cvename>
 <cvename>CVE-2019-11699</cvename>
 <cvename>CVE-2019-11701</cvename>
 <cvename>CVE-2019-9814</cvename>
 <cvename>CVE-2019-9800</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2019-13/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2019-14/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2019-15/</url>
 </references>
 <dates>
 <discovery>2019-05-21</discovery>
 <entry>2019-05-22</entry>
 <modified>2019-07-23</modified>
 </dates>
 </vuln>

<vuln vid="793a0072-7822-11e9-81e2-005056a311d1">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba46</name>
	<range><le>4.6.16</le></range>
 </package>
 <package>
	<name>samba47</name>
	<range><le>4.7.12</le></range>
 </package>
 <package>
	<name>samba48</name>
	<range><lt>4.8.12</lt></range>
 </package>
 <package>
	<name>samba49</name>
	<range><lt>4.9.8</lt></range>
 </package>
 <package>
	<name>samba410</name>
	<range><lt>4.10.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The samba project reports:
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16860.html">
	 The checksum validation in the S4U2Self handler in the embedded Heimdal KDC
	 did not first confirm that the checksum was keyed, allowing replacement of the
	 requested target (client) principal
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2019-3880.html">
	 Authenticated users with write permission can trigger a symlink traversal to write
	 or detect files outside the Samba share.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/security/CVE-2018-16860.html</url>
 <cvename>CVE-2018-16860</cvename>
 <url>https://www.samba.org/samba/security/CVE-2019-3880.html</url>
 <cvename>CVE-2019-3880</cvename>
 </references>
 <dates>
 <discovery>2019-05-14</discovery>
 <entry>2019-05-14</entry>
 </dates>
 </vuln>

<vuln vid="37528379-76a8-11e9-a4fd-00012e582166">
 <topic>Rust -- violation of Rust's safety guarantees</topic>
 <affects>
 <package>
	<name>rust</name>
	<range><ge>1.34.0</ge><lt>1.34.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sean McArthur reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12083">
	 
	 The Rust Programming Language Standard Library 1.34.x
	 before 1.34.2 contains a stabilized method which, if
	 overridden, can violate Rust's safety guarantees and
	 cause memory unsafety. If the Error::type_id method
	 is overridden then any type can be safely cast to any
	 other type, causing memory safety vulnerabilities in
	 safe code (e.g., out-of-bounds write or read). Code
	 that does not manually implement Error::type_id is
	 unaffected.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.rust-lang.org/2019/05/13/Security-advisory.html</url>
 <cvename>CVE-2019-12083</cvename>
 </references>
 <dates>
 <discovery>2019-05-09</discovery>
 <entry>2019-05-15</entry>
 </dates>
 </vuln>

<vuln vid="a99923a9-768c-11e9-885a-6451062f0f7a">
 <topic>Flash Player -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>32.0.0.192</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb19-26.html">
	 <ul>
	 <li>This update resolves a use-after-free vulnerability that
	 could lead to arbitrary code execution (CVE-2019-7837).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-7837</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb19-26.html</url>
 </references>
 <dates>
 <discovery>2019-05-14</discovery>
 <entry>2019-05-14</entry>
 </dates>
 </vuln>

<vuln vid="c2d1693b-73cb-11e9-a1c7-b499baebfeaf">
 <topic>PHP -- Multiple vulnerabilities in EXIF module</topic>
 <affects>
 <package>
	<name>php71-exif</name>
	<range><lt>7.1.28</lt></range>
 </package>
 <package>
	<name>php72-exif</name>
	<range><lt>7.2.17</lt></range>
 </package>
 <package>
	<name>php73-exif</name>
	<range><lt>7.3.4</lt></range>
 </package>

</affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP project reports:
	<blockquote cite="https://www.php.net/ChangeLog-7.php">
	 Heap-buffer-overflow in php_ifd_get32s (CVE-2019-11034)
	 Heap-buffer-overflow in exif_iif_add_value (CVE-2019-11035)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.php.net/ChangeLog-7.php</url>
 <cvename>CVE-2019-11034</cvename>
 <cvename>CVE-2019-11035</cvename>
 </references>
 <dates>
 <discovery>2019-04-04</discovery>
 <entry>2019-05-11</entry>
 </dates>
 </vuln>

<vuln vid="065890c3-725e-11e9-b0e1-6cc21735f730">
 <topic>PostgreSQL -- Selectivity estimators bypass row security policies</topic>
 <affects>
 <package>
	<name>postgresql11-server</name>
	<range><lt>11.3</lt></range>
 </package>
 <package>
	<name>postgresql10-server</name>
	<range><lt>10.8</lt></range>
 </package>
 <package>
	<name>postgresql96-server</name>
	<range><lt>9.6.13</lt></range>
 </package>
 <package>
	<name>postgresql95-server</name>
	<range><lt>9.5.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/about/news/1939/">
	 
	 PostgreSQL maintains statistics for tables by sampling
	 data available in columns; this data is consulted during
	 the query planning process. Prior to this release, a user
	 able to execute SQL queries with permissions to read a
	 given column could craft a leaky operator that could
	 read whatever data had been sampled from that column.
	 If this happened to include values from rows that the user
	 is forbidden to see by a row security policy, the user
	 could effectively bypass the policy. This is fixed by only
	 allowing a non-leakproof operator to use this data if
	 there are no relevant row security policies for the table.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.postgresql.org/about/news/1939/</url>
 <cvename>CVE-2019-10130</cvename>
 </references>
 <dates>
 <discovery>2019-05-09</discovery>
 <entry>2019-05-09</entry>
 </dates>
 </vuln>

<vuln vid="e66a5440-7258-11e9-b0e1-6cc21735f730">
 <topic>PostgreSQL -- Memory disclosure in partition routing</topic>
 <affects>
 <package>
	<name>postgresql11-server</name>
	<range><lt>11.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/about/news/1939/">
	 
	 Prior to this release, a user running PostgreSQL 11 can read
	 arbitrary bytes of server memory by executing a purpose-crafted
	 INSERT statement to a partitioned table.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.postgresql.org/about/news/1939/</url>
 <cvename>CVE-2019-10129</cvename>
 </references>
 <dates>
 <discovery>2019-05-09</discovery>
 <entry>2019-05-09</entry>
 </dates>
 </vuln>

<vuln vid="a1de4ae9-6fda-11e9-9ba0-4c72b94353b5">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.8.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitea Team reports:
	<blockquote cite="https://blog.gitea.io/2019/04/gitea-1.8.0-is-released">
	 This release contains two new security fixes which cannot be backported
	 to the 1.7.0 branch, so it is recommended to update to this version.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.io/2019/04/gitea-1.8.0-is-released/</url>
 </references>
 <dates>
 <discovery>2019-04-21</discovery>
 <entry>2019-05-06</entry>
 </dates>
 </vuln>

<vuln vid="3df5a920-6edc-11e9-a44b-0050562a4d7b">
 <topic>comms/hylafax -- Malformed fax sender remote code execution in JPEG support</topic>
 <affects>
 <package>
	<name>hylafax</name>
	<range><lt>6.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="ftp://ftp.hylafax.org/security/CVE-2018-17141.html">
	 A malicious sender that sets both JPEG and MH,MR,MMR or JBIG in
	 the same DCS signal or sends a large JPEG page could lead to remote code execution.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-17141</cvename>
 <url>ftp://ftp.hylafax.org/security/CVE-2018-17141.html</url>
 <url>https://www.x41-dsec.de/lab/advisories/x41-2018-008-hylafax/</url>
 <url>http://bugs.hylafax.org/show_bug.cgi?id=974</url>
 <url>http://git.hylafax.org/HylaFAX?a=commit;h=c6cac8d8cd0dbe313689ba77023e12bc5b3027be</url>
 </references>
 <dates>
 <discovery>2018-08-24</discovery>
 <entry>2019-05-05</entry>
 </dates>
 </vuln>

<vuln vid="4faac805-6be0-11e9-a685-001b217b3468">
 <topic>Gitlab -- Information Disclosure</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.10.0</ge><lt>11.10.3</lt></range>
	<range><ge>11.9.0</ge><lt>11.9.11</lt></range>
	<range><ge>11.8.0</ge><lt>11.8.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/04/30/security-release-gitlab-11-dot-10-dot-3-released/">
	 Information Disclosure with Limited Scope Token
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/04/30/security-release-gitlab-11-dot-10-dot-3-released/</url>
 <cvename>CVE-2019-11605</cvename>
 </references>
 <dates>
 <discovery>2019-04-30</discovery>
 <entry>2019-05-01</entry>
 </dates>
 </vuln>

<vuln vid="3f98ccb3-6b8a-11e9-9b5c-a4badb296695">
 <topic>Dovecot -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><ge>2.3.0</ge><lt>2.3.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aki Tuomi reports:
	<blockquote cite="https://dovecot.org/list/dovecot-news/2019-April/000409.html">
	 Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting. This can lead to denial-of-service attack by persistent attacker(s).
	</blockquote>
	Aki Tuomi reports:
	<blockquote cite="https://dovecot.org/list/dovecot-news/2019-April/000410.html">
	 Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent. This can lead to denial-of-service attack by persistent attacker(s).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://dovecot.org/list/dovecot-news/2019-April/000409.html</url>
 <cvename>CVE-2019-11494</cvename>
 <url>https://dovecot.org/list/dovecot-news/2019-April/000410.html</url>
 <cvename>CVE-2019-11499</cvename>
 </references>
 <dates>
 <discovery>2019-03-11</discovery>
 <entry>2019-04-30</entry>
 </dates>
 </vuln>

<vuln vid="1138b39e-6abb-11e9-a685-001b217b3468">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.10.0</ge><lt>11.10.2</lt></range>
	<range><ge>11.9.0</ge><lt>11.9.10</lt></range>
	<range><ge>6.0.0</ge><lt>11.8.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/">
	 Moving an Issue to Private Repo Leaks Project Namespace
	 Notification Emails Sent to Restricted Users
	 Unauthorized Comments on Confidential Issues
	 Merge Request Approval Count Inflation
	 Unsanitized Branch Names on New Merge Request Notification Emails
	 Improper Sanitation of Credentials in Gitaly
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/</url>
 <cvename>CVE-2019-11545</cvename>
 <cvename>CVE-2019-11544</cvename>
 <cvename>CVE-2019-11548</cvename>
 <cvename>CVE-2019-11546</cvename>
 <cvename>CVE-2019-11547</cvename>
 <cvename>CVE-2019-11549</cvename>
 </references>
 <dates>
 <discovery>2019-04-29</discovery>
 <entry>2019-04-29</entry>
 </dates>
 </vuln>

<vuln vid="5536ea5f-6814-11e9-a8f7-0050562a4d7b">
 <topic>buildbot -- CRLF injection in Buildbot login and logout redirect code</topic>
 <affects>
 <package>
	<name>py27-buildbot</name>
	<name>py35-buildbot</name>
	<name>py36-buildbot</name>
	<name>py37-buildbot</name>
	<range><lt>1.8.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://github.com/buildbot/buildbot/wiki/CRLF-injection-in-Buildbot-login-and-logout-redirect-code">
	 A CRLF can be injected in Location header of /auth/login and /auth/logout
	 This is due to lack of input validation in the buildbot redirection code.
	 
	 It was not found a way to impact Buildbot product own security through
	 this vulnerability, but it could be used to compromise other sites
	 hosted on the same domain as Buildbot.

- cookie injection a master domain (ie if your buildbot is on
		buildbot.buildbot.net, one can inject a cookie on *.buildbot.net,
		which could impact another website hosted in your domain)

- HTTP response splitting and cache poisoning (browser or proxy) are
		also typical impact of this vulnerability class, but might be impractical
		to exploit.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/buildbot/buildbot/wiki/CRLF-injection-in-Buildbot-login-and-logout-redirect-code</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7313</url>
 <cvename>CVE-2019-7313</cvename>
 </references>
 <dates>
 <discovery>2019-01-29</discovery>
 <entry>2019-04-26</entry>
 </dates>
 </vuln>

<vuln vid="2bad8b5d-66fb-11e9-9815-78acc0a3b880">
 <topic>drupal -- Drupal core - Moderately critical</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.66</lt></range>
 </package>
 <package>
	<name>drupal8</name>
	<range><lt>8.6.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/SA-CORE-2019-005">
	 CVE-2019-10909: Escape validation messages in the PHP templating engine.
	 CVE-2019-10910: Check service IDs are valid.
	 CVE-2019-10911: Add a separator in the remember me cookie hash.
	</blockquote>
	<blockquote cite="https://www.drupal.org/sa-core-2019-006">
	 jQuery 3.4.0 includes a fix for some unintended behavior when using
	 jQuery.extend(true, {}, ...). If an unsanitized source object contained
	 an enumerable __proto__ property, it could extend the native Object.prototype.
	 This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous
	 jQuery versions.

It's possible that this vulnerability is exploitable with some Drupal modules.
	 As a precaution, this Drupal security release backports the fix to jQuery.extend(),
	 without making any other changes to the jQuery version that is included in
	 Drupal core (3.2.1 for Drupal 8 and 1.4.4 for Drupal 7) or running on the site
	 via some other module such as jQuery Update.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/SA-CORE-2019-005</url>
 <url>https://www.drupal.org/SA-CORE-2019-006</url>
 </references>
 <dates>
 <discovery>2019-04-17</discovery>
 <entry>2019-04-25</entry>
 </dates>
 </vuln>

<vuln vid="f6ea18bb-65b9-11e9-8b31-002590045d9c">
 <topic>py-yaml -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>py27-yaml</name>
	<name>py35-yaml</name>
	<name>py36-yaml</name>
	<name>py37-yaml</name>
	<range><lt>4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	pyyaml reports:
	<blockquote cite="https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation">
	 the PyYAML.load function could be easily exploited to call any Python
	function. That means it could call any system command using os.system()
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-18342</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342</url>
 <url>https://github.com/yaml/pyyaml/pull/74</url>
 </references>
 <dates>
 <discovery>2018-06-27</discovery>
 <entry>2019-04-23</entry>
 </dates>
 </vuln>

<vuln vid="a207bbd8-6572-11e9-8e67-206a8a720317">
 <topic>FreeBSD -- EAP-pwd message reassembly issue with unexpected fragment</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.0</ge><lt>12.0_3</lt></range>
	<range><ge>11.2</ge><lt>11.2_9</lt></range>
 </package>
 <package>
	<name>wpa_supplicant</name>
	<range><lt>2.8</lt></range>
 </package>
 <package>
	<name>hostapd</name>
	<range><lt>2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	EAP-pwd implementation in hostapd (EAP server) and wpa_supplicant
	(EAP peer) does not to validate fragmentation reassembly state
	properly for a case where an unexpected fragment could be received.
	This could result in process termination due to NULL pointer
	dereference.
	See
	https://w1.fi/security/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt
	for a detailed description of the bug.
	<h1>Impact:</h1>
	All wpa_supplicant and hostapd versions with EAP-pwd support could
	suffer a denial of service attack through process termination.
 </body>
 </description>
 <references>
 <url>https://w1.fi/security/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt</url>
 </references>
 <dates>
 <discovery>2019-04-18</discovery>
 <entry>2019-04-23</entry>
 </dates>
 </vuln>

<vuln vid="2da3cb25-6571-11e9-8e67-206a8a720317">
 <topic>FreeBSD -- EAP-pwd missing commit validation</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.0</ge><lt>12.0_3</lt></range>
	<range><ge>11.2</ge><lt>11.2_9</lt></range>
 </package>
 <package>
	<name>wpa_supplicant</name>
	<range><lt>2.8</lt></range>
 </package>
 <package>
	<name>hostapd</name>
	<range><lt>2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	EAP-pwd implementation in hostapd (EAP server) and wpa_supplicant
	(EAP peer) does not to validate the received scalar and element values
	in EAP-pwd-Commit messages properly. This could result in attacks that
	would be able to complete EAP-pwd authentication exchange without the
	attacker having to know the used password.
	See
	https://w1.fi/security/2019-4/eap-pwd-missing-commit-validation.txt
	for a detailed description of the bug.
	<h1>Impact:</h1>
	All wpa_supplicant and hostapd versions with EAP-pwd support.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-9497</cvename>
 <cvename>CVE-2019-9498</cvename>
 <cvename>CVE-2019-9499</cvename>
 <freebsdsa>SA-19:03.wpa</freebsdsa>
 </references>
 <dates>
 <discovery>2019-04-10</discovery>
 <entry>2019-04-23</entry>
 <modified>2019-07-30</modified>
 </dates>
 </vuln>

<vuln vid="98b71436-656d-11e9-8e67-206a8a720317">
 <topic>FreeBSD -- SAE confirm missing state validation</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.0</ge><lt>12.0_3</lt></range>
	<range><ge>11.2</ge><lt>11.2_9</lt></range>
 </package>
 <package>
	<name>wpa_supplicant</name>
	<range><lt>2.8</lt></range>
 </package>
 <package>
	<name>hostapd</name>
	<range><lt>2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When hostapd is used to operate an access point with SAE
	(Simultaneous Authentication of Equals; also known as WPA3-Personal),
	an invalid authentication sequence could result in the hostapd process
	terminating due to a NULL pointer dereference when processing SAE
	confirm message. This was caused by missing state validation steps
	when processing the SAE confirm message in hostapd/AP mode.
	See
	https://w1.fi/security/2019-3/sae-confirm-missing-state-validation.txt
	for a detailed description of the bug.
	<h1>Impact:</h1>
	All hostapd versions with SAE support (CONFIG_SAE=y in the build
	configuration and SAE being enabled in the runtime configuration).
 </body>
 </description>
 <references>
 <cvename>CVE-2019-9496</cvename>
 </references>
 <dates>
 <discovery>2019-04-10</discovery>
 <entry>2019-04-23</entry>
 </dates>
 </vuln>

<vuln vid="60129efe-656d-11e9-8e67-206a8a720317">
 <topic>FreeBSD -- EAP-pwd side-channel attack</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.0</ge><lt>12.0_3</lt></range>
	<range><ge>11.2</ge><lt>11.2_9</lt></range>
 </package>
 <package>
	<name>wpa_supplicant</name>
	<range><lt>2.8</lt></range>
 </package>
 <package>
	<name>hostapd</name>
	<range><lt>2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Potential side channel attacks in the SAE implementations used
	by both hostapd and wpa_supplicant (see CVE-2019-9494 and VU#871675).
	EAP-pwd uses a similar design for deriving PWE from the password and
	while a specific attack against EAP-pwd is not yet known to be tested,
	there is no reason to believe that the EAP-pwd implementation would
	be immune against the type of cache attack that was identified for the
	SAE implementation. Since the EAP-pwd implementation in hostapd (EAP
	server) and wpa_supplicant (EAP peer) does not support MODP groups,
	the timing attack described against SAE is not applicable for the
	EAP-pwd implementation.
	See
	https://w1.fi/security/2019-2/eap-pwd-side-channel-attack.txt
	for a detailed description of the bug.
	<h1>Impact:</h1>
	All wpa_supplicant and hostapd versions with EAP-pwd support
	(CONFIG_EAP_PWD=y in the build configuration and EAP-pwd being enabled
	in the runtime configuration).
 </body>
 </description>
 <references>
 <cvename>CVE-2019-9495</cvename>
 </references>
 <dates>
 <discovery>2019-04-10</discovery>
 <entry>2019-04-23</entry>
 </dates>
 </vuln>

<vuln vid="7e53f9cc-656d-11e9-8e67-206a8a720317">
 <topic>FreeBSD -- SAE side-channel attacks</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.0</ge><lt>12.0_3</lt></range>
	<range><ge>11.2</ge><lt>11.2_9</lt></range>
 </package>
 <package>
	<name>wpa_supplicant</name>
	<range><lt>2.8</lt></range>
 </package>
 <package>
	<name>hostapd</name>
	<range><lt>2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Side channel attacks in the SAE implementations used by both
	hostapd (AP) and wpa_supplicant (infrastructure BSS station/mesh
	station). SAE (Simultaneous Authentication of Equals) is also known
	as WPA3-Personal. The discovered side channel attacks may be able to
	leak information about the used password based on observable timing
	differences and cache access patterns. This might result in full
	password recovery when combined with an offline dictionary attack and
	if the password is not strong enough to protect against dictionary
	attacks.
	See
	https://w1.fi/security/2019-1/sae-side-channel-attacks.txt
	for a detailed description of the bug.
	<h1>Impact:</h1>
	All wpa_supplicant and hostapd versions with SAE support
	(CONFIG_SAE=y in the build configuration and SAE being enabled in
	the runtime configuration).
 </body>
 </description>
 <references>
 <cvename>CVE-2019-9494</cvename>
 </references>
 <dates>
 <discovery>2019-04-10</discovery>
 <entry>2019-04-23</entry>
 </dates>
 </vuln>

<vuln vid="484d3f5e-653a-11e9-b0e3-1c39475b9f84">
 <topic>Istio -- Security vulnerabilities</topic>
 <affects>
 <package>
	<name>istio</name>
	<range><lt>1.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Istio reports:
	<blockquote cite="https://istio.io/blog/2019/announcing-1.1.2/#security-update">
	 Two security vulnerabilities have recently been identified in the Envoy proxy.
		The vulnerabilities are centered on the fact that Envoy did not normalize
		HTTP URI paths and did not fully validate HTTP/1.1 header values. These
		vulnerabilities impact Istio features that rely on Envoy to enforce any of
		authorization, routing, or rate limiting.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-9900</cvename>
 <cvename>CVE-2019-9901</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9900</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9901</url>
 <url>https://github.com/envoyproxy/envoy/issues/6434</url>
 <url>https://github.com/envoyproxy/envoy/issues/6435</url>
 </references>
 <dates>
 <discovery>2019-03-29</discovery>
 <entry>2019-04-22</entry>
 </dates>
 </vuln>

<vuln vid="5ed7102e-6454-11e9-9a3a-001cc0382b2f">
 <topic>Ghostscript -- Security bypass vulnerability</topic>
 <affects>
 <package>
	<name>ghostscript9-agpl-base</name>
	<name>ghostscript9-agpl-x11</name>
	<range><lt>9.27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cedric Buissart (Red Hat) reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3835">
	 It was found that the superexec operator was available in the
	 internal dictionary in ghostscript before 9.27. A specially crafted
	 PostScript file could use this flaw in order to, for example, have
	 access to the file system outside of the constrains imposed by
	 -dSAFER.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3838">
	 It was found that the forceput operator could be extracted from
	 the DefineResource method in ghostscript before 9.27. A specially
	 crafted PostScript file could use this flaw in order to, for
	 example, have access to the file system outside of the constrains
	 imposed by -dSAFER.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3835</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3838</url>
 <cvename>CVE-2019-3835</cvename>
 <cvename>CVE-2019-3838</cvename>
 </references>
 <dates>
 <discovery>2019-03-21</discovery>
 <entry>2019-04-21</entry>
 </dates>
 </vuln>

<vuln vid="fb30db8f-62af-11e9-b0de-001cc0382b2f">
 <topic>GnuTLS -- double free, invalid pointer access</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>3.6.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GnuTLS project reports:
	<blockquote cite="https://www.gnutls.org/security-new.html#GNUTLS-SA-2019-03-27">
	 <ul>
	 <li>Tavis Ormandy from Google Project Zero found a memory
	 corruption (double free) vulnerability in the certificate
	 verification API. Any client or server application that verifies
	 X.509 certificates with GnuTLS 3.5.8 or later is affected.</li>
	 <li>It was found using the TLS fuzzer tools that decoding a
	 malformed TLS1.3 asynchronous message can cause a server crash
	 via an invalid pointer access. The issue affects GnuTLS server
	 applications since 3.6.4.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.gnutls.org/security-new.html#GNUTLS-SA-2019-03-27</url>
 <cvename>CVE-2019-3829</cvename>
 <cvename>CVE-2019-3836</cvename>
 </references>
 <dates>
 <discovery>2019-03-27</discovery>
 <entry>2019-04-19</entry>
 </dates>
 </vuln>

<vuln vid="a64aa22f-61ec-11e9-85b9-a4badb296695">
 <topic>dovecot -- json encoder crash</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><ge>2.3.0</ge><lt>2.3.5.2</lt></range>
 </package>
 <package>
	<name>dovecot2</name>
	<range><ge>2.3.0</ge><lt>2.3.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aki Tuomi reports:
	<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2019-April/000407.html">
	 * CVE-2019-10691: Trying to login with 8bit username containing
 invalid UTF8 input causes auth process to crash if auth policy is
 enabled. This could be used rather easily to cause a DoS. Similar
 crash also happens during mail delivery when using invalid UTF8 in
 From or Subject header when OX push notification driver is used.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://dovecot.org/pipermail/dovecot-news/2019-April/000407.html</url>
 <cvename>CVE-2019-10691</cvename>
 </references>
 <dates>
 <discovery>2019-04-09</discovery>
 <entry>2019-04-18</entry>
 <modified>2019-05-26</modified>
 </dates>
 </vuln>

<vuln vid="6e58e1e9-2636-413e-9f84-4c0e21143628">
 <topic>libssh2 -- multiple issues</topic>
 <affects>
 <package>
	<name>libssh2</name>
	<range><lt>1.8.1,3</lt></range>
 </package>
 <package>
	<name>linux-c6-libssh2</name>
	<range><lt>1.4.2_7</lt></range>
 </package>
 <package>
	<name>linux-c7-libssh2</name>
	<range><lt>1.4.3_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libssh2 developers report:
	<blockquote cite="https://github.com/libssh2/libssh2/releases/tag/libssh2-1.8.1">
	 <ul>
	 <li>Defend against possible integer overflows in comp_method_zlib_decomp.</li>
	 <li>Defend against writing beyond the end of the payload in _libssh2_transport_read().</li>
	 <li>Sanitize padding_length - _libssh2_transport_read().</li>
	 <li>This prevents an underflow resulting in a potential out-of-bounds read if a server sends a too-large padding_length, possibly with malicious intent.</li>
	 <li>Prevent zero-byte allocation in sftp_packet_read() which could lead to an out-of-bounds read.</li>
	 <li>Check the length of data passed to sftp_packet_add() to prevent out-of-bounds reads.</li>
	 <li>Add a required_size parameter to sftp_packet_require et. al. to require callers of these functions to handle packets that are too short.</li>
	 <li>Additional length checks to prevent out-of-bounds reads and writes in _libssh2_packet_add().</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/libssh2/libssh2/releases/tag/libssh2-1.8.1</url>
 <url>https://libssh2.org/CVE-2019-3855.html</url>
 <url>https://libssh2.org/CVE-2019-3856.html</url>
 <url>https://libssh2.org/CVE-2019-3857.html</url>
 <url>https://libssh2.org/CVE-2019-3858.html</url>
 <url>https://libssh2.org/CVE-2019-3859.html</url>
 <url>https://libssh2.org/CVE-2019-3860.html</url>
 <url>https://libssh2.org/CVE-2019-3861.html</url>
 <url>https://libssh2.org/CVE-2019-3862.html</url>
 <url>https://libssh2.org/CVE-2019-3863.html</url>
 <cvename>CVE-2019-3855</cvename>
 <cvename>CVE-2019-3856</cvename>
 <cvename>CVE-2019-3857</cvename>
 <cvename>CVE-2019-3858</cvename>
 <cvename>CVE-2019-3859</cvename>
 <cvename>CVE-2019-3860</cvename>
 <cvename>CVE-2019-3861</cvename>
 <cvename>CVE-2019-3862</cvename>
 <cvename>CVE-2019-3863</cvename>
 </references>
 <dates>
 <discovery>2019-03-14</discovery>
 <entry>2019-04-18</entry>
 <modified>2019-07-07</modified>
 </dates>
 </vuln>

<vuln vid="b747783f-5fb6-11e9-b2ac-08002705f877">
 <topic>gitea -- remote code execution</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.7.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea team reports:
	<blockquote cite="https://blog.gitea.io/2019/04/gitea-1.7.6-is-released/">
	 Prevent remote code execution vulnerability with mirror repo URL settings.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.io/2019/04/gitea-1.7.6-is-released/</url>
 </references>
 <dates>
 <discovery>2019-04-13</discovery>
 <entry>2019-04-17</entry>
 </dates>
 </vuln>

<vuln vid="4e1997e8-5de0-11e9-b95c-b499baebfeaf">
 <topic>MySQL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb55-server</name>
	<range><lt>5.5.64</lt></range>
 </package>
 <package>
	<name>mariadb101-server</name>
	<range><lt>10.1.39</lt></range>
 </package>
 <package>
	<name>mariadb102-server</name>
	<range><lt>10.2.23</lt></range>
 </package>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.14</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.44</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.26</lt></range>
 </package>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.15</lt></range>
 </package>
 <package>
	<name>percona55-server</name>
	<range><lt>5.5.64</lt></range>
 </package>
 <package>
	<name>percona56-server</name>
	<range><lt>5.6.44</lt></range>
 </package>
 <package>
	<name>percona57-server</name>
	<range><lt>5.7.26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html">
	 Critical Patch Update Oracle MySQL Executive Summary
	 This Critical Patch Update contains 44 new security fixes for
	 Oracle MySQL. 3 of these vulnerabilities may be remotely exploitable
	 without authentication, i.e., may be exploited over a network without
	 requiring user credentials.
	 The Oracle MySQL products and versions affected by vulnerabilities
	 that are fixed in this Critical Patch Update are: MySQL Server, versions
	 5.6.43 and prior, 5.7.25 and prior, 8.0.15 and prior
	 Further details will be published by Oracle on 2019-04-16
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html</url>
 </references>
 <dates>
 <discovery>2019-04-13</discovery>
 <entry>2019-04-13</entry>
 </dates>
 </vuln>

<vuln vid="a737eb11-5cfc-11e9-ab87-8cec4bf8fcfb">
 <topic>wget -- security flaw in caching credentials passed as a part of the URL</topic>
 <affects>
 <package>
	<name>wget</name>
	<range><ge>1.19</ge><lt>1.20.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gynvael Coldwind reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20483">
	 
	 set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a
	 file's origin URL in the user.xdg.origin.url metadata attribute
	 of the extended attributes of the downloaded file, which allows
	 local users to obtain sensitive information (e.g., credentials
	 contained in the URL) by reading this attribute, as demonstrated
	 by getfattr. This also applies to Referer information in the
	 user.xdg.referrer.url metadata attribute.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20483</url>
 <cvename>CVE-2018-20483</cvename>
 </references>
 <dates>
 <discovery>2018-12-25</discovery>
 <entry>2019-04-12</entry>
 </dates>
 </vuln>

<vuln vid="a0602fa0-5c1c-11e9-abd6-001b217b3468">
 <topic>Gitlab -- Group Runner Registration Token Exposure</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.9.0</ge><lt>11.9.7</lt></range>
	<range><ge>11.8.0</ge><lt>11.8.7</lt></range>
	<range><ge>10.4.0</ge><lt>11.7.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/04/10/critical-security-release-gitlab-11-dot-9-dot-7-released/">
	 Group Runner Registration Token Exposure
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/04/10/critical-security-release-gitlab-11-dot-9-dot-7-released/</url>
 <cvename>CVE-2019-11000</cvename>
 </references>
 <dates>
 <discovery>2019-04-10</discovery>
 <entry>2019-04-11</entry>
 </dates>
 </vuln>

<vuln vid="8e9c3f5a-715b-4336-8d05-19babef55e9e">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.172</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.164.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://jenkins.io/security/advisory/2019-04-10/">
	 <h1>Description</h1>
	 <h5>(Medium) SECURITY-1289</h5>
	 Jenkins accepted cached legacy CLI authentication
	 <h5>(Medium) SECURITY-1327</h5>
	 XSS vulnerability in form validation button
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://jenkins.io/security/advisory/2019-04-10/</url>
 </references>
 <dates>
 <discovery>2019-04-10</discovery>
 <entry>2019-04-10</entry>
 </dates>
 </vuln>

<vuln vid="45d89773-5b64-11e9-80ed-d43d7ef03aa6">
 <topic>Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>32.0.0.171</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb19-19.html">
	 <ul>
	 <li>This update resolves a use-after-free vulnerability that
	 could lead to arbitrary code execution (CVE-2019-7096).</li>
	 <li>This update resolves an out-of-bounds read vulnerability that
	 could lead to information disclosure (CVE-2019-7108).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-7096</cvename>
 <cvename>CVE-2019-7108</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb19-19.html</url>
 </references>
 <dates>
 <discovery>2019-04-09</discovery>
 <entry>2019-04-10</entry>
 </dates>
 </vuln>

<vuln vid="84ce26c3-5769-11e9-abd6-001b217b3468">
 <topic>clamav -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.101.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Clamav reports:
	<blockquote cite="https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html">
	 An out-of-bounds heap read condition may occur when scanning PDF documents
	 An out-of-bounds heap read condition may occur when scanning PE files
	 An out-of-bounds heap write condition may occur when scanning OLE2 files
	 An out-of-bounds heap read condition may occur when scanning malformed PDF documents
	 A path-traversal write condition may occur as a result of improper input validation when scanning RAR archives
	 A use-after-free condition may occur as a result of improper error handling when scanning nested RAR archives
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html</url>
 <cvename>CVE-2019-1787</cvename>
 <cvename>CVE-2019-1789</cvename>
 <cvename>CVE-2019-1788</cvename>
 <cvename>CVE-2019-1786</cvename>
 <cvename>CVE-2019-1785</cvename>
 <cvename>CVE-2019-1798</cvename>
 </references>
 <dates>
 <discovery>2019-03-29</discovery>
 <entry>2019-04-05</entry>
 </dates>
 </vuln>

<vuln vid="da459dbc-5586-11e9-abd6-001b217b3468">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.9.0</ge><lt>11.9.4</lt></range>
	<range><ge>11.8.0</ge><lt>11.8.6</lt></range>
	<range><lt>11.7.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/">
	 DoS potential for regex in CI/CD refs
	 Related branches visible in issues for guests
	 Persistent XSS at merge request resolve conflicts
	 Improper authorization control "move issue"
	 Guest users of private projects have access to releases
	 DoS potential on project languages page
	 Recurity assessment: information exposure through timing discrepancy
	 Recurity assessment: loginState HMAC issues
	 Recurity assessment: open redirect
	 PDF.js vulnerable to CVE-2018-5158
	 IDOR labels of private projects/groups
	 EXIF geolocation data not stripped from uploaded images
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/</url>
 <cvename>CVE-2019-10640</cvename>
 <cvename>CVE-2019-10116</cvename>
 <cvename>CVE-2019-10111</cvename>
 <cvename>CVE-2019-10110</cvename>
 <cvename>CVE-2019-10115</cvename>
 <cvename>CVE-2019-10113</cvename>
 <cvename>CVE-2019-10114</cvename>
 <cvename>CVE-2019-10112</cvename>
 <cvename>CVE-2019-10117</cvename>
 <cvename>CVE-2018-5158</cvename>
 <cvename>CVE-2019-10108</cvename>
 <cvename>CVE-2019-10109</cvename>
 </references>
 <dates>
 <discovery>2019-04-01</discovery>
 <entry>2019-04-02</entry>
 </dates>
 </vuln>

<vuln vid="cf2105c6-551b-11e9-b95c-b499baebfeaf">
 <topic>Apache -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.39</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd Project reports:
	<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
	 Apache HTTP Server privilege escalation from modules' scripts
	 (CVE-2019-0211) (important)
	 mod_auth_digest access control bypass (CVE-2019-0217)
	 (important)
	 mod_ssl access control bypass (CVE-2019-0215) (important)
	 mod_http2, possible crash on late upgrade (CVE-2019-0197) (low)
	 mod_http2, read-after-free on a string compare (CVE-2019-0196)
	 (low)
	 Apache httpd URL normalization inconsistincy (CVE-2019-0220)
	 (low)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.apache.org/dist/httpd/CHANGES_2.4.39</url>
 <url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
 <cvename>CVE-2019-0211</cvename>
 <cvename>CVE-2019-0217</cvename>
 <cvename>CVE-2019-0215</cvename>
 <cvename>CVE-2019-0196</cvename>
 <cvename>CVE-2019-0220</cvename>
 </references>
 <dates>
 <discovery>2019-04-01</discovery>
 <entry>2019-04-02</entry>
 </dates>
 </vuln>

<vuln vid="6a0129bf-54ad-11e9-987c-1c39475b9f84">
 <topic>Kubectl -- Potential directory traversal</topic>
 <affects>
 <package>
	<name>kubectl</name>
	<range><lt>1.11.9</lt></range>
	<range><ge>1.12.0</ge><lt>1.12.7</lt></range>
	<range><ge>1.13.0</ge><lt>1.13.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kubernetes.io reports:
	<blockquote cite="https://discuss.kubernetes.io/t/announce-security-release-of-kubernetes-kubectl-potential-directory-traversal-releases-1-11-9-1-12-7-1-13-5-and-1-14-0-cve-2019-1002101/5712">
	 A security issue was discovered with the Kubernetes kubectl cp
		command that could enable a directory traversal replacing or
		deleting files on a user’s workstation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-1002101</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-1002101</url>
 </references>
 <dates>
 <discovery>2019-03-28</discovery>
 <entry>2019-04-01</entry>
 </dates>
 </vuln>

<vuln vid="b22d6d4c-53b9-11e9-9310-28d244aee256">
 <topic>znc -- Denial of Service</topic>
 <affects>
 <package>
	<name>znc</name>
	<range><lt>1.7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9917">
	 ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial
	 of Service (crash) via invalid encoding.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-9917</cvename>
 <url>https://wiki.znc.in/ChangeLog/1.7.3</url>
 </references>
 <dates>
 <discovery>2019-03-21</discovery>
 <entry>2019-03-31</entry>
 </dates>
 </vuln>

<vuln vid="fe7e322f-522d-11e9-98b5-216e512dad89">
 <topic>Jupyter notebook -- open redirect vulnerability</topic>
 <affects>
 <package>
	<name>py27-notebook</name>
	<name>py35-notebook</name>
	<name>py36-notebook</name>
	<name>py37-notebook</name>
	<range><lt>5.7.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jupyter blog:
	<blockquote cite="https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4">
	 Login pages tend to take a parameter for redirecting back to a page
	 after successful login, e.g. /login?next=/notebooks/mynotebook.ipynb, so
	 that you aren't disrupted too much if you try to visit a page, but have
	 to authenticate first. An Open Redirect Vulnerability is when a
	 malicious person crafts a link pointing to the login page of a trusted
	 site, but setting the "redirect after successful login" parameter to
	 send the user to their own site, instead of a page on the authenticated
	 site (the notebook or JupyterHub server), e.g.
	 /login?next=http://badwebsite.biz. This doesn't necessarily compromise
	 anything immediately, but it enables phishing if users don't notice
	 that the domain has changed, e.g. by showing a fake "re-enter your
	 password" page. Servers generally have to validate the redirect URL to
	 avoid this. Both JupyterHub and Notebook already do this, but the
	 validation didn't take into account all possible ways to redirect to
	 other sites, so some malicious URLs could still be crafted to redirect
	 away from the server (the above example does not work in any recent
	 version of either package). Only certain browsers (Chrome and Firefox,
	 not Safari) could be redirected from the JupyterHub login page, but all
	 browsers could be redirected away from a standalone notebook server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4</url>
 <url>https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst</url>
 <cvename>CVE-2019-10255</cvename>
 </references>
 <dates>
 <discovery>2019-03-28</discovery>
 <entry>2019-03-29</entry>
 <modified>2019-04-06</modified>
 </dates>
 </vuln>

<vuln vid="7862213c-5152-11e9-8b26-a4badb296695">
 <topic>dovecot -- Buffer overflow reading extension header</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><lt>2.3.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aki Tuomi reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-7524">
	 Vulnerability Details:
When reading FTS or POP3-UIDL header from dovecot index, the input
buffer size is not bound, and data is copied to target structure causing
stack overflow.

Risk:
This can be used for local root privilege escalation or executing
arbitrary code in dovecot process context. This requires ability to
directly modify dovecot indexes.
Steps to reproduce:
Produce dovecot.index.log entry that creates an FTS header which has
more than 12 bytes of data.
Trigger dovecot indexer-worker or run doveadm index.
Dovecot will crash.

Mitigations:
Since 2.3.0 dovecot has been compiled with stack smash protection, ASLR,
read-only GOT tables and other techniques that make exploiting this bug
much harder.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-7524</url>
 <url>https://dovecot.org/list/dovecot-news/2019-March/000401.html</url>
 <cvename>CVE-2019-7524</cvename>
 </references>
 <dates>
 <discovery>2019-02-05</discovery>
 <entry>2019-03-28</entry>
 </dates>
 </vuln>

<vuln vid="94d63fd7-508b-11e9-9ba0-4c72b94353b5">
 <topic>drupal -- Drupal core - Moderately critical - Cross Site Scripting</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.65</lt></range>
 </package>
 <package>
	<name>drupal8</name>
	<range><lt>8.6.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/SA-CORE-2019-004">
	 Under certain circumstances the File module/subsystem allows a malicious
	 user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/project/drupal/releases/8.6.13</url>
 <url>https://www.drupal.org/project/drupal/releases/7.65</url>
 <url>https://www.drupal.org/SA-CORE-2019-004</url>
 <cvename>CVE-2019-6341</cvename>
 </references>
 <dates>
 <discovery>2019-03-20</discovery>
 <entry>2019-03-27</entry>
 <modified>2019-03-28</modified>
 </dates>
 </vuln>

<vuln vid="d74371d2-4fee-11e9-a5cd-1df8a848de3d">
 <topic>Python -- NULL pointer dereference vulnerability</topic>
 <affects>
 <package>
	<name>python27</name>
	<range><lt>2.7.16</lt></range>
 </package>
 <package>
	<name>python35</name>
	<range><lt>3.5.7</lt></range>
 </package>
 <package>
	<name>python36</name>
	<range><lt>3.6.8_1</lt></range>
 </package>
 <package>
	<name>python37</name>
	<range><lt>3.7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python Changelog:
	<blockquote cite="https://docs.python.org/3.7/whatsnew/changelog.html">
	 bpo-35746: [CVE-2019-5010] Fix a NULL pointer deref in ssl module. The
	 cert parser did not handle CRL distribution points with empty DP or URI
	 correctly. A malicious or buggy certificate can result into segfault.
	 Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas Edet
	 of Cisco.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.python.org/3.7/whatsnew/changelog.html</url>
 <url>https://bugs.python.org/issue35746</url>
 <cvename>CVE-2019-5010</cvename>
 </references>
 <dates>
 <discovery>2019-01-15</discovery>
 <entry>2019-03-26</entry>
 <modified>2019-03-27</modified>
 </dates>
 </vuln>

<vuln vid="15ee0e93-4bbb-11e9-9ba0-4c72b94353b5">
 <topic>wordpress -- multiple issues</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>5.1.1,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>zh_CN-wordpress</name>
	<name>zh_TW-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<range><lt>5.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wordpress developers reports:
	<blockquote cite="https://wordpress.org/news/2019/03/wordpress-5-1-1-security-and-maintenance-release/">
	 Hosts can now offer a button for their users to update PHP.
	 The recommended PHP version used by the Update PHP notice can now be filtered.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2019/03/wordpress-5-1-1-security-and-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2019-03-12</discovery>
 <entry>2019-03-21</entry>
 </dates>
 </vuln>

<vuln vid="e0382fde-4bb0-11e9-adcb-001b217b3468">
 <topic>Gitlab -- Vulnerability</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.8.0</ge><lt>11.8.3</lt></range>
	<range><lt>11.7.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/03/20/critical-security-release-gitlab-11-dot-8-dot-3-released/">
	 Project Runner Token Exposed Through Issues Quick Actions
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/03/20/critical-security-release-gitlab-11-dot-8-dot-3-released/</url>
 <cvename>CVE-2019-9866</cvename>
 </references>
 <dates>
 <discovery>2019-03-20</discovery>
 <entry>2019-03-21</entry>
 </dates>
 </vuln>

<vuln vid="1b6a10e9-4b7b-11e9-9e89-54e1ad3d6335">
 <topic>libXdmcp -- insufficient entropy generating session keys</topic>
 <affects>
 <package>
	<name>libXdmcp</name>
	<range><lt>1.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The freedesktop and x.org project reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-2625">
	 It was discovered that libXdmcp before 1.1.3 used weak
	 entropy to generate session keys on platforms without
	 arc4random_buf() but with getentropy(). On a multi-user system using
	 xdmcp, a local attacker could potentially use information available
	 from the process list to brute force the key, allowing them to
	 hijack other users' sessions.
	 Please note, that since FreeBSD provides arc4random_buf(), it is
	 unknown if FreeBSD is affected by this vulnerability
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-2625</url>
 <url>https://lists.x.org/archives/xorg-announce/2019-March/002974.html</url>
 <cvename>CVE-2017-2625</cvename>
 </references>
 <dates>
 <discovery>2017-04-04</discovery>
 <entry>2019-03-21</entry>
 <modified>2019-03-22</modified>
 </dates>
 </vuln>

<vuln vid="7ba5a3d0-4b18-11e9-adcb-001b217b3468">
 <topic>Gitlab -- Vulnerability</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><lt>11.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/03/14/gitlab-11-8-2-released/">
	 Public project in a private group makes the group page publicly accessible
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/03/14/gitlab-11-8-2-released/</url>
 <cvename>CVE-2019-9732</cvename>
 </references>
 <dates>
 <discovery>2019-03-14</discovery>
 <entry>2019-03-20</entry>
 </dates>
 </vuln>

<vuln vid="a8ba7358-4b02-11e9-9ba0-4c72b94353b5">
 <topic>gitea -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.7.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitea Team reports:
	<blockquote cite="https://blog.gitea.io/2019/03/gitea-1.7.4-is-released/">
	 Fix potential XSS vulnerability in repository description.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.gitea.io/2019/03/gitea-1.7.4-is-released/</url>
 </references>
 <dates>
 <discovery>2019-03-12</discovery>
 <entry>2019-03-20</entry>
 </dates>
 </vuln>

<vuln vid="05da6b56-3e66-4306-9ea3-89fafe939726">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>66.0_3,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.2.9</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.53.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>60.6.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>60.6.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>60.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/">
	 CVE-2019-9790: Use-after-free when removing in-use DOM elements
	 CVE-2019-9791: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey
	 CVE-2019-9792: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script
	 CVE-2019-9793: Improper bounds checks when Spectre mitigations are disabled
	 CVE-2019-9794: Command line arguments not discarded during execution
	 CVE-2019-9795: Type-confusion in IonMonkey JIT compiler
	 CVE-2019-9796: Use-after-free with SMIL animation controller
	 CVE-2019-9797: Cross-origin theft of images with createImageBitmap
	 CVE-2019-9798: Library is loaded from world writable APITRACE_LIB location
	 CVE-2019-9799: Information disclosure via IPC channel messages
	 CVE-2019-9801: Windows programs that are not 'URL Handlers' are exposed to web content
	 CVE-2019-9802: Chrome process information leak
	 CVE-2019-9803: Upgrade-Insecure-Requests incorrectly enforced for same-origin navigation
	 CVE-2019-9804: Code execution through 'Copy as cURL' in Firefox Developer Tools on macOS
	 CVE-2019-9805: Potential use of uninitialized memory in Prio
	 CVE-2019-9806: Denial of service through successive FTP authorization prompts
	 CVE-2019-9807: Text sent through FTP connection can be incorporated into alert messages
	 CVE-2019-9809: Denial of service through FTP modal alert error messages
	 CVE-2019-9808: WebRTC permissions can display incorrect origin with data: and blob: URLs
	 CVE-2019-9789: Memory safety bugs fixed in Firefox 66
	 CVE-2019-9788: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-9788</cvename>
 <cvename>CVE-2019-9789</cvename>
 <cvename>CVE-2019-9790</cvename>
 <cvename>CVE-2019-9791</cvename>
 <cvename>CVE-2019-9792</cvename>
 <cvename>CVE-2019-9793</cvename>
 <cvename>CVE-2019-9794</cvename>
 <cvename>CVE-2019-9795</cvename>
 <cvename>CVE-2019-9796</cvename>
 <cvename>CVE-2019-9797</cvename>
 <cvename>CVE-2019-9798</cvename>
 <cvename>CVE-2019-9799</cvename>
 <cvename>CVE-2019-9801</cvename>
 <cvename>CVE-2019-9802</cvename>
 <cvename>CVE-2019-9803</cvename>
 <cvename>CVE-2019-9804</cvename>
 <cvename>CVE-2019-9805</cvename>
 <cvename>CVE-2019-9806</cvename>
 <cvename>CVE-2019-9807</cvename>
 <cvename>CVE-2019-9808</cvename>
 <cvename>CVE-2019-9809</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2019-07/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2019-08/</url>
 </references>
 <dates>
 <discovery>2019-03-19</discovery>
 <entry>2019-03-19</entry>
 <modified>2019-07-23</modified>
 </dates>
 </vuln>

<vuln vid="6001cfc6-9f0f-4fae-9b4f-9b8fae001425">
 <topic>PowerDNS -- Insufficient validation in the HTTP remote backend</topic>
 <affects>
 <package>
	<name>powerdns</name>
	<range><lt>4.1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS developers report:
	<blockquote cite="https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.html">
	 An issue has been found in PowerDNS Authoritative Server when the HTTP remote backend is used in RESTful mode (without post=1 set), allowing a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one, via a crafted DNS query. This can be used to cause a denial of service by preventing the remote backend from getting a response, content spoofing if the attacker can time its own query so that subsequent queries will use an attacker-controlled HTTP server instead of the configured one, and possibly information disclosure if the Authoritative Server has access to internal servers.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.html</url>
 <cvename>CVE-2019-3871</cvename>
 </references>
 <dates>
 <discovery>2019-03-18</discovery>
 <entry>2019-03-19</entry>
 </dates>
 </vuln>

<vuln vid="1396a74a-4997-11e9-b5f1-83edb3f89ba1">
 <topic>Rails -- Action View vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-actionview4</name>
	<range><lt>4.2.11.1</lt></range>
 </package>
 <package>
	<name>rubygem-actionview50</name>
	<range><lt>5.0.7.2</lt></range>
 </package>
 <package>
	<name>rubygem-actionview5</name>
	<range><lt>5.1.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails blog:
	<blockquote cite="https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/">
	 Rails 4.2.11.1, 5.0.7.2, 5.1.6.2, 5.2.2.1, and 6.0.0.beta3 have been released! These contain the following important security fixes. It is recommended that users upgrade as soon as possible:
	 CVE-2019-5418 File Content Disclosure in Action View
	 CVE-2019-5419 Denial of Service Vulnerability in Action View
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/</url>
 <cvename>CVE-2019-5418</cvename>
 <cvename>CVE-2019-5419</cvename>
 </references>
 <dates>
 <discovery>2019-03-13</discovery>
 <entry>2019-03-18</entry>
 </dates>
 </vuln>

<vuln vid="46e1ece5-48bd-11e9-9c40-080027ac955c">
 <topic>PuTTY -- security fixes in new release</topic>
 <affects>
 <package>
	<name>putty</name>
	<range><lt>0.71</lt></range>
 </package>
 <package>
	<name>putty-gtk2</name>
	<range><lt>0.71</lt></range>
 </package>
 <package>
	<name>putty-nogtk</name>
	<range><lt>0.71</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PuTTY team reports:
	<blockquote cite="https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html">
	 New in 0.71:
	 <ul>
	 <li>Security fixes found by an EU-funded bug bounty programme:</li>
	 <li>+ a remotely triggerable memory overwrite in RSA key exchange, which can occur before host key verification</li>
	 <li>+ potential recycling of random numbers used in cryptography</li>
	 <li>+ on Unix, remotely triggerable buffer overflow in any kind of server-to-client forwarding</li>
	 <li>+ multiple denial-of-service attacks that can be triggered by writing to the terminal</li>
	 <li>Other security enhancements: major rewrite of the crypto code to remove cache and timing side channels.</li>
	 <li>User interface changes to protect against fake authentication prompts from a malicious server.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html</url>
 </references>
 <dates>
 <discovery>2019-03-16</discovery>
 <entry>2019-03-17</entry>
 </dates>
 </vuln>

<vuln vid="72a6e3be-483a-11e9-92d7-f1590402501e">
 <topic>Jupyter notebook -- cross-site inclusion (XSSI) vulnerability</topic>
 <affects>
 <package>
	<name>py27-notebook</name>
	<name>py35-notebook</name>
	<name>py36-notebook</name>
	<name>py37-notebook</name>
	<range><lt>5.7.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jupyter notebook Changelog:
	<blockquote cite="https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst">
	 5.7.6 contains a security fix for a cross-site inclusion (XSSI)
	 vulnerability, where files at a known URL could be included in a page
	 from an unauthorized website if the user is logged into a Jupyter
	 server. The fix involves setting the X-Content-Type-Options: nosniff
	 header, and applying CSRF checks previously on all non-GET API requests
	 to GET requests to API endpoints and the /files/ endpoint.
	 The attacking page is able to access some contents of files when using
	 Internet Explorer through script errors, but this has not been
	 demonstrated with other browsers. A CVE has been requested for this
	 vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst</url>
 <url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-auth-prompt-spoofing.html</url>
 <url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-fd-set-overflow.html</url>
 <url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rng-reuse.html</url>
 <url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rsa-kex-integer-overflow.html</url>
 <url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terminal-dos-combining-chars.html</url>
 <url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terminal-dos-combining-chars-double-width-gtk.html</url>
 <url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terminal-dos-one-column-cjk.html</url>
 <url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/pscp-unsanitised-server-output.html</url>
 <url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/side-channels.html</url>
 </references>
 <dates>
 <discovery>2019-03-10</discovery>
 <entry>2019-03-16</entry>
 </dates>
 </vuln>

<vuln vid="27b12d04-4722-11e9-8b7c-b5e01141761f">
 <topic>RubyGems -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ruby23-gems</name>
	<name>ruby24-gems</name>
	<name>ruby25-gems</name>
	<range><lt>3.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RubyGems Security Advisories:
	<blockquote cite="https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html">
	 CVE-2019-8320: Delete directory using symlink when decompressing tar
	 CVE-2019-8321: Escape sequence injection vulnerability in 'verbose'
	 CVE-2019-8322: Escape sequence injection vulnerability in 'gem owner'
	 CVE-2019-8323: Escape sequence injection vulnerability in API response handling
	 CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution
	 CVE-2019-8325: Escape sequence injection vulnerability in errors
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html</url>
 <url>https://github.com/rubygems/rubygems/blob/master/History.txt</url>
 <cvename>CVE-2019-8320</cvename>
 <cvename>CVE-2019-8321</cvename>
 <cvename>CVE-2019-8322</cvename>
 <cvename>CVE-2019-8323</cvename>
 <cvename>CVE-2019-8324</cvename>
 <cvename>CVE-2019-8325</cvename>
 </references>
 <dates>
 <discovery>2019-03-05</discovery>
 <entry>2019-03-15</entry>
 </dates>
 </vuln>

<vuln vid="e56f2f7c-410e-11e9-b95c-b499baebfeaf">
 <topic>OpenSSL -- ChaCha20-Poly1305 nonce vulnerability</topic>
 <affects>
 <package>
	<name>openssl111</name>
	<range><lt>1.1.1b_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20190306.txt">
	 Low: ChaCha20-Poly1305 with long nonces (CVE-2019-1543)
	 ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce
	 input for every encryption operation. RFC 7539 specifies that the nonce
	 value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce
	 length and front pads the nonce with 0 bytes if it is less than 12 bytes.
	 However it also incorrectly allows a nonce to be set of up to 16 bytes.
	 In this case only the last 12 bytes are significant and any additional
	 leading bytes are ignored.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20190306.txt</url>
 <cvename>CVE-2019-1543</cvename>
 </references>
 <dates>
 <discovery>2019-03-06</discovery>
 <entry>2019-03-07</entry>
 </dates>
 </vuln>

<vuln vid="c2576e14-36e2-11e9-9eda-206a8a720317">
 <topic>ntp -- Crafted null dereference attack from a trusted source with an authenticated mode 6 packet</topic>
 <affects>
 <package>
	<name>ntp</name>
	<range><lt>4.2.8p13</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.0</ge><lt>12.0_2</lt></range>
	<range><ge>11.2</ge><lt>11.2_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Network Time Foundation reports:
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#March_2019_ntp_4_2_8p13_NTP_Rele">
	 A crafted malicious authenticated mode 6 (ntpq) packet from a
	 permitted network address can trigger a NULL pointer dereference,
	 crashing ntpd.
	 Note that for this attack to work, the sending
	 system must be on an address that the target's ntpd accepts mode 6
	 packets from, and must use a private key that is specifically
	 listed as being used for mode 6 authorization.
	 Impact: The ntpd daemon can crash due to the NULL pointer
	 dereference, causing a denial of service.
	 Mitigation:
	 <ul>
	 <li>Use restrict noquery to limit addresses that can send mode 6
	 queries.</li>
	 <li>Limit access to the private controlkey in ntp.keys.</li>
	 <li>Upgrade to 4.2.8p13, or later.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://bugs.ntp.org/3565</url>
 <url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8936</url>
 <url>https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?vector=(AV:N/AC:H/Au:M/C:N/I:N/A:C)</url>
 <url>https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H</url>
 <cvename>CVE-2019-8936</cvename>
 <freebsdsa>SA-19:04.ntp</freebsdsa>
 </references>
 <dates>
 <discovery>2019-01-15</discovery>
 <entry>2019-03-07</entry>
 <modified>2019-07-30</modified>
 </dates>
 </vuln>

<vuln vid="d193aa9f-3f8c-11e9-9a24-6805ca0b38e8">
 <topic>rssh - multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>rssh</name>
 <range><lt>2.3.4_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 NVD reports:
 <blockquote cite="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&amp;cves=on&amp;cpe_version=cpe%3a%2fa%3apizzashack%3arssh%3a2.3.4">
	rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.
	Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/search/results?form_type=Advanced&amp;cves=on&amp;cpe_version=cpe%3a%2fa%3apizzashack%3arssh%3a2.3.4</url>
 <cvename>CVE-2019-1000018</cvename>
 <cvename>CVE-2019-3463</cvename>
 <cvename>CVE-2019-3464</cvename>
 </references>
 <dates>
 <discovery>2019-02-04</discovery>
 <entry>2019-03-06</entry>
 </dates>
 </vuln>

<vuln vid="416ca0f4-3fe0-11e9-bbdd-6805ca0b3d42">
 <topic>rt -- XSS via jQuery</topic>
 <affects>
 <package>
	<name>rt42</name>
	<range><ge>4.2.0</ge><lt>4.2.16</lt></range>
 </package>
 <package>
	<name>rt44</name>
	<range><ge>4.4.0</ge><lt>4.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	BestPractical reports:
	<blockquote cite="https://docs.bestpractical.com/release-notes/rt/4.4.4">

The version of jQuery used in RT 4.2 and 4.4 has a
	 Cross-site Scripting (XSS) vulnerability when using
	 cross-domain Ajax requests. This vulnerability is assigned
	 <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9251">CVE-2015-9251</a>. RT
	 does not use this jQuery feature so it is not directly
	 vulnerable. jQuery version 1.12 no longer receives official
	 updates, however a fix was posted with recommendations for
	 applications to patch locally, so RT will follow this
	 recommendation and ship with a patched version.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.bestpractical.com/release-notes/rt/4.4.4</url>
 <url>https://docs.bestpractical.com/release-notes/rt/4.2.16</url>
 <cvename>CVE-2015-9251</cvename>
 </references>
 <dates>
 <discovery>2019-03-05</discovery>
 <entry>2019-03-06</entry>
 </dates>
 </vuln>

<vuln vid="526d9642-3ae7-11e9-a669-8c164582fbac">
 <topic>slixmpp -- improper access control</topic>
 <affects>
 <package>
	<name>py35-slixmpp</name>
	<name>py36-slixmpp</name>
	<name>py37-slixmpp</name>
	<range><lt>1.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-1000021">
	 slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416
	 contains an incorrect Access Control vulnerability in XEP-0223 plugin
	 (Persistent Storage of Private Data via PubSub) options profile, used
	 for the configuration of default access model that can result in
	 all of the contacts of the victim can see private data having been
	 published to a PEP node. This attack appears to be exploitable
	 if the user of this library publishes any private data on PEP,
	 the node isn't configured to be private. This vulnerability appears
	 to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416
	 which is included in slixmpp 1.4.2.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-1000021</url>
 <cvename>CVE-2019-1000021</cvename>
 </references>
 <dates>
 <discovery>2019-02-04</discovery>
 <entry>2019-03-05</entry>
 </dates>
 </vuln>

<vuln vid="11292460-3f2f-11e9-adcb-001b217b3468">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.8.0</ge><lt>11.8.1</lt></range>
	<range><ge>11.7.0</ge><lt>11.7.6</lt></range>
	<range><ge>2.9.0</ge><lt>11.6.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/">
	 Arbitrary file read via MergeRequestDiff
	 CSRF add Kubernetes cluster integration
	 Blind SSRF in prometheus integration
	 Merge request information disclosure
	 IDOR milestone name information disclosure
	 Burndown chart information disclosure
	 Private merge request titles in public project information disclosure
	 Private namespace disclosure in email notification when issue is moved
	 Milestone name disclosure
	 Issue board name disclosure
	 NPM automatic package referencer
	 Path traversal snippet mover
	 Information disclosure repo existence
	 Issue DoS via Mermaid
	 Privilege escalation impersonate user
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/</url>
 <cvename>CVE-2019-9221</cvename>
 <cvename>CVE-2019-9176</cvename>
 <cvename>CVE-2019-9174</cvename>
 <cvename>CVE-2019-9172</cvename>
 <cvename>CVE-2019-9170</cvename>
 <cvename>CVE-2019-9175</cvename>
 <cvename>CVE-2019-9178</cvename>
 <cvename>CVE-2019-9179</cvename>
 <cvename>CVE-2019-9171</cvename>
 <cvename>CVE-2019-9224</cvename>
 <cvename>CVE-2019-9225</cvename>
 <cvename>CVE-2019-9219</cvename>
 <cvename>CVE-2019-9217</cvename>
 <cvename>CVE-2019-9222</cvename>
 <cvename>CVE-2019-9223</cvename>
 <cvename>CVE-2019-9220</cvename>
 <cvename>CVE-2019-9485</cvename>
 </references>
 <dates>
 <discovery>2019-03-04</discovery>
 <entry>2019-03-05</entry>
 </dates>
 </vuln>

<vuln vid="a3e24de7-3f0c-11e9-87d1-00012e582166">
 <topic>py-gunicorn -- CWE-113 vulnerability</topic>
 <affects>
 <package>
	<name>py27-gunicorn</name>
	<name>py35-gunicorn</name>
	<name>py36-gunicorn</name>
	<name>py37-gunicorn</name>
	<range><lt>19.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Everardo reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000164">
	 gunicorn version 19.4.5 contains a CWE-113: Improper
	 Neutralization of CRLF Sequences in HTTP Headers vulnerability
	 in process_headers function in gunicorn/http/wsgi.py
	 that can result in an attacker causing the server to
	 return arbitrary HTTP headers.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-1000164</cvename>
 <url>https://epadillas.github.io/2018/04/02/http-header-splitting-in-gunicorn-19.4.5</url>
 </references>
 <dates>
 <discovery>2018-04-02</discovery>
 <entry>2019-03-05</entry>
 </dates>
 </vuln>

<vuln vid="b71d7193-3c54-11e9-a3f9-00155d006b02">
 <topic>Node.js -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>node</name>
	<range><lt>11.10.1</lt></range>
 </package>
 <package>
	<name>node10</name>
	<range><lt>10.15.2</lt></range>
 </package>
 <package>
	<name>node8</name>
	<range><lt>8.15.1</lt></range>
 </package>
 <package>
	<name>node6</name>
	<range><lt>6.17.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/">
	 Updates are now available for all active Node.js release lines. In addition to fixes for security flaws in Node.js, they also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2r which contains a fix for a moderate severity security vulnerability.
	 For these releases, we have decided to withhold the fix for the Misinterpretation of Input (CWE-115) flaw mentioned in the original announcement. This flaw is very low severity and we are not satisfied that we had a complete and stable fix ready for release. We will be seeking to address this flaw via alternate mechanisms in the near future. In addition, we have introduced an additional CVE for a change in Node.js 6 that we have decided to classify as a Denial of Service (CWE-400) flaw.
	 We recommend that all Node.js users upgrade to a version listed below as soon as possible.
	 <h1>OpenSSL: 0-byte record padding oracle (CVE-2019-1559)</h1>
	 OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only. Node.js 10 and 11 are not impacted by this vulnerability as they use newer versions of OpenSSL which do not contain the flaw.
	 Under certain circumstances, a TLS server can be forced to respond differently to a client if a zero-byte record is received with an invalid padding compared to a zero-byte record with an invalid MAC. This can be used as the basis of a padding oracle attack to decrypt data.
	 Only TLS connections using certain ciphersuites executing under certain conditions are exploitable. We are currently unable to determine whether the use of OpenSSL in Node.js exposes this vulnerability. We are taking a cautionary approach and recommend the same for users. For more information, see the advisory and a detailed write-up by the reporters of the vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/</url>
 <cvename>CVE-2019-5737</cvename>
 <cvename>CVE-2019-5739</cvename>
 <cvename>CVE-2019-1559</cvename>
 </references>
 <dates>
 <discovery>2019-02-28</discovery>
 <entry>2019-03-03</entry>
 </dates>
 </vuln>

<vuln vid="395ed9d5-3cca-11e9-9ba0-4c72b94353b5">
 <topic>mybb -- vulnerabilities</topic>
 <affects>
 <package>
	<name>mybb</name>
	<range><lt>1.8.20_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mybb Team reports:
	<blockquote cite="https://blog.mybb.com/2019/02/27/mybb-1-8-20-released-security-maintenance-release/">
	 Medium risk: Reset Password reflected XSS
	 Medium risk: ModCP Profile Editor username reflected XSS
	 Low risk: Predictable CSRF token for guest users
	 Low risk: ACP Stylesheet Properties XSS
	 Low risk: Reset Password username enumeration via email
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.mybb.com/2019/02/27/mybb-1-8-20-released-security-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2019-02-27</discovery>
 <entry>2019-03-02</entry>
 <modified>2019-03-04</modified>
 </dates>
 </vuln>

<vuln vid="be0e3817-3bfe-11e9-9cd6-001999f8d30b">
 <topic>asterisk -- Remote crash vulnerability with SDP protocol violation</topic>
 <affects>
 <package>
	<name>asterisk15</name>
	<range><lt>15.7.2</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><lt>16.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 When Asterisk makes an outgoing call, a very specific
	 SDP protocol violation by the remote party can cause
	 Asterisk to crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2019-001.html</url>
 <cvename>CVE-2019-7251</cvename>
 </references>
 <dates>
 <discovery>2019-01-24</discovery>
 <entry>2019-03-01</entry>
 </dates>
 </vuln>

<vuln vid="e3aacd6d-3d01-434c-9330-bc9efd40350f">
 <topic>webkit-gtk -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>webkit2-gtk3</name>
	<range><lt>2.22.6</lt></range>
 </package>
 <package>
	<name>webkit-gtk2</name>
	<name>webkit-gtk3</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Webkitgtk project reports:
	<blockquote cite="https://webkitgtk.org/security/WSA-2019-0001.html">
	 CVE-2019-6212 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
	 CVE-2019-6215 - Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.
	 CVE-2019-6216 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
	 CVE-2019-6217 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
	 CVE-2019-6226 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
	 CVE-2019-6227 - Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
	 CVE-2019-6229 - Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation.
	 CVE-2019-6233 - Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
	 CVE-2019-6234 - Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://webkitgtk.org/security/WSA-2019-0001.html</url>
 <cvename>CVE-2019-6212</cvename>
 <cvename>CVE-2019-6215</cvename>
 <cvename>CVE-2019-6216</cvename>
 <cvename>CVE-2019-6217</cvename>
 <cvename>CVE-2019-6226</cvename>
 <cvename>CVE-2019-6227</cvename>
 <cvename>CVE-2019-6229</cvename>
 <cvename>CVE-2019-6233</cvename>
 <cvename>CVE-2019-6234</cvename>
 </references>
 <dates>
 <discovery>2019-02-08</discovery>
 <entry>2019-02-24</entry>
 </dates>
 </vuln>

<vuln vid="3e2c9b63-223c-4575-af5c-816acb14e445">
 <topic>rdesktop - critical - Remote Code Execution</topic>
 <affects>
 <package>
	<name>rdesktop</name>
	<range><lt>1.8.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://github.com/rdesktop/rdesktop/releases/tag/v1.8.4">
	 <ul>
	 <li>Fix memory corruption in process_bitmap_data - CVE-2018-8794
	 </li>
	 <li>Fix remote code execution in process_bitmap_data - CVE-2018-8795
	 </li>
	 <li>Fix remote code execution in process_plane - CVE-2018-8797
	 </li>
	 <li>Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175
	 </li>
	 <li>Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175
	 </li>
	 <li>Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176
	 </li>
	 <li>Fix Denial of Service in sec_recv - CVE-2018-20176
	 </li>
	 <li>Fix minor information leak in rdpdr_process - CVE-2018-8791
	 </li>
	 <li>Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792
	 </li>
	 <li>Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793
	 </li>
	 <li>Fix Denial of Service in process_bitmap_data - CVE-2018-8796
	 </li>
	 <li>Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798
	 </li>
	 <li>Fix Denial of Service in process_secondary_order - CVE-2018-8799
	 </li>
	 <li>Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800
	 </li>
	 <li>Fix major information leak in ui_clip_handle_data - CVE-2018-20174
	 </li>
	 <li>Fix memory corruption in rdp_in_unistr - CVE-2018-20177
	 </li>
	 <li>Fix Denial of Service in process_demand_active - CVE-2018-20178
	 </li>
	 <li>Fix remote code execution in lspci_process - CVE-2018-20179
	 </li>
	 <li>Fix remote code execution in rdpsnddbg_process - CVE-2018-20180
	 </li>
	 <li>Fix remote code execution in seamless_process - CVE-2018-20181
	 </li>
	 <li>Fix remote code execution in seamless_process_line - CVE-2018-20182
	 </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/rdesktop/rdesktop/releases/tag/v1.8.4</url>
 <cvename>CVE-2018-20175</cvename>
 <cvename>CVE-2018-20176</cvename>
 <cvename>CVE-2018-8791</cvename>
 <cvename>CVE-2018-8792</cvename>
 <cvename>CVE-2018-8793</cvename>
 <cvename>CVE-2018-8794</cvename>
 <cvename>CVE-2018-8795</cvename>
 <cvename>CVE-2018-8796</cvename>
 <cvename>CVE-2018-8797</cvename>
 <cvename>CVE-2018-8798</cvename>
 <cvename>CVE-2018-8799</cvename>
 <cvename>CVE-2018-8800</cvename>
 <cvename>CVE-2018-20174</cvename>
 <cvename>CVE-2018-20177</cvename>
 <cvename>CVE-2018-20178</cvename>
 <cvename>CVE-2018-20179</cvename>
 <cvename>CVE-2018-20180</cvename>
 <cvename>CVE-2018-20181</cvename>
 <cvename>CVE-2018-20182</cvename>
 </references>
 <dates>
 <discovery>2019-01-02</discovery>
 <entry>2019-02-22</entry>
 </dates>
 </vuln>

<vuln vid="002b4b05-35dd-11e9-94a8-000ffec0b3e1">
 <topic>drupal -- Drupal core - Highly critical - Remote Code Execution</topic>
 <affects>
 <package>
	<name>drupal8</name>
	<range><lt>8.6.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team
	<blockquote cite="https://www.drupal.org/SA-CORE-2019-003">
	 Some field types do not properly sanitize data from non-form sources.
	This can lead to arbitrary PHP code execution in some cases..
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/sa-core-2019-002</url>
 <cvename>CVE-2019-6340</cvename>
 </references>
 <dates>
 <discovery>2019-02-20</discovery>
 <entry>2019-02-21</entry>
 </dates>
 </vuln>

<vuln vid="7700061f-34f7-11e9-b95c-b499baebfeaf">
 <topic>OpenSSL -- Padding oracle vulnerability</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2r,1</lt></range>
 </package>
 <package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20190226.txt">
	 0-byte record padding oracle (CVE-2019-1559) (Moderate) 
	 If an application encounters a fatal protocol error and then calls
	 SSL_shutdown() twice (once to send a close_notify, and once to receive
	 one) then OpenSSL can respond differently to the calling application if
	 a 0 byte record is received with invalid padding compared to if a 0 byte
	 record is received with an invalid MAC. If the application then behaves
	 differently based on that in a way that is detectable to the remote peer,
	 then this amounts to a padding oracle that could be used to decrypt data.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20190226.txt</url>
 <cvename>CVE-2019-1559</cvename>
 </references>
 <dates>
 <discovery>2019-02-19</discovery>
 <entry>2019-02-20</entry>
 <modified>2019-03-07</modified>
 </dates>
 </vuln>

<vuln vid="f0416fb5-3130-11e9-a5ba-e0d55e883e26">
 <topic>msmtp -- certificate-verification issue</topic>
 <affects>
 <package>
	<name>msmtp</name>
	<range><gt>1.8.1</gt><lt>1.8.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	msmtp developers report:
	<blockquote cite="https://marlam.de/msmtp/news/msmtp-1-8-3/">
	 In msmtp 1.8.2, when tls_trust_file has its default configuration,
	 certificate-verification results are not properly checked.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://marlam.de/msmtp/news/msmtp-1-8-3/</url>
 <cvename>CVE-2019-8337</cvename>
 </references>
 <dates>
 <discovery>2019-02-11</discovery>
 <entry>2019-02-15</entry>
 </dates>
 </vuln>

<vuln vid="18211552-f650-4d86-ba4f-e6d5cbfcdbeb">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>65.0.1,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>60.5.1,1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>60.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/">
	 CVE-2018-18356: Use-after-free in Skia
	 CVE-2019-5785: Integer overflow in Skia
	 CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-18511</cvename>
 <cvename>CVE-2018-18356</cvename>
 <cvename>CVE-2019-5785</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/</url>
 </references>
 <dates>
 <discovery>2019-02-13</discovery>
 <entry>2019-02-13</entry>
 </dates>
 </vuln>

<vuln vid="de11a8fb-2eda-11e9-8fb5-6451062f0f7a">
 <topic>Flash Player -- information disclosure</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>32.0.0.142</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb19-06.html">
	 <ul>
	 <li>This update resolves an out-of-bounds vulnerability that
	 could lead to information disclosure (CVE-2019-7090).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-7090</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb19-06.html</url>
 </references>
 <dates>
 <discovery>2019-02-12</discovery>
 <entry>2019-02-12</entry>
 </dates>
 </vuln>

<vuln vid="5efd7a93-2dfb-11e9-9549-e980e869c2e9">
 <topic>OpenJPEG -- integer overflow</topic>
 <affects>
 <package>
	<name>openjpeg</name>
	<range><lt>2.3.0_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-5727">
	 In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the
	 opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could
	 leverage this vulnerability to cause a denial of service via a crafted
	 bmp file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2018-5727</url>
 <url>https://github.com/uclouvain/openjpeg/issues/1053</url>
 <cvename>CVE-2018-5727</cvename>
 </references>
 <dates>
 <discovery>2017-12-08</discovery>
 <entry>2019-02-11</entry>
 <modified>2019-03-29</modified>
 </dates>
 </vuln>

<vuln vid="86c89abf-2d91-11e9-bf3e-a4badb2f4699">
 <topic>FreeBSD -- File description reference count leak</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	FreeBSD 12.0 attempts to handle the case where the
	receiving process does not provide a sufficiently large
	buffer for an incoming control message containing rights.
	In particular, to avoid leaking the corresponding descriptors
	into the receiving process' descriptor table, the kernel
	handles the truncation case by closing descriptors referenced
	by the discarded message.
	The code which performs this operation failed to release
	a reference obtained on the file corresponding to a received
	right. This bug can be used to cause the reference counter
	to wrap around and free the file structure.
	<h1>Impact:</h1>
	A local user can exploit the bug to gain root privileges
	or escape from a jail.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5596</cvename>
 <freebsdsa>SA-19:02.fd</freebsdsa>
 </references>
 <dates>
 <discovery>2019-02-05</discovery>
 <entry>2019-02-11</entry>
 </dates>
 </vuln>

<vuln vid="683c714d-2d91-11e9-bf3e-a4badb2f4699">
 <topic>FreeBSD -- System call kernel data register leak</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>12.0</ge><lt>12.0_3</lt></range>
	<range><ge>11.2</ge><lt>11.2_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The callee-save registers are used by kernel and for
	some of them (%r8, %r10, and for non-PTI configurations,
	%r9) the content is not sanitized before return from syscalls,
	potentially leaking sensitive information.
	<h1>Impact:</h1>
	Typically an address of some kernel data structure used
	in the syscall implementation, is exposed.
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5595</cvename>
 <freebsdsa>SA-19:01.syscall</freebsdsa>
 </references>
 <dates>
 <discovery>2019-02-05</discovery>
 <entry>2019-02-11</entry>
 </dates>
 </vuln>

<vuln vid="e8bcac84-2d5c-11e9-9a74-e0d55e2a8bf9">
 <topic>kf5-kauth -- Insecure handling of arguments in helpers</topic>
 <affects>
 <package>
	<name>kf5-kauth</name>
	<range><lt>5.54.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Albert Astals Cid reports:
	<blockquote cite="https://www.kde.org/info/security/advisory-20190209-1.txt">
	KAuth allows to pass parameters with arbitrary types to helpers running as root over DBus.
	Certain types can cause crashes and trigger decoding arbitrary images with dynamically loaded plugin
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.kde.org/info/security/advisory-20190209-1.txt</url>
 <cvename>CVE-2019-7443</cvename>
 </references>
 <dates>
 <discovery>2019-02-09</discovery>
 <entry>2019-02-10</entry>
 </dates>
 </vuln>

<vuln vid="c95836a0-2b3b-11e9-9838-8c164567ca3c">
 <topic>unit -- heap memory buffer overflow</topic>
 <affects>
 <package>
	<name>unit</name>
	<range><ge>0.3.0</ge><lt>1.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	unit security problems:
	<blockquote cite="http://mailman.nginx.org/pipermail/unit/2019-February/000112.html">
	 CVE-2019-7401: a head memory buffer overflow might have
	 been caused in the router process by a specially crafted
	 request, potentially resulting in a segmentation fault
	 or other unspecified behavior.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://mailman.nginx.org/pipermail/unit/2019-February/000112.html</url>
 <cvename>CVE-2019-7401</cvename>
 </references>
 <dates>
 <discovery>2019-02-07</discovery>
 <entry>2019-02-08</entry>
 </dates>
 </vuln>

<vuln vid="714b033a-2b09-11e9-8bc3-610fd6e6cd05">
 <topic>curl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>7.64.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	curl security problems:
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	 CVE-2018-16890: NTLM type-2 out-of-bounds buffer read
	 libcurl contains a heap buffer out-of-bounds read flaw.
	 The function handling incoming NTLM type-2 messages
	 (lib/vauth/ntlm.c:ntlm_decode_type2_target) does not validate incoming
	 data correctly and is subject to an integer overflow vulnerability.
	 Using that overflow, a malicious or broken NTLM server could trick
	 libcurl to accept a bad length + offset combination that would lead to a
	 buffer read out-of-bounds.
	 CVE-2019-3822: NTLMv2 type-3 header stack buffer overflow
	 libcurl contains a stack based buffer overflow vulnerability.
	 The function creating an outgoing NTLM type-3 header
	 (lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()), generates the
	 request HTTP header contents based on previously received data. The
	 check that exists to prevent the local buffer from getting overflowed is
	 implemented wrongly (using unsigned math) and as such it does not
	 prevent the overflow from happening.
	 This output data can grow larger than the local buffer if very large
	 "nt response" data is extracted from a previous NTLMv2 header provided
	 by the malicious or broken HTTP server.
	 Such a "large value" needs to be around 1000 bytes or more. The actual
	 payload data copied to the target buffer comes from the NTLMv2 type-2
	 response header.
	 CVE-2019-3823: SMTP end-of-response out-of-bounds read
	 libcurl contains a heap out-of-bounds read in the code handling the
	 end-of-response for SMTP.
	 If the buffer passed to smtp_endofresp() isn't NUL terminated and
	 contains no character ending the parsed number, and len is set to 5,
	 then the strtol() call reads beyond the allocated buffer. The read
	 contents will not be returned to the caller.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/security.html</url>
 <url>https://curl.haxx.se/docs/CVE-2018-16890.html</url>
 <url>https://curl.haxx.se/docs/CVE-2019-3822.html</url>
 <url>https://curl.haxx.se/docs/CVE-2019-3823.html</url>
 <cvename>CVE-2018-16890</cvename>
 <cvename>CVE-2019-3822</cvename>
 <cvename>CVE-2019-3823</cvename>
 </references>
 <dates>
 <discovery>2019-02-07</discovery>
 <entry>2019-02-07</entry>
 </dates>
 </vuln>

<vuln vid="43ee6c1d-29ee-11e9-82a1-001b217b3468">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.7.0</ge><lt>11.7.4</lt></range>
	<range><ge>11.6.0</ge><lt>11.6.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/02/05/critical-security-release-gitlab-11-dot-7-dot-4-released/">
	 Leak of Confidential Issue and Merge Request Titles
	 Persistent XSS in User Status
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/02/05/critical-security-release-gitlab-11-dot-7-dot-4-released/</url>
 <cvename>CVE-2019-7353</cvename>
 <cvename>CVE-2019-6796</cvename>
 </references>
 <dates>
 <discovery>2019-02-05</discovery>
 <entry>2019-02-06</entry>
 </dates>
 </vuln>

<vuln vid="1340fcc1-2953-11e9-bc44-a4badb296695">
 <topic>mail/dovecot -- Suitable client certificate can be used to login as other user</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><lt>2.3.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aki Tuomi (Open-Xchange Oy) reports:
	<blockquote cite="https://www.mail-archive.com/dovecot@dovecot.org/msg76117.html">
	 Normally Dovecot is configured to authenticate
imap/pop3/managesieve/submission clients using regular username/password
combination. Some installations have also required clients to present a
trusted SSL certificate on top of that. It's also possible to configure
Dovecot to take the username from the certificate instead of from the
user provided authentication. It's also possible to avoid having a
password at all, only trusting the SSL certificate.

If the provided trusted SSL certificate is missing the username field,
Dovecot should be failing the authentication. However, the earlier
versions will take the username from the user provided authentication
fields (e.g. LOGIN command). If there is no additional password
verification, this allows the attacker to login as anyone else in the
system.

This affects only installations using:

auth_ssl_require_client_cert = yes
auth_ssl_username_from_cert = yes

Attacker must also have access to a valid trusted certificate without
the ssl_cert_username_field in it. The default is commonName, which
almost certainly exists in all certificates. This could happen for
example if ssl_cert_username_field is a field that normally doesn't
exist, and attacker has access to a web server's certificate (and key),
which is signed with the same CA.

Attack can be migitated by having the certificates with proper Extended
Key Usage, such as 'TLS Web Server' and 'TLS Web Server Client'.

Also, ssl_cert_username_field setting was ignored with external SMTP
AUTH, because none of the MTAs (Postfix, Exim) currently send the
cert_username field. This may have allowed users with trusted
certificate to specify any username in the authentication. This does not
apply to Dovecot Submission service.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.mail-archive.com/dovecot@dovecot.org/msg76117.html</url>
 <cvename>CVE-2019-3814</cvename>
 </references>
 <dates>
 <discovery>2019-01-16</discovery>
 <entry>2019-02-05</entry>
 </dates>
 </vuln>

<vuln vid="5d8c0876-2716-11e9-9446-b7f8544ce15c">
 <topic>typo3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>typo3-8-php71</name>
	<name>typo3-8-php72</name>
	<name>typo3-8-php73</name>
	<range><lt>8.7.24</lt></range>
 </package>
 <package>
	<name>typo3-9-php71</name>
	<name>typo3-9-php72</name>
	<name>typo3-9-php73</name>
	<range><lt>9.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Typo3 news:
	<blockquote cite="https://typo3.org/article/typo3-954-and-8723-security-releases-published/">
	 Please read the corresponding Security Advisories for details.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://typo3.org/article/typo3-954-and-8723-security-releases-published/</url>
 <url>https://typo3.org/article/typo3-v8724-lts-released/</url>
 </references>
 <dates>
 <discovery>2019-01-22</discovery>
 <entry>2019-02-02</entry>
 </dates>
 </vuln>

<vuln vid="41c1cd6f-2645-11e9-b5f1-080027fee39c">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitea Team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.7.0">
	 Disable redirect for i18n
	 Only allow local login if password is non-empty
	 Fix go-get URL generation
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.7.1</url>
 </references>
 <dates>
 <discovery>2019-01-31</discovery>
 <entry>2019-02-01</entry>
 </dates>
 </vuln>

<vuln vid="22b90fe6-258e-11e9-9c8d-6805ca0b3d42">
 <topic>p5-Email-Address-List -- DDoS related vulnerability</topic>
 <affects>
 <package>
	<name>p5-Email-Address-List</name>
	<range><lt>0.06</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Best PRactical Solutions reports:
	<blockquote cite="https://metacpan.org/source/BPS/Email-Address-List-0.06/Changes">
	 <pre>
 0.06 2019-01-02

- Changes to address CVE-2018-18898 which could allow DDoS-type attacks.
 Thanks to Lukas Kramer for reporting the issue and Alex Vandiver for
 contributing fixes.
 - Fix pathological backtracking for unkown regex
 - Fix pathological backtracking in obs-phrase(i.e. obs-display-name)
 - Fix pathological backtracking in cfws, quoted strings
	 </pre>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://metacpan.org/source/BPS/Email-Address-List-0.06/Changes</url>
 <cvename>CVE-2018-18898</cvename>
 </references>
 <dates>
 <discovery>2019-01-02</discovery>
 <entry>2019-01-31</entry>
 </dates>
 </vuln>

<vuln vid="467b7cbe-257d-11e9-8573-001b217b3468">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.7.0</ge><lt>11.7.3</lt></range>
	<range><ge>11.6.0</ge><lt>11.6.8</lt></range>
	<range><ge>0.0.0</ge><lt>11.5.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/">
	 Remote Command Execution via GitLab Pages
	 Covert Redirect to Steal GitHub/Bitbucket Tokens
	 Remote Mirror Branches Leaked by Git Transfer Refs
	 Denial of Service with Markdown
	 Guests Can View List of Group Merge Requests
	 Guest Can View Merge Request Titles via System Notes
	 Persistent XSS via KaTeX
	 Emails Sent to Unauthorized Users
	 Hyperlink Injection in Notification Emails
	 Unauthorized Access to LFS Objects
	 Trigger Token Exposure
	 Upgrade Rails to 5.0.7.1 and 4.2.11
	 Contributed Project Information Visible in Private Profile
	 Imported Project Retains Prior Visibility Setting
	 Error disclosure on Project Import
	 Persistent XSS in User Status
	 Last Commit Status Leaked to Guest Users
	 Mitigations for IDN Homograph and RTLO Attacks
	 Access to Internal Wiki When External Wiki Enabled
	 User Can Comment on Locked Project Issues
	 Unauthorized Reaction Emojis by Guest Users
	 User Retains Project Role After Removal from Private Group
	 GitHub Token Leaked to Maintainers
	 Unauthenticated Blind SSRF in Jira Integration
	 Unauthorized Access to Group Membership
	 Validate SAML Response in Group SAML SSO
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/</url>
 <cvename>CVE-2019-6783</cvename>
 <cvename>CVE-2019-6788</cvename>
 <cvename>CVE-2019-6785</cvename>
 <cvename>CVE-2019-6790</cvename>
 <cvename>CVE-2019-6997</cvename>
 <cvename>CVE-2019-6784</cvename>
 <cvename>CVE-2019-6789</cvename>
 <cvename>CVE-2019-6781</cvename>
 <cvename>CVE-2019-6786</cvename>
 <cvename>CVE-2019-6787</cvename>
 <cvename>CVE-2018-16476</cvename>
 <cvename>CVE-2019-6782</cvename>
 <cvename>CVE-2019-6791</cvename>
 <cvename>CVE-2019-6792</cvename>
 <cvename>CVE-2019-6796</cvename>
 <cvename>CVE-2019-6794</cvename>
 <cvename>CVE-2019-6795</cvename>
 <cvename>CVE-2019-6960</cvename>
 <cvename>CVE-2019-6995</cvename>
 <cvename>CVE-2019-7176</cvename>
 <cvename>CVE-2019-7155</cvename>
 <cvename>CVE-2019-6797</cvename>
 <cvename>CVE-2019-6793</cvename>
 <cvename>CVE-2019-6996</cvename>
 </references>
 <dates>
 <discovery>2019-01-31</discovery>
 <entry>2019-01-31</entry>
 </dates>
 </vuln>

<vuln vid="181beef6-2482-11e9-b4a3-00155d006b02">
 <topic>turnserver -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>turnserver</name>
	<range><lt>4.5.1.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mihály Mészáros reports:
	<blockquote cite="https://github.com/coturn/coturn/blob/4.5.1.0/ChangeLog">
	 We made 4.5.1.0 release public today that fixes many vulnerabilities.
	 It fix the following vulnerabilities:
	 <ul>
	 <li>CVE-2018-4056</li>
	 <li>CVE-2018-4058</li>
	 <li>CVE-2018-4059</li>
	 </ul>
	 They will be exposed very soon..
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/coturn/coturn/blob/4.5.1.0/ChangeLog</url>
 <url>https://groups.google.com/d/msg/turn-server-project-rfc5766-turn-server/0RuCzcQa0ew/ebZfNEDqBwAJ</url>
 <cvename>CVE-2018-4056</cvename>
 <cvename>CVE-2018-4058</cvename>
 <cvename>CVE-2018-4059</cvename>
 </references>
 <dates>
 <discovery>2019-01-28</discovery>
 <entry>2019-01-30</entry>
 </dates>
 </vuln>

<vuln vid="b1f7d52f-fc42-48e8-8403-87d4c9d26229">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>65.0_1,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.2.7</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.53.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>60.5.0_1,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>60.5.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>60.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/">
	 CVE-2018-18500: Use-after-free parsing HTML5 stream
	 CVE-2018-18503: Memory corruption with Audio Buffer
	 CVE-2018-18504: Memory corruption and out-of-bounds read of texture client buffer
	 CVE-2018-18505: Privilege escalation through IPC channel messages
	 CVE-2018-18506: Proxy Auto-Configuration file can define localhost access to be proxied
	 CVE-2018-18502: Memory safety bugs fixed in Firefox 65
	 CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-18500</cvename>
 <cvename>CVE-2018-18501</cvename>
 <cvename>CVE-2018-18502</cvename>
 <cvename>CVE-2018-18503</cvename>
 <cvename>CVE-2018-18504</cvename>
 <cvename>CVE-2018-18505</cvename>
 <cvename>CVE-2018-18506</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-02/</url>
 </references>
 <dates>
 <discovery>2019-01-29</discovery>
 <entry>2019-01-29</entry>
 <modified>2019-07-23</modified>
 </dates>
 </vuln>

<vuln vid="40d92cc5-1e2b-11e9-bef6-6805ca2fa271">
 <topic>powerdns-recursor -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><lt>4.1.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.1.html">
	 CVE-2019-3806: An issue has been found in PowerDNS Recursor where Lua hooks are
	 not properly applied to queries received over TCP in some specific combination of
	 settings, possibly bypassing security policies enforced using Lua.

When the recursor is configured to run with more than one thread (threads=X) and to
	 do the distribution of incoming queries to the worker threads itself
	 (pdns-distributes-queries=yes), the Lua script is not properly loaded in the thread
	 handling incoming TCP queries, causing the Lua hooks to not be properly applied.
	 CVE-2019-3807: An issue has been found in PowerDNS Recursor where records in the
	 answer section of responses received from authoritative servers with the AA flag not
	 set were not properly validated, allowing an attacker to bypass DNSSEC validation.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://doc.powerdns.com/recursor/changelog/4.1.html</url>
 <cvename>CVE-2019-3806</cvename>
 <cvename>CVE-2019-3807</cvename>
 </references>
 <dates>
 <discovery>2019-01-21</discovery>
 <entry>2019-01-22</entry>
 </dates>
 </vuln>

<vuln vid="d3d02d3a-2242-11e9-b95c-b499baebfeaf">
 <topic>MySQL -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>mariadb55-server</name>
 <range><lt>5.5.63</lt></range>
 </package>
 <package>
 <name>mariadb100-server</name>
 <range><lt>10.0.38</lt></range>
 </package>
 <package>
 <name>mariadb101-server</name>
 <range><lt>10.1.38</lt></range>
 </package>
 <package>
 <name>mariadb102-server</name>
 <range><lt>10.2.22</lt></range>
 </package>
 <package>
 <name>mariadb103-server</name>
 <range><lt>10.3.13</lt></range>
 </package>
 <package>
 <name>mysql55-server</name>
 <range><lt>5.5.63</lt></range>
 </package>
 <package>
 <name>mysql56-server</name>
 <range><lt>5.6.43</lt></range>
 </package>
 <package>
 <name>mysql57-server</name>
 <range><lt>5.7.25</lt></range>
 </package>
 <package>
 <name>mysql80-server</name>
 <range><lt>8.0.14</lt></range>
 </package>
 <package>
 <name>percona55-server</name>
 <range><lt>5.5.63</lt></range>
 </package>
 <package>
 <name>percona56-server</name>
 <range><lt>5.6.43</lt></range>
 </package>
 <package>
 <name>percona57-server</name>
 <range><lt>5.7.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Oracle reports:
 <blockquote cite="https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixMSQL">
 Please reference CVE/URL list for details
 Not all listed CVE's are present in all versions/flavors
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixMSQL</url>
 <cvename>CVE-2019-2534</cvename>
 <cvename>CVE-2019-2533</cvename>
 <cvename>CVE-2019-2529</cvename>
 <cvename>CVE-2019-2482</cvename>
 <cvename>CVE-2019-2434</cvename>
 <cvename>CVE-2019-2455</cvename>
 <cvename>CVE-2019-2503</cvename>
 <cvename>CVE-2019-2436</cvename>
 <cvename>CVE-2019-2536</cvename>
 <cvename>CVE-2019-2502</cvename>
 <cvename>CVE-2019-2510</cvename>
 <cvename>CVE-2019-2539</cvename>
 <cvename>CVE-2019-2494</cvename>
 <cvename>CVE-2019-2495</cvename>
 <cvename>CVE-2019-2537</cvename>
 <cvename>CVE-2019-2420</cvename>
 <cvename>CVE-2019-2481</cvename>
 <cvename>CVE-2019-2507</cvename>
 <cvename>CVE-2019-2530</cvename>
 <cvename>CVE-2019-2528</cvename>
 <cvename>CVE-2019-2531</cvename>
 <cvename>CVE-2019-2486</cvename>
 <cvename>CVE-2019-2532</cvename>
 <cvename>CVE-2019-2535</cvename>
 <cvename>CVE-2019-2513</cvename>
 </references>
 <dates>
 <discovery>2019-01-15</discovery>
 <entry>2019-01-27</entry>
 </dates>
 </vuln>

<vuln vid="d8e7e854-17fa-11e9-bef6-6805ca2fa271">
 <topic>botan2 -- Side channel during ECC key generation</topic>
 <affects>
 <package>
	<name>botan2</name>
	<range><lt>2.9.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	botan2 developers reports:
	<blockquote cite="https://botan.randombit.net/security.html#id1">
	 A timing side channel during ECC key generation could leak information about the
		high bits of the secret scalar. Such information allows an attacker to perform a
		brute force attack on the key somewhat more efficiently than they would otherwise.
		Found by Ján Jančár using ECTester.
	 Bug introduced in 1.11.20, fixed in 2.9.0
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://botan.randombit.net/security.html#id1</url>
 <cvename>CVE-2018-20187</cvename>
 </references>
 <dates>
 <discovery>2018-12-17</discovery>
 <entry>2019-01-27</entry>
 </dates>
 </vuln>

<vuln vid="111aefca-2213-11e9-9c8d-6805ca0b3d42">
 <topic>phpMyAdmin -- File disclosure and SQL injection</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<name>phpMyAdmin-php56</name>
	<name>phpMyAdmin-php70</name>
	<name>phpMyAdmin-php71</name>
	<name>phpMyAdmin-php72</name>
	<range><lt>4.8.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2019-1/">
	 <h3>Summary</h3>
	 Arbitrary file read vulnerability
	 <h3>Description</h3>
	 When <code>AllowArbitraryServer</code> configuration set
	 to <code>true</code>, with the use of a rogue MySQL server,
	 an attacker can read any file on the server that the web
	 server's user can access.
	 phpMyadmin attempts to block the use of <code>LOAD DATA
	 INFILE</code>, but due to a <a href="https://bugs.php.net/bug.php?id=77496">bug in PHP</a>,
	 this check is not honored. Additionally, when using the
	 'mysql' extension, <a href="http://php.net/manual/en/mysql.configuration.php#ini.mysql.allow-local-infile">mysql.allow_local_infile</a>
	 is enabled by default. Both of these conditions allow the
	 attack to occur.
	 <h3>Severity</h3>
	 We consider this vulnerability to be critical.
	 <h3>Mitigation factor</h3>
	 This attack can be mitigated by setting the
	 `AllowArbitraryServer` configuration directive to false
	 (which is the default value).
	 <h3>Affected Versions</h3>
	 phpMyAdmin versions from at least 4.0 through 4.8.4 are
	 affected
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2019-2/">
	 <h3>Summary</h3>
	 SQL injection in Designer feature
	 <h3>Description</h3>
	 A vulnerability was reported where a specially crafted
	 username can be used to trigger an SQL injection attack
	 through the designer feature.
	 <h3>Severity</h3>
	 We consider this vulnerability to be serious.
	 <h3>Affected Versions</h3>
	 phpMyAdmin versions from 4.5.0 through 4.8.4 are affected
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2019-1/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2019-2/</url>
 </references>
 <dates>
 <discovery>2019-01-21</discovery>
 <entry>2019-01-27</entry>
 </dates>
 </vuln>

<vuln vid="7f6146aa-2157-11e9-9ba0-4c72b94353b5">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitea Team reports:
	<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.7.0">
	 Do not display the raw OpenID error in the UI
	 When redirecting clean the path to avoid redirecting to external site
	 Prevent DeleteFilePost doing arbitrary deletion
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/releases/tag/v1.7.0</url>
 </references>
 <dates>
 <discovery>2019-01-22</discovery>
 <entry>2019-01-26</entry>
 </dates>
 </vuln>

<vuln vid="8e48365a-214d-11e9-9f8a-0050562a4d7b">
 <topic>libzmq4 -- Remote Code Execution Vulnerability</topic>
 <affects>
 <package>
	<name>libzmq4</name>
	<range><ge>4.2.0</ge><lt>4.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://github.com/zeromq/libzmq/releases/tag/v4.3.1">
	 A vulnerability has been found that would allow attackers to direct a peer to
	 jump to and execute from an address indicated by the attacker.
	 This issue has been present since v4.2.0. Older releases are not affected.

NOTE: The attacker needs to know in advance valid addresses in the peer's
	     memory to jump to, so measures like ASLR are effective mitigations.

NOTE: this attack can only take place after authentication, so peers behind
	 CURVE/GSSAPI are not vulnerable to unauthenticated attackers.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-6250</cvename>
 <url>https://github.com/zeromq/libzmq/issues/3351</url>
 <url>https://github.com/zeromq/libzmq/pull/3353</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2019-6250</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6250</url>
 </references>
 <dates>
 <discovery>2019-01-08</discovery>
 <entry>2019-01-26</entry>
 </dates>
 </vuln>

<vuln vid="eb888ce5-1f19-11e9-be05-4c72b94353b5">
 <topic>Apache -- vulnerability</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.38</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd Project reports:
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
	 SECURITY: CVE-2018-17199
	 mod_session: mod_session_cookie does not respect expiry time allowing
	 sessions to be reused.
	 SECURITY: CVE-2019-0190
	 mod_ssl: Fix infinite loop triggered by a client-initiated
	 renegotiation in TLSv1.2 (or earlier) with OpenSSL 1.1.1 and
	 later. PR 63052.
	 SECURITY: CVE-2018-17189
	 mod_http2: fixes a DoS attack vector. By sending slow request bodies
	 to resources not consuming them, httpd cleanup code occupies a server
	 thread unnecessarily. This was changed to an immediate stream reset
	 which discards all stream state and incoming data.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.apache.org/dist/httpd/CHANGES_2.4.38</url>
 <url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
	<cvename>CVE-2018-17199</cvename>
	<cvename>CVE-2018-17189</cvename>
	<cvename>CVE-2019-0190</cvename>
 </references>
 <dates>
 <discovery>2019-01-22</discovery>
 <entry>2019-01-23</entry>
 </dates>
 </vuln>

<vuln vid="4af3241d-1f0c-11e9-b4bd-d43d7eed0ce2">
 <topic>www/mod_dav_svn -- Malicious SVN clients can crash mod_dav_svn.</topic>
 <affects>
 <package>
	<name>mod_dav_svn</name>
	<range><ge>1.10.0</ge><lt>1.10.3</lt></range>
	<range><eq>1.11.0</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion project reports:
	<blockquote cite="http://subversion.apache.org/security/CVE-2018-11803-advisory.txt">
	 Malicious SVN clients can trigger a crash in mod_dav_svn by omitting
	 the root path from a recursive directory listing request.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://subversion.apache.org/security/CVE-2018-11803-advisory.txt</url>
 </references>
 <dates>
 <discovery>2019-01-23</discovery>
 <entry>2019-01-23</entry>
 </dates>
 </vuln>

<vuln vid="50ad9a9a-1e28-11e9-98d7-0050562a4d7b">
 <topic>www/py-requests -- Information disclosure vulnerability</topic>
 <affects>
 <package>
	<name>py27-requests</name>
	<name>py35-requests</name>
	<name>py36-requests</name>
	<name>py37-requests</name>
	<range><lt>2.20.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-18074">
	 The Requests package before 2.20.0 for Python sends an HTTP Authorization header
	 to an http URI upon receiving a same-hostname https-to-http redirect, which makes
	 it easier for remote attackers to discover credentials by sniffing the network.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-18074</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2018-18074</url>
 <url>https://github.com/requests/requests/issues/4716</url>
 <url>https://github.com/requests/requests/pull/4718</url>
 <url>https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff</url>
 </references>
 <dates>
 <discovery>2018-06-27</discovery>
 <entry>2019-01-22</entry>
 <modified>2019-01-27</modified>
 </dates>
 </vuln>

<vuln vid="6aa398d0-1c4d-11e9-96dd-a4badb296695">
 <topic>joomla3 -- vulnerabilitiesw</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><lt>3.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	JSST reports:
	<blockquote cite="https://developer.joomla.org/security-centre/760-00190101-core-stored-xss-in-mod-banners.html">
	 Inadequate escaping in mod_banners leads to a stored XSS vulnerability.
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/761-20190102-core-stored-xss-in-com-contact.html">
	 Inadequate escaping in com_contact leads to a stored XSS vulnerability
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/762-20190103-core-stored-xss-issue-in-the-global-configuration-textfilter-settings.html">
	 Inadequate checks at the Global Configuration Text Filter settings allowed a stored XSS.
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/763-20190104-core-stored-xss-issue-in-the-global-configuration-help-url.html">
	 Inadequate checks at the Global Configuration helpurl settings allowed a stored XSS.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://developer.joomla.org/security-centre/760-00190101-core-stored-xss-in-mod-banners.html</url>
 <cvename>CVE-2019-6264</cvename>
 <url>https://developer.joomla.org/security-centre/761-20190102-core-stored-xss-in-com-contact.html</url>
 <cvename>CVE-2019-6261</cvename>
 <url>https://developer.joomla.org/security-centre/762-20190103-core-stored-xss-issue-in-the-global-configuration-textfilter-settings.html</url>
 <cvename>CVE-2019-6263</cvename>
 <url>https://developer.joomla.org/security-centre/763-20190104-core-stored-xss-issue-in-the-global-configuration-help-url.html</url>
 <cvename>CVE-2019-6262</cvename>
 </references>
 <dates>
 <discovery>2018-12-01</discovery>
 <entry>2019-01-20</entry>
 </dates>
 </vuln>

<vuln vid="e00ed3d9-1c27-11e9-a257-000ffec0b3e1">
 <topic>drupal -- Drupal core - Arbitrary PHP code execution</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.63</lt></range>
 </package>
 <package>
	<name>drupal8</name>
	<range><lt>8.6.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/sa-core-2019-002">
	 A remote code execution vulnerability exists in PHP's built-in
	phar stream wrapper when performing file operations on an untrusted phar:// URI.
	 Some Drupal code (core, contrib, and custom) may be performing file operations on
	insufficiently validated user input, thereby being exposed to this vulnerability.
	 This vulnerability is mitigated by the fact that such code paths typically require
	access to an administrative permission or an atypical configuration.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/SA-CORE-2018-006</url>
 </references>
 <dates>
 <discovery>2019-01-16</discovery>
 <entry>2019-01-19</entry>
 </dates>
 </vuln>

<vuln vid="2a8b79c3-1b6e-11e9-8cf4-1c39475b9f84">
 <topic>Helm -- client unpacking chart that contains malicious content</topic>
 <affects>
 <package>
	<name>helm</name>
	<range><ge>2.0.0</ge><lt>2.12.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Helm security notice
	<blockquote cite="https://helm.sh/blog/helm-security-notice-2019/index.html">
	 A specially crafted chart may be able to unpack content into locations on
		the filesystem outside of the chart's path, potentially
		overwriting existing files.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://helm.sh/blog/helm-security-notice-2019/index.html</url>
 </references>
 <dates>
 <discovery>2019-01-14</discovery>
 <entry>2019-01-18</entry>
 </dates>
 </vuln>

<vuln vid="ff50192c-19eb-11e9-8573-001b217b3468">
 <topic>Gitlab -- Arbitrary repo read in Gitlab project import</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.6.0</ge><lt>11.6.4</lt></range>
	<range><ge>11.5.0</ge><lt>11.5.7</lt></range>
	<range><ge>8.9.0</ge><lt>11.4.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2019/01/16/critical-security-release-gitlab-11-dot-6-dot-4-released/">
	 Arbitrary repo read in Gitlab project import
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2019/01/16/critical-security-release-gitlab-11-dot-6-dot-4-released/</url>
 <cvename>CVE-2019-6240</cvename>
 </references>
 <dates>
 <discovery>2019-01-16</discovery>
 <entry>2019-01-17</entry>
 </dates>
 </vuln>

<vuln vid="debf6353-5753-4e9a-b710-a83ecdd743de">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.160</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.150.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://jenkins.io/security/advisory/2019-01-16/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-868</h5>
	 Administrators could persist access to Jenkins using crafted 'Remember me' cookie
	 <h5>(Medium) SECURITY-901</h5>
	 Deleting a user in an external security realm did not invalidate their session or 'Remember me' cookie
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://jenkins.io/security/advisory/2019-01-16/</url>
 </references>
 <dates>
 <discovery>2019-01-16</discovery>
 <entry>2019-01-16</entry>
 </dates>
 </vuln>

<vuln vid="383931ba-1818-11e9-92ea-448a5b29e8a9">
 <topic>py-matrix-synapse -- undisclosed vulnerability</topic>
 <affects>
 <package>
	<name>py27-matrix-synapse</name>
	<name>py35-matrix-synapse</name>
	<name>py36-matrix-synapse</name>
	<name>py37-matrix-synapse</name>
	<range><lt>0.34.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matrix developers report:
	 <blockquote cite="https://matrix.org/blog/2019/01/10/critical-security-update-synapse-0-34-0-1-synapse-0-34-1-1/">
	 The matrix team announces the availablility of synapse security releases 0.34.0.1 and 0.34.1.1, fixing CVE-2019-5885.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-5885</cvename>
 <url>https://matrix.org/blog/2019/01/10/critical-security-update-synapse-0-34-0-1-synapse-0-34-1-1/</url>
 </references>
 <dates>
 <discovery>2019-01-10</discovery>
 <entry>2019-01-15</entry>
 </dates>
 </vuln>

<vuln vid="d38bbb79-14f3-11e9-9ce2-28d244aee256">
 <topic>irssi -- Use after free</topic>
 <affects>
 <package>
	<name>irssi</name>
	<range><ge>1.1.0,1</ge><lt>1.1.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Irssi reports:
	<blockquote cite="https://irssi.org/security/irssi_sa_2019_01.txt">
	 Use after free when hidden lines were expired from the scroll
		 buffer. It may affect the stability of Irssi. (CWE-417, CWE-825)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://irssi.org/security/irssi_sa_2019_01.txt</url>
 <cvename>CVE-2019-5882</cvename>
 <freebsdpr>ports/234798</freebsdpr>
 </references>
 <dates>
 <discovery>2019-01-09</discovery>
 <entry>2019-01-10</entry>
 </dates>
 </vuln>

<vuln vid="924bd4f8-11e7-11e9-9fe8-5404a68ad561">
 <topic>uriparser -- Out-of-bounds read</topic>
 <affects>
 <package>
	<name>uriparser</name>
	<range><lt>0.9.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Upstream project reports:
	<blockquote cite="https://github.com/uriparser/uriparser/blob/uriparser-0.9.1/ChangeLog">
	 Out-of-bounds read in uriParse*Ex* for incomplete URIs with IPv6
	 addresses with embedded IPv4 address, e.g. "//[::44.1";
	 mitigated if passed parameter afterLast points to readable memory
	 containing a '\0' byte.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/uriparser/uriparser/blob/uriparser-0.9.1/ChangeLog</url>
 </references>
 <dates>
 <discovery>2019-01-02</discovery>
 <entry>2019-01-06</entry>
 </dates>
 </vuln>

<vuln vid="63e36475-119f-11e9-aba7-080027fee39c">
 <topic>gitea -- insufficient privilege check</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea project reports:
	<blockquote cite="https://blog.gitea.io/2019/01/release-of-1.6.3/">
	 Security
	 <ul>
	 <li>Prevent DeleteFilePost doing arbitrary deletion</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/issues/5631</url>
 </references>
 <dates>
 <discovery>2019-01-04</discovery>
 <entry>2019-01-06</entry>
 </dates>
 </vuln>

<vuln vid="720590df-10eb-11e9-b407-080027ef1a23">
 <topic>chromium -- Use after free in PDFium</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>71.0.3578.98</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop_12.html">
	 1 security fix contributed by external researches:
	 <ul>
	 <li>High CVE-2018-17481: Use after free in PDFium</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-17481</cvename>
 <url>https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop_12.html</url>
 </references>
 <dates>
 <discovery>2018-12-12</discovery>
 <entry>2019-01-05</entry>
 </dates>
 </vuln>

<vuln vid="546d4dd4-10ea-11e9-b407-080027ef1a23">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>71.0.3578.80</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html">
	 43 security fixes in this release, including:
	 <ul>
	 <li>High CVE-2018-17480: Out of bounds write in V8</li>
	 <li>High CVE-2018-17481: Use after free in PDFium</li>
	 <li>High CVE-2018-18335: Heap buffer overflow in Skia</li>
	 <li>High CVE-2018-18336: Use after free in PDFium</li>
	 <li>High CVE-2018-18337: Use after free in Blink</li>
	 <li>High CVE-2018-18338: Heap buffer overflow in Canvas</li>
	 <li>High CVE-2018-18339: Use after free in WebAudio</li>
	 <li>High CVE-2018-18340: Use after free in MediaRecorder</li>
	 <li>High CVE-2018-18341: Heap buffer overflow in Blink</li>
	 <li>High CVE-2018-18342: Out of bounds write in V8</li>
	 <li>High CVE-2018-18343: Use after free in Skia</li>
	 <li>High CVE-2018-18344: Inappropriate implementation in Extensions</li>
	 <li>High To be allocated: Multiple issues in SQLite via WebSQL</li>
	 <li>Medium CVE-2018-18345: Inappropriate implementation in Site Isolation</li>
	 <li>Medium CVE-2018-18346: Incorrect security UI in Blink</li>
	 <li>Medium CVE-2018-18347: Inappropriate implementation in Navigation</li>
	 <li>Medium CVE-2018-18348: Inappropriate implementation in Omnibox</li>
	 <li>Medium CVE-2018-18349: Insufficient policy enforcement in Blink</li>
	 <li>Medium CVE-2018-18350: Insufficient policy enforcement in Blink</li>
	 <li>Medium CVE-2018-18351: Insufficient policy enforcement in Navigation</li>
	 <li>Medium CVE-2018-18352: Inappropriate implementation in Media</li>
	 <li>Medium CVE-2018-18353: Inappropriate implementation in Network Authentication</li>
	 <li>Medium CVE-2018-18354: Insufficient data validation in Shell Integration</li>
	 <li>Medium CVE-2018-18355: Insufficient policy enforcement in URL Formatter</li>
	 <li>Medium CVE-2018-18356: Use after free in Skia</li>
	 <li>Medium CVE-2018-18357: Insufficient policy enforcement in URL Formatter</li>
	 <li>Medium CVE-2018-18358: Insufficient policy enforcement in Proxy</li>
	 <li>Medium CVE-2018-18359: Out of bounds read in V8</li>
	 <li>Low To be allocated: Inappropriate implementation in PDFium</li>
	 <li>Low To be allocated: Use after free in Extensions</li>
	 <li>Low To be allocated: Inappropriate implementation in Navigation</li>
	 <li>Low To be allocated: Inappropriate implementation in Navigation</li>
	 <li>Low To be allocated: Insufficient policy enforcement in Navigation</li>
	 <li>Low To be allocated: Insufficient policy enforcement in URL Formatter</li>
	 <li>Medium To be allocated: Insufficient policy enforcement in Payments</li>
	 <li>Various fixes from internal audits, fuzzing and other initiatives</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-17480</cvename>
 <cvename>CVE-2018-17481</cvename>
 <cvename>CVE-2018-18335</cvename>
 <cvename>CVE-2018-18336</cvename>
 <cvename>CVE-2018-18337</cvename>
 <cvename>CVE-2018-18338</cvename>
 <cvename>CVE-2018-18339</cvename>
 <cvename>CVE-2018-18340</cvename>
 <cvename>CVE-2018-18341</cvename>
 <cvename>CVE-2018-18342</cvename>
 <cvename>CVE-2018-18343</cvename>
 <cvename>CVE-2018-18344</cvename>
 <cvename>CVE-2018-18345</cvename>
 <cvename>CVE-2018-18346</cvename>
 <cvename>CVE-2018-18347</cvename>
 <cvename>CVE-2018-18348</cvename>
 <cvename>CVE-2018-18349</cvename>
 <cvename>CVE-2018-18350</cvename>
 <cvename>CVE-2018-18351</cvename>
 <cvename>CVE-2018-18352</cvename>
 <cvename>CVE-2018-18353</cvename>
 <cvename>CVE-2018-18354</cvename>
 <cvename>CVE-2018-18355</cvename>
 <cvename>CVE-2018-18356</cvename>
 <cvename>CVE-2018-18357</cvename>
 <cvename>CVE-2018-18358</cvename>
 <cvename>CVE-2018-18359</cvename>
 <url>https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2018-12-04</discovery>
 <entry>2019-01-05</entry>
 </dates>
 </vuln>

<vuln vid="3e41c1a6-10bc-11e9-bd85-fcaa147e860e">
 <topic>Django -- Content spoofing possibility in the default 404 page</topic>
 <affects>
 <package>
	<name>py27-django111</name>
	<name>py35-django111</name>
	<name>py36-django111</name>
	<name>py37-django111</name>
	<range><lt>1.11.18</lt></range>
 </package>
 <package>
	<name>py35-django20</name>
	<name>py36-django20</name>
	<name>py37-django20</name>
	<range><lt>2.0.10</lt></range>
 </package>
 <package>
	<name>py35-django21</name>
	<name>py36-django21</name>
	<name>py37-django21</name>
	<range><lt>2.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 Django security releases issued reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2019/jan/04/security-releases/">
	 An attacker could craft a malicious URL that could make spoofed content
	 appear on the default page generated by the django.views.defaults.page_not_found()
	 view.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2019-3498</cvename>
 <url>https://www.djangoproject.com/weblog/2019/jan/04/security-releases/</url>
 </references>
 <dates>
 <discovery>2019-01-03</discovery>
 <entry>2019-01-05</entry>
 </dates>
 </vuln>

<vuln vid="b2f4ab91-0e6b-11e9-8700-001b217b3468">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.6.0</ge><lt>11.6.1</lt></range>
	<range><ge>11.5.0</ge><lt>11.5.6</lt></range>
	<range><ge>8.0.0</ge><lt>11.4.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/">
	 Source code disclosure merge request diff
	 Todos improper access control
	 URL rel attribute not set
	 Persistent XSS Autocompletion
	 SSRF repository mirroring
	 CI job token LFS error message disclosure
	 Secret CI variable exposure
	 Guest user CI job disclosure
	 Persistent XSS label reference
	 Persistent XSS wiki in IE browser
	 SSRF in project imports with LFS
	 Improper access control CI/CD settings
	 Missing authorization control merge requests
	 Improper access control branches and tags
	 Missing authentication for Prometheus alert endpoint
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/</url>
 <cvename>CVE-2018-20493</cvename>
 <cvename>CVE-2018-20492</cvename>
 <cvename>CVE-2018-20489</cvename>
 <cvename>CVE-2018-20490</cvename>
 <cvename>CVE-2018-20497</cvename>
 <cvename>CVE-2018-20495</cvename>
 <cvename>CVE-2018-20488</cvename>
 <cvename>CVE-2018-20494</cvename>
 <cvename>CVE-2018-20496</cvename>
 <cvename>CVE-2018-20491</cvename>
 <cvename>CVE-2018-20499</cvename>
 <cvename>CVE-2018-20500</cvename>
 <cvename>CVE-2018-20501</cvename>
 <cvename>CVE-2018-20498</cvename>
 <cvename>CVE-2018-20507</cvename>
 </references>
 <dates>
 <discovery>2018-12-31</discovery>
 <entry>2019-01-02</entry>
 </dates>
 </vuln>

<vuln vid="29d34524-0542-11e9-a444-080027fee39c">
 <topic>gitea -- privilege escalation, XSS</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea project reports:
	<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.6.2">
	 Security
	 <ul>
	 <li>Sanitize uploaded file names</li>
	 <li>HTMLEncode user added text</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/issues/5569</url>
 <url>https://github.com/go-gitea/gitea/issues/5565</url>
 </references>
 <dates>
 <discovery>2018-12-19</discovery>
 <entry>2018-12-21</entry>
 </dates>
 </vuln>

<vuln vid="f8fe2905-0918-11e9-a550-00262d164c21">
 <topic>rpm4 -- regression in -setperms, -setugids and -restore</topic>
 <affects>
 <package>
	<name>rpm4</name>
	<range><lt>4.14.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	rpm4 reports:
	<blockquote cite="http://rpm.org/wiki/Releases/4.14.2.1">
	 Regression in -setperms, -setugids and -restore
	 Note that this update can not automatically fix possible damage
	 done by using -setperms, -setugids or -restore with rpm 4.14.2, it
	 merely fixes the functionlity itself. Any damage needs to be
	 investigated and fixed manually, such as using -verify and -restore
	 or reinstalling packages.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://rpm.org/wiki/Releases/4.14.2.1</url>
 </references>
 <dates>
 <discovery>2018-10-22</discovery>
 <entry>2018-12-26</entry>
 </dates>
 </vuln>

<vuln vid="70b774a8-05bc-11e9-87ad-001b217b3468">
 <topic>Gitlab -- Arbitrary File read in Gitlab project import</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.5.0</ge><lt>11.5.5</lt></range>
	<range><ge>11.4.0</ge><lt>11.4.12</lt></range>
	<range><ge>8.9.0</ge><lt>11.3.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2018/12/20/critical-security-release-gitlab-11-dot-5-dot-5-released">
	 Arbitrary File read in Gitlab project import
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2018/12/20/critical-security-release-gitlab-11-dot-5-dot-5-released/</url>
 <cvename>CVE-2018-20229</cvename>
 </references>
 <dates>
 <discovery>2018-12-20</discovery>
 <entry>2018-12-22</entry>
 </dates>
 </vuln>

<vuln vid="4f8665d0-0465-11e9-b77a-6cc21735f730">
 <topic>shibboleth-sp -- crashes on malformed date/time content</topic>
 <affects>
 <package>
	<name>shibboleth-sp</name>
	<range><ge>3.0.0</ge><lt>3.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Shibboleth Consortium reports:
	<blockquote cite="https://shibboleth.net/community/advisories/secadv_20181219a.txt">
	 SAML messages, assertions, and metadata all commonly contain
	 date/time information in a standard XML format.
	 Invalid formatted data in such fields cause an exception of a type
	 that was not handled properly in the V3 software and causes a crash
	 (usually to the shibd daemon process, but possibly to Apache in rare
	 cases). Note that the crash occurs prior to evaluation of a message's
	 authenticity, so can be exploited by an untrusted attacker.
	 The problem is believed to be specific to the V3 software and would
	 not cause a crash in the older, now unsupported, V2 software.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://shibboleth.net/community/advisories/secadv_20181219a.txt</url>
 </references>
 <dates>
 <discovery>2018-12-19</discovery>
 <entry>2018-12-20</entry>
 </dates>
 </vuln>

<vuln vid="1999a215-fc6b-11e8-8a95-ac1f6b67e138">
 <topic>couchdb -- administrator privilege escalation</topic>
 <affects>
 <package>
	<name>couchdb</name>
	<range><lt>2.3.0,2</lt></range>
 </package>
 <package>
	<name>couchdb2</name>
	<range><lt>2.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache CouchDB PMC reports:
	<blockquote cite="https://lists.apache.org/thread.html/...">
	 Database Administrator could achieve privilege escalation to
	 the account that CouchDB runs under, by abusing insufficient validation
	 in the HTTP API, escaping security controls implemented in previous
	 releases.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://docs.couchdb.org/en/stable/cve/2018-17188.html</url>
 <cvename>CVE-2018-17188</cvename>
 </references>
 <dates>
 <discovery>2018-12-01</discovery>
 <entry>2018-12-13</entry>
 </dates>
 </vuln>

<vuln vid="b80f039d-579e-4b82-95ad-b534a709f220">
 <topic>bro -- "Magellan" remote code execution vulnerability in bundled sqlite</topic>
 <affects>
 <package>
	<name>bro</name>
	<range><lt>2.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bro Network security Monitor reports:
	<blockquote cite="https://www.bro.org/download/NEWS.bro.html">
	 Bro 2.6.1 updates the embedded SQLite to version 3.26.0
	 to address the "Magellan" remote code execution vulnerability.
	 The stock Bro configuration/scripts don't use SQLite by
	 default, but custom user scripts/packages may.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.bro.org/download/NEWS.bro.html</url>
 </references>
 <dates>
 <discovery>2018-12-01</discovery>
 <entry>2018-12-20</entry>
 </dates>
 </vuln>

<vuln vid="fa6a4a69-03d1-11e9-be12-a4badb2f4699">
 <topic>FreeBSD -- bootpd buffer overflow</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>12.0</ge><lt>12.0_1</lt></range>
	<range><ge>11.2</ge><lt>11.2_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to insufficient validation of network-provided data
	it may be possible for a malicious attacker to craft a bootp
	packet which could cause a stack buffer overflow.
	<h1>Impact:</h1>
	It is possible that the buffer overflow could lead to a
	Denial of Service or remote code execution.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-1716</cvename>
 <freebsdsa>SA-18:15.bootpd</freebsdsa>
 </references>
 <dates>
 <discovery>2018-12-19</discovery>
 <entry>2018-12-19</entry>
 </dates>
 </vuln>

<vuln vid="4b98613c-0078-11e9-b05b-00e04c1ea73d">
 <topic>wordpress -- multiple issues</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>5.0.1,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>zh_CN-wordpress</name>
	<name>zh_TW-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<range><lt>5.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wordpress developers reports:
	<blockquote cite="https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/">
	 WordPress versions 5.0 and earlier are affected by the following bugs, which are
	 fixed in version 5.0.1. Updated versions of WordPress 4.9 and older releases are
	 also available, for users who have not yet updated to 5.0.
	 Karim El Ouerghemmi discovered that authors could alter meta data to delete files
	 that they weren’t authorized to.
	 Simon Scannell of RIPS Technologies discovered that authors could create posts of
	 unauthorized post types with specially crafted input.
	 Sam Thomas discovered that contributors could craft meta data in a way that resulted
	 in PHP object injection.
	 Tim Coen discovered that contributors could edit new comments from higher-privileged
	 users, potentially leading to a cross-site scripting vulnerability.
	 Tim Coen also discovered that specially crafted URL inputs could lead to a cross-site
	 scripting vulnerability in some circumstances. WordPress itself was not affected,
	 but plugins could be in some situations.
	 Team Yoast discovered that the user activation screen could be indexed by search
	 engines in some uncommon configurations, leading to exposure of email addresses,
	 and in some rare cases, default generated passwords.
	 Tim Coen and Slavco discovered that authors on Apache-hosted sites could upload
	 specifically crafted files that bypass MIME verification, leading to a cross-site
	 scripting vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/</url>
 </references>
 <dates>
 <discovery>2018-12-13</discovery>
 <entry>2018-12-15</entry>
 </dates>
 </vuln>

<vuln vid="293f40a0-ffa1-11e8-b258-0011d823eebd">
 <topic>Mbed TLS -- Local timing attack on RSA decryption</topic>
 <affects>
 <package>
	<name>mbedtls</name>
	<range><lt>2.14.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Janos Follath reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-03">
	 An attacker who can run code on the same machine that is
	 performing an RSA decryption can potentially recover the plaintext
	 through a Bleichenbacher-like oracle.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-03</url>
 <cvename>CVE-2018-19608</cvename>
 </references>
 <dates>
 <discovery>2018-11-28</discovery>
 <entry>2018-12-14</entry>
 </dates>
 </vuln>

<vuln vid="bab29816-ff93-11e8-b05b-00e04c1ea73d">
 <topic>typo3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>typo3-8</name>
	<range><lt>8.7.21</lt></range>
 </package>
 <package>
	<name>typo3-9</name>
	<range><lt>9.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Typo3 core team reports:
	<blockquote cite="https://typo3.org/article/typo3-952-8721-and-7632-security-releases-published/">
	 CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr.
	 The vulnerability stemmed from the fact that it was possible to execute XSS inside
	 the CKEditor source area after persuading the victim to: (i) switch CKEditor to
	 source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker,
	 into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode.
	 Although this is an unlikely scenario, we recommend to upgrade to the latest editor version.
	 Failing to properly encode user input, online media asset rendering
	 (*.youtube and *.vimeo files) is vulnerable to cross-site scripting. A valid backend user
	 account or write access on the server system (e.g. SFTP) is needed in order to exploit this
	 vulnerability.
	 Failing to properly encode user input, notifications shown in modal windows in the TYPO3
	 backend are vulnerable to cross-site scripting. A valid backend user account is needed in
	 order to exploit this vulnerability.
	 Failing to properly encode user input, login status display is vulnerable to cross-site
	 scripting in the website frontend. A valid user account is needed in order to exploit this
	 vulnerability - either a backend user or a frontend user having the possibility to modify
	 their user profile.
	 Template patterns that are affected are:
	 <ul>
	 <li>###FEUSER_[fieldName]### using system extension felogin</li>
	 <li>&lt;!--###USERNAME###--&gt; for regular frontend rendering
	 (pattern can be defined individually using TypoScript setting
	 config.USERNAME_substToken)</li>
	 </ul>
	 It has been discovered that cookies created in the Install Tool are not hardened to be
	 submitted only via HTTP. In combination with other vulnerabilities such as cross-site
	 scripting it can lead to hijacking an active and valid session in the Install Tool.
	 The Install Tool exposes the current TYPO3 version number to non-authenticated users.
	 Online Media Asset Handling (*.youtube and *.vimeo files) in the TYPO3 backend is vulnerable
	 to denial of service. Putting large files with according file extensions results in high
	 consumption of system resources. This can lead to exceeding limits of the current PHP process
	 which results in a dysfunctional backend component. A valid backend user account or write
	 access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.
	 TYPO3’s built-in record registration functionality (aka “basic shopping cart”) using recs
	 URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous
	 user sessions are valid, attackers can use this vulnerability in order to create an arbitrary
	 amount of individual session-data records in the database.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://typo3.org/article/typo3-952-8721-and-7632-security-releases-published/</url>
 </references>
 <dates>
 <discovery>2018-12-11</discovery>
 <entry>2018-12-14</entry>
 </dates>
 </vuln>

<vuln vid="757e6ee8-ff91-11e8-a148-001b217b3468">
 <topic>Gitlab -- Arbitrary File read in GitLab project import with Git LFS</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.5.0</ge><lt>11.5.4</lt></range>
	<range><ge>11.4.0</ge><lt>11.4.11</lt></range>
	<range><ge>11.0.0</ge><lt>11.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2018/12/13/critical-security-release-gitlab-11-dot-5-dot-4-released/">
	 Arbitrary File read in GitLab project import with Git LFS
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2018/12/13/critical-security-release-gitlab-11-dot-5-dot-4-released/</url>
 <cvename>CVE-2018-20144</cvename>
 </references>
 <dates>
 <discovery>2018-12-13</discovery>
 <entry>2018-12-14</entry>
 </dates>
 </vuln>

<vuln vid="ed10ed3f-fddc-11e8-94cf-6805ca0b3d42">
 <topic>phpMyAdmin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<name>phpMyAdmin-php56</name>
	<name>phpMyAdmin-php70</name>
	<name>phpMyAdmin-php71</name>
	<name>phpMyAdmin-php72</name>
	<range><lt>4.8.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-6/">
	 <h3>Summary</h3>
	 Local file inclusion through transformation feature
	 <h3>Description</h3>
	 A flaw has been found where an attacker can exploit
	 phpMyAdmin to leak the contents of a local file. The
	 attacker must have access to the phpMyAdmin Configuration
	 Storage tables, although these can easily be created in any
	 database to which the attacker has access. An attacker must
	 have valid credentials to log in to phpMyAdmin; this
	 vulnerability does not allow an attacker to circumvent the
	 login system.
	 <h3>Severity</h3>
	 We consider this vulnerability to be severe.
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-7/">
	 <h3>Summary</h3>
	 XSRF/CSRF vulnerability in phpMyAdmin
	 <h3>Description</h3>
	 By deceiving a user to click on a crafted URL, it is
	 possible to perform harmful SQL operations such as renaming
	 databases, creating new tables/routines, deleting designer
	 pages, adding/deleting users, updating user passwords,
	 killing SQL processes, etc.
	 <h3>Severity</h3>
	 We consider this vulnerability to be of moderate severity.
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-8/">
	 <h3>Summary</h3>
	 XSS vulnerability in navigation tree
	 <h3>Description</h3>
	 A Cross-Site Scripting vulnerability was found in the
	 navigation tree, where an attacker can deliver a payload to
	 a user through a specially-crafted database/table name.
	 <h3>Severity</h3>
	 We consider this attack to be of moderate severity.
	 <h3>Mitigation factor</h3>
	 The stored XSS vulnerabilities can be triggered only by
	 someone who logged in to phpMyAdmin, as the usual token
	 protection prevents non-logged-in users from accessing the
	 required forms.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2018-6/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2018-7/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2018-8/</url>
 </references>
 <dates>
 <discovery>2018-12-11</discovery>
 <entry>2018-12-12</entry>
 </dates>
 </vuln>

<vuln vid="d10b49b2-8d02-49e8-afde-0844626317af">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>64.0_3,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.2.6</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.53.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>60.4.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>60.4.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>60.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/">
	 CVE-2018-12407: Buffer overflow with ANGLE library when using VertexBuffer11 module
	 CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11
	 CVE-2018-18492: Use-after-free with select element
	 CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia
	 CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs
	 CVE-2018-18495: WebExtension content scripts can be loaded in about: pages
	 CVE-2018-18496: Embedded feed preview page can be abused for clickjacking
	 CVE-2018-18497: WebExtensions can load arbitrary URLs through pipe separators
	 CVE-2018-18498: Integer overflow when calculating buffer sizes for images
	 CVE-2018-12406: Memory safety bugs fixed in Firefox 64
	 CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-12405</cvename>
 <cvename>CVE-2018-12406</cvename>
 <cvename>CVE-2018-12407</cvename>
 <cvename>CVE-2018-17466</cvename>
 <cvename>CVE-2018-18492</cvename>
 <cvename>CVE-2018-18493</cvename>
 <cvename>CVE-2018-18494</cvename>
 <cvename>CVE-2018-18495</cvename>
 <cvename>CVE-2018-18496</cvename>
 <cvename>CVE-2018-18497</cvename>
 <cvename>CVE-2018-18498</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-30/</url>
 </references>
 <dates>
 <discovery>2018-12-11</discovery>
 <entry>2018-12-11</entry>
 <modified>2019-07-23</modified>
 </dates>
 </vuln>

<vuln vid="32498c8f-fc84-11e8-be12-a4badb2f4699">
 <topic>FreeBSD -- Insufficient bounds checking in bhyve(8) device model</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.2</ge><lt>11.2_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Insufficient bounds checking in one of the device models
	provided by bhyve(8) can permit a guest operating system
	to overwrite memory in the bhyve(8) processing possibly
	permitting arbitary code execution.
	<h1>Impact:</h1>
	A guest OS using a firmware image can cause the bhyve
	process to crash, or possibly execute arbitrary code on the
	host as root.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-1716</cvename>
 <freebsdsa>SA-18:14.bhyve</freebsdsa>
 </references>
 <dates>
 <discovery>2018-12-04</discovery>
 <entry>2018-12-10</entry>
 </dates>
 </vuln>

<vuln vid="268a4289-fc84-11e8-be12-a4badb2f4699">
 <topic>FreeBSD -- Multiple vulnerabilities in NFS server code</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.2</ge><lt>11.2_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Insufficient and improper checking in the NFS server
	code could cause a denial of service or possibly remote
	code execution via a specially crafted network packet.
	<h1>Impact:</h1>
	A remote attacker could cause the NFS server to crash,
	resulting in a denial of service, or possibly execute
	arbitrary code on the server.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-1715</cvename>
 <freebsdsa>SA-18:13.nfs</freebsdsa>
 </references>
 <dates>
 <discovery>2018-11-27</discovery>
 <entry>2018-12-10</entry>
 </dates>
 </vuln>

<vuln vid="2a86f45a-fc3c-11e8-a414-00155d006b02">
 <topic>node.js -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>node6</name>
	<range><lt>6.15.0</lt></range>
 </package>
 <package>
	<name>node8</name>
	<range><lt>8.14.0</lt></range>
 </package>
 <package>
	<name>node10</name>
	<range><lt>10.14.0</lt></range>
 </package>
 <package>
	<name>node</name>
	<range><lt>11.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/">
	 Updates are now available for all active Node.js release lines. These include fixes for the vulnerabilities identified in the initial announcement. They also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2q, and upgrades of Node.js 10 and 11 to OpenSSL 1.1.0j.
	 We recommend that all Node.js users upgrade to a version listed below as soon as possible.
	 <h1>Debugger port 5858 listens on any interface by default (CVE-2018-12120)</h1>
	 All versions of Node.js 6 are vulnerable and the severity is HIGH. When the debugger is enabled with <code>node --debug</code> or <code>node debug</code>, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as <code>node --debug=localhost</code>. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.
	 <h1>Denial of Service with large HTTP headers (CVE-2018-12121)</h1>
	 All versions of 6 and later are vulnerable and the severity is HIGH. By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.
	 The total size of HTTP headers received by Node.js now must not exceed 8192 bytes.
	 <h1>"Slowloris" HTTP Denial of Service (CVE-2018-12122)</h1>
	 All versions of Node.js 6 and later are vulnerable and the severity is LOW. An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time. Attack potential is mitigated by the use of a load balancer or other proxy layer.
	 A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with <code>server.headersTimeout</code>. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with <code>server.setTimeout()</code>, this aids in protecting against excessive resource retention and possible Denial of Service.
	 <h1>Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)</h1>
	 All versions of Node.js 6 and later are vulnerable and the severity is LOW. If a Node.js application is using <code>url.parse()</code> to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.
	 <h1>HTTP request splitting (CVE-2018-12116)</h1>
	 Node.js 6 and 8 are vulnerable and the severity is MEDIUM. If Node.js can be convinced to use unsanitized user-provided Unicode data for the <code>path</code> option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
	 <h1>OpenSSL Timing vulnerability in ECDSA signature generation (CVE-2018-0735)</h1>
	 The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side-channel attack. An attacker could use variations in the signing algorithm to recover the private key.
	 <h1>OpenSSL Timing vulnerability in DSA signature generation (CVE-2018-0734)</h1>
	 The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side-channel attack. An attacker could use variations in the signing algorithm to recover the private key.
	 <h1>OpenSSL Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)</h1>
	 OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has been shown to be vulnerable to a microarchitecture timing side-channel attack. An attacker with sufficient access to mount local timing attacks during ECDSA signature generation could recover the private key.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/</url>
 <cvename>CVE-2018-12120</cvename>
 <cvename>CVE-2018-12121</cvename>
 <cvename>CVE-2018-12122</cvename>
 <cvename>CVE-2018-12123</cvename>
 <cvename>CVE-2018-12116</cvename>
 <cvename>CVE-2018-0735</cvename>
 <cvename>CVE-2018-0734</cvename>
 <cvename>CVE-2018-5407</cvename>
 </references>
 <dates>
 <discovery>2018-11-27</discovery>
 <entry>2018-12-10</entry>
 </dates>
 </vuln>

<vuln vid="f6d6308a-f2ec-11e8-b005-6805ca2fa271">
 <topic>powerdns-recursor -- Crafted query can cause a denial of service</topic>
 <affects>
 <package>
 <name>powerdns-recursor</name>
 <range><lt>4.1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	powerdns Team reports:
	<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.1.html">
	 CVE-2018-16855: An issue has been found in PowerDNS Recursor where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of the query for a packet cache lookup, possibly leading to a crash. When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd, a crash will lead to an automatic restart, limiting the impact to a somewhat degraded service.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://doc.powerdns.com/recursor/changelog/4.1.html</url>
 <cvename>CVE-2018-16855</cvename>
 </references>
 <dates>
 <discovery>2018-11-26</discovery>
 <entry>2018-12-09</entry>
 </dates>
 </vuln>

<vuln vid="0e8f496a-b498-11e8-bdcf-74d435e60b7c">
 <topic>py-asyncssh -- Allows bypass of authentication</topic>
 <affects>
 <package>
	<name>py-asyncssh</name>
	<range><lt>1.12.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mitre.org Reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7749">
		The SSH server implementation of AsyncSSH before 1.12.1 does not properly check
		whether authentication is completed before processing other requests
		A customized SSH client can simply skip the authentication step.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7749</url>
 </references>
 <dates>
 <discovery>2018-03-07</discovery>
 <entry>2018-12-08</entry>
 </dates>
 </vuln>

<vuln vid="9d3428d4-f98c-11e8-a148-001b217b3468">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.5.0</ge><lt>11.5.3</lt></range>
	<range><ge>11.4.0</ge><lt>11.4.10</lt></range>
	<range><ge>8.11.0</ge><lt>11.3.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released">
	 Directory Traversal in Templates API
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released/</url>
 <cvename>CVE-2018-19856</cvename>
 </references>
 <dates>
 <discovery>2018-12-06</discovery>
 <entry>2018-12-06</entry>
 </dates>
 </vuln>

<vuln vid="49cbe200-f92a-11e8-a89d-d43d7ef03aa6">
 <topic>Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>32.0.0.101</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-42.html">
	 <ul>
	 <li>This update resolves a use-after-free vulnerability that
	 could lead to arbitrary code execution (CVE-2018-15982).</li>
	 <li>This update resolves an insecure library loading vulnerability that
	 could lead to privilege escalation (CVE-2018-15983).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-15982</cvename>
 <cvename>CVE-2018-15983</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb18-42.html</url>
 </references>
 <dates>
 <discovery>2018-12-05</discovery>
 <entry>2018-12-06</entry>
 </dates>
 </vuln>

<vuln vid="3aa27226-f86f-11e8-a085-3497f683cb16">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.154</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.138.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://jenkins.io/security/advisory/2018-12-05/">
	 <h1>Description</h1>
	 <h5>(Critical) SECURITY-595</h5>
	 Code execution through crafted URLs
	 <h5>(Medium) SECURITY-904</h5>
	 Forced migration of user records
	 <h5>(Medium) SECURITY-1072</h5>
	 Workspace browser allowed accessing files outside the workspace
	 <h5>(Medium) SECURITY-1193</h5>
	 Potential denial of service through cron expression form validation
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://jenkins.io/security/advisory/2018-12-05/</url>
 </references>
 <dates>
 <discovery>2018-12-05</discovery>
 <entry>2018-12-05</entry>
 </dates>
 </vuln>

<vuln vid="889e35f4-f6a0-11e8-82dc-fcaa147e860e">
 <topic>moodle -- Login CSRF vulnerability</topic>
 <affects>
 <package>
	<name>moodle31</name>
	<range><lt>3.1.15</lt></range>
 </package>
 <package>
	<name>moodle33</name>
	<range><lt>3.3.9</lt></range>
 </package>
 <package>
	<name>moodle34</name>
	<range><lt>3.4.6</lt></range>
 </package>
 <package>
	<name>moodle35</name>
	<range><lt>3.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 moodle reports:
 <blockquote cite="https://moodle.org/mod/forum/discuss.php?d=378731">
	 The login form is not protected by a token to prevent login cross-site
	 request forgery.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-16854</cvename>
 <url>https://moodle.org/mod/forum/discuss.php?d=378731</url>
 </references>
 <dates>
 <discovery>2018-11-06</discovery>
 <entry>2018-12-03</entry>
 </dates>
 </vuln>

<vuln vid="f96044a2-7df9-414b-9f6b-6e5b85d06c86">
 <topic>Rails -- Active Job vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-activejob4</name>
	<range><lt>4.2.11</lt></range>
 </package>
 <package>
	<name>rubygem-activejob5</name>
	<range><lt>5.1.6.1</lt></range>
 </package>
 <package>
	<name>rubygem-activejob50</name>
	<range><lt>5.0.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails blog:
	<blockquote cite="https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/">
	 Rails 4.2.11, 5.0.7.1, 5.1.6.1 and 5.2.1.1 have been released! These
	 contain the following important security fixes, and it is recommended
	 that users upgrade as soon as possible
	 CVE-2018-16476 Broken Access Control vulnerability in Active Job:
	 Carefully crafted user input can cause Active Job to deserialize it
	 using GlobalId and allow an attacker to have access to information that
	 they should not have.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/</url>
 <cvename>CVE-2018-16476</cvename>
 </references>
 <dates>
 <discovery>2018-11-27</discovery>
 <entry>2018-12-02</entry>
 </dates>
 </vuln>

<vuln vid="3563fae5-f60c-11e8-b513-5404a68ad561">
 <topic>uriparser -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>uriparser</name>
	<range><lt>0.9.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The upstream project reports:
	<blockquote cite="https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog">
	 * Fixed: Out-of-bounds write in uriComposeQuery* and uriComposeQueryEx*
	 Commit 864f5d4c127def386dd5cc926ad96934b297f04e
	 Thanks to Google Autofuzz team for the report!
	 * Fixed: Detect integer overflow in uriComposeQuery* and uriComposeQueryEx*
	 Commit f76275d4a91b28d687250525d3a0c5509bbd666f
	 Thanks to Google Autofuzz team for the report!
	 * Fixed: Protect uriResetUri* against acting on NULL input
	 Commit f58c25069cf4a986fe17a80c5b38687e31feb539
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-19198</cvename>
 <cvename>CVE-2018-19199</cvename>
 <cvename>CVE-2018-19200</cvename>
 <url>https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog</url>
 </references>
 <dates>
 <discovery>2018-10-27</discovery>
 <entry>2018-12-02</entry>
 </dates>
 </vuln>

<vuln vid="c7b1af20-f34f-11e8-9cde-e0d55e2a8bf9">
 <topic>messagelib -- HTML email can open browser window automatically</topic>
 <affects>
 <package>
	<name>messagelib</name>
	<range><lt>18.08.3_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Albert Astals Cid reports:
	<blockquote cite="https://www.kde.org/info/security/advisory-20181128-1.txt">
	 messagelib is the library used by KMail to display emails.
	 messagelib by default displays emails as plain text, but gives the user
	 an option to "Prefer HTML to plain text" in the settings and if that option
	 is not enabled there is way to enable HTML display when an email contains HTML.
	 Some HTML emails can trick messagelib into opening a new browser window when
	 displaying said email as HTML.
	 This happens even if the option to allow the HTML emails to access
	 remote servers is disabled in KMail settings.
	 This means that the owners of the servers referred in the email can see
	 in their access logs your IP address.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-19516</cvename>
 <url>https://www.kde.org/info/security/advisory-20181128-1.txt</url>
 </references>
 <dates>
 <discovery>2018-11-28</discovery>
 <entry>2018-11-28</entry>
 </dates>
 </vuln>

<vuln vid="93f8e0ff-f33d-11e8-be46-0019dbb15b3f">
 <topic>payara -- Default typing issue in Jackson Databind</topic>
 <affects>
 <package>
	<name>payara</name>
	<range><eq>4.1.2.181.3</eq></range>
	<range><eq>4.1.2.182</eq></range>
	<range><eq>5.181.3</eq></range>
	<range><eq>5.182</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7489">
	 FasterXML jackson-databind before 2.8.11.1 and 2.9.x before
	 2.9.5 allows unauthenticated remote code execution because of
	 an incomplete fix for the CVE-2017-7525 deserialization flaw.
	 This is exploitable by sending maliciously crafted JSON input
	 to the readValue method of the ObjectMapper, bypassing a
	 blacklist that is ineffective if the c3p0 libraries are
	 available in the classpath.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7489</url>
 <cvename>CVE-2018-7489</cvename>
 </references>
 <dates>
 <discovery>2018-02-26</discovery>
 <entry>2018-11-28</entry>
 </dates>
 </vuln>

<vuln vid="22bc5327-f33f-11e8-be46-0019dbb15b3f">
 <topic>payara -- Code execution via crafted PUT requests to JSPs</topic>
 <affects>
 <package>
	<name>payara</name>
	<range><eq>4.1.2.174</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12615">
	 When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP
	 PUTs enabled (e.g. via setting the readonly initialisation
	 parameter of the Default to false) it was possible to upload a
	 JSP file to the server via a specially crafted request. This
	 JSP could then be requested and any code it contained would be
	 executed by the server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12615</url>
 <cvename>CVE-2017-12615</cvename>
 </references>
 <dates>
 <discovery>2017-08-07</discovery>
 <entry>2018-11-28</entry>
 </dates>
 </vuln>

<vuln vid="d70c9e18-f340-11e8-be46-0019dbb15b3f">
 <topic>payara -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>payara</name>
	<range><eq>4.1.2.173</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031">
	 Apache Commons FileUpload before 1.3.3
	 DiskFileItem File Manipulation Remote Code Execution.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3239">
	 Vulnerability in the Oracle GlassFish Server component of
	 Oracle Fusion Middleware (subcomponent: Administration).
	 Supported versions that are affected are 3.0.1 and 3.1.2.
	 Easily exploitable vulnerability allows low privileged attacker
	 with logon to the infrastructure where Oracle GlassFish Server
	 executes to compromise Oracle GlassFish Server. Successful
	 attacks of this vulnerability can result in unauthorized read
	 access to a subset of Oracle GlassFish Server accessible data.
	 CVSS v3.0 Base Score 3.3 (Confidentiality impacts).
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3247">
	 Vulnerability in the Oracle GlassFish Server component of Oracle
	 Fusion Middleware (subcomponent: Core). Supported versions that
	 are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable
	 vulnerability allows unauthenticated attacker with network access
	 via SMTP to compromise Oracle GlassFish Server. Successful
	 attacks require human interaction from a person other than the
	 attacker. Successful attacks of this vulnerability can result in
	 unauthorized update, insert or delete access to some of Oracle
	 GlassFish Server accessible data. CVSS v3.0 Base Score 4.3
	 (Integrity impacts).
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3249">
	 Vulnerability in the Oracle GlassFish Server component of
	 Oracle Fusion Middleware (subcomponent: Security). Supported
	 versions that are affected are 2.1.1, 3.0.1 and 3.1.2.
	 Easily exploitable vulnerability allows unauthenticated attacker
	 with network access via LDAP to compromise Oracle GlassFish Server.
	 Successful attacks of this vulnerability can result in unauthorized
	 update, insert or delete access to some of Oracle GlassFish Server
	 accessible data as well as unauthorized read access to a subset of
	 Oracle GlassFish Server accessible data and unauthorized ability
	 to cause a partial denial of service (partial DOS) of Oracle
	 GlassFish Server. CVSS v3.0 Base Score 7.3 (Confidentiality,
	 Integrity and Availability impacts).
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3250">
	 Vulnerability in the Oracle GlassFish Server component of Oracle
	 Fusion Middleware (subcomponent: Security). Supported versions that
	 are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable
	 vulnerability allows unauthenticated attacker with network access
	 via HTTP to compromise Oracle GlassFish Server. Successful attacks
	 of this vulnerability can result in unauthorized update, insert or
	 delete access to some of Oracle GlassFish Server accessible data as
	 well as unauthorized read access to a subset of Oracle GlassFish
	 Server accessible data and unauthorized ability to cause a partial
	 denial of service (partial DOS) of Oracle GlassFish Server.
	 CVSS v3.0 Base Score 7.3 (Confidentiality, Integrity and
	 Availability impacts).
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5528">
	 Vulnerability in the Oracle GlassFish Server component of Oracle
	 Fusion Middleware (subcomponent: Security). Supported versions that
	 are affected are 2.1.1, 3.0.1 and 3.1.2. Difficult to exploit
	 vulnerability allows unauthenticated attacker with network access
	 via multiple protocols to compromise Oracle GlassFish Server. While
	 the vulnerability is in Oracle GlassFish Server, attacks may
	 significantly impact additional products. Successful attacks of this
	 vulnerability can result in takeover of Oracle GlassFish Server.
	 CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and
	 Availability impacts).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031</url>
 <cvename>CVE-2016-1000031</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3239</url>
 <cvename>CVE-2017-3239</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3247</url>
 <cvename>CVE-2017-3247</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3249</url>
 <cvename>CVE-2017-3249</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3250</url>
 <cvename>CVE-2017-3250</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5528</url>
 <cvename>CVE-2016-5528</cvename>
 </references>
 <dates>
 <discovery>2016-06-16</discovery>
 <entry>2018-11-28</entry>
 </dates>
 </vuln>

<vuln vid="8a4aba2d-f33e-11e8-9416-001b217b3468">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.5.0</ge><lt>11.5.1</lt></range>
	<range><ge>11.4.0</ge><lt>11.4.8</lt></range>
	<range><ge>0</ge><lt>11.3.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released">
	 View Names of Private Groups
	 Persistent XSS in Environments
	 SSRF in Prometheus integration
	 Unauthorized Promotion of Milestones
	 Exposure of Confidential Issue Title
	 Persisent XSS in Markdown Fields via Mermaid Script
	 Persistent XSS in Markdown Fields via Unrecognized HTML Tags
	 Symlink Race Condition in Pages
	 Unauthorized Changes by Guest User in Issues
	 Unauthorized Comments on Locked Issues
	 Improper Enforcement of Token Scope
	 CRLF Injection in Project Mirroring
	 XSS in OAuth Authorization
	 SSRF in Webhooks
	 Send Email on Email Address Change
	 Workhorse Logs Contained Tokens
	 Unauthorized Publishing of Draft Comments
	 Guest Can Set Weight of a New Issue
	 Disclosure of Private Group's Members and Milestones
	 Persisent XSS in Operations
	 Reporter Can View Operations Page
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/</url>
 <cvename>CVE-2018-19494</cvename>
 <cvename>CVE-2018-19493</cvename>
 <cvename>CVE-2018-19495</cvename>
 <cvename>CVE-2018-19496</cvename>
 <cvename>CVE-2018-19577</cvename>
 <cvename>CVE-2018-19573</cvename>
 <cvename>CVE-2018-19570</cvename>
 <cvename>CVE-2018-19572</cvename>
 <cvename>CVE-2018-19576</cvename>
 <cvename>CVE-2018-19575</cvename>
 <cvename>CVE-2018-19569</cvename>
 <cvename>CVE-2018-19585</cvename>
 <cvename>CVE-2018-19574</cvename>
 <cvename>CVE-2018-19571</cvename>
 <cvename>CVE-2018-19580</cvename>
 <cvename>CVE-2018-19583</cvename>
 <cvename>CVE-2018-19582</cvename>
 <cvename>CVE-2018-19581</cvename>
 <cvename>CVE-2018-19584</cvename>
 <cvename>CVE-2018-19579</cvename>
 <cvename>CVE-2018-19578</cvename>
 </references>
 <dates>
 <discovery>2018-11-28</discovery>
 <entry>2018-11-28</entry>
 </dates>
 </vuln>

<vuln vid="54976998-f248-11e8-81e2-005056a311d1">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba46</name>
	<range><le>4.6.16</le></range>
 </package>
 <package>
	<name>samba47</name>
	<range><lt>4.7.12</lt></range>
 </package>
 <package>
	<name>samba48</name>
	<range><lt>4.8.7</lt></range>
 </package>
 <package>
	<name>samba49</name>
	<range><lt>4.9.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The samba project reports:
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-14629.html">
	 All versions of Samba from 4.0.0 onwards are vulnerable to infinite
	 query recursion caused by CNAME loops. Any dns record can be added via
	 ldap by an unprivileged user using the ldbadd tool, so this is a
	 security issue.
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16841.html">
	 When configured to accept smart-card authentication, Samba's KDC will call
	 talloc_free() twice on the same memory if the principal in a validly signed
	 certificate does not match the principal in the AS-REQ.
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16851.html">
	 During the processing of an LDAP search before Samba's AD DC returns
	 the LDAP entries to the client, the entries are cached in a single
	 memory object with a maximum size of 256MB. When this size is
	 reached, the Samba process providing the LDAP service will follow the
	 NULL pointer, terminating the process.
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16852.html">
	 During the processing of an DNS zone in the DNS management DCE/RPC server,
	 the internal DNS server or the Samba DLZ plugin for BIND9, if the
	 DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS
	 property is set, the server will follow a NULL pointer and terminate
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16853.html">
	 A user in a Samba AD domain can crash the KDC when Samba is built in the
	 non-default MIT Kerberos configuration.
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16857.html">
	 AD DC Configurations watching for bad passwords (to restrict brute forcing
	 of passwords) in a window of more than 3 minutes may not watch for bad
	 passwords at all.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/security/CVE-2018-14629.html</url>
 <cvename>CVE-2018-14629</cvename>
 <url>https://www.samba.org/samba/security/CVE-2018-16841.html</url>
 <cvename>CVE-2018-16841</cvename>
 <url>https://www.samba.org/samba/security/CVE-2018-16851.html</url>
 <cvename>CVE-2018-16851</cvename>
 <url>https://www.samba.org/samba/security/CVE-2018-16852.html</url>
 <cvename>CVE-2018-16852</cvename>
 <url>https://www.samba.org/samba/security/CVE-2018-16853.html</url>
 <cvename>CVE-2018-16853</cvename>
 <url>https://www.samba.org/samba/security/CVE-2018-16857.html</url>
 <cvename>CVE-2018-16857</cvename>
 </references>
 <dates>
 <discovery>2018-08-14</discovery>
 <entry>2018-08-14</entry>
 </dates>
 </vuln>

<vuln vid="ec49f6b5-ee39-11e8-b2f4-74d435b63d51">
 <topic>php-imap -- imap_open allows to run arbitrary shell commands via mailbox parameter</topic>
 <affects>
 <package>
	<name>php56-imap</name>
	<range><lt>5.6.38_1</lt></range>
 </package>
 <package>
	<name>php70-imap</name>
	<range><lt>*</lt></range>
 </package>
 <package>
	<name>php71-imap</name>
	<range><lt>*</lt></range>
 </package>
 <package>
	<name>php72-imap</name>
	<range><lt>*</lt></range>
 </package>
 <package>
	<name>php73-imap</name>
	<range><lt>*</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP team reports:
	<blockquote cite="https://bugs.php.net/bug.php?id=77153">
	 imap_open allows to run arbitrary shell commands via mailbox parameter.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.php.net/bug.php?id=77153</url>
 </references>
 <dates>
 <discovery>2018-10-23</discovery>
 <entry>2018-11-22</entry>
 <modified>2018-11-22</modified>
 </dates>
 </vuln>

<vuln vid="b036faba-edd8-11e8-b3b7-00e04c1ea73d">
 <topic>phpmailer -- Multiple vulnerability</topic>
 <affects>
 <package>
	<name>phpmailer</name>
	<range><lt>5.2.27</lt></range>
 </package>
 <package>
	<name>phpmailer6</name>
	<range><lt>6.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHPMailer Team reports:
	<blockquote cite="https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6">
	 CVE-2018-19296:Fix potential object injection vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.27</url>
 <url>https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6</url>
 <cvename>CVE-2018-19296</cvename>
 </references>
 <dates>
 <discovery>2018-11-16</discovery>
 <entry>2018-11-21</entry>
 <modified>2018-11-23</modified>
 </dates>
 </vuln>

<vuln vid="8f128c72-ecf9-11e8-aa00-6451062f0f7a">
 <topic>Flash Player -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>31.0.0.153</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-44.html">
	 <ul>
	 <li>This update resolves a type confusion vulnerability that
	 could lead to arbitrary code execution (CVE-2018-15981).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-15981</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb18-44.html</url>
 </references>
 <dates>
 <discovery>2018-11-20</discovery>
 <entry>2018-11-20</entry>
 </dates>
 </vuln>

<vuln vid="d889d32c-ecd9-11e8-9416-001b217b3468">
 <topic>Gitlab -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.4.0</ge><lt>11.4.6</lt></range>
	<range><ge>8.9.0</ge><lt>11.3.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/">
	 Persistent XSS Autocompletion
	 Unauthorized service template creation
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/</url>
 <cvename>CVE-2018-18643</cvename>
 <cvename>CVE-2018-19359</cvename>
 </references>
 <dates>
 <discovery>2018-11-19</discovery>
 <entry>2018-11-20</entry>
 </dates>
 </vuln>

<vuln vid="0aee2f13-ec1d-11e8-8c92-6805ca2fa271">
 <topic>powerdns -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>powerdns</name>
	<range><lt>4.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Team reports:
	<blockquote cite="https://doc.powerdns.com/authoritative/changelog/4.1.html">
	 CVE-2018-10851: An issue has been found in PowerDNS Authoritative Server allowing
	 an authorized user to cause a memory leak by inserting a specially crafted record
	 in a zone under their control, then sending a DNS query for that record. The issue
	 is due to the fact that some memory is allocated before the parsing and is not
	 always properly released if the record is malformed. When the PowerDNS
	 Authoritative Server is run inside the guardian (--guardian), or inside a
	 supervisor like supervisord or systemd, an out-of-memory crash will lead to an
	 automatic restart, limiting the impact to a somewhat degraded service.
	 CVE-2018-14626: An issue has been found in PowerDNS Authoritative Server allowing
	 a remote user to craft a DNS query that will cause an answer without DNSSEC
	 records to be inserted into the packet cache and be returned to clients asking for
	 DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname
	 and qtype. For a DNSSEC-signed domain, this means that DNSSEC validating clients
	 will consider the answer to be bogus until it expires from the packet cache,
	 leading to a denial of service.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://doc.powerdns.com/authoritative/changelog/4.1.html</url>
 <cvename>CVE-2018-10851</cvename>
 <cvename>CVE-2018-14626</cvename>
 </references>
 <dates>
 <discovery>2018-11-06</discovery>
 <entry>2018-11-19</entry>
 </dates>
 </vuln>

<vuln vid="e9aa0e4c-ea8b-11e8-a5b7-00e04c1ea73d">
 <topic>powerdns-recursor -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><lt>4.1.7</lt></range>
 </package>
 <package>
	<name>powerdns-recursor40</name>
	<range><lt>4.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	powerdns Team reports:
	<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.1.html">
	 CVE-2018-10851: An issue has been found in PowerDNS Recursor allowing
	 a malicious authoritative server to cause a memory leak by sending specially
	 crafted records. The issue is due to the fact that some memory is allocated
	 before the parsing and is not always properly released if the record is malformed.
	 When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd,
	 an out-of-memory crash will lead to an automatic restart, limiting the impact to
	 a somewhat degraded service.
	 CVE-2018-14626: An issue has been found in PowerDNS Recursor allowing a remote
	 user to craft a DNS query that will cause an answer without DNSSEC records to be
	 inserted into the packet cache and be returned to clients asking for DNSSEC
	 records, thus hiding the presence of DNSSEC signatures for a specific qname and
	 qtype. For a DNSSEC-signed domain, this means that clients performing DNSSEC
	 validation by themselves might consider the answer to be bogus until it expires
	 from the packet cache, leading to a denial of service.
	 CVE-2018-14644: An issue has been found in PowerDNS Recursor where a remote attacker
	 sending a DNS query for a meta-type like OPT can lead to a zone being wrongly cached
	 as failing DNSSEC validation. It only arises if the parent zone is signed, and all
	 the authoritative servers for that parent zone answer with FORMERR to a query for at
	 least one of the meta-types. As a result, subsequent queries from clients requesting
	 DNSSEC validation will be answered with a ServFail.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://doc.powerdns.com/recursor/changelog/4.1.html</url>
 <cvename>CVE-2018-10851</cvename>
 <cvename>CVE-2018-14626</cvename>
 <cvename>CVE-2018-14644</cvename>
 </references>
 <dates>
 <discovery>2018-11-06</discovery>
 <entry>2018-11-17</entry>
 <modified>2018-11-19</modified>
 </dates>
 </vuln>

<vuln vid="c6fb2734-e835-11e8-b14b-001999f8d30b">
 <topic>asterisk -- Remote crash vulnerability DNS SRV and NAPTR lookups</topic>
 <affects>
 <package>
	<name>asterisk15</name>
	<range><lt>15.6.1</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><lt>16.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 There is a buffer overflow vulnerability in dns_srv
	 and dns_naptr functions of Asterisk that allows an attacker
	 to crash Asterisk via a specially crafted DNS SRV or NAPTR
	 response. The attackers request causes Asterisk to segfault
	 and crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2018-010.html</url>
 </references>
 <dates>
 <discovery>2018-10-23</discovery>
 <entry>2018-11-14</entry>
 </dates>
 </vuln>

<vuln vid="b69292e8-e798-11e8-ae07-6451062f0f7a">
 <topic>Flash Player -- information disclosure</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>31.0.0.148</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-39.html">
	 <ul>
	 <li>This update resolves a out-of-bounds vulnerability that
	 could lead to information disclosure (CVE-2018-15978).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-15978</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb18-39.html</url>
 </references>
 <dates>
 <discovery>2018-11-13</discovery>
 <entry>2018-11-13</entry>
 </dates>
 </vuln>

<vuln vid="6f170cf2-e6b7-11e8-a9a8-b499baebfeaf">
 <topic>OpenSSL -- timing vulnerability</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2p_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20181112.txt">
	 Microarchitecture timing vulnerability in ECC scalar
	 multiplication. Severity: Low 
	 OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has
	 been shown to be vulnerable to a microarchitecture timing side channel
	 attack. An attacker with sufficient access to mount local timing
	 attacks during ECDSA signature generation could recover the private
	 key.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20181112.txt</url>
 <cvename>CVE-2018-5407</cvename>
 </references>
 <dates>
 <discovery>2018-11-12</discovery>
 <entry>2018-11-12</entry>
 </dates>
 </vuln>

<vuln vid="1460aa25-e6ab-11e8-a733-e0d55e2a8bf9">
 <topic>kio-extras -- HTML Thumbnailer automatic remote file access</topic>
 <affects>
 <package>
	<name>kio-extras</name>
	<range><lt>18.08.3_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Albert Astals Cid reports:
	<blockquote cite="https://www.kde.org/info/security/advisory-20181012-1.txt">
	 Various KDE applications share a plugin system to create thumbnails
	 of various file types for displaying in file managers, file dialogs, etc.
	 kio-extras contains a thumbnailer plugin for HTML files.
	 
	 
	 The HTML thumbnailer was incorrectly accessing some content of
	 remote URLs listed in HTML files. This meant that the owners of the servers
	 referred in HTML files in your system could have seen in their access logs
	 your IP address every time the thumbnailer tried to create the thumbnail.
	 
	 
	 The HTML thumbnailer has been removed in upcoming KDE Applications 18.12.0
	 because it was actually not creating thumbnails for files at all.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-19120</cvename>
 <url>https://www.kde.org/info/security/advisory-20181012-1.txt</url>
 </references>
 <dates>
 <discovery>2018-11-12</discovery>
 <entry>2018-11-12</entry>
 </dates>
 </vuln>

<vuln vid="791841a3-d484-4878-8909-92ef9ce424f4">
 <topic>patch -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>patch</name>
	<range><lt>2.7.6_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6951">
	 An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuit_diff_type function in pch.c, aka a "mangled rename" issue.
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6952">
	 A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-1000156">
	 GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6951</cvename>
 <cvename>CVE-2018-6952</cvename>
 <cvename>CVE-2018-1000156</cvename>
 <url>https://savannah.gnu.org/bugs/?53132</url>
 <url>https://savannah.gnu.org/bugs/?53133</url>
 <url>https://savannah.gnu.org/bugs/?53566</url>
 </references>
 <dates>
 <discovery>2018-04-16</discovery>
 <entry>2018-11-11</entry>
 <modified>2018-11-11</modified>
 </dates>
 </vuln>

<vuln vid="92a6efd0-e40d-11e8-ada4-408d5cf35399">
 <topic>lighttpd - use-after-free vulnerabilities</topic>
 <affects>
 <package>
	<name>lighttpd</name>
	<range><lt>1.4.51</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Lighttpd Project reports:
	<blockquote cite="https://www.lighttpd.net/2018/10/14/1.4.51/">
	 Security fixes for Lighttpd:
	 <ul>
	 <li>security: process headers after combining folded headers</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.lighttpd.net/2018/10/14/1.4.51/</url>
 <freebsdpr>ports/232278</freebsdpr>
 </references>
 <dates>
 <discovery>2018-08-26</discovery>
 <entry>2018-11-09</entry>
 </dates>
 </vuln>

<vuln vid="1c27a706-e3aa-11e8-b77a-6cc21735f730">
 <topic>PostgreSQL -- SQL injection in pg_upgrade and pg_dump</topic>
 <affects>
 <package>
	<name>postgresql10-server</name>
	<range><lt>10.6</lt></range>
 </package>
 <package>
	<name>postgresql96-server</name>
	<range><lt>9.6.11</lt></range>
 </package>
 <package>
	<name>postgresql95-server</name>
	<range><lt>9.5.15</lt></range>
 </package>
 <package>
	<name>postgresql94-server</name>
	<range><lt>9.4.20</lt></range>
 </package>
 <package>
	<name>postgresql93-server</name>
	<range><lt>9.3.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/about/news/1878/">
	 CVE-2018-16850: SQL injection in pg_upgrade and pg_dump,
	 via CREATE TRIGGER ... REFERENCING.
	 Using a purpose-crafted trigger definition, an attacker can run
	 arbitrary SQL statements with superuser privileges when a superuser
	 runs pg_upgrade on the database or during a pg_dump dump/restore
	 cycle. This attack requires a CREATE privilege on some non-temporary
	 schema or a TRIGGER privilege on a table. This is exploitable in the
	 default PostgreSQL configuration, where all users have CREATE
	 privilege on public schema.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.postgresql.org/about/news/1905/</url>
 <cvename>CVE-2018-16850</cvename>
 </references>
 <dates>
 <discovery>2018-11-08</discovery>
 <entry>2018-11-08</entry>
 </dates>
 </vuln>

<vuln vid="84ca56be-e1de-11e8-bcfd-00e04c1ea73d">
 <topic>NGINX -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><lt>1.14.1</lt></range>
 </package>
 <package>
	<name>nginx-devel</name>
	<range><lt>1.15.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NGINX Team reports:
	<blockquote cite="http://nginx.org/en/security_advisories.html">
	 Two security issues were identified in nginx HTTP/2 implementation,
	 which might cause excessive memory consumption (CVE-2018-16843)
	 and CPU usage (CVE-2018-16844).
	 The issues affect nginx compiled with the ngx_http_v2_module (not
	 compiled by default) if the "http2" option of the "listen" directive is
	 used in a configuration file.
	 A security issue was identified in the ngx_http_mp4_module, which might
	 allow an attacker to cause infinite loop in a worker process, cause a
	 worker process crash, or might result in worker process memory
	 isclosure by using a specially crafted mp4 file (CVE-2018-16845).
	 The issue only affects nginx if it is built with the ngx_http_mp4_module
	 (the module is not built by default) and the "mp4" directive is used in
	 the configuration file. Further, the attack is only possible if an
	 attacker is able to trigger processing of a specially crafted mp4 file
	 with the ngx_http_mp4_module. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://nginx.org/en/security_advisories.html</url>
 <cvename>CVE-2018-16843</cvename>
 <cvename>CVE-2018-16844</cvename>
 <cvename>CVE-2018-16845</cvename>
 </references>
 <dates>
 <discovery>2018-11-06</discovery>
 <entry>2018-11-06</entry>
 </dates>
 </vuln>

<vuln vid="deb4f633-de1d-11e8-a9fb-080027f43a02">
 <topic>gitea -- remote code exeution</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea project reports:
	<blockquote cite="https://blog.gitea.io/2018/10/gitea-1.5.3-is-released/">
	 [This release] contains crit[i]cal security fix for vulnerability
	 that could potentially allow for authorized users to do remote code
	 ex[e]cution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/pull/5177</url>
 <url>https://github.com/go-gitea/gitea/pull/5196</url>
 <url>https://github.com/go-macaron/session/commit/084f1e5c1071f585902a7552b483cee04bc00a14</url>
 </references>
 <dates>
 <discovery>2018-10-25</discovery>
 <entry>2018-11-01</entry>
 </dates>
 </vuln>

<vuln vid="e0ab1773-07c1-46c6-9170-4c5e81c00927">
 <topic>curl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.14.1</ge><lt>7.60.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	curl security problems:
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	 CVE-2018-16839: SASL password overflow via integer overflow
	 libcurl contains a buffer overrun in the SASL authentication code.
	 The internal function Curl_auth_create_plain_message fails to
	 correctly verify that the passed in lengths for name and password
	 aren't too long, then calculates a buffer size to allocate.
	 On systems with a 32 bit size_t, the math to calculate the buffer size
	 triggers an integer overflow when the user name length exceeds 2GB
	 (2^31 bytes). This integer overflow usually causes a very small buffer
	 to actually get allocated instead of the intended very huge one, making
	 the use of that buffer end up in a heap buffer overflow.
	 This bug is very similar to CVE-2017-14618.
	 It affects curl 7.33.0 to 7.61.1.
	 CVE-2018-16840: use-after-free in handle close
	 libcurl contains a heap use-after-free flaw in code related to closing
	 an easy handle.
	 When closing and cleaning up an "easy" handle in the Curl_close()
	 function, the library code first frees a struct (without nulling the
	 pointer) and might then subsequently erroneously write to a struct
	 field within that already freed struct.
	 It affects curl 7.59.0 to 7.61.1.
	 CVE-2018-16842: warning message out-of-buffer read
	 curl contains a heap out of buffer read vulnerability.
	 The command line tool has a generic function for displaying warning
	 and informational messages to stderr for various situations. For
	 example if an unknown command line argument is used, or passed to it in
	 a "config" file.
	 This display function formats the output to wrap at 80 columns. The
	 wrap logic is however flawed, so if a single word in the message is
	 itself longer than 80 bytes the buffer arithmetic calculates the
	 remainder wrong and will end up reading behind the end of the buffer.
	 This could lead to information disclosure or crash.
	 This vulnerability could lead to a security issue if used in this or
	 similar situations:
	 1. a server somewhere uses the curl command line to run something
	 2. if it fails, it shows stderr to the user
	 3. the server takes user input for parts of its command line input
	 4. user provides something overly long that triggers this crash
	 5. the stderr output may now contain user memory contents that wasn't
	 meant to be available
	 It affects curl 7.14.1 to 7.61.1.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/security.html</url>
 <url>https://curl.haxx.se/docs/CVE-2018-16839.html</url>
 <url>https://curl.haxx.se/docs/CVE-2018-16840.html</url>
 <url>https://curl.haxx.se/docs/CVE-2018-16842.html</url>
 <cvename>CVE-2018-16839</cvename>
 <cvename>CVE-2018-16840</cvename>
 <cvename>CVE-2018-16842</cvename>
 </references>
 <dates>
 <discovery>2018-10-31</discovery>
 <entry>2018-11-01</entry>
 </dates>
 </vuln>

<vuln vid="b51d9e83-de08-11e8-9416-001b217b3468">
 <topic>Gitlab -- SSRF in Kubernetes integration</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.4.0</ge><lt>11.4.4</lt></range>
	<range><ge>11.3.0</ge><lt>11.3.9</lt></range>
	<range><ge>11.0.0</ge><lt>11.2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GitLab Team reports:
	<blockquote cite="https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/">
	 SSRF in Kubernetes integration
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/</url>
 <cvename>CVE-2018-18843</cvename>
 </references>
 <dates>
 <discovery>2018-11-01</discovery>
 <entry>2018-11-01</entry>
 </dates>
 </vuln>

<vuln vid="36a2a89e-7ee1-4ea4-ae22-7ca38019c8d0">
 <topic>Loofah -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-loofah</name>
	<range><lt>2.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitHub issue:
	<blockquote cite="https://github.com/flavorjones/loofah/issues/154">
	 This issue has been created for public disclosure of an XSS
	 vulnerability that was responsibly reported (independently) by Shubham
	 Pathak and @yasinS (Yasin Soliman).
	 In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in
	 sanitized output when a crafted SVG element is republished.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/flavorjones/loofah/releases</url>
 <url>https://github.com/flavorjones/loofah/issues/154</url>
 <cvename>CVE-2018-16468</cvename>
 </references>
 <dates>
 <discovery>2018-10-30</discovery>
 <entry>2018-11-01</entry>
 </dates>
 </vuln>

<vuln vid="b9591212-dba7-11e8-9416-001b217b3468">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.4.0</ge><lt>11.4.3</lt></range>
	<range><ge>11.3.0</ge><lt>11.3.8</lt></range>
	<range><ge>5.3.0</ge><lt>11.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/">
	 RCE in Gitlab Wiki API
	 SSRF in Hipchat integration
	 Cleartext storage of personal access tokens
	 Information exposure through stack trace error message
	 Persistent XSS autocomplete
	 Information exposure in stored browser history
	 Information exposure when replying to issues through email
	 Persistent XSS in License Management and Security Reports
	 Metrics information disclosure in Prometheus integration
	 Unauthorized changes to a protected branch's access levels
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/</url>
 <cvename>CVE-2018-18649</cvename>
 <cvename>CVE-2018-18646</cvename>
 <cvename>CVE-2018-18641</cvename>
 <cvename>CVE-2018-18648</cvename>
 <cvename>CVE-2018-18643</cvename>
 <cvename>CVE-2018-18640</cvename>
 <cvename>CVE-2018-18645</cvename>
 <cvename>CVE-2018-18642</cvename>
 <cvename>CVE-2018-18644</cvename>
 <cvename>CVE-2018-18647</cvename>
 </references>
 <dates>
 <discovery>2018-10-29</discovery>
 <entry>2018-10-29</entry>
 </dates>
 </vuln>

<vuln vid="238ae7de-dba2-11e8-b713-b499baebfeaf">
 <topic>OpenSSL -- Multiple vulnerabilities in 1.1 branch</topic>
 <affects>
 <package>
	<name>openssl-devel</name>
	<range><lt>1.1.0i_1</lt></range>
 </package>
 <package>
	<name>openssl111</name>
	<range><lt>1.1.1_2</lt></range>
 </package>
 <package>
	<name>libressl</name>
	<range><ge>2.8.0</ge><lt>2.8.3</lt></range>
 </package>
 <package>
	<name>libressl-devel</name>
	<range><ge>2.8.0</ge><lt>2.8.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20181029.txt">
	 Timing vulnerability in ECDSA signature generation
	 (CVE-2018-0735): The OpenSSL ECDSA signature algorithm has been
	 shown to be vulnerable to a timing side channel attack. An
	 attacker could use variations in the signing algorithm to
	 recover the private key (Low).
	 Timing vulnerability in DSA signature generation (CVE-2018-0734):
	 Avoid a timing attack that leaks information via a side channel
	 that triggers when a BN is resized. Increasing the size of the
	 BNs prior to doing anything with them suppresses the attack (Low).
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20181029.txt</url>
 <url>https://github.com/openssl/openssl/commit/8abfe72e</url>
 <cvename>CVE-2018-0735</cvename>
 <cvename>CVE-2018-0734</cvename>
 </references>
 <dates>
 <discovery>2018-10-29</discovery>
 <entry>2018-10-29</entry>
 <modified>2018-11-10</modified>
 </dates>
 </vuln>

<vuln vid="fa194483-dabd-11e8-bf39-5404a68ad561">
 <topic>liveMedia -- potential remote code execution</topic>
 <affects>
 <package>
	<name>liveMedia</name>
	<range><lt>2018.10.17,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Talos reports:
	<blockquote cite="https://talosintelligence.com/vulnerability_reports/TALOS-2018-0684">
	 An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality
	 of the LIVE555 RTSP server library. A specially crafted packet can cause a stack-based buffer
	 overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-4013</cvename>
 <url>https://talosintelligence.com/vulnerability_reports/TALOS-2018-0684</url>
 <url>http://lists.live555.com/pipermail/live-devel/2018-October/021071.html</url>
 </references>
 <dates>
 <discovery>2018-10-18</discovery>
 <entry>2018-10-28</entry>
 </dates>
 </vuln>

<vuln vid="33c384f3-5af6-4662-9741-0acb21c7e499">
 <topic>mini_httpd -- disclose arbitrary files is some circumstances</topic>
 <affects>
 <package>
	<name>mini_httpd</name>
	<range><lt>1.30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jef Poskanzer reports:
	<blockquote cite="http://acme.com/updates/archive/211.html">
	 Prior versions allowed remote users to read arbitrary files in some circumstances.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://acme.com/updates/archive/211.html</url>
 </references>
 <dates>
 <discovery>2018-10-26</discovery>
 <entry>2018-10-26</entry>
 </dates>
 </vuln>

<vuln vid="4f7c6af3-6a2c-4ead-8453-04e509688d45">
 <topic>salt -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-salt</name>
	<name>py32-salt</name>
	<name>py33-salt</name>
	<name>py34-salt</name>
	<name>py35-salt</name>
	<name>py36-salt</name>
	<name>py37-salt</name>
	<range><lt>2017.7.8</lt></range>
	<range><ge>2018.3.0</ge><lt>2018.3.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SaltStack reports:
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html">
	 Remote command execution and incorrect access control when using
	 salt-api.
	 Directory traversal vulnerability when using salt-api. Allows an
	 attacker to determine what files exist on a server when querying
	 /run or /events.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-15751</cvename>
 <cvename>CVE-2018-15750</cvename>
 <url>https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html</url>
 <url>https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html</url>
 </references>
 <dates>
 <discovery>2018-10-24</discovery>
 <entry>2018-10-27</entry>
 </dates>
 </vuln>

<vuln vid="7c3a02b9-3273-4426-a0ba-f90fad2ff72e">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>63.0_1,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.2.5</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.53.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>60.3.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>60.3.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>60.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/">
	 CVE-2018-12391: HTTP Live Stream audio data is accessible cross-origin
	 CVE-2018-12392: Crash with nested event loops
	 CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript
	 CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting
	 CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts
	 CVE-2018-12397:
	 CVE-2018-12398: CSP bypass through stylesheet injection in resource URIs
	 CVE-2018-12399: Spoofing of protocol registration notification bar
	 CVE-2018-12400: Favicons are cached in private browsing mode on Firefox for Android
	 CVE-2018-12401: DOS attack through special resource URI parsing
	 CVE-2018-12402: SameSite cookies leak when pages are explicitly saved
	 CVE-2018-12403: Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP
	 CVE-2018-12388: Memory safety bugs fixed in Firefox 63
	 CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-12388</cvename>
 <cvename>CVE-2018-12390</cvename>
 <cvename>CVE-2018-12391</cvename>
 <cvename>CVE-2018-12392</cvename>
 <cvename>CVE-2018-12393</cvename>
 <cvename>CVE-2018-12395</cvename>
 <cvename>CVE-2018-12396</cvename>
 <cvename>CVE-2018-12397</cvename>
 <cvename>CVE-2018-12398</cvename>
 <cvename>CVE-2018-12399</cvename>
 <cvename>CVE-2018-12400</cvename>
 <cvename>CVE-2018-12401</cvename>
 <cvename>CVE-2018-12402</cvename>
 <cvename>CVE-2018-12403</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/</url>
 </references>
 <dates>
 <discovery>2018-10-23</discovery>
 <entry>2018-10-23</entry>
 <modified>2019-07-23</modified>
 </dates>
 </vuln>

<vuln vid="140a14b5-d615-11e8-b3cb-00e04c1ea73d">
 <topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.60</lt></range>
 </package>
 <package>
	<name>drupal8</name>
	<range><lt>8.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/SA-CORE-2018-006">
	 he path module allows users with the 'administer paths' to create pretty URLs
	 for content. In certain circumstances the user can enter a particular path that
	 triggers an open redirect to a malicious url.The issue is mitigated by the fact
	 that the user needs the administer paths permission to exploit.
	 When sending email some variables were not being sanitized for shell arguments,
	 which could lead to remote code execution. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/SA-CORE-2018-006</url>
 </references>
 <dates>
 <discovery>2018-10-17</discovery>
 <entry>2018-10-22</entry>
 <modified>2018-11-04</modified>
 </dates>
 </vuln>

<vuln vid="afc60484-0652-440e-b01a-5ef814747f06">
 <topic>ruby -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>2.3.0,1</ge><lt>2.3.8,1</lt></range>
	<range><ge>2.4.0,1</ge><lt>2.4.5,1</lt></range>
	<range><ge>2.5.0,1</ge><lt>2.5.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby news:
	<blockquote cite="https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/">
	 CVE-2018-16395: OpenSSL::X509::Name equality check does not work
	 correctly
	 An instance of OpenSSL::X509::Name contains entities such as CN, C and
	 so on. Some two instances of OpenSSL::X509::Name are equal only when
	 all entities are exactly equal. However, there is a bug that the
	 equality check is not correct if the value of an entity of the
	 argument (right-hand side) starts with the value of the receiver
	 (left-hand side). So, if a malicious X.509 certificate is passed to
	 compare with an existing certificate, there is a possibility to be
	 judged incorrectly that they are equal.
	 CVE-2018-16396: Tainted flags are not propagated in Array#pack and
	 String#unpack with some directives
	 Array#pack method converts the receiver's contents into a string with
	 specified format. If the receiver contains some tainted objects, the
	 returned string also should be tainted. String#unpack method which
	 converts the receiver into an array also should propagate its tainted
	 flag to the objects contained in the returned array. But, with B, b, H
	 and h directives, the tainted flags are not propagated. So, if a script
	 processes unreliable inputs by Array#pack and/or String#unpack with
	 these directives and checks the reliability with tainted flags, the
	 check might be wrong.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/</url>
 <url>https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/</url>
 <url>https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/</url>
 <cvename>CVE-2018-16395</cvename>
 <cvename>CVE-2018-16396</cvename>
 </references>
 <dates>
 <discovery>2018-10-17</discovery>
 <entry>2018-10-20</entry>
 </dates>
 </vuln>

<vuln vid="ec5072b0-d43a-11e8-a6d2-b499baebfeaf">
 <topic>MySQL -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>mariadb55-server</name>
 <range><lt>5.5.62</lt></range>
 </package>
 <package>
 <name>mariadb100-server</name>
 <range><lt>10.0.37</lt></range>
 </package>
 <package>
 <name>mariadb101-server</name>
 <range><lt>10.1.37</lt></range>
 </package>
 <package>
 <name>mariadb102-server</name>
 <range><lt>10.2.19</lt></range>
 </package>
 <package>
 <name>mariadb103-server</name>
 <range><lt>10.3.11</lt></range>
 </package>
 <package>
 <name>mysql55-server</name>
 <range><lt>5.5.62</lt></range>
 </package>
 <package>
 <name>mysql56-server</name>
 <range><lt>5.6.42</lt></range>
 </package>
 <package>
 <name>mysql57-server</name>
 <range><lt>5.7.24</lt></range>
 </package>
 <package>
 <name>mysql80-server</name>
 <range><lt>8.0.13</lt></range>
 </package>
 <package>
 <name>percona55-server</name>
 <range><lt>5.5.62</lt></range>
 </package>
 <package>
 <name>percona56-server</name>
 <range><lt>5.6.42</lt></range>
 </package>
 <package>
 <name>percona57-server</name>
 <range><lt>5.7.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Oracle reports:
 <blockquote cite="https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixMSQL">
 Please reference CVE/URL list for details
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixMSQL</url>
 <cvename>CVE-2016-9843</cvename>
 <cvename>CVE-2018-3155</cvename>
 <cvename>CVE-2018-3143</cvename>
 <cvename>CVE-2018-3156</cvename>
 <cvename>CVE-2018-3251</cvename>
 <cvename>CVE-2018-3182</cvename>
 <cvename>CVE-2018-3137</cvename>
 <cvename>CVE-2018-3203</cvename>
 <cvename>CVE-2018-3133</cvename>
 <cvename>CVE-2018-3145</cvename>
 <cvename>CVE-2018-3144</cvename>
 <cvename>CVE-2018-3185</cvename>
 <cvename>CVE-2018-3195</cvename>
 <cvename>CVE-2018-3247</cvename>
 <cvename>CVE-2018-3187</cvename>
 <cvename>CVE-2018-3174</cvename>
 <cvename>CVE-2018-3171</cvename>
 <cvename>CVE-2018-3277</cvename>
 <cvename>CVE-2018-3162</cvename>
 <cvename>CVE-2018-3173</cvename>
 <cvename>CVE-2018-3200</cvename>
 <cvename>CVE-2018-3170</cvename>
 <cvename>CVE-2018-3212</cvename>
 <cvename>CVE-2018-3280</cvename>
 <cvename>CVE-2018-3186</cvename>
 <cvename>CVE-2018-3161</cvename>
 <cvename>CVE-2018-3278</cvename>
 <cvename>CVE-2018-3279</cvename>
 <cvename>CVE-2018-3282</cvename>
 <cvename>CVE-2018-3284</cvename>
 <cvename>CVE-2018-3283</cvename>
 <cvename>CVE-2018-3286</cvename>
 </references>
 <dates>
 <discovery>2018-10-16</discovery>
 <entry>2018-10-20</entry>
 <modified>2018-11-08</modified>
 </dates>
 </vuln>

<vuln vid="44864c84-d3b8-11e8-b3cb-00e04c1ea73d">
 <topic>matomo -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>matomo</name>
	<range><lt>3.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matomo reports:
	<blockquote cite="https://matomo.org/changelog/matomo-3-6-1/">
	 Several XSS issues have been fixed thanks to the great work of security
	 researchers who responsible disclosed issues to us.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://matomo.org/changelog/matomo-3-6-1/</url>
 </references>
 <dates>
 <discovery>2018-10-18</discovery>
 <entry>2018-10-19</entry>
 </dates>
 </vuln>

<vuln vid="2383767c-d224-11e8-9623-a4badb2f4699">
 <topic>libssh -- authentication bypass vulnerability</topic>
 <affects>
 <package>
	<name>libssh</name>
	<range><ge>0.6</ge><lt>0.7.6</lt></range>
	<range><ge>0.8</ge><lt>0.8.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	gladiac reports:
	<blockquote cite="https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/">
	 libssh versions 0.6 and above have an authentication bypass
	 vulnerability in the server code. By presenting the server an
	 SSH2_MSG_USERAUTH_SUCCESS message in place of the
	 SSH2_MSG_USERAUTH_REQUEST message which the server would expect to
	 initiate authentication, the attacker could successfully authentciate
	 without any credentials.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/</url>
 <cvename>CVE-2018-10933</cvename>
 </references>
 <dates>
 <discovery>2018-10-16</discovery>
 <entry>2018-10-17</entry>
 </dates>
 </vuln>

<vuln vid="8c08ab4c-d06c-11e8-b35c-001b217b3468">
 <topic>Libgit2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libgit2</name>
	<range><lt>0.27.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Git community reports:
	<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.27.5">
	 Multiple vulnerabilities.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/libgit2/libgit2/releases/tag/v0.27.5</url>
 <cvename>CVE-2018-17456</cvename>
 </references>
 <dates>
 <discovery>2018-10-05</discovery>
 <entry>2018-10-15</entry>
 </dates>
 </vuln>

<vuln vid="4c11b51e-cd8d-11e8-b0cb-a0f3c100ae18">
 <topic>Memory leak bug in Toxcore</topic>
 <affects>
 <package>
	<name>toxcore</name>
	<range><lt>0.2.8,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Tox project blog reports:
	<blockquote cite="https://blog.tox.chat/2018/10/memory-leak-bug-and-new-toxcore-release-fixing-it/">
	 A memory leak bug was discovered in Toxcore that can be triggered remotely to
exhaust one’s system memory, resulting in a denial of service attack.
The bug is present in the TCP Server module of Toxcore and therefore it
affects mostly bootstrap nodes. Regular Tox clients generally have the
TCP Server functionality disabled by default, leaving them unaffected.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.tox.chat/2018/10/memory-leak-bug-and-new-toxcore-release-fixing-it/</url>
 </references>
 <dates>
 <discovery>2018-09-29</discovery>
 <entry>2018-10-11</entry>
 </dates>
 </vuln>

<vuln vid="cb539d4e-cd68-11e8-8819-00e04c1ea73d">
 <topic>gitea -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitea project reports:
	<blockquote cite="https://github.com/go-gitea/gitea/issues/4357">
	 CSRF Vulnerability on API.
	 Enforce token on api routes.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/issues/4357</url>
 <url>ttps://github.com/go-gitea/gitea/pull/4840</url>
 </references>
 <dates>
 <discovery>2018-10-01</discovery>
 <entry>2018-10-11</entry>
 </dates>
 </vuln>

<vuln vid="3350275d-cd5a-11e8-a7be-3497f683cb16">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.146</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.138.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://jenkins.io/security/advisory/2018-10-10/">
	 <h1>Description</h1>
	 <h5>(Low) SECURITY-867</h5>
	 Path traversal vulnerability in Stapler allowed accessing internal data
	 <h5>(Medium) SECURITY-1074</h5>
	 Arbitrary file write vulnerability using file parameter definitions
	 <h5>(Medium) SECURITY-1129</h5>
	 Reflected XSS vulnerability
	 <h5>(Medium) SECURITY-1162</h5>
	 Ephemeral user record was created on some invalid authentication attempts
	 <h5>(Medium) SECURITY-1128</h5>
	 Ephemeral user record creation
	 <h5>(Medium) SECURITY-1158</h5>
	 Session fixation vulnerability on user signup
	 <h5>(Medium) SECURITY-765</h5>
	 Failures to process form submission data could result in secrets being displayed or written to logs
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://jenkins.io/security/advisory/2018-10-10/</url>
 </references>
 <dates>
 <discovery>2018-10-10</discovery>
 <entry>2018-10-11</entry>
 </dates>
 </vuln>

<vuln vid="a4eb38ea-cc06-11e8-ada4-408d5cf35399">
 <topic>tinc -- Buffer overflow</topic>
 <affects>
 <package>
	<name>tinc</name>
	<range><lt>1.0.35</lt></range>
 </package>
 <package>
	<name>tinc-devel</name>
	<range><lt>1.1pre17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	tinc-vpn.org reports:
	<blockquote cite="http://www.tinc-vpn.org/news/">
	 The authentication protocol allows an oracle attack that could
potentially be exploited.
	 If a man-in-the-middle has intercepted the TCP connection it
might be able to force plaintext UDP packets between two nodes for up to
a PingInterval period.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=d3297fbd3b8c8c8a4661f5bbf89aca5cacba8b5a</url>
 <url>https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=e97943b7cc9c851ae36f5a41e2b6102faa74193f</url>
 <cvename>CVE-2018-16737</cvename>
 <cvename>CVE-2018-16738</cvename>
 <cvename>CVE-2018-16758</cvename>
 </references>
 <dates>
 <discovery>2018-10-08</discovery>
 <entry>2018-10-09</entry>
 </dates>
 </vuln>

<vuln vid="23413442-c8ea-11e8-b35c-001b217b3468">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.3.0</ge><lt>11.3.4</lt></range>
	<range><ge>11.2.0</ge><lt>11.2.5</lt></range>
	<range><ge>10.2.0</ge><lt>11.1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/">
	 Merge request information disclosure
	 Private project namespace information disclosure
	 Gitlab Flavored Markdown API information disclosure
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/</url>
 <cvename>CVE-2018-17939</cvename>
 <cvename>CVE-2018-17976</cvename>
 <cvename>CVE-2018-17975</cvename>
 </references>
 <dates>
 <discovery>2018-10-05</discovery>
 <entry>2018-10-05</entry>
 </dates>
 </vuln>

<vuln vid="8b812395-c739-11e8-ab5b-9c5c8e75236a">
 <topic>clamav -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.100.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 Joel Esler reports:
	<blockquote cite="https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html">
	 <ul>
	 <li>CVE-2018-15378:
	 <ul>
		<li>Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.</li>
		<li>Reported by Secunia Research at Flexera.</li>
	 </ul>
	 </li>
	 <li>Fix for a 2-byte buffer over-read bug in ClamAV&amp;s PDF parsing code.
	 <ul>
		<li>Reported by Alex Gaynor.</li>
	 </ul>
	 </li>
	 <li>CVE-2018-14680:
	 <ul>
		<li>An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.</li>
	 </ul>
	 </li>
	 <li>CVE-2018-14681:
	 <ul>
		<li>An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.</li>
	 </ul>
	 </li>
	 <li>CVE-2018-14682:
	 <ul>
		<li>An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. Additionally, 0.100.2 reverted 0.100.1's patch for CVE-2018-14679, and applied libmspack's version of the fix in its place.</li>
	 </ul>
	 </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html</url>
 <cvename>CVE-2018-15378</cvename>
 <cvename>CVE-2018-14680</cvename>
 <cvename>CVE-2018-14681</cvename>
 <cvename>CVE-2018-14682</cvename>
 </references>
 <dates>
 <discovery>2018-10-03</discovery>
 <entry>2018-10-03</entry>
 <modified>2020-06-24</modified>
 </dates>
 </vuln>

<vuln vid="004d8c23-c710-11e8-98c7-000c29434208">
 <topic>Django -- password hash disclosure</topic>
 <affects>
 <package>
	<name>py34-django21</name>
	<name>py35-django21</name>
	<name>py36-django21</name>
	<name>py37-django21</name>
	<range><lt>2.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django release notes:
	<blockquote cite="https://docs.djangoproject.com/en/2.1/releases/2.1.2/">
	 CVE-2018-16984: Password hash disclosure to "view only" admin users
	 If an admin user has the change permission to the user model, only part
	 of the password hash is displayed in the change form. Admin users with the
	 view (but not change) permission to the user model were displayed the entire
	 hash. While it's typically infeasible to reverse a strong password hash, if
	 your site uses weaker password hashing algorithms such as MD5 or SHA1, it
	 could be a problem.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.djangoproject.com/en/2.1/releases/2.1.2/</url>
 <cvename>CVE-2018-16984</cvename>
 </references>
 <dates>
 <discovery>2018-10-02</discovery>
 <entry>2018-10-03</entry>
 </dates>
 </vuln>

<vuln vid="c4f39920-781f-4aeb-b6af-17ed566c4272">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>62.0.3,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.2.4</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.53.0</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>60.2.2,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>60.2.2,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>60.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/">
	 <h1>CVE-2018-12386: Type confusion in JavaScript</h1>
	 A vulnerability in register allocation in JavaScript can
	 lead to type confusion, allowing for an arbitrary read and
	 write. This leads to remote code execution inside the
	 sandboxed content process when triggered.
	 <h1>CVE-2018-12387: </h1>
	 A vulnerability where the JavaScript JIT compiler inlines
	 Array.prototype.push with multiple arguments that results
	 in the stack pointer being off by 8 bytes after a
	 bailout. This leaks a memory address to the calling
	 function which can be used as part of an exploit inside
	 the sandboxed content process.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-12386</cvename>
 <cvename>CVE-2018-12387</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/</url>
 </references>
 <dates>
 <discovery>2018-10-02</discovery>
 <entry>2018-10-02</entry>
 <modified>2019-07-23</modified>
 </dates>
 </vuln>

<vuln vid="065b3b72-c5ab-11e8-9ae2-001b217b3468">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.3.0</ge><lt>11.3.1</lt></range>
	<range><ge>11.2.0</ge><lt>11.2.4</lt></range>
	<range><ge>7.6.0</ge><lt>11.1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/">
	 SSRF GCP access token disclosure
	 Persistent XSS on issue details
	 Diff formatter DoS in Sidekiq jobs
	 Confidential information disclosure in events API endpoint
	 validate_localhost function in url_blocker.rb could be bypassed
	 Slack integration CSRF Oauth2
	 GRPC::Unknown logging token disclosure
	 IDOR merge request approvals
	 Persistent XSS package.json
	 Persistent XSS merge request project import
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/</url>
 <cvename>CVE-2018-17450</cvename>
 <cvename>CVE-2018-17454</cvename>
 <cvename>CVE-2018-15472</cvename>
 <cvename>CVE-2018-17449</cvename>
 <cvename>CVE-2018-17452</cvename>
 <cvename>CVE-2018-17451</cvename>
 <cvename>CVE-2018-17453</cvename>
 <cvename>CVE-2018-17455</cvename>
 <cvename>CVE-2018-17537</cvename>
 <cvename>CVE-2018-17536</cvename>
 </references>
 <dates>
 <discovery>2018-10-01</discovery>
 <entry>2018-10-01</entry>
 </dates>
 </vuln>

<vuln vid="5a757a31-f98e-4bd4-8a85-f1c0f3409769">
 <topic>pango -- remote DoS vulnerability</topic>
 <affects>
 <package>
	<name>pango</name>
	<range><lt>1.42.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15120">
	 libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15120</url>
 <url>https://www.exploit-db.com/exploits/45263/</url>
 <url>https://mail.gnome.org/archives/distributor-list/2018-August/msg00001.html</url>
 <url>https://github.com/GNOME/pango/commit/71aaeaf020340412b8d012fe23a556c0420eda5f</url>
 <cvename>CVE-2018-15120</cvename>
 </references>
 <dates>
 <discovery>2018-08-06</discovery>
 <entry>2018-10-01</entry>
 </dates>
 </vuln>

<vuln vid="01018916-c47c-11e8-8b07-00e04c1ea73d">
 <topic>Serendipity -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>serendipity</name>
	<range><lt>2.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Serendipity reports:
	<blockquote cite="https://blog.s9y.org/archives/280-Serendipity-2.1.4-and-2.2.1-alpha1-released.html">
	 Security: Fix XSS for pagination, when multi-category selection is used.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.s9y.org/archives/280-Serendipity-2.1.4-and-2.2.1-alpha1-released.html</url>
 </references>
 <dates>
 <discovery>2018-09-20</discovery>
 <entry>2018-09-30</entry>
 </dates>
 </vuln>

<vuln vid="40a844bf-c430-11e8-96dc-000743165db0">
 <topic>bitcoin -- Denial of Service and Possible Mining Inflation</topic>
 <affects>
 <package>
	<name>bitcoin</name>
	<name>bitcoin-daemon</name>
	<range><lt>0.16.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bitcoin Core reports:
	<blockquote cite="https://bitcoincore.org/en/2018/09/20/notice/">
	 CVE-2018-17144, a fix for which was released on September 18th in Bitcoin Core versions 0.16.3 and 0.17.0rc4, includes both a Denial of Service component and a critical inflation vulnerability. It was originally reported to several developers working on Bitcoin Core, as well as projects supporting other cryptocurrencies, including ABC and Unlimited on September 17th as a Denial of Service bug only, however we quickly determined that the issue was also an inflation vulnerability with the same root cause and fix.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bitcoincore.org/en/2018/09/20/notice/</url>
 <cvename>CVE-2018-17144</cvename>
 </references>
 <dates>
 <discovery>2018-09-17</discovery>
 <entry>2018-09-29</entry>
 </dates>
 </vuln>

<vuln vid="613193a0-c1b4-11e8-ae2d-54e1ad3d6335">
 <topic>spamassassin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>spamassassin</name>
	<range><lt>3.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	the Apache Spamassassin project reports:
	<blockquote cite="https://seclists.org/oss-sec/2018/q3/242">
	 In Apache SpamAssassin, using HTML::Parser, we setup an object and
	 hook into the begin and end tag event handlers In both cases, the
	 "open" event is immediately followed by a "close" event - even if
	 the tag *does not* close in the HTML being parsed.
	 Because of this, we are missing the "text" event to deal with
	 the object normally. This can cause carefully crafted emails that
	 might take more scan time than expected leading to a Denial of
	 Service.
	 Fix a reliance on "." in @INC in one configuration script. Whether
	 this can be exploited in any way is uncertain.
	 Fix a potential Remote Code Execution bug with the PDFInfo plugin.
	 Thanks to cPanel Security Team for their report of this issue.
	 Fourth, this release fixes a local user code injection in the
	 meta rule syntax. Thanks again to cPanel Security Team for their
	 report of this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://seclists.org/oss-sec/2018/q3/242</url>
	<cvename>CVE-2017-15705</cvename>
	<cvename>CVE-2016-1238</cvename>
	<cvename>CVE-2018-11780</cvename>
	<cvename>CVE-2018-11781</cvename>
 </references>
 <dates>
 <discovery>2018-09-16</discovery>
 <entry>2018-09-26</entry>
 </dates>
 </vuln>

<vuln vid="bad59128-c188-11e8-9d40-f0def10dca57">
 <topic>wesnoth -- Code Injection vulnerability</topic>
 <affects>
 <package>
	<name>wesnoth</name>
	<range><ge>1.7.0</ge><lt>1.14.4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	shadowm reports:
	<blockquote cite="https://forums.wesnoth.org/viewtopic.php?t=48528">
	 A severe bug was found in the game client which could allow a malicious user to execute arbitrary code through the Lua engine by using specially-crafted code in add-ons, saves, replays, or networked games. This issue affects all platforms and all existing releases since Wesnoth version 1.7.0.
	 Users of all previous version should upgrade immediately.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-1999023</cvename>
 <url>https://gist.github.com/shikadiqueen/45951ddc981cf8e0d9a74e4b30400380</url>
 </references>
 <dates>
 <discovery>2018-07-14</discovery>
 <entry>2018-09-26</entry>
 </dates>
 </vuln>

<vuln vid="e182c076-c189-11e8-a6d2-b499baebfeaf">
 <topic>Apache -- Denial of service vulnerability in HTTP/2</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.35</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
	 low: DoS for HTTP/2 connections by continuous SETTINGS
	 By sending continous SETTINGS frames of maximum size an ongoing
	 HTTP/2 connection could be kept busy and would never time out. This
	 can be abused for a DoS on the server. This only affect a server
	 that has enabled the h2 protocol.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
 <cvename>CVE-2018-11763</cvename>
 </references>
 <dates>
 <discovery>2018-09-25</discovery>
 <entry>2018-09-26</entry>
 </dates>
 </vuln>

<vuln vid="6bf71117-c0c9-11e8-b760-6023b685b1ee">
 <topic>mantis -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>mantis-php56</name>
	<name>mantis-php70</name>
	<name>mantis-php71</name>
	<name>mantis-php72</name>
	<range><lt>2.17.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Brian Carpenter reports:
	<blockquote cite="https://mantisbt.org/bugs/view.php?id=24731">
	 Reflected XSS in view_filters_page.php via core/filter_form_api.php
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-16514</cvename>
 </references>
 <dates>
 <discovery>2018-09-03</discovery>
 <entry>2018-09-25</entry>
 </dates>
 </vuln>

<vuln vid="2d6de6a8-fb78-4149-aeda-77fc8f140f06">
 <topic>smart_proxy_dynflow -- authentication bypass vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-smart_proxy_dynflow</name>
	<range><lt>0.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-14643">
	 An authentication bypass flaw was found in the smart_proxy_dynflow
	 component used by Foreman. A malicious attacker can use this flaw to
	 remotely execute arbitrary commands on machines managed by vulnerable
	 Foreman instances, in a highly privileged context.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-14643</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14643</url>
 <cvename>CVE-2018-14643</cvename>
 </references>
 <dates>
 <discovery>2018-09-20</discovery>
 <entry>2018-09-22</entry>
 </dates>
 </vuln>

<vuln vid="be1aada2-be6c-11e8-8fc6-000c29434208">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki127</name>
	<range><lt>1.27.5</lt></range>
 </package>
 <package>
	<name>mediawiki129</name>
	<range><le>1.29.3</le></range>
 </package>
 <package>
	<name>mediawiki130</name>
	<range><lt>1.30.1</lt></range>
 </package>
 <package>
	<name>mediawiki131</name>
	<range><lt>1.31.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawiki reports:
	<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2018-September/000223.html">
	 Security fixes:
	 T169545: $wgRateLimits entry for 'user' overrides 'newbie'.
	 T194605: BotPasswords can bypass CentralAuth's account lock.
	 T187638: When a log event is (partially) hidden Special:Redirect/logid
	 can link to the incorrect log and reveal hidden
	 T193237: Special:BotPasswords should require reauthenticate.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-0503</cvename>
 <cvename>CVE-2018-0505</cvename>
 <cvename>CVE-2018-0504</cvename>
 <url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2018-September/000223.html</url>
 </references>
 <dates>
 <discovery>2018-08-29</discovery>
 <entry>2018-09-22</entry>
 </dates>
 </vuln>

<vuln vid="3284d948-140c-4a3e-aa76-3b440e2006a8">
 <topic>firefox -- Crash in TransportSecurityInfo due to cached data</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>62.0.2,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>60.2.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-22/">
	 A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-12385</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2018-22/</url>
 </references>
 <dates>
 <discovery>2018-09-21</discovery>
 <entry>2018-09-21</entry>
 </dates>
 </vuln>

<vuln vid="77f67b46-bd75-11e8-81b6-001999f8d30b">
 <topic>asterisk -- Remote crash vulnerability in HTTP websocket upgrade</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.23.1</lt></range>
 </package>
 <package>
	<name>asterisk15</name>
	<range><lt>15.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 There is a stack overflow vulnerability in the
	 res_http_websocket.so module of Asterisk that allows an
	 attacker to crash Asterisk via a specially crafted HTTP
	 request to upgrade the connection to a websocket. The
	 attackers request causes Asterisk to run out of stack
	 space and crash.
	 As a workaround disable HTTP websocket access by not
	 loading the res_http_websocket.so module.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2018-009.html</url>
 <cvename>CVE-2018-17281</cvename>
 </references>
 <dates>
 <discovery>2018-08-16</discovery>
 <entry>2018-09-21</entry>
 </dates>
 </vuln>

<vuln vid="074cb225-bb2d-11e8-90e1-fcaa147e860e">
 <topic>moodle -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moodle31</name>
	<range><lt>3.1.14</lt></range>
 </package>
 <package>
	<name>moodle33</name>
	<range><lt>3.3.8</lt></range>
 </package>
 <package>
	<name>moodle34</name>
	<range><lt>3.4.5</lt></range>
 </package>
 <package>
	<name>moodle35</name>
	<range><lt>3.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 moodle reports:
 <blockquote cite="https://moodle.org/mod/forum/discuss.php?d=376023">
	 Moodle XML import of ddwtos could lead to intentional remote code
	 execution
	 QuickForm library remote code vulnerability (upstream)
	 Boost theme - blog search GET parameter insufficiently filtered
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-14630</cvename>
 <cvename>CVE-2018-1999022</cvename>
 <cvename>CVE-2018-14631</cvename>
 <url>https://moodle.org/mod/forum/discuss.php?d=376023</url>
 </references>
 <dates>
 <discovery>2018-09-05</discovery>
 <entry>2018-09-18</entry>
 </dates>
 </vuln>

<vuln vid="bf2b9c56-b93e-11e8-b2a8-a4badb296695">
 <topic>joomla3 -- vulnerabilitiesw</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><lt>3.8.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	JSST reports: Multiple low-priority Vulnerabilities
	<blockquote cite="https://developer.joomla.org/security-centre/743-20180801-core-hardening-the-inputfilter-for-phar-stubs.html">
	 Inadequate checks in the InputFilter class could allow specifically prepared PHAR files to pass the upload filter.
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/744-20180802-core-stored-xss-vulnerability-in-the-frontend-profile.html">
	 Inadequate output filtering on the user profile page could lead to a stored XSS attack.
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/745-20180803-core-acl-violation-in-custom-fields.html">
	 Inadequate checks regarding disabled fields can lead to an ACL violation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-15860</cvename>
 <cvename>CVE-2018-15881</cvename>
 <cvename>CVE-2018-15882</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15880</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15881</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15882</url>
 <url>https://developer.joomla.org/security-centre/743-20180801-core-hardening-the-inputfilter-for-phar-stubs.html</url>
 <url>https://developer.joomla.org/security-centre/744-20180802-core-stored-xss-vulnerability-in-the-frontend-profile.html</url>
 <url>https://developer.joomla.org/security-centre/745-20180803-core-acl-violation-in-custom-fields.html</url>
 </references>
 <dates>
 <discovery>2018-08-23</discovery>
 <entry>2018-09-15</entry>
 </dates>
 </vuln>

<vuln vid="ab38d9f8-b787-11e8-8e7a-00e04c1ea73d">
 <topic>mybb -- vulnerabilities</topic>
 <affects>
 <package>
	<name>mybb</name>
	<range><lt>1.8.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mybb Team reports:
	<blockquote cite="https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/">
	 High risk: Email field SQL Injection.
	 Medium risk: Video MyCode Persistent XSS in Visual Editor.
	 Low risk: Insufficient permission check in User CP’s attachment management.
	 Low risk: Insufficient email address verification.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2018-09-11</discovery>
 <entry>2018-09-13</entry>
 </dates>
 </vuln>

<vuln vid="a67c122a-b693-11e8-ac58-a4badb2f4699">
 <topic>FreeBSD -- Improper ELF header parsing</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.2</ge><lt>11.2_3</lt></range>
	<range><ge>11.1</ge><lt>11.1_14</lt></range>
	<range><ge>10.4</ge><lt>10.4_12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Insufficient validation was performed in the ELF header
	parser, and malformed or otherwise invalid ELF binaries
	were not rejected as they should be.
	<h1>Impact:</h1>
	Execution of a malicious ELF binary may result in a
	kernel crash or may disclose kernel memory.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6924</cvename>
 <freebsdsa>SA-18:12.elf</freebsdsa>
 </references>
 <dates>
 <discovery>2018-09-12</discovery>
 <entry>2018-09-12</entry>
 </dates>
 </vuln>

<vuln vid="fe818607-b5ff-11e8-856b-485b3931c969">
 <topic>Containous Traefik -- exposes the configuration and secret</topic>
 <affects>
 <package>
	<name>traefik</name>
	<range><lt>1.6.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15598">
	 Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the
	 configuration and secret if authentication is missing and the API's port
	 is publicly reachable.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-15598</cvename>
 <url>https://github.com/containous/traefik/pull/3790</url>
 <url>https://github.com/containous/traefik/releases/tag/v1.6.6</url>
 </references>
 <dates>
 <discovery>2018-08-20</discovery>
 <entry>2018-09-11</entry>
 </dates>
 </vuln>

<vuln vid="f9d73a20-b5f0-11e8-b1da-6451062f0f7a">
 <topic>Flash Player -- information disclosure</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>31.0.0.108</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-31.html">
	 <ul>
	 <li>This update resolves a privilege escalation vulnerability that
	 could lead to information disclosure (CVE-2018-15967).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-15967</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb18-31.html</url>
 </references>
 <dates>
 <discovery>2018-09-11</discovery>
 <entry>2018-09-11</entry>
 </dates>
 </vuln>

<vuln vid="337960ec-b5dc-11e8-ac58-a4badb2f4699">
 <topic>Plex Media Server -- Information Disclosure Vulnerability</topic>
 <affects>
 <package>
	<name>plexmediaserver</name>
	<name>plexmediaserver-plexpass</name>
	<range><lt>1.13.5.5332</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chris reports:
	<blockquote cite="https://seclists.org/fulldisclosure/2018/Aug/1">
	 The XML parsing engine for Plex Media Server's SSDP/UPNP
	 functionality is vulnerable to an XML External Entity
	 Processing (XXE) attack. Unauthenticated attackers on the same LAN can
	 use this vulnerability to:
	 <ul>
	 <li>Access arbitrary files from the filesystem with the same permission as
	 the user account running Plex.</li>
	 <li>Initiate SMB connections to capture NetNTLM challenge/response and
	 crack to clear-text password.</li>
	 <li>Initiate SMB connections to relay NetNTLM challenge/response and
	 achieve Remote Command Execution in Windows domains.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://seclists.org/fulldisclosure/2018/Aug/1</url>
 <cvename>CVE-2018-13415</cvename>
 </references>
 <dates>
 <discovery>2018-08-01</discovery>
 <entry>2018-09-11</entry>
 </dates>
 </vuln>

<vuln vid="f00acdec-b59f-11e8-805d-001e2a3f778d">
 <topic>X11 Session -- SDDM allows unauthorised unlocking</topic>
 <affects>
 <package>
	<name>sddm</name>
	<range><lt>0.17.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-14345">
	An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session.
	</blockquote>
	The default configuration of SDDM on FreeBSD is not affected, since it has ReuseSession=false.
 </body>
 </description>
 <references>
 <url>https://www.suse.com/security/cve/CVE-2018-14345/</url>
 <cvename>CVE-2018-14345</cvename>
 </references>
 <dates>
 <discovery>2018-08-13</discovery>
 <entry>2018-09-11</entry>
 </dates>
 </vuln>

<vuln vid="db2acdac-b5a7-11e8-8f6f-00e04c1ea73d">
 <topic>mybb -- vulnerabilities</topic>
 <affects>
 <package>
	<name>mybb</name>
	<range><lt>1.8.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mybb Team reports:
	<blockquote cite="https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release/">
	 High risk: Image MyCode “alt” attribute persistent XSS.
	 Medium risk: RSS Atom 1.0 item title persistent XSS.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2018-08-22</discovery>
 <entry>2018-09-11</entry>
 </dates>
 </vuln>

<vuln vid="7c750960-b129-11e8-9fcd-080027f43a02">
 <topic>Information disclosure - Gitea leaks email addresses</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea project reports:
	<blockquote cite="https://github.com/go-gitea/gitea/issues/4417">
	 [Privacy] Gitea leaks hidden email addresses #4417
	 A fix has been implemented in Gitea 1.5.1.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/issues/4417</url>
 <url>https://github.com/go-gitea/gitea/pull/4784</url>
 </references>
 <dates>
 <discovery>2018-07-10</discovery>
 <entry>2018-09-05</entry>
 </dates>
 </vuln>

<vuln vid="2a92555f-a6f8-11e8-8acd-10c37b4ac2ea">
 <topic>links -- denial of service</topic>
 <affects>
 <package>
	<name>links</name>
	<range><lt>2.16,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NIST reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-11114">
	 The put_chars function in html_r.c in Twibright Links 2.14 allows
	 remote attackers to cause a denial of service (buffer over-read)
	 via a crafted HTML file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-11114</url>
 <cvename>CVE-2017-11114</cvename>
 </references>
 <dates>
 <discovery>2017-07-31</discovery>
 <entry>2018-08-23</entry>
 </dates>
 </vuln>

<vuln vid="f4d638b9-e6e5-4dbe-8c70-571dbc116174">
 <topic>curl -- password overflow vulnerability</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.15.4</ge><lt>7.61.1</lt></range>
 </package>
 <package>
	<name>linux-c7-curl</name>
	<range><lt>7.29.0_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	curl security problems:
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	 CVE-2018-14618: NTLM password overflow via integer overflow
	 The internal function Curl_ntlm_core_mk_nt_hash multiplies the length
	 of the password by two (SUM) to figure out how large temporary storage
	 area to allocate from the heap.
	 The length value is then subsequently used to iterate over the
	 password and generate output into the allocated storage buffer. On
	 systems with a 32 bit size_t, the math to calculate SUM triggers an
	 integer overflow when the password length exceeds 2GB (2^31 bytes).
	 This integer overflow usually causes a very small buffer to actually
	 get allocated instead of the intended very huge one, making the use of
	 that buffer end up in a heap buffer overflow.
	 This bug is almost identical to CVE-2017-8816.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/security.html</url>
 <url>https://curl.haxx.se/docs/CVE-2018-14618.html</url>
 <cvename>CVE-2018-14618</cvename>
 </references>
 <dates>
 <discovery>2018-09-05</discovery>
 <entry>2018-09-05</entry>
 <modified>2019-08-03</modified>
 </dates>
 </vuln>

<vuln vid="c96d416a-eae7-4d5d-bc84-40deca9329fb">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>62.0_1,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.2.3</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.5</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>60.2.0_1,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>60.2.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>60.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/">
	 CVE-2018-12377: Use-after-free in refresh driver timers
	 CVE-2018-12378: Use-after-free in IndexedDB
	 CVE-2018-12379: Out-of-bounds write with malicious MAR file
	 CVE-2017-16541: Proxy bypass using automount and autofs
	 CVE-2018-12381: Dragging and dropping Outlook email message results in page navigation
	 CVE-2018-12382: Addressbar spoofing with javascript URI on Firefox for Android
	 CVE-2018-12383: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords
	 CVE-2018-12375: Memory safety bugs fixed in Firefox 62
	 CVE-2018-12376: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-16541</cvename>
 <cvename>CVE-2018-12375</cvename>
 <cvename>CVE-2018-12376</cvename>
 <cvename>CVE-2018-12377</cvename>
 <cvename>CVE-2018-12378</cvename>
 <cvename>CVE-2018-12379</cvename>
 <cvename>CVE-2018-12381</cvename>
 <cvename>CVE-2018-12382</cvename>
 <cvename>CVE-2018-12383</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/</url>
 </references>
 <dates>
 <discovery>2018-09-05</discovery>
 <entry>2018-09-05</entry>
 <modified>2018-09-15</modified>
 </dates>
 </vuln>

<vuln vid="30c0f878-b03e-11e8-be8a-0011d823eebd">
 <topic>Ghostscript -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>ghostscript9-agpl-base</name>
	<name>ghostscript9-agpl-x11</name>
	<range><lt>9.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CERT reports:
	<blockquote cite="https://www.kb.cert.org/vuls/id/332928">
	 Ghostscript contains an optional -dSAFER option, which is supposed
	 to prevent unsafe PostScript operations. Multiple PostScript
	 operations bypass the protections provided by -dSAFER, which can
	 allow an attacker to execute arbitrary commands with arbitrary
	 arguments. This vulnerability can also be exploited in applications
	 that leverage Ghostscript, such as ImageMagick, GraphicsMagick,
	 evince, Okular, Nautilus, and others.
	 Exploit code for this vulnerability is publicly available.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.kb.cert.org/vuls/id/332928</url>
 <cvename>CVE-2018-15908</cvename>
 <cvename>CVE-2018-15909</cvename>
 <cvename>CVE-2018-15910</cvename>
 <cvename>CVE-2018-15911</cvename>
 </references>
 <dates>
 <discovery>2018-08-21</discovery>
 <entry>2018-09-04</entry>
 </dates>
 </vuln>

<vuln vid="1f8d5806-ac51-11e8-9cb6-10c37b4ac2ea">
 <topic>grafana -- LDAP and OAuth login vulnerability</topic>
 <affects>
 <package>
	<name>grafana5</name>
	<range><ge>5.0.0</ge><lt>5.2.3</lt></range>
 </package>
 <package>
	<name>grafana4</name>
	<range><ge>4.0.0</ge><lt>4.6.4</lt></range>
 </package>
 <package>
	<name>grafana3</name>
	<range><ge>3.0.0</ge></range>
 </package>
 <package>
	<name>grafana2</name>
	<range><ge>2.0.0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Grafana Labs reports:
	<blockquote cite="https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050">
	 On the 20th of August at 1800 CEST we were contacted about a
	 potential security issue with the “remember me” cookie Grafana
	 sets upon login. The issue targeted users without a local Grafana
	 password (LDAP &amp; OAuth users) and enabled a potential attacker
	 to generate a valid cookie knowing only a username.
	 All installations which use the Grafana LDAP or OAuth
	 authentication features must be upgraded as soon as possible. If
	 you cannot upgrade, you should switch authentication mechanisms
	 or put additional protections in front of Grafana such as a
	 reverse proxy.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050</url>
 <cvename>CVE-2018-558213</cvename>
 </references>
 <dates>
 <discovery>2018-08-20</discovery>
 <entry>2018-08-31</entry>
 </dates>
 </vuln>

<vuln vid="ffeb25d0-ac94-11e8-ab15-d8cb8abf62dd">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.2.0</ge><lt>11.2.3</lt></range>
	<range><ge>11.1.0</ge><lt>11.1.6</lt></range>
	<range><ge>2.7.0</ge><lt>11.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/">
	 Persistent XSS in Pipeline Tooltip
	 GitLab.com GCP Endpoints Exposure
	 Persistent XSS in Merge Request Changes View
	 Sensitive Data Disclosure in Sidekiq Logs
	 Missing CSRF in System Hooks
	 Orphaned Upload Files Exposure
	 Missing Authorization Control API Repository Storage
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/</url>
 </references>
 <dates>
 <discovery>2018-08-28</discovery>
 <entry>2018-08-30</entry>
 </dates>
 </vuln>

<vuln vid="d0be41fe-2a20-4633-b057-4e8b25c41780">
 <topic>bro -- array bounds and potential DOS issues</topic>
 <affects>
 <package>
	<name>bro</name>
	<range><lt>2.5.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Corelight reports:
	<blockquote cite="https://www.bro.org/download/NEWS.bro.html">
	 Bro 2.5.5 primarily addresses security issues:
	 <ul>
	 <li>Fix array bounds checking in BinPAC: for arrays
		that are fields within a record, the bounds check
		was based on a pointer to the start of the record
		rather than the start of the array field, potentially
		resulting in a buffer over-read.</li>
	 <li>Fix SMTP command string comparisons: the number
	 of bytes compared was based on the user-supplied
	 string length and can lead to incorrect matches.
	 e.g. giving a command of "X" incorrectly matched
	 "X-ANONYMOUSTLS" (and an empty commands match
	 anything).</li>
	 </ul>
	 Address potential vectors for Denial of Service:
	 <ul>
	 <li>"Weird" events are now generally suppressed/sampled
		by default according to some tunable parameters.</li>
	 <li>Improved handling of empty lines in several text
		protocol analyzers that can cause performance issues
		when seen in long sequences.</li>
	 <li>Add `smtp_excessive_pending_cmds' weird which
		serves as a notification for when the "pending
		command" queue has reached an upper limit and been
		cleared to prevent one from attempting to slowly
		exhaust memory.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.bro.org/download/NEWS.bro.html</url>
 </references>
 <dates>
 <discovery>2018-08-28</discovery>
 <entry>2018-08-29</entry>
 </dates>
 </vuln>

<vuln vid="0904e81f-a89d-11e8-afbb-bc5ff4f77b71">
 <topic>node.js -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>node</name>
	<range><lt>10.9.0</lt></range>
 </package>
 <package>
	<name>node8</name>
	<range><lt>8.11.4</lt></range>
 </package>
 <package>
	<name>node6</name>
	<range><lt>6.14.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/">
	 <h1>OpenSSL: Client DoS due to large DH parameter</h1>
	 This fixes a potential denial of service (DoS) attack
	 against client connections by a malicious server. During a TLS
	 communication handshake, where both client and server agree to
	 use a cipher-suite using DH or DHE (Diffie-Hellman, in both
	 ephemeral and non-ephemeral modes), a malicious server can
	 send a very large prime value to the client. Because this has
	 been unbounded in OpenSSL, the client can be forced to spend
	 an unreasonably long period of time to generate a key,
	 potentially causing a denial of service.
	 <h1>OpenSSL: ECDSA key extraction via local side-channel</h1>
	 Attackers with access to observe cache-timing may be able
	 to extract DSA or ECDSA private keys by causing the victim to
	 create several signatures and watching responses. This flaw
	 does not have a CVE due to OpenSSL policy to not assign itself
	 CVEs for local-only vulnerabilities that are more academic
	 than practical. This vulnerability was discovered by Keegan
	 Ryan at NCC Group and impacts many cryptographic libraries
	 including OpenSSL.
	 <h1>Unintentional exposure of uninitialized memory</h1>
	 Only Node.js 10 is impacted by this flaw.
	 Node.js TSC member Nikita Skovoroda discovered an argument
	 processing flaw that causes Buffer.alloc() to return
	 uninitialized memory. This method is intended to be safe and
	 only return initialized, or cleared, memory. The third
	 argument specifying encoding can be passed as a number, this
	 is misinterpreted by Buffer's internal "fill" method as the
	 start to a fill operation. This flaw may be abused where
	 Buffer.alloc() arguments are derived from user input to return
	 uncleared memory blocks that may contain sensitive
	 information.
	 <h1>Out of bounds (OOB) write</h1>
	 Node.js TSC member Nikita Skovoroda discovered an OOB write
	 in Buffer that can be used to write to memory outside of a
	 Buffer's memory space. This can corrupt unrelated Buffer
	 objects or cause the Node.js process to crash.
	 When used with UCS-2 encoding (recognized by Node.js under
	 the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le'),
	 Buffer#write() can be abused to write outside of the bounds of
	 a single Buffer. Writes that start from the second-to-last
	 position of a buffer cause a miscalculation of the maximum
	 length of the input bytes to be written.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/</url>
 <cvename>CVE-2018-0732</cvename>
 <cvename>CVE-2018-7166</cvename>
 <cvename>CVE-2018-12115</cvename>
 </references>
 <dates>
 <discovery>2018-08-16</discovery>
 <entry>2018-08-25</entry>
 </dates>
 </vuln>

<vuln vid="45671c0e-a652-11e8-805b-a4badb2f4699">
 <topic>FreeBSD -- Unauthenticated EAPOL-Key Decryption Vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.2</ge><lt>11.2_2</lt></range>
	<range><ge>11.1</ge><lt>11.1_13</lt></range>
	<range><ge>10.4</ge><lt>10.4_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When using WPA2, EAPOL-Key frames with the Encrypted
	flag and without the MIC flag set, the data field was
	decrypted first without verifying the MIC. When the dta
	field was encrypted using RC4, for example, when negotiating
	TKIP as a pairwise cipher, the unauthenticated but decrypted
	data was subsequently processed. This opened wpa_supplicant(8)
	to abuse by decryption and recovery of sensitive information
	contained in EAPOL-Key messages.
	See
	https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt
	for a detailed description of the bug.
	<h1>Impact:</h1>
	All users of the WPA2 TKIP pairwise cipher are vulnerable
	to information, for example, the group key.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-1452</cvename>
 <freebsdsa>SA-18:11.hostapd</freebsdsa>
 </references>
 <dates>
 <discovery>2018-08-14</discovery>
 <entry>2018-08-22</entry>
 </dates>
 </vuln>

<vuln vid="359e1548-a652-11e8-805b-a4badb2f4699">
 <topic>FreeBSD -- Resource exhaustion in IP fragment reassembly</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.2</ge><lt>11.2_2</lt></range>
	<range><ge>11.1</ge><lt>11.1_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A researcher has notified us of a DoS attack applicable
	to another operating system. While FreeBSD may not be
	vulnerable to that exact attack, we have identified several
	places where inadequate DoS protection could allow an
	attacker to consume system resources.
	It is not necessary that the attacker be able to establish
	two-way communication to carry out these attacks. These
	attacks impact both IPv4 and IPv6 fragment reassembly.
	<h1>Impact:</h1>
	In the worst case, an attacker could send a stream of
	crafted fragments with a low packet rate which would consume
	a substantial amount of CPU.
	Other attack vectors allow an attacker to send a stream
	of crafted fragments which could consume a large amount of
	CPU or all available mbuf clusters on the system.
	These attacks could temporarily render a system unreachable
	through network interfaces or temporarily render a system
	unresponsive. The effects of the attack should clear within
	60 seconds after the attack stops.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6923</cvename>
 <freebsdsa>SA-18:10.ip</freebsdsa>
 </references>
 <dates>
 <discovery>2018-08-14</discovery>
 <entry>2018-08-22</entry>
 </dates>
 </vuln>

<vuln vid="2310b814-a652-11e8-805b-a4badb2f4699">
 <topic>FreeBSD -- L1 Terminal Fault (L1TF) Kernel Information Disclosure</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.2</ge><lt>11.2_2</lt></range>
	<range><ge>11.1</ge><lt>11.1_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	On certain Intel 64-bit x86 systems there is a period
	of time during terminal fault handling where the CPU may
	use speculative execution to try to load data. The CPU may
	speculatively access the level 1 data cache (L1D). Data
	which would otherwise be protected may then be determined
	by using side channel methods.
	This issue affects bhyve on FreeBSD/amd64 systems.
	<h1>Impact:</h1>
	An attacker executing user code, or kernel code inside
	of a virtual machine, may be able to read secret data from
	the kernel or from another virtual machine.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-3620</cvename>
 <cvename>CVE-2018-3646</cvename>
 <freebsdsa>SA-18:09.l1tf</freebsdsa>
 </references>
 <dates>
 <discovery>2018-08-14</discovery>
 <entry>2018-08-22</entry>
 </dates>
 </vuln>

<vuln vid="e53a908d-a645-11e8-8acd-10c37b4ac2ea">
 <topic>gogs -- open redirect vulnerability</topic>
 <affects>
 <package>
	<name>gogs</name>
	<range><lt>0.11.53_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	bluecatli (Tencent's Xuanwu Lab) reports:
	<blockquote cite="https://github.com/gogs/gogs/issues/5364">
	 The function isValidRedirect in gogs/routes/user/auth.go is used in login action to validate if url is on the same site.
	 If the Location header startswith /\, it will be transformed to // by browsers.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/gogs/gogs/issues/5364</url>
 <url>https://github.com/gogs/gogs/pull/5365</url>
 <url>https://github.com/gogs/gogs/commit/1f247cf8139cb483276cd8dd06385a800ce9d4b2</url>
 </references>
 <dates>
 <discovery>2018-08-06</discovery>
 <entry>2018-08-22</entry>
 </dates>
 </vuln>

<vuln vid="9e205ef5-a649-11e8-b1f6-6805ca0b3d42">
 <topic>phpmyadmin -- XSS in the import dialog</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<name>phpMyAdmin-php56</name>
	<name>phpMyAdmin-php70</name>
	<name>phpMyAdmin-php71</name>
	<name>phpMyAdmin-php72</name>
	<range><lt>4.8.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-5/">
	 <h3>Description</h3>
	 A Cross-Site Scripting vulnerability was found in the
	 file import feature, where an attacker can deliver a payload
	 to a user through importing a specially-crafted file.
	 <h3>Severity</h3>
	 We consider this attack to be of moderate severity.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2018-5/</url>
 <cvename>CVE-2018-15605</cvename>
 </references>
 <dates>
 <discovery>2018-08-21</discovery>
 <entry>2018-08-22</entry>
 </dates>
 </vuln>

<vuln vid="fe99d3ca-a63a-11e8-a7c6-54e1ad3d6335">
 <topic>libX11 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libX11</name>
	<range><lt>1.6.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The freedesktop.org project reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2018-August/002915.html">
	 The functions XGetFontPath, XListExtensions, and XListFonts are
	 vulnerable to an off-by-one override on malicious server responses.
	 The server replies consist of chunks consisting of a length byte
	 followed by actual string, which is not NUL-terminated.
	 While parsing the response, the length byte is overridden with '\0',
	 thus the memory area can be used as storage of C strings later on.
	 To be able to NUL-terminate the last string, the buffer is reserved
	 with an additional byte of space. For a boundary check, the variable
	 chend (end of ch) was introduced, pointing at the end of the buffer
	 which ch initially points to. Unfortunately there is a difference
	 in handling "the end of ch". While chend points at the first byte
	 that must not be written to, the for-loop uses chend as the last
	 byte that can be written to. Therefore, an off-by-one can occur.
	 The length value is interpreted as signed char on many systems
	 (depending on default signedness of char), which can lead to an out
	 of boundary write up to 128 bytes in front of the allocated storage,
	 but limited to NUL byte(s).
	 If the server sends a reply in which even the first string would
	 overflow the transmitted bytes, list[0] (or flist[0]) will be set to
	 NULL and a count of 0 is returned. If the resulting list is freed
	 with XFreeExtensionList or XFreeFontPath later on, the first Xfree
	 call is turned into Xfree (NULL-1) which will most likely trigger a
	 segmentation fault. Casting the length value to unsigned char fixes
	 the problem and allows string values with up to 255 characters.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.x.org/archives/xorg-announce/2018-August/002915.html</url>
 <cvename>CVE-2018-14598</cvename>
 <cvename>CVE-2018-14599</cvename>
 <cvename>CVE-2018-14600</cvename>
 </references>
 <dates>
 <discovery>2018-08-21</discovery>
 <entry>2018-08-22</entry>
 </dates>
 </vuln>

<vuln vid="9b19b6df-a4be-11e8-9366-0028f8d09152">
 <topic>couchdb -- administrator privilege escalation</topic>
 <affects>
 <package>
	<name>couchdb</name>
	<range><lt>2.2.0,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache CouchDB PMC reports:
	<blockquote cite="https://lists.apache.org/thread.html/1052ad7a1b32b9756df4f7860f5cb5a96b739f444117325a19a4bf75@%3Cdev.couchdb.apache.org%3E">
	 Database Administrator could achieve privilege escalation to
	 the account that CouchDB runs under, by abusing insufficient validation
	 in the HTTP API, escaping security controls implemented in previous
	 releases.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://docs.couchdb.org/en/stable/cve/2018-11769.html</url>
 <cvename>CVE-2018-11769</cvename>
 </references>
 <dates>
 <discovery>2018-06-05</discovery>
 <entry>2018-08-08</entry>
 </dates>
 </vuln>

<vuln vid="7762d7ad-2e38-41d2-9785-c51f653ba8bd">
 <topic>botan2 -- ECDSA side channel</topic>
 <affects>
 <package>
	<name>botan2</name>
	<range><ge>2.5.0</ge><lt>2.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	botan2 developers report:
	<blockquote cite="https://botan.randombit.net/security.html#id1">
	 A side channel in the ECDSA signature operation could allow a local attacker to recover the secret key. Found by Keegan Ryan of NCC Group.
	 Bug introduced in 2.5.0, fixed in 2.7.0. The 1.10 branch is not affected.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://botan.randombit.net/security.html#id1</url>
 <url>https://github.com/randombit/botan/pull/1604</url>
 <cvename>CVE-2018-12435</cvename>
 </references>
 <dates>
 <discovery>2018-06-13</discovery>
 <entry>2018-08-17</entry>
 </dates>
 </vuln>

<vuln vid="6905f05f-a0c9-11e8-8335-8c164535ad80">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.138</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.121.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://jenkins.io/security/advisory/2018-08-15/">
	 <h1>Description</h1>
	 <h5>(Low) SECURITY-637</h5>
	 Jenkins allowed deserialization of URL objects with host components
	 <h5>(Medium) SECURITY-672</h5>
	 Ephemeral user record was created on some invalid authentication attempts
	 <h5>(Medium) SECURITY-790</h5>
	 Cron expression form validation could enter infinite loop, potentially resulting in denial of service
	 <h5>(Low) SECURITY-996</h5>
	 "Remember me" cookie was evaluated even if that feature is disabled
	 <h5>(Medium) SECURITY-1071</h5>
	 Unauthorized users could access agent logs
	 <h5>(Low) SECURITY-1076</h5>
	 Unauthorized users could cancel scheduled restarts initiated from the update center
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://jenkins.io/security/advisory/2018-08-15/</url>
 </references>
 <dates>
 <discovery>2018-08-15</discovery>
 <entry>2018-08-15</entry>
 </dates>
 </vuln>

<vuln vid="98b603c8-9ff3-11e8-ad63-6451062f0f7a">
 <topic>Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>30.0.0.154</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-25.html">
	 <ul>
	 <li>This update resolves out-of-bounds read vulnerabilities that
	 could lead to information disclosure (CVE-2018-12824,
	 CVE-2018-12826, CVE-2018-12827).</li>
	 <li>This update resolves a security bypass vulnerability that
	 could lead to security mitigation bypass (CVE-2018-12825).</li>
	 <li>This update resolves a component vulnerability that
	 could lead to privilege escalation (CVE-2018-12828).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-12824</cvename>
 <cvename>CVE-2018-12825</cvename>
 <cvename>CVE-2018-12826</cvename>
 <cvename>CVE-2018-12827</cvename>
 <cvename>CVE-2018-12828</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb18-25.html</url>
 </references>
 <dates>
 <discovery>2018-08-14</discovery>
 <entry>2018-08-14</entry>
 </dates>
 </vuln>

<vuln vid="c4e9a427-9fc2-11e8-802a-000c29a1e3ec">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba46</name>
	<range><lt>4.6.16</lt></range>
 </package>
 <package>
	<name>samba47</name>
	<range><lt>4.7.9</lt></range>
 </package>
 <package>
	<name>samba48</name>
	<range><lt>4.8.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The samba project reports:
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1139.html">
	 Samba releases 4.7.0 to 4.8.3 (inclusive) contain an error which
	 allows authentication using NTLMv1 over an SMB1 transport (either
	 directory or via NETLOGON SamLogon calls from a member server), even
	 when NTLMv1 is explicitly disabled on the server.
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1140.html">
	 Missing input sanitization checks on some of the input parameters to
	 LDB database layer cause the LDAP server and DNS server to crash when
	 following a NULL pointer.
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-10858.html">
	 Samba releases 3.2.0 to 4.8.3 (inclusive) contain an error in
	 libsmbclient that could allow a malicious server to overwrite
	 client heap memory by returning an extra long filename in a directory
	 listing.
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-10918.html">
	 Missing database output checks on the returned directory attributes
	 from the LDB database layer cause the DsCrackNames call in the DRSUAPI
	 server to crash when following a NULL pointer.
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-10919.html">
	 All versions of the Samba Active Directory LDAP server from 4.0.0
	 onwards are vulnerable to the disclosure of confidential attribute
	 values, both of attributes where the schema SEARCH_FLAG_CONFIDENTIAL
	 (0x80) searchFlags bit and where an explicit Access Control Entry has
	 been specified on the ntSecurityDescriptor.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/security/CVE-2018-1139.html</url>
 <cvename>CVE-2018-1139</cvename>
 <url>https://www.samba.org/samba/security/CVE-2018-1140.html</url>
 <cvename>CVE-2018-1140</cvename>
 <url>https://www.samba.org/samba/security/CVE-2018-10858.html</url>
 <cvename>CVE-2018-10858</cvename>
 <url>https://www.samba.org/samba/security/CVE-2018-10918.html</url>
 <cvename>CVE-2018-10918</cvename>
 <url>https://www.samba.org/samba/security/CVE-2018-10919.html</url>
 <cvename>CVE-2018-10919</cvename>
 </references>
 <dates>
 <discovery>2018-08-14</discovery>
 <entry>2018-08-14</entry>
 </dates>
 </vuln>

<vuln vid="e714b7d2-39f6-4992-9f48-e6b2f5f949df">
 <topic>GraphicsMagick -- SVG/Rendering vulnerability</topic>
 <affects>
 <package>
	<name>GraphicsMagick</name>
	<range><lt>1.3.30,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GraphicsMagick News:
	<blockquote cite="http://www.graphicsmagick.org/NEWS.html">
	 Fix heap write overflow of PrimitiveInfo and PointInfo arrays. This is
	 another manefestation of CVE-2016-2317, which should finally be fixed
	 correctly due to active detection/correction of pending overflow rather
	 than using estimation.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.graphicsmagick.org/NEWS.html</url>
 <cvename>CVE-2016-2317</cvename>
 </references>
 <dates>
 <discovery>2018-06-23</discovery>
 <entry>2018-08-11</entry>
 </dates>
 </vuln>

<vuln vid="5a771686-9e33-11e8-8b2d-9cf7a8059466">
 <topic>chicken -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chicken</name>
	<range><lt>4.13.0,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CHICKEN reports:
	<blockquote cite="https://code.call-cc.org/releases/4.13.0/NEWS">
	 <ul>
	 <li>CVE-2017-6949: Unchecked malloc() call in SRFI-4
	 constructors when allocating in non-GC memory, resulting
	 in potential 1-word buffer overrun and/or segfault</li>
	 <li>CVE-2017-9334: "length" crashes on improper lists</li>
	 <li>CVE-2017-11343: The randomization factor of the symbol
	 table was set before the random seed was set, causing it
	 to have a fixed value on many platforms</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://code.call-cc.org/releases/4.13.0/NEWS</url>
 <cvename>CVE-2017-6949</cvename>
 <cvename>CVE-2017-9334</cvename>
 <cvename>CVE-2017-11343</cvename>
 </references>
 <dates>
 <discovery>2017-03-16</discovery>
 <entry>2018-08-12</entry>
 </dates>
 </vuln>

<vuln vid="bcf56a42-9df8-11e8-afb0-589cfc0f81b0">
 <topic>gitea -- TOTP passcode reuse</topic>
 <affects>
 <package>
	<name>gitea</name>
	<range><lt>1.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gitea project reports:
	<blockquote cite="https://blog.gitea.io/2018/08/gitea-1.5.0-is-released/">
	 TOTP passcodes can be reused.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/go-gitea/gitea/pull/3878</url>
 </references>
 <dates>
 <discovery>2018-05-01</discovery>
 <entry>2018-08-12</entry>
 </dates>
 </vuln>

<vuln vid="f4876dd4-9ca8-11e8-aa17-0011d823eebd">
 <topic>mbed TLS -- plaintext recovery vulnerabilities</topic>
 <affects>
 <package>
	<name>mbedtls</name>
	<range><lt>2.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Butcher reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02">
	 <ul>
	 <li>When using a CBC based ciphersuite, a remote attacker can
	 partially recover the plaintext.</li>
	 <li>When using a CBC based ciphersuite, an attacker with the
	 ability to execute arbitrary code on the machine under attack
	 can partially recover the plaintext by use of cache based
	 side-channels.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02</url>
 <cvename>CVE-2018-0497</cvename>
 <cvename>CVE-2018-0498</cvename>
 </references>
 <dates>
 <discovery>2018-07-24</discovery>
 <entry>2018-08-10</entry>
 </dates>
 </vuln>

<vuln vid="96eab874-9c79-11e8-b34b-6cc21735f730">
 <topic>PostgreSQL -- two vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql10-server</name>
	<range><lt>10.5</lt></range>
 </package>
 <package>
	<name>postgresql96-server</name>
	<range><lt>9.6.10</lt></range>
 </package>
 <package>
	<name>postgresql95-server</name>
	<range><lt>9.5.14</lt></range>
 </package>
 <package>
	<name>postgresql94-server</name>
	<range><lt>9.4.19</lt></range>
 </package>
 <package>
	<name>postgresql93-server</name>
	<range><lt>9.3.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/about/news/1878/">
	 CVE-2018-10915: Certain host connection parameters defeat
	 client-side security defenses
	 libpq, the client connection API for PostgreSQL that is also used
	 by other connection libraries, had an internal issue where it did not
	 reset all of its connection state variables when attempting to
	 reconnect. In particular, the state variable that determined whether
	 or not a password is needed for a connection would not be reset, which
	 could allow users of features requiring libpq, such as the "dblink" or
	 "postgres_fdw" extensions, to login to servers they should not be able
	 to access.
	 CVE-2018-10925: Memory disclosure and missing authorization in
	 `INSERT ... ON CONFLICT DO UPDATE`
	 An attacker able to issue CREATE TABLE can read arbitrary bytes of
	 server memory using an upsert (`INSERT ... ON CONFLICT DO UPDATE`)
	 query. By default, any user can exploit that. A user that has
	 specific INSERT privileges and an UPDATE privilege on at least one
	 column in a given table can also update other columns using a view and
	 an upsert query.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.postgresql.org/about/news/1878/</url>
 <cvename>CVE-2018-10915</cvename>
 <cvename>CVE-2018-10925</cvename>
 </references>
 <dates>
 <discovery>2018-08-09</discovery>
 <entry>2018-08-10</entry>
 </dates>
 </vuln>

<vuln vid="909be51b-9b3b-11e8-add2-b499baebfeaf">
 <topic>MySQL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb55-server</name>
	<range><lt>5.5.61</lt></range>
 </package>
 <package>
	<name>mariadb100-server</name>
	<range><lt>10.0.36</lt></range>
 </package>
 <package>
	<name>mariadb101-server</name>
	<range><lt>10.1.35</lt></range>
 </package>
 <package>
	<name>mariadb102-server</name>
	<range><lt>10.2.17</lt></range>
 </package>
 <package>
	<name>mariadb103-server</name>
	<range><lt>10.3.9</lt></range>
 </package>
 <package>
	<name>mysql55-server</name>
	<range><lt>5.5.61</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.41</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.23</lt></range>
 </package>
 <package>
	<name>mysql80-server</name>
	<range><lt>8.0.12</lt></range>
 </package>
 <package>
	<name>percona55-server</name>
	<range><lt>5.5.61</lt></range>
 </package>
 <package>
	<name>percona56-server</name>
	<range><lt>5.6.41</lt></range>
 </package>
 <package>
	<name>percona57-server</name>
	<range><lt>5.7.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html">
	 Multiple vulnerabilities have been disclosed by Oracle without
	 further detail. CVSS scores 7.1 - 2.7
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html</url>
 <cvename>CVE-2018-3064</cvename>
 <cvename>CVE-2018-0739</cvename>
 <cvename>CVE-2018-3070</cvename>
 <cvename>CVE-2018-3060</cvename>
 <cvename>CVE-2018-3065</cvename>
 <cvename>CVE-2018-3073</cvename>
 <cvename>CVE-2018-3074</cvename>
 <cvename>CVE-2018-3081</cvename>
 <cvename>CVE-2018-3071</cvename>
 <cvename>CVE-2018-3079</cvename>
 <cvename>CVE-2018-3054</cvename>
 <cvename>CVE-2018-3077</cvename>
 <cvename>CVE-2018-3078</cvename>
 <cvename>CVE-2018-3080</cvename>
 <cvename>CVE-2018-3061</cvename>
 <cvename>CVE-2018-3067</cvename>
 <cvename>CVE-2018-3063</cvename>
 <cvename>CVE-2018-3075</cvename>
 <cvename>CVE-2018-3058</cvename>
 <cvename>CVE-2018-3056</cvename>
 <cvename>CVE-2018-3066</cvename>
 <cvename>CVE-2018-2767</cvename>
 <cvename>CVE-2018-3084</cvename>
 <cvename>CVE-2018-3082</cvename>
 </references>
 <dates>
 <discovery>2018-07-17</discovery>
 <entry>2018-08-08</entry>
 </dates>
 </vuln>

<vuln vid="5786185a-9a43-11e8-b34b-6cc21735f730">
 <topic>xml-security-c -- crashes on malformed KeyInfo content</topic>
 <affects>
 <package>
	<name>apache-xml-security-c</name>
	<range><lt>2.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The shibboleth project reports:
	<blockquote cite="https://shibboleth.net/community/advisories/secadv_20180803.txt">
	 
	 SAML messages, assertions, and metadata all commonly make use of the
	 XML Signature KeyInfo construct, which expresses information about
	 keys and certificates used in signing or encrypting XML.
	 
	 
	 The Apache Santuario XML Security for C++ library contained code
	 paths at risk of dereferencing null pointers when processing various
	 kinds of malformed KeyInfo hints typically found in signed or
	 encrypted XML. The usual effect is a crash, and in the case of the
	 Shibboleth SP software, a crash in the shibd daemon, which prevents
	 access to protected resources until the daemon is restarted.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://shibboleth.net/community/advisories/secadv_20180803.txt</url>
 </references>
 <dates>
 <discovery>2018-08-03</discovery>
 <entry>2018-08-07</entry>
 </dates>
 </vuln>

<vuln vid="3c2eea8c-99bf-11e8-8bee-a4badb2f4699">
 <topic>FreeBSD -- Resource exhaustion in TCP reassembly</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.2</ge><lt>11.2_1</lt></range>
	<range><ge>11.1</ge><lt>11.1_12</lt></range>
	<range><ge>10.4</ge><lt>10.4_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	One of the data structures that holds TCP segments uses
	an inefficient algorithm to reassemble the data. This causes
	the CPU time spent on segment processing to grow linearly
	with the number of segments in the reassembly queue.
	<h1>Impact:</h1>
	An attacker who has the ability to send TCP traffic to
	a victim system can degrade the victim system's network
	performance and/or consume excessive CPU by exploiting the
	inefficiency of TCP reassembly handling, with relatively
	small bandwidth cost.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6922</cvename>
 <freebsdsa>SA-18:08.tcp</freebsdsa>
 </references>
 <dates>
 <discovery>2018-08-06</discovery>
 <entry>2018-08-06</entry>
 </dates>
 </vuln>

<vuln vid="9e2d0dcf-9926-11e8-a92d-0050562a4d7b">
 <topic>py-cryptography -- tag forgery vulnerability</topic>
 <affects>
 <package>
	<name>py27-cryptography</name>
	<name>py34-cryptography</name>
	<name>py35-cryptography</name>
	<name>py36-cryptography</name>
	<name>py37-cryptography</name>
	<range><lt>2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Python Cryptographic Authority (PyCA) project reports:
	<blockquote cite="https://cryptography.io/en/latest/changelog/#v2-3">
	 finalize_with_tag() allowed tag truncation by default which can allow tag forgery in some cases. The method now enforces the min_tag_length provided to the GCM constructor
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-10903</cvename>
 </references>
 <dates>
 <discovery>2018-07-17</discovery>
 <entry>2018-08-06</entry>
 </dates>
 </vuln>

<vuln vid="06c4a79b-981d-11e8-b460-9c5c8e75236a">
 <topic>cgit -- directory traversal vulnerability</topic>
 <affects>
 <package>
	<name>cgit</name>
	<range><lt>1.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jann Horn reports:
	<blockquote cite="https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html">
	 cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html</url>
 <cvename>CVE-2018-14912</cvename>
 </references>
 <dates>
 <discovery>2018-08-03</discovery>
 <entry>2018-08-04</entry>
 </dates>
 </vuln>

<vuln vid="e309a2c7-598b-4fa6-a398-bc72fbd1d167">
 <topic>rubygem-doorkeeper -- token revocation vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-doorkeeper</name>
	<name>rubygem-doorkeeper43</name>
	<name>rubygem-doorkeeper-rails5</name>
	<name>rubygem-doorkeeper-rails50</name>
	<range><lt>4.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-1000211">
	 Doorkeeper version 4.2.0 and later contains a Incorrect Access Control
	 vulnerability in Token revocation API's authorized method that can
	 result in Access tokens are not revoked for public OAuth apps, leaking
	 access until expiry.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2018-1000211</url>
 <url>https://github.com/doorkeeper-gem/doorkeeper/pull/1120</url>
 <cvename>CVE-2018-1000211</cvename>
 </references>
 <dates>
 <discovery>2018-07-13</discovery>
 <entry>2018-07-31</entry>
 <modified>2018-08-03</modified>
 </dates>
 </vuln>

<vuln vid="ca05d9da-ac1d-4113-8a05-ffe9cd0d6160">
 <topic>sinatra -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-sinatra</name>
	<range><ge>2.0.0</ge><lt>2.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sinatra blog:
	<blockquote cite="http://sinatrarb.com/2018/06/09/sinatra-2.0.2-and-2.0.3.html">
	 Sinatra had a critical vulnerability since v2.0.0. The purpose of this
	 release is to fix CVE-2018-11627.
	 The vulnerability is that XSS can be executed by using illegal parameters.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://sinatrarb.com/2018/06/09/sinatra-2.0.2-and-2.0.3.html</url>
 <url>https://github.com/sinatra/sinatra/blob/master/CHANGELOG.md</url>
 <cvename>CVE-2018-11627</cvename>
 </references>
 <dates>
 <discovery>2018-06-09</discovery>
 <entry>2018-07-31</entry>
 </dates>
 </vuln>

<vuln vid="b4f0ad36-94a5-11e8-9007-080027ac955c">
 <topic>mailman -- content spoofing with invalid list names in web UI</topic>
 <affects>
 <package><name>mailman</name> <range><lt>2.1.28</lt></range></package>
 <package><name>mailman-with-htdig</name><range><lt>2.1.28</lt></range></package>
 <package><name>ja-mailman</name> <range><lt>2.1.14.j7_6,1</lt></range></package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mark Sapiro reports:
	<blockquote cite="https://bugs.launchpad.net/mailman/+bug/1780874">
	 A URL with a very long text listname such as
	 <pre>http://www.example.com/mailman/listinfo/This_is_a_long_string_with_some_phishing_text</pre>
	 will echo the text in the "No such list" error response. This can be used to make a potential victim think the phishing text comes from a trusted site.
	 This issue was discovered by Hammad Qureshi.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.launchpad.net/mailman/+bug/1780874</url>
 <url>https://mail.python.org/pipermail/mailman-announce/2018-July/000241.html</url>
 <cvename>CVE-2018-13796</cvename>
 </references>
 <dates>
 <discovery>2018-07-09</discovery>
 <entry>2018-07-31</entry>
 </dates>
 </vuln>

<vuln vid="0822a4cf-9318-11e8-8d88-00e04c1ea73d">
 <topic>mantis -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mantis</name>
	<range><lt>2.15.0,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mantis reports:
	<blockquote cite="https://github.com/mantisbt/mantisbt/commit/8b5fa243dbf04344a55fe880135ec149fc1f439f">
	 Teun Beijers reported a cross-site scripting (XSS) vulnerability in
	 the Edit Filter page which allows execution of arbitrary code
	 (if CSP settings permit it) when displaying a filter with a crafted
	 name. Prevent the attack by sanitizing the filter name before display.
	 Ömer Cıtak, Security Researcher at Netsparker, reported this
	 vulnerability, allowing remote attackers to inject arbitrary code
	 (if CSP settings permit it) through a crafted PATH_INFO on
	 view_filters_page.php. Prevent the attack by sanitizing the output
	 of $_SERVER['PHP_SELF'] before display.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/mantisbt/mantisbt/commit/8b5fa243dbf04344a55fe880135ec149fc1f439f</url>
 <url>https://github.com/mantisbt/mantisbt/commit/4efac90ed89a5c009108b641e2e95683791a165a</url>
 <cvename>CVE-2018-14504</cvename>
 <cvename>CVE-2018-13066</cvename>
 </references>
 <dates>
 <discovery>2018-07-13</discovery>
 <entry>2018-07-29</entry>
 <modified>2018-08-24</modified>
 </dates>
 </vuln>

<vuln vid="e97a8852-32dd-4291-ba4d-92711daff056">
 <topic>py-bleach -- unsanitized character entities</topic>
 <affects>
 <package>
	<name>py27-bleach</name>
	<name>py36-bleach</name>
	<range><ge>2.1.0</ge><lt>2.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	bleach developer reports:
	<blockquote cite="https://github.com/mozilla/bleach/blob/v2.1.3/CHANGES">
	 Attributes that have URI values weren't properly sanitized if the
	 values contained character entities. Using character entities, it
	 was possible to construct a URI value with a scheme that was not
	 allowed that would slide through unsanitized.
	 This security issue was introduced in Bleach 2.1. Anyone using
	 Bleach 2.1 is highly encouraged to upgrade.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/mozilla/bleach/blob/v2.1.3/CHANGES</url>
 </references>
 <dates>
 <discovery>2018-03-05</discovery>
 <entry>2018-07-27</entry>
 </dates>
 </vuln>

<vuln vid="07d04eef-d8e2-11e6-a071-001e67f15f5a">
 <topic>lshell -- Shell autocomplete reveals forbidden directories</topic>
 <affects>
 <package>
	<name>lshell</name>
	<range><lt>0.9.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	lshell reports:
	<blockquote cite="https://github.com/ghantoos/lshell/issues/151">
	 The autocomplete feature allows users to list directories, while they do not have access to those paths (issue #109).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/ghantoos/lshell/issues/109</url>
 </references>
 <dates>
 <discovery>2015-07-25</discovery>
 <entry>2018-07-27</entry>
 </dates>
 </vuln>

<vuln vid="f353525a-d8b8-11e6-a071-001e67f15f5a">
 <topic>lshell -- Multiple security issues</topic>
 <affects>
 <package>
	<name>lshell</name>
	<range><le>0.9.18</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	lshell reports:
	<blockquote cite="https://github.com/ghantoos/lshell/issues/151">
	 It is possible to escape lshell if an allowed command can execute an arbitrary non allowed one (issue #122).
	 Inappropriate parsing of commands can lead to arbitrary command execution (issue #147, #149, #151).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/ghantoos/lshell/issues/122</url>
 <url>https://github.com/ghantoos/lshell/issues/147</url>
 <url>https://github.com/ghantoos/lshell/issues/149</url>
 <url>https://github.com/ghantoos/lshell/issues/151</url>
 </references>
 <dates>
 <discovery>2016-02-04</discovery>
 <entry>2018-07-27</entry>
 </dates>
 </vuln>

<vuln vid="11dc3890-0e64-11e8-99b0-d017c2987f9a">
 <topic>OpenJPEG -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openjpeg</name>
	<range><lt>2.3.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenJPEG reports:
	<blockquote cite="https://github.com/uclouvain/openjpeg/issues?q=is%3Aissue+CVE-2017-17479+OR+CVE-2017-17480+OR+CVE-2018-5785+OR+CVE-2018-6616">
	 Multiple vulnerabilities have been found in OpenJPEG, the
	 opensource JPEG 2000 codec. Please consult the CVE list for further
	 details.
	 CVE-2017-17479 and CVE-2017-17480 were fixed in r477112.
	 CVE-2018-5785 was fixed in r480624.
	 CVE-2018-6616 was fixed in r489415.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-17479</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-17480</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2018-5785</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2018-6616</url>
 <cvename>CVE-2017-17479</cvename>
 <cvename>CVE-2017-17480</cvename>
 <cvename>CVE-2018-5785</cvename>
 <cvename>CVE-2018-6616</cvename>
 </references>
 <dates>
 <discovery>2017-12-08</discovery>
 <entry>2018-07-27</entry>
 <modified>2019-02-11</modified>
 </dates>
 </vuln>

<vuln vid="5ccbb2f8-c798-11e7-a633-009c02a2ab30">
 <topic>ffmpeg -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ffmpeg</name>
	<range><lt>3.3.5_1,1</lt></range>
	<range><ge>3.4,1</ge><le>3.4.1_4,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="http://ffmpeg.org/security.html">
	 Multiple vulnerabilities have been found in FFmpeg. Please refer
	 to CVE list for details.
	 Note: CVE-2017-15186 and CVE-2017-15672 affect only the 3.3 branch
	 before 3.3.5, CVE-2017-16840 and CVE-2017-17081 have been fixed
	 in 3.4.1. They're listed here for completeness of the record.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15186</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15672</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16840</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17081</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6392</url>
 <url>http://ffmpeg.org/security.html</url>
 <cvename>CVE-2017-15186</cvename>
 <cvename>CVE-2017-15672</cvename>
 <cvename>CVE-2017-16840</cvename>
 <cvename>CVE-2017-17081</cvename>
 <cvename>CVE-2018-6392</cvename>
 </references>
 <dates>
 <discovery>2017-10-09</discovery>
 <entry>2018-07-27</entry>
 </dates>
 </vuln>

<vuln vid="bfda2d80-0858-11e8-ad5c-0021ccb9e74d">
 <topic>GIMP - Heap Buffer Overflow Vulnerability</topic>
 <affects>
 <package>
	<name>gimp</name>
	<range><lt>2.8.22,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GNOME reports:
	<blockquote cite="https://www.securityfocus.com/bid/102765/references">
	 CVE-2017-17786 Out of bounds read / heap overflow in tga importer / function bgr2rgb.part.1
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.gnome.org/show_bug.cgi?id=739134</url>
 <cvename>CVE-2017-17786</cvename>
 </references>
 <dates>
 <discovery>2017-12-21</discovery>
 <entry>2018-07-27</entry>
 </dates>
 </vuln>

<vuln vid="b9c525d9-9198-11e8-beba-080027ef1a23">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>68.0.3440.75</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html">
	 42 security fixes in this release, including:
	 <ul>
	 <li>[850350] High CVE-2018-6153: Stack buffer overflow in Skia. Reported by Zhen Zhou of NSFOCUS Security Team on 2018-06-07</li>
	 <li>[848914] High CVE-2018-6154: Heap buffer overflow in WebGL. Reported by Omair on 2018-06-01</li>
	 <li>[842265] High CVE-2018-6155: Use after free in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-11</li>
	 <li>[841962] High CVE-2018-6156: Heap buffer overflow in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-10</li>
	 <li>[840536] High CVE-2018-6157: Type confusion in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-07</li>
	 <li>[812667] Medium CVE-2018-6150: Cross origin information disclosure in Service Workers. Reported by Rob Wu on 2018-02-15</li>
	 <li>[805905] Medium CVE-2018-6151: Bad cast in DevTools. Reported by Rob Wu on 2018-01-25</li>
	 <li>[805445] Medium CVE-2018-6152: Local file write in DevTools. Reported by Rob Wu on 2018-01-24</li>
	 <li>[841280] Medium CVE-2018-6158: Use after free in Blink. Reported by Zhe Jin, Luyao Liu from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd on 2018-05-09</li>
	 <li>[837275] Medium CVE-2018-6159: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-04-26</li>
	 <li>[839822] Medium CVE-2018-6160: URL spoof in Chrome on iOS. Reported by evi1m0 of Bilibili Security Team on 2018-05-04</li>
	 <li>[826552] Medium CVE-2018-6161: Same origin policy bypass in WebAudio. Reported by Jun Kokatsu (@shhnjk) on 2018-03-27</li>
	 <li>[804123] Medium CVE-2018-6162: Heap buffer overflow in WebGL. Reported by Omair on 2018-01-21</li>
	 <li>[849398] Medium CVE-2018-6163: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-06-04</li>
	 <li>[848786] Medium CVE-2018-6164: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-06-01</li>
	 <li>[847718] Medium CVE-2018-6165: URL spoof in Omnibox. Reported by evi1m0 of Bilibili Security Team on 2018-05-30</li>
	 <li>[835554] Medium CVE-2018-6166: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-21</li>
	 <li>[833143] Medium CVE-2018-6167: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-15</li>
	 <li>[828265] Medium CVE-2018-6168: CORS bypass in Blink. Reported by Gunes Acar and Danny Y. Huang of Princeton University, Frank Li of UC Berkeley on 2018-04-03</li>
	 <li>[394518] Medium CVE-2018-6169: Permissions bypass in extension installation. Reported by Sam P on 2014-07-16</li>
	 <li>[862059] Medium CVE-2018-6170: Type confusion in PDFium. Reported by Anonymous on 2018-07-10</li>
	 <li>[851799] Medium CVE-2018-6171: Use after free in WebBluetooth. Reported by amazon@mimetics.ca on 2018-06-12</li>
	 <li>[847242] Medium CVE-2018-6172: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-05-28</li>
	 <li>[836885] Medium CVE-2018-6173: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-04-25</li>
	 <li>[835299] Medium CVE-2018-6174: Integer overflow in SwiftShader. Reported by Mark Brand of Google Project Zero on 2018-04-20</li>
	 <li>[826019] Medium CVE-2018-6175: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-26</li>
	 <li>[666824] Medium CVE-2018-6176: Local user privilege escalation in Extensions. Reported by Jann Horn of Google Project Zero on 2016-11-18</li>
	 <li>[826187] Low CVE-2018-6177: Cross origin information leak in Blink. Reported by Ron Masas (Imperva) on 2018-03-27</li>
	 <li>[823194] Low CVE-2018-6178: UI spoof in Extensions. Reported by Khalil Zhani on 2018-03-19</li>
	 <li>[816685] Low CVE-2018-6179: Local file information leak in Extensions. Reported by Anonymous on 2018-02-26</li>
	 <li>[797461] Low CVE-2018-6044: Request privilege escalation in Extensions. Reported by Wob Wu on 2017-12-23</li>
	 <li>[791324] Low CVE-2018-4117: Cross origin information leak in Blink. Reported by AhsanEjaz - @AhsanEjazA on 2017-12-03</li>
	 <li>[866821] Various fixes from internal audits, fuzzing and other initiatives</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-4117</cvename>
 <cvename>CVE-2018-6044</cvename>
 <cvename>CVE-2018-6150</cvename>
 <cvename>CVE-2018-6151</cvename>
 <cvename>CVE-2018-6152</cvename>
 <cvename>CVE-2018-6153</cvename>
 <cvename>CVE-2018-6154</cvename>
 <cvename>CVE-2018-6155</cvename>
 <cvename>CVE-2018-6156</cvename>
 <cvename>CVE-2018-6157</cvename>
 <cvename>CVE-2018-6158</cvename>
 <cvename>CVE-2018-6159</cvename>
 <cvename>CVE-2018-6160</cvename>
 <cvename>CVE-2018-6161</cvename>
 <cvename>CVE-2018-6162</cvename>
 <cvename>CVE-2018-6163</cvename>
 <cvename>CVE-2018-6164</cvename>
 <cvename>CVE-2018-6165</cvename>
 <cvename>CVE-2018-6166</cvename>
 <cvename>CVE-2018-6167</cvename>
 <cvename>CVE-2018-6168</cvename>
 <cvename>CVE-2018-6169</cvename>
 <cvename>CVE-2018-6170</cvename>
 <cvename>CVE-2018-6171</cvename>
 <cvename>CVE-2018-6172</cvename>
 <cvename>CVE-2018-6173</cvename>
 <cvename>CVE-2018-6174</cvename>
 <cvename>CVE-2018-6175</cvename>
 <cvename>CVE-2018-6176</cvename>
 <cvename>CVE-2018-6177</cvename>
 <cvename>CVE-2018-6178</cvename>
 <cvename>CVE-2018-6179</cvename>
 <url>https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2018-07-24</discovery>
 <entry>2018-07-27</entry>
 </dates>
 </vuln>

<vuln vid="3849e28f-8693-11e8-9610-9c5c8e75236a">
 <topic>curl -- SMTP send heap buffer overflow</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.54.1</ge><lt>7.61.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Peter Wu reports:
	<blockquote cite="https://curl.haxx.se/docs/adv_2018-70a2.html">
	 curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/adv_2018-70a2.html</url>
 <cvename>CVE-2018-0500</cvename>
 </references>
 <dates>
 <discovery>2018-07-11</discovery>
 <entry>2018-07-27</entry>
 <modified>2018-07-28</modified>
 </dates>
 </vuln>

<vuln vid="2da838f9-9168-11e8-8c75-d8cb8abf62dd">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<range><ge>11.1.0</ge><lt>11.1.2</lt></range>
	<range><ge>11.0.0</ge><lt>11.0.5</lt></range>
	<range><ge>2.7.0</ge><lt>10.8.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2018/07/26/security-release-gitlab-11-dot-1-dot-2-released/">
	 Markdown DoS
	 Information Disclosure Prometheus Metrics
	 CSRF in System Hooks
	 Persistent XSS Pipeline Tooltip
	 Persistent XSS in Branch Name via Web IDE
	 Persistent XSS in Branch Name via Web IDE
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-14601</cvename>
 <cvename>CVE-2018-14602</cvename>
 <cvename>CVE-2018-14603</cvename>
 <cvename>CVE-2018-14604</cvename>
 <cvename>CVE-2018-14605</cvename>
 <cvename>CVE-2018-14606</cvename>
 <url>https://about.gitlab.com/2018/07/26/security-release-gitlab-11-dot-1-dot-2-released/</url>
 </references>
 <dates>
 <discovery>2018-07-26</discovery>
 <entry>2018-07-27</entry>
 </dates>
 </vuln>

<vuln vid="38fec4bd-90f7-11e8-aafb-1c39475b9f84">
 <topic>Fix a buffer overflow in the tiff reader</topic>
 <affects>
 <package>
	<name>vips</name>
	<range><lt>8.6.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libvips reports:
	<blockquote cite="https://github.com/jcupitt/libvips/releases/tag/v8.6.5">
	 A buffer overflow was found and fixed in the libvips code
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/jcupitt/libvips/releases/tag/v8.6.5</url>
 </references>
 <dates>
 <discovery>2018-07-22</discovery>
 <entry>2018-07-26</entry>
 </dates>
 </vuln>

<vuln vid="efe43d2b-8f35-11e8-b9e8-dcfe074bd614">
 <topic>Memory leak in different components</topic>
 <affects>
 <package>
	<name>libsixel</name>
	<range><lt>1.8.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-14072">
	 bsixel 1.8.1 has a memory leak in sixel_decoder_decode in
	 decoder.c, image_buffer_resize in fromsixel.c, sixel_decode_raw in
	 fromsixel.c and sixel_allocator_new in allocator.c
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-14072</cvename>
 <cvename>CVE-2018-14073</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14072</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14073</url>
 </references>
 <dates>
 <discovery>2018-07-15</discovery>
 <entry>2018-07-24</entry>
 </dates>
 </vuln>

<vuln vid="dc57ad48-ecbb-439b-a4d0-5869be47684e">
 <topic>vlc -- Use after free vulnerability</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><le>2.2.8_6,4</le></range>
 </package>
 <package>
	<name>vlc-qt4</name>
	<range><le>2.2.8_6,4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11529">
	 VideoLAN VLC media player 2.2.x is prone to a use after free
	 vulnerability which an attacker can leverage to execute arbitrary
	 code via crafted MKV files. Failed exploit attempts will likely
	 result in denial of service conditions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-11529</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11529</url>
 <url>http://seclists.org/fulldisclosure/2018/Jul/28</url>
 <url>https://github.com/rapid7/metasploit-framework/pull/10335</url>
 <url>https://github.com/videolan/vlc-3.0/commit/c472668ff873cfe29281822b4548715fb7bb0368</url>
 <url>https://github.com/videolan/vlc-3.0/commit/d2dadb37e7acc25ae08df71e563855d6e17b5b42</url>
 </references>
 <dates>
 <discovery>2018-06-06</discovery>
 <entry>2018-07-21</entry>
 </dates>
 </vuln>

<vuln vid="a2f35081-8a02-11e8-8fa5-4437e6ad11c4">
 <topic>mutt -- remote code injection and path traversal vulnerability</topic>
 <affects>
 <package>
	<name>mutt</name>
	<range><lt>1.10.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kevin J. McCarthy reports:
	<blockquote cite="http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20180716/000004.html">
	 Fixes a remote code injection vulnerability when "subscribing"
	 to an IMAP mailbox, either via $imap_check_subscribed, or via the
	 &lt;subscribe&gt; function in the browser menu. Mutt was generating a
	 "mailboxes" command and sending that along to the muttrc parser.
	 However, it was not escaping "`", which executes code and inserts
	 the result. This would allow a malicious IMAP server to execute
	 arbitrary code (for $imap_check_subscribed).
	 Fixes POP body caching path traversal vulnerability.
	 Fixes IMAP header caching path traversal vulnerability.
	 CVE-2018-14349 - NO Response Heap Overflow
	 CVE-2018-14350 - INTERNALDATE Stack Overflow
	 CVE-2018-14351 - STATUS Literal Length relative write
	 CVE-2018-14352 - imap_quote_string off-by-one stack overflow
	 CVE-2018-14353 - imap_quote_string int underflow
	 CVE-2018-14354 - imap_subscribe Remote Code Execution
	 CVE-2018-14355 - STATUS mailbox header cache directory traversal
	 CVE-2018-14356 - POP empty UID NULL deref
	 CVE-2018-14357 - LSUB Remote Code Execution
	 CVE-2018-14358 - RFC822.SIZE Stack Overflow
	 CVE-2018-14359 - base64 decode Stack Overflow
	 CVE-2018-14362 - POP Message Cache Directory Traversal
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-14349</cvename>
 <cvename>CVE-2018-14350</cvename>
 <cvename>CVE-2018-14351</cvename>
 <cvename>CVE-2018-14352</cvename>
 <cvename>CVE-2018-14353</cvename>
 <cvename>CVE-2018-14354</cvename>
 <cvename>CVE-2018-14355</cvename>
 <cvename>CVE-2018-14356</cvename>
 <cvename>CVE-2018-14357</cvename>
 <cvename>CVE-2018-14358</cvename>
 <cvename>CVE-2018-14359</cvename>
 <cvename>CVE-2018-14362</cvename>
 <url>http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20180716/000004.html</url>
 </references>
 <dates>
 <discovery>2018-07-15</discovery>
 <entry>2018-07-17</entry>
 </dates>
 </vuln>

<vuln vid="fe12ef83-8b47-11e8-96cc-001a4a7ec6be">
 <topic>mutt/neomutt -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>neomutt</name>
	<range><lt>20180716</lt></range>
 </package>
 <package>
	<name>mutt</name>
	<range><lt>1.10.1</lt></range>
 </package>
 <package>
	<name>mutt14</name>
	<range><lt>*</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NeoMutt report:
	<blockquote cite="https://github.com/neomutt/neomutt/releases/tag/neomutt-20180716">
	 <h1>Description</h1>
	 <h5>CVE-2018-14349</h5>NO Response Heap Overflow
	 <h5>CVE-2018-14350</h5>INTERNALDATE Stack Overflow
	 <h5>CVE-2018-14351</h5>STATUS Literal Length relative write
	 <h5>CVE-2018-14352</h5>imap_quote_string off-by-one stack overflow
	 <h5>CVE-2018-14353</h5>imap_quote_string int underflow
	 <h5>CVE-2018-14354</h5>imap_subscribe Remote Code Execution
	 <h5>CVE-2018-14355</h5>STATUS mailbox header cache directory traversal
	 <h5>CVE-2018-14356</h5>POP empty UID NULL deref
	 <h5>CVE-2018-14357</h5>LSUB Remote Code Execution
	 <h5>CVE-2018-14358</h5>RFC822.SIZE Stack Overflow
	 <h5>CVE-2018-14359</h5>base64 decode Stack Overflow
	 <h5>CVE-2018-14360</h5>NNTP Group Stack Overflow
	 <h5>CVE-2018-14361</h5>NNTP Write 1 where via GROUP response
	 <h5>CVE-2018-14362</h5>POP Message Cache Directory Traversal
	 <h5>CVE-2018-14363</h5>NNTP Header Cache Directory Traversal
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-14349</cvename>
 <cvename>CVE-2018-14350</cvename>
 <cvename>CVE-2018-14351</cvename>
 <cvename>CVE-2018-14352</cvename>
 <cvename>CVE-2018-14353</cvename>
 <cvename>CVE-2018-14354</cvename>
 <cvename>CVE-2018-14355</cvename>
 <cvename>CVE-2018-14356</cvename>
 <cvename>CVE-2018-14357</cvename>
 <cvename>CVE-2018-14358</cvename>
 <cvename>CVE-2018-14359</cvename>
 <cvename>CVE-2018-14360</cvename>
 <cvename>CVE-2018-14361</cvename>
 <cvename>CVE-2018-14362</cvename>
 <cvename>CVE-2018-14363</cvename>
 <url>https://github.com/neomutt/neomutt/releases/tag/neomutt-20180716</url>
 </references>
 <dates>
 <discovery>2018-07-10</discovery>
 <entry>2018-07-19</entry>
 </dates>
 </vuln>

<vuln vid="20a1881e-8a9e-11e8-bddf-d017c2ca229d">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.133</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.121.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://jenkins.io/security/advisory/2018-07-18/">
	 <h1>Description</h1>
	 <h5>(High) SECURITY-897 / CVE-2018-1999001</h5>
	 Users without Overall/Read permission can have Jenkins reset parts of global configuration on the next restart 
	 <h5>(High) SECURITY-914 / CVE-2018-1999002</h5>
	 Arbitrary file read vulnerability
	 <h5>(Medium) SECURITY-891 / CVE-2018-1999003</h5>
	 Unauthorized users could cancel queued builds
	 <h5>(Medium) SECURITY-892 / CVE-2018-1999004</h5>
	 Unauthorized users could initiate and abort agent launches
	 <h5>(Medium) SECURITY-944 / CVE-2018-1999005</h5>
	 Stored XSS vulnerability
	 <h5>(Medium) SECURITY-925 / CVE-2018-1999006</h5>
	 Unauthorized users are able to determine when a plugin was extracted from its JPI package
	 <h5>(Medium) SECURITY-390 / CVE-2018-1999007</h5>
	 XSS vulnerability in Stapler debug mode
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-1999001</cvename>
 <cvename>CVE-2018-1999002</cvename>
 <cvename>CVE-2018-1999003</cvename>
 <cvename>CVE-2018-1999004</cvename>
 <cvename>CVE-2018-1999005</cvename>
 <cvename>CVE-2018-1999006</cvename>
 <cvename>CVE-2018-1999007</cvename>
 <url>https://jenkins.io/security/advisory/2018-07-18/</url>
 </references>
 <dates>
 <discovery>2018-07-18</discovery>
 <entry>2018-07-18</entry>
 </dates>
 </vuln>

<vuln vid="c6d1a8a6-8a91-11e8-be4d-005056925db4">
 <topic>znc -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>znc</name>
	<range><lt>1.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14055">
	 ZNC before 1.7.1-rc1 does not properly validate untrusted lines
	 coming from the network, allowing a non-admin user to escalate his
	 privilege and inject rogue values into znc.conf.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14056">
	 ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in
	 a web skin name to access files outside of the intended skins
	 directories.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-14055</cvename>
 <cvename>CVE-2018-14056</cvename>
 <url>https://wiki.znc.in/ChangeLog/1.7.1</url>
 </references>
 <dates>
 <discovery>2018-07-14</discovery>
 <entry>2018-07-18</entry>
 </dates>
 </vuln>

<vuln vid="8b1a50ab-8a8e-11e8-add2-b499baebfeaf">
 <topic>Apache httpd -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.34</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache project reports:
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
	 <ul>
	 <li>DoS for HTTP/2 connections by crafted requests
	 (CVE-2018-1333). By specially crafting HTTP/2 requests, workers
	 would be allocated 60 seconds longer than necessary, leading to
	 worker exhaustion and a denial of service. (low)</li>
	 <li>mod_md, DoS via Coredumps on specially crafted requests
	 (CVE-2018-8011). By specially crafting HTTP requests, the mod_md
	 challenge handler would dereference a NULL pointer and cause the
	 child process to segfault. This could be used to DoS the server.
	 (moderate)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
 <cvename>CVE-2018-1333</cvename>
 <cvename>CVE-2018-8011</cvename>
 </references>
 <dates>
 <discovery>2018-07-18</discovery>
 <entry>2018-07-18</entry>
 </dates>
 </vuln>

<vuln vid="8fc615cc-8a66-11e8-8c75-d8cb8abf62dd">
 <topic>Gitlab -- Remote Code Execution Vulnerability in GitLab Projects Import</topic>
 <affects>
 <package>
	<name>gitlab-ce</name>
	<name>gitlab</name>
	<range><ge>11.0.0</ge><lt>11.0.4</lt></range>
	<range><ge>10.8.0</ge><lt>10.8.6</lt></range>
	<range><ge>8.9.0</ge><lt>10.7.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2018/07/17/critical-security-release-gitlab-11-dot-0-dot-4-released/">
	 Remote Code Execution Vulnerability in GitLab Projects Import
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-14364</cvename>
 <url>https://about.gitlab.com/2018/07/17/critical-security-release-gitlab-11-dot-0-dot-4-released/</url>
 </references>
 <dates>
 <discovery>2018-07-17</discovery>
 <entry>2018-07-18</entry>
 </dates>
 </vuln>

<vuln vid="ef013039-89cd-11e8-84e9-00e04c1ea73d">
 <topic>typo3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>typo3-7</name>
	<range><lt>7.6.30</lt></range>
 </package>
 <package>
	<name>typo3-8</name>
	<range><lt>8.7.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Typo3 core team reports:
	<blockquote cite="https://typo3.org/article/typo3-931-8717-and-7630-security-releases-published/">
	 It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system component)
	 is vulnerable to Authentication Bypass when using hashing methods which are related by PHP class inheritance.
	 In standard TYPO3 core distributions stored passwords using the blowfish hashing algorithm can be overridden
	 when using MD5 as the default hashing algorithm by just knowing a valid username.
	 Per default the Portable PHP hashing algorithm (PHPass) is used which is not vulnerable.
	 Phar files (formerly known as "PHP archives") can act als self extracting archives which leads to the fact
	 that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored
	 with a dedicated file extension - "bundle.phar" would be valid as well as "bundle.txt" would be. This way,
	 Phar files can be obfuscated as image or text file which would not be denied from being uploaded and persisted
	 to a TYPO3 installation. Due to a missing sanitization of user input, those Phar files can be invoked by
	 manipulated URLs in TYPO3 backend forms. A valid backend user account is needed to exploit this vulnerability.
	 In theory the attack vector would be possible in the TYPO3 frontend as well, however no functional exploit
	 has been identified so far.
	 Failing to properly dissociate system related configuration from user generated configuration,
	 the Form Framework (system extension "form") is vulnerable to SQL injection and Privilege Escalation.
	 Basically instructions can be persisted to a form definition file that were not configured to be modified -
	 this applies to definitions managed using the form editor module as well as direct file upload using the regular
	 file list module. A valid backend user account as well as having system extension form activated are needed
	 in order to exploit this vulnerability.
	 It has been discovered that the Form Framework (system extension "form") is vulnerable to Insecure Deserialization
	 when being used with the additional PHP PECL package “yaml”, which is capable of unserializing YAML contents
	 to PHP objects. A valid backend user account as well as having PHP setting "yaml.decode_php" enabled is needed
	 to exploit this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2018-001/</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2018-002/</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2018-003/</url>
 <url>https://typo3.org/security/advisory/typo3-core-sa-2018-004/</url>
 </references>
 <dates>
 <discovery>2018-07-12</discovery>
 <entry>2018-07-17</entry>
 </dates>
 </vuln>

<vuln vid="fe93803c-883f-11e8-9f0c-001b216d295b">
 <topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic>
 <affects>
 <package>
	<name>bouncycastle</name>
	<range><lt>1.60</lt></range>
 </package>
 <package>
	<name>bouncycastle15</name>
	<range><lt>1.60</lt></range>
 </package>
 <package>
	<name>puppetserver</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>puppetserver5</name>
	<range><lt>5.3.8</lt></range>
 </package>
 <package>
	<name>puppetserver6</name>
	<range><lt>6.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Legion of the Bouncy Castle reports:
	<blockquote cite="https://www.bouncycastle.org/latest_releases.html">
	 Release 1.60 is now available for download.
	 CVE-2018-1000180: issue around primality tests for RSA key pair
	 generation if done using only the low-level API.
	 CVE-2018-1000613: lack of class checking in deserialization
	 of XMSS/XMSS^MT private keys with BDS state information.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-1000180</cvename>
 <cvename>CVE-2018-1000613</cvename>
 <url>https://www.bouncycastle.org/latest_releases.html</url>
 </references>
 <dates>
 <discovery>2018-06-30</discovery>
 <entry>2018-07-15</entry>
 </dates>
 </vuln>

<vuln vid="bd6cf187-8710-11e8-833d-18a6f7016652">
 <topic>qutebrowser -- Remote code execution due to CSRF</topic>
 <affects>
 <package>
	<name>qutebrowser</name>
	<range><ge>1.4.0</ge><lt>1.4.1</lt></range>
	<range><ge>1.0.0</ge><lt>1.3.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	qutebrowser team reports:
	<blockquote cite="https://blog.qutebrowser.org/cve-2018-10895-remote-code-execution-due-to-csrf-in-qutebrowser.html">
	 Due to a CSRF vulnerability affecting the qute://settings page,
	 it was possible for websites to modify qutebrowser settings.
	 Via settings like editor.command, this possibly allowed websites
	 to execute arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2018/q3/29</url>
 <cvename>CVE-2018-10895</cvename>
 </references>
 <dates>
 <discovery>2018-07-11</discovery>
 <entry>2018-07-14</entry>
 </dates>
 </vuln>

<vuln vid="e78732b2-8528-11e8-9c42-6451062f0f7a">
 <topic>Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>30.0.0.134</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-24.html">
	 <ul>
	 <li>This update resolves an out-of-bounds read vulnerability that
	 could lead to information disclosure (CVE-2018-5008).</li>
	 <li>This update resolves a type confusion vulnerability that
	 could lead to arbitrary code execution (CVE-2018-5007).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-5007</cvename>
 <cvename>CVE-2018-5008</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb18-24.html</url>
 </references>
 <dates>
 <discovery>2018-07-10</discovery>
 <entry>2018-07-11</entry>
 </dates>
 </vuln>

<vuln vid="1e54d140-8493-11e8-a795-0028f8d09152">
 <topic>couchdb -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>couchdb</name>
	<range><lt>1.7.2,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache CouchDB PMC reports:
	<blockquote cite="https://blog.couchdb.org/2018/07/10/cve-2018-8007/">
	 Database Administrator could achieve privilege escalation to
	 the account that CouchDB runs under, by abusing insufficient validation
	 in the HTTP API, escaping security controls implemented in previous
	 releases.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.couchdb.org/2018/07/10/cve-2018-8007/</url>
 <cvename>CVE-2018-8007</cvename>
 <url>https://blog.couchdb.org/2017/11/14/apache-couchdb-cve-2017-12635-and-cve-2017-12636/</url>
 <cvename>CVE-2017-12636</cvename>
 <cvename>CVE-2017-12635</cvename>
 <url>https://lists.apache.org/thread.html/6fa798e96686b7b0013ec2088140d00aeb7d34487d3f5ad032af6934@%3Cdev.couchdb.apache.org%3E</url>
 </references>
 <dates>
 <discovery>2017-11-14</discovery>
 <entry>2018-07-10</entry>
 </dates>
 </vuln>

<vuln vid="3c9b7698-84da-11e8-8c75-d8cb8abf62dd">
 <topic>Libgit2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libgit2</name>
	<range><lt>0.27.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Git community reports:
	<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.27.3">
	 Out-of-bounds reads when reading objects from a packfile
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/libgit2/libgit2/releases/tag/v0.27.3</url>
 <cvename>CVE-2018-10887</cvename>
 <cvename>CVE-2018-10888</cvename>
 </references>
 <dates>
 <discovery>2018-07-09</discovery>
 <entry>2018-07-11</entry>
 </dates>
 </vuln>

<vuln vid="d1e9d8c5-839b-11e8-9610-9c5c8e75236a">
 <topic>clamav -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.100.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 Joel Esler reports:
	<blockquote cite="https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html">
	 3 security fixes in this release:
	 <ul>
	 <li>CVE-2017-16932: Vulnerability in libxml2 dependency (affects ClamAV on Windows only).</li>
	 <li>CVE-2018-0360: HWP integer overflow, infinite loop vulnerability. Reported by Secunia Research at Flexera.</li>
	 <li>CVE-2018-0361: ClamAV PDF object length check, unreasonably long time to parse relatively small file. Report
ed by aCaB.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html</url>
 <cvename>CVE-2017-16932</cvename>
 <cvename>CVE-2018-0360</cvename>
 <cvename>CVE-2018-0361</cvename>
 </references>
 <dates>
 <discovery>2018-07-09</discovery>
 <entry>2018-07-09</entry>
 </dates>
 </vuln>

<vuln vid="7764b219-8148-11e8-aa4d-000e0cd7b374">
 <topic>zziplib - multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>zziplib</name>
	<range><lt>0.13.68</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NIST reports (by search in the range 2017/01/01 - 2018/07/06):
	<blockquote cite="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&amp;results_type=overview&amp;query=zziplib&amp;search_type=all&amp;pub_start_date=01%2F01%2F2017&amp;pub_end_date=07%2F06%2F2018">
	 17 security fixes in this release:
	 <ul>
	 <li>Heap-based buffer overflow in the __zzip_get32 function in fetch.c.</li>
	 <li>Heap-based buffer overflow in the __zzip_get64 function in fetch.c.</li>
	 <li>Heap-based buffer overflow in the zzip_mem_entry_extra_block function
	 in memdisk.c.</li>
	 <li>The zzip_mem_entry_new function in memdisk.c allows remote attackers
	 to cause a denial of service (out-of-bounds read and crash) via a
	 crafted ZIP file.</li>
	 <li>The prescan_entry function in fseeko.c allows remote attackers to cause
	 a denial of service (NULL pointer dereference and crash) via crafted
	 ZIP file.</li>
	 <li>The zzip_mem_entry_new function in memdisk.c cause a NULL pointer
	 dereference and crash via a crafted ZIP file.</li>
	 <li>seeko.c cause a denial of service (assertion failure and crash) via a
	 crafted ZIP file.</li>
	 <li>A segmentation fault caused by invalid memory access in the
	 zzip_disk_fread function because the size variable is not validated
	 against the amount of file-&gt;stored data.</li>
	 <li>A memory alignment error and bus error in the __zzip_fetch_disk_trailer
	 function of zzip/zip.c.</li>
	 <li>A bus error caused by loading of a misaligned address in the
	 zzip_disk_findfirst function.</li>
	 <li>An uncontrolled memory allocation and a crash in the __zzip_parse_root_directory
	 function.</li>
	 <li>An invalid memory address dereference was discovered in zzip_disk_fread
	 in mmapped.c.</li>
	 <li>A memory leak triggered in the function zzip_mem_disk_new in
	 memdisk.c.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5974</cvename>
 <cvename>CVE-2017-5975</cvename>
 <cvename>CVE-2017-5976</cvename>
 <cvename>CVE-2017-5977</cvename>
 <cvename>CVE-2017-5978</cvename>
 <cvename>CVE-2017-5979</cvename>
 <cvename>CVE-2017-5980</cvename>
 <cvename>CVE-2017-5981</cvename>
 <cvename>CVE-2018-6381</cvename>
 <cvename>CVE-2018-6484</cvename>
 <cvename>CVE-2018-6540</cvename>
 <cvename>CVE-2018-6541</cvename>
 <cvename>CVE-2018-6542</cvename>
 <cvename>CVE-2018-6869</cvename>
 <cvename>CVE-2018-7725</cvename>
 <cvename>CVE-2018-7726</cvename>
 <cvename>CVE-2018-7727</cvename>
 <url>https://nvd.nist.gov/vuln/search/results?form_type=Advanced&amp;results_type=overview&amp;query=zziplib&amp;search_type=all&amp;pub_start_date=01%2F01%2F2017&amp;pub_end_date=07%2F06%2F2018"</url>
 </references>
 <dates>
 <discovery>2017-03-01</discovery>
 <entry>2018-07-06</entry>
 </dates>
 </vuln>

<vuln vid="4740174c-82bb-11e8-a29a-00e04c1ea73d">
 <topic>wordpress -- multiple issues</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>4.9.7,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>zh_CN-wordpress</name>
	<name>zh_TW-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<range><lt>4.9.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wordpressdevelopers reports:
	<blockquote cite="https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/">
	 Taxonomy: Improve cache handling for term queries.
	 Posts, Post Types: Clear post password cookie when logging out.
	 Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen.
	 Community Events Dashboard: Always show the nearest WordCamp if one is coming up, even if there are multiple Meetups happening first.
	 Privacy: Make sure default privacy policy content does not cause a fatal error when flushing rewrite rules outside of the admin context.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2018-07-05</discovery>
 <entry>2018-07-08</entry>
 </dates>
 </vuln>

<vuln vid="bfd5d004-81d4-11e8-a29a-00e04c1ea73d">
 <topic>mybb -- vulnerabilities</topic>
 <affects>
 <package>
	<name>mybb</name>
	<range><lt>1.8.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mybb Team reports:
	<blockquote cite="https://blog.mybb.com/2018/07/04/mybb-1-8-16-released-security-maintenance-release/">
	 High risk: Image and URL MyCode Persistent XSS
	 Medium risk: Multipage Reflected XSS
	 Low risk: ACP logs XSS
	 Low risk: Arbitrary file deletion via ACP’s Settings
	 Low risk: Login CSRF
	 Low risk: Non-video content embedding via Video MyCode
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.mybb.com/2018/07/04/mybb-1-8-16-released-security-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2018-07-04</discovery>
 <entry>2018-07-07</entry>
 </dates>
 </vuln>

<vuln vid="e375ff3f-7fec-11e8-8088-28d244aee256">
 <topic>expat -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>expat</name>
	<range><lt>2.2.1</lt></range>
 </package>
 <package>
	<name>libwww</name>
	<range><lt>5.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063">
	 An integer overflow during the parsing of XML using the Expat library.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233">
	 XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat
	 XML Parser Library) allows attackers to put the parser in an infinite
	 loop using a malformed external entity definition from an external DTD.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9063</cvename>
 <cvename>CVE-2017-9233</cvename>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063</url>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233</url>
 <url>https://libexpat.github.io/doc/cve-2017-9233/</url>
 </references>
 <dates>
 <discovery>2016-10-27</discovery>
 <entry>2018-07-05</entry>
 </dates>
 </vuln>

<vuln vid="ce39379f-7eb7-11e8-ab03-00bd7f19ff09">
 <topic>h2o -- heap buffer overflow during logging</topic>
 <affects>
 <package>
	<name>h2o</name>
	<range><lt>2.2.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marlies Ruck reports:
	<blockquote cite="https://github.com/h2o/h2o/releases/tag/v2.2.5">
	 Fix heap buffer overflow while trying to emit access log
	 - see references for full details.
	 CVE-2018-0608: Buffer overflow in H2O version 2.2.4 and
	 earlier allows remote attackers to execute arbitrary code or
	 cause a denial of service (DoS) via unspecified vectors.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-0608</cvename>
 <url>https://github.com/h2o/h2o/issues/1775</url>
 <url>https://github.com/h2o/h2o/releases/tag/v2.2.5</url>
 </references>
 <dates>
 <discovery>2018-06-01</discovery>
 <entry>2018-07-03</entry>
 </dates>
 </vuln>

<vuln vid="c1630aa3-7970-11e8-8634-dcfe074bd614">
 <topic>SQLite -- Corrupt DB can cause a NULL pointer dereference</topic>
 <affects>
 <package>
	<name>upp</name>
	<range><le>11540</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-8740">
	 SQLite databases whose schema is corrupted using a CREATE TABLE AS
	 statement could cause a NULL pointer dereference, related to build.c
	 and prepare.c.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-8740</cvename>
 <url>http://openwall.com/lists/oss-security/2018/03/17/1</url>
 </references>
 <dates>
 <discovery>2018-03-16</discovery>
 <entry>2018-07-01</entry>
 </dates>
 </vuln>

<vuln vid="cd81806c-26e7-4d4a-8425-02724a2f48af">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>61.0_1,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.2.1.19_2</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.4</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><ge>60.0,1</ge><lt>60.1.0_1,1</lt></range>
	<range><lt>52.9.0_1,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>52.9.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.9.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/">
	 CVE-2018-12359: Buffer overflow using computed size of canvas element
	 CVE-2018-12360: Use-after-free when using focus()
	 CVE-2018-12361: Integer overflow in SwizzleData
	 CVE-2018-12358: Same-origin bypass using service worker and redirection
	 CVE-2018-12362: Integer overflow in SSSE3 scaler
	 CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture
	 CVE-2018-12363: Use-after-free when appending DOM nodes
	 CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins
	 CVE-2018-12365: Compromised IPC child process can list local filenames
	 CVE-2018-12371: Integer overflow in Skia library during edge builder allocation
	 CVE-2018-12366: Invalid data handling during QCMS transformations
	 CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming
	 CVE-2018-12368: No warning when opening executable SettingContent-ms files
	 CVE-2018-12369: WebExtension security permission checks bypassed by embedded experiments
	 CVE-2018-12370: SameSite cookie protections bypassed when exiting Reader View
	 CVE-2018-5186: Memory safety bugs fixed in Firefox 61
	 CVE-2018-5187: Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1
	 CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-5156</cvename>
 <cvename>CVE-2018-5186</cvename>
 <cvename>CVE-2018-5187</cvename>
 <cvename>CVE-2018-5188</cvename>
 <cvename>CVE-2018-12358</cvename>
 <cvename>CVE-2018-12359</cvename>
 <cvename>CVE-2018-12360</cvename>
 <cvename>CVE-2018-12361</cvename>
 <cvename>CVE-2018-12362</cvename>
 <cvename>CVE-2018-12363</cvename>
 <cvename>CVE-2018-12364</cvename>
 <cvename>CVE-2018-12365</cvename>
 <cvename>CVE-2018-12366</cvename>
 <cvename>CVE-2018-12367</cvename>
 <cvename>CVE-2018-12368</cvename>
 <cvename>CVE-2018-12369</cvename>
 <cvename>CVE-2018-12370</cvename>
 <cvename>CVE-2018-12371</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-17/</url>
 </references>
 <dates>
 <discovery>2018-06-26</discovery>
 <entry>2018-06-26</entry>
 <modified>2018-07-07</modified>
 </dates>
 </vuln>

<vuln vid="739948e3-78bf-11e8-b23c-080027ac955c">
 <topic>mailman -- hardening against malicious listowners injecting evil HTML scripts</topic>
 <affects>
 <package> <name>mailman</name> <range><lt>2.1.27</lt></range> </package>
 <package> <name>mailman-with-htdig</name> <range><lt>2.1.27</lt></range> </package>
 <package> <name>ja-mailman</name> <range><lt>2.1.14.j7_5,1</lt></range> </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mark Sapiro reports:
	<blockquote cite="https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS#L8">
	 Existing protections against malicious listowners injecting evil
	 scripts into listinfo pages have had a few more checks added.
	 
	 A few more error messages have had their values HTML escaped.
	 The hash generated when SUBSCRIBE_FORM_SECRET is set could have been
	 the same as one generated at the same time for a different list and
	 IP address.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS#L8</url>
 <url>https://www.mail-archive.com/mailman-users@python.org/</url>
 <cvename>CVE-2018-0618</cvename>
 </references>
 <dates>
 <discovery>2018-03-09</discovery> 
 <entry>2018-06-25</entry>
 </dates>
 </vuln>

<vuln vid="b950a83b-789e-11e8-8545-d8cb8abf62dd">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab</name>
	<range><ge>11.0.0</ge><lt>11.0.1</lt></range>
	<range><ge>10.8.0</ge><lt>10.8.5</lt></range>
	<range><ge>4.1</ge><lt>10.7.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gitlab reports:
	<blockquote cite="https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/">
	 Wiki XSS
	 Sanitize gem updates
	 XSS in url_for(params)
	 Content injection via username
	 Activity feed publicly displaying internal project names
	 Persistent XSS in charts
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-12606</cvename>
 <cvename>CVE-2018-3740</cvename>
 <cvename>CVE-2018-12605</cvename>
 <cvename>CVE-2018-12607</cvename>
 <url>https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/</url>
 </references>
 <dates>
 <discovery>2018-06-25</discovery>
 <entry>2018-06-25</entry>
 </dates>
 </vuln>

<vuln vid="17cb6ff3-7670-11e8-8854-6805ca0b3d42">
 <topic>phpmyadmin -- remote code inclusion and XSS scripting</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><lt>4.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-3/">
	 <h3>Summary</h3>
	 XSS in Designer feature
	 <h3>Description</h3>
	 A Cross-Site Scripting vulnerability was found in the
	 Designer feature, where an attacker can deliver a
	 payload to a user through a specially-crafted database
	 name.
	 <h3>Severity</h3>
	 We consider this attack to be of moderate severity.
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-4/">
	 <h3>Summary</h3>
	 File inclusion and remote code execution attack
	 <h3>Description</h3>
	 A flaw has been discovered where an attacker can include
	 (view and potentially execute) files on the server.
	 The vulnerability comes from a portion of code where
	 pages are redirected and loaded within phpMyAdmin, and an
	 improper test for whitelisted pages.
	 An attacker must be authenticated, except in these
	 situations:
	 <ul>
	 <li>$cfg['AllowArbitraryServer'] = true: attacker can
	 specify any host he/she is already in control of, and
	 execute arbitrary code on phpMyAdmin</li>
	 <li>$cfg['ServerDefault'] = 0: this bypasses the login and
	 runs the vulnerable code without any authentication</li>
	 </ul>
	 <h3>Severity</h3>
	 We consider this to be severe. <h3>Mitigation
	 factor</h3> Configuring PHP with a restrictive
	 `open_basedir` can greatly restrict an attacker's ability to
	 view files on the server. Vulnerable systems should not be
	 run with the phpMyAdmin directives
	 $cfg['AllowArbitraryServer'] = true or $cfg['ServerDefault']
	 = 0
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2018-3/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2018-4/</url>
 <cvename>CVE-2018-12581</cvename>
 <cvename>CVE-2018-12613</cvename>
 </references>
 <dates>
 <discovery>2018-06-21</discovery>
 <entry>2018-06-22</entry>
 </dates>
 </vuln>

<vuln vid="4e07d94f-75a5-11e8-85d1-a4badb2f4699">
 <topic>FreeBSD -- Lazy FPU State Restore Information Disclosure</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A subset of Intel processors can allow a local thread
	to infer data from another thread through a speculative
	execution side channel when Lazy FPU state restore is
	used.
	<h1>Impact:</h1>
	Any local thread can potentially read FPU state information
	from other threads running on the host. This could include
	cryptographic keys when the AES-NI CPU feature is present.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-3665</cvename>
 <freebsdsa>SA-18:07.lazyfpu</freebsdsa>
 </references>
 <dates>
 <discovery>2018-06-21</discovery>
 <entry>2018-06-21</entry>
 </dates>
 </vuln>

<vuln vid="25f73c47-68a8-4a30-9cbc-1ca5eea4d6ba">
 <topic>GraphicsMagick -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>GraphicsMagick</name>
	<range><lt>1.3.26,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GraphicsMagick reports:
	<blockquote cite="http://www.graphicsmagick.org/NEWS.html">
	 Multiple vulnerabilities have been found in GraphicsMagick 1.3.26
	 or earlier. Please refer to the CVE list for details.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.graphicsmagick.org/NEWS.html</url>
 <cvename>CVE-2016-7800</cvename>
 <cvename>CVE-2016-7996</cvename>
 <cvename>CVE-2016-7997</cvename>
 <cvename>CVE-2016-9830</cvename>
 <cvename>CVE-2017-6335</cvename>
 <cvename>CVE-2017-8350</cvename>
 <cvename>CVE-2017-10794</cvename>
 <cvename>CVE-2017-10799</cvename>
 <cvename>CVE-2017-10800</cvename>
 </references>
 <dates>
 <discovery>2017-07-04</discovery>
 <entry>2018-06-18</entry>
 </dates>
 </vuln>

<vuln vid="3a66cb69-716f-11e8-be54-3085a9a47796">
 <topic>slurm -- insecure handling of user_name and gid fields</topic>
 <affects>
 <package>
	<name>slurm-wlm</name>
	<range><lt>17.02.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SchedMD reports:
	<blockquote cite="https://lists.schedmd.com/pipermail/slurm-announce/2018/000008.html">
	 <h1>Insecure handling of user_name and gid fields (CVE-2018-10995)</h1>
	 While fixes are only available for the supported 17.02 and 17.11
	 releases, it is believed that similar vulnerabilities do affect past
	 versions as well. The only resolution is to upgrade Slurm to a fixed
	 release.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.schedmd.com/pipermail/slurm-announce/2018/000008.html</url>
 </references>
 <dates>
 <discovery>2018-05-30</discovery>
 <entry>2018-06-16</entry>
 </dates>
 </vuln>

<vuln vid="45b8e2eb-7056-11e8-8fab-63ca6e0e13a2">
 <topic>node.js -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>node6</name>
	<range><lt>6.14.3</lt></range>
 </package>
 <package>
	<name>node8</name>
	<range><lt>8.11.3</lt></range>
 </package>
 <package>
	<name>node</name>
	<range><lt>10.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/">
	 <h1>Denial of Service Vulnerability in HTTP/2 (CVE-2018-7161)</h1>
	 All versions of 8.x and later are vulnerable and the severity is
	 HIGH. An attacker can cause a denial of service (DoS) by causing a
	 node server providing an http2 server to crash. This can be
	 accomplished by interacting with the http2 server in a manner that
	 triggers a cleanup bug where objects are used in native code after
	 they are no longer available. This has been addressed by updating
	 the http2 implementation. Thanks to Jordan Zebor at F5 Networks for
	 reporting this issue.
	 <h1>Denial of Service, nghttp2 dependency (CVE-2018-1000168)</h1>
	 All versions of 9.x and later are vulnerable and the severity is
	 HIGH. Under certain conditions, a malicious client can trigger an
	 uninitialized read (and a subsequent segfault) by sending a
	 malformed ALTSVC frame. This has been addressed through an by
	 updating nghttp2.
	 <h1>Denial of Service Vulnerability in TLS (CVE-2018-7162)</h1>
	 All versions of 9.x and later are vulnerable and the severity is
	 HIGH. An attacker can cause a denial of service (DoS) by causing a
	 node process which provides an http server supporting TLS server to
	 crash. This can be accomplished by sending duplicate/unexpected
	 messages during the handshake. This vulnerability has been addressed
	 by updating the TLS implementation. Thanks to Jordan Zebor at F5
	 Networks all of his help investigating this issue with the Node.js
	 team.
	 <h1>Memory exhaustion DoS on v9.x (CVE-2018-7164)</h1>
	 Versions 9.7.0 and later are vulnerable and the severity is MEDIUM.
	 A bug introduced in 9.7.0 increases the memory consumed when reading
	 from the network into JavaScript using the net.Socket object
	 directly as a stream. An attacker could use this cause a denial of
	 service by sending tiny chunks of data in short succession. This
	 vulnerability was restored by reverting to the prior behaviour.
	 <h1>Calls to Buffer.fill() and/or Buffer.alloc() may hang (CVE-2018-7167)</h1>
	 Calling Buffer.fill() or Buffer.alloc() with some parameters can
	 lead to a hang which could result in a Denial of Service. In order
	 to address this vulnerability, the implementations of Buffer.alloc()
	 and Buffer.fill() were updated so that they zero fill instead of
	 hanging in these cases.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/</url>
 <url>https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</url>
 <cvename>CVE-2018-7161</cvename>
 <cvename>CVE-2018-7162</cvename>
 <cvename>CVE-2018-7164</cvename>
 <cvename>CVE-2018-7167</cvename>
 <cvename>CVE-2018-1000168</cvename>
 </references>
 <dates>
 <discovery>2018-06-12</discovery>
 <entry>2018-06-15</entry>
 </dates>
 </vuln>

<vuln vid="53eb9e1e-7014-11e8-8b1f-3065ec8fd3ec">
 <topic>password-store -- GPG parsing vulnerabilities</topic>
 <affects>
 <package>
	<name>password-store</name>
	<range><lt>1.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jason A. Donenfeld reports:
	<blockquote cite="https://lists.zx2c4.com/pipermail/password-store/2018-June/003308.html">
	 Markus Brinkmann discovered that [the] parsing of gpg command line
	 output with regexes isn't anchored to the beginning of the line,
	 which means an attacker can generate a malicious key that simply has
	 the verification string as part of its username.
	 This has a number of nasty consequences:
	 <ul>
	 <li>an attacker who manages to write into your ~/.password-store
	 and also inject a malicious key into your keyring can replace
	 your .gpg-id key and have your passwords encrypted under
	 additional keys;</li>
	 <li>if you have extensions enabled (disabled by default), an
	 attacker who manages to write into your ~/.password-store and
	 also inject a malicious key into your keyring can replace your
	 extensions and hence execute code.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.zx2c4.com/pipermail/password-store/2018-June/003308.html</url>
 <cvename>CVE-2018-12356</cvename>
 </references>
 <dates>
 <discovery>2018-06-14</discovery>
 <entry>2018-06-14</entry>
 </dates>
 </vuln>

<vuln vid="9b5162de-6f39-11e8-818e-e8e0b747a45a">
 <topic>libgcrypt -- side-channel attack vulnerability</topic>
 <affects>
 <package>
	<name>libgcrypt</name>
	<range><lt>1.8.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GnuPG reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495">
	 Mitigate a local side-channel attack on ECDSA signature as described in the white paper "Return on the Hidden Number Problem".
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-0495</cvename>
 <url>https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495</url>
 <url>https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.4-relnotes.txt</url>
 </references>
 <dates>
 <discovery>2018-06-13</discovery>
 <entry>2018-06-13</entry>
 <modified>2018-06-14</modified>
 </dates>
 </vuln>

<vuln vid="c82ecac5-6e3f-11e8-8777-b499baebfeaf">
 <topic>OpenSSL -- Client DoS due to large DH parameter</topic>
 <affects>
 <package>
	<name>libressl</name>
	<name>libressl-devel</name>
	<range><lt>2.6.5</lt></range>
	<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
 </package>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2o_4,1</lt></range>
 </package>
 <package>
	<name>openssl-devel</name>
	<range><lt>1.1.0h_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20180612.txt">
	 During key agreement in a TLS handshake using a DH(E) based
	 ciphersuite a malicious server can send a very large prime value
	 to the client. This will cause the client to spend an unreasonably
	 long period of time generating a key for this prime resulting in a
	 hang until the client has finished. This could be exploited in a
	 Denial Of Service attack.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20180612.txt</url>
 <cvename>CVE-2018-0732</cvename>
 </references>
 <dates>
 <discovery>2018-06-12</discovery>
 <entry>2018-06-12</entry>
 <modified>2018-07-24</modified>
 </dates>
 </vuln>

<vuln vid="0137167b-6dca-11e8-a671-001999f8d30b">
 <topic>asterisk -- PJSIP endpoint presence disclosure when using ACL</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.21.1</lt></range>
 </package>
 <package>
	<name>asterisk15</name>
	<range><lt>15.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 When endpoint specific ACL rules block a SIP request
	 they respond with a 403 forbidden. However, if an endpoint
	 is not identified then a 401 unauthorized response is
	 sent. This vulnerability just discloses which requests
	 hit a defined endpoint. The ACL rules cannot be bypassed
	 to gain access to the disclosed endpoints.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2018-008.html</url>
 </references>
 <dates>
 <discovery>2018-06-11</discovery>
 <entry>2018-06-11</entry>
 </dates>
 </vuln>

<vuln vid="f14ce57f-6dc8-11e8-a671-001999f8d30b">
 <topic>asterisk -- Infinite loop when reading iostreams</topic>
 <affects>
 <package>
	<name>asterisk15</name>
	<range><lt>15.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 When connected to Asterisk via TCP/TLS if the client
	 abruptly disconnects, or sends a specially crafted message
	 then Asterisk gets caught in an infinite loop while trying
	 to read the data stream. Thus rendering the system as
	 unusable.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2018-007.html</url>
 </references>
 <dates>
 <discovery>2018-06-11</discovery>
 <entry>2018-06-11</entry>
 </dates>
 </vuln>

<vuln vid="4cb49a23-6c89-11e8-8b33-e8e0b747a45a">
 <topic>chromium -- Incorrect handling of CSP header</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>67.0.3396.79</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-desktop.html">
	 1 security fix contributed by external researchers:
	 <ul>
	 <li>[845961] High CVE-2018-6148: Incorrect handling of CSP header. Reported by Michal Bentkowski on 2018-05-23</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6148</cvename>
 <url>https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2018-06-06</discovery>
 <entry>2018-06-10</entry>
 </dates>
 </vuln>

<vuln vid="7da0417f-6b24-11e8-84cc-002590acae31">
 <topic>gnupg -- unsanitized output (CVE-2018-12020)</topic>
 <affects>
 <package>
	<name>gnupg</name>
	<range><lt>2.2.8</lt></range>
 </package>
 <package>
	<name>gnupg1</name>
	<range><lt>1.4.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GnuPG reports:
	<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html">
	 GnuPG did not sanitize input file names, which may then be output to
	 the terminal. This could allow terminal control sequences or fake
	 status messages to be injected into the output.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12020</url>
 <cvename>CVE-2018-12020</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7526</url>
 <cvename>CVE-2017-7526</cvename>
 </references>
 <dates>
 <discovery>2018-06-07</discovery>
 <entry>2018-06-08</entry>
 </dates>
 </vuln>

<vuln vid="e3e68fe8-d9cb-4ba8-b09c-9e3a28588eb7">
 <topic>firefox -- Heap buffer overflow rasterizing paths in SVG with Skia</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>60.0.2,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.2.0.13_5</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>52.8.1,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-14/">
	 A heap buffer overflow can occur in the Skia library when
	 rasterizing paths using a maliciously crafted SVG file
	 with anti-aliasing turned off. This results in a
	 potentially exploitable crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.mozilla.org/security/advisories/mfsa2018-14/</url>
 </references>
 <dates>
 <discovery>2018-06-06</discovery>
 <entry>2018-06-08</entry>
 </dates>
 </vuln>

<vuln vid="2dde5a56-6ab1-11e8-b639-6451062f0f7a">
 <topic>Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>30.0.0.113</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-19.html">
	 <ul>
	 <li>This update resolves a type confusion vulnerability that
	 could lead to arbitrary code execution (CVE-2018-4945).</li>
	 <li>This update resolves an integer overflow vulnerability that
	 could lead to information disclosure (CVE-2018-5000).</li>
	 <li>This update resolves an out-of-bounds read vulnerability that
	 could lead to information disclosure (CVE-2018-5001).</li>
	 <li>This update resolves a stack-based buffer overflow vulnerability that
	 could lead to arbitrary code execution (CVE-2018-5002).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-4945</cvename>
 <cvename>CVE-2018-5000</cvename>
 <cvename>CVE-2018-5001</cvename>
 <cvename>CVE-2018-5002</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb18-19.html</url>
 </references>
 <dates>
 <discovery>2018-06-07</discovery>
 <entry>2018-06-07</entry>
 <modified>2018-07-11</modified>
 </dates>
 </vuln>

<vuln vid="2f4fd3aa-32f8-4116-92f2-68f05398348e">
 <topic>bro -- multiple memory allocation issues</topic>
 <affects>
 <package>
	<name>bro</name>
	<range><lt>2.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Corelight reports:
	<blockquote cite="https://www.bro.org/download/NEWS.bro.html">
	 Bro 2.5.4 primarily fixes security issues
	 Multiple fixes and improvements to BinPAC generated code related to array parsing, with potential impact to all Bro's BinPAC-generated analyzers in the form of buffer over-reads or other invalid memory accesses depending on whether a particular analyzer incorrectly assumed that the evaulated-array-length expression is actually the number of elements that were parsed out from the input.
	 The NCP analyzer (not enabled by default and also updated to actually work with newer Bro APIs in the release) performed a memory allocation based directly on a field in the input packet and using signed integer storage. This could result in a signed integer overflow and memory allocations of negative or very large size, leading to a crash or memory exhaustion. The new NCP::max_frame_size tuning option now limits the maximum amount of memory that can be allocated.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.bro.org/download/NEWS.bro.html</url>
 </references>
 <dates>
 <discovery>2018-05-29</discovery>
 <entry>2018-06-06</entry>
 </dates>
 </vuln>

<vuln vid="5a1589ad-68f9-11e8-83f5-d8cb8abf62dd">
 <topic>Libgit2 -- Fixing insufficient validation of submodule names</topic>
 <affects>
 <package>
	<name>libgit2</name>
	<name>py-pygit2</name>
	<range><lt>0.27.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Git community reports:
	<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.27.1">
	 Insufficient validation of submodule names
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/libgit2/libgit2/releases/tag/v0.27.1</url>
 <cvename>CVE-2018-11235</cvename>
 </references>
 <dates>
 <discovery>2018-05-29</discovery>
 <entry>2018-06-05</entry>
 </dates>
 </vuln>

<vuln vid="c7a135f4-66a4-11e8-9e63-3085a9a47796">
 <topic>Git -- Fix memory out-of-bounds and remote code execution vulnerabilities (CVE-2018-11233 and CVE-2018-11235)</topic>
 <affects>
 <package>
	<name>git</name>
	<name>git-lite</name>
	<range><lt>2.13.7</lt></range>
	<range><ge>2.14</ge><lt>2.14.4</lt></range>
	<range><ge>2.15</ge><lt>2.15.2</lt></range>
	<range><ge>2.16</ge><lt>2.16.4</lt></range>
	<range><ge>2.17</ge><lt>2.17.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Git community reports:
	<blockquote cite="https://marc.info/?l=git&amp;m=152761328506724&amp;=2">
	 <ul><li>In affected versions of Git, code to sanity-check pathnames on
	 NTFS can result in reading out-of-bounds memory.</li>
	 <li>In affected versions of Git, remote code execution can
	 occur. With a crafted .gitmodules file, a malicious project can
	 execute an arbitrary script on a machine that runs "git clone
	 --recurse-submodules" because submodule "names" are obtained from
	 this file, and then appended to $GIT_DIR/modules, leading to
	 directory traversal with "../" in a name. Finally, post-checkout
	 hooks from a submodule are executed, bypassing the intended design
	 in which hooks are not obtained from a remote server.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11233</url>
 <cvename>CVE-2018-11233</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11235</url>
 <cvename>CVE-2018-11235</cvename>
 </references>
 <dates>
 <discovery>2018-05-29</discovery>
 <entry>2018-06-02</entry>
 </dates>
 </vuln>

<vuln vid="9557dc72-64da-11e8-bc32-d8cb8abf62dd">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab</name>
	<range><ge>10.8.0</ge><lt>10.8.2</lt></range>
	<range><ge>10.7.0</ge><lt>10.7.5</lt></range>
	<range><ge>1.0</ge><lt>10.6.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab reports:
	<blockquote cite="https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/">
	 Removing public deploy keys regression
	 Users can update their password without entering current password
	 Persistent XSS - Selecting users as allowed merge request approvers
	 Persistent XSS - Multiple locations of user selection drop downs
	 include directive in .gitlab-ci.yml allows SSRF requests
	 Permissions issue in Merge Requests Create Service
	 Arbitrary assignment of project fields using "Import project"
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/</url>
 </references>
 <dates>
 <discovery>2018-05-29</discovery>
 <entry>2018-05-31</entry>
 </dates>
 </vuln>

<vuln vid="7fc3e827-64a5-11e8-aedb-00224d821998">
 <topic>strongswan -- Fix Denial-of-Service Vulnerability strongSwan (CVE-2018-10811, CVE-2018-5388)</topic>
 <affects>
 <package>
	<name>strongswan</name>
	<range><lt>5.6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	strongSwan security team reports:
	<blockquote cite="https://www.strongswan.org/blog/2018/05/28/strongswan-5.6.3-released.html">
	 <ul><li>A denial-of-service vulnerability in the IKEv2 key derivation was fixed
	 if the openssl plugin is used in FIPS mode and HMAC-MD5 is negotiated as
	 PRF (which is not FIPS-compliant). So this should only affect very specific setups,
	 but in such configurations all strongSwan versions since 5.0.1 may be affected.</li>
	 <li>A denial-of-service vulnerability in the stroke plugin was fixed.
		 When reading a message from the socket the plugin did not check the received length.
		 Unless a group is configured, root privileges are required to access that socket,
		 so in the default configuration this shouldn't be an issue, but all strongSwan versions may be affected.
	 </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.strongswan.org/blog/2018/05/28/strongswan-vulnerability-(cve-2018-10811).html</url>
 <cvename>CVE-2018-10811</cvename>
 <url>https://www.strongswan.org/blog/2018/05/28/strongswan-vulnerability-(cve-2018-5388).html</url>
 <cvename>CVE-2018-5388</cvename>
 </references>
 <dates>
 <discovery>2018-05-16</discovery>
 <entry>2018-05-31</entry>
 </dates>
 </vuln>

<vuln vid="427b0f58-644c-11e8-9e1b-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>67.0.3396.62</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html">
	 34 security fixes in this release, including:
	 <ul>
	 <li>[835639] High CVE-2018-6123: Use after free in Blink. Reported by Looben Yang on 2018-04-22</li>
	 <li>[840320] High CVE-2018-6124: Type confusion in Blink. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-07</li>
	 <li>[818592] High CVE-2018-6125: Overly permissive policy in WebUSB. Reported by Yubico, Inc on 2018-03-05</li>
	 <li>[844457] High CVE-2018-6126: Heap buffer overflow in Skia. Reported by Ivan Fratric of Google Project Zero on 2018-05-18</li>
	 <li>[842990] High CVE-2018-6127: Use after free in indexedDB. Reported by Looben Yang on 2018-05-15</li>
	 <li>[841105] High CVE-2018-6128: uXSS in Chrome on iOS. Reported by Tomasz Bojarski on 2018-05-09</li>
	 <li>[838672] High CVE-2018-6129: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-01</li>
	 <li>[838402] High CVE-2018-6130: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-04-30</li>
	 <li>[826434] High CVE-2018-6131: Incorrect mutability protection in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-27</li>
	 <li>[839960] Medium CVE-2018-6132: Use of uninitialized memory in WebRTC. Reported by Ronald E. Crane on 2018-05-04</li>
	 <li>[817247] Medium CVE-2018-6133: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-28</li>
	 <li>[797465] Medium CVE-2018-6134: Referrer Policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-12-23</li>
	 <li>[823353] Medium CVE-2018-6135: UI spoofing in Blink. Reported by Jasper Rebane on 2018-03-19</li>
	 <li>[831943] Medium CVE-2018-6136: Out of bounds memory access in V8. Reported by Peter Wong on 2018-04-12</li>
	 <li>[835589] Medium CVE-2018-6137: Leak of visited status of page in Blink. Reported by Michael Smith (spinda.net) on 2018-04-21</li>
	 <li>[810220] Medium CVE-2018-6138: Overly permissive policy in Extensions. Reported by Francois Lajeunesse-Robert on 2018-02-08</li>
	 <li>[805224] Medium CVE-2018-6139: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-24</li>
	 <li>[798222] Medium CVE-2018-6140: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-01</li>
	 <li>[796107] Medium CVE-2018-6141: Heap buffer overflow in Skia. Reported by Yangkang (@dnpushme) and Wanglu of Qihoo360 Qex Team on 2017-12-19</li>
	 <li>[837939] Medium CVE-2018-6142: Out of bounds memory access in V8. Reported by Choongwoo Han of Naver Corporation on 2018-04-28</li>
	 <li>[843022] Medium CVE-2018-6143: Out of bounds memory access in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-15</li>
	 <li>[828049] Low CVE-2018-6144: Out of bounds memory access in PDFium. Reported by pdknsk on 2018-04-02</li>
	 <li>[805924] Low CVE-2018-6145: Incorrect escaping of MathML in Blink. Reported by Masato Kinugawa on 2018-01-25</li>
	 <li>[818133] Low CVE-2018-6147: Password fields not taking advantage of OS protections in Views. Reported by Michail Pishchagin (Yandex) on 2018-03-02</li>
	 <li>[847542] Various fixes from internal audits, fuzzing and other initiatives</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6123</cvename>
 <cvename>CVE-2018-6124</cvename>
 <cvename>CVE-2018-6125</cvename>
 <cvename>CVE-2018-6126</cvename>
 <cvename>CVE-2018-6127</cvename>
 <cvename>CVE-2018-6128</cvename>
 <cvename>CVE-2018-6129</cvename>
 <cvename>CVE-2018-6130</cvename>
 <cvename>CVE-2018-6131</cvename>
 <cvename>CVE-2018-6132</cvename>
 <cvename>CVE-2018-6133</cvename>
 <cvename>CVE-2018-6134</cvename>
 <cvename>CVE-2018-6135</cvename>
 <cvename>CVE-2018-6136</cvename>
 <cvename>CVE-2018-6137</cvename>
 <cvename>CVE-2018-6138</cvename>
 <cvename>CVE-2018-6139</cvename>
 <cvename>CVE-2018-6140</cvename>
 <cvename>CVE-2018-6141</cvename>
 <cvename>CVE-2018-6142</cvename>
 <cvename>CVE-2018-6143</cvename>
 <cvename>CVE-2018-6144</cvename>
 <cvename>CVE-2018-6145</cvename>
 <cvename>CVE-2018-6147</cvename>
 <url>https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html</url>
 </references>
 <dates>
 <discovery>2018-05-29</discovery>
 <entry>2018-05-30</entry>
 </dates>
 </vuln>

<vuln vid="94599fe0-5ca3-11e8-8be1-d05099c0ae8c">
 <topic>BIND -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bind912</name>
	<range><lt>9.12.1P2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01602">
	 An error in zone database reference counting can
	 lead to an assertion failure if a server which is
	 running an affected version of BIND attempts
	 several transfers of a slave zone in quick
	 succession.
	</blockquote>
	<blockquote cite="https://kb.isc.org/article/AA-01606">
	 A problem with the implementation of the new
	 serve-stale feature in BIND 9.12 can lead to
	 an assertion failure in rbtdb.c, even when
	 stale-answer-enable is off. Additionally,
	 problematic interaction between the serve-stale
	 feature and NSEC aggressive negative caching can
	 in some cases cause undesirable behavior from named,
	 such as a recursion loop or excessive logging.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-5736</cvename>
 <cvename>CVE-2018-5737</cvename>
 <url>https://kb.isc.org/article/AA-01602</url>
 <url>https://kb.isc.org/article/AA-01606</url>
 </references>
 <dates>
 <discovery>2018-05-18</discovery>
 <entry>2018-05-21</entry>
 </dates>
 </vuln>

<vuln vid="04fe6c8d-2a34-4009-a81e-e7a7e759b5d2">
 <topic>cURL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>7.60.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cURL security problems:
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	 CVE-2018-1000300: FTP shutdown response buffer overflow
	 curl might overflow a heap based memory buffer when closing down an
	 FTP connection with very long server command replies.
	 When doing FTP transfers, curl keeps a spare "closure handle" around
	 internally that will be used when an FTP connection gets shut down
	 since the original curl easy handle is then already removed.
	 FTP server response data that gets cached from the original transfer
	 might then be larger than the default buffer size (16 KB) allocated in
	 the "closure handle", which can lead to a buffer overwrite. The
	 contents and size of that overwrite is controllable by the server.
	 This situation was detected by an assert() in the code, but that was
	 of course only preventing bad stuff in debug builds. This bug is very
	 unlikely to trigger with non-malicious servers.
	 We are not aware of any exploit of this flaw.
	 CVE-2018-1000301: RTSP bad headers buffer over-read
	 curl can be tricked into reading data beyond the end of a heap based
	 buffer used to store downloaded content.
	 When servers send RTSP responses back to curl, the data starts out
	 with a set of headers. curl parses that data to separate it into a
	 number of headers to deal with those appropriately and to find the end
	 of the headers that signal the start of the "body" part.
	 The function that splits up the response into headers is called
	 Curl_http_readwrite_headers() and in situations where it can't find a
	 single header in the buffer, it might end up leaving a pointer pointing
	 into the buffer instead of to the start of the buffer which then later
	 on may lead to an out of buffer read when code assumes that pointer
	 points to a full buffer size worth of memory to use.
	 This could potentially lead to information leakage but most likely a
	 crash/denial of service for applications if a server triggers this flaw.
	 We are not aware of any exploit of this flaw.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/security.html</url>
 <url>https://curl.haxx.se/docs/adv_2018-82c2.html</url>
 <url>https://curl.haxx.se/docs/adv_2018-b138.html</url>
 <cvename>CVE-2018-1000300</cvename>
 <cvename>CVE-2018-1000301</cvename>
 </references>
 <dates>
 <discovery>2018-05-16</discovery>
 <entry>2018-05-16</entry>
 </dates>
 </vuln>

<vuln vid="50210bc1-54ef-11e8-95d9-9c5c8e75236a">
 <topic>wavpack -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wavpack</name>
	<range><lt>5.1.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sebastian Ramacher reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6767">
	 A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7253">
	 The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7254">
	 The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.
	</blockquote>
	Thuan Pham reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10536">
	 An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10537">
	 An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10538">
	 An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10539">
	 An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10540">
	 An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6767</cvename>
 <cvename>CVE-2018-7253</cvename>
 <cvename>CVE-2018-7254</cvename>
 <cvename>CVE-2018-10536</cvename>
 <cvename>CVE-2018-10537</cvename>
 <cvename>CVE-2018-10538</cvename>
 <cvename>CVE-2018-10539</cvename>
 <cvename>CVE-2018-10540</cvename>
 <url>https://www.debian.org/security/2018/dsa-4125</url>
 <url>https://www.debian.org/security/2018/dsa-4197</url>
 <freebsdpr>228141</freebsdpr>
 </references>
 <dates>
 <discovery>2018-05-09</discovery>
 <entry>2018-05-11</entry>
 </dates>
 </vuln>

<vuln vid="e457978b-5484-11e8-9b85-54ee754af08e">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>66.0.3359.170</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Google Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html">
 4 security fixes in this release:
 <ul>
	 <li>[835887] Critical: Chain leading to sandbox escape.
	 Reported by Anonymous on 2018-04-23</li>
	 <li>[836858] High CVE-2018-6121: Privilege Escalation in extensions</li>
	 <li>[836141] High CVE-2018-6122: Type confusion in V8</li>
	 <li>[833721] High CVE-2018-6120: Heap buffer overflow in PDFium.
	 Reported by Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team on 2018-04-17</li>
	 <li>[841841] Various fixes from internal audits, fuzzing and other initiatives</li>
 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6120</cvename>
 <cvename>CVE-2018-6121</cvename>
 <cvename>CVE-2018-6122</cvename>
 <url>https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2018-04-14</discovery>
 <entry>2018-05-11</entry>
 </dates>
 </vuln>

<vuln vid="06ab7724-0fd7-427e-a5ce-fe436302b10c">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><le>2.120</le></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><le>2.107.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins developers report:
	<blockquote cite="https://jenkins.io/security/advisory/2018-05-09/">
	 The agent to master security subsystem ensures that the Jenkins
	 master is protected from maliciously configured agents. A path
	 traversal vulnerability allowed agents to escape whitelisted
	 directories to read and write to files they should not be able to
	 access.
	 Black Duck Hub Plugin's API endpoint was affected by an XML
	 External Entity (XXE) processing vulnerability. This allowed an
	 attacker with Overall/Read access to have Jenkins parse a maliciously
	 crafted file that uses external entities for extraction of secrets
	 from the Jenkins master, server-side request forgery, or
	 denial-of-service attacks.
	 Several other lower severity issues were reported, see reference
	 url for details.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://jenkins.io/security/advisory/2018-05-09/</url>
 </references>
 <dates>
 <discovery>2018-05-09</discovery>
 <entry>2018-05-10</entry>
 </dates>
 </vuln>

<vuln vid="5aefc41e-d304-4ec8-8c82-824f84f08244">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>60.0,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.1.0_18</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.4</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>52.8.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>52.8.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.8.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/">
	 CVE-2018-5183: Backport critical security fixes in Skia
	 CVE-2018-5154: Use-after-free with SVG animations and clip paths
	 CVE-2018-5155: Use-after-free with SVG animations and text paths
	 CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files
	 CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer
	 CVE-2018-5159: Integer overflow and out-of-bounds write in Skia
	 CVE-2018-5160: Uninitialized memory use by WebRTC encoder
	 CVE-2018-5152: WebExtensions information leak through webRequest API
	 CVE-2018-5153: Out-of-bounds read in mixed content websocket messages
	 CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache
	 CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace
	 CVE-2018-5166: WebExtension host permission bypass through filterReponseData
	 CVE-2018-5167: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger
	 CVE-2018-5168: Lightweight themes can be installed without user interaction
	 CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages
	 CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer
	 CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters
	 CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update
	 CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies
	 CVE-2018-5176: JSON Viewer script injection
	 CVE-2018-5177: Buffer overflow in XSLT during number formatting
	 CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox
	 CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension
	 CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced
	 CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink
	 CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar
	 CVE-2018-5151: Memory safety bugs fixed in Firefox 60
	 CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-5150</cvename>
 <cvename>CVE-2018-5151</cvename>
 <cvename>CVE-2018-5152</cvename>
 <cvename>CVE-2018-5153</cvename>
 <cvename>CVE-2018-5154</cvename>
 <cvename>CVE-2018-5155</cvename>
 <cvename>CVE-2018-5157</cvename>
 <cvename>CVE-2018-5158</cvename>
 <cvename>CVE-2018-5159</cvename>
 <cvename>CVE-2018-5160</cvename>
 <cvename>CVE-2018-5163</cvename>
 <cvename>CVE-2018-5164</cvename>
 <cvename>CVE-2018-5165</cvename>
 <cvename>CVE-2018-5166</cvename>
 <cvename>CVE-2018-5167</cvename>
 <cvename>CVE-2018-5168</cvename>
 <cvename>CVE-2018-5169</cvename>
 <cvename>CVE-2018-5172</cvename>
 <cvename>CVE-2018-5173</cvename>
 <cvename>CVE-2018-5174</cvename>
 <cvename>CVE-2018-5175</cvename>
 <cvename>CVE-2018-5176</cvename>
 <cvename>CVE-2018-5177</cvename>
 <cvename>CVE-2018-5178</cvename>
 <cvename>CVE-2018-5180</cvename>
 <cvename>CVE-2018-5181</cvename>
 <cvename>CVE-2018-5182</cvename>
 <cvename>CVE-2018-5183</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2018-11/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2018-12/</url>
 </references>
 <dates>
 <discovery>2018-05-09</discovery>
 <entry>2018-05-09</entry>
 </dates>
 </vuln>

<vuln vid="5af6378b-bd88-4997-bccc-b9ba2daecdd2">
 <topic>kamailio - buffer overflow</topic>
 <affects>
 <package>
	<name>kamailio</name>
	<range><lt>5.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A specially crafted REGISTER message with a malformed branch or
	 From tag triggers an off-by-one heap-based buffer overflow in the
	 tmx_check_pretran function in modules/tmx/tmx_pretran.c
 </body>
 </description>
 <references>
 <cvename>CVE-2018-8828</cvename>
 <url>https://www.kamailio.org/w/2018/03/kamailio-security-announcement-tmx-lcr/</url>
 <url>https://github.com/EnableSecurity/advisories/tree/master/ES2018-05-kamailio-heap-overflow</url>
 </references>
 <dates>
 <discovery>2018-02-10</discovery>
 <entry>2018-05-06</entry>
 </dates>
 </vuln>

<vuln vid="7b5a8e3b-52cc-11e8-8c7a-9c5c8e75236a">
 <topic>wget -- cookie injection vulnerability</topic>
 <affects>
 <package>
	<name>wget</name>
	<range><lt>1.19.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Harry Sintonen of F-Secure Corporation reports:
	<blockquote cite="https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt">
	 GNU Wget is susceptible to a malicious web server injecting arbitrary cookies to the cookie jar file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt</url>
 <cvename>CVE-2018-0494</cvename>
 <freebsdpr>ports/228071</freebsdpr>
 </references>
 <dates>
 <discovery>2018-04-26</discovery>
 <entry>2018-05-08</entry>
 </dates>
 </vuln>

<vuln vid="9558d49c-534c-11e8-8177-d43d7ef03aa6">
 <topic>Flash Player -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>29.0.0.171</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-16.html">
	 <ul>
	 <li>This update resolves a type confusion vulnerability that
	 could lead to arbitrary code execution (CVE-2018-4944).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-4944</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb18-16.html</url>
 </references>
 <dates>
 <discovery>2018-05-08</discovery>
 <entry>2018-05-09</entry>
 </dates>
 </vuln>

<vuln vid="521ce804-52fd-11e8-9123-a4badb2f4699">
 <topic>FreeBSD -- Mishandling of x86 debug exceptions</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_10</lt></range>
	<range><ge>10.4</ge><lt>10.4_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The MOV SS and POP SS instructions inhibit debug exceptions
	until the instruction boundary following the next instruction.
	If that instruction is a system call or similar instruction
	that transfers control to the operating system, the debug
	exception will be handled in the kernel context instead of
	the user context.
	<h1>Impact:</h1>
	An authenticated local attacker may be able to read
	sensitive data in kernel memory, control low-level operating
	system functions, or may panic the system.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-8897</cvename>
 <freebsdsa>SA-18:06.debugreg</freebsdsa>
 </references>
 <dates>
 <discovery>2018-05-08</discovery>
 <entry>2018-05-08</entry>
 </dates>
 </vuln>

<vuln vid="8719b935-8bae-41ad-92ba-3c826f651219">
 <topic>python 2.7 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python27</name>
	<range><lt>2.7.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	python release notes:
	<blockquote cite="https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15rc1.rst">
	 Multiple vulnerabilities has been fixed in this release. Please refer to the CVE list for details.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15rc1.rst</url>
 <url>https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15.rst</url>
 <cvename>CVE-2012-0876</cvename>
 <cvename>CVE-2016-0718</cvename>
 <cvename>CVE-2016-4472</cvename>
 <cvename>CVE-2016-9063</cvename>
 <cvename>CVE-2017-9233</cvename>
 <cvename>CVE-2018-1060</cvename>
 <cvename>CVE-2018-1061</cvename>
 </references>
 <dates>
 <discovery>2018-05-01</discovery>
 <entry>2018-05-05</entry>
 </dates>
 </vuln>

<vuln vid="83a548b5-4fa5-11e8-9a8e-001e2a3f778d">
 <topic>KWallet-PAM -- Access to privileged files</topic>
 <affects>
 <package>
	<name>plasma5-kwallet-pam</name>
	<range><lt>5.12.5_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The KDE Community reports:
	<blockquote cite="https://www.kde.org/info/security/advisory-20180503-1.txt">
	 
	 kwallet-pam was doing file writing and permission changing
	 as root that with correct timing and use of carefully
	 crafted symbolic links could allow a non privileged user
	 to become the owner of any file on the system.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.kde.org/info/security/advisory-20180503-1.txt</url>
 </references>
 <dates>
 <discovery>2018-05-04</discovery>
 <entry>2018-05-04</entry>
 </dates>
 </vuln>

<vuln vid="89ca6f7d-4f00-11e8-9b1d-00e04c1ea73d">
 <topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.58</lt></range>
 </package>
 <package>
	<name>drupal8</name>
	<range><lt>8.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/SA-CORE-2018-004">
	 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x.
	 This potentially allows attackers to exploit multiple attack vectors on a Drupal site,
	 which could result in the site being compromised. This vulnerability is related to
	 Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002.
	 Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/SA-CORE-2018-004</url>
 </references>
 <dates>
 <discovery>2018-04-25</discovery>
 <entry>2018-05-03</entry>
 </dates>
 </vuln>

<vuln vid="9dfe61c8-4d15-11e8-8f2f-d8cb8abf62dd">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab</name>
	<range><ge>10.7.0</ge><lt>10.7.2</lt></range>
	<range><ge>10.6.0</ge><lt>10.6.5</lt></range>
	<range><ge>9.5.0</ge><lt>10.5.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab reports:
	<blockquote cite="https://about.gitlab.com/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released">
	 Persistent XSS in Move Issue using project namespace
	 Download Archive allowing unauthorized private repo access
	 Mattermost Updates
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-10379</cvename>
 <url>https://about.gitlab.com/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released</url>
 </references>
 <dates>
 <discovery>2018-04-30</discovery>
 <entry>2018-05-01</entry>
 </dates>
 </vuln>

<vuln vid="006bee4e-4c49-11e8-9c32-54ee754af08e">
 <topic>chromium -- vulnerability</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>66.0.3359.139</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Google Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop_26.html">
 3 security fixes in this release:
 <ul>
	 <li>[831963] Critical CVE-2018-6118: Use after free in Media Cache. Reported by Ned Williamson on 2018-04-12</li>
	<li>[837635] Various fixes from internal audits, fuzzing and other initiatives</li>
 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6118</cvename>
 <url>https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop_26.html</url>
 </references>
 <dates>
 <discovery>2018-04-12</discovery>
 <entry>2018-04-30</entry>
 </dates>
 </vuln>

<vuln vid="499f6b41-58db-4f98-b8e7-da8c18985eda">
 <topic>quassel -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>quassel</name>
	<range><lt>0.12.5</lt></range>
 </package>
 <package>
	<name>quassel-core</name>
	<range><lt>0.12.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gentoo reports:
	<blockquote cite="https://bugs.gentoo.org/653834">
	 quasselcore: corruption of heap metadata caused by qdatastream
	 leading to preauth remote code execution.
	 <ul>
	 <li>Severity: high, by default the server port is publicly open
		and the address can be requested using the /WHOIS command of IRC
		protocol.</li>
	 <li>Description: In Qdatastream protocol each object is prepended
		with 4 bytes for the object size, this can be used to trigger
		allocation errors.</li>
	 </ul>
	 quasselcore DDOS
	 <ul>
	 <li>Severity: low, only impacts unconfigured quasselcore
		instances.</li>
	 <li>Description: A login attempt causes a NULL pointer dereference
		when the database is not initialized.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.gentoo.org/653834</url>
 <url>https://github.com/quassel/quassel/commit/08bace4e9ecf08273f094c0c6aa8b3363d38ac3e</url>
 <url>https://github.com/quassel/quassel/commit/18389a713a6810f57ab237b945e8ee03df857b8b</url>
 </references>
 <dates>
 <discovery>2018-04-24</discovery>
 <entry>2018-04-26</entry>
 </dates>
 </vuln>

<vuln vid="36ff7a74-47b1-11e8-a7d6-54e1ad544088">
 <topic>chromium -- vulnerability</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>66.0.3359.117</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html">
	 62 security fixes in this release:
	 <ul>
	 <li>[826626] Critical CVE-2018-6085: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-28</li>
	 <li>[827492] Critical CVE-2018-6086: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-30</li>
	 <li>[813876] High CVE-2018-6087: Use after free in WebAssembly. Reported by Anonymous on 2018-02-20</li>
	 <li>[822091] High CVE-2018-6088: Use after free in PDFium. Reported by Anonymous on 2018-03-15</li>
	 <li>[808838] High CVE-2018-6089: Same origin policy bypass in Service Worker. Reported by Rob Wu on 2018-02-04</li>
	 <li>[820913] High CVE-2018-6090: Heap buffer overflow in Skia. Reported by ZhanJia Song on 2018-03-12</li>
	 <li>[771933] High CVE-2018-6091: Incorrect handling of plug-ins by Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-10-05</li>
	 <li>[819869] High CVE-2018-6092: Integer overflow in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-08</li>
	 <li>[780435] Medium CVE-2018-6093: Same origin bypass in Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-01</li>
	 <li>[633030] Medium CVE-2018-6094: Exploit hardening regression in Oilpan. Reported by Chris Rohlf on 2016-08-01</li>
	 <li>[637098] Medium CVE-2018-6095: Lack of meaningful user interaction requirement before file upload. Reported by Abdulrahman Alqabandi (@qab) on 2016-08-11</li>
	 <li>[776418] Medium CVE-2018-6096: Fullscreen UI spoof. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-19</li>
	 <li>[806162] Medium CVE-2018-6097: Fullscreen UI spoof. Reported by xisigr of Tencent's Xuanwu Lab on 2018-01-26</li>
	 <li>[798892] Medium CVE-2018-6098: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-03</li>
	 <li>[808825] Medium CVE-2018-6099: CORS bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-02-03</li>
	 <li>[811117] Medium CVE-2018-6100: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-02-11</li>
	 <li>[813540] Medium CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools . Reported by Rob Wu on 2018-02-19</li>
	 <li>[813814] Medium CVE-2018-6102: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-20</li>
	 <li>[816033] Medium CVE-2018-6103: UI spoof in Permissions. Reported by Khalil Zhani on 2018-02-24</li>
	 <li>[820068] Medium CVE-2018-6104: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-08</li>
	 <li>[803571] Medium CVE-2018-6105: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-18</li>
	 <li>[805729] Medium CVE-2018-6106: Incorrect handling of promises in V8. Reported by lokihardt of Google Project Zero on 2018-01-25</li>
	 <li>[808316] Medium CVE-2018-6107: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-02</li>
	 <li>[816769] Medium CVE-2018-6108: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-27</li>
	 <li>[710190] Low CVE-2018-6109: Incorrect handling of files by FileAPI. Reported by Dominik Weber (@DoWeb_) on 2017-04-10</li>
	 <li>[777737] Low CVE-2018-6110: Incorrect handling of plaintext files via file:// . Reported by Wenxiang Qian (aka blastxiang) on 2017-10-24</li>
	 <li>[780694] Low CVE-2018-6111: Heap-use-after-free in DevTools. Reported by Khalil Zhani on 2017-11-02</li>
	 <li>[798096] Low CVE-2018-6112: Incorrect URL handling in DevTools. Reported by Rob Wu on 2017-12-29</li>
	 <li>[805900] Low CVE-2018-6113: URL spoof in Navigation. Reported by Khalil Zhani on 2018-01-25</li>
	 <li>[811691] Low CVE-2018-6114: CSP bypass. Reported by Lnyas Zhang on 2018-02-13</li>
	 <li>[819809] Low CVE-2018-6115: SmartScreen bypass in downloads. Reported by James Feher on 2018-03-07</li>
	 <li>[822266] Low CVE-2018-6116: Incorrect low memory handling in WebAssembly. Reported by Jin from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. on 2018-03-15</li>
	 <li>[822465] Low CVE-2018-6117: Confusing autofill settings. Reported by Spencer Dailey on 2018-03-15</li>
	 <li>[822424] Low CVE-2018-6084: Incorrect use of Distributed Objects in Google Software Updater on MacOS. Reported by Ian Beer of Google Project Zero on 2018-03-15</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html</url>
 <cvename>CVE-2018-6085</cvename>
 <cvename>CVE-2018-6086</cvename>
 <cvename>CVE-2018-6087</cvename>
 <cvename>CVE-2018-6088</cvename>
 <cvename>CVE-2018-6089</cvename>
 <cvename>CVE-2018-6090</cvename>
 <cvename>CVE-2018-6091</cvename>
 <cvename>CVE-2018-6092</cvename>
 <cvename>CVE-2018-6093</cvename>
 <cvename>CVE-2018-6094</cvename>
 <cvename>CVE-2018-6095</cvename>
 <cvename>CVE-2018-6096</cvename>
 <cvename>CVE-2018-6097</cvename>
 <cvename>CVE-2018-6098</cvename>
 <cvename>CVE-2018-6099</cvename>
 <cvename>CVE-2018-6100</cvename>
 <cvename>CVE-2018-6101</cvename>
 <cvename>CVE-2018-6102</cvename>
 <cvename>CVE-2018-6103</cvename>
 <cvename>CVE-2018-6104</cvename>
 <cvename>CVE-2018-6105</cvename>
 <cvename>CVE-2018-6106</cvename>
 <cvename>CVE-2018-6107</cvename>
 <cvename>CVE-2018-6108</cvename>
 <cvename>CVE-2018-6109</cvename>
 <cvename>CVE-2018-6110</cvename>
 <cvename>CVE-2018-6111</cvename>
 <cvename>CVE-2018-6112</cvename>
 <cvename>CVE-2018-6113</cvename>
 <cvename>CVE-2018-6114</cvename>
 <cvename>CVE-2018-6115</cvename>
 <cvename>CVE-2018-6116</cvename>
 <cvename>CVE-2018-6117</cvename>
 <cvename>CVE-2018-6084</cvename>
 </references>
 <dates>
 <discovery>2017-04-10</discovery>
 <entry>2018-04-24</entry>
 </dates>
 </vuln>

<vuln vid="d8382a69-4728-11e8-ba83-0011d823eebd">
 <topic>mbed TLS (PolarSSL) -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mbedtls</name>
	<range><lt>2.7.2</lt></range>
 </package>
 <package>
	<name>polarssl13</name>
	<range><ge>*</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Butcher reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.11-released">
	 <ul>
	 <li>Defend against Bellcore glitch attacks by verifying the results
	 of RSA private key operations.</li>
	 <li>Fix implementation of the truncated HMAC extension. The
	 previous implementation allowed an offline 2^80 brute force
	 attack on the HMAC key of a single, uninterrupted connection
	 (with no resumption of the session).</li>
	 <li>Reject CRLs containing unsupported critical extensions. Found
	 by Falko Strenzke and Evangelos Karatsiolis.</li>
	 <li>Fix a buffer overread in ssl_parse_server_key_exchange() that
	 could cause a crash on invalid input.</li>
	 <li>Fix a buffer overread in ssl_parse_server_psk_hint() that could
	 cause a crash on invalid input.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.11-released</url>
 </references>
 <dates>
 <discovery>2018-03-21</discovery>
 <entry>2018-04-23</entry>
 </dates>
 </vuln>

<vuln vid="57aec168-453e-11e8-8777-b499baebfeaf">
 <topic>MySQL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb55-server</name>
	<range><lt>5.5.60</lt></range>
 </package>
 <package>
	<name>mariadb100-server</name>
	<range><lt>10.0.35</lt></range>
 </package>
 <package>
	<name>mariadb101-server</name>
	<range><lt>10.1.33</lt></range>
 </package>
 <package>
	<name>mariadb102-server</name>
	<range><lt>10.2.15</lt></range>
 </package>
 <package>
	<name>mysql55-server</name>
	<range><lt>5.5.60</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.40</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.22</lt></range>
 </package>
 <package>
	<name>percona55-server</name>
	<range><lt>5.5.60</lt></range>
 </package>
 <package>
	<name>percona56-server</name>
	<range><lt>5.6.40</lt></range>
 </package>
 <package>
	<name>percona57-server</name>
	<range><lt>5.7.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html">
	 MySQL Multiple Flaws Let Remote Authenticated Users Access and
	 Modify Data, Remote and Local Users Deny Service, and Local Users
	 Access Data and Gain Elevated Privileges
	 <ul>
	 <li>A local user can exploit a flaw in the Replication component
	 to gain elevated privileges [CVE-2018-2755].</li>
	 <li>A remote authenticated user can exploit a flaw in the GIS
	 Extension component to cause denial of service conditions
	 [CVE-2018-2805].</li>
	 <li>A remote authenticated user can exploit a flaw in the InnoDB
	 component to cause denial of service conditions [CVE-2018-2782,
	 CVE-2018-2784, CVE-2018-2819].</li>
	 <li>A remote authenticated user can exploit a flaw in the Security
	 Privileges component to cause denial of service conditions
	 [CVE-2018-2758, CVE-2018-2818].</li>
	 <li>A remote authenticated user can exploit a flaw in the DDL
	 component to cause denial of service conditions
	 [CVE-2018-2817].</li>
	 <li>A remote authenticated user can exploit a flaw in the Optimizer
	 component to cause denial of service conditions [CVE-2018-2775,
	 CVE-2018-2778, CVE-2018-2779, CVE-2018-2780, CVE-2018-2781,
	 CVE-2018-2816].</li>
	 <li>A remote user can exploit a flaw in the Client programs
	 component to cause denial of service conditions [CVE-2018-2761,
	 CVE-2018-2773].</li>
	 <li>A remote authenticated user can exploit a flaw in the InnoDB
	 component to partially modify data and cause denial of service
	 conditions [CVE-2018-2786, CVE-2018-2787].</li>
	 <li>A remote authenticated user can exploit a flaw in the Optimizer
	 component to partially modify data and cause denial of service
	 conditions [CVE-2018-2812].</li>
	 <li>A local user can exploit a flaw in the Cluster ndbcluster/plugin
	 component to cause denial of service conditions [CVE-2018-2877].
	 </li>
	 <li>A remote authenticated user can exploit a flaw in the InnoDB
	 component to cause denial of service conditions [CVE-2018-2759,
	 CVE-2018-2766, CVE-2018-2777, CVE-2018-2810].</li>
	 <li>A remote authenticated user can exploit a flaw in the DML
	 component to cause denial of service conditions [CVE-2018-2839].
	 </li>
	 <li>A remote authenticated user can exploit a flaw in the
	 Performance Schema component to cause denial of service conditions
	 [CVE-2018-2846].</li>
	 <li>A remote authenticated user can exploit a flaw in the Pluggable
	 Auth component to cause denial of service conditions
	 [CVE-2018-2769].</li>
	 <li>A remote authenticated user can exploit a flaw in the Group
	 Replication GCS component to cause denial of service conditions
	 [CVE-2018-2776].</li>
	 <li>A local user can exploit a flaw in the Connection component to
	 cause denial of service conditions [CVE-2018-2762].</li>
	 <li>A remote authenticated user can exploit a flaw in the Locking
	 component to cause denial of service conditions [CVE-2018-2771].
	 </li>
	 <li>A remote authenticated user can exploit a flaw in the DDL
	 component to partially access data [CVE-2018-2813].</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html</url>
 <cvename>CVE-2018-2755</cvename>
 <cvename>CVE-2018-2805</cvename>
 <cvename>CVE-2018-2782</cvename>
 <cvename>CVE-2018-2784</cvename>
 <cvename>CVE-2018-2819</cvename>
 <cvename>CVE-2018-2758</cvename>
 <cvename>CVE-2018-2817</cvename>
 <cvename>CVE-2018-2775</cvename>
 <cvename>CVE-2018-2780</cvename>
 <cvename>CVE-2018-2761</cvename>
 <cvename>CVE-2018-2786</cvename>
 <cvename>CVE-2018-2787</cvename>
 <cvename>CVE-2018-2812</cvename>
 <cvename>CVE-2018-2877</cvename>
 <cvename>CVE-2018-2759</cvename>
 <cvename>CVE-2018-2766</cvename>
 <cvename>CVE-2018-2777</cvename>
 <cvename>CVE-2018-2810</cvename>
 <cvename>CVE-2018-2818</cvename>
 <cvename>CVE-2018-2839</cvename>
 <cvename>CVE-2018-2778</cvename>
 <cvename>CVE-2018-2779</cvename>
 <cvename>CVE-2018-2781</cvename>
 <cvename>CVE-2018-2816</cvename>
 <cvename>CVE-2018-2846</cvename>
 <cvename>CVE-2018-2769</cvename>
 <cvename>CVE-2018-2776</cvename>
 <cvename>CVE-2018-2762</cvename>
 <cvename>CVE-2018-2771</cvename>
 <cvename>CVE-2018-2813</cvename>
 <cvename>CVE-2018-2773</cvename>
 </references>
 <dates>
 <discovery>2018-04-17</discovery>
 <entry>2018-04-21</entry>
 </dates>
 </vuln>

<vuln vid="be38245e-44d9-11e8-a292-00e04c1ea73d">
 <topic>wordpress -- multiple issues</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>4.9.5,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>zh_CN-wordpress</name>
	<name>zh_TW-wordpress</name>
	<name>ja-wordpress</name>
	<range><lt>4.9.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wordpress developers reports:
	<blockquote cite="https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/">
	 Don't treat localhost as same host by default.
	 Use safe redirects when redirecting the login page if SSL is forced.
	 Make sure the version string is correctly escaped for use in generator tags.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2018-04-03</discovery>
 <entry>2018-04-20</entry>
 </dates>
 </vuln>

<vuln vid="ac7da39b-4405-11e8-afbe-6805ca0b3d42">
 <topic>phpmyadmin -- CSRF vulnerability allowing arbitrary SQL execution</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><ge>4.8.0</ge><lt>4.8.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-2/">
	 <h3>Summary</h3>
	 CSRF vulnerability allowing arbitrary SQL execution
	 <h3>Description</h3>
	 By deceiving a user to click on a crafted URL, it is
	 possible for an attacker to execute arbitrary SQL
	 commands.
	 <h3>Severity</h3>
	 We consider this vulnerability to be critical.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2018-2/</url>
 </references>
 <dates>
 <discovery>2018-04-17</discovery>
 <entry>2018-04-19</entry>
 </dates>
 </vuln>

<vuln vid="33174280-43fa-11e8-aad5-6cf0497db129">
 <topic>drupal -- Drupal core - Moderately critical</topic>
 <affects>
 <package>
 <name>drupal8</name>
 <range><lt>8.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 The Drupal security team reports:
 <blockquote cite="https://www.drupal.org/sa-core-2018-003">
 CKEditor, a third-party JavaScript library included in Drupal
 core, has fixed a cross-site scripting (XSS) vulnerability. The
 vulnerability stemmed from the fact that it was possible to execute
 XSS inside CKEditor when using the image2 plugin (which Drupal 8
 core also uses).
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/sa-core-2018-003</url>
 </references>
 <dates>
 <discovery>2018-04-18</discovery>
 <entry>2018-04-19</entry>
 </dates>
 </vuln>

<vuln vid="8f353420-4197-11e8-8777-b499baebfeaf">
 <topic>OpenSSL -- Cache timing vulnerability</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2o_2,1</lt></range>
 </package>
 <package>
	<name>openssl-devel</name>
	<range><lt>1.1.0h_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20180416.txt">
	 The OpenSSL RSA Key generation algorithm has been shown to be
	 vulnerable to a cache timing side channel attack. An attacker
	 with sufficient access to mount cache timing attacks during the
	 RSA key generation process could recover the private key.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20180416.txt</url>
 <cvename>CVE-2018-0737</cvename>
 </references>
 <dates>
 <discovery>2018-04-16</discovery>
 <entry>2018-04-16</entry>
 </dates>
 </vuln>

<vuln vid="a9e466e8-4144-11e8-a292-00e04c1ea73d">
 <topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.57</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/psa-2018-001">
	 CVE-2018-7600: Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6,
	 and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because
	 of an issue affecting multiple subsystems with default or common module configurations.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-7600</cvename>
 </references>
 <dates>
 <discovery>2018-03-13</discovery>
 <entry>2018-04-16</entry>
 </dates>
 </vuln>

<vuln vid="41c96ffd-29a6-4dcc-9a88-65f5038fa6eb">
 <topic>perl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>perl5</name>
	<range><ge>5.24.0</ge><lt>5.24.4</lt></range>
	<range><ge>5.26.0</ge><lt>5.26.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	perldelta:
	<blockquote cite="https://metacpan.org/changes/release/SHAY/perl-5.26.2">
	 CVE-2018-6797: heap-buffer-overflow (WRITE of size 1) in S_regatom
	 (regcomp.c)
	 A crafted regular expression could cause a heap buffer write overflow,
	 with control over the bytes written. [perl #132227]
	 CVE-2018-6798: Heap-buffer-overflow in Perl__byte_dump_string (utf8.c)
	 Matching a crafted locale dependent regular expression could cause a
	 heap buffer read overflow and potentially information disclosure. [perl
	 #132063]
	 CVE-2018-6913: heap-buffer-overflow in S_pack_rec
	 pack() could cause a heap buffer write overflow with a large item
	 count. [perl #131844]
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://metacpan.org/changes/release/SHAY/perl-5.26.2</url>
 <url>https://metacpan.org/changes/release/SHAY/perl-5.24.4</url>
 <cvename>CVE-2018-6797</cvename>
 <cvename>CVE-2018-6798</cvename>
 <cvename>CVE-2018-6913</cvename>
 </references>
 <dates>
 <discovery>2018-04-14</discovery>
 <entry>2018-04-15</entry>
 </dates>
 </vuln>

<vuln vid="974a6d32-3fda-11e8-aea4-001b216d295b">
 <topic>ipsec-tools -- remotely exploitable computational-complexity attack</topic>
 <affects>
 <package>
	<name>ipsec-tools</name>
	<range><lt>0.8.2_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Robert Foggia via NetBSD GNATS reports:
	<blockquote cite="https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682">
	 The ipsec-tools racoon daemon contains a remotely exploitable computational
	 complexity attack when parsing and storing isakmp fragments. The implementation
	 permits a remote attacker to exhaust computational resources on the remote endpoint
	 by repeatedly sending isakmp fragment packets in a particular order such that
	 the worst-case computational complexity is realized in the algorithm utilized
	 to determine if reassembly of the fragments can take place.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682</url>
 <cvename>CVE-2016-10396</cvename>
 </references>
 <dates>
 <discovery>2016-12-02</discovery>
 <entry>2018-04-14</entry>
 </dates>
 </vuln>

<vuln vid="1fccb25e-8451-438c-a2b9-6a021e4d7a31">
 <topic>nghttp2 -- Denial of service due to NULL pointer dereference</topic>
 <affects>
 <package>
	<name>libnghttp2</name>
	<name>nghttp2</name>
	<range><ge>1.10.0</ge><lt>1.31.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	nghttp2 blog:
	<blockquote cite="https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/">
	 If ALTSVC frame is received by libnghttp2 and it is larger than it can
	 accept, the pointer field which points to ALTSVC frame payload is left
	 NULL. Later libnghttp2 attempts to access another field through the
	 pointer, and gets segmentation fault.
	 ALTSVC frame is defined by RFC 7838.
	 The largest frame size libnghttp2 accept is by default 16384 bytes.
	 Receiving ALTSVC frame is disabled by default. Application has to
	 enable it explicitly by calling
	 nghttp2_option_set_builtin_recv_extension_type(opt, NGHTTP2_ALTSVC).
	 Transmission of ALTSVC is always enabled, and it does not cause this
	 vulnerability.
	 ALTSVC frame is expected to be sent by server, and received by client
	 as defined in RFC 7838.
	 Client and server are both affected by this vulnerability if the
	 reception of ALTSVC frame is enabled. As written earlier, it is useless
	 to enable reception of ALTSVC frame on server side. So, server is
	 generally safe unless application accidentally enabled the reception of
	 ALTSVC frame.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</url>
 <cvename>CVE-2018-1000168</cvename>
 </references>
 <dates>
 <discovery>2018-04-04</discovery>
 <entry>2018-04-13</entry>
 </dates>
 </vuln>

<vuln vid="48894ca9-3e6f-11e8-92f0-f0def167eeea">
 <topic>roundcube -- IMAP command injection vulnerability</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><le>1.3.5,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Upstream reports:
	<blockquote cite="https://roundcube.net/news/2018/04/11/security-update-1.3.6">
	 This update primarily fixes a recently discovered IMAP-cmd-injection
	 vulnerability caused by insufficient input validation within
	 the archive plugin.
	 Details about the vulnerability are published under CVE-2018-9846.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-9846</cvename>
 <url>https://roundcube.net/news/2018/04/11/security-update-1.3.6</url>
 </references>
 <dates>
 <discovery>2018-04-11</discovery>
 <entry>2018-04-13</entry>
 </dates>
 </vuln>

<vuln vid="aaba17aa-782e-4843-8a79-7756cfa2bf89">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><le>2.115</le></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><le>2.107.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins developers report:
	<blockquote cite="https://jenkins.io/security/advisory/2018-04-11/">
	 The Jenkins CLI sent different error responses for commands with
	 view and agent arguments depending on the existence of the specified
	 views or agents to unauthorized users. This allowed attackers to
	 determine whether views or agents with specified names exist.
	 The Jenkins CLI now returns the same error messages to unauthorized
	 users independent of the existence of specified view or agent
	 names
	 Some JavaScript confirmation dialogs included the item name in an
	 unsafe manner, resulting in a possible cross-site scripting
	 vulnerability exploitable by users with permission to create or
	 configure items.
	 JavaScript confirmation dialogs that include the item name now
	 properly escape it, so it can be safely displayed.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://jenkins.io/security/advisory/2018-04-11/</url>
 </references>
 <dates>
 <discovery>2018-04-11</discovery>
 <entry>2018-04-12</entry>
 </dates>
 </vuln>

<vuln vid="5c6f7482-3ced-11e8-b157-6451062f0f7a">
 <topic>Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>29.0.0.140</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-08.html">
	 <ul>
	 <li>This update resolves a use-after-free vulnerability that
	 could lead to remote code execution (CVE-2018-4932).</li>
	 <li>This update resolves out-of-bounds read vulnerabilities that
	 could lead to information disclosure (CVE-2018-4933,
	 CVE-2018-4934).</li>
	 <li>This update resolves out-of-bounds write vulnerabilities that
	 could lead to remote code execution (CVE-2018-4935,
	 CVE-2018-4937).</li>
	 <li>This update resolves a heap overflow vulnerability that
	 could lead to information disclosure (CVE-2018-4936).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-4932</cvename>
 <cvename>CVE-2018-4933</cvename>
 <cvename>CVE-2018-4934</cvename>
 <cvename>CVE-2018-4935</cvename>
 <cvename>CVE-2018-4936</cvename>
 <cvename>CVE-2018-4937</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb18-08.html</url>
 </references>
 <dates>
 <discovery>2018-04-10</discovery>
 <entry>2018-04-10</entry>
 <modified>2018-07-11</modified>
 </dates>
 </vuln>

<vuln vid="085a087b-3897-11e8-ac53-d8cb8abf62dd">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>gitlab</name>
 <range><ge>10.6.0</ge><lt>10.6.3</lt></range>
 <range><ge>10.5.0</ge><lt>10.5.7</lt></range>
 <range><ge>8.6</ge><lt>10.4.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 GitLab reports:
 <blockquote cite="https://about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/">
	Confidential issue comments in Slack, Mattermost, and webhook integrations.
	Persistent XSS in milestones data-milestone-id.
	Persistent XSS in filename of merge request.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/</url>
 </references>
 <dates>
 <discovery>2018-04-04</discovery>
 <entry>2018-04-05</entry>
 </dates>
 </vuln>

<vuln vid="c0c5afef-38db-11e8-8b7f-a4badb2f469b">
 <topic>FreeBSD -- ipsec crash or denial of service</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_9</lt></range>
	<range><ge>10.4</ge><lt>10.4_8</lt></range>
	<range><ge>10.3</ge><lt>10.3_29</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The length field of the option header does not count the
	size of the option header itself. This causes a problem
	when the length is zero, the count is then incremented by
	zero, which causes an infinite loop.
	In addition there are pointer/offset mistakes in the
	handling of IPv4 options.
	<h1>Impact:</h1>
	A remote attacker who is able to send an arbitrary packet,
	could cause the remote target machine to crash.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6918</cvename>
 <freebsdsa>SA-18:05.ipsec</freebsdsa>
 </references>
 <dates>
 <discovery>2018-04-04</discovery>
 <entry>2018-04-05</entry>
 </dates>
 </vuln>

<vuln vid="a5cf3ecd-38db-11e8-8b7f-a4badb2f469b">
 <topic>FreeBSD -- vt console memory disclosure</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_9</lt></range>
	<range><ge>10.4</ge><lt>10.4_8</lt></range>
	<range><ge>10.3</ge><lt>10.3_29</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Insufficient validation of user-provided font parameters
	can result in an integer overflow, leading to the use of
	arbitrary kernel memory as glyph data. Characters that
	reference this data can be displayed on the screen, effectively
	disclosing kernel memory.
	<h1>Impact:</h1>
	Unprivileged users may be able to access privileged
	kernel data.
	Such memory might contain sensitive information, such
	as portions of the file cache or terminal buffers. This
	information might be directly useful, or it might be leveraged
	to obtain elevated privileges in some way; for example, a
	terminal buffer might include a user-entered password.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6917</cvename>
 <freebsdsa>SA-18:04.vt</freebsdsa>
 </references>
 <dates>
 <discovery>2018-04-04</discovery>
 <entry>2018-04-05</entry>
 </dates>
 </vuln>

<vuln vid="cdb4d962-34f9-11e8-92db-080027907385">
 <topic>moodle -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moodle31</name>
	<range><lt>3.1.11</lt></range>
 </package>
 <package>
	<name>moodle32</name>
	<range><lt>3.2.8</lt></range>
 </package>
 <package>
	<name>moodle33</name>
	<range><lt>3.3.5</lt></range>
 </package>
 <package>
	<name>moodle34</name>
	<range><lt>3.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	moodle reports:
	<blockquote cite="https://moodle.org/mod/forum/discuss.php?d=367938">
	 Unauthenticated users can trigger custom messages to admin via
	 paypal enrol script.
	 Suspended users with OAuth 2 authentication method can still log in to
	 the site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-1081</cvename>
 <cvename>CVE-2018-1082</cvename>
 <url>https://moodle.org/mod/forum/discuss.php?d=367938</url>
 </references>
 <dates>
 <discovery>2018-03-14</discovery>
 <entry>2018-03-31</entry>
 </dates>
 </vuln>

<vuln vid="eb69bcf2-18ef-4aa2-bb0c-83b263364089">
 <topic>ruby -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>2.3.0,1</ge><lt>2.3.7,1</lt></range>
	<range><ge>2.4.0,1</ge><lt>2.4.4,1</lt></range>
	<range><ge>2.5.0,1</ge><lt>2.5.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby news:
	<blockquote cite="https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/">
	 CVE-2017-17742: HTTP response splitting in WEBrick
	 If a script accepts an external input and outputs it without
	 modification as a part of HTTP responses, an attacker can use newline
	 characters to deceive the clients that the HTTP response header is
	 stopped at there, and can inject fake HTTP responses after the newline
	 characters to show malicious contents to the clients.
	 CVE-2018-6914: Unintentional file and directory creation with
	 directory traversal in tempfile and tmpdir
	 Dir.mktmpdir method introduced by tmpdir library accepts the prefix
	 and the suffix of the directory which is created as the first parameter.
	 The prefix can contain relative directory specifiers "../", so this
	 method can be used to target any directory. So, if a script accepts an
	 external input as the prefix, and the targeted directory has
	 inappropriate permissions or the ruby process has inappropriate
	 privileges, the attacker can create a directory or a file at any
	 directory.
	 CVE-2018-8777: DoS by large request in WEBrick
	 If an attacker sends a large request which contains huge HTTP headers,
	 WEBrick try to process it on memory, so the request causes the
	 out-of-memory DoS attack.
	 CVE-2018-8778: Buffer under-read in String#unpack
	 String#unpack receives format specifiers as its parameter, and can
	 be specified the position of parsing the data by the specifier @. If a
	 big number is passed with @, the number is treated as the negative
	 value, and out-of-buffer read is occurred. So, if a script accepts an
	 external input as the argument of String#unpack, the attacker can read
	 data on heaps.
	 CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in
	 UNIXServer and UNIXSocket
	 UNIXServer.open accepts the path of the socket to be created at the
	 first parameter. If the path contains NUL (\0) bytes, this method
	 recognize that the path is completed before the NUL bytes. So, if a
	 script accepts an external input as the argument of this method, the
	 attacker can make the socket file in the unintentional path. And,
	 UNIXSocket.open also accepts the path of the socket to be created at
	 the first parameter without checking NUL bytes like UNIXServer.open.
	 So, if a script accepts an external input as the argument of this
	 method, the attacker can accepts the socket file in the unintentional
	 path.
	 CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte
	 in Dir
	 Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the
	 target directory as their parameter. If the parameter contains NUL (\0)
	 bytes, these methods recognize that the path is completed before the
	 NUL bytes. So, if a script accepts an external input as the argument of
	 these methods, the attacker can make the unintentional directory
	 traversal.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/</url>
 <url>https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/</url>
 <url>https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/</url>
 <url>https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/</url>
 <url>https://www.ruby-lang.org/en/news/2018/03/28/unintentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914/</url>
 <url>https://www.ruby-lang.org/en/news/2018/03/28/large-request-dos-in-webrick-cve-2018-8777/</url>
 <url>https://www.ruby-lang.org/en/news/2018/03/28/buffer-under-read-unpack-cve-2018-8778/</url>
 <url>https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-unixsocket-cve-2018-8779/</url>
 <url>https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/</url>
 <cvename>CVE-2017-17742</cvename>
 <cvename>CVE-2018-6914</cvename>
 <cvename>CVE-2018-8777</cvename>
 <cvename>CVE-2018-8778</cvename>
 <cvename>CVE-2018-8779</cvename>
 <cvename>CVE-2018-8780</cvename>
 </references>
 <dates>
 <discovery>2018-03-28</discovery>
 <entry>2018-03-29</entry>
 </dates>
 </vuln>

<vuln vid="5a9bbb6e-32d3-11e8-a769-6daaba161086">
 <topic>node.js -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>node4</name>
	<range><lt>4.9.0</lt></range>
 </package>
 <package>
	<name>node6</name>
	<range><lt>6.14.0</lt></range>
 </package>
 <package>
	<name>node8</name>
	<range><lt>8.11.0</lt></range>
 </package>
 <package>
	<name>node</name>
	<range><lt>9.10.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/">
	 <h1>Node.js Inspector DNS rebinding vulnerability (CVE-2018-7160)</h1>
	 Node.js 6.x and later include a debugger protocol (also known as "inspector") that can be activated by the --inspect and related command line flags. This debugger service was vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution.
	 <h1>'path' module regular expression denial of service (CVE-2018-7158)</h1>
	 The 'path' module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x.
	 <h1>Spaces in HTTP Content-Length header values are ignored (CVE-2018-7159)</h1>
	 The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been brought into line on this particular difference.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/</url>
 <cvename>CVE-2018-7158</cvename>
 <cvename>CVE-2018-7159</cvename>
 <cvename>CVE-2018-7160</cvename>
 </references>
 <dates>
 <discovery>2018-03-21</discovery>
 <entry>2018-03-28</entry>
 <modified>2018-03-28</modified>
 </dates>
 </vuln>

<vuln vid="1ce95bc7-3278-11e8-b527-00012e582166">
 <topic>webkit2-gtk3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>webkit2-gtk3</name>
	<range><ge>2.16.6</ge><lt>2.20.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The WebKit team reports many vulnerabilities.
	Please reference the CVE/URL list for details.
 </body>
 </description>
 <references>
 <url>https://webkitgtk.org/security/WSA-2017-0008.html</url>
 <url>https://webkitgtk.org/security/WSA-2017-0009.html</url>
 <url>https://webkitgtk.org/security/WSA-2017-0010.html</url>
 <url>https://webkitgtk.org/security/WSA-2018-0001.html</url>
 <url>https://webkitgtk.org/security/WSA-2018-0002.html</url>
 <cvename>CVE-2017-7087</cvename>
 <cvename>CVE-2017-7089</cvename>
 <cvename>CVE-2017-7090</cvename>
 <cvename>CVE-2017-7091</cvename>
 <cvename>CVE-2017-7092</cvename>
 <cvename>CVE-2017-7092</cvename>
 <cvename>CVE-2017-7093</cvename>
 <cvename>CVE-2017-7095</cvename>
 <cvename>CVE-2017-7096</cvename>
 <cvename>CVE-2017-7098</cvename>
 <cvename>CVE-2017-7100</cvename>
 <cvename>CVE-2017-7102</cvename>
 <cvename>CVE-2017-7104</cvename>
 <cvename>CVE-2017-7107</cvename>
 <cvename>CVE-2017-7109</cvename>
 <cvename>CVE-2017-7111</cvename>
 <cvename>CVE-2017-7117</cvename>
 <cvename>CVE-2017-7120</cvename>
 <cvename>CVE-2017-13783</cvename>
 <cvename>CVE-2017-13784</cvename>
 <cvename>CVE-2017-13785</cvename>
 <cvename>CVE-2017-13788</cvename>
 <cvename>CVE-2017-13791</cvename>
 <cvename>CVE-2017-13792</cvename>
 <cvename>CVE-2017-13794</cvename>
 <cvename>CVE-2017-13795</cvename>
 <cvename>CVE-2017-13796</cvename>
 <cvename>CVE-2017-13798</cvename>
 <cvename>CVE-2017-13802</cvename>
 <cvename>CVE-2017-13803</cvename>
 <cvename>CVE-2017-7156</cvename>
 <cvename>CVE-2017-7157</cvename>
 <cvename>CVE-2017-13856</cvename>
 <cvename>CVE-2017-13866</cvename>
 <cvename>CVE-2017-13870</cvename>
 <cvename>CVE-2017-5753</cvename>
 <cvename>CVE-2017-5715</cvename>
 <cvename>CVE-2018-4088</cvename>
 <cvename>CVE-2018-4089</cvename>
 <cvename>CVE-2018-4096</cvename>
 <cvename>CVE-2017-7153</cvename>
 <cvename>CVE-2017-7160</cvename>
 <cvename>CVE-2017-7161</cvename>
 <cvename>CVE-2017-7165</cvename>
 <cvename>CVE-2017-13884</cvename>
 <cvename>CVE-2017-13885</cvename>
 </references>
 <dates>
 <discovery>2017-10-18</discovery>
 <entry>2018-03-28</entry>
 <modified>2018-03-28</modified>
 </dates>
 </vuln>

<vuln vid="3ae21918-31e3-11e8-927b-e8e0b747a45a">
 <topic>chromium -- vulnerability</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>65.0.3325.181</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop_20.html">
	 1 security fix in this release, including:
	 <ul>
	 <li>[823553] Various fixes from internal audits, fuzzing and other initiatives</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop_20.html</url>
 </references>
 <dates>
 <discovery>2018-03-20</discovery>
 <entry>2018-03-27</entry>
 </dates>
 </vuln>

<vuln vid="b7cff5a9-31cc-11e8-8f07-b499baebfeaf">
 <topic>OpenSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2o,1</lt></range>
 </package>
 <package>
	<name>openssl-devel</name>
	<range><lt>1.1.0h</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20180327.txt">
	 <ul><li>Constructed ASN.1 types with a recursive definition could
	 exceed the stack (CVE-2018-0739) 
	 Constructed ASN.1 types with a recursive definition (such as can be
	 found in PKCS7) could eventually exceed the stack given malicious input
	 with excessive recursion. This could result in a Denial Of Service
	 attack. There are no such structures used within SSL/TLS that come from
	 untrusted sources so this is considered safe.</li>
	 <li>rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738) 
	 There is an overflow bug in the AVX2 Montgomery multiplication
	 procedure	used in exponentiation with 1024-bit moduli. This only
	 affects processors that support the AVX2 but not ADX extensions
	 like Intel Haswell (4th generation).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20180327.txt</url>
 <cvename>CVE-2018-0739</cvename>
 <cvename>CVE-2017-3738</cvename>
 </references>
 <dates>
 <discovery>2018-03-27</discovery>
 <entry>2018-03-27</entry>
 </dates>
 </vuln>

<vuln vid="dc0c201c-31da-11e8-ac53-d8cb8abf62dd">
 <topic>Gitlab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab</name>
	<range><ge>10.5.0</ge><lt>10.5.6</lt></range>
	<range><ge>10.4.0</ge><lt>10.4.6</lt></range>
	<range><ge>8.3</ge><lt>10.3.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab reports:
	<blockquote cite="https://about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/">
	 <h1>SSRF in services and web hooks</h1>
	 There were multiple server-side request forgery issues in the Services feature.
	 An attacker could make requests to servers within the same network of the GitLab
	 instance. This could lead to information disclosure, authentication bypass, or
	 potentially code execution. This issue has been assigned
	 <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8801">CVE-2018-8801</a>.
	 <h1>Gitlab Auth0 integration issue</h1>
	 There was an issue with the GitLab <code>omniauth-auth0</code> configuration
	 which resulted in the Auth0 integration signing in the wrong users.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-8801</cvename>
 <url>https://about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/</url>
 </references>
 <dates>
 <discovery>2018-03-20</discovery>
 <entry>2018-03-27</entry>
 <modified>2018-04-07</modified>
 </dates>
 </vuln>

<vuln vid="23f59689-0152-42d3-9ade-1658d6380567">
 <topic>mozilla -- use-after-free in compositor</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>59.0.2,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.0.4.36_3</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.3</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>52.7.3,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>52.7.3,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>52.7.3</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>52.7.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>52.7.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-10/">
	 <h1>CVE-2018-5148: Use-after-free in compositor</h1>
	 A use-after-free vulnerability can occur in the
	 compositor during certain graphics operations when a raw
	 pointer is used instead of a reference counted one. This
	 results in a potentially exploitable crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-5148</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2018-10/</url>
 </references>
 <dates>
 <discovery>2018-03-26</discovery>
 <entry>2018-03-27</entry>
 <modified>2018-03-31</modified>
 </dates>
 </vuln>

<vuln vid="81946ace-6961-4488-a164-22d58ebc8d66">
 <topic>rails-html-sanitizer -- possible XSS vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-rails-html-sanitizer</name>
	<range><lt>1.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OSS-Security list:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2018/03/22/4">
	 There is a possible XSS vulnerability in rails-html-sanitizer. The gem
	 allows non-whitelisted attributes to be present in sanitized output
	 when input with specially-crafted HTML fragments, and these attributes
	 can lead to an XSS attack on target applications.
	 This issue is similar to CVE-2018-8048 in Loofah.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2018/03/22/4</url>
 <cvename>CVE-2018-3741</cvename>
 </references>
 <dates>
 <discovery>2018-03-22</discovery>
 <entry>2018-03-24</entry>
 </dates>
 </vuln>

<vuln vid="f38187e7-2f6e-11e8-8f07-b499baebfeaf">
 <topic>apache -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.30</lt></range>
 </package>
 <package>
	<name>apache22</name>
	<range><lt>2.2.34_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd reports:
	<blockquote cite="https://www.apache.org/dist/httpd/CHANGES_2.4.33">
	 Out of bound write in mod_authnz_ldap with AuthLDAPCharsetConfig
	 enabled (CVE-2017-15710)
	 mod_session: CGI-like applications that intend to read from
	 mod_session's 'SessionEnv ON' could be fooled into reading
	 user-supplied data instead. (CVE-2018-1283)
	 mod_cache_socache: Fix request headers parsing to avoid a possible
	 crash with specially crafted input data. (CVE-2018-1303)
	 core: Possible crash with excessively long HTTP request headers.
	 Impractical to exploit with a production build and production
	 LogLevel. (CVE-2018-1301)
	 core: Configure the regular expression engine to match '$' to the
	 end of the input string only, excluding matching the end of any
	 embedded newline characters. Behavior can be changed with new
	 directive 'RegexDefaultOptions'. (CVE-2017-15715)
	 mod_auth_digest: Fix generation of nonce values to prevent replay
	 attacks across servers using a common Digest domain. This change
	 may cause problems if used with round robin load balancers.
	 (CVE-2018-1312)
	 mod_http2: Potential crash w/ mod_http2. (CVE-2018-1302)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.apache.org/dist/httpd/CHANGES_2.4.33</url>
 <cvename>CVE-2017-15710</cvename>
 <cvename>CVE-2018-1283</cvename>
 <cvename>CVE-2018-1303</cvename>
 <cvename>CVE-2018-1301</cvename>
 <cvename>CVE-2017-15715</cvename>
 <cvename>CVE-2018-1312</cvename>
 <cvename>CVE-2018-1302</cvename>
 </references>
 <dates>
 <discovery>2018-03-23</discovery>
 <entry>2018-03-24</entry>
 <modified>2018-03-27</modified>
 </dates>
 </vuln>

<vuln vid="d50a50a2-2f3e-11e8-86f8-00e04c1ea73d">
 <topic>mybb -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mybb</name>
	<range><lt>1.8.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mybb Team reports:
	<blockquote cite="https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/">
	 Medium risk: Tasks Local File Inclusion
	 Medium risk: Forum Password Check Bypass
	 Low risk: Admin Permissions Group Title XSS
	 Low risk: Attachment types file extension XSS
	 Low risk: Moderator Tools XSS
	 Low risk: Security Questions XSS
	 Low risk: Settings Management XSS
	 Low risk: Templates Set Name XSS
	 Low risk: Usergroup Promotions XSS
	 Low risk: Warning Types XSS
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2018-03-15</discovery>
 <entry>2018-03-24</entry>
 </dates>
 </vuln>

<vuln vid="6d52bda1-2e54-11e8-a68f-485b3931c969">
 <topic>SQLite -- Corrupt DB can cause a NULL pointer dereference</topic>
 <affects>
 <package>
	<name>sqlite3</name>
	<range><lt>3.22.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-8740">
	 SQLite databases whose schema is corrupted using a CREATE TABLE AS
	 statement could cause a NULL pointer dereference, related to build.c
	 and prepare.c.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-8740</cvename>
 <url>http://openwall.com/lists/oss-security/2018/03/17/1</url>
 </references>
 <dates>
 <discovery>2018-03-16</discovery>
 <entry>2018-03-22</entry>
 </dates>
 </vuln>

<vuln vid="39a30e0a-0c34-431b-9dce-b87cab02412a">
 <topic>Sanitize -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-sanitize</name>
	<range><lt>2.6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sanitize release:
	<blockquote cite="https://github.com/rgrove/sanitize/releases">
	 Fixed an HTML injection vulnerability that could allow XSS.
	 When Sanitize &lt;= 4.6.2 is used in combination with libxml2 &gt;= 2.9.2,
	 a specially crafted HTML fragment can cause libxml2 to generate
	 improperly escaped output, allowing non-whitelisted attributes to be
	 used on whitelisted elements.
	 Sanitize now performs additional escaping on affected attributes to
	 prevent this.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/rgrove/sanitize/releases</url>
 <url>https://github.com/rgrove/sanitize/issues/176</url>
 <cvename>CVE-2018-3740</cvename>
 </references>
 <dates>
 <discovery>2018-03-19</discovery>
 <entry>2018-03-21</entry>
 </dates>
 </vuln>

<vuln vid="ba6d0c9b-f5f6-4b9b-a6de-3cce93c83220">
 <topic>Loofah -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-loofah</name>
	<range><lt>2.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitHub issue:
	<blockquote cite="https://github.com/flavorjones/loofah/issues/144">
	 This issue has been created for public disclosure of an XSS / code
	 injection vulnerability that was responsibly reported by the Shopify
	 Application Security Team.
	 Loofah allows non-whitelisted attributes to be present in sanitized
	 output when input with specially-crafted HTML fragments.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/flavorjones/loofah/releases</url>
 <url>https://github.com/flavorjones/loofah/issues/144</url>
 <cvename>CVE-2018-8048</cvename>
 </references>
 <dates>
 <discovery>2018-03-15</discovery>
 <entry>2018-03-20</entry>
 </dates>
 </vuln>

<vuln vid="b3edc7d9-9af5-4daf-88f1-61f68f4308c2">
 <topic>Jupyter Notebook -- vulnerability</topic>
 <affects>
 <package>
	<name>py27-notebook</name>
	<name>py34-notebook</name>
	<name>py35-notebook</name>
	<name>py36-notebook</name>
	<range><lt>5.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8768">
	 In Jupyter Notebook before 5.4.1, a maliciously forged notebook file
	 can bypass sanitization to execute JavaScript in the notebook context.
	 Specifically, invalid HTML is 'fixed' by jQuery after sanitization,
		making it dangerous.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8768</url>
 <cvename>CVE-2018-8768</cvename>
 </references>
 <dates>
 <discovery>2018-03-18</discovery>
 <entry>2018-03-19</entry>
 </dates>
 </vuln>

<vuln vid="928d5c59-2a5a-11e8-a712-0025908740c2">
 <topic>SquirrelMail -- post-authentication access privileges</topic>
 <affects>
 <package>
	<name>squirrelmail</name>
	<range><le>20170705</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Florian Grunow reports:
	<blockquote cite="https://insinuator.net/2018/03/squirrelmail-full-disclosure-troopers18/">
	 An attacker able to exploit this vulnerability can extract files
	 of the server the application is running on. This may include
	 configuration files, log files and additionally all files that are
	 readable for all users on the system. This issue is
	 post-authentication. That means an attacker would need valid
	 credentials for the application to log in or needs to exploit an
	 additional vulnerability of which we are not aware of at this point
	 of time.
	 An attacker would also be able to delete files on the system, if
	 the user running the application has the rights to do so.
	 Does this issue affect me?
	 Likely yes, if you are using Squirrelmail. We checked the latest
	 development version, which is 1.5.2-svn and the latest version
	 available for download at this point of time, 1.4.22. Both contain
	 the vulnerable code.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2018/03/17/2</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2018-8741</url>
 <cvename>CVE-2018-8741</cvename>
 </references>
 <dates>
 <discovery>2017-05-21</discovery>
 <entry>2018-03-17</entry>
 </dates>
 </vuln>

<vuln vid="b3e04661-2a0a-11e8-9e63-3085a9a47796">
 <topic>slurm-wlm -- SQL Injection attacks against SlurmDBD</topic>
 <affects>
 <package>
	<name>slurm-wlm</name>
	<range><lt>17.02.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SchedMD reports:
	<blockquote cite="https://lists.schedmd.com/pipermail/slurm-announce/2018/000006.html">
	 Several issues were discovered with incomplete sanitization of
	 user-provided text strings, which could potentially lead to SQL
	 injection attacks against SlurmDBD itself. Such exploits could lead to a
	 loss of accounting data, or escalation of user privileges on the cluster.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-7033</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2018-7033</url>
 </references>
 <dates>
 <discovery>2018-03-15</discovery>
 <entry>2018-03-17</entry>
 </dates>
 </vuln>

<vuln vid="64ee858e-e035-4bb4-9c77-2468963dddb8">
 <topic>libvorbis -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libvorbis</name>
	<range><lt>1.3.6,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-14632">
	 Xiph.Org libvorbis 1.3.5 allows Remote Code Execution
	 upon freeing uninitialized memory in the function
	 vorbis_analysis_headerout() in info.c when
	 vi-&gt;channels&lt;=0, a similar issue to Mozilla bug
	 550184.
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-14633">
	 In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read
	 vulnerability exists in the function mapping0_forward() in
	 mapping0.c, which may lead to DoS when operating on a
	 crafted audio file with vorbis_analysis().
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-14632</cvename>
 <cvename>CVE-2017-14633</cvename>
 </references>
 <dates>
 <discovery>2018-03-16</discovery>
 <entry>2018-03-16</entry>
 </dates>
 </vuln>

<vuln vid="7943794f-707f-4e31-9fea-3bbf1ddcedc1">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libvorbis</name>
	<range><lt>1.3.6,3</lt></range>
 </package>
 <package>
	<name>libtremor</name>
	<range><lt>1.2.1.s20180316</lt></range>
 </package>
 <package>
	<name>firefox</name>
	<range><lt>59.0.1,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.0.4.36_3</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.3</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>52.7.2,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>52.7.2,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>52.7.3</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-08/">
	 <h1>CVE-2018-5146: Out of bounds memory write in libvorbis</h1>
	 An out of bounds memory write while processing Vorbis
	 audio data was reported through the Pwn2Own contest.
	 <h1>CVE-2018-5147: Out of bounds memory write in libtremor</h1>
	 The libtremor library has the same flaw as
	 CVE-2018-5146. This library is used by Firefox in place of
	 libvorbis on Android and ARM platforms.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-5146</cvename>
 <cvename>CVE-2018-5147</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2018-08/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2018-09/</url>
 </references>
 <dates>
 <discovery>2018-03-16</discovery>
 <entry>2018-03-16</entry>
 <modified>2018-03-31</modified>
 </dates>
 </vuln>

<vuln vid="2aa9967c-27e0-11e8-9ae1-080027ac955c">
 <topic>e2fsprogs -- potential buffer overrun bugs in the blkid library and in the fsck program</topic>
 <affects>
 <package>
	<name>e2fsprogs</name>
	<range><lt>1.44.0</lt></range>
 </package>
 <package>
	<name>e2fsprogs-libblkid</name>
	<range><lt>1.44.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Theodore Y. Ts'o reports:
	<blockquote cite="http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.44.0">
	 Fixed some potential buffer overrun bugs in the blkid library and in the fsck program.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.44.0</url>
 </references>
 <dates>
 <discovery>2018-03-07</discovery>
 <entry>2018-03-14</entry>
 </dates>
 </vuln>

<vuln vid="74daa370-2797-11e8-95ec-a4badb2f4699">
 <topic>FreeBSD -- Speculative Execution Vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A number of issues relating to speculative execution
	were found last year and publicly announced January 3rd.
	Two of these, known as Meltdown and Spectre V2, are addressed
	here.
	CVE-2017-5754 (Meltdown) - ------------------------
	This issue relies on an affected CPU speculatively
	executing instructions beyond a faulting instruction. When
	this happens, changes to architectural state are not
	committed, but observable changes may be left in micro-
	architectural state (for example, cache). This may be used
	to infer privileged data.
	CVE-2017-5715 (Spectre V2) - --------------------------
	Spectre V2 uses branch target injection to speculatively
	execute kernel code at an address under the control of an
	attacker.
	<h1>Impact:</h1>
	An attacker may be able to read secret data from the
	kernel or from a process when executing untrusted code (for
	example, in a web browser).
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5715</cvename>
 <cvename>CVE-2017-5754</cvename>
 <freebsdsa>SA-18:03.speculative_execution</freebsdsa>
 </references>
 <dates>
 <discovery>2018-03-14</discovery>
 <entry>2018-03-14</entry>
 </dates>
 </vuln>

<vuln vid="dca7ced0-2796-11e8-95ec-a4badb2f4699">
 <topic>FreeBSD -- ipsec validation and use-after-free</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_7</lt></range>
	<range><ge>10.4</ge><lt>10.4_7</lt></range>
	<range><ge>10.3</ge><lt>10.3_28</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to a lack of strict checking, an attacker from a
	trusted host can send a specially constructed IP packet
	that may lead to a system crash.
	Additionally, a use-after-free vulnerability in the AH
	handling code could cause unpredictable results.
	<h1>Impact:</h1>
	Access to out of bounds or freed mbuf data can lead to
	a kernel panic or other unpredictable results.
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6916</cvename>
 <freebsdsa>SA-18:01.ipsec</freebsdsa>
 </references>
 <dates>
 <discovery>2018-03-07</discovery>
 <entry>2018-03-14</entry>
 </dates>
 </vuln>

<vuln vid="313078e3-26e2-11e8-9920-6451062f0f7a">
 <topic>Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>29.0.0.113</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-05.html">
	 <ul>
	 <li>This update resolves a use-after-free vulnerability that
	 could lead to remote code execution (CVE-2018-4919).</li>
	 <li>This update resolves a type confusion vulnerability that
	 could lead to remote code execution (CVE-2018-4920).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-4919</cvename>
 <cvename>CVE-2018-4920</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb18-05.html</url>
 </references>
 <dates>
 <discovery>2018-03-13</discovery>
 <entry>2018-03-13</entry>
 </dates>
 </vuln>

<vuln vid="c71cdc95-3c18-45b7-866a-af28b59aabb5">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>59.0_1,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.0.4.36_3</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.3</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>52.7.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>52.7.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-06/">
	 CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList
	 CVE-2018-5128: Use-after-free manipulating editor selection ranges
	 CVE-2018-5129: Out-of-bounds write with malformed IPC messages
	 CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption
	 CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources
	 CVE-2018-5132: WebExtension Find API can search privileged pages
	 CVE-2018-5133: Value of the app.support.baseURL preference is not properly sanitized
	 CVE-2018-5134: WebExtensions may use view-source: URLs to bypass content restrictions
	 CVE-2018-5135: WebExtension browserAction can inject scripts into unintended contexts
	 CVE-2018-5136: Same-origin policy violation with data: URL shared workers
	 CVE-2018-5137: Script content can access legacy extension non-contentaccessible resources
	 CVE-2018-5138: Android Custom Tab address spoofing through long domain names
	 CVE-2018-5140: Moz-icon images accessible to web content through moz-icon: protocol
	 CVE-2018-5141: DOS attack through notifications Push API
	 CVE-2018-5142: Media Capture and Streams API permissions display incorrect origin with data: and blob: URLs
	 CVE-2018-5143: Self-XSS pasting javascript: URL with embedded tab into addressbar
	 CVE-2018-5126: Memory safety bugs fixed in Firefox 59
	 CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-5125</cvename>
 <cvename>CVE-2018-5126</cvename>
 <cvename>CVE-2018-5127</cvename>
 <cvename>CVE-2018-5128</cvename>
 <cvename>CVE-2018-5129</cvename>
 <cvename>CVE-2018-5130</cvename>
 <cvename>CVE-2018-5131</cvename>
 <cvename>CVE-2018-5132</cvename>
 <cvename>CVE-2018-5133</cvename>
 <cvename>CVE-2018-5134</cvename>
 <cvename>CVE-2018-5135</cvename>
 <cvename>CVE-2018-5136</cvename>
 <cvename>CVE-2018-5137</cvename>
 <cvename>CVE-2018-5138</cvename>
 <cvename>CVE-2018-5140</cvename>
 <cvename>CVE-2018-5141</cvename>
 <cvename>CVE-2018-5142</cvename>
 <cvename>CVE-2018-5143</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2018-06/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2018-07/</url>
 </references>
 <dates>
 <discovery>2018-03-13</discovery>
 <entry>2018-03-13</entry>
 <modified>2018-03-16</modified>
 </dates>
 </vuln>

<vuln vid="fb26f78a-26a9-11e8-a1c2-00505689d4ae">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba44</name>
	<range><lt>4.4.17</lt></range>
 </package>
 <package>
	<name>samba45</name>
	<range><lt>4.5.16</lt></range>
 </package>
 <package>
	<name>samba46</name>
	<range><lt>4.6.14</lt></range>
 </package>
 <package>
	<name>samba47</name>
	<range><lt>4.7.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The samba project reports:
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1050.html">
	 Missing null pointer checks may crash the external
	 print server process.
	</blockquote>
	<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1057.html">
	 On a Samba 4 AD DC any authenticated user can change
	 other user's passwords over LDAP, including the
	 passwords of administrative users and service accounts.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/security/CVE-2018-1050.html</url>
 <cvename>CVE-2018-1050</cvename>
 <url>https://www.samba.org/samba/security/CVE-2018-1057.html</url>
 <cvename>CVE-2018-1057</cvename>
 </references>
 <dates>
 <discovery>2018-01-03</discovery>
 <entry>2018-03-13</entry>
 </dates>
 </vuln>

<vuln vid="c2f107e1-2493-11e8-b3e8-001cc0382b2f">
 <topic>mbed TLS (PolarSSL) -- remote code execution</topic>
 <affects>
 <package>
	<name>mbedtls</name>
	<range><lt>2.7.0</lt></range>
 </package>
 <package>
	<name>polarssl13</name>
	<range><lt>1.3.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Butcher reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01">
	 <ul>
	 <li>When the truncated HMAC extension is enabled and CBC is used,
	 sending a malicious application packet can be used to selectively
	 corrupt 6 bytes on the peer's heap, potentially leading to a
	 crash or remote code execution. This can be triggered remotely
	 from either side in both TLS and DTLS.</li>
	 <li>When RSASSA-PSS signature verification is enabled, sending a
	 maliciously constructed certificate chain can be used to cause a
	 buffer overflow on the peer's stack, potentially leading to crash
	 or remote code execution. This can be triggered remotely from
	 either side in both TLS and DTLS.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01</url>
 <cvename>CVE-2018-0487</cvename>
 <cvename>CVE-2018-0488</cvename>
 </references>
 <dates>
 <discovery>2018-02-05</discovery>
 <entry>2018-03-10</entry>
 </dates>
 </vuln>

<vuln vid="555af074-22b9-11e8-9799-54ee754af08e">
<topic>chromium -- vulnerability</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>65.0.3325.146</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Google Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html">
 45 security fixes in this release:
 <ul>
	 <li>[758848] High CVE-2017-11215: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25</li>
	 <li>[758863] High CVE-2017-11225: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25</li>
	 <li>[780919] High CVE-2018-6060: Use after free in Blink. Reported by Omair on 2017-11-02</li>
	 <li>[794091] High CVE-2018-6061: Race condition in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2017-12-12</li>
	 <li>[780104] High CVE-2018-6062: Heap buffer overflow in Skia. Reported by Anonymous on 2017-10-31</li>
	 <li>[789959] High CVE-2018-6057: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-11-30</li>
	 <li>[792900] High CVE-2018-6063: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-12-07</li>
	 <li>[798644] High CVE-2018-6064: Type confusion in V8. Reported by lokihardt of Google Project Zero on 2018-01-03</li>
	 <li>[808192] High CVE-2018-6065: Integer overflow in V8. Reported by Mark Brand of Google Project Zero on 2018-02-01</li>
	 <li>[799477] Medium CVE-2018-6066: Same Origin Bypass via canvas. Reported by Masato Kinugawa on 2018-01-05</li>
	 <li>[779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30</li>
	 <li>[779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30</li>
	 <li>[799918] Medium CVE-2018-6069: Stack buffer overflow in Skia. Reported by Wanglu and Yangkang(@dnpushme) of Qihoo360 Qex Team on 2018-01-08</li>
	 <li>[668645] Medium CVE-2018-6070: CSP bypass through extensions. Reported by Rob Wu on 2016-11-25</li>
	 <li>[777318] Medium CVE-2018-6071: Heap bufffer overflow in Skia. Reported by Anonymous on 2017-10-23</li>
	 <li>[791048] Medium CVE-2018-6072: Integer overflow in PDFium. Reported by Atte Kettunen of OUSPG on 2017-12-01</li>
	 <li>[804118] Medium CVE-2018-6073: Heap bufffer overflow in WebGL. Reported by Omair on 2018-01-20</li>
	 <li>[809759] Medium CVE-2018-6074: Mark-of-the-Web bypass. Reported by Abdulrahman Alqabandi (@qab) on 2018-02-06</li>
	 <li>[608669] Medium CVE-2018-6075: Overly permissive cross origin downloads. Reported by Inti De Ceukelaire (intigriti.com) on 2016-05-03</li>
	 <li>[758523] Medium CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink. Reported by Mateusz Krzeszowiec on 2017-08-24</li>
	 <li>[778506] Medium CVE-2018-6077: Timing attack using SVG filters. Reported by Khalil Zhani on 2017-10-26</li>
	 <li>[793628] Medium CVE-2018-6078: URL Spoof in OmniBox. Reported by Khalil Zhani on 2017-12-10</li>
	 <li>[788448] Medium CVE-2018-6079: Information disclosure via texture data in WebGL. Reported by Ivars Atteka on 2017-11-24</li>
	 <li>[792028] Medium CVE-2018-6080: Information disclosure in IPC call. Reported by Gal Beniamini of Google Project Zero on 2017-12-05</li>
	 <li>[797525] Low CVE-2018-6081: XSS in interstitials. Reported by Rob Wu on 2017-12-24</li>
	 <li>[767354] Low CVE-2018-6082: Circumvention of port blocking. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-09-21</li>
	 <li>[771709] Low CVE-2018-6083: Incorrect processing of AppManifests. Reported by Jun Kokatsu (@shhnjk) on 2017-10-04</li>
 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-11215</cvename>
 <cvename>CVE-2017-11225</cvename>
 <cvename>CVE-2018-6060</cvename>
 <cvename>CVE-2018-6061</cvename>
 <cvename>CVE-2018-6060</cvename>
 <cvename>CVE-2018-6061</cvename>
 <cvename>CVE-2018-6062</cvename>
 <cvename>CVE-2018-6057</cvename>
 <cvename>CVE-2018-6063</cvename>
 <cvename>CVE-2018-6064</cvename>
 <cvename>CVE-2018-6065</cvename>
 <cvename>CVE-2018-6066</cvename>
 <cvename>CVE-2018-6067</cvename>
 <cvename>CVE-2018-6069</cvename>
 <cvename>CVE-2018-6070</cvename>
 <cvename>CVE-2018-6071</cvename>
 <cvename>CVE-2018-6072</cvename>
 <cvename>CVE-2018-6073</cvename>
 <cvename>CVE-2018-6074</cvename>
 <cvename>CVE-2018-6075</cvename>
 <cvename>CVE-2018-6076</cvename>
 <cvename>CVE-2018-6077</cvename>
 <cvename>CVE-2018-6078</cvename>
 <cvename>CVE-2018-6079</cvename>
 <cvename>CVE-2018-6080</cvename>
 <cvename>CVE-2018-6081</cvename>
 <cvename>CVE-2018-6082</cvename>
 <cvename>CVE-2018-6083</cvename>
 <url>https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2016-05-03</discovery>
 <entry>2018-03-08</entry>
 </dates>
</vuln>

<vuln vid="c5ab620f-4576-4ad5-b51f-93e4fec9cd0e">
 <topic>wireshark -- multiple security issues</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
 </package>
 <package>
	<name>wireshark-lite</name>
	<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
 </package>
 <package>
	<name>wireshark-qt5</name>
	<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
 </package>
 <package>
	<name>tshark</name>
	<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
 </package>
 <package>
	<name>tshark-lite</name>
	<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wireshark developers reports:
	<blockquote cite="https://www.wireshark.org/security/">
	 wnpa-sec-2018-05. IEEE 802.11 dissector crash. (CVE-2018-7335)
	 wnpa-sec-2018-06. Large or infinite loops in multiple dissectors. (CVE-2018-7321 through CVE-2018-7333)
	 wnpa-sec-2018-07. UMTS MAC dissector crash. (CVE-2018-7334)
	 wnpa-sec-2018-08. DOCSIS dissector crash. (CVE-2018-7337)
	 wnpa-sec-2018-09. FCP dissector crash. (CVE-2018-7336)
	 wnpa-sec-2018-10. SIGCOMP dissector crash. (CVE-2018-7320)
	 wnpa-sec-2018-11. Pcapng file parser crash.
	 wnpa-sec-2018-12. IPMI dissector crash.
	 wnpa-sec-2018-13. SIGCOMP dissector crash.
	 wnpa-sec-2018-14. NBAP dissector crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.wireshark.org/security/</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2018-05.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2018-06.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2018-07.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2018-08.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2018-09.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2018-10.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2018-11.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2018-12.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2018-13.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2018-14.html</url>
 <cvename>CVE-2018-7320</cvename>
 <cvename>CVE-2018-7321</cvename>
 <cvename>CVE-2018-7322</cvename>
 <cvename>CVE-2018-7323</cvename>
 <cvename>CVE-2018-7324</cvename>
 <cvename>CVE-2018-7325</cvename>
 <cvename>CVE-2018-7326</cvename>
 <cvename>CVE-2018-7327</cvename>
 <cvename>CVE-2018-7328</cvename>
 <cvename>CVE-2018-7329</cvename>
 <cvename>CVE-2018-7330</cvename>
 <cvename>CVE-2018-7331</cvename>
 <cvename>CVE-2018-7332</cvename>
 <cvename>CVE-2018-7333</cvename>
 <cvename>CVE-2018-7334</cvename>
 <cvename>CVE-2018-7335</cvename>
 <cvename>CVE-2018-7336</cvename>
 <cvename>CVE-2018-7337</cvename>
 <cvename>CVE-2018-7417</cvename>
 </references>
 <dates>
 <discovery>2018-02-23</discovery>
 <entry>2018-03-04</entry>
 </dates>
 </vuln>

<vuln vid="2040c7f5-1e3a-11e8-8ae9-0050569f0b83">
 <topic>isc-dhcp -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>isc-dhcp44-server</name>
	<range><lt>4.4.1</lt></range>
 </package>
 <package>
	<name>isc-dhcp44-client</name>
	<range><lt>4.4.1</lt></range>
 </package>
 <package>
	<name>isc-dhcp43-server</name>
	<range><le>4.3.6</le></range>
 </package>
 <package>
	<name>isc-dhcp43-client</name>
	<range><le>4.3.6</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01565">
	 Failure to properly bounds check a buffer used for processing
	 DHCP options allows a malicious server (or an entity
	 masquerading as a server) to cause a buffer overflow (and
	 resulting crash) in dhclient by sending a response containing a
	 specially constructed options section.
	</blockquote>
	<blockquote cite="https://kb.isc.org/article/AA-01567">
	 A malicious client which is allowed to send very large amounts
	 of traffic (billions of packets) to a DHCP server can eventually
	 overflow a 32-bit reference counter, potentially causing dhcpd
	 to crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-5732</cvename>
 <cvename>CVE-2018-5733</cvename>
 <url>https://kb.isc.org/article/AA-01565</url>
 <url>https://kb.isc.org/article/AA-01567</url>
 </references>
 <dates>
 <discovery>2018-02-21</discovery>
 <entry>2018-03-02</entry>
 </dates>
 </vuln>

<vuln vid="30704aba-1da4-11e8-b6aa-4ccc6adda413">
 <topic>libsndfile -- out-of-bounds reads</topic>
 <affects>
 <package>
	<name>libsndfile</name>
	<name>linux-c6-libsndfile</name>
	<name>linux-c7-libsndfile</name>
	<range><lt>1.0.28_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Xin-Jiang on Github reports:
	<blockquote cite="https://github.com/erikd/libsndfile/issues/317">
	 CVE-2017-14245 (Medium): An out of bounds read in the function
	 d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote
	 DoS attack or information disclosure, related to mishandling of
	 the NAN and INFINITY floating-point values.
	 CVE-2017-14246 (Medium): An out of bounds read in the function
	 d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote
	 DoS attack or information disclosure, related to mishandling of the
	 NAN and INFINITY floating-point values.
	</blockquote>
	my123px on Github reports:
	<blockquote cite="https://github.com/erikd/libsndfile/issues/344">
	 CVE-2017-17456 (Medium): The function d2alaw_array() in alaw.c of
	 libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown
	 address 0x000000000000), a different vulnerability than CVE-2017-14245.
	 CVE-2017-17457 (Medium): The function d2ulaw_array() in ulaw.c of
	 libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown
	 address 0x000000000000), a different vulnerability than CVE-2017-14246.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-14245</cvename>
 <cvename>CVE-2017-14246</cvename>
 <url>https://github.com/erikd/libsndfile/issues/317</url>
 <cvename>CVE-2017-17456</cvename>
 <cvename>CVE-2017-17457</cvename>
 <url>https://github.com/erikd/libsndfile/issues/344</url>
 </references>
 <dates>
 <discovery>2017-09-11</discovery>
 <entry>2018-03-01</entry>
 </dates>
 </vuln>

<vuln vid="2b386075-1d9c-11e8-b6aa-4ccc6adda413">
 <topic>libsndfile -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libsndfile</name>
	<name>linux-c6-libsndfile</name>
	<name>linux-c7-libsndfile</name>
	<range><lt>1.0.28_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Agostino Sarubbo, Gentoo reports:
	<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-flac_buffer_copy-flac-c/">
	 CVE-2017-8361 (Medium): The flac_buffer_copy function in flac.c in
	 libsndfile 1.0.28 allows remote attackers to cause a denial of service
	 (buffer overflow and application crash) or possibly have unspecified
	 other impact via a crafted audio file.
	</blockquote>
	<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/">
	 CVE-2017-8362 (Medium): The flac_buffer_copy function in flac.c in
	 libsndfile 1.0.28 allows remote attackers to cause a denial of service
	 (invalid read and application crash) via a crafted audio file.
	</blockquote>
	<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/">
	 CVE-2017-8363 (Medium): The flac_buffer_copy function in flac.c in
	 libsndfile 1.0.28 allows remote attackers to cause a denial of service
	 (heap-based buffer over-read and application crash) via a crafted audio
	 file.
	</blockquote>
	<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-i2les_array-pcm-c/">
	 CVE-2017-8365 (Medium): The i2les_array function in pcm.c in libsndfile
	 1.0.28 allows remote attackers to cause a denial of service (buffer
	 over-read and application crash) via a crafted audio file.
	</blockquote>
	manxorist on Github reports:
	<blockquote cite="https://github.com/erikd/libsndfile/issues/292">
	 CVE-2017-12562 (High): Heap-based Buffer Overflow in the
	 psf_binheader_writef function in common.c in libsndfile through
	 1.0.28 allows remote attackers to cause a denial of service
	 (application crash) or possibly have unspecified other impact.
	</blockquote>
	Xin-Jiang on Github reports:
	<blockquote cite="https://github.com/erikd/libsndfile/issues/318">
	 CVE-2017-14634 (Medium): In libsndfile 1.0.28, a divide-by-zero
	 error exists in the function double64_init() in double64.c, which
	 may lead to DoS when playing a crafted audio file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-8361</cvename>
 <url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-flac_buffer_copy-flac-c/</url>
 <url>https://github.com/erikd/libsndfile/issues/232</url>
 <url>https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3</url>
 <cvename>CVE-2017-8362</cvename>
 <url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/</url>
 <url>https://github.com/erikd/libsndfile/issues/231</url>
 <url>https://github.com/erikd/libsndfile/commit/ef1dbb2df1c0e741486646de40bd638a9c4cd808</url>
 <cvename>CVE-2017-8363</cvename>
 <url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/</url>
 <url>https://github.com/erikd/libsndfile/issues/233</url>
 <url>https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3</url>
 <url>https://github.com/erikd/libsndfile/commit/cd7da8dbf6ee4310d21d9e44b385d6797160d9e8</url>
 <cvename>CVE-2017-8365</cvename>
 <url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-i2les_array-pcm-c/</url>
 <url>https://github.com/erikd/libsndfile/issues/230</url>
 <url>https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3</url>
 <cvename>CVE-2017-12562</cvename>
 <url>https://github.com/erikd/libsndfile/issues/292/</url>
 <url>https://github.com/erikd/libsndfile/commit/cf7a8182c2642c50f1cf90dddea9ce96a8bad2e8</url>
 <cvename>CVE-2017-14634</cvename>
 <url>https://github.com/erikd/libsndfile/issues/318</url>
 <url>https://github.com/erikd/libsndfile/commit/85c877d5072866aadbe8ed0c3e0590fbb5e16788</url>
 </references>
 <dates>
 <discovery>2017-04-12</discovery>
 <entry>2018-03-01</entry>
 </dates>
 </vuln>

<vuln vid="e3eeda2e-1d67-11e8-a2ec-6cc21735f730">
 <topic>PostgreSQL vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.22</lt></range>
 </package>
 <package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.17</lt></range>
 </package>
 <package>
	<name>postgresql95-server</name>
	<range><ge>9.5.0</ge><lt>9.5.12</lt></range>
 </package>
 <package>
	<name>postgresql96-server</name>
	<range><ge>9.6.0</ge><lt>9.6.8</lt></range>
 </package>
 <package>
	<name>postgresql10-server</name>
	<range><ge>10.0</ge><lt>10.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/about/news/1834/">
	 <ul>
	 <li>CVE-2018-1058: Uncontrolled search path element in pg_dump and other client applications</li>
	 </ul>
	 </blockquote>
 </body>
 </description>
 <references>
 <url>https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058:_Protect_Your_Search_Path</url>
 <cvename>CVE-2018-1058</cvename>
 </references>
 <dates>
 <discovery>2018-03-01</discovery>
 <entry>2018-03-01</entry>
 </dates>
 </vuln>

<vuln vid="6a449a37-1570-11e8-8e00-000c294a5758">
 <topic>strongswan - Insufficient input validation in RSASSA-PSS signature parser</topic>
 <affects>
 <package>
	<name>strongswan</name>
	<range><eq>5.6.1</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Strongswan Release Notes reports:
	<blockquote cite="https://github.com/strongswan/strongswan/blob/master/NEWS">
	 Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that
	 was caused by insufficient input validation. One of the configurable
	 parameters in algorithm identifier structures for RSASSA-PSS signatures is the
	 mask generation function (MGF). Only MGF1 is currently specified for this
	 purpose. However, this in turn takes itself a parameter that specifies the
	 underlying hash function. strongSwan's parser did not correctly handle the
	 case of this parameter being absent, causing an undefined data read.
	 his vulnerability has been registered as CVE-2018-6459.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6459</cvename>
 <url>https://github.com/strongswan/strongswan/commit/40da179f28b768ffcf6ff7e2f68675eb44806668</url>
 </references>
 <dates>
 <discovery>2018-01-31</discovery>
 <entry>2018-02-19</entry>
 </dates>
 </vuln>

<vuln vid="004debf9-1d16-11e8-b6aa-4ccc6adda413">
 <topic>libsndfile -- out-of-bounds read memory access</topic>
 <affects>
 <package>
	<name>libsndfile</name>
	<name>linux-c6-libsndfile</name>
	<name>linux-c7-libsndfile</name>
	<range><lt>1.0.28_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Laurent Delosieres, Secunia Research at Flexera Software reports:
	<blockquote cite="https://secuniaresearch.flexerasoftware.com/secunia_research/2017-13/">
	 Secunia Research has discovered a vulnerability in libsndfile, which can be
	 exploited by malicious people to disclose potentially sensitive information.
	 The vulnerability is caused due to an error in the "aiff_read_chanmap()" function
	 (src/aiff.c), which can be exploited to cause an out-of-bounds read memory access
	 via a specially crafted AIFF file. The vulnerability is confirmed in version 1.0.28.
	 Other versions may also be affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-6892</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-6892</url>
 <url>https://secuniaresearch.flexerasoftware.com/secunia_research/2017-13/</url>
 <url>https://github.com/erikd/libsndfile/commit/f833c53cb596e9e1792949f762e0b33661822748</url>
 </references>
 <dates>
 <discovery>2017-05-23</discovery>
 <entry>2018-03-01</entry>
 </dates>
 </vuln>

<vuln vid="af485ef4-1c58-11e8-8477-d05099c0ae8c">
 <topic>ntp -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.1</ge><lt>11.1_7</lt></range>
	<range><ge>10.4</ge><lt>10.4_6</lt></range>
	<range><ge>10.3</ge><lt>10.3_27</lt></range>
 </package>
 <package>
	<name>ntp</name>
	<range><lt>4.2.8p11</lt></range>
 </package>
 <package>
	<name>ntp-devel</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Network Time Foundation reports:
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S">
	 The NTP Project at Network Time Foundation is releasing ntp-4.2.8p11.
	 This release addresses five security issues in ntpd:
	 <ul>
	 <li>LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil
	 vulnerability: ephemeral association attack</li>
	 <li>INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909:
	 ctl_getitem(): buffer read overrun leads to undefined
	 behavior and information leak</li>
	 <li>LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple
	 authenticated ephemeral associations</li>
	 <li>LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved
	 symmetric mode cannot recover from bad state</li>
	 <li>LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909:
	 Unauthenticated packet can reset authenticated interleaved
	 association</li>
	 </ul>
	 one security issue in ntpq:
	 <ul>
	 <li>MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909:
	 ntpq:decodearr() can write beyond its buffer limit</li>
	 </ul>
	 and provides over 33 bugfixes and 32 other improvements.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1549</cvename>
 <cvename>CVE-2018-7182</cvename>
 <cvename>CVE-2018-7170</cvename>
 <cvename>CVE-2018-7184</cvename>
 <cvename>CVE-2018-7185</cvename>
 <cvename>CVE-2018-7183</cvename>
 <freebsdsa>SA-18:02.ntp</freebsdsa>
 <url>http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S</url>
 </references>
 <dates>
 <discovery>2018-02-27</discovery>
 <entry>2018-02-28</entry>
 <modified>2018-03-14</modified>
 </dates>
 </vuln>

<vuln vid="abfc932e-1ba8-11e8-a944-54ee754af08e">
 <topic>chromium -- vulnerability</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>64.0.3282.167</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Google Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2018/02/stable-channel-update-for-desktop_13.html">
	 1 security fix in this release:
	 <ul>
	 <li>[806388] High CVE-2018-6056: Incorrect derived class instantiation in V8. Reported by lokihardt of Google Project Zero on 2018-01-26</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6056</cvename>
 <url>https://chromereleases.googleblog.com/2018/02/stable-channel-update-for-desktop_13.html</url>
 </references>
 <dates>
 <discovery>2018-01-26</discovery>
 <entry>2018-02-27</entry>
 </dates>
 </vuln>

<vuln vid="8e986b2b-1baa-11e8-a944-54ee754af08e">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>chromium</name>
 <range><lt>64.0.3282.119</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Google Chrome Releases reports:
 <blockquote cite="https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html">
	 Several security fixes in this release, including:
	 <ul>
	 <li>[780450] High CVE-2018-6031: Use after free in PDFium. Reported by Anonymous on 2017-11-01</li>
	 <li>[787103] High CVE-2018-6032: Same origin bypass in Shared Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-20</li>
	 <li>[793620] High CVE-2018-6033: Race when opening downloaded files. Reported by Juho Nurminen on 2017-12-09</li>
	 <li>[784183] Medium CVE-2018-6034: Integer overflow in Blink. Reported by Tobias Klein (www.trapkit.de) on 2017-11-12</li>
	 <li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
	 <li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
	 <li>[753645] Medium CVE-2018-6037: Insufficient user gesture requirements in autofill. Reported by Paul Stone of Context Information Security on
 2017-08-09</li>
	 <li>[774174] Medium CVE-2018-6038: Heap buffer overflow in WebGL. Reported by cloudfuzzer on 2017-10-12</li>
	 <li>[775527] Medium CVE-2018-6039: XSS in DevTools. Reported by Juho Nurminen on 2017-10-17</li>
	 <li>[778658] Medium CVE-2018-6040: Content security policy bypass. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-26</li>
	 <li>[760342] Medium CVE-2018-6041: URL spoof in Navigation. Reported by Luan Herrera on 2017-08-29</li>
	 <li>[773930] Medium CVE-2018-6042: URL spoof in OmniBox. Reported by Khalil Zhani on 2017-10-12</li>
	 <li>[785809] Medium CVE-2018-6043: Insufficient escaping with external URL handlers. Reported by 0x09AL on 2017-11-16</li>
	 <li>[797497] Medium CVE-2018-6045: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
	 <li>[798163] Medium CVE-2018-6046: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-31</li>
	 <li>[799847] Medium CVE-2018-6047: Cross origin URL leak in WebGL. Reported by Masato Kinugawa on 2018-01-08</li>
	 <li>[763194] Low CVE-2018-6048: Referrer policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-09-08</li>
	 <li>[771848] Low CVE-2017-15420: URL spoofing in Omnibox. Reported by Drew Springall (@_aaspring_) on 2017-10-05</li>
	 <li>[774438] Low CVE-2018-6049: UI spoof in Permissions. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-13</li>
	 <li>[774842] Low CVE-2018-6050: URL spoof in OmniBox. Reported by Jonathan Kew on 2017-10-15</li>
	 <li>[441275] Low CVE-2018-6051: Referrer leak in XSS Auditor. Reported by Antonio Sanso (@asanso) on 2014-12-11</li>
	 <li>[615608] Low CVE-2018-6052: Incomplete no-referrer policy implementation. Reported by Tanner Emek on 2016-05-28</li>
	 <li>[758169] Low CVE-2018-6053: Leak of page thumbnails in New Tab Page. Reported by Asset Kabdenov on 2017-08-23</li>
	 <li>[797511] Low CVE-2018-6054: Use after free in WebUI. Reported by Rob Wu on 2017-12-24</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6031</cvename>
 <cvename>CVE-2018-6032</cvename>
 <cvename>CVE-2018-6033</cvename>
 <cvename>CVE-2018-6034</cvename>
 <cvename>CVE-2018-6035</cvename>
 <cvename>CVE-2018-6036</cvename>
 <cvename>CVE-2018-6037</cvename>
 <cvename>CVE-2018-6038</cvename>
 <cvename>CVE-2018-6039</cvename>
 <cvename>CVE-2018-6040</cvename>
 <cvename>CVE-2018-6041</cvename>
 <cvename>CVE-2018-6042</cvename>
 <cvename>CVE-2018-6043</cvename>
 <cvename>CVE-2018-6045</cvename>
 <cvename>CVE-2018-6046</cvename>
 <cvename>CVE-2018-6047</cvename>
 <cvename>CVE-2018-6048</cvename>
 <cvename>CVE-2017-15420</cvename>
 <cvename>CVE-2018-6049</cvename>
 <cvename>CVE-2018-6050</cvename>
 <cvename>CVE-2018-6051</cvename>
 <cvename>CVE-2018-6052</cvename>
 <cvename>CVE-2018-6053</cvename>
 <cvename>CVE-2018-6054</cvename>
 <url>https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html</url>
 </references>
 <dates>
 <discovery>2017-08-09</discovery>
 <entry>2018-02-27</entry>
 </dates>
 </vuln>

<vuln vid="55c4233e-1844-11e8-a712-0025908740c2">
 <topic>tomcat -- Security constraints ignored or applied too late</topic>
 <affects>
 <package>
 <name>tomcat</name>
 <range><ge>7.0.0</ge><le>7.0.84</le></range>
 <range><ge>8.0.0</ge><le>8.0.49</le></range>
 <range><ge>8.5.0</ge><le>8.5.27</le></range>
 <range><ge>9.0.0</ge><le>9.0.4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 The Apache Software Foundation reports:
 <blockquote cite="https://lists.apache.org/thread.html/d3354bb0a4eda4acc0a66f3eb24a213fdb75d12c7d16060b23e65781@%3Cannounce.tomcat.apache.org%3E">
 Security constraints defined by annotations of Servlets were only
 applied once a Servlet had been loaded. Because security constraints
 defined in this way apply to the URL pattern and any URLs below that
 point, it was possible - depending on the order Servlets were loaded -
 for some security constraints not to be applied. This could have exposed
 resources to users who were not authorised to access them.
 </blockquote>
 <blockquote cite="https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb@%3Cannounce.tomcat.apache.org%3E">
 The URL pattern of "" (the empty string) which exactly maps to the
 context root was not correctly handled when used as part of a security
 constraint definition. This caused the constraint to be ignored. It was,
 therefore, possible for unauthorised users to gain access to web
 application resources that should have been protected. Only security
 constraints with a URL pattern of the empty string were affected.
 </blockquote>
 </body>
 </description>
 <references>
 <url>http://tomcat.apache.org/security-9.html</url>
 <url>http://tomcat.apache.org/security-8.html</url>
 <url>http://tomcat.apache.org/security-7.html</url>
 <cvename>CVE-2018-1304</cvename>
 <cvename>CVE-2018-1305</cvename>
 </references>
 <dates>
 <discovery>2018-02-23</discovery>
 <entry>2018-02-23</entry>
 </dates>
 </vuln>

<vuln vid="22438240-1bd0-11e8-a2ec-6cc21735f730">
 <topic>shibboleth-sp -- vulnerable to forged user attribute data</topic>
 <affects>
 <package>
	<name>xmltooling</name>
	<range><lt>1.6.4</lt></range>
 </package>
 <package>
	<name>xerces-c3</name>
	<range><lt>3.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Shibboleth consortium reports:
	<blockquote cite="https://shibboleth.net/community/advisories/secadv_20180227.txt">
	 
	 Shibboleth SP software vulnerable to additional data forgery flaws
	 
	 
	 The XML processing performed by the Service Provider software has
	 been found to be vulnerable to new flaws similar in nature to the
	 one addressed in an advisory last month.
	 
	 
	 These bugs involve the use of other XML constructs rather than
	 entity references, and therefore required additional mitigation once
	 discovered. As with the previous issue, this flaw allows for
	 changes to an XML document that do not break a digital signature but
	 can alter the user data passed through to applications behind the SP
	 and result in impersonation attacks and exposure of protected
	 information.
	 
	 
	 As before, the use of XML Encryption is a significant mitigation,
	 but we have not dismissed the possibility that attacks on the
	 Response "envelope" may be possible, in both the original and this
	 new case. No actual attacks of this nature are known, so deployers
	 should prioritize patching systems that expect to handle unencrypted
	 SAML assertions.
	 
	 
	 An updated version of XMLTooling-C (V1.6.4) is available that
	 protects against these new attacks, and should help prevent similar
	 vulnerabilities in the future.
	 
	 
	 Unlike the previous case, these bugs are NOT prevented by any
	 existing Xerces-C parser version on any platform and cannot be
	 addressed by any means other than the updated XMLTooling-C library.
	 
	 
	 The Service Provider software relies on a generic XML parser to
	 process SAML responses and there are limitations in older versions
	 of the parser that make it impossible to fully disable Document Type
	 Definition (DTD) processing.
	 
	 
	 Through addition/manipulation of a DTD, it's possible to make
	 changes to an XML document that do not break a digital signature but
	 are mishandled by the SP and its libraries. These manipulations can
	 alter the user data passed through to applications behind the SP and
	 result in impersonation attacks and exposure of protected
	 information.
	 
	 
	 While newer versions of the xerces-c3 parser are configured by the
	 SP into disallowing the use of a DTD via an environment variable,
	 this feature is not present in the xerces-c3 parser before version
	 3.1.4, so an additional fix is being provided now that an actual DTD
	 exploit has been identified. Xerces-c3-3.1.4 was committed to the
	 ports tree already on 2016-07-26.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://shibboleth.net/community/advisories/secadv_20180227.txt</url>
 <cvename>CVE-2018-0489</cvename>
 </references>
 <dates>
 <discovery>2018-02-27</discovery>
 <entry>2018-02-27</entry>
 </dates>
 </vuln>

<vuln vid="57580fcc-1a61-11e8-97e0-00e04c1ea73d">
 <topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.56</lt></range>
 </package>
 <package>
	<name>drupal8</name>
	<range><lt>8.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/SA-CORE-2018-001">
	 CVE-2017-6926: Comment reply form allows access to restricted content
	 CVE-2017-6927: JavaScript cross-site scripting prevention is incomplete
	 CVE-2017-6928: Private file access bypass - Moderately Critical
	 CVE-2017-6929: jQuery vulnerability with untrusted domains - Moderately Critical
	 CVE-2017-6930: Language fallback can be incorrect on multilingual sites with node access restrictions
	 CVE-2017-6931: Settings Tray access bypass
	 CVE-2017-6932: External link injection on 404 pages when linking to the current page
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-6926</cvename>
 <cvename>CVE-2017-6927</cvename>
 <cvename>CVE-2017-6928</cvename>
 <cvename>CVE-2017-6929</cvename>
 <cvename>CVE-2017-6930</cvename>
 <cvename>CVE-2017-6931</cvename>
 <cvename>CVE-2017-6932</cvename>
 </references>
 <dates>
 <discovery>2018-02-21</discovery>
 <entry>2018-02-25</entry>
 </dates>
 </vuln>

<vuln vid="d9fe59ea-1940-11e8-9eb8-5404a68ad561">
 <topic>cvs -- Remote code execution via ssh command injection</topic>
 <affects>
 <package>
	<name>cvs</name>
	<range><lt>1.20120905_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hank Leininger reports:
	<blockquote cite="http://lists.nongnu.org/archive/html/bug-cvs/2017-08/msg00000.html">
	 Bugs in Git, Subversion, and Mercurial were just announced and patched
	 which allowed arbitrary local command execution if a malicious name was
	 used for the remote server, such as starting with - to pass options to
	 the ssh client:
	 git clone ssh://-oProxyCommand=some-command...
	 CVS has a similar problem with the -d option:
	 Tested vanilla CVS 1.12.13, and Gentoo CVS 1.12.12-r11.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.nongnu.org/archive/html/bug-cvs/2017-08/msg00000.html</url>
 <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871810#10</url>
 <cvename>CVE-2017-12836</cvename>
 <freebsdpr>ports/226088</freebsdpr>
 </references>
 <dates>
 <discovery>2017-08-10</discovery>
 <entry>2018-02-24</entry>
 </dates>
 </vuln>

<vuln vid="289269f1-0def-11e8-99b0-d017c2987f9a">
 <topic>LibreOffice -- Remote arbitrary file disclosure vulnerability via WEBSERVICE formula</topic>
 <affects>
 <package>
	<name>libreoffice</name>
	<range><lt>5.4.5</lt></range>
	<range><ge>6.0.0</ge><lt>6.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	LibreOffice reports:
	<blockquote cite="https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/">
	 LibreOffice Calc supports a WEBSERVICE function to obtain data by URL.
	 Vulnerable versions of LibreOffice allow WEBSERVICE to take a local file
	 URL (e.g file://) which can be used to inject local files into the
	 spreadsheet without warning the user. Subsequent formulas can operate on
	 that inserted data and construct a remote URL whose path leaks the local
	 data to a remote attacker.
	 In later versions of LibreOffice without this flaw, WEBSERVICE has now
	 been limited to accessing http and https URLs along with bringing
	 WEBSERVICE URLs under LibreOffice Calc's link management infrastructure.
	 Note: This vulnerability has been identified upstream
	 as CVE-2018-1055, but NVD/Mitre are advising it's a reservation
	 duplicate of CVE-2018-6871 which should be used instead.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/</url>
 <url>https://github.com/jollheef/libreoffice-remote-arbitrary-file-disclosure</url>
 <cvename>CVE-2018-6871</cvename>
 <freebsdpr>ports/225797</freebsdpr>
 </references>
 <dates>
 <discovery>2018-02-09</discovery>
 <entry>2018-02-23</entry>
 </dates>
 </vuln>

<vuln vid="d5b6d151-1887-11e8-94f7-9c5c8e75236a">
 <topic>squid -- Vulnerable to Denial of Service attack</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>3.5.27_3</lt></range>
 </package>
 <package>
	<name>squid-devel</name>
	<range><lt>4.0.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Louis Dion-Marcil reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2018_1.txt">
	 Due to incorrect pointer handling Squid is vulnerable to denial
	 of service attack when processing ESI responses.
	 This problem allows a remote server delivering certain ESI
	 response syntax to trigger a denial of service for all clients
	 accessing the Squid service.
	 Due to unrelated changes Squid-3.5 has become vulnerable to some
	 regular ESI server responses also triggering this issue.
	 This problem is limited to the Squid custom ESI parser.
	 Squid built to use libxml2 or libexpat XML parsers do not have
	 this problem.
	</blockquote>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2018_2.txt">
	 Due to incorrect pointer handling Squid is vulnerable to denial
	 of service attack when processing ESI responses or downloading
	 intermediate CA certificates.
	 This problem allows a remote client delivering certain HTTP
	 requests in conjunction with certain trusted server responses to
	 trigger a denial of service for all clients accessing the Squid
	 service.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.squid-cache.org/Advisories/SQUID-2018_1.txt</url>
 <url>http://www.squid-cache.org/Advisories/SQUID-2018_2.txt</url>
 <cvename>CVE-2018-1000024</cvename>
 <cvename>CVE-2018-1000027</cvename>
 <url>https://www.debian.org/security/2018/dsa-4122</url>
 <freebsdpr>ports/226138</freebsdpr>
 </references>
 <dates>
 <discovery>2017-12-13</discovery>
 <entry>2018-02-23</entry>
 </dates>
 </vuln>

<vuln vid="933654ce-17b8-11e8-90b8-001999f8d30b">
 <topic>asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.19.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 AST-2018-004 - When processing a SUBSCRIBE request the
	 res_pjsip_pubsub module stores the accepted formats present
	 in the Accept headers of the request. This code did not
	 limit the number of headers it processed despite having
	 a fixed limit of 32. If more than 32 Accept headers were
	 present the code would write outside of its memory and
	 cause a crash.
	 AST-2018-005 - A crash occurs when a number of
	 authenticated INVITE messages are sent over TCP or TLS
	 and then the connection is suddenly closed. This issue
	 leads to a segmentation fault.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2018-004.html</url>
 <cvename>CVE-2018-7284</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2018-005.html</url>
 <cvename>CVE-2018-7286</cvename>
 </references>
 <dates>
 <discovery>2018-02-21</discovery>
 <entry>2018-02-22</entry>
 <modified>2018-06-12</modified>
 </dates>
 </vuln>

<vuln vid="f9f5c5a2-17b5-11e8-90b8-001999f8d30b">
 <topic>asterisk and pjsip -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.19.2</lt></range>
 </package>
 <package>
	<name>pjsip</name>
	<range><lt>2.7.2</lt></range>
 </package>
 <package>
	<name>pjsip-extsrtp</name>
	<range><lt>2.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 AST-2018-002 - By crafting an SDP message with an
	 invalid media format description Asterisk crashes when
	 using the pjsip channel driver because pjproject's sdp
	 parsing algorithm fails to catch the invalid media format
	 description.
	 AST-2018-003 - By crafting an SDP message body with
	 an invalid fmtp attribute Asterisk crashes when using the
	 pjsip channel driver because pjproject's fmtp retrieval
	 function fails to check if fmtp value is empty (set empty
	 if previously parsed as invalid).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2018-002.html</url>
 <url>https://downloads.asterisk.org/pub/security/AST-2018-003.html</url>
 </references>
 <dates>
 <discovery>2018-02-21</discovery>
 <entry>2018-02-22</entry>
 </dates>
 </vuln>

<vuln vid="261ca31c-179f-11e8-b8b9-6805ca0b3d42">
 <topic>phpMyAdmin -- self XSS in central columns feature</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.7.0</ge><lt>4.7.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-1/">
	 <h3>Summary</h3>
	 Self XSS in central columns feature
	 <h3>Description</h3>
	 A self-cross site scripting (XSS) vulnerability has been
	 reported relating to the central columns feature.
	 <h3>Severity</h3>
	 We consider this vulnerability to be of moderate severity.
	 <h3>Mitigation factor</h3>
	 A valid token must be used in the attack
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2018-1/</url>
 <cvename>CVE-2018-7260</cvename>
 </references>
 <dates>
 <discovery>2018-02-21</discovery>
 <entry>2018-02-22</entry>
 </dates>
 </vuln>

<vuln vid="86291013-16e6-11e8-ae9f-d43d7e971a1b">
 <topic>GitLab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab</name>
	<range><ge>6.1.0</ge><le>10.2.7</le></range>
 <range><ge>10.3.0</ge><le>10.3.6</le></range>
 <range><ge>10.4.0</ge><le>10.4.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab reports:
	<blockquote cite="https://about.gitlab.com/2018/02/07/gitlab-security-10-4-3-plus-10-3-7-plus-10-2-8-blog/">
 <h1>SnippetFinder information disclosure</h1>
	 The GitLab SnippetFinder component contained an information disclosure
	 which allowed access to snippets restricted to Only team members or
	 configured as disabled. The issue is now resolved in the latest version.
 <h1>LDAP API authorization issue</h1>
 An LDAP API endpoint contained an authorization vulnerability which
 unintentionally disclosed bulk LDAP groups data. This issue is now fixed in
 the latest release.
 <h1>Persistent XSS mermaid markdown</h1>
 The mermaid markdown feature contained a persistent XSS issue that is now
 resolved in the latest release.
 <h1>Insecure direct object reference Todo API</h1>
 The Todo API was vulnerable to an insecure direct object reference issue
 which resulted in an information disclosure of confidential data.
 <h1>GitHub import access control issue</h1>
 An improper access control weakness issue was discovered in the GitHub
 import feature. The issue allowed an attacker to create projects under other
 accounts which they shouldn't have access to. The issue is now resolved in
 the latest version.
 <h1>Protected variables information disclosure</h1>
 The CI jobs protected tag feature contained a vulnerability which
 resulted in an information disclosure of protected variables. The issue is
 now resolved in the latest release.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2018/02/07/gitlab-security-10-4-3-plus-10-3-7-plus-10-2-8-blog/</url>
 </references>
 <dates>
 <discovery>2018-02-07</discovery>
 <entry>2018-02-21</entry>
 </dates>
 </vuln>

<vuln vid="7afc5e56-156d-11e8-95f2-005056925db4">
 <topic>irssi -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>irssi</name>
	<range><lt>1.1.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Irssi reports:
	<blockquote cite="https://irssi.org/security/irssi_sa_2018_02.txt">
	 Use after free when server is disconnected during netsplits.
	 Found by Joseph Bisch.
	 Use after free when SASL messages are received in unexpected order.
	 Found by Joseph Bisch.
	 Null pointer dereference when an “empty” nick has been observed by
	 Irssi. Found by Joseph Bisch.
	 When the number of windows exceed the available space, Irssi would
	 crash due to Null pointer dereference. Found by Joseph Bisch.
	 Certain nick names could result in out of bounds access when printing
	 theme strings. Found by Oss-Fuzz.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://irssi.org/security/irssi_sa_2018_02.txt</url>
 <cvename>CVE-2018-7054</cvename>
 <cvename>CVE-2018-7053</cvename>
 <cvename>CVE-2018-7052</cvename>
 <cvename>CVE-2018-7051</cvename>
 <cvename>CVE-2018-7050</cvename>
 <freebsdpr>ports/226001</freebsdpr>
 </references>
 <dates>
 <discovery>2018-02-15</discovery>
 <entry>2018-02-19</entry>
 <modified>2018-02-22</modified>
 </dates>
 </vuln>

<vuln vid="a183acb5-1414-11e8-9542-002590acae31">
 <topic>p5-Mojolicious -- cookie-handling vulnerability</topic>
 <affects>
 <package>
	<name>p5-Mojolicious</name>
	<range><lt>7.66</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Upstream commit:
	<blockquote cite="https://github.com/kraih/mojo/commit/c16a56a9d6575ddc53d15e76d58f0ebcb0eeb149">
	 Vulnerabilities existed in cookie handling.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/kraih/mojo/issues/1185</url>
 </references>
 <dates>
 <discovery>2018-01-31</discovery>
 <entry>2018-02-17</entry>
 </dates>
 </vuln>

<vuln vid="22283b8c-13c5-11e8-a861-20cf30e32f6d">
 <topic>Bugzilla security issues</topic>
 <affects>
 <package>
	<name>bugzilla44</name>
	<range><lt>4.4.13</lt></range>
 </package>
 <package>
	<name>bugzilla50</name>
	<range><lt>5.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bugzilla Security Advisory
	<blockquote cite="https://www.bugzilla.org/security/4.4.12/">
	A CSRF vulnerability in report.cgi would allow a third-party site
	 to extract confidential information from a bug the victim had access to.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-5123</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1433400</url>
 </references>
 <dates>
 <discovery>2018-02-16</discovery>
 <entry>2018-02-16</entry>
 </dates>
 </vuln>

<vuln vid="044cff62-ed8b-4e72-b102-18a7d58a669f">
 <topic>bro -- integer overflow allows remote DOS</topic>
 <affects>
 <package>
	<name>bro</name>
	<range><lt>2.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Philippe Antoine of Catena cyber:
	<blockquote cite="http://blog.bro.org/2018/02/bro-253-released-security-update.html">
	 This is a security release that fixes an integer overflow in code generated by binpac. This issue can be used by remote attackers to crash Bro (i.e. a DoS attack). There also is a possibility this can be exploited in other ways. (CVE pending.)
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.bro.org/2018/02/bro-253-released-security-update.html</url>
 </references>
 <dates>
 <discovery>2018-02-14</discovery>
 <entry>2018-02-16</entry>
 </dates>
 </vuln>

<vuln vid="ad2eeab6-ca68-4f06-9325-1937b237df60">
 <topic>consul -- vulnerability in embedded DNS library</topic>
 <affects>
 <package>
	<name>consul</name>
	<range><lt>1.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Consul developers report:
	<blockquote cite="https://github.com/hashicorp/consul/issues/3859">
	 A flaw was found in the embedded DNS library used in consul which
	 may allow a denial of service attack. Consul was updated to include
	 the fixed version.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/hashicorp/consul/issues/3859</url>
 <url>https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#105-february-7-2018</url>
 <url>https://github.com/miekg/dns/pull/631</url>
 <url>https://github.com/miekg/dns/issues/627</url>
 <cvename>CVE-2017-15133</cvename>
 </references>
 <dates>
 <discovery>2018-01-17</discovery>
 <entry>2018-02-16</entry>
 </dates>
 </vuln>

<vuln vid="746d04dc-507e-4450-911f-4c41e48bb07a">
 <topic>bro -- out of bounds write allows remote DOS</topic>
 <affects>
 <package>
	<name>bro</name>
	<range><lt>2.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Frank Meier:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000458">
	 Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service (crash) and possibly other exploitation.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.bro.org/2017/10/bro-252-242-release-security-update.html</url>
 </references>
 <dates>
 <discovery>2017-10-16</discovery>
 <entry>2018-02-16</entry>
 </dates>
 </vuln>

<vuln vid="e15a22ce-f16f-446b-9ca7-6859350c2e75">
 <topic>quagga -- several security issues</topic>
 <affects>
 <package>
	<name>quagga</name>
	<range><lt>1.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Quagga reports:
	<blockquote cite="https://www.quagga.net/security/Quagga-2018-0543.txt">
	 The Quagga BGP daemon, bgpd, does not properly bounds
	 check the data sent with a NOTIFY to a peer, if an attribute
	 length is invalid. Arbitrary data from the bgpd process
	 may be sent over the network to a peer and/or it may crash.
	</blockquote>
	<blockquote cite="https://www.quagga.net/security/Quagga-2018-1114.txt">
	 The Quagga BGP daemon, bgpd, can double-free memory
	 when processing certain forms of UPDATE message, containing
	 cluster-list and/or unknown attributes.
	</blockquote>
	<blockquote cite="https://www.quagga.net/security/Quagga-2018-1550.txt">
	 The Quagga BGP daemon, bgpd, can overrun internal BGP
	 code-to-string conversion tables used for debug by 1
	 pointer value, based on input.
	</blockquote>
	<blockquote cite="https://www.quagga.net/security/Quagga-2018-1975.txt">
	 The Quagga BGP daemon, bgpd, can enter an infinite
	 loop if sent an invalid OPEN message by a configured peer.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.quagga.net/security/Quagga-2018-0543.txt</url>
 <url>https://www.quagga.net/security/Quagga-2018-1114.txt</url>
 <url>https://www.quagga.net/security/Quagga-2018-1550.txt</url>
 <url>https://www.quagga.net/security/Quagga-2018-1975.txt</url>
 <cvename>CVE-2018-5378</cvename>
 <cvename>CVE-2018-5379</cvename>
 <cvename>CVE-2018-5380</cvename>
 <cvename>CVE-2018-5381</cvename>
 </references>
 <dates>
 <discovery>2018-01-31</discovery>
 <entry>2018-02-15</entry>
 </dates>
 </vuln>

<vuln vid="6f0b0cbf-1274-11e8-8b5b-4ccc6adda413">
 <topic>libraw -- multiple DoS vulnerabilities</topic>
 <affects>
 <package>
 <name>libraw</name>
 <range><lt>0.18.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Secunia Research reports:
 <blockquote cite="https://www.securityfocus.com/archive/1/541732">
 CVE-2018-5800: An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()"
	 function (internal/dcraw_common.cpp) can be exploited to cause a heap-based
	 buffer overflow and subsequently cause a crash.
 CVE-2017-5801: An error within the "LibRaw::unpack()" function
	 (src/libraw_cxx.cpp) can be exploited to trigger a NULL pointer dereference.
 CVE-2017-5802: An error within the "kodak_radc_load_raw()" function
	 (internal/dcraw_common.cpp) related to the "buf" variable can be exploited
	 to cause an out-of-bounds read memory access and subsequently cause a crash.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://www.securityfocus.com/archive/1/541732</url>
 <cvename>CVE-2018-5800</cvename>
 <cvename>CVE-2018-5801</cvename>
 <cvename>CVE-2018-5802</cvename>
 </references>
 <dates>
 <discovery>2018-01-16</discovery>
 <entry>2018-02-15</entry>
 </dates>
 </vuln>

<vuln vid="c60804f1-126f-11e8-8b5b-4ccc6adda413">
 <topic>libraw -- multiple DoS vulnerabilities</topic>
 <affects>
 <package>
 <name>libraw</name>
 <range><lt>0.18.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Secunia Research reports:
 <blockquote cite="https://www.securityfocus.com/archive/1/541583">
 CVE-2017-16909: An error related to the "LibRaw::panasonic_load_raw()"
	 function (dcraw_common.cpp) can be exploited to cause a heap-based buffer
	 overflow and subsequently cause a crash via a specially crafted TIFF image.
 CVE-2017-16910: An error within the "LibRaw::xtrans_interpolate()" function
	 (internal/dcraw_common.cpp) can be exploited to cause an invalid read
	 memory access.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://www.securityfocus.com/archive/1/541583</url>
 <cvename>CVE-2017-16909</cvename>
 <cvename>CVE-2017-16910</cvename>
 </references>
 <dates>
 <discovery>2017-12-04</discovery>
 <entry>2018-02-15</entry>
 </dates>
 </vuln>

<vuln vid="1a75c84a-11c8-11e8-83e7-485b3931c969">
 <topic>bitmessage -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>bitmessage</name>
	<range><le>0.6.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bitmessage developers report:
	<blockquote cite="https://github.com/Bitmessage/PyBitmessage/releases/tag/v0.6.3">
	 A remote code execution vulnerability has been spotted in use
	 against some users running PyBitmessage v0.6.2. The cause was
	 identified and a fix has been added and released as 0.6.3.2. (Will be
	 updated if/when CVE will be available.)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/Bitmessage/PyBitmessage/releases/tag/v0.6.3</url>
 <url>https://bitmessage.org/wiki/Main_Page</url>
 </references>
 <dates>
 <discovery>2018-02-13</discovery>
 <entry>2018-02-14</entry>
 </dates>
 </vuln>

<vuln vid="5d374fbb-bae3-45db-afc0-795684ac7353">
 <topic>jenkins -- Path traversal vulnerability allows access to files outside plugin resources</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><le>2.106</le></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><le>2.89.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins developers report:
	<blockquote cite="https://jenkins.io/security/advisory/2018-02-14/">
	 Jenkins did not properly prevent specifying relative paths that
	 escape a base directory for URLs accessing plugin resource files. This
	 allowed users with Overall/Read permission to download files from the
	 Jenkins master they should not have access to.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://jenkins.io/security/advisory/2018-02-14/</url>
 <url>https://jenkins.io/blog/2018/02/14/security-updates/</url>
 <cvename>CVE-2018-6356</cvename>
 </references>
 <dates>
 <discovery>2018-02-14</discovery>
 <entry>2018-02-14</entry>
 </dates>
 </vuln>

<vuln vid="279f682c-0e9e-11e8-83e7-485b3931c969">
 <topic>bchunk -- access violation near NULL on destination operand and crash</topic>
 <affects>
 <package>
	<name>bchunk</name>
	<range><ge>1.2.0</ge><le>1.2.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15955">
	 bchunk 1.2.0 and 1.2.1 is vulnerable to an "Access violation near
	 NULL on destination operand" and crash when processing a malformed CUE
	 (.cue) file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-15955</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-15955</url>
 </references>
 <dates>
 <discovery>2017-10-28</discovery>
 <entry>2018-02-13</entry>
 </dates>
 </vuln>

<vuln vid="8ba2819c-0e9d-11e8-83e7-485b3931c969">
 <topic>bchunk -- heap-based buffer overflow (with invalid free) and crash</topic>
 <affects>
 <package>
	<name>bchunk</name>
	<range><ge>1.2.0</ge><le>1.2.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15954">
	 bchunk 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer
	 overflow (with a resultant invalid free) and crash when processing a
	 malformed CUE (.cue) file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-15954</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-15954</url>
 </references>
 <dates>
 <discovery>2017-10-28</discovery>
 <entry>2018-02-13</entry>
 </dates>
 </vuln>

<vuln vid="1ec1c59b-0e98-11e8-83e7-485b3931c969">
 <topic>bchunk -- heap-based buffer overflow and crash</topic>
 <affects>
 <package>
	<name>bchunk</name>
	<range><ge>1.2.0</ge><le>1.2.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15953">
	 bchunk 1.2.0 and 1.2.1 vulnerable to a heap-based buffer overflow
	 and crash when processing a malformed CUE (.cue) file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-15953</cvename>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-15953</url>
 </references>
 <dates>
 <discovery>2017-10-28</discovery>
 <entry>2018-02-13</entry>
 </dates>
 </vuln>

<vuln vid="a8f25565-109e-11e8-8d41-97657151f8c2">
 <topic>uwsgi -- a stack-based buffer overflow</topic>
 <affects>
 <package>
	<name>uwsgi</name>
	<range><lt>2.0.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Uwsgi developers report:
	<blockquote cite="http://lists.unbit.it/pipermail/uwsgi/2018-February/008835.html">
	 It was discovered that the uwsgi_expand_path function in utils.c in
	 Unbit uWSGI, an application container server, has a stack-based buffer
	 overflow via a large directory length that can cause a
	 denial-of-service (application crash) or stack corruption.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.unbit.it/pipermail/uwsgi/2018-February/008835.html</url>
 <url>https://lists.debian.org/debian-lts-announce/2018/02/msg00010.html</url>
 <cvename>CVE-2018-6758</cvename>
 </references>
 <dates>
 <discovery>2018-02-06</discovery>
 <entry>2018-02-13</entry>
 </dates>
 </vuln>

<vuln vid="0fe70bcd-2ce3-46c9-a64b-4a7da097db07">
 <topic>python -- possible integer overflow vulnerability</topic>
 <affects>
 <package>
	<name>python34</name>
	<range><lt>3.4.8</lt></range>
 </package>
 <package>
	<name>python35</name>
	<range><lt>3.5.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Python issue:
	<blockquote cite="https://bugs.python.org/issue30657">
	 There is a possible integer overflow in PyString_DecodeEscape
	 function of the file stringobject.c, which can be abused to gain
	 a heap overflow, possibly leading to arbitrary code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.python.org/issue30657</url>
 <url>https://docs.python.org/3.4/whatsnew/changelog.html</url>
 <url>https://docs.python.org/3.5/whatsnew/changelog.html</url>
 <cvename>CVE-2017-1000158</cvename>
 </references>
 <dates>
 <discovery>2017-06-03</discovery>
 <entry>2018-02-11</entry>
 </dates>
 </vuln>

<vuln vid="aa743ee4-0f16-11e8-8fd2-10bf48e1088e">
 <topic>electrum -- JSONRPC vulnerability</topic>
 <affects>
 <package>
	<name>electrum-py36</name>
	<range><ge>2.6</ge><lt>3.0.5</lt></range>
 </package>
 <package>
	<name>electrum2</name>
	<range><ge>2.6</ge><lt>3.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6353">
	 JSONRPC vulnerability
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-6353</cvename>
 <url>https://github.com/spesmilo/electrum-docs/blob/master/cve.rst</url>
 <url>https://bitcointalk.org/index.php?topic=2702103.0</url>
 </references>
 <dates>
 <discovery>2018-01-27</discovery>
 <entry>2018-02-11</entry>
 </dates>
 </vuln>

<vuln vid="e4dd787e-0ea9-11e8-95f2-005056925db4">
 <topic>libtorrent -- remote DoS</topic>
 <affects>
 <package>
	<name>libtorrent</name>
	<range><lt>0.13.6_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	X-cela reports:
	<blockquote cite="https://github.com/rakshasa/libtorrent/pull/99">
	 Calls into build_benocde that use %zu could crash on 64 bit
	 machines due to the size change of size_t. Someone can force
	 READ_ENC_IA to fail allowing an internal_error to be thrown
	 and bring down the client.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/rakshasa/libtorrent/pull/99</url>
 <freebsdpr>ports/224664</freebsdpr>
 </references>
 <dates>
 <discovery>2015-12-01</discovery>
 <entry>2018-02-10</entry>
 </dates>
 </vuln>

<vuln vid="316b3c3e-0e98-11e8-8d41-97657151f8c2">
 <topic>exim -- a buffer overflow vulnerability, remote code execution</topic>
 <affects>
 <package>
	<name>exim</name>
	<range><lt>4.90.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Exim developers report:
	<blockquote cite="https://exim.org/static/doc/security/CVE-2018-6789.txt">
	 There is a buffer overflow in base64d(), if some pre-conditions are met.
Using a handcrafted message, remote code execution seems to be possible.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://exim.org/static/doc/security/CVE-2018-6789.txt</url>
 </references>
 <dates>
 <discovery>2018-02-05</discovery>
 <entry>2018-02-10</entry>
 </dates>
 </vuln>

<vuln vid="7a2e0063-0e4e-11e8-94c0-5453ed2e2b49">
 <topic>p7zip-codec-rar -- insufficient error handling</topic>
 <affects>
 <package>
	<name>p7zip-codec-rar</name>
	<range><lt>16.02_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5996">
	 Insufficient exception handling in the method
	 NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip
	 can lead to multiple memory corruptions within the PPMd code,
	 alows remote attackers to cause a denial of service (segmentation
	 fault) or execute arbitrary code via a crafted RAR archive.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-5996</cvename>
 <url>https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5996</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2018-5996</url>
 </references>
 <dates>
 <discovery>2018-01-23</discovery>
 <entry>2018-02-10</entry>
 </dates>
 </vuln>

<vuln vid="6d337396-0e4a-11e8-94c0-5453ed2e2b49">
 <topic>p7zip -- heap-based buffer overflow</topic>
 <affects>
 <package>
	<name>p7zip</name>
	<range><lt>16.02_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17969">
	 Heap-based buffer overflow in the
	 NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before
	 18.00 and p7zip allows remote attackers to cause a denial of
	 service (out-of-bounds write) or potentially execute arbitrary
	 code via a crafted ZIP archive.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-17969</cvename>
 <url>https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17969</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-17969</url>
 <url>https://marc.info/?l=bugtraq&amp;=151782582216805&amp;=2</url>
 </references>
 <dates>
 <discovery>2018-01-23</discovery>
 <entry>2018-02-10</entry>
 </dates>
 </vuln>

<vuln vid="3ee6e521-0d32-11e8-99b0-d017c2987f9a">
 <topic>mpv -- arbitrary code execution via crafted website</topic>
 <affects>
 <package>
	<name>mpv</name>
	<range><lt>0.27.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mpv developers report:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6360">
	 mpv through 0.28.0 allows remote attackers to execute arbitrary code
	 via a crafted web site, because it reads HTML documents containing
	 VIDEO elements, and accepts arbitrary URLs in a src attribute without
	 a protocol whitelist in player/lua/ytdl_hook.lua. For example, an
	 av://lavfi:ladspa=file= URL signifies that the product should call
	 dlopen on a shared object file located at an arbitrary local pathname.
	 The issue exists because the product does not consider that youtube-dl
	 can provide a potentially unsafe URL.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/mpv-player/mpv/issues/5456</url>
 <cvename>CVE-2018-6360</cvename>
 </references>
 <dates>
 <discovery>2018-01-28</discovery>
 <entry>2018-02-09</entry>
 <modified>2018-02-11</modified>
 </dates>
 </vuln>

<vuln vid="3d0eeef8-0cf9-11e8-99b0-d017c2987f9a">
 <topic>Mailman -- Cross-site scripting (XSS) vulnerability in the web UI</topic>
 <affects>
 <package>
	<name>mailman</name>
	<range><lt>2.1.26</lt></range>
 </package>
 <package>
	<name>mailman-with-htdig</name>
	<range><lt>2.1.26</lt></range>
 </package>
 <package>
	<name>ja-mailman</name>
	<range><le>2.1.14.j7_3,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mark Sapiro reports:
	<blockquote cite="https://www.mail-archive.com/mailman-users@python.org/msg70478.html">
	 An XSS vulnerability in the user options CGI could allow a crafted URL
	 to execute arbitrary javascript in a user's browser. A related issue
	 could expose information on a user's options page without requiring
	 login.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.mail-archive.com/mailman-users@python.org/msg70478.html</url>
 <cvename>CVE-2018-5950</cvename>
 </references>
 <dates>
 <discovery>2018-01-20</discovery>
 <entry>2018-02-08</entry>
 </dates>
 </vuln>

<vuln vid="c602c791-0cf4-11e8-a2ec-6cc21735f730">
 <topic>PostgreSQL vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.21</lt></range>
 </package>
 <package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.16</lt></range>
 </package>
 <package>
	<name>postgresql95-server</name>
	<range><ge>9.5.0</ge><lt>9.5.11</lt></range>
 </package>
 <package>
	<name>postgresql96-server</name>
	<range><ge>9.6.0</ge><lt>9.6.7</lt></range>
 </package>
 <package>
	<name>postgresql10-server</name>
	<range><ge>10.0</ge><lt>10.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/about/news/1829/">
	 <ul>
	 <li>CVE-2018-1052: Fix the processing of partition keys containing multiple expressions (only for PostgreSQL-10.x)</li>
	 <li>CVE-2018-1053: Ensure that all temporary files made with "pg_upgrade" are non-world-readable</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-1052</cvename>
 <cvename>CVE-2018-1053</cvename>
 </references>
 <dates>
 <discovery>2018-02-05</discovery>
 <entry>2018-02-08</entry>
 </dates>
 </vuln>

<vuln vid="b38e8150-0535-11e8-96ab-0800271d4b9c">
 <topic>tiff -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>tiff</name>
 <range><le>4.0.9</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Debian Security Advisory reports:
 <blockquote cite="https://www.debian.org/security/2018/dsa-4100">
	Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-9935</cvename>
 <url>http://bugzilla.maptools.org/show_bug.cgi?id=2704</url>
 <cvename>CVE-2017-18013</cvename>
 <url>http://bugzilla.maptools.org/show_bug.cgi?id=2770</url>
 <bid>225544</bid>
 </references>
 <dates>
 <discovery>2017-06-22</discovery>
 <entry>2018-01-29</entry>
 </dates>
 </vuln>

<vuln vid="756a8631-0b84-11e8-a986-6451062f0f7a">
 <topic>Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>28.0.0.161</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-03.html">
	 <ul>
	 <li>This update resolves use-after-free vulnerabilities that
	 could lead to remote code execution (CVE-2018-4877,
	 CVE-2018-4878).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-4877</cvename>
 <cvename>CVE-2018-4878</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsa18-01.html</url>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb18-03.html</url>
 </references>
 <dates>
 <discovery>2018-01-31</discovery>
 <entry>2018-02-06</entry>
 </dates>
 </vuln>

<vuln vid="f5524753-67b1-4c88-8114-29c2d258b383">
 <topic>mini_httpd,thttpd -- Buffer overflow in htpasswd</topic>
 <affects>
 <package>
	<name>mini_httpd</name>
	<range><lt>1.28</lt></range>
 </package>
 <package>
	<name>thttpd</name>
	<range><lt>2.28</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Alessio Santoru reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17663">
	 Buffer overflow in htpasswd.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://acme.com/updates/archive/199.html</url>
 </references>
 <dates>
 <discovery>2017-12-13</discovery>
 <entry>2018-02-06</entry>
 </dates>
 </vuln>

<vuln vid="3746de31-0a1a-11e8-83e7-485b3931c969">
 <topic>shadowsocks-libev -- command injection via shell metacharacters</topic>
 <affects>
 <package>
	<name>shadowsocks-libev</name>
	<range><ge>3.1.0</ge><lt>3.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15924">
	 Improper parsing allows command injection via shell metacharacters in
	 a JSON configuration request received via 127.0.0.1 UDP traffic.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-15924</url>
 </references>
 <dates>
 <discovery>2017-10-27</discovery>
 <entry>2018-02-05</entry>
 </dates>
 </vuln>

<vuln vid="5044bd23-08cb-11e8-b08f-00012e582166">
 <topic>palemoon -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>palemoon</name>
	<range><lt>27.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pale Moon reports:
	<blockquote cite="http://www.palemoon.org/releasenotes.shtml">
	 CVE-2018-5102: Use-after-free in HTML media elements
	 CVE-2018-5122: Potential integer overflow in DoCrypt
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-5102</cvename>
 <cvename>CVE-2018-5122</cvename>
 </references>
 <dates>
 <discovery>2018-01-23</discovery>
 <entry>2018-02-03</entry>
 </dates>
 </vuln>

<vuln vid="d696473f-9f32-42c5-a106-bf4536fb1f74">
 <topic>Django -- information leakage</topic>
 <affects>
 <package>
	<name>py27-django111</name>
	<name>py34-django111</name>
	<name>py35-django111</name>
	<name>py36-django111</name>
	<range><lt>1.11.10</lt></range>
 </package>
 <package>
	<name>py27-django20</name>
	<name>py34-django20</name>
	<name>py35-django20</name>
	<name>py36-django20</name>
	<range><lt>2.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django release notes:
	<blockquote cite="https://docs.djangoproject.com/en/1.11/releases/1.11.10/">
	 CVE-2018-6188: Information leakage in AuthenticationForm
	 A regression in Django 1.11.8 made AuthenticationForm run its
	 confirm_login_allowed() method even if an incorrect password is entered.
	 This can leak information about a user, depending on what messages
	 confirm_login_allowed() raises. If confirm_login_allowed() isn't
	 overridden, an attacker enter an arbitrary username and see if that user
	 has been set to is_active=False. If confirm_login_allowed() is
	 overridden, more sensitive details could be leaked.
	 This issue is fixed with the caveat that AuthenticationForm can no
	 longer raise the "This account is inactive." error if the authentication
	 backend rejects inactive users (the default authentication backend,
	 ModelBackend, has done that since Django 1.10). This issue will be
	 revisited for Django 2.1 as a fix to address the caveat will likely be too
	 invasive for inclusion in older versions.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.djangoproject.com/en/1.11/releases/1.11.10/</url>
 <url>https://docs.djangoproject.com/en/2.0/releases/2.0.2/</url>
 <cvename>CVE-2018-6188</cvename>
 </references>
 <dates>
 <discovery>2018-02-01</discovery>
 <entry>2018-02-02</entry>
 </dates>
 </vuln>

<vuln vid="e72d5bf5-07a0-11e8-8248-0021ccb9e74d">
 <topic>w3m - multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>w3m</name>
 <name>w3m-img</name>
 <name>ja-w3m</name>
 <name>ja-w3m-img</name>
 <range><lt>0.5.3.20180125</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Tatsuya Kinoshita reports:
 <blockquote cite="https://github.com/tats/w3m/commit/01d41d49b273a8cc75b27c6ab42291b46004fc0c">
 CVE-2018-6196 * table.c: Prevent negative indent value in feed_table_block_tag().
 CVE-2018-6197 * form.c: Prevent invalid columnPos() call in formUpdateBuffer().
 CVE-2018-6198 * config.h.dist, config.h.in, configure, configure.ac, main.c, rc.c: Make temporary directory safely when ~/.w3m is unwritable.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/tats/w3m/commit/e773a0e089276f82c546447c0fd1e6c0f9156628</url>
 <cvename>CVE-2018-6196</cvename>
 <cvename>CVE-2018-6197</cvename>
 <cvename>CVE-2018-6198</cvename>
 </references>
 <dates>
 <discovery>2018-01-25</discovery>
 <entry>2018-02-01</entry>
 <modified>2018-02-03</modified>
 </dates>
 </vuln>

<vuln vid="103bf96a-6211-45ab-b567-1555ebb3a86a">
 <topic>firefox -- Arbitrary code execution through unsanitized browser UI</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>58.0.1,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.0.3.65</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-05/">
	 Mozilla developer Johann Hofmann reported that
	 unsanitized output in the browser UI can lead to arbitrary
	 code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1432966</url>
 </references>
 <dates>
 <discovery>2018-01-29</discovery>
 <entry>2018-01-29</entry>
 <modified>2018-01-31</modified>
 </dates>
 </vuln>

<vuln vid="2cceb80e-c482-4cfd-81b3-2088d2c0ad53">
 <topic>gcab -- stack overflow</topic>
 <affects>
 <package>
	<name>gcab</name>
	<range><lt>0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Upstream reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-5345">
	 A stack-based buffer overflow within GNOME gcab through
	 0.7.4 can be exploited by malicious attackers to cause a
	 crash or, potentially, execute arbitrary code via a
	 crafted .cab file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2018-5345</url>
 <url>https://mail.gnome.org/archives/ftp-release-list/2018-January/msg00066.html</url>
 <cvename>CVE-2018-5345</cvename>
 </references>
 <dates>
 <discovery>2018-01-23</discovery>
 <entry>2018-01-27</entry>
 </dates>
 </vuln>

<vuln vid="92b8b284-a3a2-41b1-956c-f9cf8b74f500">
 <topic>dovecot -- abort of SASL authentication results in a memory leak</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><gt>2.0</gt><le>2.2.33.2_3</le></range>
	<range><ge>2.3</ge><le>2.3.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 Pedro Sampaio reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1532768">
	 A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. A abort of
	 SASL authentication results in a memory leak in Dovecot auth client
	 used by login processes. The leak has impact in high performance
	 configuration where same login processes are reused and can cause the
	 process to crash due to memory exhaustion.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-15132</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1532768</url>
 <url>https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.patch</url>
 </references>
 <dates>
 <discovery>2018-01-09</discovery>
 <entry>2018-01-26</entry>
 <modified>2018-02-01</modified>
 </dates>
 </vuln>

<vuln vid="0cbf0fa6-dcb7-469c-b87a-f94cffd94583">
 <topic>cURL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>7.58.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000007">
	 libcurl 7.1 through 7.57.0 might accidentally leak authentication
	 data to third parties. When asked to send custom headers in its HTTP
	 requests, libcurl will send that set of headers first to the host in
	 the initial URL but also, if asked to follow redirects and a 30X HTTP
	 response code is returned, to the host mentioned in URL in the
	 `Location:` response header value. Sending the same set of headers to
	 subsequest hosts is in particular a problem for applications that pass
	 on custom `Authorization:` headers, as this header often contains
	 privacy sensitive information or data that could allow others to
	 impersonate the libcurl-using client's request.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/adv_2018-b3bf.html</url>
 <cvename>CVE-2018-1000007</cvename>
 </references>
 <dates>
 <discovery>2018-01-24</discovery>
 <entry>2018-01-26</entry>
 </dates>
 </vuln>

<vuln vid="b464f61b-84c7-4e1c-8ad4-6cf9efffd025">
 <topic>clamav -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.99.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ClamAV project reports:
	<blockquote cite="http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html">
	 Join us as we welcome ClamAV 0.99.3 to the family!.
	 This release is a security release and is recommended for
	 all ClamAV users.
	 CVE-2017-12374 ClamAV UAF (use-after-free) Vulnerabilities
	 CVE-2017-12375 ClamAV Buffer Overflow Vulnerability
	 CVE-2017-12376 ClamAV Buffer Overflow in handle_pdfname
	 Vulnerability
	 CVE-2017-12377 ClamAV Mew Packet Heap Overflow Vulnerability
	 CVE-2017-12378 ClamAV Buffer Over Read Vulnerability
	 CVE-2017-12379 ClamAV Buffer Overflow in messageAddArgument
	 Vulnerability
	 CVE-2017-12380 ClamAV Null Dereference Vulnerability
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html</url>
 <cvename>CVE-2017-12374</cvename>
 <cvename>CVE-2017-12375</cvename>
 <cvename>CVE-2017-12376</cvename>
 <cvename>CVE-2017-12377</cvename>
 <cvename>CVE-2017-12378</cvename>
 <cvename>CVE-2017-12379</cvename>
 <cvename>CVE-2017-12380</cvename>
 </references>
 <dates>
 <discovery>2018-01-25</discovery>
 <entry>2018-01-26</entry>
 </dates>
 </vuln>

<vuln vid="a891c5b4-3d7a-4de9-9c71-eef3fd698c77">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>58.0_1,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.0.3.63</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>52.6.0_1,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>52.6.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-02/">
	 CVE-2018-5091: Use-after-free with DTMF timers
	 CVE-2018-5092: Use-after-free in Web Workers
	 CVE-2018-5093: Buffer overflow in WebAssembly during Memory/Table resizing
	 CVE-2018-5094: Buffer overflow in WebAssembly with garbage collection on uninitialized memory
	 CVE-2018-5095: Integer overflow in Skia library during edge builder allocation
	 CVE-2018-5097: Use-after-free when source document is manipulated during XSLT
	 CVE-2018-5098: Use-after-free while manipulating form input elements
	 CVE-2018-5099: Use-after-free with widget listener
	 CVE-2018-5100: Use-after-free when IsPotentiallyScrollable arguments are freed from memory
	 CVE-2018-5101: Use-after-free with floating first-letter style elements
	 CVE-2018-5102: Use-after-free in HTML media elements
	 CVE-2018-5103: Use-after-free during mouse event handling
	 CVE-2018-5104: Use-after-free during font face manipulation
	 CVE-2018-5105: WebExtensions can save and execute files on local file system without user prompts
	 CVE-2018-5106: Developer Tools can expose style editor information cross-origin through service worker
	 CVE-2018-5107: Printing process will follow symlinks for local file access
	 CVE-2018-5108: Manually entered blob URL can be accessed by subsequent private browsing tabs
	 CVE-2018-5109: Audio capture prompts and starts with incorrect origin attribution
	 CVE-2018-5110: Cursor can be made invisible on OS X
	 CVE-2018-5111: URL spoofing in addressbar through drag and drop
	 CVE-2018-5112: Extension development tools panel can open a non-relative URL in the panel
	 CVE-2018-5113: WebExtensions can load non-HTTPS pages with browser.identity.launchWebAuthFlow
	 CVE-2018-5114: The old value of a cookie changed to HttpOnly remains accessible to scripts
	 CVE-2018-5115: Background network requests can open HTTP authentication in unrelated foreground tabs
	 CVE-2018-5116: WebExtension ActiveTab permission allows cross-origin frame content access
	 CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right
	 CVE-2018-5118: Activity Stream images can attempt to load local content through file:
	 CVE-2018-5119: Reader view will load cross-origin content in violation of CORS headers
	 CVE-2018-5121: OS X Tibetan characters render incompletely in the addressbar
	 CVE-2018-5122: Potential integer overflow in DoCrypt
	 CVE-2018-5090: Memory safety bugs fixed in Firefox 58
	 CVE-2018-5089: Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-5089</cvename>
 <cvename>CVE-2018-5090</cvename>
 <cvename>CVE-2018-5091</cvename>
 <cvename>CVE-2018-5092</cvename>
 <cvename>CVE-2018-5093</cvename>
 <cvename>CVE-2018-5094</cvename>
 <cvename>CVE-2018-5095</cvename>
 <cvename>CVE-2018-5097</cvename>
 <cvename>CVE-2018-5098</cvename>
 <cvename>CVE-2018-5099</cvename>
 <cvename>CVE-2018-5100</cvename>
 <cvename>CVE-2018-5101</cvename>
 <cvename>CVE-2018-5102</cvename>
 <cvename>CVE-2018-5103</cvename>
 <cvename>CVE-2018-5104</cvename>
 <cvename>CVE-2018-5105</cvename>
 <cvename>CVE-2018-5106</cvename>
 <cvename>CVE-2018-5107</cvename>
 <cvename>CVE-2018-5108</cvename>
 <cvename>CVE-2018-5109</cvename>
 <cvename>CVE-2018-5110</cvename>
 <cvename>CVE-2018-5111</cvename>
 <cvename>CVE-2018-5112</cvename>
 <cvename>CVE-2018-5113</cvename>
 <cvename>CVE-2018-5114</cvename>
 <cvename>CVE-2018-5115</cvename>
 <cvename>CVE-2018-5116</cvename>
 <cvename>CVE-2018-5117</cvename>
 <cvename>CVE-2018-5118</cvename>
 <cvename>CVE-2018-5119</cvename>
 <cvename>CVE-2018-5121</cvename>
 <cvename>CVE-2018-5122</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2018-02/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2018-03/</url>
 </references>
 <dates>
 <discovery>2018-01-23</discovery>
 <entry>2018-01-23</entry>
 <modified>2018-01-29</modified>
 </dates>
 </vuln>

<vuln vid="24a82876-002e-11e8-9a95-0cc47a02c232">
 <topic>powerdns-recursor -- insufficient validation of DNSSEC signatures</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><lt>4.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Security Advisory reports:
	<blockquote cite="https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html">
	 An issue has been found in the DNSSEC validation component of
	 PowerDNS Recursor, allowing an ancestor delegation NSEC or NSEC3
	 record to be used to wrongfully prove the non-existence of a RR
	 below the owner name of that record. This would allow an attacker in
	 position of man-in-the-middle to send a NXDOMAIN answer for a name
	 that does exist.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-1000003</cvename>
 <url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html</url>
 </references>
 <dates>
 <discovery>2018-01-22</discovery>
 <entry>2018-01-23</entry>
 </dates>
 </vuln>

<vuln vid="e264e74e-ffe0-11e7-8b91-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>63.0.3239.108</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html">
	 2 security fixes in this release, including:
	 <ul>
	 <li>[788453] High CVE-2017-15429: UXSS in V8. Reported by
	 Anonymous on 2017-11-24</li>
	 <li>[794792] Various fixes from internal audits, fuzzing and other initiatives</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-15429</cvename>
 <url>https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html</url>
 </references>
 <dates>
 <discovery>2017-12-14</discovery>
 <entry>2018-01-23</entry>
 </dates>
 </vuln>

<vuln vid="1d951e85-ffdb-11e7-8b91-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>63.0.3239.84</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html">
	 37 security fixes in this release, including:
	 <ul>
	 <li>[778505] Critical CVE-2017-15407: Out of bounds write in QUIC. Reported by
	 Ned Williamson on 2017-10-26</li>
	 <li>[762374] High CVE-2017-15408: Heap buffer overflow in PDFium. Reported by
	 Ke Liu of Tencent's Xuanwu LAB on 2017-09-06</li>
	 <li>[763972] High CVE-2017-15409: Out of bounds write in Skia. Reported by
	 Anonymous on 2017-09-11</li>
	 <li>[765921] High CVE-2017-15410: Use after free in PDFium. Reported by
	 Luat Nguyen of KeenLab, Tencent on 2017-09-16</li>
	 <li>[770148] High CVE-2017-15411: Use after free in PDFium. Reported by
	 Luat Nguyen of KeenLab, Tencent on 2017-09-29</li>
	 <li>[727039] High CVE-2017-15412: Use after free in libXML. Reported by
	 Nick Wellnhofer on 2017-05-27</li>
	 <li>[766666] High CVE-2017-15413: Type confusion in WebAssembly. Reported by
	 Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-09-19</li>
	 <li>[765512] Medium CVE-2017-15415: Pointer information disclosure in IPC call.
	 Reported by Viktor Brange of Microsoft Offensive Security Research Team on 2017-09-15</li>
	 <li>[779314] Medium CVE-2017-15416: Out of bounds read in Blink. Reported by
	 Ned Williamson on 2017-10-28</li>
	 <li>[699028] Medium CVE-2017-15417: Cross origin information disclosure in Skia.
	 Reported by Max May on 2017-03-07</li>
	 <li>[765858] Medium CVE-2017-15418: Use of uninitialized value in Skia. Reported by
	 Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-09-15</li>
	 <li>[780312] Medium CVE-2017-15419: Cross origin leak of redirect URL in Blink.
	 Reported by Jun Kokatsu on 2017-10-31</li>
	 <li>[777419] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by
	 WenXu Wu of Tencent's Xuanwu Lab on 2017-10-23</li>
	 <li>[774382] Medium CVE-2017-15422: Integer overflow in ICU. Reported by
	 Yuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13</li>
	 <li>[780484] Medium CVE-2017-15430: Unsafe navigation in Chromecast Plugin.
	 Reported by jinmo123 on 2017-01-11</li>
	 <li>[778101] Low CVE-2017-15423: Issue with SPAKE implementation in BoringSSL.
	 Reported by Greg Hudson on 2017-10-25</li>
	 <li>[756226] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by
	 Khalil Zhani on 2017-08-16</li>
	 <li>[756456] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by
	 xisigr of Tencent's Xuanwu Lab on 2017-08-17</li>
	 <li>[757735] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by
	 WenXu Wu of Tencent's Xuanwu Lab on 2017-08-18</li>
	 <li>[768910] Low CVE-2017-15427: Insufficient blocking of Javascript in Omnibox.
	 Reported by Junaid Farhan on 2017-09-26</li>
	 <li>[792099] Various fixes from internal audits, fuzzing and other initiatives</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-15407</cvename>
 <cvename>CVE-2017-15408</cvename>
 <cvename>CVE-2017-15409</cvename>
 <cvename>CVE-2017-15410</cvename>
 <cvename>CVE-2017-15411</cvename>
 <cvename>CVE-2017-15412</cvename>
 <cvename>CVE-2017-15413</cvename>
 <cvename>CVE-2017-15415</cvename>
 <cvename>CVE-2017-15416</cvename>
 <cvename>CVE-2017-15417</cvename>
 <cvename>CVE-2017-15418</cvename>
 <cvename>CVE-2017-15419</cvename>
 <cvename>CVE-2017-15420</cvename>
 <cvename>CVE-2017-15422</cvename>
 <cvename>CVE-2017-15430</cvename>
 <cvename>CVE-2017-15423</cvename>
 <cvename>CVE-2017-15424</cvename>
 <cvename>CVE-2017-15425</cvename>
 <cvename>CVE-2017-15426</cvename>
 <cvename>CVE-2017-15427</cvename>
 <url>https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2017-12-06</discovery>
 <entry>2018-01-23</entry>
 </dates>
 </vuln>

<vuln vid="82894193-ffd4-11e7-8b91-e8e0b747a45a">
 <topic>chromium -- out of bounds read</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>62.0.3202.94</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop_13.html">
	 1 security fix in this release, including:
	 <ul>
	 <li>[782145] High CVE-2017-15428: Out of bounds read in V8. Reported by
	 Zhao Qixun of Qihoo 360 Vulcan Team on 2017-11-07</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-15428</cvename>
 <url>https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop_13.html</url>
 </references>
 <dates>
 <discovery>2017-11-13</discovery>
 <entry>2018-01-23</entry>
 </dates>
 </vuln>

<vuln vid="8d3bae09-fd28-11e7-95f2-005056925db4">
 <topic>unbound -- vulnerability in the processing of wildcard synthesized NSEC records</topic>
 <affects>
 <package>
	<name>unbound</name>
	<range><lt>1.6.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Unbound reports:
	<blockquote cite="https://unbound.net/downloads/CVE-2017-15105.txt">
	 We discovered a vulnerability in the processing of wildcard synthesized
	 NSEC records. While synthesis of NSEC records is allowed by RFC4592,
	 these synthesized owner names should not be used in the NSEC processing.
	 This does, however, happen in Unbound 1.6.7 and earlier versions.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://unbound.net/downloads/CVE-2017-15105.txt</url>
 <cvename>CVE-2017-15105</cvename>
 <freebsdpr>ports/225313</freebsdpr>
 </references>
 <dates>
 <discovery>2017-10-08</discovery>
 <entry>2018-01-19</entry>
 </dates>
 </vuln>

<vuln vid="8e89a89a-fd15-11e7-bdf6-00e04c1ea73d">
 <topic>phpbb3 -- multiple issues</topic>
 <affects>
 <package>
	<name>phpbb3</name>
	<range><lt>3.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpbb developers reports:
	<blockquote cite="https://wiki.phpbb.com/Release_Highlights/3.2.2">
	 Password updater working with PostgreSQL - The cron for updating legacy password hashes was running invalid queries on PostgreSQL.
	 Deleting orphaned attachments w/ large number of orphaned attachments - Orphaned attachment deletion was improved to be able to delete them when a large number of orphaned attachments exist.
	 Multiple bugfixes for retrieving image size - Multiple issues with retrieving the image size of JPEGs and temporary files were resolved.
	 Issues with updating from phpBB 3.0.6 - Inconsistencies in the way parent modules were treated caused issues with updating from older phpBB 3.0 versions.
	 Forum / topic icon blurriness - Fixed issues with forum and topic icons looking blurry on some browsers.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wiki.phpbb.com/Release_Highlights/3.2.2</url>
 </references>
 <dates>
 <discovery>2018-01-07</discovery>
 <entry>2018-01-19</entry>
 </dates>
 </vuln>

<vuln vid="e3445736-fd01-11e7-ac58-b499baebfeaf">
 <topic>MySQL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb55-server</name>
	<range><lt>5.5.59</lt></range>
 </package>
 <package>
	<name>mariadb100-server</name>
	<range><lt>10.0.34</lt></range>
 </package>
 <package>
	<name>mariadb101-server</name>
	<range><lt>10.1.31</lt></range>
 </package>
 <package>
	<name>mariadb102-server</name>
	<range><lt>10.2.13</lt></range>
 </package>
 <package>
	<name>mysql55-server</name>
	<range><lt>5.5.59</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.39</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.21</lt></range>
 </package>
 <package>
	<name>percona55-server</name>
	<range><lt>5.5.59</lt></range>
 </package>
 <package>
	<name>percona56-server</name>
	<range><lt>5.6.39</lt></range>
 </package>
 <package>
	<name>percona57-server</name>
	<range><lt>5.7.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixMSQL">
	 Not all vulnerabilities are relevant for all flavors/versions of the
	 servers and clients
	 <ul>
	 <li>Vulnerability allows low privileged attacker with network access
	 via multiple protocols to compromise MySQL Server. Successful attacks
	 of this vulnerability can result in unauthorized ability to cause a
	 hang or frequently repeatable crash (complete DOS) of MySQL Server.
	 GIS: CVE-2018-2573, DDL CVE-2018-2622, Optimizer: CVE-2018-2640,
	 CVE-2018-2665, CVE-2018-2668, Security:Privileges: CVE-2018-2703,
	 Partition: CVE-2018-2562.</li>
	 <li>Vulnerability allows high privileged attacker with network access
	 via multiple protocols to compromise MySQL Server. Successful attacks
	 of this vulnerability can result in unauthorized ability to cause a
	 hang or frequently repeatable crash (complete DOS) of MySQL Server.
	 InnoDB: CVE-2018-2565, CVE-2018-2612 DML: CVE-2018-2576,
	 CVE-2018-2646, Stored Procedure: CVE-2018-2583, Performance Schema:
	 CVE-2018-2590, Partition: CVE-2018-2591, Optimizer: CVE-2018-2600,
	 CVE-2018-2667, Security:Privileges: CVE-2018-2696, Replication:
	 CVE-2018-2647.</li>
	 <li>Vulnerability allows a low or high privileged attacker with network
	 access via multiple protocols to compromise MySQL Server with
	 unauthorized creation, deletion, modification or access to data/
	 critical data. InnoDB: CVE-2018-2612, Performance Schema:
	 CVE-2018-2645, Replication: CVE-2018-2647, Partition: CVE-2018-2562.
	 </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixMSQL</url>
 <url>https://mariadb.com/kb/en/library/mariadb-5559-release-notes/</url>
 <cvename>CVE-2018-2562</cvename>
 <cvename>CVE-2018-2565</cvename>
 <cvename>CVE-2018-2573</cvename>
 <cvename>CVE-2018-2576</cvename>
 <cvename>CVE-2018-2583</cvename>
 <cvename>CVE-2018-2586</cvename>
 <cvename>CVE-2018-2590</cvename>
 <cvename>CVE-2018-2591</cvename>
 <cvename>CVE-2018-2600</cvename>
 <cvename>CVE-2018-2612</cvename>
 <cvename>CVE-2018-2622</cvename>
 <cvename>CVE-2018-2640</cvename>
 <cvename>CVE-2018-2645</cvename>
 <cvename>CVE-2018-2646</cvename>
 <cvename>CVE-2018-2647</cvename>
 <cvename>CVE-2018-2665</cvename>
 <cvename>CVE-2018-2667</cvename>
 <cvename>CVE-2018-2668</cvename>
 <cvename>CVE-2018-2696</cvename>
 <cvename>CVE-2018-2703</cvename>
 </references>
 <dates>
 <discovery>2017-01-18</discovery>
 <entry>2018-01-19</entry>
 </dates>
 </vuln>

<vuln vid="c04dc18f-fcde-11e7-bdf6-00e04c1ea73d">
 <topic>wordpress -- multiple issues</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>4.9.2,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wordpress developers reports:
	<blockquote cite="https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/">
	 JavaScript errors that prevented saving posts in Firefox have been fixed.
	 The previous taxonomy-agnostic behavior of get_category_link() and category_description() was restored.
	 Switching themes will now attempt to restore previous widget assignments, even when there are no sidebars to map.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2018-01-16</discovery>
 <entry>2018-01-19</entry>
 </dates>
 </vuln>

<vuln vid="65fab89f-2231-46db-8541-978f4e87f32a">
 <topic>gitlab -- Remote code execution on project import</topic>
 <affects>
 <package>
	<name>gitlab</name>
	<range><lt>10.1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab developers report:
	<blockquote cite="https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/">
	 Today we are releasing versions 10.3.4, 10.2.6, and 10.1.6 for
	 GitLab Community Edition (CE) and Enterprise Edition (EE).
	 These versions contain a number of important security fixes,
	 including two that prevent remote code execution, and we strongly
	 recommend that all GitLab installations be upgraded to one of these
	 versions immediately.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/</url>
 <cvename>CVE-2017-0915</cvename>
 <cvename>CVE-2018-3710</cvename>
 </references>
 <dates>
 <discovery>2018-01-16</discovery>
 <entry>2018-01-17</entry>
 </dates>
 </vuln>

<vuln vid="3e5b8bd3-0c32-452f-a60e-beab7b762351">
 <topic>transmission-daemon -- vulnerable to dns rebinding attacks</topic>
 <affects>
 <package>
	<name>transmission-daemon</name>
	<range><le>2.92_3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Project Zero reports:
	<blockquote cite="https://bugs.chromium.org/p/project-zero/issues/detail?id=1447">
	 The transmission bittorrent client uses a client/server
	 architecture, the user interface is the client which communicates
	 to the worker daemon using JSON RPC requests.
	 As with all HTTP RPC schemes like this, any website can send
	 requests to the daemon listening on localhost with XMLHttpRequest(),
	 but the theory is they will be ignored because clients must prove
	 they can read and set a specific header, X-Transmission-Session-Id.
	 Unfortunately, this design doesn't work because of an attack called
	 "DNS rebinding". Any website can simply create a dns name that they
	 are authorized to communicate with, and then make it resolve to
	 localhost.
	 Exploitation is simple, you could set script-torrent-done-enabled
	 and run any command, or set download-dir to /home/user/ and then
	 upload a torrent for .bashrc.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.chromium.org/p/project-zero/issues/detail?id=1447</url>
 <url>https://github.com/transmission/transmission/pull/468</url>
 </references>
 <dates>
 <discovery>2017-11-30</discovery>
 <entry>2018-01-14</entry>
 </dates>
 </vuln>

<vuln vid="3dbe9492-f7b8-11e7-a12d-6cc21735f730">
 <topic>shibboleth-sp -- vulnerable to forged user attribute data</topic>
 <affects>
 <package>
	<name>xmltooling</name>
	<range><lt>1.6.3</lt></range>
 </package>
 <package>
	<name>xerces-c3</name>
	<range><lt>3.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Shibboleth consortium reports:
	<blockquote cite="https://shibboleth.net/community/advisories/secadv_20180112.txt">
	 
	 Shibboleth SP software vulnerable to forged user attribute data
	 
	 
	 The Service Provider software relies on a generic XML parser to
	 process SAML responses and there are limitations in older versions
	 of the parser that make it impossible to fully disable Document Type
	 Definition (DTD) processing.
	 
	 
	 Through addition/manipulation of a DTD, it's possible to make
	 changes to an XML document that do not break a digital signature but
	 are mishandled by the SP and its libraries. These manipulations can
	 alter the user data passed through to applications behind the SP and
	 result in impersonation attacks and exposure of protected
	 information.
	 
	 
	 While newer versions of the xerces-c3 parser are configured by the
	 SP into disallowing the use of a DTD via an environment variable,
	 this feature is not present in the xerces-c3 parser before version
	 3.1.4, so an additional fix is being provided now that an actual DTD
	 exploit has been identified. Xerces-c3-3.1.4 was committed to the
	 ports tree already on 2016-07-26.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://shibboleth.net/community/advisories/secadv_20180112.txt</url>
 <cvename>CVE-2018-0486</cvename>
 </references>
 <dates>
 <discovery>2018-01-12</discovery>
 <entry>2018-01-12</entry>
 </dates>
 </vuln>

<vuln vid="9c016563-f582-11e7-b33c-6451062f0f7a">
 <topic>Flash Player -- information disclosure</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>28.0.0.137</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-01.html">
	 <ul>
	 <li>This update resolves an out-of-bounds read vulnerability that
	 could lead to information disclosure (CVE-2018-4871).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2018-4871</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb18-01.html</url>
 </references>
 <dates>
 <discovery>2018-01-09</discovery>
 <entry>2018-01-09</entry>
 </dates>
 </vuln>

<vuln vid="4055aee5-f4c6-11e7-95f2-005056925db4">
 <topic>awstats -- remote code execution</topic>
 <affects>
 <package>
	<name>awstats</name>
	<range><lt>7.7,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000501">
	 Awstats version 7.6 and earlier is vulnerable to a path traversal
	 flaw in the handling of the "config" and "migrate" parameters resulting
	 in unauthenticated remote code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000501</url>
 <cvename>CVE-2017-1000501</cvename>
 <freebsdpr>ports/225007</freebsdpr>
 </references>
 <dates>
 <discovery>2018-01-03</discovery>
 <entry>2018-01-08</entry>
 </dates>
 </vuln>

<vuln vid="a3764767-f31e-11e7-95f2-005056925db4">
 <topic>irssi -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>irssi</name>
	<range><lt>1.0.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Irssi reports:
	<blockquote cite="https://irssi.org/security/irssi_sa_2018_01.txt">
	 When the channel topic is set without specifying a sender, Irssi
	 may dereference NULL pointer. Found by Joseph Bisch.
	 When using incomplete escape codes, Irssi may access data beyond
	 the end of the string. Found by Joseph Bisch.
	 A calculation error in the completion code could cause a heap
	 buffer overflow when completing certain strings.
	 Found by Joseph Bisch.
	 When using an incomplete variable argument, Irssi may access data
	 beyond the end of the string. Found by Joseph Bisch.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://irssi.org/security/irssi_sa_2018_01.txt</url>
 <cvename>CVE-2018-5205</cvename>
 <cvename>CVE-2018-5206</cvename>
 <cvename>CVE-2018-5207</cvename>
 <cvename>CVE-2018-5208</cvename>
 <freebsdpr>ports/224954</freebsdpr>
 </references>
 <dates>
 <discovery>2018-01-03</discovery>
 <entry>2018-01-06</entry>
 </dates>
 </vuln>

<vuln vid="8429711b-76ca-474e-94a0-6b980f1e2d47">
 <topic>mozilla -- Speculative execution side-channel attack</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>57.0.4,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-01/">
	 Jann Horn of Google Project Zero
	 Security reported that speculative execution performed
	 by modern CPUs could leak information through a timing
	 side-channel attack. Microsoft Vulnerability Research
	 extended this attack to browser JavaScript engines and
	 demonstrated that code on a malicious web page could
	 read data from other web sites (violating the
	 same-origin policy) or private data from the browser
	 itself.
	 Since this new class of attacks involves measuring
	 precise time intervals, as a parti al, short-term,
	 mitigation we are disabling or reducing the precision of
	 several time sources in Firefox. The precision of
	 <code>performance.now()</code> has been reduced from 5μs
	 to 20μs, and the <code>SharedArrayBuffer</code> feature
	 has been disabled because it can be used to construct a
	 high-resolution timer.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.mozilla.org/security/advisories/mfsa2018-01/</url>
 </references>
 <dates>
 <discovery>2018-01-04</discovery>
 <entry>2018-01-05</entry>
 </dates>
 </vuln>

<vuln vid="cebd05d6-ed7b-11e7-95f2-005056925db4">
 <topic>OTRS -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><lt>5.0.26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OTRS reports:
	<blockquote cite="https://www.otrs.com/security-advisory-2017-07-security-update-otrs-framework/">
	 An attacker who is logged into OTRS as an agent can request special URLs
	 from OTRS which can lead to the execution of shell commands with the
	 permissions of the web server user.
	</blockquote>
	<blockquote cite="https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/">
	 An attacker who is logged into OTRS as a customer can use the ticket search
	 form to disclose internal article information of their customer tickets.
	</blockquote>
	<blockquote cite="https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/">
	 An attacker who is logged into OTRS as an agent can manipulate form
	 parameters and execute arbitrary shell commands with the permissions of the
	 OTRS or web server user.
	</blockquote>
	<blockquote cite="https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/">
	 An attacker can send a specially prepared email to an OTRS system. If this
	 system has cookie support disabled, and a logged in agent clicks a link in this
	 email, the session information could be leaked to external systems, allowing the
	 attacker to take over the agent’s session.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-16664</cvename>
 <cvename>CVE-2017-16854</cvename>
 <cvename>CVE-2017-16921</cvename>
 <freebsdpr>ports/224729</freebsdpr>
 <url>https://www.otrs.com/security-advisory-2017-07-security-update-otrs-framework/</url>
 <url>https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/</url>
 <url>https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/</url>
 <url>https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/</url>
 </references>
 <dates>
 <discovery>2017-11-21</discovery>
 <entry>2017-12-30</entry>
 </dates>
 </vuln>

<vuln vid="6a131fbf-ec76-11e7-aa65-001b216d295b">
 <topic>The Bouncy Castle Crypto APIs: CVE-2017-13098 ("ROBOT")</topic>
 <affects>
 <package>
	<name>bouncycastle</name>
	<range><lt>1.59</lt></range>
 </package>
 <package>
	<name>bouncycastle15</name>
	<range><lt>1.59</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Legion of the Bouncy Castle reports:
	<blockquote cite="https://www.bouncycastle.org/releasenotes.html">
	 Release: 1.59
	 CVE-2017-13098 ("ROBOT"), a Bleichenbacher oracle in TLS
	 when RSA key exchange is negotiated. This potentially affected
	 BCJSSE servers and any other TLS servers configured to use JCE
	 for the underlying crypto - note the two TLS implementations
	 using the BC lightweight APIs are not affected by this.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-13098</cvename>
 <url>https://www.bouncycastle.org/releasenotes.html</url>
 </references>
 <dates>
 <discovery>2017-12-12</discovery>
 <entry>2017-12-29</entry>
 </dates>
 </vuln>

<vuln vid="6a09c80e-6ec7-442a-bc65-d72ce69fd887">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/">
	 CVE-2017-7845: Buffer overflow when drawing and validating elements with ANGLE library using Direct 3D 9
	 CVE-2017-7846: JavaScript Execution via RSS in mailbox:// origin
	 CVE-2017-7847: Local path string can be leaked from RSS feed
	 CVE-2017-7848: RSS Feed vulnerable to new line Injection
	 CVE-2017-7829: Mailsploit part 1: From address with encoded null character is cut off in message header display
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-7829</cvename>
 <cvename>CVE-2017-7845</cvename>
 <cvename>CVE-2017-7846</cvename>
 <cvename>CVE-2017-7847</cvename>
 <cvename>CVE-2017-7848</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2017-30/</url>
 </references>
 <dates>
 <discovery>2017-12-22</discovery>
 <entry>2017-12-25</entry>
 </dates>
 </vuln>

<vuln vid="63eb2b11-e802-11e7-a58c-6805ca0b3d42">
 <topic>phpMyAdmin -- XSRF/CSRF vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.7.0</ge><lt>4.7.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-9/">
	 <h3>Description</h3>
	 By deceiving a user to click on a crafted URL, it is
	 possible to perform harmful database operations such as
	 deleting records, dropping/truncating tables etc.
	 <h3>Severity</h3>
	 We consider this vulnerability to be critical.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2017-9/</url>
 </references>
 <dates>
 <discovery>2017-12-23</discovery>
 <entry>2017-12-23</entry>
 </dates>
 </vuln>

<vuln vid="2a3bc6ac-e7c6-11e7-a90b-001999f8d30b">
 <topic>asterisk -- Crash in PJSIP resource when missing a contact header</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.18.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 A select set of SIP messages create a dialog in Asterisk.
	 Those SIP messages must contain a contact header. For
	 those messages, if the header was not present and using
	 the PJSIP channel driver, it would cause Asterisk to
	 crash. The severity of this vulnerability is somewhat
	 mitigated if authentication is enabled. If authentication
	 is enabled a user would have to first be authorized before
	 reaching the crash point.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2017-014.html</url>
 <cvename>CVE-2017-17850</cvename>
 </references>
 <dates>
 <discovery>2017-12-12</discovery>
 <entry>2017-12-23</entry>
 </dates>
 </vuln>

<vuln vid="b7d89082-e7c0-11e7-ac58-b499baebfeaf">
 <topic>MariaDB -- unspecified vulnerability</topic>
 <affects>
 <package>
	<name>mariadb101-client</name>
	<range><lt>10.1.30</lt></range>
 </package>
 <package>
	<name>mariadb102-client</name>
	<range><lt>10.2.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MariaDB project reports:
	<blockquote cite="https://mariadb.com/kb/en/library/mariadb-10130-release-notes/">
	 Fixes for the following security vulnerabilities:
	 CVE-2017-15365
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mariadb.com/kb/en/library/mariadb-10130-release-notes/</url>
 <cvename>CVE-2017-15365</cvename>
 </references>
 <dates>
 <discovery>2017-12-23</discovery>
 <entry>2017-12-23</entry>
 </dates>
 </vuln>

<vuln vid="72fff788-e561-11e7-8097-0800271d4b9c">
 <topic>rsync -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rsync</name>
	<range><ge>3.1.2</ge><le>3.1.2_7</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jeriko One reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16548">
	 The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17433">
	 The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17434">
	 The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.debian.org/security/2017/dsa-4068</url>
 <cvename>CVE-2017-16548</cvename>
 <cvename>CVE-2017-17433</cvename>
 <cvename>CVE-2017-17434</cvename>
 <freebsdpr>ports/224477</freebsdpr>
 </references>
 <dates>
 <discovery>2017-12-17</discovery>
 <entry>2017-12-20</entry>
 <modified>2017-12-31</modified>
 </dates>
 </vuln>

<vuln vid="dd644964-e10e-11e7-8097-0800271d4b9c">
 <topic>ruby -- Command injection vulnerability in Net::FTP</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>2.2.0,1</ge><lt>2.2.9,1</lt></range>
	<range><ge>2.3.0,1</ge><lt>2.3.6,1</lt></range>
	<range><ge>2.4.0,1</ge><lt>2.4.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Etienne Stalmans from the Heroku product security team reports:
	<blockquote cite="https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/">
	 There is a command injection vulnerability in Net::FTP bundled with Ruby.
	 <code>Net::FTP#get</code>, <code>getbinaryfile</code>, <code>gettextfile</code>, <code>put</code>, <code>putbinaryfile</code>, and <code>puttextfile</code> use <code>Kernel#open</code> to open a local file. If the <code>localfile</code> argument starts with the pipe character <code>"|"</code>, the command following the pipe character is executed. The default value of <code>localfile</code> is <code>File.basename(remotefile)</code>, so malicious FTP servers could cause arbitrary command execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/</url>
 <cvename>CVE-2017-17405</cvename>
 </references>
 <dates>
 <discovery>2017-12-14</discovery>
 <entry>2017-12-14</entry>
 </dates>
 </vuln>

<vuln vid="8cf25a29-e063-11e7-9b2c-001e672571bc">
 <topic>rubygem-passenger -- arbitrary file read vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-passenger</name>
	<range><ge>5.0.10</ge><lt>5.1.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Phusion reports:
	<blockquote cite="https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/">
	 The cPanel Security Team discovered a vulnerability in Passenger
	 that allows users to list the contents of arbitrary files on the
	 system. CVE-2017-16355 has been assigned to this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/</url>
 <cvename>CVE-2017-16355</cvename>
 </references>
 <dates>
 <discovery>2017-10-13</discovery>
 <entry>2017-12-18</entry>
 </dates>
 </vuln>

<vuln vid="08a125f3-e35a-11e7-a293-54e1ad3d6335">
 <topic>libXfont -- permission bypass when opening files through symlinks</topic>
 <affects>
 <package>
	<name>libXfont</name>
	<range><lt>1.5.4</lt></range>
 </package>
 <package>
	<name>libXfont2</name>
	<range><lt>2.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	the freedesktop.org project reports:
	<blockquote cite="https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=7b377456f95d2ec3ead40f4fb74ea620191f88c8">
	 A non-privileged X client can instruct X server running under root
	 to open any file by creating own directory with "fonts.dir",
	 "fonts.alias" or any font file being a symbolic link to any other
	 file in the system. X server will then open it. This can be issue
	 with special files such as /dev/watchdog.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=7b377456f95d2ec3ead40f4fb74ea620191f88c8</url>
 <cvename>CVE-2017-16611</cvename>
 </references>
 <dates>
 <discovery>2017-11-25</discovery>
 <entry>2017-12-17</entry>
 </dates>
 </vuln>

<vuln vid="3b9590a1-e358-11e7-a293-54e1ad3d6335">
 <topic>libXfont -- multiple memory leaks</topic>
 <affects>
 <package>
	<name>libXfont</name>
	<range><lt>1.5.3</lt></range>
 </package>
 <package>
	<name>libXfont2</name>
	<range><lt>2.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The freedesktop.org project reports:
	<blockquote cite="https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608">
	 If a pattern contains '?' character, any character in the string
	 is skipped, even if it is '\0'. The rest of the matching then reads
	 invalid memory.
	</blockquote>
	<blockquote cite="https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=672bb944311392e2415b39c0d63b1e1902906bcd">
	 Without the checks a malformed PCF file can cause the library to
	 make atom from random heap memory that was behind the `strings`
	 buffer. This may crash the process or leak information.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608</url>
 <url>https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=672bb944311392e2415b39c0d63b1e1902905bcd</url>
 <cvename>CVE-2017-13720</cvename>
 <cvename>CVE-2017-13722</cvename>
 </references>
 <dates>
 <discovery>2017-10-04</discovery>
 <entry>2017-12-17</entry>
 </dates>
 </vuln>

<vuln vid="ddecde18-e33b-11e7-a293-54e1ad3d6335">
 <topic>libXcursor -- integer overflow that can lead to heap buffer overflow</topic>
 <affects>
 <package>
	<name>libXcursor</name>
	<range><lt>1.1.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The freedesktop.org project reports:
	<blockquote cite="http://seclists.org/oss-sec/2017/q4/339">
	 It is possible to trigger heap overflows due to an integer
	 overflow while parsing images and a signedness issue while
	 parsing comments.
	 The integer overflow occurs because the chosen limit 0x10000
	 for dimensions is too large for 32 bit systems, because each pixel
	 takes 4 bytes. Properly chosen values allow an overflow which in
	 turn will lead to less allocated memory than needed for subsequent
	 reads.
	 The signedness bug is triggered by reading the length of a comment
	 as unsigned int, but casting it to int when calling the function
	 XcursorCommentCreate. Turning length into a negative value allows
	 the check against XCURSOR_COMMENT_MAX_LEN to pass, and the following
	 addition of sizeof (XcursorComment) + 1 makes it possible to
	 allocate less memory than needed for subsequent reads.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2017/q4/339</url>
 <url>https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8</url>
 <cvename>CVE-2017-16612</cvename>
 </references>
 <dates>
 <discovery>2017-11-28</discovery>
 <entry>2017-12-17</entry>
 </dates>
 </vuln>

<vuln vid="48cca164-e269-11e7-be51-6599c735afc8">
 <topic>global -- gozilla vulnerability</topic>
 <affects>
 <package>
	<name>global</name>
	<range><ge>4.8.6</ge><lt>6.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17531">
	 gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching
	 the program specified by the BROWSER environment variable, which might
	 allow remote attackers to conduct argument-injection attacks via a crafted
	 URL.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17531</url>
 <url>http://lists.gnu.org/archive/html/info-global/2017-12/msg00001.html</url>
 <cvename>CVE-2017-17531</cvename>
 </references>
 <dates>
 <discovery>2017-12-11</discovery>
 <entry>2017-12-16</entry>
 </dates>
 </vuln>

<vuln vid="7136e6b7-e1b3-11e7-a4d3-000c292ee6b8">
 <topic>jenkins -- Two startup race conditions</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.95</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.89.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Jenkins project reports:
	<blockquote cite="https://jenkins.io/security/advisory/2017-12-14/">
	 A race condition during Jenkins startup could result in the wrong
	 order of execution of commands during initialization.
	 On Jenkins 2.81 and newer, including LTS 2.89.1, this could in
	 rare cases (we estimate less than 20% of new instances) result in
	 failure to initialize the setup wizard on the first startup.
	 There is a very short window of time after startup during which
	 Jenkins may no longer show the "Please wait while Jenkins is
	 getting ready to work" message, but Cross-Site Request Forgery
	 (CSRF) protection may not yet be effective.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://jenkins.io/security/advisory/2017-12-14/</url>
 </references>
 <dates>
 <discovery>2017-12-14</discovery>
 <entry>2017-12-15</entry>
 </dates>
 </vuln>

<vuln vid="bea84a7a-e0c9-11e7-b4f3-11baa0c2df21">
 <topic>node.js -- Data Confidentiality/Integrity Vulnerability, December 2017</topic>
 <affects>
 <package>
	<name>node4</name>
	<range><lt>4.8.7</lt></range>
 </package>
 <package>
	<name>node6</name>
	<range><lt>6.12.2</lt></range>
 </package>
 <package>
	<name>node8</name>
	<range><lt>8.9.3</lt></range>
 </package>
 <package>
	<name>node</name>
	<range><lt>9.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/">
	 <h1>Data Confidentiality/Integrity Vulnerability - CVE-2017-15896</h1>
	 Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.
	 <h1>Uninitialized buffer vulnerability - CVE-2017-15897</h1>
	 Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.
	 <h1>Also included in OpenSSL update - CVE 2017-3738</h1>
	 Note that CVE 2017-3738 of OpenSSL-1.0.2 affected Node but it was low severity.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/</url>
 <cvename>CVE-2017-15896</cvename>
 <cvename>CVE-2017-15897</cvename>
 <cvename>CVE-2017-3738</cvename>
 </references>
 <dates>
 <discovery>2017-12-08</discovery>
 <entry>2017-12-14</entry>
 </dates>
 </vuln>

<vuln vid="e72a8864-e0bc-11e7-b627-d43d7e971a1b">
 <topic>GitLab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab</name>
	<range><ge>4.2.0</ge><le>10.0.6</le></range>
 <range><ge>10.1.0</ge><le>10.1.4</le></range>
 <range><ge>10.2.0</ge><le>10.2.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab reports:
	<blockquote cite="https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/">
 <h1>User without access to private Wiki can see it on the project page</h1>
	 Matthias Burtscher reported that it was possible for a user to see a
	 private Wiki on the project page without having the corresponding
	 permission.
 <h1>E-mail address disclosure through member search fields</h1>
 Hugo Geoffroy reported via HackerOne that it was possible to find out the
 full e-mail address of any user by brute-forcing the member search
 field.
 <h1>Groups API leaks private projects</h1>
 An internal code review discovered that users were able to list private
 projects they had no access to by using the Groups API.
 <h1>Cross-Site Scripting (XSS) possible by editing a comment</h1>
 Sylvain Heiniger reported via HackerOne that it was possible for
 arbitrary JavaScript code to be executed when editing a comment.
 <h1>Issue API allows any user to create a new issue even when issues are
 restricted or disabled</h1>
 Mohammad Hasbini reported that any user could create a new issues in a
 project even when issues were disabled or restricted to team members in the
 project settings.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/</url>
 </references>
 <dates>
 <discovery>2017-12-08</discovery>
 <entry>2017-12-14</entry>
 </dates>
 </vuln>

<vuln vid="36ef8753-d86f-11e7-ad28-0025908740c2">
 <topic>tor -- Use-after-free in onion service v2</topic>
 <affects>
 <package>
	<name>tor</name>
	<range><lt>0.3.1.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Torproject.org reports:
	<blockquote cite="https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516">
	 <ul>
	 <li>TROVE-2017-009: Replay-cache ineffective for v2 onion services</li>
	 <li>TROVE-2017-010: Remote DoS attack against directory authorities</li>
	 <li>TROVE-2017-011: An attacker can make Tor ask for a password</li>
	 <li>TROVE-2017-012: Relays can pick themselves in a circuit path</li>
	 <li>TROVE-2017-013: Use-after-free in onion service v2</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516</url>
 <cvename>CVE-2017-8819</cvename>
 </references>
 <dates>
 <discovery>2017-12-01</discovery>
 <entry>2017-12-14</entry>
 </dates>
 </vuln>

<vuln vid="4a67450a-e044-11e7-accc-001999f8d30b">
 <topic>asterisk -- Remote Crash Vulnerability in RTCP Stack</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.18.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 If a compound RTCP packet is received containing more
	 than one report (for example a Receiver Report and a
	 Sender Report) the RTCP stack will incorrectly store
	 report information outside of allocated memory potentially
	 causing a crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2017-012.html</url>
 </references>
 <dates>
 <discovery>2017-12-12</discovery>
 <entry>2017-12-13</entry>
 </dates>
 </vuln>

<vuln vid="76e59f55-4f7a-4887-bcb0-11604004163a">
 <topic>libxml2 -- Multiple Issues</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><le>2.9.4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libxml2 developers report:
	The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.
	A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content-&gt;type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content-&gt;prefix is appended to buf (if it actually fits) whereupon (ii) content-&gt;name is written to the buffer. However, the check for whether the content-&gt;name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.
	libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 &lt; size. This vulnerability causes programs that use libxml2, such as PHP, to crash.
	libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.
	libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.
 </body>
 </description>
 <references>
 <url>https://bugzilla.gnome.org/show_bug.cgi?id=775200</url>
 <url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
 <url>http://www.securityfocus.com/bid/98599</url>
 <url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
 <url>http://www.securityfocus.com/bid/98556</url>
 <url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
 <url>http://www.securityfocus.com/bid/98601</url>
 <url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
 <url>http://www.securityfocus.com/bid/98568</url>
 <cvename>CVE-2017-8872</cvename>
 <cvename>CVE-2017-9047</cvename>
 <cvename>CVE-2017-9048</cvename>
 <cvename>CVE-2017-9049</cvename>
 <cvename>CVE-2017-9050</cvename>
 </references>
 <dates>
 <discovery>2017-05-10</discovery>
 <entry>2017-12-13</entry>
 </dates>
 </vuln>

<vuln vid="9f7a0f39-ddc0-11e7-b5af-a4badb2f4699">
 <topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.1</ge><lt>11.1_6</lt></range>
	<range><ge>10.4</ge><lt>10.4_5</lt></range>
	<range><ge>10.3</ge><lt>10.3_26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Invoking SSL_read()/SSL_write() while in an error state
	causes data to be passed without being decrypted/encrypted
	directly from the SSL/TLS record layer.
	In order to exploit this issue an application bug would
	have to be present that resulted in a call to
	SSL_read()/SSL_write() being issued after having already
	received a fatal error. [CVE-2017-3737]
	There is an overflow bug in the x86_64 Montgomery
	multiplication procedure used in exponentiation with 1024-bit
	moduli. This only affects processors that support the AVX2
	but not ADX extensions like Intel Haswell (4th generation).
	[CVE-2017-3738] This bug only affects FreeBSD 11.x.
	<h1>Impact:</h1>
	Applications with incorrect error handling may inappropriately
	pass unencrypted data. [CVE-2017-3737]
	Mishandling of carry propagation will produce incorrect
	output, and make it easier for a remote attacker to obtain
	sensitive private-key information. No EC algorithms are
	affected and analysis suggests that attacks against RSA and
	DSA as a result of this defect would be very difficult to
	perform and are not believed likely.
	Attacks against DH1024 are considered just feasible
	(although very difficult) because most of the work necessary
	to deduce information about a private key may be performed
	offline. The amount of resources required for such an attack
	would be very significant and likely only accessible to a
	limited number of attackers. However, for an attack on TLS
	to be meaningful, the server would have to share the DH1024
	private key among multiple clients, which is no longer an
	option since CVE-2016-0701. [CVE-2017-3738]
 </body>
 </description>
 <references>
 <cvename>CVE-2016-0701</cvename>
 <cvename>CVE-2017-3737</cvename>
 <cvename>CVE-2017-3738</cvename>
 <freebsdsa>SA-17:12.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2017-12-09</discovery>
 <entry>2017-12-10</entry>
 </dates>
 </vuln>

<vuln vid="4b228e69-22e1-4019-afd0-8aa716d0ec0b">
 <topic>wireshark -- multiple security issues</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<range><ge>2.2.0</ge><le>2.2.10</le></range>
	<range><ge>2.4.0</ge><le>2.4.2</le></range>
 </package>
 <package>
	<name>wireshark-lite</name>
	<range><ge>2.2.0</ge><le>2.2.10</le></range>
	<range><ge>2.4.0</ge><le>2.4.2</le></range>
 </package>
 <package>
	<name>wireshark-qt5</name>
	<range><ge>2.2.0</ge><le>2.2.10</le></range>
	<range><ge>2.4.0</ge><le>2.4.2</le></range>
 </package>
 <package>
	<name>tshark</name>
	<range><ge>2.2.0</ge><le>2.2.10</le></range>
	<range><ge>2.4.0</ge><le>2.4.2</le></range>
 </package>
 <package>
	<name>tshark-lite</name>
	<range><ge>2.2.0</ge><le>2.2.10</le></range>
	<range><ge>2.4.0</ge><le>2.4.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wireshark developers reports:
	<blockquote cite="https://www.wireshark.org/security/">
	 wnpa-sec-2017-47: The IWARP_MPA dissector could crash. (CVE-2017-17084)
	 wnpa-sec-2017-48: The NetBIOS dissector could crash. Discovered by Kamil Frankowicz. (CVE-2017-17083)
	 wnpa-sec-2017-49: The CIP Safety dissector could crash. (CVE-2017-17085)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.wireshark.org/security/</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2017-47.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2017-48.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2017-49.html</url>
 <cvename>CVE-2017-17083</cvename>
 <cvename>CVE-2017-17084</cvename>
 <cvename>CVE-2017-17085</cvename>
 </references>
 <dates>
 <discovery>2017-11-30</discovery>
 <entry>2017-12-10</entry>
 </dates>
 </vuln>

<vuln vid="3bb451fc-db64-11e7-ac58-b499baebfeaf">
 <topic>OpenSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><gt>1.0.2</gt><lt>1.0.2n</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20171207.txt">
	 <ul><li>Read/write after SSL object in error state (CVE-2017-3737) 
	 OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error
	 state" mechanism. The intent was that if a fatal error occurred
	 during a handshake then OpenSSL would move into the error state and
	 would immediately fail if you attempted to continue the handshake.
	 This works as designed for the explicit handshake functions
	 (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to
	 a bug it does not work correctly if SSL_read() or SSL_write() is
	 called directly. In that scenario, if the handshake fails then a
	 fatal error will be returned in the initial function call. If
	 SSL_read()/SSL_write() is subsequently called by the application for
	 the same SSL object then it will succeed and the data is passed
	 without being decrypted/encrypted directly from the SSL/TLS record
	 layer.</li>
	 <li>rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738) 
	 There is an overflow bug in the AVX2 Montgomery multiplication
	 procedure used in exponentiation with 1024-bit moduli. No EC
	 algorithms are affected. Analysis suggests that attacks against
	 RSA and DSA as a result of this defect would be very difficult to
	 perform and are not believed likely. Attacks against DH1024 are
	 considered just feasible, because most of the work necessary to
	 deduce information about a private key may be performed offline.
	 The amount of resources required for such an attack would be
	 significant. However, for an attack on TLS to be meaningful, the
	 server would have to share the DH1024 private key among multiple
	 clients, which is no longer an option since CVE-2016-0701.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20171207.txt</url>
 <cvename>CVE-2017-3737</cvename>
 <cvename>CVE-2017-3738</cvename>
 </references>
 <dates>
 <discovery>2017-12-07</discovery>
 <entry>2017-12-07</entry>
 </dates>
 </vuln>

<vuln vid="9442a811-dab3-11e7-b5af-a4badb2f4699">
 <topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.1</ge><lt>11.1_5</lt></range>
	<range><ge>11.0</ge><lt>11.0_16</lt></range>
	<range><ge>10.4</ge><lt>10.4_4</lt></range>
	<range><ge>10.3</ge><lt>10.3_25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	If an X.509 certificate has a malformed IPAddressFamily
	extension, OpenSSL could do a one-byte buffer overread.
	[CVE-2017-3735]
	There is a carry propagating bug in the x86_64 Montgomery
	squaring procedure. This only affects processors that support
	the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th
	generation) and later or AMD Ryzen. [CVE-2017-3736] This
	bug only affects FreeBSD 11.x.
	<h1>Impact:</h1>
	Application using OpenSSL may display erroneous certificate
	in text format. [CVE-2017-3735]
	Mishandling of carry propagation will produce incorrect
	output, and make it easier for a remote attacker to obtain
	sensitive private-key information. No EC algorithms are
	affected, analysis suggests that attacks against RSA and
	DSA as a result of this defect would be very difficult to
	perform and are not believed likely.
	Attacks against DH are considered just feasible (although
	very difficult) because most of the work necessary to deduce
	information about a private key may be performed offline.
	The amount of resources required for such an attack would
	be very significant and likely only accessible to a limited
	number of attackers. An attacker would additionally need
	online access to an unpatched system using the target private
	key in a scenario with persistent DH parameters and a private
	key that is shared between multiple clients. [CVE-2017-3736]
 </body>
 </description>
 <references>
 <cvename>CVE-2017-3735</cvename>
 <cvename>CVE-2017-3736</cvename>
 <freebsdsa>SA-17:11.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2017-11-29</discovery>
 <entry>2017-12-06</entry>
 </dates>
 </vuln>

<vuln vid="759059ac-dab3-11e7-b5af-a4badb2f4699">
 <topic>FreeBSD -- Information leak in kldstat(2)</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_4</lt></range>
	<range><ge>11.0</ge><lt>11.0_15</lt></range>
	<range><ge>10.4</ge><lt>10.4_3</lt></range>
	<range><ge>10.3</ge><lt>10.3_24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The kernel does not properly clear the memory of the
	kld_file_stat structure before filling the data. Since the
	structure filled by the kernel is allocated on the kernel
	stack and copied to userspace, a leak of information from
	the kernel stack is possible.
	<h1>Impact:</h1>
	Some bytes from the kernel stack can be observed in
	userspace.
 </body>
 </description>
 <references>
 <cvename>CVE-2017-1088</cvename>
 <freebsdsa>SA-17:10.kldstat</freebsdsa>
 </references>
 <dates>
 <discovery>2017-11-15</discovery>
 <entry>2017-12-06</entry>
 </dates>
 </vuln>

<vuln vid="5b1463dd-dab3-11e7-b5af-a4badb2f4699">
 <topic>FreeBSD -- POSIX shm allows jails to access global namespace</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.4</ge><lt>10.4_3</lt></range>
	<range><ge>10.3</ge><lt>10.3_24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Named paths are globally scoped, meaning a process located
	in one jail can read and modify the content of POSIX shared
	memory objects created by a process in another jail or the
	host system.
	<h1>Impact:</h1>
	A malicious user that has access to a jailed system is
	able to abuse shared memory by injecting malicious content
	in the shared memory region. This memory region might be
	executed by applications trusting the shared memory, like
	Squid.
	This issue could lead to a Denial of Service or local
	privilege escalation.
 </body>
 </description>
 <references>
 <cvename>CVE-2017-1087</cvename>
 <freebsdsa>SA-17:09.shm</freebsdsa>
 </references>
 <dates>
 <discovery>2017-11-15</discovery>
 <entry>2017-12-06</entry>
 </dates>
 </vuln>

<vuln vid="34a3f9b5-dab3-11e7-b5af-a4badb2f4699">
 <topic>FreeBSD -- Kernel data leak via ptrace(PT_LWPINFO)</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.1</ge><lt>11.1_4</lt></range>
	<range><ge>11.0</ge><lt>11.0_15</lt></range>
	<range><ge>10.4</ge><lt>10.4_3</lt></range>
	<range><ge>10.3</ge><lt>10.3_24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Not all information in the struct ptrace_lwpinfo is
	relevant for the state of any thread, and the kernel does
	not fill the irrelevant bytes or short strings. Since the
	structure filled by the kernel is allocated on the kernel
	stack and copied to userspace, a leak of information of the
	kernel stack of the thread is possible from the debugger.
	<h1>Impact:</h1>
	Some bytes from the kernel stack of the thread using
	ptrace(PT_LWPINFO) call can be observed in userspace.
 </body>
 </description>
 <references>
 <cvename>CVE-2017-1086</cvename>
 <freebsdsa>SA-17:08.ptrace</freebsdsa>
 </references>
 <dates>
 <discovery>2017-11-15</discovery>
 <entry>2017-12-06</entry>
 </dates>
 </vuln>

<vuln vid="1f8de723-dab3-11e7-b5af-a4badb2f4699">
 <topic>FreeBSD -- WPA2 protocol vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.1</ge><lt>11.1_2</lt></range>
	<range><ge>11.0</ge><lt>11.0_13</lt></range>
	<range><ge>10.4</ge><lt>10.4_1</lt></range>
	<range><ge>10.3</ge><lt>10.3_22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A vulnerability was found in how a number of implementations
	can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK,
	or IGTK) by replaying a specific frame that is used to
	manage the keys.
	<h1>Impact:</h1>
	Such reinstallation of the encryption key can result in
	two different types of vulnerabilities: disabling replay
	protection and significantly reducing the security of
	encryption to the point of allowing frames to be decrypted
	or some parts of the keys to be determined by an attacker
	depending on which cipher is used.
 </body>
 </description>
 <references>
 <cvename>CVE-2017-1307</cvename>
 <cvename>CVE-2017-1308</cvename>
 <freebsdsa>SA-17:07.wpa</freebsdsa>
 </references>
 <dates>
 <discovery>2017-10-16</discovery>
 <entry>2017-12-06</entry>
 </dates>
 </vuln>

<vuln vid="b7e23050-2d5d-4e61-9b48-62e89db222ca">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><ge>57.0,1</ge><lt>57.0.1,1</lt></range>
	<range><lt>56.0.2_11,1</lt></range>
 </package>
 <package>
	<name>waterfox</name>
	<range><lt>56.0.s20171130</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>52.5.1,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>52.5.1,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-27/">
	 CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data
	 CVE-2017-7844: Visited history information leak through SVG image
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-7843</cvename>
 <cvename>CVE-2017-7844</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2017-27/</url>
 </references>
 <dates>
 <discovery>2017-11-29</discovery>
 <entry>2017-12-05</entry>
 </dates>
 </vuln>

<vuln vid="17133e7e-d764-11e7-b5af-a4badb2f4699">
 <topic>varnish -- information disclosure vulnerability</topic>
 <affects>
 <package>
	<name>varnish4</name>
	<range><lt>4.1.9</lt></range>
 </package>
 <package>
	<name>varnish5</name>
	<range><lt>5.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Varnish reports:
	<blockquote cite="https://varnish-cache.org/security/VSV00002.html">
	 A wrong if statement in the varnishd source code means that
	 synthetic objects in stevedores which over-allocate, may leak up to page
	 size of data from a malloc(3) memory allocation.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://varnish-cache.org/security/VSV00002.html</url>
 <cvename>CVE-2017-8807</cvename>
 </references>
 <dates>
 <discovery>2017-11-15</discovery>
 <entry>2017-12-02</entry>
 </dates>
 </vuln>

<vuln vid="addad6de-d752-11e7-99bf-00e04c1ea73d">
 <topic>mybb -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mybb</name>
	<range><lt>1.8.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mybb Team reports:
	<blockquote cite="https://blog.mybb.com/2017/11/28/mybb-1-8-14-released-security-maintenance-release/">
	 High risk: Language file headers RCE
	 Low risk: Language Pack Properties XSS
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.mybb.com/2017/11/28/mybb-1-8-14-released-security-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2017-11-27</discovery>
 <entry>2017-12-02</entry>
 </dates>
 </vuln>

<vuln vid="a2589511-d6ba-11e7-88dd-00e04c1ea73d">
 <topic>wordpress -- multiple issues</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>4.9.1,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.9.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wordpress developers reports:
	<blockquote cite="https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/">
	 Use a properly generated hash for the newbloguser key instead of a determinate substring.
	 Add escaping to the language attributes used on html elements.
	 Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.
	 Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2017-11-29</discovery>
 <entry>2017-12-01</entry>
 </dates>
 </vuln>

<vuln vid="e91cf90c-d6dd-11e7-9d10-001999f8d30b">
 <topic>asterisk -- DOS Vulnerability in Asterisk chan_skinny</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.18.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
	 If the chan_skinny (AKA SCCP protocol) channel driver
	 is flooded with certain requests it can cause the asterisk
	 process to use excessive amounts of virtual memory
	 eventually causing asterisk to stop processing requests
	 of any kind.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2017-013.html</url>
 <cvename>CVE-2017-17090</cvename>
 </references>
 <dates>
 <discovery>2017-11-30</discovery>
 <entry>2017-12-01</entry>
 <modified>2017-12-13</modified>
 </dates>
 </vuln>

<vuln vid="75dd622c-d5fd-11e7-b9fe-c13eb7bcbf4f">
 <topic>exim -- remote DoS attack in BDAT processing</topic>
 <affects>
 <package>
	<name>exim</name>
	<range><ge>4.88</ge><lt>4.89.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Exim developers team reports:
	<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=2199">
	 The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.exim.org/show_bug.cgi?id=2199</url>
 <cvename>CVE-2017-16944</cvename>
 </references>
 <dates>
 <discovery>2017-11-23</discovery>
 <entry>2017-11-30</entry>
 </dates>
 </vuln>

<vuln vid="a66f9be2-d519-11e7-9866-c85b763a2f96">
 <topic>xrdp -- local user can cause a denial of service</topic>
 <affects>
 <package>
	<name>xrdp-devel</name>
	<range><le>0.9.3,1</le></range>
	<range><gt>0.9.3_1,1</gt><le>0.9.4,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	xrdp reports:
	<blockquote cite="https://github.com/neutrinolabs/xrdp/pull/958">
	 The scp_v0s_accept function in the session manager uses an untrusted integer as a write length,
	 which allows local users to cause a denial of service (buffer overflow and application crash)
	 or possibly have unspecified other impact via a crafted input stream.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-16927</cvename>
 </references>
 <dates>
 <discovery>2017-11-23</discovery>
 <entry>2017-11-29</entry>
 </dates>
 </vuln>

<vuln vid="301a01b7-d50e-11e7-ac58-b499baebfeaf">
 <topic>cURL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.21.0</ge><lt>7.57.0</lt></range>
 </package>
 <package>
	<name>linux-c7-curl</name>
	<range><ge>7.21.0</ge><lt>7.29.0_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports:
	<blockquote cite="https://curl.haxx.se/changes.html">
	 <ul><li>NTLM buffer overflow via integer overflow
	 (CVE-2017-8816) libcurl contains a buffer overrun flaw
	 in the NTLM authentication code.
	 The internal function Curl_ntlm_core_mk_ntlmv2_hash sums up
	 the lengths of the user name + password (= SUM) and multiplies
	 the sum by two (= SIZE) to figure out how large storage to
	 allocate from the heap.</li>
	 <li>FTP wildcard out of bounds read (CVE-2017-8817) 
	 libcurl contains a read out of bounds flaw in the FTP wildcard
	 function.
	 libcurl's FTP wildcard matching feature, which is enabled with
	 the CURLOPT_WILDCARDMATCH option can use a built-in wildcard
	 function or a user provided one. The built-in wildcard function
	 has a flaw that makes it not detect the end of the pattern
	 string if it ends with an open bracket ([) but instead it will
	 continue reading the heap beyond the end of the URL buffer that
	 holds the wildcard.</li>
	 <li>SSL out of buffer access (CVE-2017-8818) 
	 libcurl contains an out boundary access flaw in SSL related code.
	 When allocating memory for a connection (the internal struct
	 called connectdata), a certain amount of memory is allocated at
	 the end of the struct to be used for SSL related structs. Those
	 structs are used by the particular SSL library libcurl is built
	 to use. The application can also tell libcurl which specific SSL
	 library to use if it was built to support more than one.
	 </li></ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/changes.html</url>
 <cvename>CVE-2017-8816</cvename>
 <cvename>CVE-2017-8817</cvename>
 <cvename>CVE-2017-8818</cvename>
 </references>
 <dates>
 <discovery>2017-11-29</discovery>
 <entry>2017-11-29</entry>
 <modified>2017-12-11</modified>
 </dates>
 </vuln>

<vuln vid="0d369972-d4ba-11e7-bfca-005056925db4">
 <topic>borgbackup -- remote users can override repository restrictions</topic>
 <affects>
 <package>
	<name>py34-borgbackup</name>
	<name>py35-borgbackup</name>
	<name>py36-borgbackup</name>
	<range><ge>1.1.0</ge><lt>1.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	BorgBackup reports:
	<blockquote cite="https://github.com/borgbackup/borg/blob/1.1.3/docs/changes.rst#version-113-2017-11-27">
	 Incorrect implementation of access controls allows remote users to
	 override repository restrictions in Borg servers. A user able to
	 access a remote Borg SSH server is able to circumvent access controls
	 post-authentication. Affected releases: 1.1.0, 1.1.1, 1.1.2. Releases
	 1.0.x are NOT affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-15914</cvename>
 <url>https://github.com/borgbackup/borg/blob/1.1.3/docs/changes.rst#version-113-2017-11-27</url>
 </references>
 <dates>
 <discovery>2017-11-27</discovery>
 <entry>2017-11-29</entry>
 </dates>
 </vuln>

<vuln vid="6056bf68-f570-4e70-b740-b9f606971283">
 <topic>palemoon -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>palemoon</name>
	<range><lt>27.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pale Moon reports:
	<blockquote cite="http://www.palemoon.org/releasenotes.shtml">
	 CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers
	 CVE-2017-7835: Mixed content blocking incorrectly applies with redirects
	 CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-7832</cvename>
 <cvename>CVE-2017-7835</cvename>
 <cvename>CVE-2017-7840</cvename>
 </references>
 <dates>
 <discovery>2017-11-14</discovery>
 <entry>2017-11-28</entry>
 </dates>
 </vuln>

<vuln vid="68b29058-d348-11e7-b9fe-c13eb7bcbf4f">
 <topic>exim -- remote code execution, deny of service in BDAT</topic>
 <affects>
 <package>
	<name>exim</name>
	<range><ge>4.88</ge><lt>4.89_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Exim team reports:
	<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=2199">
	 The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.exim.org/show_bug.cgi?id=2199</url>
 </references>
 <dates>
 <discovery>2017-11-23</discovery>
 <entry>2017-11-27</entry>
 </dates>
 </vuln>

<vuln vid="7761288c-d148-11e7-87e5-00e04c1ea73d">
 <topic>mybb -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mybb</name>
	<range><lt>1.8.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	myBB Team reports:
	<blockquote cite="https://blog.mybb.com/2017/11/07/mybb-1-8-13-released-security-maintenance-release/">
	 High risk: Installer RCE on configuration file write
	 High risk: Language file headers RCE
	 Medium risk: Installer XSS
	 Medium risk: Mod CP Edit Profile XSS
	 Low risk: Insufficient moderator permission check in delayed moderation tools
	 Low risk: Announcements HTML filter bypass
	 Low risk: Language Pack Properties XSS.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.mybb.com/2017/11/07/mybb-1-8-13-released-security-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2017-11-07</discovery>
 <entry>2017-11-24</entry>
 </dates>
 </vuln>

<vuln vid="50127e44-7b88-4ade-8e12-5d57320823f1">
 <topic>salt -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-salt</name>
	<name>py32-salt</name>
	<name>py33-salt</name>
	<name>py34-salt</name>
	<name>py35-salt</name>
	<name>py36-salt</name>
	<range><lt>2016.11.8</lt></range>
	<range><ge>2017.7.0</ge><lt>2017.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SaltStack reports:
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html">
	 Directory traversal vulnerability in minion id validation in SaltStack.
	 Allows remote minions with incorrect credentials to authenticate to a
	 master via a crafted minion ID. Credit for discovering the security flaw
	 goes to: Julian Brost (julian@0x4a42.net). NOTE: this vulnerability exists
	 because of an incomplete fix for CVE-2017-12791.
	 Remote Denial of Service with a specially crafted authentication request.
	 Credit for discovering the security flaw goes to: Julian Brost
	 (julian@0x4a42.net)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-14695</cvename>
 <cvename>CVE-2017-14696</cvename>
 <url>https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html</url>
 <url>https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.8.html</url>
 <url>https://github.com/saltstack/salt/commit/80d90307b07b3703428ecbb7c8bb468e28a9ae6d</url>
 <url>https://github.com/saltstack/salt/commit/5f8b5e1a0f23fe0f2be5b3c3e04199b57a53db5b</url>
 </references>
 <dates>
 <discovery>2017-10-09</discovery>
 <entry>2017-11-23</entry>
 </dates>
 </vuln>

<vuln vid="ef3423e4-d056-11e7-a52c-002590263bf5">
 <topic>codeigniter -- input validation bypass</topic>
 <affects>
 <package>
	<name>codeigniter</name>
	<range><lt>3.1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The CodeIgniter changelog reports:
	<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
	 Security: Fixed a potential object injection in Cache Library 'apc'
	 driver when save() is used with $raw = TRUE.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.codeigniter.com/user_guide/changelog.html</url>
 </references>
 <dates>
 <discovery>2017-09-25</discovery>
 <entry>2017-11-23</entry>
 </dates>
 </vuln>

<vuln vid="288f7cee-ced6-11e7-8ae9-0050569f0b83">
 <topic>procmail -- Heap-based buffer overflow</topic>
 <affects>
 <package>
	<name>procmail</name>
	<range><lt>3.22_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://www.debian.org/security/2017/dsa-4041">
	 A remote attacker could use a flaw to cause formail to crash,
	 resulting in a denial of service or data loss.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-16844</cvename>
 <url>https://www.debian.org/security/2017/dsa-4041</url>
 <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511</url>
 </references>
 <dates>
 <discovery>2017-11-16</discovery>
 <entry>2017-11-21</entry>
 <modified>2017-12-08</modified>
 </dates>
 </vuln>

<vuln vid="bf266183-cec7-11e7-af2d-2047478f2f70">
 <topic>frr -- BGP Mishandled attribute length on Error</topic>
 <affects>
 <package>
	<name>frr</name>
	<range><lt>3.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	FRR reports:
	<blockquote cite="https://frrouting.org/community/security/cve-2017-15865.html">
	 BGP Mishandled attribute length on Error
	 A vulnerability exists in the BGP daemon of FRR where a malformed BGP UPDATE
		packet can leak information from the BGP daemon and cause a denial of
		service by crashing the daemon.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-15865</cvename>
 <url>https://frrouting.org/community/security/cve-2017-15865.html</url>
 </references>
 <dates>
 <discovery>2017-11-08</discovery>
 <entry>2017-11-21</entry>
 </dates>
 </vuln>

<vuln vid="db570002-ce06-11e7-804e-c85b763a2f96">
 <topic>cacti -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>1.1.28</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cacti reports:
	<blockquote cite="https://www.cacti.net/release_notes.php?version=1.1.28">
	 Changelog
	 issue#1057: CVE-2017-16641 - Potential vulnerability in RRDtool functions
	 issue#1066: CVE-2017-16660 in remote_agent.php logging function
	 issue#1066: CVE-2017-16661 in view log file
	 issue#1071: CVE-2017-16785 in global_session.php Reflection XSS
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-16641</cvename>
 <cvename>CVE-2017-16660</cvename>
 <cvename>CVE-2017-16661</cvename>
 <cvename>CVE-2017-16785</cvename>
 <url>https://sourceforge.net/p/cacti/mailman/message/36122745/</url>
 </references>
 <dates>
 <discovery>2017-11-01</discovery>
 <entry>2017-11-20</entry>
 </dates>
 </vuln>

<vuln vid="298829e2-ccce-11e7-92e4-000c29649f92">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki127</name>
	<range><lt>1.27.3</lt></range>
 </package>
 <package>
	<name>mediawiki128</name>
	<range><lt>1.28.2</lt></range>
 </package>
 <package>
	<name>mediawiki129</name>
	<range><lt>1.29.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mediawiki reports:
	<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html">
	 security fixes:
	 T128209: Reflected File Download from api.php. Reported by Abdullah Hussam.
	 T165846: BotPasswords doesn't throttle login attempts.
	 T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password.
	 T178451: XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping.
	 T176247: It's possible to mangle HTML via raw message parameter expansion.
	 T125163: id attribute on headlines allow raw.
	 T124404: language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition.
	 T119158: Language converter: unsafe attribute injection via glossary rules.
	 T180488: api.log contains passwords in plaintext wasn't correctly fixed.
	 T180231: composer.json has require-dev versions of PHPUnit with known security issues. Reported by Tom Hutchison.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-8808</cvename>
 <cvename>CVE-2017-8809</cvename>
 <cvename>CVE-2017-8810</cvename>
 <cvename>CVE-2017-8811</cvename>
 <cvename>CVE-2017-8812</cvename>
 <cvename>CVE-2017-8814</cvename>
 <cvename>CVE-2017-8815</cvename>
 <cvename>CVE-2017-0361</cvename>
 <cvename>CVE-2017-9841</cvename>
 <url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html</url>
 </references>
 <dates>
 <discovery>2017-11-14</discovery>
 <entry>2017-11-19</entry>
 </dates>
 </vuln>

<vuln vid="52f10525-caff-11e7-b590-6451062f0f7a">
 <topic>Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>27.0.0.187</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-33.html">
	 <ul>
	 <li>These updates resolve out-of-bounds read vulnerabilities that
	 could lead to remote code execution (CVE-2017-3112,
	 CVE-2017-3114, CVE-2017-11213).</li>
	 <li>These updates resolve use after free vulnerabilities that
	 could lead to remote code execution (CVE-2017-11215,
	 CVE-2017-11225).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-3112</cvename>
 <cvename>CVE-2017-3114</cvename>
 <cvename>CVE-2017-11213</cvename>
 <cvename>CVE-2017-11215</cvename>
 <cvename>CVE-2017-11225</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb17-33.html</url>
 </references>
 <dates>
 <discovery>2017-11-14</discovery>
 <entry>2017-11-16</entry>
 </dates>
 </vuln>

<vuln vid="b4b7ec7d-ca27-11e7-a12d-6cc21735f730">
 <topic>shibboleth2-sp -- "Dynamic" metadata provider plugin issue</topic>
 <affects>
 <package>
	<name>shibboleth2-sp</name>
	<range><lt>2.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Internet2 community reports:
	<blockquote cite="http://shibboleth.internet2.edu/secadv/secadv_20171115.txt">
	 
	 The Shibboleth Service Provider software includes a MetadataProvider
	 plugin with the plugin type "Dynamic" to obtain metadata on demand
	 from a query server, in place of the more typical mode of
	 downloading aggregates separately containing all of the metadata to
	 load.
	 
	 All the plugin types rely on MetadataFilter plugins to perform
	 critical security checks such as signature verification, enforcement
	 of validity periods, and other checks specific to deployments.
	 
	 Due to a coding error, the "Dynamic" plugin fails to configure
	 itself with the filters provided to it and thus omits whatever
	 checks they are intended to perform, which will typically leave
	 deployments vulnerable to active attacks involving the substitution
	 of metadata if the network path to the query service is
	 compromised.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://shibboleth.internet2.edu/secadv/secadv_20171115.txt</url>
 </references>
 <dates>
 <discovery>2017-11-15</discovery>
 <entry>2017-11-15</entry>
 </dates>
 </vuln>

<vuln vid="f78eac48-c3d1-4666-8de5-63ceea25a578">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	
	<range><lt>56.0.2_10,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.2</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>52.5.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>52.5.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/">
	 CVE-2017-7828: Use-after-free of PressShell while restyling layout
	 CVE-2017-7830: Cross-origin URL information leak through Resource Timing API
	 CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects
	 CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers
	 CVE-2017-7833: Domain spoofing with Arabic and Indic vowel marker characters
	 CVE-2017-7834: data: URLs opened in new tabs bypass CSP protections
	 CVE-2017-7835: Mixed content blocking incorrectly applies with redirects
	 CVE-2017-7836: Pingsender dynamically loads libcurl on Linux and OS X
	 CVE-2017-7837: SVG loaded as &lt;img&gt; can use meta tags to set cookies
	 CVE-2017-7838: Failure of individual decoding of labels in international domain names triggers punycode display of entire IDN
	 CVE-2017-7839: Control characters before javascript: URLs defeats self-XSS prevention mechanism
	 CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags
	 CVE-2017-7842: Referrer Policy is not always respected for &lt;link&gt; elements
	 CVE-2017-7827: Memory safety bugs fixed in Firefox 57
	 CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-7826</cvename>
 <cvename>CVE-2017-7827</cvename>
 <cvename>CVE-2017-7828</cvename>
 <cvename>CVE-2017-7830</cvename>
 <cvename>CVE-2017-7831</cvename>
 <cvename>CVE-2017-7832</cvename>
 <cvename>CVE-2017-7833</cvename>
 <cvename>CVE-2017-7834</cvename>
 <cvename>CVE-2017-7835</cvename>
 <cvename>CVE-2017-7836</cvename>
 <cvename>CVE-2017-7837</cvename>
 <cvename>CVE-2017-7838</cvename>
 <cvename>CVE-2017-7839</cvename>
 <cvename>CVE-2017-7840</cvename>
 <cvename>CVE-2017-7842</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2017-24/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2017-25/</url>
 </references>
 <dates>
 <discovery>2017-11-14</discovery>
 <entry>2017-11-14</entry>
 </dates>
 </vuln>

<vuln vid="27b38d85-c891-11e7-a7bd-cd1209e563f2">
 <topic>rubygem-geminabox -- XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-geminabox</name>
	<range><lt>0.13.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-16792">
	 Stored cross-site scripting (XSS) vulnerability in "geminabox"
	 (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary
	 web script via the "homepage" value of a ".gemspec" file, related
	 to views/gem.erb and views/index.erb.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-16792</url>
 <cvename>CVE-2017-16792</cvename>
 </references>
 <dates>
 <discovery>2017-11-13</discovery>
 <entry>2017-11-13</entry>
 </dates>
 </vuln>

<vuln vid="795ccee1-c7ed-11e7-ad7d-001e2a3f778d">
 <topic>konversation -- crash in IRC message parsing</topic>
 <affects>
 <package>
	<name>konversation</name>
	<range><lt>1.7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	KDE reports:
	<blockquote cite="https://www.kde.org/info/security/advisory-20171112-1.txt">
	 Konversation has support for colors in IRC messages. Any malicious user connected to the same IRC network can send a carefully crafted message that will crash the Konversation user client.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-15923</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15923</url>
 <url>https://www.kde.org/info/security/advisory-20171112-1.txt</url>
 </references>
 <dates>
 <discovery>2017-10-27</discovery>
 <entry>2017-11-12</entry>
 </dates>
 </vuln>

<vuln vid="f622608c-c53c-11e7-a633-009c02a2ab30">
 <topic>roundcube -- file disclosure vulnerability</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><lt>1.3.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16651">
	 Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before
	 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem,
	 including configuration files, as exploited in the wild in November 2017.
	 The attacker must be able to authenticate at the target system with a valid
	 username/password as the attack requires an active session.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/roundcube/roundcubemail/issues/6026</url>
 <url>https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10</url>
 <cvename>CVE-2017-16651</cvename>
 <freebsdpr>ports/223557</freebsdpr>
 </references>
 <dates>
 <discovery>2017-11-06</discovery>
 <entry>2017-11-11</entry>
 <modified>2017-12-31</modified>
 </dates>
 </vuln>

<vuln vid="f8e72cd4-c66a-11e7-bb17-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>62.0.3202.89</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html">
	 2 security fixes in this release, including:
	 <ul>
	 <li>[777728] Critical CVE-2017-15398: Stack buffer overflow in QUIC.
	 Reported by Ned Williamson on 2017-10-24</li>
	 <li>[776677] High CVE-2017-15399: Use after free in V8. Reported by
	 Zhao Qixun of Qihoo 360 Vulcan Team on 2017-10-20</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-15398</cvename>
 <cvename>CVE-2017-15399</cvename>
 <url>https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2017-11-06</discovery>
 <entry>2017-11-10</entry>
 </dates>
 </vuln>

<vuln vid="1f02af5d-c566-11e7-a12d-6cc21735f730">
 <topic>PostgreSQL vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.24</lt></range>
 </package>
 <package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.20</lt></range>
 </package>
 <package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.15</lt></range>
 </package>
 <package>
	<name>postgresql95-server</name>
	<range><ge>9.5.0</ge><lt>9.5.10</lt></range>
 </package>
 <package>
	<name>postgresql96-server</name>
	<range><ge>9.6.0</ge><lt>9.6.6</lt></range>
 </package>
 <package>
	<name>postgresql10-server</name>
	<range><ge>10.0</ge><lt>10.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/about/news/1801/">
	 <ul>
	 <li>CVE-2017-15098: Memory disclosure in JSON functions</li>
	 <li>CVE-2017-15099: INSERT ... ON CONFLICT DO UPDATE fails to
	 enforce SELECT privileges</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-15099</cvename>
 <cvename>CVE-2017-15098</cvename>
 </references>
 <dates>
 <discovery>2017-10-10</discovery>
 <entry>2017-11-09</entry>
 </dates>
 </vuln>

<vuln vid="1c2a9d76-9d98-43c3-8f5d-8c059b104d99">
 <topic>jenkins -- multiple issues</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.89</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.73.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins developers report:
	<blockquote cite="http://www.securityfocus.com/bid/99574">
	 Jenkins stores metadata related to people, which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping. This potentially resulted in a number of problems.
	 Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://jenkins.io/security/advisory/2017-11-08/</url>
 </references>
 <dates>
 <discovery>2017-11-08</discovery>
 <entry>2017-11-09</entry>
 </dates>
 </vuln>

<vuln vid="be261737-c535-11e7-8da5-001999f8d30b">
 <topic>asterisk -- Memory/File Descriptor/RTP leak in pjsip session resource</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><ge>13.5.0</ge><lt>13.18.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 A memory leak occurs when an Asterisk pjsip session
	 object is created and that call gets rejected before the
	 session itself is fully established. When this happens
	 the session object never gets destroyed. This then leads
	 to file descriptors and RTP ports being leaked as well.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2017-011.html</url>
 <cvename>CVE-2017-16672</cvename>
 </references>
 <dates>
 <discovery>2017-10-15</discovery>
 <entry>2017-11-09</entry>
 <modified>2017-12-13</modified>
 </dates>
 </vuln>

<vuln vid="ab04cb0b-c533-11e7-8da5-001999f8d30b">
 <topic>asterisk -- Buffer overflow in CDR's set user</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.18.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 No size checking is done when setting the user field
	 for Party B on a CDR. Thus, it is possible for someone
	 to use an arbitrarily large string and write past the end
	 of the user field storage buffer. The earlier AST-2017-001
	 advisory for the CDR user field overflow was for the Party
	 A buffer.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2017-010.html</url>
 <cvename>CVE-2017-16671</cvename>
 </references>
 <dates>
 <discovery>2017-10-09</discovery>
 <entry>2017-11-09</entry>
 <modified>2017-12-13</modified>
 </dates>
 </vuln>

<vuln vid="19b052c9-c533-11e7-8da5-001999f8d30b">
 <topic>asterisk -- Buffer overflow in pjproject header parsing can cause crash in Asterisk</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.18.1</lt></range>
 </package>
 <package>
	<name>pjsip</name>
	<range><lt>2.7.1</lt></range>
 </package>
 <package>
	<name>pjsip-extsrtp</name>
	<range><lt>2.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 By carefully crafting invalid values in the Cseq and
	 the Via header port, pjprojects packet parsing code can
	 create strings larger than the buffer allocated to hold
	 them. This will usually cause Asterisk to crash immediately.
	 The packets do not have to be authenticated.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2017-009.html</url>
 </references>
 <dates>
 <discovery>2017-10-05</discovery>
 <entry>2017-11-09</entry>
 <modified>2017-11-15</modified>
 </dates>
 </vuln>

<vuln vid="f40f07aa-c00f-11e7-ac58-b499baebfeaf">
 <topic>OpenSSL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2m,1</lt></range>
 </package>
 <package>
	<name>openssl-devel</name>
	<range><lt>1.1.0g</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20171102.txt">
	 bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736) 
	 Severity: Moderate 
	 There is a carry propagating bug in the x86_64 Montgomery squaring
	 procedure. No EC algorithms are affected. Analysis suggests that
	 attacks against RSA and DSA as a result of this defect would be
	 very difficult to perform and are not believed likely. Attacks
	 against DH are considered just feasible (although very difficult)
	 because most of the work necessary to deduce information about a
	 private key may be performed offline.
	 Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735) 
	 Severity: Low 
	 This issue was previously announced in security advisory
	 https://www.openssl.org/news/secadv/20170828.txt, but the fix has
	 not previously been included in a release due to its low severity.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20171102.txt</url>
 <cvename>CVE-2017-3735</cvename>
 <cvename>CVE-2017-3736</cvename>
 </references>
 <dates>
 <discovery>2017-11-02</discovery>
 <entry>2017-11-02</entry>
 </dates>
 </vuln>

<vuln vid="cee3d12f-bf41-11e7-bced-00e04c1ea73d">
 <topic>wordpress -- multiple issues</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.8.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wordpress developers reports:
	<blockquote cite="https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/">
	 WordPress versions 4.8.2 and earlier are affected by an issue
	 where $wpdb-&gt;prepare() can create unexpected and unsafe queries
	 leading to potential SQL injection (SQLi). WordPress core is not
	 directly vulnerable to this issue, but we've added hardening to
	 prevent plugins and themes from accidentally causing a vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/</url>
 </references>
 <dates>
 <discovery>2017-10-31</discovery>
 <entry>2017-11-01</entry>
 </dates>
 </vuln>

<vuln vid="4684a426-774d-4390-aa19-b8dd481c4c94">
 <topic>wireshark -- multiple security issues</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<range><ge>2.2.0</ge><le>2.2.9</le></range>
	<range><ge>2.4.0</ge><le>2.4.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wireshark developers reports:
	<blockquote cite="http://www.securityfocus.com/bid/101228">
	 In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by adding decrements.
	 In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. This was addressed in epan/dissectors/packet-rtsp.c by correcting the scope of a variable.
	 In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.
	 In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level.
	 In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by changing the memory-allocation approach.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/bid/101227</url>
 <url>http://www.securityfocus.com/bid/101228</url>
 <url>http://www.securityfocus.com/bid/101229</url>
 <url>http://www.securityfocus.com/bid/101235</url>
 <url>http://www.securityfocus.com/bid/101240</url>
 <url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14049</url>
 <url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14056</url>
 <url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14068</url>
 <url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14077</url>
 <url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14080</url>
 <url>https://code.wireshark.org/review/23470</url>
 <url>https://code.wireshark.org/review/23537</url>
 <url>https://code.wireshark.org/review/23591</url>
 <url>https://code.wireshark.org/review/23635</url>
 <url>https://code.wireshark.org/review/23663</url>
 <url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=3689dc1db36037436b1616715f9a3f888fc9a0f6</url>
 <url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=625bab309d9dd21db2d8ae2aa3511810d32842a8</url>
 <url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=8dbb21dfde14221dab09b6b9c7719b9067c1f06e</url>
 <url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=afb9ff7982971aba6e42472de0db4c1bedfc641b</url>
 <url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=e27870eaa6efa1c2dac08aa41a67fe9f0839e6e0</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2017-42.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2017-43.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2017-44.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2017-45.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2017-46.html</url>
 <cvename>CVE-2017-15189</cvename>
 <cvename>CVE-2017-15190</cvename>
 <cvename>CVE-2017-15191</cvename>
 <cvename>CVE-2017-15192</cvename>
 <cvename>CVE-2017-15193</cvename>
 </references>
 <dates>
 <discovery>2017-10-10</discovery>
 <entry>2017-10-30</entry>
 </dates>
 </vuln>

<vuln vid="de7a2b32-bd7d-11e7-b627-d43d7e971a1b">
 <topic>PHP -- denial of service attack</topic>
 <affects>
 <package>
	<name>php56</name>
	<range><lt>5.6.32</lt></range>
 </package>
 <package>
	<name>php70</name>
	<range><lt>7.0.25</lt></range>
 </package>
 <package>
	<name>php71</name>
	<range><lt>7.1.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP project reports:
 <blockquote cite="http://php.net/archive/2017.php#id2017-10-26-3">
	 The PHP development team announces the immediate availability of PHP
	 5.6.32. This is a security release. Several security bugs were fixed in this
	 release. All PHP 5.6 users are encouraged to upgrade to this version.
	</blockquote>
	<blockquote cite="http://php.net/archive/2017.php#id2017-10-26-1">
	 The PHP development team announces the immediate availability of PHP
	 7.0.25. This is a security release. Several security bugs were fixed in this
	 release. All PHP 7.0 users are encouraged to upgrade to this version.
	</blockquote>
 <blockquote cite="http://php.net/archive/2017.php#id2017-10-27-1">
	 The PHP development team announces the immediate availability of PHP
	 7.1.11. This is a bugfix release, with several bug fixes included. All PHP
	 7.1 users are encouraged to upgrade to this version. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://php.net/archive/2017.php#id2017-10-26-3</url>
 <url>http://php.net/archive/2017.php#id2017-10-26-1</url>
 <url>http://php.net/archive/2017.php#id2017-10-27-1</url>
 <cvename>CVE-2016-1283</cvename>
 </references>
 <dates>
 <discovery>2017-10-26</discovery>
 <entry>2017-10-30</entry>
 <modified>2017-11-14</modified>
 </dates>
 </vuln>

<vuln vid="3cd46257-bbc5-11e7-a3bc-e8e0b747a45a">
 <topic>chromium -- Stack overflow in V8</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>62.0.3202.75</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html">
	 2 security fixes in this release, including:
	 <ul>
	 <li>[770452] High CVE-2017-15396: Stack overflow in V8. Reported by
	 Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30</li>
	 <li>[770450] Medium CVE-2017-15406: Stack overflow in V8. Reported by
	 Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-15396</cvename>
 <cvename>CVE-2017-15406</cvename>
 <url>https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html</url>
 </references>
 <dates>
 <discovery>2017-10-26</discovery>
 <entry>2017-10-28</entry>
 <modified>2018-01-23</modified>
 </dates>
 </vuln>

<vuln vid="d77ceb8c-bb13-11e7-8357-3065ec6f3643">
 <topic>wget -- Heap overflow in HTTP protocol handling</topic>
 <affects>
 <package>
	<name>wget</name>
	<range><lt>1.19.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Antti Levomäki, Christian Jalio, Joonas Pihlaja:
	<blockquote cite="https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html">
	 Wget contains two vulnerabilities, a stack overflow and a heap
	 overflow, in the handling of HTTP chunked encoding. By convincing
	 a user to download a specific link over HTTP, an attacker may be
	 able to execute arbitrary code with the privileges of the user.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://git.savannah.gnu.org/cgit/wget.git/commit/?id=ba6b44f6745b14dce414761a8e4b35d31b176bba</url>
 <cvename>CVE-2017-13090</cvename>
 </references>
 <dates>
 <discovery>2017-10-20</discovery>
 <entry>2017-10-27</entry>
 </dates>
 </vuln>

<vuln vid="09849e71-bb12-11e7-8357-3065ec6f3643">
 <topic>wget -- Stack overflow in HTTP protocol handling</topic>
 <affects>
 <package>
	<name>wget</name>
	<range><lt>1.19.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Antti Levomäki, Christian Jalio, Joonas Pihlaja:
	<blockquote cite="https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html">
	 Wget contains two vulnerabilities, a stack overflow and a heap
	 overflow, in the handling of HTTP chunked encoding. By convincing
	 a user to download a specific link over HTTP, an attacker may be
	 able to execute arbitrary code with the privileges of the user.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3f</url>
 <cvename>CVE-2017-13089</cvename>
 </references>
 <dates>
 <discovery>2017-10-20</discovery>
 <entry>2017-10-27</entry>
 </dates>
 </vuln>

<vuln vid="d7d1cc94-b971-11e7-af3a-f1035dd0da62">
 <topic>Node.js -- remote DOS security vulnerability</topic>
 <affects>
 <package>
	<name>node</name>
	<range><lt>8.8.0</lt></range>
 </package>
 <package>
	<name>node6</name>
	<range><ge>6.10.2</ge><lt>6.11.5</lt></range>
 </package>
 <package>
	<name>node4</name>
	<range><ge>4.8.2</ge><lt>4.8.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js reports:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/oct-2017-dos/">
	 Node.js was susceptible to a remote DoS attack due to a change that came in as part of zlib v1.2.9. In zlib v1.2.9 8 became an invalid value for the windowBits parameter and Node's zlib module will crash or throw an exception (depending on the version)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/oct-2017-dos/</url>
 <cvename>CVE-2017-14919</cvename>
 </references>
 <dates>
 <discovery>2017-10-17</discovery>
 <entry>2017-10-25</entry>
 </dates>
 </vuln>

<vuln vid="418c172b-b96f-11e7-b627-d43d7e971a1b">
 <topic>GitLab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab</name>
	<range><ge>2.8.0</ge><le>9.4.6</le></range>
	<range><ge>9.5.0</ge><le>9.5.8</le></range>
 <range><ge>10.0.0</ge><le>10.0.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab reports:
	<blockquote cite="https://about.gitlab.com/2017/10/17/gitlab-10-dot-0-dot-4-security-release/">
 <h1>Cross-Site Scripting (XSS) vulnerability in the Markdown sanitization
 filter</h1>
	 Yasin Soliman via HackerOne reported a Cross-Site Scripting (XSS)
	 vulnerability in the GitLab markdown sanitization filter. The sanitization
	 filter was not properly stripping invalid characters from URL schemes and
	 was therefore vulnerable to persistent XSS attacks anywhere Markdown was
	 supported.
 <h1>Cross-Site Scripting (XSS) vulnerability in search bar</h1>
 Josh Unger reported a Cross-Site Scripting (XSS) vulnerability in the
 issue search bar. Usernames were not being properly HTML escaped inside the
 author filter would could allow arbitrary script execution.
 <h1>Open redirect in repository git redirects</h1>
 Eric Rafaloff via HackerOne reported that GitLab was vulnerable to an
 open redirect vulnerability when redirecting requests for repository names
 that include the git extension. GitLab was not properly removing dangerous
 parameters from the params field before redirecting which could allow an
 attacker to redirect users to arbitrary hosts.
 <h1>Username changes could leave repositories behind</h1>
 An internal code review discovered that a bug in the code that moves
 repositories during a username change could potentially leave behind
 projects, allowing an attacker who knows the previous username to
 potentially steal the contents of repositories on instances that are not
 configured with hashed namespaces.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2017/10/17/gitlab-10-dot-0-dot-4-security-release/</url>
 </references>
 <dates>
 <discovery>2017-10-17</discovery>
 <entry>2017-10-25</entry>
 </dates>
 </vuln>

<vuln vid="27229c67-b8ff-11e7-9f79-ac9e174be3af">
 <topic>Apache OpenOffice -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache-openoffice</name>
	<range><lt>4.1.4</lt></range>
 </package>
 <package>
	<name>apache-openoffice-devel</name>
	<range><lt>4.2.1810071_1,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Openofffice project reports:
	<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-3157.html">
	 <h1>CVE-2017-3157: Arbitrary file disclosure in Calc and Writer</h1>
	 By exploiting the way OpenOffice renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to sent the document back to the attacker.
	 The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.
	</blockquote>
	<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-9806.html">
	 <h1>CVE-2017-9806: Out-of-Bounds Write in Writer's WW8Fonts Constructor</h1>
	 A vulnerability in the OpenOffice Writer DOC file parser, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.
	</blockquote>
	<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-12607.html">
	 <h1>CVE-2017-12607: Out-of-Bounds Write in Impress' PPT Filter</h1>
	 A vulnerability in OpenOffice's PPT file parser, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.
	</blockquote>
	<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-12608.html">
	 <h1>CVE-2017-12608: Out-of-Bounds Write in Writer's ImportOldFormatStyles</h1>
	 A vulnerability in OpenOffice Writer DOC file parser, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openoffice.org/security/cves/CVE-2017-3157.html</url>
 <url>https://www.openoffice.org/security/cves/CVE-2017-9806.html</url>
 <url>https://www.openoffice.org/security/cves/CVE-2017-12607.html</url>
 <url>https://www.openoffice.org/security/cves/CVE-2017-12608.html</url>
 <cvename>CVE-2017-3157</cvename>
 <cvename>CVE-2017-9806</cvename>
 <cvename>CVE-2017-12607</cvename>
 <cvename>CVE-2017-12608</cvename>
 </references>
 <dates>
 <discovery>2016-09-11</discovery>
 <entry>2017-10-24</entry>
 <modified>2017-10-26</modified>
 </dates>
 </vuln>

<vuln vid="143ec3d6-b7cf-11e7-ac58-b499baebfeaf">
 <topic>cURL -- out of bounds read</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.20</ge><lt>7.56.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports:
	<blockquote cite="https://curl.haxx.se/docs/adv_20171023.html">
	 libcurl contains a buffer overrun flaw in the IMAP handler. 
	 An IMAP FETCH response line indicates the size of the returned data,
	 in number of bytes. When that response says the data is zero bytes,
	 libcurl would pass on that (non-existing) data with a pointer and
	 the size (zero) to the deliver-data function. 
	 libcurl's deliver-data function treats zero as a magic number and
	 invokes strlen() on the data to figure out the length. The strlen()
	 is called on a heap based buffer that might not be zero terminated
	 so libcurl might read beyond the end of it into whatever memory lies
	 after (or just crash) and then deliver that to the application as if
	 it was actually downloaded.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/adv_20171023.html</url>
 <cvename>CVE-2017-1000257</cvename>
 </references>
 <dates>
 <discovery>2017-10-23</discovery>
 <entry>2017-10-23</entry>
 </dates>
 </vuln>

<vuln vid="10c0fabc-b5da-11e7-816e-00bd5d1fff09">
 <topic>h2o -- DoS in workers</topic>
 <affects>
 <package>
 <name>h2o</name>
 <range><lt>2.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Frederik Deweerdt reports:
 <blockquote cite="https://github.com/h2o/h2o/releases/tag/v2.2.3">
 Multiple Denial-of-Service vulnerabilities exist in h2o workers -
 see references for full details.
 CVE-2017-10868: Worker processes may crash when receiving a request with invalid framing.
 CVE-2017-10869: The stack may overflow when proxying huge requests.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-10868</cvename>
 <cvename>CVE-2017-10869</cvename>
 <url>https://github.com/h2o/h2o/issues/1459</url>
 <url>https://github.com/h2o/h2o/issues/1460</url>
 <url>https://github.com/h2o/h2o/releases/tag/v2.2.3</url>
 </references>
 <dates>
 <discovery>2017-07-19</discovery>
 <entry>2017-10-17</entry>
 </dates>
 </vuln>

<vuln vid="85e2c7eb-b74b-11e7-8546-5cf3fcfdd1f1">
 <topic>irssi -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>irssi</name>
	<range><lt>1.0.5,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Irssi reports:
	<blockquote cite="https://irssi.org/security/irssi_sa_2017_10.txt">
	 When installing themes with unterminated colour formatting
	 sequences, Irssi may access data beyond the end of the string.
	 While waiting for the channel synchronisation, Irssi may
	 incorrectly fail to remove destroyed channels from the query list,
	 resulting in use after free conditions when updating the state later
	 on.
	 Certain incorrectly formatted DCC CTCP messages could cause NULL
	 pointer dereference.
	 Overlong nicks or targets may result in a NULL pointer dereference
	 while splitting the message.
	 In certain cases Irssi may fail to verify that a Safe channel ID
	 is long enough, causing reads beyond the end of the string.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://irssi.org/security/irssi_sa_2017_10.txt</url>
 <cvename>CVE-2017-15721</cvename>
 <cvename>CVE-2017-15722</cvename>
 <cvename>CVE-2017-15723</cvename>
 <cvename>CVE-2017-15227</cvename>
 <cvename>CVE-2017-15228</cvename>
 <freebsdpr>ports/223169</freebsdpr>
 </references>
 <dates>
 <discovery>2017-10-10</discovery>
 <entry>2017-10-22</entry>
 <modified>2017-12-31</modified>
 </dates>
 </vuln>

<vuln vid="a692bffe-b6ad-11e7-a1c2-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>62.0.3202.62</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html">
	 35 security fixes in this release, including:
	 <ul>
	 <li>[762930] High CVE-2017-5124: UXSS with MHTML. Reported by
	 Anonymous on 2017-09-07</li>
	 <li>[749147] High CVE-2017-5125: Heap overflow in Skia. Reported by
	 Anonymous on 2017-07-26</li>
	 <li>[760455] High CVE-2017-5126: Use after free in PDFium. Reported by
	 Luat Nguyen on KeenLab, Tencent on 2017-08-30</li>
	 <li>[765384] High CVE-2017-5127: Use after free in PDFium. Reported by
	 Luat Nguyen on KeenLab, Tencent on 2017-09-14</li>
	 <li>[765469] High CVE-2017-5128: Heap overflow in WebGL. Reported by
	 Omair on 2017-09-14</li>
	 <li>[765495] High CVE-2017-5129: Use after free in WebAudio. Reported by
	 Omair on 2017-09-15</li>
	 <li>[718858] High CVE-2017-5132: Incorrect stack manipulation in WebAssembly. Reported by
	 Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-05-05</li>
	 <li>[722079] High CVE-2017-5130: Heap overflow in libxml2. Reported by
	 Pranjal Jumde on 2017-05-14</li>
	 <li>[744109] Medium CVE-2017-5131: Out of bounds write in Skia. Reported by
	 Anonymous on 2017-07-16</li>
	 <li>[762106] Medium CVE-2017-5133: Out of bounds write in Skia. Reported by
	 Aleksandar Nikolic of Cisco Talos on 2017-09-05</li>
	 <li>[752003] Medium CVE-2017-15386: UI spoofing in Blink. Reported by
	 WenXu Wu of Tencent's Xuanwu Lab on 2017-08-03</li>
	 <li>[756040] Medium CVE-2017-15387: Content security bypass. Reported by
	 Jun Kokatsu on 2017-08-16</li>
	 <li>[756563] Medium CVE-2017-15388: Out of bounds read in Skia. Reported by
	 Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-08-17</li>
	 <li>[739621] Medium CVE-2017-15389: URL spoofing in Omnibox. Reported by
	 xisigr of Tencent's Xuanwu Lab on 2017-07-06</li>
	 <li>[750239] Medium CVE-2017-15390: URL spoofing in Omnibox. Reported by
	 Haosheng Wang on 2017-07-28</li>
	 <li>[598265] Low CVE-2017-15391: Extension limitation bypass in Extensions. Reported by
	 Joao Lucas Melo Brasio on 2016-03-28</li>
	 <li>[714401] Low CVE-2017-15392: Incorrect registry key handling in PlatformIntegration.
	 Reported by Xiaoyin Liu on 2017-04-22</li>
	 <li>[732751] Low CVE-2017-15393: Referrer leak in Devtools. Reported by
	 Svyat Mitin on 2017-06-13</li>
	 <li>[745580] Low CVE-2017-15394: URL spoofing in extensions UI. Reported by
	 Sam on 2017-07-18</li>
	 <li>[759457] Low CVE-2017-15395: Null pointer dereference in ImageCapture. Reported by
	 Johannes Bergman on 2017-08-28</li>
	 <li>[775550] Various fixes from internal audits, fuzzing and other initiatives</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5124</cvename>
 <cvename>CVE-2017-5125</cvename>
 <cvename>CVE-2017-5126</cvename>
 <cvename>CVE-2017-5127</cvename>
 <cvename>CVE-2017-5128</cvename>
 <cvename>CVE-2017-5129</cvename>
 <cvename>CVE-2017-5132</cvename>
 <cvename>CVE-2017-5130</cvename>
 <cvename>CVE-2017-5131</cvename>
 <cvename>CVE-2017-5133</cvename>
 <cvename>CVE-2017-15386</cvename>
 <cvename>CVE-2017-15387</cvename>
 <cvename>CVE-2017-15388</cvename>
 <cvename>CVE-2017-15389</cvename>
 <cvename>CVE-2017-15390</cvename>
 <cvename>CVE-2017-15391</cvename>
 <cvename>CVE-2017-15392</cvename>
 <cvename>CVE-2017-15393</cvename>
 <cvename>CVE-2017-15394</cvename>
 <cvename>CVE-2017-15395</cvename>
 <url>https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2017-10-17</discovery>
 <entry>2017-10-21</entry>
 </dates>
 </vuln>

<vuln vid="e1cb9dc9-daa9-44db-adde-e94d900e2f7f">
 <topic>cacti -- Cross Site Scripting issue</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>1.1.26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cacti developers report:
	<blockquote cite=" https://github.com/Cacti/cacti/commit/93f661d8adcfa6618b11522cdab30e97bada33fd">
	 The file include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securitytracker.com/id/1039569</url>
 <url>https://github.com/Cacti/cacti/commit/93f661d8adcfa6618b11522cdab30e97bada33fd</url>
 <url>https://github.com/Cacti/cacti/issues/1010</url>
 <cvename>CVE-2017-15194</cvename>
 </references>
 <dates>
 <discovery>2017-10-10</discovery>
 <entry>2017-10-19</entry>
 </dates>
 </vuln>

<vuln vid="b95e5674-b4d6-11e7-b895-0cc47a494882">
 <topic>arj -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>arj</name>
	<range><lt>3.10.22_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Several vulnerabilities: symlink directory traversal, absolute path directory
	traversal and buffer overflow were discovered in the arj archiver.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0556</cvename>
 <cvename>CVE-2015-0557</cvename>
 <cvename>CVE-2015-2782</cvename>
 </references>
 <dates>
 <discovery>2015-04-08</discovery>
 <entry>2017-10-19</entry>
 </dates>
 </vuln>

<vuln vid="3f3837cc-48fb-4414-aa46-5b1c23c9feae">
 <topic>krb5 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><lt>1.14.6</lt></range>
	<range><ge>1.15</ge><lt>1.15.2</lt></range>
 </package>
 <package>
	<name>krb5-devel</name>
	<range><lt>1.14.6</lt></range>
	<range><ge>1.15</ge><lt>1.15.2</lt></range>
 </package>
 <package>
	<name>krb5-115</name>
	<range><lt>1.15.2</lt></range>
 </package>
 <package>
	<name>krb5-114</name>
	<range><lt>1.14.6</lt></range>
 </package>
 <package>
	<name>krb5-113</name>
	<range><lt>1.14.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MIT reports:
	<blockquote cite="http://krbdev.mit.edu/rt/Ticket/Display.html?id=8599">
	 CVE-2017-11368:
	 In MIT krb5 1.7 and later, an authenticated attacker can cause an
	 assertion failure in krb5kdc by sending an invalid S4U2Self or
	 S4U2Proxy request.
	</blockquote>
	<blockquote cite="http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598">
	 CVE-2017-11462:
	 RFC 2744 permits a GSS-API implementation to delete an existing
	 security context on a second or subsequent call to gss_init_sec_context()
	 or gss_accept_sec_context() if the call results in an error.
	 This API behavior has been found to be dangerous, leading to the
	 possibility of memory errors in some callers. For safety, GSS-API
	 implementations should instead preserve existing security contexts
	 on error until the caller deletes them.
	 All versions of MIT krb5 prior to this change may delete acceptor
	 contexts on error. Versions 1.13.4 through 1.13.7, 1.14.1 through
	 1.14.5, and 1.15 through 1.15.1 may also delete initiator contexts
	 on error.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-11368</url>
 <url>https://krbdev.mit.edu/rt/Ticket/Display.html?id=8599</url>
 <url>https://github.com/krb5/krb5/commit/ffb35baac6981f9e8914f8f3bffd37f284b85970</url>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-11462</url>
 <url>https://krbdev.mit.edu/rt/Ticket/Display.html?id=8598</url>
 <url>https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf</url>
 <cvename>CVE-2017-11368</cvename>
 <cvename>CVE-2017-11462</cvename>
 </references>
 <dates>
 <discovery>2017-07-14</discovery>
 <entry>2017-10-18</entry>
 </dates>
 </vuln>

<vuln vid="c41bedfd-b3f9-11e7-ac58-b499baebfeaf">
 <topic>MySQL -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>mariadb55-server</name>
 <range><lt>5.5.58</lt></range>
 </package>
 <package>
 <name>mariadb100-server</name>
 <range><lt>10.0.33</lt></range>
 </package>
 <package>
 <name>mariadb101-server</name>
 <range><lt>10.1.29</lt></range>
 </package>
 <package>
 <name>mariadb102-server</name>
 <range><lt>10.2.10</lt></range>
 </package>
 <package>
 <name>mysql55-server</name>
 <range><lt>5.5.58</lt></range>
 </package>
 <package>
 <name>mysql56-server</name>
 <range><lt>5.6.38</lt></range>
 </package>
 <package>
 <name>mysql57-server</name>
 <range><lt>5.7.20</lt></range>
 </package>
 <package>
 <name>percona55-server</name>
 <range><lt>5.5.58</lt></range>
 </package>
 <package>
 <name>percona56-server</name>
 <range><lt>5.6.38</lt></range>
 </package>
 <package>
 <name>percona57-server</name>
 <range><lt>5.7.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Oracle reports:
 <blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL">
 Please reference CVE/URL list for details
 </blockquote>
 </body>
 </description>
 <references>
 <url>http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL</url>
 <cvename>CVE-2017-10155</cvename>
 <cvename>CVE-2017-10379</cvename>
 <cvename>CVE-2017-10384</cvename>
 <cvename>CVE-2017-10276</cvename>
 <cvename>CVE-2017-10167</cvename>
 <cvename>CVE-2017-10378</cvename>
 <cvename>CVE-2017-10277</cvename>
 <cvename>CVE-2017-10203</cvename>
 <cvename>CVE-2017-10283</cvename>
 <cvename>CVE-2017-10313</cvename>
 <cvename>CVE-2017-10296</cvename>
 <cvename>CVE-2017-10311</cvename>
 <cvename>CVE-2017-10320</cvename>
 <cvename>CVE-2017-10314</cvename>
 <cvename>CVE-2017-10227</cvename>
 <cvename>CVE-2017-10279</cvename>
 <cvename>CVE-2017-10294</cvename>
 <cvename>CVE-2017-10165</cvename>
 <cvename>CVE-2017-10284</cvename>
 <cvename>CVE-2017-10286</cvename>
 <cvename>CVE-2017-10268</cvename>
 <cvename>CVE-2017-10365</cvename>
 </references>
 <dates>
 <discovery>2017-10-18</discovery>
 <entry>2017-10-18</entry>
 <modified>2017-12-23</modified>
 </dates>
 </vuln>

<vuln vid="ab881a74-c016-4e6d-9f7d-68c8e7cedafb">
 <topic>xorg-server -- Multiple Issues</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<range><le>1.18.4_6,1</le></range>
	<range><ge>1.19.0,1</ge><le>1.19.3,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	xorg-server developers reports:
	<blockquote cite="http://www.securityfocus.com/bid/99546">
	 In the X.Org X server before 2017-06-19, a user authenticated to
	 an X Session could crash or execute code in the context of the X
	 Server by exploiting a stack overflow in the endianness conversion
	 of X Events.
	 Uninitialized data in endianness conversion in the XEvent handling
	 of the X.Org X Server before 2017-06-19 allowed authenticated
	 malicious users to access potentially privileged data from the X
	 server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/bid/99546</url>
 <url>https://bugzilla.suse.com/show_bug.cgi?id=1035283</url>
 <url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=215f894965df5fb0bb45b107d84524e700d2073c</url>
 <url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=8caed4df36b1f802b4992edcfd282cbeeec35d9d</url>
 <url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b136486961c82deac76bbde455</url>
 <url>http://www.securityfocus.com/bid/99543</url>
 <url>https://bugzilla.suse.com/show_bug.cgi?id=1035283</url>
 <url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=05442de962d3dc624f79fc1a00eca3ffc5489ced</url>
 <cvename>CVE-2017-10971</cvename>
 <cvename>CVE-2017-10972</cvename>
 </references>
 <dates>
 <discovery>2017-07-06</discovery>
 <entry>2017-10-17</entry>
 <modified>2018-05-20</modified>
 </dates>
 </vuln>

<vuln vid="a73518da-b2fa-11e7-98ef-d43d7ef03aa6">
 <topic>Flash Player -- Remote code execution</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>27.0.0.170</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-32.html">
	 <ul>
	 <li>This update resolves a type confusion vulnerability that
	 could lead to remote code execution (CVE-2017-11292).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-11292</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb17-32.html</url>
 </references>
 <dates>
 <discovery>2017-10-16</discovery>
 <entry>2017-10-17</entry>
 </dates>
 </vuln>

<vuln vid="d670a953-b2a1-11e7-a633-009c02a2ab30">
 <topic>WPA packet number reuse with replayed messages and key reinstallation</topic>
 <affects>
 <package>
	<name>wpa_supplicant</name>
	<range><le>2.6_1</le></range>
 </package>
 <package>
	<name>hostapd</name>
	<range><le>2.6</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wpa_supplicant developers report:
	<blockquote cite="http://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt">
	 A vulnerability was found in how a number of implementations can be
	 triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by
	 replaying a specific frame that is used to manage the keys.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt</url>
 <url>https://www.kb.cert.org/vuls/id/228519</url>
 <cvename>CVE-2017-13077</cvename>
 <cvename>CVE-2017-13078</cvename>
 <cvename>CVE-2017-13079</cvename>
 <cvename>CVE-2017-13080</cvename>
 <cvename>CVE-2017-13081</cvename>
 <cvename>CVE-2017-13082</cvename>
 <cvename>CVE-2017-13084</cvename>
 <cvename>CVE-2017-13086</cvename>
 <cvename>CVE-2017-13087</cvename>
 <cvename>CVE-2017-13088</cvename>
 </references>
 <dates>
 <discovery>2017-10-16</discovery>
 <entry>2017-10-16</entry>
 </dates>
 </vuln>

<vuln vid="b0628e53-092a-4037-938b-29805a7cd31b">
 <topic>mercurial -- multiple issues</topic>
 <affects>
 <package>
	<name>mercurial</name>
	<range><lt>4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mercurial developers reports:
	<blockquote cite="http://www.securityfocus.com/bid/100290">
	 Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository
	 Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/bid/100290</url>
 <url>https://security.gentoo.org/glsa/201709-18</url>
 <url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29</url>
 <url>http://www.securityfocus.com/bid/100290</url>
 <url>https://security.gentoo.org/glsa/201709-18</url>
 <url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29</url>
 <cvename>CVE-2017-1000115</cvename>
 <cvename>CVE-2017-1000116</cvename>
 </references>
 <dates>
 <discovery>2017-10-05</discovery>
 <entry>2017-10-16</entry>
 </dates>
 </vuln>

<vuln vid="555cd806-b031-11e7-a369-14dae9d59f67">
 <topic>Multiple exploitable heap-based buffer overflow vulnerabilities exists in FreeXL 1.0.3</topic>
 <affects>
 <package>
	<name>freexl</name>
	<range><lt>1.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cisco TALOS reports:
	<blockquote cite="http://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430">
	 An exploitable heap based buffer overflow vulnerability exists in the read_biff_next_record function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
	</blockquote>
	<blockquote cite="https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0431">
	 An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430</url>
 <cvename>CVE-2017-2923</cvename>
 <url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0431</url>
 <cvename>CVE-2017-2924</cvename>
 </references>
 <dates>
 <discovery>2017-09-11</discovery>
 <entry>2017-10-13</entry>
 </dates>
 </vuln>

<vuln vid="ed73829d-af6d-11e7-a633-009c02a2ab30">
 <topic>FFmpeg -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ffmpeg</name>
	<range><lt>3.3.4</lt></range>
 </package>
 <package>
	<name>mythtv</name>
	<name>mythtv-frontend</name>
	
	<range><lt>29.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	FFmpeg security reports:
	<blockquote cite="https://www.ffmpeg.org/security.html">
	 Multiple vulnerabilities have been fixed in FFmpeg 3.3.4. Please refer to the CVE list for details.
	</blockquote>
 </body>
 </description>
 <references>
	 <url>https://www.ffmpeg.org/security.html</url>
	 <cvename>CVE-2017-14054</cvename>
	 <cvename>CVE-2017-14055</cvename>
	 <cvename>CVE-2017-14056</cvename>
	 <cvename>CVE-2017-14057</cvename>
	 <cvename>CVE-2017-14058</cvename>
	 <cvename>CVE-2017-14059</cvename>
	 <cvename>CVE-2017-14169</cvename>
	 <cvename>CVE-2017-14170</cvename>
	 <cvename>CVE-2017-14171</cvename>
	 <cvename>CVE-2017-14222</cvename>
	 <cvename>CVE-2017-14223</cvename>
	 <cvename>CVE-2017-14225</cvename>
	 <cvename>CVE-2017-14767</cvename>
 </references>
 <dates>
 <discovery>2017-09-11</discovery>
 <entry>2017-10-12</entry>
 <modified>2018-03-25</modified>
 </dates>
 </vuln>

<vuln vid="7274e0cc-575f-41bc-8619-14a41b3c2ad0">
 <topic>xorg-server -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xephyr</name>
	<range><lt>1.18.4_5,1</lt></range>
 </package>
 <package>
	<name>xorg-dmx</name>
	<range><lt>1.18.4_5,1</lt></range>
 </package>
 <package>
	<name>xorg-nestserver</name>
	<range><lt>1.19.1_2,2</lt></range>
 </package>
 <package>
	<name>xorg-server</name>
	<range><lt>1.18.4_5,1</lt></range>
 </package>
 <package>
	<name>xorg-vfbserver</name>
	<range><lt>1.19.1_2,1</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>1.19.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adam Jackson reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2017-October/002814.html">
	 One regression fix since 1.19.4 (mea culpa), and fixes for
	 CVEs 2017-12176 through 2017-12187.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.x.org/archives/xorg-announce/2017-October/002814.html</url>
 <cvename>CVE-2017-12176</cvename>
 <cvename>CVE-2017-12177</cvename>
 <cvename>CVE-2017-12178</cvename>
 <cvename>CVE-2017-12179</cvename>
 <cvename>CVE-2017-12180</cvename>
 <cvename>CVE-2017-12181</cvename>
 <cvename>CVE-2017-12182</cvename>
 <cvename>CVE-2017-12183</cvename>
 <cvename>CVE-2017-12184</cvename>
 <cvename>CVE-2017-12185</cvename>
 <cvename>CVE-2017-12186</cvename>
 <cvename>CVE-2017-12187</cvename>
 </references>
 <dates>
 <discovery>2017-10-12</discovery>
 <entry>2017-10-13</entry>
 </dates>
 </vuln>

<vuln vid="e837390d-0ceb-46b8-9b32-29c1195f5dc7">
 <topic>solr -- Code execution via entity expansion</topic>
 <affects>
 <package>
	<name>apache-solr</name>
	<range><ge>5.1</ge><le>6.6.1</le></range>
	<range><ge>7.0.0</ge><lt>7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Solr developers report:
	<blockquote cite="http://lucene.472066.n3.nabble.com/Re-Several-critical-vulnerabilities-discovered-in-Apache-Solr-XXE-amp-RCE-td4358308.html">
	 Lucene XML parser does not explicitly prohibit doctype declaration and expansion of external entities which leads to arbitrary HTTP requests to the local SOLR instance and to bypass all firewall restrictions.
	 Solr "RunExecutableListener" class can be used to execute arbitrary commands on specific events, for example after each update query. The problem is that such listener can be enabled with any parameters just by using Config API with add-listener command.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lucene.472066.n3.nabble.com/Re-Several-critical-vulnerabilities-discovered-in-Apache-Solr-XXE-amp-RCE-td4358308.html</url>
 <url>https://marc.info/?l=apache-announce&amp;m=150786685013286</url>
 <cvename>CVE-2017-12629</cvename>
 </references>
 <dates>
 <discovery>2017-10-13</discovery>
 <entry>2017-10-13</entry>
 <modified>2017-10-16</modified>
 </dates>
 </vuln>

<vuln vid="6dc3c61c-e866-4c27-93f7-ae50908594fd">
 <topic>jenkins -- multiple issues</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><le>2.83</le></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><le>2.73.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	jenkins developers report:
	<blockquote cite="https://jenkins.io/security/advisory/2017-10-11/">
	 A total of 11 issues are reported, please see reference URL for details.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://jenkins.io/security/advisory/2017-10-11/</url>
 </references>
 <dates>
 <discovery>2017-10-11</discovery>
 <entry>2017-10-13</entry>
 </dates>
 </vuln>

<vuln vid="da70d472-af59-11e7-ace2-f8b156b439c5">
 <topic>xen-kernel -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.7.2_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen project reports multiple vulnerabilities.
 </body>
 </description>
 <references>
	<url>http://xenbits.xen.org/xsa/advisory-237.html</url>
	<url>http://xenbits.xen.org/xsa/advisory-238.html</url>
	<url>http://xenbits.xen.org/xsa/advisory-239.html</url>
	<url>http://xenbits.xen.org/xsa/advisory-240.html</url>
	<url>http://xenbits.xen.org/xsa/advisory-241.html</url>
	<url>http://xenbits.xen.org/xsa/advisory-242.html</url>
	<url>http://xenbits.xen.org/xsa/advisory-243.html</url>
	<url>http://xenbits.xen.org/xsa/advisory-244.html</url>
 </references>
 <dates>
 <discovery>2017-10-12</discovery>
 <entry>2017-10-12</entry>
 </dates>
 </vuln>

<vuln vid="e71fd9d3-af47-11e7-a633-009c02a2ab30">
 <topic>nss -- Use-after-free in TLS 1.2 generating handshake hashes</topic>
 <affects>
 <package>
	<name>nss</name>
	<range><ge>3.32</ge><lt>3.32.1</lt></range>
	<range><ge>3.28</ge><lt>3.28.6</lt></range>
 </package>
 <package>
	<name>linux-c6-nss</name>
	<range><ge>3.28</ge><lt>3.28.4_2</lt></range>
 </package>
 <package>
	<name>linux-c7-nss</name>
	<range><ge>3.28</ge><lt>3.28.4_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/#CVE-2017-7805">
	 During TLS 1.2 exchanges, handshake hashes are generated which
	 point to a message buffer. This saved data is used for later
	 messages but in some cases, the handshake transcript can
	 exceed the space available in the current buffer, causing the
	 allocation of a new buffer. This leaves a pointer pointing to
	 the old, freed buffer, resulting in a use-after-free when
	 handshake hashes are then calculated afterwards. This can
	 result in a potentially exploitable crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/#CVE-2017-7805</url>
 <url>https://hg.mozilla.org/projects/nss/rev/2d7b65b72290</url>
 <url>https://hg.mozilla.org/projects/nss/rev/d3865e2957d0</url>
 <cvename>CVE-2017-7805</cvename>
 </references>
 <dates>
 <discovery>2017-08-04</discovery>
 <entry>2017-10-12</entry>
 <modified>2018-01-29</modified>
 </dates>
 </vuln>

<vuln vid="15a62f22-098a-443b-94e2-2d26c375b993">
 <topic>osip -- Improper Restriction of Operations within the Bounds of a Memory Buffer</topic>
 <affects>
 <package>
	<name>libosip2</name>
	<range><le>5.0.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	osip developers reports:
	<blockquote cite="http://www.securityfocus.com/bid/97644">
	 In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/bid/97644</url>
 <url>https://savannah.gnu.org/support/index.php?109265</url>
 <cvename>CVE-2017-7853</cvename>
 </references>
 <dates>
 <discovery>2017-04-13</discovery>
 <entry>2017-10-11</entry>
 </dates>
 </vuln>

<vuln vid="b84dbd94-e894-4c91-b8cd-d328537b1b2b">
 <topic>ncurses -- multiple issues</topic>
 <affects>
 <package>
	<name>ncurses</name>
	<range><le>6.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ncurses developers reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1484285">
	 There are multiple illegal address access issues and an infinite loop issue. Please refer to the CVE list for details.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1484274</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1484276</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1484284</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1484285</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1484287</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1484290</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1484291</url>
 <cvename>CVE-2017-13728</cvename>
 <cvename>CVE-2017-13729</cvename>
 <cvename>CVE-2017-13730</cvename>
 <cvename>CVE-2017-13731</cvename>
 <cvename>CVE-2017-13732</cvename>
 <cvename>CVE-2017-13733</cvename>
 <cvename>CVE-2017-13734</cvename>
 </references>
 <dates>
 <discovery>2017-08-29</discovery>
 <entry>2017-10-11</entry>
 </dates>
 </vuln>

<vuln vid="9164f51e-ae20-11e7-a633-009c02a2ab30">
 <topic>Python 2.7 -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>python27</name>
 <range><lt>2.7.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Python reports:
 <blockquote cite="https://raw.githubusercontent.com/python/cpython/84471935ed2f62b8c5758fd544c7d37076fe0fa5/Misc/NEWS">
	Multiple vulnerabilities have been fixed in Python 2.7.14. Please refer to the CVE list for details.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://raw.githubusercontent.com/python/cpython/84471935ed2f62b8c5758fd544c7d37076fe0fa5/Misc/NEWS</url>
 <cvename>CVE-2012-0876</cvename>
 <cvename>CVE-2016-0718</cvename>
 <cvename>CVE-2016-4472</cvename>
 <cvename>CVE-2016-5300</cvename>
 <cvename>CVE-2016-9063</cvename>
 <cvename>CVE-2017-9233</cvename>
 </references>
 <dates>
 <discovery>2017-08-26</discovery>
 <entry>2017-10-11</entry>
 </dates>
 </vuln>

<vuln vid="1257718e-be97-458a-9744-d938b592db42">
 <topic>node -- access to unintended files</topic>
 <affects>
 <package>
	<name>node</name>
	<range><ge>8.5.0</ge><lt>8.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	node developers report:
	<blockquote cite="http://www.securityfocus.com/bid/101056">
	 Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/bid/101056</url>
 <cvename>CVE-2017-14849</cvename>
 </references>
 <dates>
 <discovery>2017-09-27</discovery>
 <entry>2017-10-10</entry>
 </dates>
 </vuln>

<vuln vid="af61b271-9e47-4db0-a0f6-29fb032236a3">
 <topic>zookeeper -- Denial Of Service</topic>
 <affects>
 <package>
	<name>zookeeper</name>
	<range><lt>3.4.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	zookeeper developers report:
	<blockquote cite="https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370@%3Cdev.zookeeper.apache.org%3E">
	 Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370@%3Cdev.zookeeper.apache.org%3E</url>
 <cvename>CVE-2017-5637</cvename>
 </references>
 <dates>
 <discovery>2017-10-09</discovery>
 <entry>2017-10-10</entry>
 </dates>
 </vuln>

<vuln vid="9b5a905f-e556-452f-a00c-8f070a086181">
 <topic>libtiff -- Improper Input Validation</topic>
 <affects>
 <package>
	<name>libtiff</name>
	<range><le>4.0.8</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libtiff developers report:
	<blockquote cite="http://www.securityfocus.com/bid/100524">
	 There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.
	 There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://bugzilla.maptools.org/show_bug.cgi?id=2727</url>
 <url>http://bugzilla.maptools.org/show_bug.cgi?id=2728</url>
 <url>http://www.securityfocus.com/bid/100524</url>
 <cvename>CVE-2017-13726</cvename>
 <cvename>CVE-2017-13727</cvename>
 </references>
 <dates>
 <discovery>2017-08-29</discovery>
 <entry>2017-10-10</entry>
 </dates>
 </vuln>

<vuln vid="2c8bd00d-ada2-11e7-82af-8dbff7d75206">
 <topic>rubygems -- deserialization vulnerability</topic>
 <affects>
 <package>
	<name>ruby22-gems</name>
	<name>ruby23-gems</name>
	<name>ruby24-gems</name>
	<range><lt>2.6.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	oss-security mailing list:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2017/10/10/2">
	 There is a possible unsafe object desrialization vulnerability in
	 RubyGems. It is possible for YAML deserialization of gem specifications
	 to bypass class white lists. Specially crafted serialized objects can
	 possibly be used to escalate to remote code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2017/10/10/2</url>
 <url>http://blog.rubygems.org/2017/10/09/2.6.14-released.html</url>
 <cvename>CVE-2017-0903</cvename>
 </references>
 <dates>
 <discovery>2017-10-09</discovery>
 <entry>2017-10-10</entry>
 </dates>
 </vuln>

<vuln vid="4f8ffb9c-f388-4fbd-b90f-b3131559d888">
 <topic>xorg-server -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xephyr</name>
	<range><lt>1.18.4_4,1</lt></range>
 </package>
 <package>
	<name>xorg-dmx</name>
	<range><lt>1.18.4_4,1</lt></range>
 </package>
 <package>
	<name>xorg-nestserver</name>
	<range><lt>1.19.1_1,2</lt></range>
 </package>
 <package>
	<name>xorg-server</name>
	<range><lt>1.18.4_4,1</lt></range>
 </package>
 <package>
	<name>xorg-vfbserver</name>
	<range><lt>1.19.1_1,1</lt></range>
 </package>
 <package>
	<name>xwayland</name>
	<range><lt>1.19.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Alan Coopersmith reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2017-October/002809.html">
	 X.Org thanks Michal Srb of SuSE for finding these issues
	 and bringing them to our attention, Julien Cristau of
	 Debian for getting the fixes integrated, and Adam Jackson
	 of Red Hat for publishing the release.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.x.org/archives/xorg-announce/2017-October/002809.html</url>
 <cvename>CVE-2017-13721</cvename>
 <cvename>CVE-2017-13723</cvename>
 </references>
 <dates>
 <discovery>2017-10-04</discovery>
 <entry>2017-10-09</entry>
 </dates>
 </vuln>

<vuln vid="c0dae634-4820-4505-850d-b1c975d0f67d">
 <topic>tomcat -- Remote Code Execution</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><ge>7.0.0</ge><le>7.0.81</le></range>
	<range><ge>8.0.0</ge><le>8.0.46</le></range>
	<range><ge>8.5.0</ge><le>8.5.22</le></range>
	<range><ge>9.0.0</ge><lt>9.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	tomcat developers reports:
	<blockquote cite="http://www.securityfocus.com/bid/100954">
	 When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/bid/100954</url>
 <url>https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb@%3Cannounce.tomcat.apache.org%3E</url>
 <cvename>CVE-2017-12617</cvename>
 </references>
 <dates>
 <discovery>2017-10-04</discovery>
 <entry>2017-10-06</entry>
 </dates>
 </vuln>

<vuln vid="ccace707-a8d8-11e7-ac58-b499baebfeaf">
 <topic>cURL -- out of bounds read</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>7.56.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports:
	<blockquote cite="https://curl.haxx.se/docs/adv_20171004.html">
	 FTP PWD response parser out of bounds read
	 libcurl may read outside of a heap allocated buffer when doing FTP.
	 When libcurl connects to an FTP server and successfully logs in
	 (anonymous or not), it asks the server for the current directory with
	 the PWD command. The server then responds with a 257 response containing
	 the path, inside double quotes. The returned path name is then kept by
	 libcurl for subsequent uses.
	 Due to a flaw in the string parser for this directory name, a directory
	 name passed like this but without a closing double quote would lead to
	 libcurl not adding a trailing NUL byte to the buffer holding the name.
	 When libcurl would then later access the string, it could read beyond
	 the allocated heap buffer and crash or wrongly access data beyond the
	 buffer, thinking it was part of the path.
	 A malicious server could abuse this fact and effectively prevent
	 libcurl-based clients to work with it - the PWD command is always issued
	 on new FTP connections and the mistake has a high chance of causing a
	 segfault.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/adv_20171004.html</url>
 <cvename>CVE-2017-1000254</cvename>
 </references>
 <dates>
 <discovery>2017-10-04</discovery>
 <entry>2017-10-04</entry>
 </dates>
 </vuln>

<vuln vid="6ed5c5e3-a840-11e7-b5af-a4badb2f4699">
 <topic>FreeBSD -- OpenSSH Denial of Service vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.1</ge><lt>11.1_1</lt></range>
	<range><ge>11.0</ge><lt>11.0_12</lt></range>
	<range><ge>10.3</ge><lt>10.3_21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	There is no limit on the password length.
	<h1>Impact:</h1>
	A remote attacker may be able to cause an affected SSH
	server to use excessive amount of CPU by sending very long
	passwords, when PasswordAuthentication is enabled by the
	system administrator.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-6515</cvename>
 <freebsdsa>SA-17:06.openssh</freebsdsa>
 </references>
 <dates>
 <discovery>2017-08-10</discovery>
 <entry>2017-10-03</entry>
 </dates>
 </vuln>

<vuln vid="420243e9-a840-11e7-b5af-a4badb2f4699">
 <topic>FreeBSD -- heimdal KDC-REP service name validation vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_11</lt></range>
	<range><ge>10.3</ge><lt>10.3_20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	There is a programming error in the Heimdal implementation
	that used an unauthenticated, plain-text version of the
	KDC-REP service name found in a ticket.
	<h1>Impact:</h1>
	An attacker who has control of the network between a
	client and the service it talks to will be able to impersonate
	the service, allowing a successful man-in-the-middle (MITM)
	attack that circumvents the mutual authentication.
 </body>
 </description>
 <references>
 <cvename>CVE-2017-1110</cvename>
 <freebsdsa>SA-17:05.heimdal</freebsdsa>
 </references>
 <dates>
 <discovery>2017-07-12</discovery>
 <entry>2017-10-03</entry>
 </dates>
 </vuln>

<vuln vid="b77b5646-a778-11e7-ac58-b499baebfeaf">
 <topic>dnsmasq -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dnsmasq</name>
	<range><lt>2.78,1</lt></range>
 </package>
 <package>
	<name>dnsmasq-devel</name>
	<range><lt>2.78</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Project Zero reports:
	<blockquote cite="https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html">
	 <ul>
	 <li>CVE-2017-14491: Heap based overflow (2 bytes). Before 2.76 and this
	 commit overflow was unrestricted.</li>
	 <li>CVE-2017-14492: Heap based overflow.</li>
	 <li>CVE-2017-14493: Stack Based overflow.</li>
	 <li>CVE-2017-14494: Information Leak</li>
	 <li>CVE-2017-14495: Lack of free()</li>
	 <li>CVE-2017-14496: Invalid boundary checks. Integer underflow leading
	 to a huge memcpy.</li>
	 <li>CVE-2017-13704: Crash on large DNS query</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html</url>
 <cvename>CVE-2017-14491</cvename>
 <cvename>CVE-2017-14492</cvename>
 <cvename>CVE-2017-14493</cvename>
 <cvename>CVE-2017-14494</cvename>
 <cvename>CVE-2017-14495</cvename>
 <cvename>CVE-2017-14496</cvename>
 <cvename>CVE-2017-13704</cvename>
 </references>
 <dates>
 <discovery>2017-10-02</discovery>
 <entry>2017-10-02</entry>
 </dates>
 </vuln>

<vuln vid="33888815-631e-4bba-b776-a9b46fe177b5">
 <topic>phpmyfaq -- multiple issues</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><le>2.9.8</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpmyfaq developers report:
	<blockquote cite="https://www.exploit-db.com/exploits/42761/">
	 Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action.
	 Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.exploit-db.com/exploits/42761/</url>
 <url>https://github.com/thorsten/phpMyFAQ/commit/30b0025e19bd95ba28f4eff4d259671e7bb6bb86</url>
 <cvename>CVE-2017-14618</cvename>
 <cvename>CVE-2017-14619</cvename>
 </references>
 <dates>
 <discovery>2017-09-20</discovery>
 <entry>2017-09-29</entry>
 </dates>
 </vuln>

<vuln vid="a48d4478-e23f-4085-8ae4-6b3a7b6f016b">
 <topic>wordpress -- multiple issues</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wordpress developers report:
	<blockquote cite="http://www.securityfocus.com/bid/100912">
	 Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.
	 Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.
	 Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.
	 Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.
	 Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.
	 Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.
	 Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/bid/100912</url>
 <url>https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/</url>
 <url>https://core.trac.wordpress.org/changeset/41393</url>
 <url>https://core.trac.wordpress.org/changeset/41395</url>
 <url>https://core.trac.wordpress.org/changeset/41397</url>
 <url>https://core.trac.wordpress.org/changeset/41412</url>
 <url>https://core.trac.wordpress.org/changeset/41448</url>
 <url>https://core.trac.wordpress.org/changeset/41457</url>
 <url>https://wpvulndb.com/vulnerabilities/8911</url>
 <url>https://wpvulndb.com/vulnerabilities/8912</url>
 <url>https://wpvulndb.com/vulnerabilities/8913</url>
 <url>https://wpvulndb.com/vulnerabilities/8914</url>
 <cvename>CVE-2017-14718</cvename>
 <cvename>CVE-2017-14719</cvename>
 <cvename>CVE-2017-14720</cvename>
 <cvename>CVE-2017-14721</cvename>
 <cvename>CVE-2017-14722</cvename>
 <cvename>CVE-2017-14724</cvename>
 <cvename>CVE-2017-14726</cvename>
 </references>
 <dates>
 <discovery>2017-09-23</discovery>
 <entry>2017-09-29</entry>
 </dates>
 </vuln>

<vuln vid="1098a15b-b0f6-42b7-b5c7-8a8646e8be07">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>56.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>52.4.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>52.4.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/">
	 CVE-2017-7793: Use-after-free with Fetch API
	 CVE-2017-7817: Firefox for Android address bar spoofing through fullscreen mode
	 CVE-2017-7818: Use-after-free during ARIA array manipulation
	 CVE-2017-7819: Use-after-free while resizing images in design mode
	 CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE
	 CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes
	 CVE-2017-7812: Drag and drop of malicious page content to the tab bar can open locally stored files
	 CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings
	 CVE-2017-7813: Integer truncation in the JavaScript parser
	 CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces
	 CVE-2017-7815: Spoofing attack with modal dialogs on non-e10s installations
	 CVE-2017-7816: WebExtensions can load about: URLs in extension UI
	 CVE-2017-7821: WebExtensions can download and open non-executable files without user interaction
	 CVE-2017-7823: CSP sandbox directive did not create a unique origin
	 CVE-2017-7822: WebCrypto allows AES-GCM with 0-length IV
	 CVE-2017-7820: Xray wrapper bypass with new tab and web console
	 CVE-2017-7811: Memory safety bugs fixed in Firefox 56
	 CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-7793</cvename>
 <cvename>CVE-2017-7805</cvename>
 <cvename>CVE-2017-7810</cvename>
 <cvename>CVE-2017-7811</cvename>
 <cvename>CVE-2017-7812</cvename>
 <cvename>CVE-2017-7813</cvename>
 <cvename>CVE-2017-7814</cvename>
 <cvename>CVE-2017-7815</cvename>
 <cvename>CVE-2017-7816</cvename>
 <cvename>CVE-2017-7817</cvename>
 <cvename>CVE-2017-7818</cvename>
 <cvename>CVE-2017-7819</cvename>
 <cvename>CVE-2017-7820</cvename>
 <cvename>CVE-2017-7821</cvename>
 <cvename>CVE-2017-7822</cvename>
 <cvename>CVE-2017-7823</cvename>
 <cvename>CVE-2017-7824</cvename>
 <cvename>CVE-2017-7825</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-22/</url>
 </references>
 <dates>
 <discovery>2017-09-28</discovery>
 <entry>2017-09-29</entry>
 <modified>2017-10-03</modified>
 </dates>
 </vuln>

<vuln vid="43a1b8f9-3451-4f3c-b4fc-730c0f5876c1">
 <topic>sam2p -- multiple issues</topic>
 <affects>
 <package>
	<name>sam2p</name>
	<range><lt>0.49.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	sam2p developers report:
	<blockquote cite="https://github.com/pts/sam2p/issues/14">
	 In sam2p 0.49.3, a heap-based buffer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp.
	 In sam2p 0.49.3, the in_xpm_reader function in in_xpm.cpp has an integer signedness error, leading to a crash when writing to an out-of-bounds array element.
	 In sam2p 0.49.3, an integer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp, leading to an invalid write operation.
	 In sam2p 0.49.3, the pcxLoadRaster function in in_pcx.cpp has an integer signedness error leading to a heap-based buffer overflow.
	 Because of an integer overflow in sam2p 0.49.3, a loop executes 0xffffffff times, ending with an invalid read of size 1 in the Image::Indexed::sortPal function in image.cpp. However, this also causes memory corruption because of an attempted write to the invalid d[0xfffffffe] array element.
	 In sam2p 0.49.3, there is an invalid read of size 2 in the parse_rgb function in in_xpm.cpp. However, this can also cause a write to an illegal address.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/pts/sam2p/issues/14</url>
 <cvename>CVE-2017-14628</cvename>
 <cvename>CVE-2017-14629</cvename>
 <cvename>CVE-2017-14630</cvename>
 <cvename>CVE-2017-14631</cvename>
 <cvename>CVE-2017-14636</cvename>
 <cvename>CVE-2017-14637</cvename>
 </references>
 <dates>
 <discovery>2017-09-21</discovery>
 <entry>2017-09-28</entry>
 </dates>
 </vuln>

<vuln vid="02bee9ae-c5d1-409b-8a79-983a88861509">
 <topic>libraw -- Out-of-bounds Read</topic>
 <affects>
 <package>
	<name>libraw</name>
	<range><le>0.18.4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libraw developers report:
	<blockquote cite="https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21">
	 In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21</url>
 <url>https://github.com/LibRaw/LibRaw/issues/101</url>
 <cvename>CVE-2017-14608</cvename>
 </references>
 <dates>
 <discovery>2017-09-20</discovery>
 <entry>2017-09-28</entry>
 </dates>
 </vuln>

<vuln vid="3dd6ccf4-a3c6-11e7-a52e-0800279f2ff8">
 <topic>OpenVPN -- out-of-bounds write in legacy key-method 1</topic>
 <affects>
 <package>
	<name>openvpn-polarssl</name>
	<range><lt>2.3.18</lt></range>
 </package>
 <package>
	<name>openvpn-mbedtls</name>
	<range><ge>2.4.0</ge><lt>2.4.4</lt></range>
 </package>
 <package>
	<name>openvpn</name>
	<range><ge>2.4.0</ge><lt>2.4.4</lt></range>
	<range><lt>2.3.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Steffan Karger reports:
	<blockquote cite="https://community.openvpn.net/openvpn/wiki/CVE-2017-12166">
	 The bounds check in read_key() was performed after using the value,
	 instead of before. If 'key-method 1' is used, this allowed an
	 attacker to send a malformed packet to trigger a stack buffer
	 overflow. [...]
	 Note that 'key-method 1' has been replaced by 'key method 2' as the
	 default in OpenVPN 2.0 (released on 2005-04-17), and explicitly
	 deprecated in 2.4 and marked for removal in 2.5. This should limit
	 the amount of users impacted by this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://community.openvpn.net/openvpn/wiki/CVE-2017-12166</url>
 <url>https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15492.html</url>
 <cvename>CVE-2017-12166</cvename>
 </references>
 <dates>
 <discovery>2017-09-21</discovery>
 <entry>2017-09-27</entry>
 </dates>
 </vuln>

<vuln vid="16fb4f83-a2ab-11e7-9c14-009c02a2ab30">
 <topic>ImageMagick -- denial of service via a crafted font file</topic>
 <affects>
 <package>
	<name>ImageMagick7</name>
	<range><lt>7.0.7.4</lt></range>
 </package>
 <package>
	<name>ImageMagick7-nox11</name>
	<range><lt>7.0.7.4</lt></range>
 </package>
 <package>
	<name>ImageMagick</name>
	<range><le>6.9.8.9_1</le></range>
 </package>
 <package>
	<name>ImageMagick-nox11</name>
	<range><le>6.9.8.9_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14741">
	 The ReadCAPTIONImage function in coders/caption.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via a crafted font file.
	</blockquote>
 </body>
 </description>
 <references>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14741</url>
	<url>https://github.com/ImageMagick/ImageMagick/issues/771</url>
	<url>https://github.com/ImageMagick/ImageMagick/commit/7d8e14899c562157c7760a77fc91625a27cb596f</url>
	<url>https://github.com/ImageMagick/ImageMagick/commit/bb11d07139efe0f5e4ce0e4afda32abdbe82fa9d</url>
	<cvename>CVE-2017-14741</cvename>
 </references>
 <dates>
 <discovery>2017-09-21</discovery>
 <entry>2017-09-26</entry>
 </dates>
 </vuln>

<vuln vid="58fafead-cd13-472f-a9bd-d0173ba1b04c">
 <topic>libofx -- exploitable buffer overflow</topic>
 <affects>
 <package>
	<name>libofx</name>
	<range><le>0.9.11_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Talos developers report:
	<blockquote cite="http://www.securityfocus.com/bid/100828">
	 An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/bid/100828</url>
 <url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0317</url>
 <cvename>CVE-2017-2816</cvename>
 </references>
 <dates>
 <discovery>2017-09-13</discovery>
 <entry>2017-09-27</entry>
 </dates>
 </vuln>

<vuln vid="3b776502-f601-44e0-87cd-b63f1b9ae42a">
 <topic>sugarcrm -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>sugarcrm</name>
	<range><le>6.5.26</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	sugarcrm developers report:
	<blockquote cite="https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/">
	 An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection, as demonstrated by a backslash character at the end of a bean_id to modules/Emails/DetailView.php. An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker to modify the SQL database. Proper SQL escaping has been added to prevent such exploits.
	 An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a query string. Proper input validation has been added to mitigate this issue.
	 An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/</url>
 <url>https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-006/</url>
 <url>https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/</url>
 <url>https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/</url>
 <url>https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/</url>
 <url>https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/</url>
 <cvename>CVE-2017-14508</cvename>
 <cvename>CVE-2017-14509</cvename>
 <cvename>CVE-2017-14510</cvename>
 </references>
 <dates>
 <discovery>2017-09-17</discovery>
 <entry>2017-09-26</entry>
 </dates>
 </vuln>

<vuln vid="b2952517-07e5-4d19-8850-21c5b7e0623f">
 <topic>libzip -- denial of service</topic>
 <affects>
 <package>
	<name>libzip</name>
	<range><lt>1.1.13_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libzip developers report:
	<blockquote cite="https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/">
	 The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/</url>
 <url>https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5</url>
 <cvename>CVE-2017-14107</cvename>
 </references>
 <dates>
 <discovery>2017-09-01</discovery>
 <entry>2017-09-27</entry>
 </dates>
 </vuln>

<vuln vid="10214bda-0902-4e3b-a2f9-9a68ef206a73">
 <topic>libbson -- Denial of Service</topic>
 <affects>
 <package>
	<name>libbson</name>
	<range><lt>1.8.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mongodb developers report:
	<blockquote cite="http://www.securityfocus.com/bid/100825">
	 In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/bid/100825</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1489355</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1489356</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1489362</url>
 <cvename>CVE-2017-14227</cvename>
 </references>
 <dates>
 <discovery>2017-09-09</discovery>
 <entry>2017-09-26</entry>
 </dates>
 </vuln>

<vuln vid="eb03d642-6724-472d-b038-f2bf074e1fc8">
 <topic>tcpdump -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>tcpdump</name>
	<range><lt>4.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	tcpdump developers report:
	<blockquote cite="http://www.tcpdump.org/tcpdump-changes.txt">
	 Too many issues to detail, see CVE references for details.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-11541</cvename>
 <cvename>CVE-2017-11542</cvename>
 <cvename>CVE-2017-11543</cvename>
 <cvename>CVE-2017-12893</cvename>
 <cvename>CVE-2017-12894</cvename>
 <cvename>CVE-2017-12895</cvename>
 <cvename>CVE-2017-12896</cvename>
 <cvename>CVE-2017-12897</cvename>
 <cvename>CVE-2017-12898</cvename>
 <cvename>CVE-2017-12899</cvename>
 <cvename>CVE-2017-12900</cvename>
 <cvename>CVE-2017-12901</cvename>
 <cvename>CVE-2017-12902</cvename>
 <cvename>CVE-2017-12985</cvename>
 <cvename>CVE-2017-12986</cvename>
 <cvename>CVE-2017-12987</cvename>
 <cvename>CVE-2017-12988</cvename>
 <cvename>CVE-2017-12989</cvename>
 <cvename>CVE-2017-12990</cvename>
 <cvename>CVE-2017-12991</cvename>
 <cvename>CVE-2017-12992</cvename>
 <cvename>CVE-2017-12993</cvename>
 <cvename>CVE-2017-12994</cvename>
 <cvename>CVE-2017-12995</cvename>
 <cvename>CVE-2017-12996</cvename>
 <cvename>CVE-2017-12997</cvename>
 <cvename>CVE-2017-12998</cvename>
 <cvename>CVE-2017-12999</cvename>
 <cvename>CVE-2017-13000</cvename>
 <cvename>CVE-2017-13001</cvename>
 <cvename>CVE-2017-13002</cvename>
 <cvename>CVE-2017-13003</cvename>
 <cvename>CVE-2017-13004</cvename>
 <cvename>CVE-2017-13005</cvename>
 <cvename>CVE-2017-13006</cvename>
 <cvename>CVE-2017-13007</cvename>
 <cvename>CVE-2017-13008</cvename>
 <cvename>CVE-2017-13009</cvename>
 <cvename>CVE-2017-13010</cvename>
 <cvename>CVE-2017-13011</cvename>
 <cvename>CVE-2017-13012</cvename>
 <cvename>CVE-2017-13013</cvename>
 <cvename>CVE-2017-13014</cvename>
 <cvename>CVE-2017-13015</cvename>
 <cvename>CVE-2017-13016</cvename>
 <cvename>CVE-2017-13017</cvename>
 <cvename>CVE-2017-13018</cvename>
 <cvename>CVE-2017-13019</cvename>
 <cvename>CVE-2017-13020</cvename>
 <cvename>CVE-2017-13021</cvename>
 <cvename>CVE-2017-13022</cvename>
 <cvename>CVE-2017-13023</cvename>
 <cvename>CVE-2017-13024</cvename>
 <cvename>CVE-2017-13025</cvename>
 <cvename>CVE-2017-13026</cvename>
 <cvename>CVE-2017-13027</cvename>
 <cvename>CVE-2017-13028</cvename>
 <cvename>CVE-2017-13029</cvename>
 <cvename>CVE-2017-13030</cvename>
 <cvename>CVE-2017-13031</cvename>
 <cvename>CVE-2017-13032</cvename>
 <cvename>CVE-2017-13033</cvename>
 <cvename>CVE-2017-13034</cvename>
 <cvename>CVE-2017-13035</cvename>
 <cvename>CVE-2017-13036</cvename>
 <cvename>CVE-2017-13037</cvename>
 <cvename>CVE-2017-13038</cvename>
 <cvename>CVE-2017-13039</cvename>
 <cvename>CVE-2017-13040</cvename>
 <cvename>CVE-2017-13041</cvename>
 <cvename>CVE-2017-13042</cvename>
 <cvename>CVE-2017-13043</cvename>
 <cvename>CVE-2017-13044</cvename>
 <cvename>CVE-2017-13045</cvename>
 <cvename>CVE-2017-13046</cvename>
 <cvename>CVE-2017-13047</cvename>
 <cvename>CVE-2017-13048</cvename>
 <cvename>CVE-2017-13049</cvename>
 <cvename>CVE-2017-13050</cvename>
 <cvename>CVE-2017-13051</cvename>
 <cvename>CVE-2017-13052</cvename>
 <cvename>CVE-2017-13053</cvename>
 <cvename>CVE-2017-13054</cvename>
 <cvename>CVE-2017-13055</cvename>
 <cvename>CVE-2017-13687</cvename>
 <cvename>CVE-2017-13688</cvename>
 <cvename>CVE-2017-13689</cvename>
 <cvename>CVE-2017-13690</cvename>
 <cvename>CVE-2017-13725</cvename>
 </references>
 <dates>
 <discovery>2017-07-22</discovery>
 <entry>2017-09-26</entry>
 </dates>
 </vuln>

<vuln vid="d9f96741-47bd-4426-9aba-8736c0971b24">
 <topic>libraw -- buffer overflow</topic>
 <affects>
 <package>
	<name>libraw</name>
	<range><lt>0.18.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libraw developers report:
	<blockquote cite="http://www.securityfocus.com/bid/100866">
	 LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/bid/100866</url>
 <url>https://github.com/LibRaw/LibRaw/issues/100</url>
 <cvename>CVE-2017-14348</cvename>
 </references>
 <dates>
 <discovery>2017-09-12</discovery>
 <entry>2017-09-26</entry>
 </dates>
 </vuln>

<vuln vid="4cd857d9-26d2-4417-b765-69701938f9e0">
 <topic>libraw -- denial of service and remote code execution</topic>
 <affects>
 <package>
	<name>libraw</name>
	<range><lt>0.18.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libraw developers report:
	<blockquote cite="https://github.com/LibRaw/LibRaw/issues/99">
	 A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3. It could allow a remote denial of service or code execution attack.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/LibRaw/LibRaw/issues/99</url>
 <cvename>CVE-2017-14265</cvename>
 </references>
 <dates>
 <discovery>2017-09-11</discovery>
 <entry>2017-09-26</entry>
 </dates>
 </vuln>

<vuln vid="a60a2e95-acba-4b11-bc32-ffb47364e07d">
 <topic>libgd -- Denial of servica via double free</topic>
 <affects>
 <package>
	<name>libgd</name>
	<range><lt>2.2.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libgd developers report:
	<blockquote cite="http://www.debian.org/security/2017/dsa-3961">
	 Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.debian.org/security/2017/dsa-3961</url>
 <url>https://github.com/libgd/libgd/issues/381</url>
 <url>https://github.com/libgd/libgd/releases/tag/gd-2.2.5</url>
 <url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N2BLXX7KNRE7ZVQAKGTHHWS33CUCXVUP/</url>
 <cvename>CVE-2017-6362</cvename>
 </references>
 <dates>
 <discovery>2017-09-07</discovery>
 <entry>2017-09-26</entry>
 </dates>
 </vuln>

<vuln vid="5033e2fc-98ec-4ef5-8e0b-87cfbbc73081">
 <topic>php-gd and gd -- Buffer over-read into uninitialized memory</topic>
 <affects>
 <package>
	<name>libgd</name>
	<range><lt>2.2.5</lt></range>
 </package>
 <package>
	<name>php70-gd</name>
	<range><lt>7.0.21</lt></range>
 </package>
 <package>
	<name>php71-gd</name>
	<range><lt>7.1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP developers report:
	<blockquote cite="https://bugs.php.net/bug.php?id=74435">
	 The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.php.net/bug.php?id=74435</url>
 <cvename>CVE-2017-7890</cvename>
 </references>
 <dates>
 <discovery>2017-08-02</discovery>
 <entry>2017-09-26</entry>
 </dates>
 </vuln>

<vuln vid="d843a984-7f22-484f-ba81-483ddbe30dc3">
 <topic>ledger -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ledger</name>
	<range><le>3.1.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Talos reports:
	<blockquote cite="http://www.securityfocus.com/bid/100543">
	 An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.
	 An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/bid/100543</url>
 <url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0303</url>
 <url>http://www.securityfocus.com/bid/100546</url>
 <url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0304</url>
 <cvename>CVE-2017-2808</cvename>
 <cvename>CVE-2017-2807</cvename>
 </references>
 <dates>
 <discovery>2017-09-05</discovery>
 <entry>2017-09-26</entry>
 </dates>
 </vuln>

<vuln vid="7801b1e1-99b4-42ac-ab22-7646235e7c16">
 <topic>aacplusenc -- denial of service</topic>
 <affects>
 <package>
	<name>aacplusenc</name>
	<range><le>0.17.5_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gentoo developers report:
	<blockquote cite="https://blogs.gentoo.org/ago/2017/09/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/">
	 DeleteBitBuffer in libbitbuf/bitbuffer.c in mp4tools aacplusenc 0.17.5 allows remote attackers to cause a denial of service (invalid memory write, SEGV on unknown address 0x000000000030, and application crash) or possibly have unspecified other impact via a crafted .wav file, aka a NULL pointer dereference.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blogs.gentoo.org/ago/2017/09/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/</url>
 <url>https://github.com/teknoraver/aacplusenc/issues/1</url>
 <cvename>CVE-2017-14181</cvename>
 </references>
 <dates>
 <discovery>2017-09-07</discovery>
 <entry>2017-09-25</entry>
 </dates>
 </vuln>

<vuln vid="478d4102-2319-4026-b3b2-a57c48f159ac">
 <topic>ansible -- information disclosure flaw</topic>
 <affects>
 <package>
	<name>ansible</name>
	<range><le>2.2.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ansible developers report:
	<blockquote cite="https://github.com/ansible/ansible/issues/22505">
	 Ansible versions 2.2.3 and earlier are vulnerable to an information disclosure flaw due to the interaction of call back plugins and the no_log directive where the information may not be sanitized properly.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/ansible/ansible/issues/22505</url>
 <cvename>CVE-2017-7473</cvename>
 </references>
 <dates>
 <discovery>2017-07-21</discovery>
 <entry>2017-09-25</entry>
 </dates>
 </vuln>

<vuln vid="b63421b6-a1e0-11e7-ac58-b499baebfeaf">
 <topic>weechat -- crash in logger plugin</topic>
 <affects>
 <package>
	<name>weechat</name>
	<range><lt>1.9.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	WeeChat reports:
	<blockquote cite="https://weechat.org/news/98/20170923-Version-1.9.1-security-release/">
	 security problem: a crash can happen in logger plugin when
	 converting date/time specifiers in file mask.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://weechat.org/news/98/20170923-Version-1.9.1-security-release/</url>
 <cvename>CVE-2017-14727</cvename>
 </references>
 <dates>
 <discovery>2017-09-23</discovery>
 <entry>2017-09-25</entry>
 </dates>
 </vuln>

<vuln vid="d9e82328-a129-11e7-987e-4f174049b30a">
 <topic>perl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>perl5</name>
	<range><ge>5.24.0</ge><lt>5.24.3</lt></range>
	<range><ge>5.26.0</ge><lt>5.26.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Meta CPAN reports:
	<blockquote cite="https://metacpan.org/changes/release/SHAY/perl-5.26.1#Security">
	 CVE-2017-12814: $ENV{$key} stack buffer overflow on Windows
	 A possible stack buffer overflow in the %ENV code on Windows has been
	 fixed by removing the buffer completely since it was superfluous anyway.
	 CVE-2017-12837: Heap buffer overflow in regular expression compiler
	 Compiling certain regular expression patterns with the case-insensitive
	 modifier could cause a heap buffer overflow and crash perl. This has now
	 been fixed.
	 CVE-2017-12883: Buffer over-read in regular expression parser
	 For certain types of syntax error in a regular expression pattern, the
	 error message could either contain the contents of a random, possibly
	 large, chunk of memory, or could crash perl. This has now been fixed.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://metacpan.org/changes/release/SHAY/perl-5.24.3</url>
 <url>https://metacpan.org/changes/release/SHAY/perl-5.26.1</url>
 <cvename>CVE-2017-12814</cvename>
 <cvename>CVE-2017-12837</cvename>
 <cvename>CVE-2017-12883</cvename>
 </references>
 <dates>
 <discovery>2017-09-19</discovery>
 <entry>2017-09-24</entry>
 </dates>
 </vuln>

<vuln vid="917e5519-9fdd-11e7-8b58-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>61.0.3163.100</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html">
	 3 security fixes in this release, including:
	 <ul>
	 <li>[765433] High CVE-2017-5121: Out-of-bounds access in V8. Reported by
	 Jordan Rabet, Microsoft Offensive Security Research and Microsoft
	 ChakraCore team on 2017-09-14</li>
	 <li>[752423] High CVE-2017-5122: Out-of-bounds access in V8. Reported by
	 Choongwoo Han of Naver Corporation on 2017-08-04</li>
	 <li>[767508] Various fixes from internal audits, fuzzing and other initiatives</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5121</cvename>
 <cvename>CVE-2017-5122</cvename>
 <url>https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html</url>
 </references>
 <dates>
 <discovery>2017-09-21</discovery>
 <entry>2017-09-22</entry>
 </dates>
 </vuln>

<vuln vid="c2ea3b31-9d75-11e7-bb13-001999f8d30b">
 <topic>asterisk -- RTP/RTCP information leak</topic>
 <affects>
 <package>
	<name>asterisk11</name>
	<range><lt>11.25.3</lt></range>
 </package>
 <package>
	<name>asterisk13</name>
	<range><lt>13.17.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 This is a follow up advisory to AST-2017-005.
	 Insufficient RTCP packet validation could allow reading
	 stale buffer contents and when combined with the "nat"
	 and "symmetric_rtp" options allow redirecting where
	 Asterisk sends the next RTCP report.
	 The RTP stream qualification to learn the source address
	 of media always accepted the first RTP packet as the new
	 source and allowed what AST-2017-005 was mitigating. The
	 intent was to qualify a series of packets before accepting
	 the new source address.
	 The RTP/RTCP stack will now validate RTCP packets before processing them.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2017-008.html</url>
 <cvename>CVE-2017-14099</cvename>
 </references>
 <dates>
 <discovery>2017-09-01</discovery>
 <entry>2017-09-19</entry>
 </dates>
 </vuln>

<vuln vid="95b01379-9d52-11e7-a25c-471bafc3262f">
 <topic>ruby -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>2.2.0</ge><lt>2.2.8</lt></range>
	<range><ge>2.3.0</ge><lt>2.3.5</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby blog:
	<blockquote cite="https://www.ruby-lang.org/en/security/">
	 CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf
	 If a malicious format string which contains a precious specifier (*)
	 is passed and a huge minus value is also passed to the specifier,
	 buffer underrun may be caused. In such situation, the result may
	 contains heap, or the Ruby interpreter may crash.
	 CVE-2017-10784: Escape sequence injection vulnerability in the Basic
	 authentication of WEBrick
	 When using the Basic authentication of WEBrick, clients can pass an
	 arbitrary string as the user name. WEBrick outputs the passed user name
	 intact to its log, then an attacker can inject malicious escape
	 sequences to the log and dangerous control characters may be executed
	 on a victim’s terminal emulator.
	 This vulnerability is similar to a vulnerability already fixed, but
	 it had not been fixed in the Basic authentication.
	 CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 decode
	 If a malicious string is passed to the decode method of OpenSSL::ASN1,
	 buffer underrun may be caused and the Ruby interpreter may crash.
	 CVE-2017-14064: Heap exposure vulnerability in generating JSON
	 The generate method of JSON module optionally accepts an instance of
	 JSON::Ext::Generator::State class. If a malicious instance is passed,
	 the result may include contents of heap.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.ruby-lang.org/en/security/</url>
 <url>https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/</url>
 <url>https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/</url>
 <url>https://www.ruby-lang.org/en/news/2017/09/14/openssl-asn1-buffer-underrun-cve-2017-14033/</url>
 <url>https://www.ruby-lang.org/en/news/2017/09/14/json-heap-exposure-cve-2017-14064/</url>
 <cvename>CVE-2017-0898</cvename>
 <cvename>CVE-2017-10784</cvename>
 <cvename>CVE-2017-14033</cvename>
 <cvename>CVE-2017-14064</cvename>
 </references>
 <dates>
 <discovery>2017-09-14</discovery>
 <entry>2017-09-19</entry>
 </dates>
 </vuln>

<vuln vid="2bffdf2f-9d45-11e7-a25c-471bafc3262f">
 <topic>rubygem-geminabox -- XSS &amp; CSRF vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-geminabox</name>
	<range><lt>0.13.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gem in a box XSS vulenrability - CVE-2017-14506:
	<blockquote cite="https://baraktawily.blogspot.com/2017/09/gem-in-box-xss-vulenrability-cve-2017.html">
	 Malicious attacker create GEM file with crafted homepage value
	 (gem.homepage in .gemspec file) includes XSS payload.
	 The attacker access geminabox system and uploads the gem file
	 (or uses CSRF/SSRF attack to do so).
	 From now on, any user access Geminabox web server, executes the
	 malicious XSS payload, that will delete any gems on the server,
	 and won't let users use the geminabox anymore. (make victim's
	 browser crash or redirect them to other hosts).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://baraktawily.blogspot.com/2017/09/gem-in-box-xss-vulenrability-cve-2017.html</url>
 <cvename>CVE-2017-14506</cvename>
 <cvename>CVE-2017-14683</cvename>
 </references>
 <dates>
 <discovery>2017-09-18</discovery>
 <entry>2017-09-19</entry>
 <modified>2017-09-27</modified>
 </dates>
 </vuln>

<vuln vid="76b085e2-9d33-11e7-9260-000c292ee6b8">
 <topic>Apache -- HTTP OPTIONS method can leak server memory</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.27_1</lt></range>
 </package>
 <package>
	<name>apache22</name>
	<range><lt>2.2.34_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Fuzzing Project reports:
	<blockquote cite="https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html">
	 Apache httpd allows remote attackers to read secret data from
	 process memory if the Limit directive can be set in a user's
	 .htaccess file, or if httpd.conf has certain misconfigurations,
	 aka Optionsbleed. This affects the Apache HTTP Server through
	 2.2.34 and 2.4.x through 2.4.27. The attacker sends an
	 unauthenticated OPTIONS HTTP request when attempting to read
	 secret data. This is a use-after-free issue and thus secret data
	 is not always sent, and the specific data depends on many factors
	 including configuration. Exploitation with .htaccess can be
	 blocked with a patch to the ap_limit_section function in
	 server/core.c.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/detail/CVE-2017-9798</url>
 <cvename>CVE-2017-9798</cvename>
 </references>
 <dates>
 <discovery>2017-09-18</discovery>
 <entry>2017-09-19</entry>
 </dates>
 </vuln>

<vuln vid="6a177c87-9933-11e7-93f7-d43d7e971a1b">
 <topic>GitLab -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gitlab</name>
	<range><ge>1.0.0</ge><le>9.3.10</le></range>
	<range><ge>9.4.0</ge><le>9.4.5</le></range>
	<range><ge>9.5.0</ge><le>9.5.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab reports:
	<blockquote cite="https://about.gitlab.com/2017/09/07/gitlab-9-dot-5-dot-4-security-release/">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2017/09/07/gitlab-9-dot-5-dot-4-security-release/</url>
 <cvename>CVE-2017-5029</cvename>
 <cvename>CVE-2016-4738</cvename>
 </references>
 <dates>
 <discovery>2017-09-07</discovery>
 <entry>2017-09-14</entry>
 </dates>
 </vuln>

<vuln vid="531aae08-97f0-11e7-aadd-6451062f0f7a">
 <topic>Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>27.0.0.130</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-28.html">
	 <ul>
	 <li>These updates resolve memory corruption vulnerabilities that
	 could lead to remote code execution (CVE-2017-11281,
	 CVE-2017-11282).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-11281</cvename>
 <cvename>CVE-2017-11282</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb17-28.html</url>
 </references>
 <dates>
 <discovery>2017-09-12</discovery>
 <entry>2017-09-12</entry>
 </dates>
 </vuln>

<vuln vid="47e2e52c-975c-11e7-942d-5404a68a61a2">
 <topic>emacs -- enriched text remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>emacs25</name>
	<name>emacs-nox11</name>
	<range><lt>25.3,3</lt></range>
 </package>
 <package>
	<name>emacs-devel</name>
	<range><lt>26.0.50.20170912,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Paul Eggert reports:
	<blockquote cite="http://seclists.org/oss-sec/2017/q3/422">
	 Charles A. Roelli has found a security flaw in the enriched mode in GNU Emacs.
	 When Emacs renders MIME text/enriched data (Internet RFC 1896), it
	 is vulnerable to arbitrary code execution. Since Emacs-based mail
	 clients decode "Content-Type: text/enriched", this code is exploitable
	 remotely. This bug affects GNU Emacs versions 19.29 through 25.2.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2017/q3/422</url>
 <url>https://bugs.gnu.org/28350</url>
 </references>
 <dates>
 <discovery>2017-09-04</discovery>
 <entry>2017-09-12</entry>
 <modified>2017-09-13</modified>
 </dates>
 </vuln>

<vuln vid="f9f76a50-9642-11e7-ab09-080027b00c2e">
 <topic>cyrus-imapd -- broken "other users" behaviour</topic>
 <affects>
 <package>
	<name>cyrus-imapd30</name>
	<range><ge>3.0.0</ge><lt>3.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cyrus IMAP 3.0.4 Release Notes states:
	<blockquote cite="https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.4.html">
	 Fixed Issue #2132: Broken "Other Users" behaviour
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-14230</cvename>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14230</url>
 </references>
 <dates>
 <discovery>2017-09-07</discovery>
 <entry>2017-09-10</entry>
 </dates>
 </vuln>

<vuln vid="aaab03be-932d-11e7-92d8-4b26fc968492">
 <topic>Django -- possible XSS in traceback section of technical 500 debug page</topic>
 <affects>
 <package>
	<name>py27-django110</name>
	<name>py34-django110</name>
	<name>py35-django110</name>
	<name>py36-django110</name>
	<range><lt>1.10.8</lt></range>
 </package>
 <package>
	<name>py27-django111</name>
	<name>py34-django111</name>
	<name>py35-django111</name>
	<name>py36-django111</name>
	<range><lt>1.11.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django blog:
	<blockquote cite="https://www.djangoproject.com/weblog/2017/sep/05/security-releases/">
	 In older versions, HTML autoescaping was disabled in a portion of the template
	 for the technical 500 debug page. Given the right circumstances, this allowed a
	 cross-site scripting attack. This vulnerability shouldn't affect most production
	 sites since you shouldn't run with DEBUG = True (which makes this page accessible)
	 in your production settings.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-12794</cvename>
 <url>https://www.djangoproject.com/weblog/2017/sep/05/security-releases/</url>
 </references>
 <dates>
 <discovery>2017-09-05</discovery>
 <entry>2017-09-06</entry>
 </dates>
 </vuln>

<vuln vid="e1100e63-92f7-11e7-bd95-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>61.0.3163.79</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html">
	 22 security fixes in this release, including:
	 <ul>
	 <li>[737023] High CVE-2017-5111: Use after free in PDFium. Reported by
	 Luat Nguyen on KeenLab, Tencent on 2017-06-27</li>
	 <li>[740603] High CVE-2017-5112: Heap buffer overflow in WebGL. Reported by
	 Tobias Klein on 2017-07-10</li>
	 <li>[747043] High CVE-2017-5113: Heap buffer overflow in Skia. Reported by
	 Anonymous on 2017-07-20</li>
	 <li>[752829] High CVE-2017-5114: Memory lifecycle issue in PDFium. Reported by
	 Ke Liu of Tencent's Xuanwu LAB on 2017-08-07</li>
	 <li>[744584] High CVE-2017-5115: Type confusion in V8. Reported by
	 Marco Giovannini on 2017-07-17</li>
	 <li>[759624] High CVE-2017-5116: Type confusion in V8. Reported by
	 Anonymous on 2017-08-28</li>
	 <li>[739190] Medium CVE-2017-5117: Use of uninitialized value in Skia. Reported by
	 Tobias Klein on 2017-07-04</li>
	 <li>[747847] Medium CVE-2017-5118: Bypass of Content Security Policy in Blink. Reported by
	 WenXu Wu of Tencent's Xuanwu Lab on 2017-07-24</li>
	 <li>[725127] Medium CVE-2017-5119: Use of uninitialized value in Skia. Reported by
	 Anonymous on 2017-05-22</li>
	 <li>[718676] Low CVE-2017-5120: Potential HTTPS downgrade during redirect navigation. Reported by
	 Xiaoyin Liu on 2017-05-05</li>
	 <li>[762099] Various fixes from internal audits, fuzzing and other initiatives</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5111</cvename>
 <cvename>CVE-2017-5112</cvename>
 <cvename>CVE-2017-5113</cvename>
 <cvename>CVE-2017-5114</cvename>
 <cvename>CVE-2017-5115</cvename>
 <cvename>CVE-2017-5116</cvename>
 <cvename>CVE-2017-5117</cvename>
 <cvename>CVE-2017-5118</cvename>
 <cvename>CVE-2017-5119</cvename>
 <cvename>CVE-2017-5120</cvename>
 <url>https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2017-09-05</discovery>
 <entry>2017-09-06</entry>
 </dates>
 </vuln>

<vuln vid="5a1f1a86-8f4c-11e7-b5af-a4badb2f4699">
 <topic>gdk-pixbuf -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gtk-pixbuf2</name>
	<range><lt>2.36.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	TALOS reports:
	<blockquote cite="http://blog.talosintelligence.com/2017/08/vuln-spotlight-multiple-gdk.html">
	 <ul>
	 <li>An exploitable integer overflow vulnerability exists in
	 the tiff_image_parse functionality.</li>
	 <li>An exploitable heap-overflow vulnerability exists in
	 the gdk_pixbuf__jpeg_image_load_increment functionality.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.talosintelligence.com/2017/08/vuln-spotlight-multiple-gdk.html</url>
 <cvename>CVE-2017-2862</cvename>
 <cvename>CVE-2017-2870</cvename>
 </references>
 <dates>
 <discovery>2017-08-30</discovery>
 <entry>2017-09-01</entry>
 </dates>
 </vuln>

<vuln vid="ec1df2a1-8ee6-11e7-8be8-001999f8d30b">
 <topic>asterisk -- Remote Crash Vulerability in res_pjsip</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.17.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 A carefully crafted URI in a From, To or Contact header could cause Asterisk to crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2017-007.html</url>
 <cvename>CVE-2017-14098</cvename>
 </references>
 <dates>
 <discovery>2017-08-31</discovery>
 <entry>2017-09-01</entry>
 </dates>
 </vuln>

<vuln vid="c599f95c-8ee5-11e7-8be8-001999f8d30b">
 <topic>asterisk -- Unauthorized data disclosure and shell access command injection in app_minivm</topic>
 <affects>
 <package>
	<name>asterisk11</name>
	<range><lt>11.25.2</lt></range>
 </package>
 <package>
	<name>asterisk13</name>
	<range><lt>13.17.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 AST-2017-005 - A change was made to the strict RTP
	 support in the RTP stack to better tolerate late media
	 when a reinvite occurs. When combined with the symmetric
	 RTP support this introduced an avenue where media could
	 be hijacked. Instead of only learning a new address when
	 expected the new code allowed a new source address to be
	 learned at all times.
	 AST-2017-006 - The app_minivm module has an "externnotify"
	 program configuration option that is executed by the
	 MinivmNotify dialplan application. The application uses
	 the caller-id name and number as part of a built string
	 passed to the OS shell for interpretation and execution.
	 Since the caller-id name and number can come from an
	 untrusted source, a crafted caller-id name or number
	 allows an arbitrary shell command injection.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://downloads.asterisk.org/pub/security/AST-2017-005.html</url>
 <cvename>CVE-2017-14099</cvename>
 <url>https://downloads.asterisk.org/pub/security/AST-2017-006.html</url>
 <cvename>CVE-2017-14100</cvename>
 </references>
 <dates>
 <discovery>2017-08-31</discovery>
 <entry>2017-09-01</entry>
 </dates>
 </vuln>

<vuln vid="22f28bb3-8d98-11e7-8c37-e8e0b747a45a">
 <topic>libgcrypt -- side-channel attack vulnerability</topic>
 <affects>
 <package>
	<name>libgcrypt</name>
	<range><lt>1.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GnuPG reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0379">
	 Mitigate a local side-channel attack on Curve25519 dubbed "May the Fourth Be With You".
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-0379</cvename>
 <url>https://eprint.iacr.org/2017/806</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0379</url>
 </references>
 <dates>
 <discovery>2017-08-27</discovery>
 <entry>2017-08-30</entry>
 </dates>
 </vuln>

<vuln vid="3f6de636-8cdb-11e7-9c71-f0def1fd7ea2">
 <topic>rubygems -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ruby22-gems</name>
	<name>ruby23-gems</name>
	<name>ruby24-gems</name>
	<range><lt>2.6.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Official blog of RubyGems reports:
	<blockquote cite="https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/">
	 The following vulnerabilities have been reported: a DNS request
	 hijacking vulnerability, an ANSI escape sequence vulnerability, a DoS
	 vulnerability in the query command, and a vulnerability in the gem
	 installer that allowed a malicious gem to overwrite arbitrary
	 files.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/</url>
 </references>
 <dates>
 <discovery>2017-08-29</discovery>
 <entry>2017-08-29</entry>
 </dates>
 </vuln>

<vuln vid="7d7e05fb-64da-435a-84fb-4061493b89b9">
 <topic>kanboard -- multiple privilege escalation vulnerabilities</topic>
 <affects>
 <package>
	<name>kanboard</name>
	<range><lt>1.0.46</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	chbi reports:
	<blockquote cite="https://kanboard.net/news/version-1.0.46">
	 an authenticated standard user could reset the password of another
	 user (including admin) by altering form data.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://kanboard.net/news/version-1.0.46</url>
 <cvename>CVE-2017-12850</cvename>
 <cvename>CVE-2017-12851</cvename>
 </references>
 <dates>
 <discovery>2017-08-15</discovery>
 <entry>2017-08-26</entry>
 </dates>
 </vuln>

<vuln vid="eca2d861-76f4-42ed-89d2-23a2cb396c87">
 <topic>poppler -- multiple denial of service issues</topic>
 <affects>
 <package>
	<name>poppler</name>
	<range><lt>0.56.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Poppler developers report:
	<blockquote cite="http://www.securityfocus.com/bid/99241/discuss">
	 Poppler is prone to a stack-based buffer-overflow
	 vulnerability.
	 Successful exploits may allow attackers to crash the affected
	 application, resulting in denial-of-service condition. Due to the
	 nature of this issue, arbitrary code execution may be possible but
	 this has not been confirmed.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/bid/99241/discuss</url>
 <cvename>CVE-2017-9865</cvename>
 <cvename>CVE-2017-9775</cvename>
 </references>
 <dates>
 <discovery>2017-06-21</discovery>
 <entry>2017-08-24</entry>
 </dates>
 </vuln>

<vuln vid="c5d79773-8801-11e7-93f7-d43d7e971a1b">
 <topic>phpmailer -- XSS in code example and default exeception handler</topic>
 <affects>
 <package>
	<name>phpmailer</name>
	<range><lt>5.2.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHPMailer reports:
	<blockquote cite="https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.24">
	 Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The
	 code_generator.phps example did not filter user input prior to output. This
	 file is distributed with a .phps extension, so it it not normally executable
	 unless it is explicitly renamed, so it is safe by default. There was also an
	 undisclosed potential XSS vulnerability in the default exception handler
	 (unused by default). Patches for both issues kindly provided by Patrick
	 Monnerat of the Fedora Project.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.24</url>
 <cvename>CVE-2017-11503</cvename>
 </references>
 <dates>
 <discovery>2017-07-27</discovery>
 <entry>2017-08-23</entry>
 </dates>
 </vuln>

<vuln vid="3531141d-a708-477c-954a-2a0549e49ca9">
 <topic>salt -- Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master</topic>
 <affects>
 <package>
	<name>py27-salt</name>
	<name>py32-salt</name>
	<name>py33-salt</name>
	<name>py34-salt</name>
	<name>py35-salt</name>
	<name>py36-salt</name>
	<range><lt>2016.11.7</lt></range>
	<range><ge>2017.7.0</ge><lt>2017.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SaltStack reports:
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html">
	 Correct a flaw in minion id validation which could allow certain
	 minions to authenticate to a master despite not having the correct
	 credentials. To exploit the vulnerability, an attacker must create a
	 salt-minion with an ID containing characters that will cause a
	 directory traversal.
	 Credit for discovering the security flaw goes to: Vernhk@qq.com
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-12791</cvename>
 <url>https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html</url>
 <url>https://docs.saltstack.com/en/latest/topics/releases/2016.11.7.html</url>
 </references>
 <dates>
 <discovery>2017-08-16</discovery>
 <entry>2017-08-22</entry>
 </dates>
 </vuln>

<vuln vid="198d82f3-8777-11e7-950a-e8e0b747a45a">
 <topic>dnsdist -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dnsdist</name>
	<range><lt>1.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Security Advisory reports:
	<blockquote cite="https://dnsdist.org/security-advisories/index.html">
	 The first issue can lead to a denial of service on 32-bit if a backend
	 sends crafted answers, and the second to an alteration of dnsdist's ACL
	 if the API is enabled, writable and an authenticated user is tricked
	 into visiting a crafted website.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-7069</cvename>
 <cvename>CVE-2017-7557</cvename>
 <url>https://dnsdist.org/security-advisories/index.html</url>
 </references>
 <dates>
 <discovery>2017-08-21</discovery>
 <entry>2017-08-22</entry>
 </dates>
 </vuln>

<vuln vid="01a197ca-67f1-11e7-a266-28924a333806">
 <topic>evince and atril -- command injection vulnerability in CBT handler</topic>
 <affects>
 <package>
	<name>evince</name>
	<range><le>3.24.0</le></range>
 </package>
 <package>
	<name>evince-lite</name>
	<range><le>3.24.0</le></range>
 </package>
 <package>
	<name>atril</name>
	<range><lt>1.18.1</lt></range>
	<range><ge>1.19.0</ge><lt>1.19.1</lt></range>
 </package>
 <package>
	<name>atril-lite</name>
	<range><lt>1.18.1</lt></range>
	<range><ge>1.19.0</ge><lt>1.19.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GNOME reports:
	<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=784630">
	 The comic book backend in evince 3.24.0 (and earlier) is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened.
	 The same vulnerability affects atril, the Evince fork.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.gnome.org/show_bug.cgi?id=784630</url>
 <url>https://github.com/mate-desktop/atril/issues/257</url>
 <cvename>CVE-2017-1000083</cvename>
 </references>
 <dates>
 <discovery>2017-07-06</discovery>
 <entry>2017-07-13</entry>
 </dates>
 </vuln>

<vuln vid="e1de77e8-c45e-48d7-8866-5a6f943046de">
 <topic>SquirrelMail -- post-authentication remote code execution</topic>
 <affects>
 <package>
	<name>squirrelmail</name>
	<range><lt>20170705</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SquirrelMail developers report:
	<blockquote cite="http://seclists.org/fulldisclosure/2017/Apr/81">
	 SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN)
	 allows post-authentication remote code execution via a sendmail.cf
	 file that is mishandled in a popen call. It's possible to exploit this
	 vulnerability to execute arbitrary shell commands on the remote
	 server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7692</url>
 </references>
 <dates>
 <discovery>2017-04-19</discovery>
 <entry>2017-08-22</entry>
 </dates>
 </vuln>

<vuln vid="6876b163-8708-11e7-8568-e8e0b747a45a">
 <topic>pspp -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>pspp</name>
	<range><lt>1.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE Details reports:
	<blockquote cite="https://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-38732/year-2017/GNU-Pspp.html">
	 <ul>
	 <li>There is an Integer overflow in the hash_int function of the libpspp library
	 in GNU PSPP 0.10.5-pre2 (CVE-2017-10791).</li>
	 <li>There is a NULL Pointer Dereference in the function ll_insert() of the libpspp
	 library in GNU PSPP 0.10.5-pre2 (CVE-2017-10792).</li>
	 <li>There is an illegal address access in the function output_hex() in data/data-out.c
	 of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12958).</li>
	 <li>There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c
	 of the libpspp library in GNU PSPP 0.11.0 that will lead to a remote denial of service attack (CVE-2017-12959).</li>
	 <li>There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c
	 of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12960).</li>
	 <li>There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c
	 of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12961).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-10791</cvename>
 <cvename>CVE-2017-10792</cvename>
 <cvename>CVE-2017-12958</cvename>
 <cvename>CVE-2017-12959</cvename>
 <cvename>CVE-2017-12960</cvename>
 <cvename>CVE-2017-12961</cvename>
 <url>https://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-38732/year-2017/GNU-Pspp.html</url>
 </references>
 <dates>
 <discovery>2017-08-18</discovery>
 <entry>2017-08-22</entry>
 <modified>2017-08-30</modified>
 </dates>
 </vuln>

<vuln vid="473b6a9e-8493-11e7-b24b-6cf0497db129">
 <topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal8</name>
	<range><lt>8.3.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team:
	<blockquote cite="https://www.drupal.org/SA-CORE-2017-004">
	 CVE-2017-6923: Views - Access Bypass - Moderately Critical
	 CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica
	 CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-6923</cvename>
 <cvename>CVE-2017-6924</cvename>
 <cvename>CVE-2017-6925</cvename>
 </references>
 <dates>
 <discovery>2017-08-16</discovery>
 <entry>2017-08-19</entry>
 </dates>
 </vuln>

<vuln vid="8e7bbddd-8338-11e7-867f-b499baebfeaf">
 <topic>libsoup -- stack based buffer overflow</topic>
 <affects>
 <package>
	<name>libsoup</name>
	<range><lt>2.52.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tobias Mueller reports:
	<blockquote cite="http://seclists.org/oss-sec/2017/q3/304">
	 libsoup is susceptible to a stack based buffer overflow
	 attack when using chunked encoding. Regardless of libsoup
	 being used as a server or client.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2017/q3/304</url>
 <cvename>CVE-2017-2885</cvename>
 </references>
 <dates>
 <discovery>2017-08-17</discovery>
 <entry>2017-08-17</entry>
 <modified>2017-08-20</modified>
 </dates>
 </vuln>

<vuln vid="5df8bd95-8290-11e7-93af-005056925db4">
 <topic>Zabbix -- Remote code execution</topic>
 <affects>
 <package>
	<name>zabbix2-server</name>
	<name>zabbix2-proxy</name>
	<range><le>2.0.20</le></range>
 </package>
 <package>
	<name>zabbix22-server</name>
	<name>zabbix22-proxy</name>
	<range><lt>2.2.19</lt></range>
 </package>
 <package>
	<name>zabbix3-server</name>
	<name>zabbix3-proxy</name>
	<range><lt>3.0.10</lt></range>
 </package>
 <package>
	<name>zabbix32-server</name>
	<name>zabbix32-proxy</name>
	<range><lt>3.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2824">
	 An exploitable code execution vulnerability exists in the trapper command
	 functionality of Zabbix Server 2.4.X. A specially crafted set of packets
	 can cause a command injection resulting in remote code execution. An attacker
	 can make requests from an active Zabbix Proxy to trigger this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-2824</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2824</url>
 <url>https://support.zabbix.com/browse/ZBX-12349</url>
 </references>
 <dates>
 <discovery>2017-07-05</discovery>
 <entry>2017-08-16</entry>
 </dates>
 </vuln>

<vuln vid="c9460380-81e3-11e7-93af-005056925db4">
 <topic>Supervisord -- An authenticated client can run arbitrary shell commands via malicious XML-RPC requests</topic>
 <affects>
 <package>
	<name>py27-supervisor</name>
	<range><lt>3.3.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mnaberez reports:
	<blockquote cite="https://github.com/Supervisor/supervisor/issues/964#issuecomment-317551606">
	 supervisord can be configured to run an HTTP server on a TCP socket and/or a Unix domain socket.
	 The HTTP server is how supervisorctl communicates with supervisord. If an HTTP server has been
	 enabled, it will always serve both HTML pages and an XML-RPC interface. A vulnerability has been
	 found where an authenticated client can send a malicious XML-RPC request to supervisord that
	 will run arbitrary shell commands on the server. The commands will be run as the same user as
	 supervisord. Depending on how supervisord has been configured, this may be root.
	 This vulnerability can only be exploited by an authenticated client or if supervisord has been
	 configured to run an HTTP server without authentication. If authentication has not been enabled,
	 supervisord will log a message at the critical level every time it starts.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://supervisord.org/changes.html</url>
 <url>https://github.com/Supervisor/supervisor/issues/964#issuecomment-317551606</url>
 <cvename>CVE-2017-11610</cvename>
 </references>
 <dates>
 <discovery>2017-07-24</discovery>
 <entry>2017-08-15</entry>
 </dates>
 </vuln>

<vuln vid="79bbec7e-8141-11e7-b5af-a4badb2f4699">
 <topic>FreeRadius -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>freeradius3</name>
	<range><lt>3.0.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Guido Vranken reports:
	<blockquote cite="http://freeradius.org/security/fuzzer-2017.html">
	 Multiple vulnerabilities found via fuzzing:
	 FR-GV-201 (v2,v3) Read / write overflow in make_secret()
	 FR-GV-202 (v2) Write overflow in rad_coalesce()
	 FR-GV-203 (v2) DHCP - Memory leak in decode_tlv()
	 FR-GV-204 (v2) DHCP - Memory leak in fr_dhcp_decode()
	 FR-GV-205 (v2) DHCP - Buffer over-read in fr_dhcp_decode_options()
	 FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
	 FR-GV-207 (v2) Zero-length malloc in data2vp()
	 FR-GV-301 (v3) Write overflow in data2vp_wimax()
	 FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
	 FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
	 FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
	 FR-GV-305 (v3) Decode 'signed' attributes correctly
	 FR-AD-001 (v2,v3) Use strncmp() instead of memcmp() for string data
	 FR-AD-002 (v3) String lifetime issues in rlm_python
	 FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://freeradius.org/security/fuzzer-2017.html</url>
 </references>
 <dates>
 <discovery>2017-06-17</discovery>
 <entry>2017-08-14</entry>
 </dates>
 </vuln>

<vuln vid="1d33cdee-7f6b-11e7-a9b5-3debb10a6871">
 <topic>Mercurial -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mercurial</name>
	<range><lt>4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mercurial Release Notes:
	<blockquote cite="https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29">
	 CVE-2017-1000115
	 Mercurial's symlink auditing was incomplete prior to 4.3, and could be
	 abused to write to files outside the repository.
	 CVE-2017-1000116
	 Mercurial was not sanitizing hostnames passed to ssh, allowing shell
	 injection attacks on clients by specifying a hostname starting with
	 -oProxyCommand. This is also present in Git (CVE-2017-1000117) and
	 Subversion (CVE-2017-9800), so please patch those tools as well if you
	 have them installed.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29</url>
 <cvename>CVE-2017-1000115</cvename>
 <cvename>CVE-2017-1000116</cvename>
 </references>
 <dates>
 <discovery>2017-08-10</discovery>
 <entry>2017-08-12</entry>
 </dates>
 </vuln>

<vuln vid="6e80bd9b-7e9b-11e7-abfe-90e2baa3bafc">
 <topic>subversion -- Arbitrary code execution vulnerability</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><ge>1.9.0</ge><le>1.9.6</le></range>
 </package>
 <package>
	<name>subversion18</name>
	<range><ge>1.0.0</ge><le>1.8.18</le></range>
 </package>
 <package>
	<name>subversion-static</name>
	<range><ge>1.0.0</ge><le>1.8.18</le></range>
	<range><ge>1.9.0</ge><le>1.9.6</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	subversion team reports:
	<blockquote cite="http://subversion.apache.org/security/CVE-2017-9800-advisory.txt">
	 A Subversion client sometimes connects to URLs provided by the repository.
	 This happens in two primary cases: during 'checkout', 'export', 'update', and
	 'switch', when the tree being downloaded contains svn:externals properties;
	 and when using 'svnsync sync' with one URL argument.
	 A maliciously constructed svn+ssh:// URL would cause Subversion clients to
	 run an arbitrary shell command. Such a URL could be generated by a malicious
	 server, by a malicious user committing to a honest server (to attack another
	 user of that server's repositories), or by a proxy server.
	 The vulnerability affects all clients, including those that use file://,
	 http://, and plain (untunneled) svn://.
	 An exploit has been tested.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://subversion.apache.org/security/CVE-2017-9800-advisory.txt</url>
 </references>
 <dates>
 <discovery>2017-08-10</discovery>
 <entry>2017-08-11</entry>
 </dates>
 </vuln>

<vuln vid="abcc5ad3-7e6a-11e7-93f7-d43d7e971a1b">
 <topic>GitLab -- two vulnerabilities</topic>
 <affects>
 <package>
	 <name>gitlab</name>
 <range><ge>7.9.0</ge><le>8.17.8</le></range>
	<range><ge>9.0.0</ge><le>9.0.12</le></range>
	<range><ge>9.1.0</ge><le>9.1.9</le></range>
	<range><ge>9.2.0</ge><le>9.2.9</le></range>
	<range><ge>9.3.0</ge><le>9.3.9</le></range>
 <range><ge>9.4.0</ge><le>9.4.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab reports:
	<blockquote cite="https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/">
 <h1>Remote Command Execution in git client</h1>
	 An external code review performed by Recurity-Labs identified a remote
	 command execution vulnerability in git that could be exploited via the "Repo
	 by URL" import option in GitLab. The command line git client was not
	 properly escaping command line arguments in URLs using the SSH protocol
	 before invoking the SSH client. A specially crafted URL could be used to
	 execute arbitrary shell commands on the GitLab server. 
 To fully patch this vulnerability two fixes were needed. The Omnibus
 versions of GitLab contain a patched git client. For source users who may
 still be running an older version of git, GitLab now also blocks import URLs
 containing invalid host and usernames. 
 This issue has been assigned CVE-2017-12426.
 <h1>Improper sanitization of GitLab export files on import</h1>
 GitLab versions 8.13.3, 8.12.8, 8.11.10, 8.10.13, and 8.9.12 contained a
 patch for a critical directory traversal vulnerability in the GitLab export
 feature that could be exploited by including symlinks in the export file and
 then re-importing it to a GitLab instance. This vulnerability was patched by
 checking for and removing symlinks in these files on import. 
 Recurity-Labs also determined that this fix did not properly remove symlinks for
 hidden files. Though not as dangerous as the original vulnerability hidden file
 symlinks could still be used to steal copies of git repositories belonging to
 other users if the path to the git repository was known by the attacker. An
 updated fix has been included in these releases that properly removes all
 symlinks. 
 This import option was not made available to non-admin users until GitLab
 8.13.0.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/</url>
 <cvename>CVE-2017-12426</cvename>
 </references>
 <dates>
 <discovery>2017-08-10</discovery>
 <entry>2017-08-11</entry>
 </dates>
 </vuln>

<vuln vid="982872f1-7dd3-11e7-9736-6cc21735f730">
 <topic>PostgreSQL vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.22</lt></range>
 </package>
 <package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.18</lt></range>
 </package>
 <package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.13</lt></range>
 </package>
 <package>
	<name>postgresql95-server</name>
	<range><ge>9.5.0</ge><lt>9.5.8</lt></range>
 </package>
 <package>
	<name>postgresql96-server</name>
	<range><ge>9.6.0</ge><lt>9.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote cite="https://www.postgresql.org/about/news/1772/">
	 <ul>
	 <li>CVE-2017-7546: Empty password accepted in some authentication
	 methods</li>
	 <li>CVE-2017-7547: The "pg_user_mappings" catalog view discloses passwords
	 to users lacking server privileges</li>
	 <li>CVE-2017-7548: lo_put() function ignores ACLs</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-7546</cvename>
 <cvename>CVE-2017-7547</cvename>
 <cvename>CVE-2017-7548</cvename>
 </references>
 <dates>
 <discovery>2017-08-10</discovery>
 <entry>2017-08-10</entry>
 </dates>
 </vuln>

<vuln vid="7e3d3e9a-7d8f-11e7-a02b-d43d7ef03aa6">
 <topic>Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>26.0.0.151</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-23.html">
	 <ul>
	 <li>These updates resolve security bypass vulnerability that
	 could lead to information disclosure (CVE-2017-3085).</li>
	 <li>These updates resolve type confusion vulnerability that
	 could lead to remote code execution (CVE-2017-3106).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-3085</cvename>
 <cvename>CVE-2017-3106</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb17-23.html</url>
 </references>
 <dates>
 <discovery>2017-08-08</discovery>
 <entry>2017-08-10</entry>
 </dates>
 </vuln>

<vuln vid="69cfa386-7cd0-11e7-867f-b499baebfeaf">
 <topic>cURL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>7.55.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports:
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	 <ul>
	 <li>FILE buffer read out of bounds</li>
	 <li>TFTP sends more than buffer size</li>
	 <li>URL globbing out of bounds read</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/security.html</url>
 <cvename>CVE-2017-1000099</cvename>
 <cvename>CVE-2017-1000100</cvename>
 <cvename>CVE-2017-1000101</cvename>
 </references>
 <dates>
 <discovery>2017-08-09</discovery>
 <entry>2017-08-09</entry>
 </dates>
 </vuln>

<vuln vid="c1265e85-7c95-11e7-93af-005056925db4">
 <topic>Axis2 -- Security vulnerability on dependency Apache Commons FileUpload</topic>
 <affects>
 <package>
	<name>axis2</name>
	<range><lt>1.7.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache Axis2 reports:
	<blockquote cite="http://axis.apache.org/axis2/java/core/release-notes/1.7.6.html">
	 The commons-fileupload dependency has been updated to a version that fixes
	 CVE-2016-1000031 (AXIS2-5853).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://axis.apache.org/axis2/java/core/release-notes/1.7.6.html</url>
 <url>https://issues.apache.org/jira/browse/AXIS2-5853</url>
 <url>https://issues.apache.org/jira/browse/FILEUPLOAD-279</url>
 <cvename>CVE-2016-1000031</cvename>
 </references>
 <dates>
 <discovery>2016-11-14</discovery>
 <entry>2017-08-09</entry>
 </dates>
 </vuln>

<vuln vid="555b244e-6b20-4546-851f-d8eb7d6c1ffa">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>55.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>52.3.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>52.3.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-7753</cvename>
 <cvename>CVE-2017-7779</cvename>
 <cvename>CVE-2017-7780</cvename>
 <cvename>CVE-2017-7781</cvename>
 <cvename>CVE-2017-7782</cvename>
 <cvename>CVE-2017-7783</cvename>
 <cvename>CVE-2017-7784</cvename>
 <cvename>CVE-2017-7785</cvename>
 <cvename>CVE-2017-7786</cvename>
 <cvename>CVE-2017-7787</cvename>
 <cvename>CVE-2017-7788</cvename>
 <cvename>CVE-2017-7789</cvename>
 <cvename>CVE-2017-7790</cvename>
 <cvename>CVE-2017-7791</cvename>
 <cvename>CVE-2017-7792</cvename>
 <cvename>CVE-2017-7794</cvename>
 <cvename>CVE-2017-7796</cvename>
 <cvename>CVE-2017-7797</cvename>
 <cvename>CVE-2017-7798</cvename>
 <cvename>CVE-2017-7799</cvename>
 <cvename>CVE-2017-7800</cvename>
 <cvename>CVE-2017-7801</cvename>
 <cvename>CVE-2017-7802</cvename>
 <cvename>CVE-2017-7803</cvename>
 <cvename>CVE-2017-7804</cvename>
 <cvename>CVE-2017-7806</cvename>
 <cvename>CVE-2017-7807</cvename>
 <cvename>CVE-2017-7808</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/</url>
 </references>
 <dates>
 <discovery>2017-08-08</discovery>
 <entry>2017-08-08</entry>
 </dates>
 </vuln>

<vuln vid="9245681c-7c3c-11e7-b5af-a4badb2f4699">
 <topic>sqlite3 -- heap-buffer overflow</topic>
 <affects>
 <package>
	<name>sqlite3</name>
	<range><lt>3.20.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google reports:
	<blockquote cite="https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937">
	 A heap-buffer overflow (sometimes a crash) can arise when
	 running a SQL request on malformed sqlite3 databases.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937</url>
 <cvename>CVE-2017-10989</cvename>
 </references>
 <dates>
 <discovery>2017-08-08</discovery>
 <entry>2017-08-08</entry>
 <modified>2017-09-19</modified>
 </dates>
 </vuln>

<vuln vid="88a77ad8-77b1-11e7-b5af-a4badb2f4699">
 <topic>Varnish -- Denial of service vulnerability</topic>
 <affects>
 <package>
	<name>varnish4</name>
	<range><ge>4.0.1</ge><lt>4.0.5</lt></range>
	<range><ge>4.1.0</ge><lt>4.1.8</lt></range>
 </package>
 <package>
	<name>varnish5</name>
	<range><lt>5.0.1</lt></range>
	<range><ge>5.1.0</ge><lt>5.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phk reports:
	<blockquote cite="https://varnish-cache.org/security/VSV00001.html">
	 A wrong if statement in the varnishd source code means that
	 particular invalid requests from the client can trigger an assert.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://varnish-cache.org/security/VSV00001.html</url>
 </references>
 <dates>
 <discovery>2017-08-02</discovery>
 <entry>2017-08-02</entry>
 </dates>
 </vuln>

<vuln vid="7d138476-7710-11e7-88a1-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-pulse</name>
	<range><lt>60.0.3112.78</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html">
	 40 security fixes in this release
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5091</cvename>
 <cvename>CVE-2017-5092</cvename>
 <cvename>CVE-2017-5093</cvename>
 <cvename>CVE-2017-5094</cvename>
 <cvename>CVE-2017-5095</cvename>
 <cvename>CVE-2017-5096</cvename>
 <cvename>CVE-2017-5097</cvename>
 <cvename>CVE-2017-5098</cvename>
 <cvename>CVE-2017-5099</cvename>
 <cvename>CVE-2017-5100</cvename>
 <cvename>CVE-2017-5101</cvename>
 <cvename>CVE-2017-5102</cvename>
 <cvename>CVE-2017-5103</cvename>
 <cvename>CVE-2017-5104</cvename>
 <cvename>CVE-2017-7000</cvename>
 <cvename>CVE-2017-5105</cvename>
 <cvename>CVE-2017-5106</cvename>
 <cvename>CVE-2017-5107</cvename>
 <cvename>CVE-2017-5108</cvename>
 <cvename>CVE-2017-5109</cvename>
 <cvename>CVE-2017-5110</cvename>
 <url>https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2017-07-25</discovery>
 <entry>2017-08-01</entry>
 </dates>
 </vuln>

<vuln vid="f86d0e5d-7467-11e7-93af-005056925db4">
 <topic>Cacti -- Cross-site scripting (XSS) vulnerability in auth_profile.php</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><eq>1.1.13</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	kimiizhang reports:
	<blockquote cite="https://github.com/Cacti/cacti/issues/867">
	 Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti
	 1.1.13 allows remote authenticated users to inject arbitrary web script
	 or HTML via specially crafted HTTP Referer headers.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/Cacti/cacti/issues/867</url>
 <url>https://www.cacti.net/release_notes.php?version=1.1.14</url>
 <cvename>CVE-2017-11691</cvename>
 </references>
 <dates>
 <discovery>2017-07-20</discovery>
 <entry>2017-07-29</entry>
 </dates>
 </vuln>

<vuln vid="770d7e91-72af-11e7-998a-08606e47f965">
 <topic>proftpd -- user chroot escape vulnerability</topic>
 <affects>
 <package>
	<name>proftpd</name>
	<range><lt>1.3.5e</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7418">
	 ProFTPD ... controls whether the home directory of a user could
	 contain a symbolic link through the AllowChrootSymlinks
	 configuration option, but checks only the last path component when
	 enforcing AllowChrootSymlinks. Attackers with local access could
	 bypass the AllowChrootSymlinks control by replacing a path
	 component (other than the last one) with a symbolic link.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://bugs.proftpd.org/show_bug.cgi?id=4295</url>
 <cvename>CVE-2017-7418</cvename>
 </references>
 <dates>
 <discovery>2017-03-06</discovery>
 <entry>2017-07-27</entry>
 </dates>
 </vuln>

<vuln vid="76d80b33-7211-11e7-998a-08606e47f965">
 <topic>jabberd -- authentication bypass vulnerability</topic>
 <affects>
 <package>
	<name>jabberd</name>
	<range><lt>2.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/99511/discuss">
	 JabberD is prone to an authentication-bypass vulnerability.
	 An attacker can exploit this issue to bypass the authentication
	 mechanism and perform unauthorized actions. This may lead to
	 further attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867032</url>
 <url>http://www.securityfocus.com/bid/99511</url>
 <cvename>CVE-2017-10807</cvename>
 </references>
 <dates>
 <discovery>2017-07-03</discovery>
 <entry>2017-07-26</entry>
 </dates>
 </vuln>

<vuln vid="0f66b901-715c-11e7-ad1f-bcaec565249c">
 <topic>webkit2-gtk3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>webkit2-gtk3</name>
	<range><lt>2.16.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Webkit gtk team reports:
	<blockquote cite="https://webkitgtk.org/security/WSA-2017-0006.html">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://webkitgtk.org/security/WSA-2017-0006.html</url>
 <cvename>CVE-2017-7006</cvename>
 <cvename>CVE-2017-7011</cvename>
 <cvename>CVE-2017-7012</cvename>
 <cvename>CVE-2017-7018</cvename>
 <cvename>CVE-2017-7019</cvename>
 <cvename>CVE-2017-7020</cvename>
 <cvename>CVE-2017-7030</cvename>
 <cvename>CVE-2017-7034</cvename>
 <cvename>CVE-2017-7037</cvename>
 <cvename>CVE-2017-7038</cvename>
 <cvename>CVE-2017-7039</cvename>
 <cvename>CVE-2017-7040</cvename>
 <cvename>CVE-2017-7041</cvename>
 <cvename>CVE-2017-7042</cvename>
 <cvename>CVE-2017-7043</cvename>
 <cvename>CVE-2017-7046</cvename>
 <cvename>CVE-2017-7048</cvename>
 <cvename>CVE-2017-7049</cvename>
 <cvename>CVE-2017-7052</cvename>
 <cvename>CVE-2017-7055</cvename>
 <cvename>CVE-2017-7056</cvename>
 <cvename>CVE-2017-7059</cvename>
 <cvename>CVE-2017-7061</cvename>
 <cvename>CVE-2017-7064</cvename>
 </references>
 <dates>
 <discovery>2017-07-24</discovery>
 <entry>2017-07-25</entry>
 <modified>2018-03-28</modified>
 </dates>
 </vuln>

<vuln vid="8745c67e-7dd1-4165-96e2-fcf9da2dc5b5">
 <topic>gsoap -- remote code execution via via overflow</topic>
 <affects>
 <package>
	<name>gsoap</name>
	<range><lt>2.8.47</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Senrio reports:
	<blockquote cite="http://www.securityfocus.com/bid/99868/discuss">
	 Genivia gSOAP is prone to a stack-based buffer-overflow
	 vulnerability because it fails to properly bounds check user-supplied
	 data before copying it into an insufficiently sized buffer.
	 A remote attacker may exploit this issue to execute arbitrary code
	 in the context of the affected device. Failed attempts will likely
	 cause a denial-of-service condition.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/bid/99868/discuss</url>
 <url>http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions</url>
 <url>http://blog.senr.io/devilsivy.html</url>
 <url>https://www.genivia.com/advisory.html#Security_advisory:_CVE-2017-9765_bug_in_certain_versions_of_gSOAP_2.7_up_to_2.8.47_%28June_21,_2017%29</url>
 <url>https://www.genivia.com/changelog.html#Version_2.8.48_upd_%2806/21/2017%29</url>
 <cvename>CVE-2017-9765</cvename>
 </references>
 <dates>
 <discovery>2017-07-18</discovery>
 <entry>2017-07-25</entry>
 </dates>
 </vuln>

<vuln vid="92f4191a-6d25-11e7-93f7-d43d7e971a1b">
 <topic>GitLab -- Various security issues</topic>
 <affects>
 <package>
	<name>gitlab</name>
	<range><ge>8.0.0</ge><le>8.17.6</le></range>
	<range><ge>9.0.0</ge><le>9.0.10</le></range>
	<range><ge>9.1.0</ge><le>9.1.7</le></range>
	<range><ge>9.2.0</ge><le>9.2.7</le></range>
	<range><ge>9.3.0</ge><le>9.3.7</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab reports:
	<blockquote cite="https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/</url>
 <cvename>CVE-2017-11438</cvename>
 </references>
 <dates>
 <discovery>2017-07-20</discovery>
 <entry>2017-07-20</entry>
 <modified>2017-08-15</modified>
 </dates>
 </vuln>

<vuln vid="cda2f3c2-6c8b-11e7-867f-b499baebfeaf">
 <topic>MySQL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb55-server</name>
	<range><lt>5.5.57</lt></range>
 </package>
 <package>
	<name>mariadb100-server</name>
	<range><lt>10.0.32</lt></range>
 </package>
 <package>
	<name>mariadb101-server</name>
	<range><lt>10.1.26</lt></range>
 </package>
 <package>
	<name>mariadb102-server</name>
	<range><lt>10.2.6</lt></range>
 </package>
 <package>
	<name>mysql55-server</name>
	<range><lt>5.5.57</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.37</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.19</lt></range>
 </package>
 <package>
	<name>percona55-server</name>
	<range><lt>5.5.57</lt></range>
 </package>
 <package>
	<name>percona56-server</name>
	<range><lt>5.6.37</lt></range>
 </package>
 <package>
	<name>percona57-server</name>
	<range><lt>5.7.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixMSQL">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixMSQL</url>
 <cvename>CVE-2017-3529</cvename>
 <cvename>CVE-2017-3633</cvename>
 <cvename>CVE-2017-3634</cvename>
 <cvename>CVE-2017-3635</cvename>
 <cvename>CVE-2017-3636</cvename>
 <cvename>CVE-2017-3637</cvename>
 <cvename>CVE-2017-3638</cvename>
 <cvename>CVE-2017-3639</cvename>
 <cvename>CVE-2017-3640</cvename>
 <cvename>CVE-2017-3641</cvename>
 <cvename>CVE-2017-3642</cvename>
 <cvename>CVE-2017-3643</cvename>
 <cvename>CVE-2017-3644</cvename>
 <cvename>CVE-2017-3645</cvename>
 <cvename>CVE-2017-3646</cvename>
 <cvename>CVE-2017-3647</cvename>
 <cvename>CVE-2017-3648</cvename>
 <cvename>CVE-2017-3649</cvename>
 <cvename>CVE-2017-3650</cvename>
 <cvename>CVE-2017-3651</cvename>
 <cvename>CVE-2017-3652</cvename>
 <cvename>CVE-2017-3653</cvename>
 </references>
 <dates>
 <discovery>2017-07-19</discovery>
 <entry>2017-07-19</entry>
 <modified>2017-08-12</modified>
 </dates>
 </vuln>

<vuln vid="08a2df48-6c6a-11e7-9b01-2047478f2f70">
 <topic>collectd5 -- Denial of service by sending a signed network packet to a server which is not set up to check signatures</topic>
 <affects>
 <package>
	<name>collectd5</name>
	<range><lt>5.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	marcinguy reports:
	<blockquote cite="https://github.com/collectd/collectd/issues/2174">
	 After sending this payload, collectd seems to be entering endless while()
	 loop in packet_parse consuming high CPU resources, possibly crash/gets killed after a while.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/collectd/collectd/issues/2174</url>
 <cvename>CVE-2017-7401</cvename>
 </references>
 <dates>
 <discovery>2017-02-13</discovery>
 <entry>2017-07-19</entry>
 </dates>
 </vuln>

<vuln vid="e6ccaf8a-6c63-11e7-9b01-2047478f2f70">
 <topic>strongswan -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>strongswan</name>
	<range><ge>4.4.0</ge><le>5.5.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	strongSwan security team reports:
	<blockquote cite="https://www.strongswan.org/blog/2017/05/30/strongswan-5.5.3-released.html">
	 <ul>
	 <li>RSA public keys passed to the gmp plugin aren't validated sufficiently
		 before attempting signature verification, so that invalid input might
	 lead to a floating point exception. [CVE-2017-9022]</li>
	 <li>ASN.1 CHOICE types are not correctly handled by the ASN.1 parser when
	 parsing X.509 certificates with extensions that use such types. This
	 could lead to infinite looping of the thread parsing a specifically crafted certificate.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9022).html</url>
 <cvename>CVE-2017-9022</cvename>
 <url>https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9023).html</url>
 <cvename>CVE-2017-9023</cvename>
 </references>
 <dates>
 <discovery>2017-05-30</discovery>
 <entry>2017-07-19</entry>
 </dates>
 </vuln>

<vuln vid="dc3c66e8-6a18-11e7-93af-005056925db4">
 <topic>Cacti -- Cross-site scripting (XSS) vulnerability in link.php</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><ge>1.0.0</ge><lt>1.1.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	kimiizhang reports:
	<blockquote cite="https://github.com/Cacti/cacti/issues/838">
	 Cross-site scripting (XSS) vulnerability in link.php in Cacti 
	 1.1.12 allows remote anonymous users to inject arbitrary web 
	 script or HTML via the id parameter.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/Cacti/cacti/issues/838</url>
 <url>https://www.cacti.net/release_notes.php?version=1.1.13</url>
 <cvename>CVE-2017-10970</cvename>
 </references>
 <dates>
 <discovery>2017-07-05</discovery>
 <entry>2017-07-17</entry>
 </dates>
 </vuln>

<vuln vid="457ce015-67fa-11e7-867f-b499baebfeaf">
 <topic>Apache httpd -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
	 important: Read after free in mod_http2 (CVE-2017-9789) 
	 When under stress, closing many connections, the HTTP/2 handling
	 code would sometimes access memory after it has been freed,
	 resulting in potentially erratic behaviour.
	 important: Uninitialized memory reflection in mod_auth_digest
	 (CVE-2017-9788) The value placeholder in [Proxy-]Authorization
	 headers of type 'Digest' was not initialized or reset before or
	 between successive key=value assignments. by mod_auth_digest. 
	 Providing an initial key with no '=' assignment could reflect
	 the stale value of uninitialized pool memory used by the prior
	 request, leading to leakage of potentially confidential
	 information, and a segfault.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
 <cvename>CVE-2017-9789</cvename>
 <cvename>CVE-2017-9788</cvename>
 </references>
 <dates>
 <discovery>2017-07-11</discovery>
 <entry>2017-07-13</entry>
 </dates>
 </vuln>

<vuln vid="a03e043a-67f1-11e7-beff-6451062f0f7a">
 <topic>Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>26.0.0.137</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-21.html">
	 <ul>
	 <li>These updates resolve security bypass vulnerability that
	 could lead to information disclosure (CVE-2017-3080).</li>
	 <li>These updates resolve memory corruption vulnerability that
	 could lead to remote code execution (CVE-2017-3099).</li>
	 <li>These updates resolve memory corruption vulnerability that
	 could lead to memory address disclosure (CVE-2017-3100).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-3080</cvename>
 <cvename>CVE-2017-3099</cvename>
 <cvename>CVE-2017-3100</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb17-21.html</url>
 </references>
 <dates>
 <discovery>2017-07-11</discovery>
 <entry>2017-07-13</entry>
 </dates>
 </vuln>

<vuln vid="85851e4f-67d9-11e7-bc37-00505689d4ae">
 <topic>samba -- Orpheus Lyre mutual authentication validation bypass</topic>
 <affects>
 <package>
	<name>samba42</name>
	<range><lt>4.2.15</lt></range>
 </package>
 <package>
	<name>samba43</name>
	<range><lt>4.3.14</lt></range>
 </package>
 <package>
	<name>samba44</name>
	<range><lt>4.4.15</lt></range>
 </package>
 <package>
	<name>samba45</name>
	<range><lt>4.5.12</lt></range>
 </package>
 <package>
	<name>samba46</name>
	<range><lt>4.6.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The samba project reports:
	<blockquote cite="https://www.samba.org/samba/security/CVE-2017-11103.html">
	 A MITM attacker may impersonate a trusted server and thus gain elevated access to the domain by
	 returning malicious replication or authorization data.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/security/CVE-2017-11103.html</url>
 <cvename>CVE-2017-11103</cvename>
 </references>
 <dates>
 <discovery>2017-07-12</discovery>
 <entry>2017-07-12</entry>
 </dates>
 </vuln>

<vuln vid="3eff66c5-66c9-11e7-aa1d-3d2e663cef42">
 <topic>node.js -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>node</name>
	<range><lt>8.1.4</lt></range>
 </package>
 <package>
	<name>node4</name>
	<range><lt>4.8.4</lt></range>
 </package>
 <package>
	<name>node6</name>
	<range><lt>6.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Updates are now available for all active Node.js release lines as
	 well as the 7.x line. These include the fix for the high severity
	 vulnerability identified in the initial announcement, one additional
	 lower priority Node.js vulnerability in the 4.x release line, as well
	 as some lower priority fixes for Node.js dependencies across the
	 current release lines.
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/">
	 <h2>Constant Hashtable Seeds (CVE pending)</h2>
	 Node.js was susceptible to hash flooding remote DoS attacks as the
	 HashTable seed was constant across a given released version of
	 Node.js. This was a result of building with V8 snapshots enabled by
	 default which caused the initially randomized seed to be overwritten
	 on startup. Thanks to Jann Horn of Google Project Zero for reporting
	 this vulnerability.
	 This is a high severity vulnerability and applies to all active
	 release lines (4.x, 6.x, 8.x) as well as the 7.x line.
	 <h2>http.get with numeric authorization options creates uninitialized
	 buffers</h2>
	 Application code that allows the auth field of the options object
	 used with http.get() to be set to a number can result in an
	 uninitialized buffer being created/used as the authentication
	 string.
	 This is a low severity defect and only applies to the 4.x release
	 line.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/</url>
 </references>
 <dates>
 <discovery>2017-06-27</discovery>
 <entry>2017-07-12</entry>
 </dates>
 </vuln>

<vuln vid="b28adc5b-6693-11e7-ad43-f0def16c5c1b">
 <topic>nginx -- a specially crafted request might result in an integer overflow</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><ge>0.5.6</ge><lt>1.12.1,2</lt></range>
 </package>
 <package>
	<name>nginx-devel</name>
	<range><ge>0.5.6</ge><lt>1.13.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Maxim Dounin reports:
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html">
	 A security issue was identified in nginx range filter. A specially
	 crafted request might result in an integer overflow and incorrect
	 processing of ranges, potentially resulting in sensitive information
	 leak (CVE-2017-7529).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html</url>
 <cvename>CVE-2017-7529</cvename>
 </references>
 <dates>
 <discovery>2017-07-11</discovery>
 <entry>2017-07-11</entry>
 </dates>
 </vuln>

<vuln vid="aaedf196-6436-11e7-8b49-002590263bf5">
 <topic>codeigniter -- input validation bypass</topic>
 <affects>
 <package>
	<name>codeigniter</name>
	<range><lt>3.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The CodeIgniter changelog reports:
	<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
	 Form Validation Library rule valid_email could be bypassed if
	 idn_to_ascii() is available.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.codeigniter.com/user_guide/changelog.html</url>
 </references>
 <dates>
 <discovery>2017-06-19</discovery>
 <entry>2017-07-08</entry>
 </dates>
 </vuln>

<vuln vid="31001c6b-63e7-11e7-85aa-a4badb2f4699">
 <topic>irssi -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>irssi</name>
	<range><lt>1.0.4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	irssi reports:
	<blockquote cite="https://irssi.org/security/irssi_sa_2017_07.txt">
	 When receiving messages with invalid time stamps, Irssi
	 would try to dereference a NULL pointer.
	 While updating the internal nick list, Irssi may
	 incorrectly use the GHashTable interface and free the nick while
	 updating it. This will then result in use-after-free conditions on each
	 access of the hash table.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://irssi.org/security/irssi_sa_2017_07.txt</url>
 <cvename>CVE-2017-10965</cvename>
 <cvename>CVE-2017-10966</cvename>
 <freebsdpr>ports/220544</freebsdpr>
 </references>
 <dates>
 <discovery>2017-07-05</discovery>
 <entry>2017-07-08</entry>
 </dates>
 </vuln>

<vuln vid="b396cf6c-62e6-11e7-9def-b499baebfeaf">
 <topic>oniguruma -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libevhtp</name>
	<range><lt>1.2.14</lt></range>
 </package>
 <package>
	<name>oniguruma4</name>
	<range><lt>4.7.2</lt></range>
 </package>
 <package>
	<name>oniguruma5</name>
	<range><lt>5.9.7</lt></range>
 </package>
 <package>
	<name>oniguruma6</name>
	<range><lt>6.4.0</lt></range>
 </package>
 <package>
	<name>php56-mbstring</name>
	<range><lt>5.6.31</lt></range>
 </package>
 <package>
	<name>php70-mbstring</name>
	<range><lt>7.0.21</lt></range>
 </package>
 <package>
	<name>php71-mbstring</name>
	<range><lt>7.1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	the PHP project reports:
	<blockquote cite="http://php.net/ChangeLog-7.php">
	 <ul>
	 <li>A stack out-of-bounds read occurs in match_at() during regular
	 expression searching. A logical error involving order of validation
	 and access in match_at() could result in an out-of-bounds read from
	 a stack buffer (CVE-2017-9224).</li>
	 <li>A heap out-of-bounds write or read occurs in next_state_val()
	 during regular expression compilation. Octal numbers larger than 0xff
	 are not handled correctly in fetch_token() and fetch_token_in_cc().
	 A malformed regular expression containing an octal number in the form
	 of '\700' would produce an invalid code point value larger than 0xff
	 in next_state_val(), resulting in an out-of-bounds write memory
	 corruption (CVE-2017-9226).</li>
	 <li>A stack out-of-bounds read occurs in mbc_enc_len() during regular
	 expression searching. Invalid handling of reg-&gt;dmin in
	 forward_search_range() could result in an invalid pointer dereference,
	 as an out-of-bounds read from a stack buffer (CVE-2017-9227).</li>
	 <li>A heap out-of-bounds write occurs in bitset_set_range() during
	 regular expression compilation due to an uninitialized variable from
	 an incorrect state transition. An incorrect state transition in
	 parse_char_class() could create an execution path that leaves a
	 critical local variable uninitialized until it's used as an index,
	 resulting in an out-of-bounds write memory corruption (CVE-2017-9228).</li>
	 <li>A SIGSEGV occurs in left_adjust_char_head() during regular expression
	 compilation. Invalid handling of reg-&gt;dmax in forward_search_range() could
	 result in an invalid pointer dereference, normally as an immediate
	 denial-of-service condition (CVE-2017-9228).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://php.net/ChangeLog-7.php</url>
 <cvename>CVE-2017-9224</cvename>
 <cvename>CVE-2017-9226</cvename>
 <cvename>CVE-2017-9227</cvename>
 <cvename>CVE-2017-9228</cvename>
 <cvename>CVE-2017-9228</cvename>
 </references>
 <dates>
 <discovery>2017-07-06</discovery>
 <entry>2017-07-07</entry>
 <modified>2018-01-04</modified>
 </dates>
 </vuln>

<vuln vid="4fc2df49-6279-11e7-be0f-6cf0497db129">
 <topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.56</lt></range>
 </package>
 <package>
	<name>drupal8</name>
	<range><lt>8.3.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team Reports:
	<blockquote cite="https://www.drupal.org/SA-CORE-2017-003">
	 CVE-2017-6920: PECL YAML parser unsafe object handling.
	 CVE-2017-6921: File REST resource does not properly validate
	 CVE-2017-6922: Files uploaded by anonymous users into a private
	 file system can be accessed by other anonymous users.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-6920</cvename>
 <cvename>CVE-2017-6921</cvename>
 <cvename>CVE-2017-6922</cvename>
 </references>
 <dates>
 <discovery>2017-06-21</discovery>
 <entry>2017-07-06</entry>
 </dates>
 </vuln>

<vuln vid="60931f98-55a7-11e7-8514-589cfc0654e1">
 <topic>Dropbear -- two vulnerabilities</topic>
 <affects>
 <package>
	<name>dropbear</name>
	<range><lt>2017.75</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matt Johnston reports:
	<blockquote cite="https://matt.ucc.asn.au/dropbear/CHANGES">
	 Fix double-free in server TCP listener cleanup A double-free in
	 the server could be triggered by an authenticated user if dropbear
	 is running with -a (Allow connections to forwarded ports from any
	 host) This could potentially allow arbitrary code execution as root
	 by an authenticated user.
	 Fix information disclosure with ~/.ssh/authorized_keys symlink.
	 Dropbear parsed authorized_keys as root, even if it were a symlink.
	 The fix is to switch to user permissions when opening authorized_keys.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://matt.ucc.asn.au/dropbear/CHANGES</url>
 <cvename>CVE-2017-9078</cvename>
 <cvename>CVE-2017-9079</cvename>
 </references>
 <dates>
 <discovery>2017-05-18</discovery>
 <entry>2017-07-03</entry>
 </dates>
 </vuln>

<vuln vid="6e4e35c3-5fd1-11e7-9def-b499baebfeaf">
 <topic>smarty3 -- shell injection in math</topic>
 <affects>
 <package>
	<name>smarty3</name>
	<range><lt>3.1.30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The smarty project reports:
	<blockquote cite="https://github.com/smarty-php/smarty/blob/v3.1.30/change_log.txt">
	 bugfix {math} shell injection vulnerability
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/smarty-php/smarty/blob/v3.1.30/change_log.txt</url>
 </references>
 <dates>
 <discovery>2016-07-19</discovery>
 <entry>2017-07-03</entry>
 </dates>
 </vuln>

<vuln vid="ed3bf433-5d92-11e7-aa14-e8e0b747a45a">
 <topic>libgcrypt -- side-channel attack on RSA secret keys</topic>
 <affects>
 <package>
	<name>libgcrypt</name>
	<range><lt>1.7.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GnuPG reports:
	<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html">
	 Mitigate a flush+reload side-channel attack on RSA secret keys dubbed "Sliding right into disaster".
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-7526</cvename>
 <url>https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html</url>
 </references>
 <dates>
 <discovery>2017-06-29</discovery>
 <entry>2017-06-30</entry>
 </dates>
 </vuln>

<vuln vid="85ebfa0c-5d8d-11e7-93f7-d43d7e971a1b">
 <topic>GitLab -- Various security issues</topic>
 <affects>
 <package>
	<name>gitlab</name>
	<range><ge>4.0.0</ge><le>9.0.9</le></range>
	<range><ge>9.1.0</ge><le>9.1.6</le></range>
	<range><ge>9.2.0</ge><le>9.2.4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab reports:
	<blockquote cite="https://about.gitlab.com/2017/06/07/gitlab-9-dot-2-dot-5-security-release/">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2017/06/07/gitlab-9-dot-2-dot-5-security-release/</url>
 </references>
 <dates>
 <discovery>2017-06-07</discovery>
 <entry>2017-06-30</entry>
 </dates>
 </vuln>

<vuln vid="0b9f4b5e-5d82-11e7-85df-14dae9d5a9d2">
 <topic>tor -- security regression</topic>
 <affects>
 <package>
	<name>tor</name>
	<range><lt>0.3.0.9</lt></range>
 </package>
 <package>
	<name>tor-devel</name>
	<range><lt>0.3.1.4.a</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Tor Project reports:
	<blockquote cite="https://lists.torproject.org/pipermail/tor-announce/2017-June/000133.html">
	 Tor 0.3.0.9 fixes a path selection bug that would allow a client
	 to use a guard that was in the same network family as a chosen exit
	 relay. This is a security regression; all clients running earlier
	 versions of 0.3.0.x or 0.3.1.x should upgrade to 0.3.0.9 or
	 0.3.1.4-alpha.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.torproject.org/blog/tor-0309-released-security-update-clients</url>
 <url>https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients</url>
 <url>https://lists.torproject.org/pipermail/tor-announce/2017-June/000133.html</url>
 <cvename>CVE-2017-0377</cvename>
 </references>
 <dates>
 <discovery>2017-06-29</discovery>
 <entry>2017-06-30</entry>
 </dates>
 </vuln>

<vuln vid="8c1a271d-56cf-11e7-b9fe-c13eb7bcbf4f">
 <topic>exim -- Privilege escalation via multiple memory leaks</topic>
 <affects>
 <package>
	<name>exim</name>
	<range><lt>4.89_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Qualsys reports:
	<blockquote cite="https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt">
	 
	 Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000369</url>
 </references>
 <dates>
 <discovery>2017-06-19</discovery>
 <entry>2017-06-21</entry>
 </dates>
 </vuln>

<vuln vid="00e4050b-56c1-11e7-8e66-08606e46faad">
 <topic>pear-Horde_Image -- DoS vulnerability</topic>
 <affects>
 <package>
	<name>pear-Horde_Image</name>
	<range><gt>2.3.0</gt><lt>2.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michael J Rubinsky reports:
	<blockquote cite="https://lists.horde.org/archives/announce/2017/001234.html">
	 The second vulnerability (CVE-2017-9773) is a DOS vulnerability.
This only affects Horde installations that do not have a configured image
handling backend, and thus use the "Null" image driver. It is exploitable by
a logged in user clicking on a maliciously crafted URL.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.horde.org/archives/announce/2017/001234.html</url>
 <cvename>CVE-2017-9773</cvename>
 </references>
 <dates>
 <discovery>2017-06-21</discovery>
 <entry>2017-06-21</entry>
 </dates>
 </vuln>

<vuln vid="a7003121-56bf-11e7-8e66-08606e46faad">
 <topic>pear-Horde_Image -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>pear-Horde_Image</name>
	<range><ge>2.0.0</ge><lt>2.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michael J Rubinsky reports:
	<blockquote cite="https://lists.horde.org/archives/announce/2017/001234.html">
	 The fist vulnerability (CVE-2017-9774) is a Remote Code Execution
vulnerability and is exploitable by a logged in user sending a
maliciously crafted GET request to the Horde server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.horde.org/archives/announce/2017/001234.html</url>
 <cvename>CVE-2017-9774</cvename>
 </references>
 <dates>
 <discovery>2017-06-21</discovery>
 <entry>2017-06-21</entry>
 </dates>
 </vuln>

<vuln vid="9f65d382-56a4-11e7-83e3-080027ef73ec">
 <topic>OpenVPN -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><lt>2.3.17</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.3</lt></range>
 </package>
 <package>
	<name>openvpn-mbedtls</name>
	<range><lt>2.4.3</lt></range>
 </package>
 <package>
	<name>openvpn-polarssl</name>
	<range><lt>2.3.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samuli Seppänen reports:
	<blockquote cite="https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243">
	 In May/June 2017 Guido Vranken threw a fuzzer at OpenVPN 2.4.2. In
	 the process he found several vulnerabilities and reported them to
	 the OpenVPN project. [...] The first releases to have these fixes are OpenVPN 2.4.3 and 2.3.17.
	 This is a list of fixed important vulnerabilities:
	 <ul>
	 <li>Remotely-triggerable ASSERT() on malformed IPv6 packet</li>
	 <li>Pre-authentication remote crash/information disclosure for clients</li>
	 <li>Potential double-free in --x509-alt-username</li>
	 <li>Remote-triggerable memory leaks</li>
	 <li>Post-authentication remote DoS when using the --x509-track option</li>
	 <li>Null-pointer dereference in establish_http_proxy_passthru()</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243</url>
 <cvename>CVE-2017-7508</cvename>
 <cvename>CVE-2017-7512</cvename>
 <cvename>CVE-2017-7520</cvename>
 <cvename>CVE-2017-7521</cvename>
 <cvename>CVE-2017-7522</cvename>
 </references>
 <dates>
 <discovery>2017-05-19</discovery>
 <entry>2017-06-21</entry>
 </dates>
 </vuln>

<vuln vid="0c2db2aa-5584-11e7-9a7d-b499baebfeaf">
 <topic>Apache httpd -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>apache22</name>
	<range><lt>2.2.33</lt></range>
 </package>
 <package>
	<name>apache24</name>
	<range><lt>2.4.26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache httpd project reports:
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
	 <ul>
	 <li>ap_get_basic_auth_pw() Authentication Bypass (CVE-2017-3167): 
	 Use of the ap_get_basic_auth_pw() by third-party modules outside
	 of the authentication phase may lead to authentication requirements
	 being bypassed.</li>
	 <li>mod_ssl Null Pointer Dereference (CVE-2017-3169): mod_ssl may
	 dereference a NULL pointer when third-party modules
	 call ap_hook_process_connection() during an HTTP request to an HTTPS
	 port.</li>
	 <li>mod_http2 Null Pointer Dereference (CVE-2017-7659): A maliciously
	 constructed HTTP/2 request could cause mod_http2 to dereference a NULL
	 pointer and crash the server process.</li>
	 <li>ap_find_token() Buffer Overread (CVE-2017-7668): The HTTP strict
	 parsing changes added in 2.2.32 and 2.4.24 introduced a bug in token
	 list parsing, which allows ap_find_token() to search past the end of its
	 input string. By maliciously crafting a sequence of request headers, an
	 attacker may be able to cause a segmentation fault, or to force
	 ap_find_token() to return an incorrect value.</li>
	 <li>mod_mime Buffer Overread (CVE-2017-7679): mod_mime can read one
	 byte past the end of a buffer when sending a malicious Content-Type
	 response header.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
 <url>https://httpd.apache.org/security/vulnerabilities_22.html</url>
 <cvename>CVE-2017-3167</cvename>
 <cvename>CVE-2017-3169</cvename>
 <cvename>CVE-2017-7659</cvename>
 <cvename>CVE-2017-7668</cvename>
 <cvename>CVE-2017-7679</cvename>
 </references>
 <dates>
 <discovery>2017-06-20</discovery>
 <entry>2017-06-20</entry>
 </dates>
 </vuln>

<vuln vid="f53dd5cc-527f-11e7-a772-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-pulse</name>
	<range><lt>59.0.3071.104</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html">
	 5 security fixes in this release, including:
	 <ul>
	 <li>[725032] High CVE-2017-5087: Sandbox Escape in IndexedDB. Reported by
	 Ned Williamson on 2017-05-22</li>
	 <li>[729991] High CVE-2017-5088: Out of bounds read in V8. Reported by
	 Xiling Gong of Tencent Security Platform Department on 2017-06-06</li>
	 <li>[714196] Medium CVE-2017-5089: Domain spoofing in Omnibox. Reported by
	 Michal Bentkowski on 2017-04-21</li>
	 <li>[732498] Various fixes from internal audits, fuzzing and other initiatives</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5087</cvename>
 <cvename>CVE-2017-5088</cvename>
 <cvename>CVE-2017-5089</cvename>
 <url>https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html</url>
 </references>
 <dates>
 <discovery>2017-06-15</discovery>
 <entry>2017-06-16</entry>
 </dates>
 </vuln>

<vuln vid="9314058e-5204-11e7-b712-b1a44a034d72">
 <topic>cURL -- URL file scheme drive letter buffer overflow</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.53.0</ge><lt>7.54.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cURL security advisory:
	<blockquote cite="https://curl.haxx.se/docs/adv_20170614.html">
	 When libcurl is given either
	 1. a file: URL that doesn't use two slashes following the colon, or
	 2. is told that file is the default scheme to use for URLs without scheme
	 ... and the given path starts with a drive letter and libcurl is built for
	 Windows or DOS, then libcurl would copy the path with a wrong offset, so that
	 the end of the given path would write beyond the malloc buffer. Up to seven
	 bytes too much.
	 We are not aware of any exploit of this flaw.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-9502</cvename>
 <url>https://curl.haxx.se/docs/adv_20170614.html</url>
 </references>
 <dates>
 <discovery>2017-06-14</discovery>
 <entry>2017-06-15</entry>
 </dates>
 </vuln>

<vuln vid="7a92e958-5207-11e7-8d7c-6805ca0b3d42">
 <topic>rt and dependent modules -- multiple security vulnerabilities</topic>
 <affects>
 <package>
	<name>rt42</name>
	<range><ge>4.2.0</ge><lt>4.2.13_1</lt></range>
 </package>
 <package>
	<name>rt44</name>
	<range><ge>4.4.0</ge><lt>4.4.1_1</lt></range>
 </package>
 <package>
	<name>p5-RT-Authen-ExternalAuth</name>
	<range><ge>0.9</ge><lt>0.27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	BestPractical reports:
	<blockquote cite="http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html</url>
 <cvename>CVE-2015-7686</cvename>
 <cvename>CVE-2016-6127</cvename>
 <cvename>CVE-2017-5361</cvename>
 <cvename>CVE-2017-5943</cvename>
 <cvename>CVE-2017-5944</cvename>
 </references>
 <dates>
 <discovery>2017-06-15</discovery>
 <entry>2017-06-15</entry>
 </dates>
 </vuln>

<vuln vid="cd944b3f-51f6-11e7-b7b2-001c25e46b1d">
 <topic>Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>26.0.0.126</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-17.html">
	 <ul>
	 <li>These updates resolve use-after-free vulnerabilities that
	 could lead to code execution (CVE-2017-3075, CVE-2017-3081,
	 CVE-2017-3083, CVE-2017-3084).</li>
	 <li>These updates resolve memory corruption vulnerabilities that
	 could lead to code execution (CVE-2017-3076, CVE-2017-3077,
	 CVE-2017-3078, CVE-2017-3079, CVE-2017-3082).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-3075</cvename>
 <cvename>CVE-2017-3076</cvename>
 <cvename>CVE-2017-3077</cvename>
 <cvename>CVE-2017-3078</cvename>
 <cvename>CVE-2017-3079</cvename>
 <cvename>CVE-2017-3081</cvename>
 <cvename>CVE-2017-3082</cvename>
 <cvename>CVE-2017-3083</cvename>
 <cvename>CVE-2017-3084</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb17-17.html</url>
 </references>
 <dates>
 <discovery>2017-06-13</discovery>
 <entry>2017-06-15</entry>
 </dates>
 </vuln>

<vuln vid="6cec1b0a-da15-467d-8691-1dea392d4c8d">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>54.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>52.2.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>52.2.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>52.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5470</cvename>
 <cvename>CVE-2017-5471</cvename>
 <cvename>CVE-2017-5472</cvename>
 <cvename>CVE-2017-7749</cvename>
 <cvename>CVE-2017-7750</cvename>
 <cvename>CVE-2017-7751</cvename>
 <cvename>CVE-2017-7752</cvename>
 <cvename>CVE-2017-7754</cvename>
 <cvename>CVE-2017-7755</cvename>
 <cvename>CVE-2017-7756</cvename>
 <cvename>CVE-2017-7757</cvename>
 <cvename>CVE-2017-7758</cvename>
 <cvename>CVE-2017-7759</cvename>
 <cvename>CVE-2017-7760</cvename>
 <cvename>CVE-2017-7761</cvename>
 <cvename>CVE-2017-7762</cvename>
 <cvename>CVE-2017-7763</cvename>
 <cvename>CVE-2017-7764</cvename>
 <cvename>CVE-2017-7765</cvename>
 <cvename>CVE-2017-7766</cvename>
 <cvename>CVE-2017-7767</cvename>
 <cvename>CVE-2017-7768</cvename>
 <cvename>CVE-2017-7778</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/</url>
 </references>
 <dates>
 <discovery>2017-06-13</discovery>
 <entry>2017-06-13</entry>
 <modified>2017-09-19</modified>
 </dates>
 </vuln>

<vuln vid="bce47c89-4d3f-11e7-8080-a4badb2f4699">
 <topic>roundcube -- arbitrary password resets</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><lt>1.2.5,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Roundcube reports:
	<blockquote cite="https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11">
	 Roundcube Webmail allows arbitrary password resets by
	 authenticated users. The problem is caused by an improperly restricted
	 exec call in the virtualmin and sasl drivers of the password plugin.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11</url>
 <cvename>CVE-2017-8114</cvename>
 </references>
 <dates>
 <discovery>2017-04-28</discovery>
 <entry>2017-06-09</entry>
 </dates>
 </vuln>

<vuln vid="b33fb1e0-4c37-11e7-afeb-0011d823eebd">
 <topic>GnuTLS -- Denial of service vulnerability</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>3.5.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GnuTLS project reports:
	<blockquote cite="https://gnutls.org/security.html#GNUTLS-SA-2017-4">
	 It was found using the TLS fuzzer tools that decoding a status
	 response TLS extension with valid contents could lead to a crash
	 due to a null pointer dereference. The issue affects GnuTLS server
	 applications.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://gnutls.org/security.html#GNUTLS-SA-2017-4</url>
 </references>
 <dates>
 <discovery>2017-06-07</discovery>
 <entry>2017-06-08</entry>
 </dates>
 </vuln>

<vuln vid="165e8951-4be0-11e7-a539-0050569f7e80">
 <topic>irssi -- remote DoS</topic>
 <affects>
 <package>
	<name>irssi</name>
	<range><lt>1.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Joseph Bisch reports:
	<blockquote cite="https://irssi.org/security/irssi_sa_2017_06.txt">
	 When receiving a DCC message without source nick/host, Irssi would
	 attempt to dereference a NULL pointer.
	 When receiving certain incorrectly quoted DCC files, Irssi would
	 try to find the terminating quote one byte before the allocated
	 memory.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-9468</cvename>
 <cvename>CVE-2017-9469</cvename>
 <url>https://irssi.org/security/irssi_sa_2017_06.txt</url>
 </references>
 <dates>
 <discovery>2017-06-06</discovery>
 <entry>2017-06-08</entry>
 </dates>
 </vuln>

<vuln vid="52f4b48b-4ac3-11e7-99aa-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-pulse</name>
	<range><lt>59.0.3071.86</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html">
	 30 security fixes in this release
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5070</cvename>
 <cvename>CVE-2017-5071</cvename>
 <cvename>CVE-2017-5072</cvename>
 <cvename>CVE-2017-5073</cvename>
 <cvename>CVE-2017-5074</cvename>
 <cvename>CVE-2017-5075</cvename>
 <cvename>CVE-2017-5086</cvename>
 <cvename>CVE-2017-5076</cvename>
 <cvename>CVE-2017-5077</cvename>
 <cvename>CVE-2017-5078</cvename>
 <cvename>CVE-2017-5079</cvename>
 <cvename>CVE-2017-5080</cvename>
 <cvename>CVE-2017-5081</cvename>
 <cvename>CVE-2017-5082</cvename>
 <cvename>CVE-2017-5083</cvename>
 <cvename>CVE-2017-5085</cvename>
 <url>https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2017-06-05</discovery>
 <entry>2017-06-06</entry>
 </dates>
 </vuln>

<vuln vid="15a04b9f-47cb-11e7-a853-001fbc0f280f">
 <topic>ansible -- Input validation flaw in jinja2 templating system</topic>
 <affects>
 <package>
	<name>ansible</name>
	<range><lt>2.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RedHat security team reports:
	<blockquote cite="https://access.redhat.com/security/cve/cve-2017-7481">
	 An input validation flaw was found in Ansible, where it fails to
	 properly mark lookup-plugin results as unsafe. If an attacker could
	 control the results of lookup() calls, they could inject Unicode
	 strings to be parsed by the jinja2 templating system, result in
	 code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://access.redhat.com/security/cve/cve-2017-7481</url>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7481</url>
 </references>
 <dates>
 <discovery>2017-05-09</discovery>
 <entry>2017-06-02</entry>
 </dates>
 </vuln>

<vuln vid="738e8ae1-46dd-11e7-a539-0050569f7e80">
 <topic>duo -- Two-factor authentication bypass</topic>
 <affects>
 <package>
	<name>duo</name>
	<range><lt>1.9.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The duo security team reports:
	<blockquote cite="https://duo.com/labs/psa/duo-psa-2017-002">
	 An untrusted user may be able to set the http_proxy variable to
	 an invalid address. If this happens, this will trigger the
	 configured 'failmode' behavior, which defaults to safe. Safe
	 mode causes the authentication to report a success.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://duo.com/labs/psa/duo-psa-2017-002</url>
 </references>
 <dates>
 <discovery>2017-05-19</discovery>
 <entry>2017-06-01</entry>
 </dates>
 </vuln>

<vuln vid="673dce46-46d0-11e7-a539-0050569f7e80">
 <topic>FreeRADIUS -- TLS resumption authentication bypass</topic>
 <affects>
 <package>
	<name>freeradius</name>
	<name>freeradius2</name>
	<name>freeradius3</name>
	<range><lt>3.0.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Winter reports:
	<blockquote cite="http://seclists.org/oss-sec/2017/q2/342">
	 The TLS session cache in FreeRADIUS before 3.0.14 fails to
	 reliably prevent resumption of an unauthenticated session, which
	 allows remote attackers (such as malicious 802.1X supplicants) to
	 bypass authentication via PEAP or TTLS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-9148</cvename>
 <url>http://freeradius.org/security.html</url>
 <url>http://seclists.org/oss-sec/2017/q2/342</url>
 <url>http://www.securityfocus.com/bid/98734</url>
 </references>
 <dates>
 <discovery>2017-02-03</discovery>
 <entry>2017-06-01</entry>
 </dates>
 </vuln>

<vuln vid="40a8d798-4615-11e7-8080-a4badb2f4699">
 <topic>heimdal -- bypass of capath policy</topic>
 <affects>
 <package>
	<name>heimdal</name>
	<range><lt>7.1.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Viktor Dukhovni reports:
	<blockquote cite="https://www.h5l.org/advisories.html?show=2017-04-13">
	 Commit f469fc6 (2010-10-02) inadvertently caused the
	 previous hop realm to not be added to the transit path of issued
	 tickets. This may, in some cases, enable bypass of capath policy in
	 Heimdal versions 1.5 through 7.2. Note, this may break sites that rely
	 on the bug. With the bug some incomplete [capaths] worked, that should
	 not have. These may now break authentication in some cross-realm
	 configurations. (CVE-2017-6594)
	</blockquote>
 </body>
 </description>
 <references>
 <url>CVE-2017-6594</url>
 <freebsdpr>ports/219657</freebsdpr>
 </references>
 <dates>
 <discovery>2017-04-13</discovery>
 <entry>2017-05-31</entry>
 </dates>
 </vuln>

<vuln vid="51d1282d-420e-11e7-82c5-14dae9d210b8">
 <topic>FreeBSD -- ipfilter(4) fragment handling panic</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.0</ge><lt>11.0_10</lt></range>
	<range><ge>10.3</ge><lt>10.3_19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	ipfilter(4), capable of stateful packet inspection, using
	the "keep state" or "keep frags" rule options, will not
	only maintain the state of connections, such as TCP streams
	or UDP communication, it also maintains the state of
	fragmented packets. When a packet fragments are received
	they are cached in a hash table (and linked list). When a
	fragment is received it is compared with fragments already
	cached in the hash table for a match. If it does not match
	the new entry is used to create a new entry in the hash
	table. If on the other hand it does match, unfortunately
	the wrong entry is freed, the entry in the hash table. This
	results in use after free panic (and for a brief moment
	prior to the panic a memory leak due to the wrong entry
	being freed).
	<h1>Impact:</h1>
	Carefully feeding fragments that are allowed to pass by
	an ipfilter(4) firewall can be used to cause a panic followed
	by reboot loop denial of service attack.
 </body>
 </description>
 <references>
 <cvename>CVE-2017-1081</cvename>
 <freebsdsa>SA-17:04.ipfilter</freebsdsa>
 </references>
 <dates>
 <discovery>2017-04-27</discovery>
 <entry>2017-05-26</entry>
 </dates>
 </vuln>

<vuln vid="3c0237f5-420e-11e7-82c5-14dae9d210b8">
 <topic>FreeBSD -- Multiple vulnerabilities of ntp</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_9</lt></range>
	<range><ge>10.3</ge><lt>10.3_18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A vulnerability was discovered in the NTP server's parsing
	of configuration directives. [CVE-2017-6464]
	A vulnerability was found in NTP, in the parsing of
	packets from the DPTS Clock. [CVE-2017-6462]
	A vulnerability was discovered in the NTP server's parsing
	of configuration directives. [CVE-2017-6463]
	A vulnerability was found in NTP, affecting the origin
	timestamp check function. [CVE-2016-9042]
	<h1>Impact:</h1>
	A remote, authenticated attacker could cause ntpd to
	crash by sending a crafted message. [CVE-2017-6463,
	CVE-2017-6464]
	A malicious device could send crafted messages, causing
	ntpd to crash. [CVE-2017-6462]
	An attacker able to spoof messages from all of the
	configured peers could send crafted packets to ntpd, causing
	later replies from those peers to be discarded, resulting
	in denial of service. [CVE-2016-9042]
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9042</cvename>
 <cvename>CVE-2017-6462</cvename>
 <cvename>CVE-2017-6463</cvename>
 <cvename>CVE-2017-6464</cvename>
 <freebsdsa>SA-17:03.ntp</freebsdsa>
 </references>
 <dates>
 <discovery>2017-04-12</discovery>
 <entry>2017-05-26</entry>
 </dates>
 </vuln>

<vuln vid="ec6aeb8e-41e4-11e7-aa00-5404a68ad561">
 <topic>vlc -- remote code execution via crafted subtitles</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><lt>2.2.6,4</lt></range>
 </package>
 <package>
	<name>vlc-qt4</name>
	<range><lt>2.2.6,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Check Point research team reports:
	<blockquote cite="http://blog.checkpoint.com/2017/05/23/hacked-in-translation/">
	 Remote code execution via crafted subtitles
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.checkpoint.com/2017/05/23/hacked-in-translation/</url>
 </references>
 <dates>
 <discovery>2017-05-23</discovery>
 <entry>2017-05-26</entry>
 </dates>
 </vuln>

<vuln vid="803879e9-4195-11e7-9b08-080027ef73ec">
 <topic>OpenEXR -- multiple remote code execution and denial of service vulnerabilities</topic>
 <affects>
 <package>
	<name>OpenEXR</name>
	<range><lt>2.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Brandon Perry reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2017/05/12/5">
	 [There] is a zip file of EXR images that cause segmentation faults in the OpenEXR library (tested against 2.2.0).
	 <ul>
	 <li>CVE-2017-9110
	 In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.</li>
	 <li>CVE-2017-9111
	 In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.</li>
	 <li>CVE-2017-9112
	 In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.</li>
	 <li>CVE-2017-9113
	 In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute arbitrary code.</li>
	 <li>CVE-2017-9114
	 In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.</li>
	 <li>CVE-2017-9115
	 In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.</li>
	 <li>CVE-2017-9116
	 In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2017/05/12/5</url>
 <cvename>CVE-2017-9110</cvename>
 <cvename>CVE-2017-9111</cvename>
 <cvename>CVE-2017-9112</cvename>
 <cvename>CVE-2017-9113</cvename>
 <cvename>CVE-2017-9114</cvename>
 <cvename>CVE-2017-9115</cvename>
 <cvename>CVE-2017-9116</cvename>
 <url>https://github.com/openexr/openexr/issues/232</url>
 </references>
 <dates>
 <discovery>2017-01-12</discovery>
 <entry>2017-05-25</entry>
 </dates>
 </vuln>

<vuln vid="50776801-4183-11e7-b291-b499baebfeaf">
 <topic>ImageMagick -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.9.6.4_2,1</lt></range>
	<range><ge>6.9.7.0,1</ge><lt>6.9.8.8,1</lt></range>
 </package>
 <package>
	<name>ImageMagick7</name>
	<name>ImageMagick7-nox11</name>
	<range><lt>7.0.5.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://nvd.nist.gov/vuln/search/results?query=ImageMagick">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nvd.nist.gov/vuln/search/results?query=ImageMagick</url>
 <cvename>CVE-2017-5506</cvename>
 <cvename>CVE-2017-5507</cvename>
 <cvename>CVE-2017-5508</cvename>
 <cvename>CVE-2017-5509</cvename>
 <cvename>CVE-2017-5510</cvename>
 <cvename>CVE-2017-5511</cvename>
 <cvename>CVE-2017-6497</cvename>
 <cvename>CVE-2017-6498</cvename>
 <cvename>CVE-2017-6499</cvename>
 <cvename>CVE-2017-6500</cvename>
 <cvename>CVE-2017-6501</cvename>
 <cvename>CVE-2017-6502</cvename>
 <cvename>CVE-2017-7275</cvename>
 <cvename>CVE-2017-7606</cvename>
 <cvename>CVE-2017-7619</cvename>
 <cvename>CVE-2017-7941</cvename>
 <cvename>CVE-2017-7942</cvename>
 <cvename>CVE-2017-7943</cvename>
 <cvename>CVE-2017-8343</cvename>
 <cvename>CVE-2017-8344</cvename>
 <cvename>CVE-2017-8345</cvename>
 <cvename>CVE-2017-8346</cvename>
 <cvename>CVE-2017-8347</cvename>
 <cvename>CVE-2017-8348</cvename>
 <cvename>CVE-2017-8349</cvename>
 <cvename>CVE-2017-8350</cvename>
 <cvename>CVE-2017-8351</cvename>
 <cvename>CVE-2017-8352</cvename>
 <cvename>CVE-2017-8353</cvename>
 <cvename>CVE-2017-8354</cvename>
 <cvename>CVE-2017-8355</cvename>
 <cvename>CVE-2017-8356</cvename>
 <cvename>CVE-2017-8357</cvename>
 <cvename>CVE-2017-8765</cvename>
 <cvename>CVE-2017-8830</cvename>
 <cvename>CVE-2017-9141</cvename>
 <cvename>CVE-2017-9142</cvename>
 <cvename>CVE-2017-9143</cvename>
 <cvename>CVE-2017-9144</cvename>
 </references>
 <dates>
 <discovery>2017-03-05</discovery>
 <entry>2017-05-25</entry>
 <modified>2017-05-29</modified>
 </dates>
 </vuln>

<vuln vid="6f4d96c0-4062-11e7-b291-b499baebfeaf">
 <topic>samba -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>samba42</name>
	<range><lt>4.2.15</lt></range>
 </package>
 <package>
	<name>samba43</name>
	<range><lt>4.3.14</lt></range>
 </package>
 <package>
	<name>samba44</name>
	<range><lt>4.4.14</lt></range>
 </package>
 <package>
	<name>samba45</name>
	<range><lt>4.5.10</lt></range>
 </package>
 <package>
	<name>samba46</name>
	<range><lt>4.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The samba project reports:
	<blockquote cite="https://www.samba.org/samba/security/CVE-2017-7494.html">
	 Remote code execution from a writable share.
	 All versions of Samba from 3.5.0 onwards are vulnerable to a remote
	 code execution vulnerability, allowing a malicious client to upload
	 a shared library to a writable share, and then cause the server to
	 load and execute it.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/security/CVE-2017-7494.html</url>
 <cvename>CVE-2017-7494</cvename>
 </references>
 <dates>
 <discovery>2017-05-24</discovery>
 <entry>2017-05-24</entry>
 </dates>
 </vuln>

<vuln vid="f52e3a8d-3f7e-11e7-97a9-a0d3c19bfa21">
 <topic>NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler</topic>
 <affects>
 <package>
	<name>nvidia-driver</name>
	<range><lt>375.66</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVIDIA Unix security team reports:
	<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/4462">
	 NVIDIA GPU Display Driver contains vulnerabilities in the
	 kernel mode layer handler where not correctly validated user
	 input, NULL pointer dereference, and incorrect access control
	 may lead to denial of service or potential escalation of
	 privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-0350</cvename>
 <cvename>CVE-2017-0351</cvename>
 <cvename>CVE-2017-0352</cvename>
 <url>http://nvidia.custhelp.com/app/answers/detail/a_id/4462</url>
 </references>
 <dates>
 <discovery>2017-05-15</discovery>
 <entry>2017-05-23</entry>
 </dates>
 </vuln>

<vuln vid="da1d5d2e-3eca-11e7-8861-0018fe623f2b">
 <topic>miniupnpc -- integer signedness error</topic>
 <affects>
 <package>
	<name>miniupnpc</name>
	<range><lt>2.0.20170509</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tintinweb reports:
	<blockquote cite="https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798">
	 An integer signedness error was found in miniupnp's miniwget
	 allowing an unauthenticated remote entity typically located on the
	 local network segment to trigger a heap corruption or an access
	 violation in miniupnp's http response parser when processing a
	 specially crafted chunked-encoded response to a request for the
	 xml root description url.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-8798</cvename>
 <url>https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798</url>
 </references>
 <dates>
 <discovery>2017-05-09</discovery>
 <entry>2017-05-22</entry>
 </dates>
 </vuln>

<vuln vid="a5bb7ea0-3e58-11e7-94a2-00e04c1ea73d">
 <topic>Wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>fr-wordpress</name>
	<range><lt>4.7.5,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.7.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://wordpress.org/news/2017/05/wordpress-4-7-5/">
	 WordPress versions 4.7.4 and earlier are affected by six security issues
	 <ul>
	 <li>Insufficient redirect validation in the HTTP class.</li>
	 <li>Improper handling of post meta data values in the XML-RPC API.</li>
	 <li>Lack of capability checks for post meta data in the XML-RPC API.</li>
	 <li>A Cross Site Request Forgery (CRSF) vulnerability was discovered in the filesystem credentials dialog.</li>
	 <li>A cross-site scripting (XSS) vulnerability was discovered related to the Customizer.</li>
	</ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2017/05/wordpress-4-7-5/</url>
 </references>
 <dates>
 <discovery>2017-05-16</discovery>
 <entry>2017-05-21</entry>
 </dates>
 </vuln>

<vuln vid="fab87bff-3ce5-11e7-bf9d-001999f8d30b">
 <topic>asterisk -- Memory exhaustion on short SCCP packets</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.15.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 A remote memory exhaustion can be triggered by sending
	 an SCCP packet to Asterisk system with "chan_skinny"
	 enabled that is larger than the length of the SCCP header
	 but smaller than the packet length specified in the header.
	 The loop that reads the rest of the packet doesn't detect
	 that the call to read() returned end-of-file before the
	 expected number of bytes and continues infinitely. The
	 "partial data" message logging in that tight loop causes
	 Asterisk to exhaust all available memory.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2017-004.html</url>
 </references>
 <dates>
 <discovery>2017-04-13</discovery>
 <entry>2017-05-19</entry>
 </dates>
 </vuln>

<vuln vid="0537afa3-3ce0-11e7-bf9d-001999f8d30b">
 <topic>asterisk -- Buffer Overrun in PJSIP transaction layer</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.15.1</lt></range>
 </package>
 <package>
	<name>pjsip</name>
	<range><lt>2.6_1</lt></range>
 </package>
 <package>
	<name>pjsip-extsrtp</name>
	<range><lt>2.6_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 A remote crash can be triggered by sending a SIP packet
	 to Asterisk with a specially crafted CSeq header and a
	 Via header with no branch parameter. The issue is that
	 the PJSIP RFC 2543 transaction key generation algorithm
	 does not allocate a large enough buffer. By overrunning
	 the buffer, the memory allocation table becomes corrupted,
	 leading to an eventual crash.
	 The multi-part body parser in PJSIP contains a logical
	 error that can make certain multi-part body parts attempt
	 to read memory from outside the allowed boundaries. A
	 specially-crafted packet can trigger these invalid reads
	 and potentially induce a crash.
	 This issues is in PJSIP, and so the issue can be fixed
	 without performing an upgrade of Asterisk at all. However,
	 we are releasing a new version of Asterisk with the bundled
	 PJProject updated to include the fix.
	 If you are running Asterisk with chan_sip, this issue
	 does not affect you.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2017-002.html</url>
 <url>http://downloads.asterisk.org/pub/security/AST-2017-003.html</url>
 </references>
 <dates>
 <discovery>2017-04-12</discovery>
 <entry>2017-05-19</entry>
 </dates>
 </vuln>

<vuln vid="3c2549b3-3bed-11e7-a9f0-a4badb296695">
 <topic>Joomla3 -- SQL Injection</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><eq>3.7.0</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	JSST reports:
	<blockquote cite="https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html">
	 Inadequate filtering of request data leads to a SQL Injection vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-8917</cvename>
 <url>https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html</url>
 </references>
 <dates>
 <discovery>2017-05-11</discovery>
 <entry>2017-05-18</entry>
 </dates>
 </vuln>

<vuln vid="9704930c-3bb7-11e7-93f7-d43d7e971a1b">
 <topic>gitlab -- Various security issues</topic>
 <affects>
 <package>
	<name>gitlab</name>
	<range><ge>6.6.0</ge><le>8.17.5</le></range>
	<range><ge>9.0.0</ge><le>9.0.6</le></range>
	<range><ge>9.1.0</ge><le>9.1.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab reports:
	<blockquote cite="https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/</url>
 </references>
 <dates>
 <discovery>2017-05-08</discovery>
 <entry>2017-05-18</entry>
 <modified>2017-05-30</modified>
 </dates>
 </vuln>

<vuln vid="5d62950f-3bb5-11e7-93f7-d43d7e971a1b">
 <topic>gitlab -- Various security issues</topic>
 <affects>
 <package>
	<name>gitlab</name>
	<range><ge>8.7.0</ge><le>8.15.7</le></range>
	<range><ge>8.16.0</ge><le>8.16.7</le></range>
	<range><ge>8.17.0</ge><le>8.17.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab reports:
	<blockquote cite="https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/">
 <h1>Information Disclosure in Issue and Merge Request Trackers</h1>
 During an internal code review a critical vulnerability in the GitLab
 Issue and Merge Request trackers was discovered. This vulnerability could
 allow a user with access to assign ownership of an issue or merge request to
 another user to disclose that user's private token, email token, email
 address, and encrypted OTP secret. Reporter-level access to a GitLab project
 is required to exploit this flaw.
 <h1>SSRF when importing a project from a Repo by URL</h1>
 GitLab instances that have enabled project imports using "Repo by URL"
 were vulnerable to Server-Side Request Forgery attacks. By specifying a
 project import URL of localhost an attacker could target services that are
 bound to the local interface of the server. These services often do not
 require authentication. Depending on the service an attacker might be able
 craft an attack using the project import request URL.
 <h1>Links in Environments tab vulnerable to tabnabbing</h1>
 edio via HackerOne reported that user-configured Environment links
 include target=_blank but do not also include rel: noopener
 noreferrer. Anyone clicking on these links may therefore be subjected to
 tabnabbing attacks where a link back to the requesting page is maintained
 and can be manipulated by the target server.
 <h1>Accounts with email set to "Do not show on profile" have addresses
 exposed in public atom feed</h1>
 Several GitLab users reported that even with "Do not show on profile"
 configured for their email addresses those addresses were still being leaked
 in Atom feeds if they commented on a public project.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-0882</cvename>
 <url>https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/</url>
 </references>
 <dates>
 <discovery>2017-03-20</discovery>
 <entry>2017-05-18</entry>
 <modified>2017-05-30</modified>
 </dates>
 </vuln>

<vuln vid="4a088d67-3af2-11e7-9d75-c86000169601">
 <topic>freetype2 -- buffer overflows</topic>
 <affects>
 <package>
	<name>freetype2</name>
	<range><lt>2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Werner Lemberg reports:
	<blockquote cite="http://lists.nongnu.org/archive/html/freetype-announce/2017-05/msg00000.html">
	 CVE-2017-8105, CVE-2017-8287: Older FreeType versions have
	 out-of-bounds writes caused by heap-based buffer overflows
	 related to Type 1 fonts.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.nongnu.org/archive/html/freetype-announce/2017-05/msg00000.html</url>
 <cvename>CVE-2017-8105</cvename>
 <cvename>CVE-2017-8287</cvename>
 </references>
 <dates>
 <discovery>2017-05-17</discovery>
 <entry>2017-05-17</entry>
 </dates>
 </vuln>

<vuln vid="04cc7bd2-3686-11e7-aa64-080027ef73ec">
 <topic>OpenVPN -- two remote denial-of-service vulnerabilities</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><lt>2.3.15</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.2</lt></range>
 </package>
 <package>
	<name>openvpn23</name>
	<range><lt>2.3.15</lt></range>
 </package>
 <package>
	<name>openvpn-mbedtls</name>
	<range><ge>2.4.0</ge><lt>2.4.2</lt></range>
 </package>
 <package>
	<name>openvpn-polarssl</name>
	<range><lt>2.3.15</lt></range>
 </package>
 <package>
	<name>openvpn23-polarssl</name>
	<range><lt>2.3.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samuli Seppänen reports:
	<blockquote cite="https://openvpn.net/index.php/open-source/downloads.html">
	 OpenVPN v2.4.0 was audited for security vulnerabilities independently by
	 Quarkslabs (funded by OSTIF) and Cryptography Engineering (funded by
	 Private Internet Access) between December 2016 and April 2017. The
	 primary findings were two remote denial-of-service vulnerabilities.
	 Fixes to them have been backported to v2.3.15.
	 An authenticated client can do the 'three way handshake'
	 (P_HARD_RESET, P_HARD_RESET, P_CONTROL), where the P_CONTROL packet
	 is the first that is allowed to carry payload. If that payload is
	 too big, the OpenVPN server process will stop running due to an
	 ASSERT() exception. That is also the reason why servers using
	 tls-auth/tls-crypt are protected against this attack - the P_CONTROL
	 packet is only accepted if it contains the session ID we specified,
	 with a valid HMAC (challenge-response). (CVE-2017-7478)
	 An authenticated client can cause the server's the packet-id
	 counter to roll over, which would lead the server process to hit an
	 ASSERT() and stop running. To make the server hit the ASSERT(), the
	 client must first cause the server to send it 2^32 packets (at least
	 196 GB).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://openvpn.net/index.php/open-source/downloads.html</url>
 <cvename>CVE-2017-7478</cvename>
 <cvename>CVE-2017-7479</cvename>
 <url>https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits</url>
 <url>https://ostif.org/?p=870&amp;preview=true</url>
 <url>https://www.privateinternetaccess.com/blog/2017/05/openvpn-2-4-2-fixes-critical-issues-discovered-openvpn-audit-reports/</url>
 </references>
 <dates>
 <discovery>2017-05-10</discovery>
 <entry>2017-05-11</entry>
 </dates>
 </vuln>

<vuln vid="414c18bf-3653-11e7-9550-6cc21735f730">
 <topic>PostgreSQL vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql92-client</name>
	<range><ge>9.2.0</ge><lt>9.2.20</lt></range>
 </package>
 <package>
	<name>postgresql93-client</name>
	<range><ge>9.3.0</ge><lt>9.3.16</lt></range>
 </package>
 <package>
	<name>postgresql94-client</name>
	<range><ge>9.4.0</ge><lt>9.4.11</lt></range>
 </package>
 <package>
	<name>postgresql95-client</name>
	<range><ge>9.5.0</ge><lt>9.5.6</lt></range>
 </package>
 <package>
	<name>postgresql96-client</name>
	<range><ge>9.6.0</ge><lt>9.6.2</lt></range>
 </package>
 <package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.20</lt></range>
 </package>
 <package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.16</lt></range>
 </package>
 <package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.11</lt></range>
 </package>
 <package>
	<name>postgresql95-server</name>
	<range><ge>9.5.0</ge><lt>9.5.6</lt></range>
 </package>
 <package>
	<name>postgresql96-server</name>
	<range><ge>9.6.0</ge><lt>9.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL project reports:
	<blockquote cite="http://www.postgresql.org/about/news/1746/">
	 
	 Security Fixes nested CASE expressions +
	 database and role names with embedded special characters
	 
	 <ul>
	 <li>CVE-2017-7484: selectivity estimators bypass SELECT privilege
	 checks.
	 </li>
	 <li>CVE-2017-7485: libpq ignores PGREQUIRESSL environment variable
	 </li>
	 <li>CVE-2017-7486: pg_user_mappings view discloses foreign server
	 passwords. This applies to new databases, see the release notes for
	 the procedure to apply the fix to an existing database.
	 </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5423</cvename>
 <cvename>CVE-2016-5424</cvename>
 </references>
 <dates>
 <discovery>2017-05-11</discovery>
 <entry>2017-05-11</entry>
 </dates>
 </vuln>

<vuln vid="0baee383-356c-11e7-b9a9-50e549ebab6c">
 <topic>kauth: Local privilege escalation</topic>
 <affects>
 <package>
	<name>kdelibs</name>
	<range><lt>4.14.30_4</lt></range>
 </package>
 <package>
	<name>kf5-kauth</name>
	<range><lt>5.33.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Albert Astals Cid reports:
	<blockquote cite="https://www.kde.org/info/security/advisory-20170510-1.txt">
	 KAuth contains a logic flaw in which the service invoking dbus
	 is not properly checked.
	 This allows spoofing the identity of the caller and with some
	 carefully crafted calls can lead to gaining root from an
	 unprivileged account.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-8422</cvename>
 <mlist>http://www.openwall.com/lists/oss-security/2017/05/10/3</mlist>
 <url>https://www.kde.org/info/security/advisory-20170510-1.txt</url>
 </references>
 <dates>
 <discovery>2017-05-10</discovery>
 <entry>2017-05-10</entry>
 </dates>
 </vuln>

<vuln vid="57600032-34fe-11e7-8965-bcaec524bf84">
 <topic>libetpan -- null dereference vulnerability in MIME parsing component</topic>
 <affects>
 <package>
	<name>libetpan</name>
	<range><lt>1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	rwhitworth reports:
	<blockquote cite="https://github.com/dinhviethoa/libetpan/issues/274">
	 I was using American Fuzzy Lop (afl-fuzz) to fuzz input to the
	 mime-parse test program. Is fixing these crashes something you're
	 interested in? The input files can be found here:
	 https://github.com/rwhitworth/libetpan-fuzz/.

The files can be executed as ./mime-parse id_filename to cause
	 seg faults.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-8825</cvename>
 <url>http://cve.circl.lu/cve/CVE-2017-8825</url>
 </references>
 <dates>
 <discovery>2017-04-29</discovery>
 <entry>2017-05-09</entry>
 </dates>
 </vuln>

<vuln vid="92e345d0-304d-11e7-8359-e8e0b747a45a">
 <topic>chromium -- race condition vulnerability</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>58.0.3029.96</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html">
	 1 security fix in this release:
	</blockquote>
	<ul>
	 <li>[679306] High CVE-2017-5068: Race condition in WebRTC. Credit to
	 Philipp Hancke</li>
	</ul>
 </body>
 </description>
 <references>
	<cvename>CVE-2017-5068</cvename>
 <url>https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2017-05-02</discovery>
 <entry>2017-05-03</entry>
 </dates>
 </vuln>

<vuln vid="a8c8001b-216c-11e7-80aa-005056925db4">
 <topic>dovecot -- Dovecot DoS when passdb dict was used for authentication</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<name>dovecot2</name>
	<range><gt>2.2.25_6</gt><lt>2.2.29</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Timo Sirainen reports:
	<blockquote cite="https://dovecot.org/list/dovecot-news/2017-April/000341.html">
	 passdb/userdb dict: Don't double-expand %variables in keys. If dict
		was used as the authentication passdb, using specially crafted
	 %variables in the username could be used to cause DoS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-2669</cvename>
 <mlist>https://dovecot.org/list/dovecot-news/2017-April/000341.html</mlist>
 <mlist>https://dovecot.org/list/dovecot-news/2017-April/000342.html</mlist>
 </references>
 <dates>
 <discovery>2016-12-01</discovery>
 <entry>2017-04-30</entry>
 </dates>
 </vuln>

<vuln vid="24673ed7-2bf3-11e7-b291-b499baebfeaf">
 <topic>LibreSSL -- TLS verification vulnerability</topic>
 <affects>
 <package>
	<name>libressl</name>
	<range><ge>2.5.1</ge><lt>2.5.3_1</lt></range>
 </package>
 <package>
	<name>libressl-devel</name>
	<range><ge>2.5.1</ge><lt>2.5.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 Jakub Jirutka reports:
	<blockquote cite="http://seclists.org/oss-sec/2017/q2/145">
	 LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if
	 SSL_get_verify_result is relied upon for a later check of a
	 verification result, in a use case where a user-provided verification
	 callback returns 1, as demonstrated by acceptance of invalid
	 certificates by nginx.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2017/q2/145</url>
 <url>https://github.com/libressl-portable/portable/issues/307</url>
 <cvename>CVE-2017-8301</cvename>
 </references>
 <dates>
 <discovery>2017-04-27</discovery>
 <entry>2017-04-28</entry>
 </dates>
 </vuln>

<vuln vid="631c4710-9be5-4a80-9310-eb2847fe24dd">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.57</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.46.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://jenkins.io/security/advisory/2017-04-26/">
	 <h1>Description</h1>
	 <h5>SECURITY-412 through SECURITY-420 / CVE-2017-1000356</h5>
	 CSRF: Multiple vulnerabilities
	 <h5>SECURITY-429 / CVE-2017-1000353</h5>
	 CLI: Unauthenticated remote code execution
	 <h5>SECURITY-466 / CVE-2017-1000354</h5>
	 CLI: Login command allowed impersonating any Jenkins user
	 <h5>SECURITY-503 / CVE-2017-1000355</h5>
	 XStream: Java crash when trying to instantiate void/Void
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-1000356</cvename>
 <cvename>CVE-2017-1000353</cvename>
 <cvename>CVE-2017-1000354</cvename>
 <cvename>CVE-2017-1000355</cvename>
 <url>https://jenkins.io/security/advisory/2017-04-26/</url>
 </references>
 <dates>
 <discovery>2017-04-26</discovery>
 <entry>2017-04-27</entry>
 </dates>
 </vuln>

<vuln vid="df0144fb-295e-11e7-970f-002590263bf5">
 <topic>codeigniter -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>codeigniter</name>
	<range><lt>3.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The CodeIgniter changelog reports:
	<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
	 Fixed a header injection vulnerability in common function
	 set_status_header() under Apache (thanks to Guillermo Caminer from
	 Flowgate).
	 Fixed byte-safety issues in Encrypt Library (DEPRECATED) when
	 mbstring.func_overload is enabled.
	 Fixed byte-safety issues in Encryption Library when
	 mbstring.func_overload is enabled.
	 Fixed byte-safety issues in compatibility functions
	 password_hash(), hash_pbkdf2() when mbstring.func_overload is
	 enabled.
	 Updated Encrypt Library (DEPRECATED) to call mcrypt_create_iv()
	 with MCRYPT_DEV_URANDOM.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.codeigniter.com/user_guide/changelog.html</url>
 </references>
 <dates>
 <discovery>2017-03-23</discovery>
 <entry>2017-04-25</entry>
 </dates>
 </vuln>

<vuln vid="81433129-2916-11e7-ad3e-00e04c1ea73d">
 <topic>weechat -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>weechat</name>
	<range><lt>1.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Common Vulnerabilities and Exposures:
	<blockquote cite="https://weechat.org/download/security/">
	 WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to
	 the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes
	 function during quote removal, with a buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://weechat.org/download/security/</url>
 <cvename>CVE-2017-8073</cvename>
 </references>
 <dates>
 <discovery>2017-04-23</discovery>
 <entry>2017-04-24</entry>
 </dates>
 </vuln>

<vuln vid="1455c86c-26c2-11e7-9daa-6cf0497db129">
 <topic>drupal8 -- Drupal Core - Critical - Access Bypass</topic>
 <affects>
 <package>
	<name>drupal8</name>
	<range><lt>8.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team Reports:
	<blockquote cite="https://www.drupal.org/SA-CORE-2017-002">
	 CVE-2017-6919: Access bypass
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-6919</cvename>
 </references>
 <dates>
 <discovery>2017-04-19</discovery>
 <entry>2017-04-21</entry>
 </dates>
 </vuln>

<vuln vid="95a74a48-2691-11e7-9e2d-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-pulse</name>
	<range><lt>58.0.3029.81</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html">
	 29 security fixes in this release, including:
	 <ul>
	 <li>[695826] High CVE-2017-5057: Type confusion in PDFium. Credit to
	 Guang Gong of Alpha Team, Qihoo 360</li>
	 <li>[694382] High CVE-2017-5058: Heap use after free in Print Preview.
	 Credit to Khalil Zhani</li>
	 <li>[684684] High CVE-2017-5059: Type confusion in Blink. Credit to
	 SkyLined working with Trend Micro's Zero Day Initiative</li>
	 <li>[683314] Medium CVE-2017-5060: URL spoofing in Omnibox. Credit to
	 Xudong Zheng</li>
	 <li>[672847] Medium CVE-2017-5061: URL spoofing in Omnibox. Credit to
	 Haosheng Wang (@gnehsoah)</li>
	 <li>[702896] Medium CVE-2017-5062: Use after free in Chrome Apps.
	 Credit to anonymous</li>
	 <li>[700836] Medium CVE-2017-5063: Heap overflow in Skia. Credit to
	 Sweetchip</li>
	 <li>[693974] Medium CVE-2017-5064: Use after free in Blink. Credit to
	 Wadih Matar</li>
	 <li>[704560] Medium CVE-2017-5065: Incorrect UI in Blink. Credit to
	 Khalil Zhani</li>
	 <li>[690821] Medium CVE-2017-5066: Incorrect signature handing in Networking.
	 Credit to Prof. Zhenhua Duan, Prof. Cong Tian, and Ph.D candidate Chu Chen
	 (ICTT, Xidian University)</li>
	 <li>[648117] Medium CVE-2017-5067: URL spoofing in Omnibox. Credit to
	 Khalil Zhani</li>
	 <li>[691726] Low CVE-2017-5069: Cross-origin bypass in Blink. Credit to
	 Michael Reizelman</li>
	 <li>[713205] Various fixes from internal audits, fuzzing and other initiatives</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5057</cvename>
 <cvename>CVE-2017-5058</cvename>
 <cvename>CVE-2017-5059</cvename>
 <cvename>CVE-2017-5060</cvename>
 <cvename>CVE-2017-5061</cvename>
 <cvename>CVE-2017-5062</cvename>
 <cvename>CVE-2017-5063</cvename>
 <cvename>CVE-2017-5064</cvename>
 <cvename>CVE-2017-5065</cvename>
 <cvename>CVE-2017-5066</cvename>
 <cvename>CVE-2017-5067</cvename>
 <cvename>CVE-2017-5069</cvename>
 <url>https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2017-04-19</discovery>
 <entry>2017-04-21</entry>
 </dates>
 </vuln>

<vuln vid="607f8b57-7454-42c6-a88a-8706f327076d">
 <topic>icu -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>icu</name>
	<range><lt>58.2_2,1</lt></range>
 </package>
 <package>
	<name>linux-c6-icu</name>
	<name>linux-c7-icu</name>
	<range><lt>59.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7867">
	 International Components for Unicode (ICU) for C/C++
	 before 2017-02-13 has an out-of-bounds write caused by a
	 heap-based buffer overflow related to the utf8TextAccess
	 function in common/utext.cpp and the utext_setNativeIndex*
	 function.
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7868">
	 International Components for Unicode (ICU) for C/C++
	 before 2017-02-13 has an out-of-bounds write caused by a
	 heap-based buffer overflow related to the utf8TextAccess
	 function in common/utext.cpp and the utext_moveIndex32*
	 function.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-7867</cvename>
 <cvename>CVE-2017-7868</cvename>
 <url>http://bugs.icu-project.org/trac/changeset/39671</url>
 <url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437</url>
 </references>
 <dates>
 <discovery>2017-01-21</discovery>
 <entry>2017-04-20</entry>
 <modified>2017-05-04</modified>
 </dates>
 </vuln>

<vuln vid="2a96e498-3234-4950-a9ad-419bc84a839d">
 <topic>tiff -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>tiff</name>
	<name>linux-f8-tiff</name>
	<name>linux-f10-tiff</name>
	<name>linux-c6-tiff</name>
	<name>linux-c7-tiff</name>
	<range><lt>4.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-5225">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5225</cvename>
 <cvename>CVE-2017-7592</cvename>
 <cvename>CVE-2017-7593</cvename>
 <cvename>CVE-2017-7594</cvename>
 <cvename>CVE-2017-7595</cvename>
 <cvename>CVE-2017-7596</cvename>
 <cvename>CVE-2017-7597</cvename>
 <cvename>CVE-2017-7598</cvename>
 <cvename>CVE-2017-7599</cvename>
 <cvename>CVE-2017-7600</cvename>
 <cvename>CVE-2017-7601</cvename>
 <cvename>CVE-2017-7602</cvename>
 <url>https://github.com/vadz/libtiff/commit/5c080298d59e</url>
 <url>https://github.com/vadz/libtiff/commit/48780b4fcc42</url>
 <url>https://github.com/vadz/libtiff/commit/d60332057b95</url>
 <url>https://github.com/vadz/libtiff/commit/2ea32f7372b6</url>
 <url>https://github.com/vadz/libtiff/commit/8283e4d1b7e5</url>
 <url>https://github.com/vadz/libtiff/commit/47f2fb61a3a6</url>
 <url>https://github.com/vadz/libtiff/commit/3cfd62d77c2a</url>
 <url>https://github.com/vadz/libtiff/commit/3144e57770c1</url>
 <url>https://github.com/vadz/libtiff/commit/0a76a8c765c7</url>
 <url>https://github.com/vadz/libtiff/commit/66e7bd595209</url>
 </references>
 <dates>
 <discovery>2017-04-01</discovery>
 <entry>2017-04-20</entry>
 </dates>
 </vuln>

<vuln vid="d44129d6-b22e-4e9c-b200-6a46e8bd3e60">
 <topic>libsamplerate -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libsamplerate</name>
	<name>linux-c6-libsamplerate</name>
	<name>linux-c7-libsamplerate</name>
	<range><lt>0.1.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7697">
	 In libsamplerate before 0.1.9, a buffer over-read
	 occurs in the calc_output_single function in src_sinc.c
	 via a crafted audio file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-7697</cvename>
 <url>https://github.com/erikd/libsamplerate/commit/c3b66186656d</url>
 </references>
 <dates>
 <discovery>2017-04-11</discovery>
 <entry>2017-04-20</entry>
 </dates>
 </vuln>

<vuln vid="5a97805e-93ef-4dcb-8d5e-dbcac263bfc2">
 <topic>libsndfile -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libsndfile</name>
	<name>linux-c6-libsndfile</name>
	<name>linux-c7-libsndfile</name>
	<range><lt>1.0.28_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7585">
	 In libsndfile before 1.0.28, an error in the
	 "flac_buffer_copy()" function (flac.c) can be exploited to
	 cause a stack-based buffer overflow via a specially crafted
	 FLAC file.
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7586">
	 In libsndfile before 1.0.28, an error in the
	 "header_read()" function (common.c) when handling ID3 tags
	 can be exploited to cause a stack-based buffer overflow
	 via a specially crafted FLAC file.
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7741">
	 In libsndfile before 1.0.28, an error in the
	 "flac_buffer_copy()" function (flac.c) can be exploited to
	 cause a segmentation violation (with write memory access)
	 via a specially crafted FLAC file during a resample
	 attempt, a similar issue to CVE-2017-7585.
	</blockquote>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7742">
	 In libsndfile before 1.0.28, an error in the
	 "flac_buffer_copy()" function (flac.c) can be exploited to
	 cause a segmentation violation (with read memory access)
	 via a specially crafted FLAC file during a resample
	 attempt, a similar issue to CVE-2017-7585.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-7585</cvename>
 <cvename>CVE-2017-7586</cvename>
 <cvename>CVE-2017-7741</cvename>
 <cvename>CVE-2017-7742</cvename>
 <url>https://github.com/erikd/libsndfile/commit/60b234301adf</url>
 <url>https://github.com/erikd/libsndfile/commit/708e996c87c5</url>
 <url>https://github.com/erikd/libsndfile/commit/f457b7b5ecfe</url>
 <url>https://github.com/erikd/libsndfile/commit/60b234301adf</url>
 </references>
 <dates>
 <discovery>2017-04-07</discovery>
 <entry>2017-04-20</entry>
 </dates>
 </vuln>

<vuln vid="3e2e9b44-25ce-11e7-a175-939b30e0836d">
 <topic>cURL -- TLS session resumption client cert bypass (again)</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.52.0</ge><lt>7.54.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cURL security advisory:
	<blockquote cite="https://curl.haxx.se/docs/adv_20170419.html">
	 libcurl would attempt to resume a TLS session even if the client
	 certificate had changed. That is unacceptable since a server by
	 specification is allowed to skip the client certificate check on
	 resume, and may instead use the old identity which was established
	 by the previous certificate (or no certificate).
	 libcurl supports by default the use of TLS session id/ticket to
	 resume previous TLS sessions to speed up subsequent TLS handshakes.
	 They are used when for any reason an existing TLS connection
	 couldn't be kept alive to make the next handshake faster.
	 This flaw is a regression and identical to CVE-2016-5419 reported
	 on August 3rd 2016, but affecting a different version range.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-7468</cvename>
 <url>https://curl.haxx.se/docs/adv_20170419.html</url>
 </references>
 <dates>
 <discovery>2017-04-19</discovery>
 <entry>2017-04-20</entry>
 </dates>
 </vuln>

<vuln vid="cf133acc-82e7-4755-a66a-5ddf90dacbe6">
 <topic>graphite2 -- out-of-bounds write with malicious font</topic>
 <affects>
 <package>
	<name>graphite2</name>
	<range><lt>1.3.9_1</lt></range>
 </package>
 <package>
	<name>linux-c7-graphite2</name>
	<range><lt>1.3.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
	 An out-of-bounds write in the Graphite 2 library
	 triggered with a maliciously crafted Graphite font. This
	 results in a potentially exploitable crash. This issue was
	 fixed in the Graphite 2 library as well as Mozilla
	 products.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5436</cvename>
 <url>https://github.com/silnrsi/graphite/commit/1ce331d5548b</url>
 </references>
 <dates>
 <discovery>2017-04-19</discovery>
 <entry>2017-04-19</entry>
 <modified>2017-04-20</modified>
 </dates>
 </vuln>

<vuln vid="b8ee7a81-a879-4358-9b30-7dd1bd4c14b1">
 <topic>libevent -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libevent</name>
	<name>libevent2</name>
	<name>linux-c6-libevent2</name>
	<name>linux-c7-libevent</name>
	<range><lt>2.1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian Security reports:
	<blockquote cite="https://security-tracker.debian.org/tracker/DSA-3789-1">
	 CVE-2016-10195: The name_parse function in evdns.c in
	 libevent before 2.1.6-beta allows remote attackers to have
	 unspecified impact via vectors involving the label_len
	 variable, which triggers an out-of-bounds stack read.
	 CVE-2016-10196: Stack-based buffer overflow in the
	 evutil_parse_sockaddr_port function in evutil.c in libevent
	 before 2.1.6-beta allows attackers to cause a denial of
	 service (segmentation fault) via vectors involving a long
	 string in brackets in the ip_as_string argument.
	 CVE-2016-10197: The search_make_new function in evdns.c
	 in libevent before 2.1.6-beta allows attackers to cause a
	 denial of service (out-of-bounds read) via an empty
	 hostname.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-10195</cvename>
 <cvename>CVE-2016-10196</cvename>
 <cvename>CVE-2016-10197</cvename>
 <url>http://www.openwall.com/lists/oss-security/2017/01/31/17</url>
 <url>https://github.com/libevent/libevent/issues/317</url>
 <url>https://github.com/libevent/libevent/issues/318</url>
 <url>https://github.com/libevent/libevent/issues/332</url>
 <url>https://github.com/libevent/libevent/issues/335</url>
 </references>
 <dates>
 <discovery>2017-01-31</discovery>
 <entry>2017-04-19</entry>
 </dates>
 </vuln>

<vuln vid="4cb165f0-6e48-423e-8147-92255d35c0f7">
 <topic>NSS -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>nss</name>
	<name>linux-f10-nss</name>
	<name>linux-c6-nss</name>
	<name>linux-c7-nss</name>
	<range><ge>3.30</ge><lt>3.30.1</lt></range>
	<range><ge>3.29</ge><lt>3.29.5</lt></range>
	<range><ge>3.22</ge><lt>3.28.4</lt></range>
	<range><lt>3.21.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
	 An out-of-bounds write during Base64 decoding operation
	 in the Network Security Services (NSS) library due to
	 insufficient memory being allocated to the buffer. This
	 results in a potentially exploitable crash. The NSS library
	 has been updated to fix this issue to address this issue and
	 Firefox 53 has been updated with NSS version 3.29.5.
	</blockquote>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
	 A flaw in DRBG number generation within the Network
	 Security Services (NSS) library where the internal state V
	 does not correctly carry bits over. The NSS library has been
	 updated to fix this issue to address this issue and Firefox
	 53 has been updated with NSS version 3.29.5.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5461</cvename>
 <cvename>CVE-2017-5462</cvename>
 <url>https://hg.mozilla.org/projects/nss/rev/99a86619eac9</url>
 <url>https://hg.mozilla.org/projects/nss/rev/e126381a3c29</url>
 </references>
 <dates>
 <discovery>2017-03-17</discovery>
 <entry>2017-04-19</entry>
 </dates>
 </vuln>

<vuln vid="5e0a038a-ca30-416d-a2f5-38cbf5e7df33">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>53.0_2,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49.1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><ge>46.0,1</ge><lt>52.1.0_2,1</lt></range>
	<range><lt>45.9.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><ge>46.0,2</ge><lt>52.1.0,2</lt></range>
	<range><lt>45.9.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><ge>46.0</ge><lt>52.1.0</lt></range>
	<range><lt>45.9.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><ge>46.0</ge><lt>52.1.0</lt></range>
	<range><lt>45.9.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5433</cvename>
 <cvename>CVE-2017-5435</cvename>
 <cvename>CVE-2017-5436</cvename>
 <cvename>CVE-2017-5461</cvename>
 <cvename>CVE-2017-5459</cvename>
 <cvename>CVE-2017-5466</cvename>
 <cvename>CVE-2017-5434</cvename>
 <cvename>CVE-2017-5432</cvename>
 <cvename>CVE-2017-5460</cvename>
 <cvename>CVE-2017-5438</cvename>
 <cvename>CVE-2017-5439</cvename>
 <cvename>CVE-2017-5440</cvename>
 <cvename>CVE-2017-5441</cvename>
 <cvename>CVE-2017-5442</cvename>
 <cvename>CVE-2017-5464</cvename>
 <cvename>CVE-2017-5443</cvename>
 <cvename>CVE-2017-5444</cvename>
 <cvename>CVE-2017-5446</cvename>
 <cvename>CVE-2017-5447</cvename>
 <cvename>CVE-2017-5465</cvename>
 <cvename>CVE-2017-5448</cvename>
 <cvename>CVE-2017-5437</cvename>
 <cvename>CVE-2017-5454</cvename>
 <cvename>CVE-2017-5455</cvename>
 <cvename>CVE-2017-5456</cvename>
 <cvename>CVE-2017-5469</cvename>
 <cvename>CVE-2017-5445</cvename>
 <cvename>CVE-2017-5449</cvename>
 <cvename>CVE-2017-5450</cvename>
 <cvename>CVE-2017-5451</cvename>
 <cvename>CVE-2017-5462</cvename>
 <cvename>CVE-2017-5463</cvename>
 <cvename>CVE-2017-5467</cvename>
 <cvename>CVE-2017-5452</cvename>
 <cvename>CVE-2017-5453</cvename>
 <cvename>CVE-2017-5458</cvename>
 <cvename>CVE-2017-5468</cvename>
 <cvename>CVE-2017-5430</cvename>
 <cvename>CVE-2017-5429</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/</url>
 </references>
 <dates>
 <discovery>2017-04-19</discovery>
 <entry>2017-04-19</entry>
 <modified>2017-09-19</modified>
 </dates>
 </vuln>

<vuln vid="d9e01c35-2531-11e7-b291-b499baebfeaf">
 <topic>MySQL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb55-server</name>
	<range><lt>5.5.55</lt></range>
 </package>
 <package>
	<name>mariadb100-server</name>
	<range><lt>10.0.31</lt></range>
 </package>
 <package>
	<name>mariadb101-server</name>
	<range><lt>10.1.23</lt></range>
 </package>
 <package>
	<name>mysql55-server</name>
	<range><lt>5.5.55</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.36</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html">
	 This Critical Patch Update contains 39 new security fixes for
	 Oracle MySQL. 11 of these vulnerabilities may be remotely
	 exploitable without authentication, i.e., may be exploited over a
	 network without requiring user credentials.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html</url>
 <cvename>CVE-2017-3308</cvename>
 <cvename>CVE-2017-3309</cvename>
 <cvename>CVE-2017-3450</cvename>
 <cvename>CVE-2017-3599</cvename>
 <cvename>CVE-2017-3329</cvename>
 <cvename>CVE-2017-3600</cvename>
 <cvename>CVE-2017-3331</cvename>
 <cvename>CVE-2017-3453</cvename>
 <cvename>CVE-2017-3452</cvename>
 <cvename>CVE-2017-3454</cvename>
 <cvename>CVE-2017-3455</cvename>
 <cvename>CVE-2017-3305</cvename>
 <cvename>CVE-2017-3460</cvename>
 <cvename>CVE-2017-3456</cvename>
 <cvename>CVE-2017-3458</cvename>
 <cvename>CVE-2017-3457</cvename>
 <cvename>CVE-2017-3459</cvename>
 <cvename>CVE-2017-3463</cvename>
 <cvename>CVE-2017-3462</cvename>
 <cvename>CVE-2017-3461</cvename>
 <cvename>CVE-2017-3464</cvename>
 <cvename>CVE-2017-3465</cvename>
 <cvename>CVE-2017-3467</cvename>
 <cvename>CVE-2017-3468</cvename>
 </references>
 <dates>
 <discovery>2017-04-19</discovery>
 <entry>2017-04-19</entry>
 </dates>
 </vuln>

<vuln vid="c6861494-1ffb-11e7-934d-d05099c0ae8c">
 <topic>BIND -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><lt>9.9.9P8</lt></range>
 </package>
 <package>
	<name>bind910</name>
	<range><lt>9.10.4P8</lt></range>
 </package>
 <package>
	<name>bind911</name>
	<range><lt>9.11.0P5</lt></range>
 </package>
 <package>
	<name>bind9-devel</name>
	<range><le>9.12.0.a.2017.03.25</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01465/0">
	 A query with a specific set of characteristics could
	 cause a server using DNS64 to encounter an assertion
	 failure and terminate.
	 An attacker could deliberately construct a query,
	 enabling denial-of-service against a server if it
	 was configured to use the DNS64 feature and other
	 preconditions were met.
	</blockquote>
	<blockquote cite="https://kb.isc.org/article/AA-01466/0">
	 Mistaken assumptions about the ordering of records in
	 the answer section of a response containing CNAME or
	 DNAME resource records could lead to a situation in
	 which named would exit with an assertion failure when
	 processing a response in which records occurred in an
	 unusual order.
	</blockquote>
	<blockquote cite="https://kb.isc.org/article/AA-01471/0">
	 named contains a feature which allows operators to
	 issue commands to a running server by communicating
	 with the server process over a control channel,
	 using a utility program such as rndc.
	 A regression introduced in a recent feature change
	 has created a situation under which some versions of
	 named can be caused to exit with a REQUIRE assertion
	 failure if they are sent a null command string.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-3136</cvename>
 <cvename>CVE-2017-3137</cvename>
 <cvename>CVE-2017-3138</cvename>
 <url>https://kb.isc.org/article/AA-01465/0</url>
 <url>https://kb.isc.org/article/AA-01466/0</url>
 <url>https://kb.isc.org/article/AA-01471/0</url>
 </references>
 <dates>
 <discovery>2017-04-12</discovery>
 <entry>2017-04-13</entry>
 <modified>2017-04-13</modified>
 </dates>
 </vuln>

<vuln vid="e48355d7-1548-11e7-8611-0090f5f2f347">
 <topic>id Tech 3 -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>ioquake3</name>
	<range><lt>1.36_16</lt></range>
 </package>
 <package>
	<name>ioquake3-devel</name>
	<range><lt>g2930</lt></range>
 </package>
 <package>
	<name>iourbanterror</name>
	<range><lt>4.3.2,1</lt></range>
 </package>
 <package>
	<name>openarena</name>
	<range><lt>0.8.8.s1910_3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The content auto-download of id Tech 3 can be used to deliver
	 maliciously crafted content, that triggers downloading of
	 further content and loading and executing it as native code
	 with user credentials. This affects ioquake3, ioUrbanTerror,
	 OpenArena, the original Quake 3 Arena and other forks.
 </body>
 </description>
 <references>
 <cvename>CVE-2017-6903</cvename>
 <url>https://ioquake3.org/2017/03/13/important-security-update-please-update-ioquake3-immediately/</url>
 </references>
 <dates>
 <discovery>2017-03-14</discovery>
 <entry>2017-04-07</entry>
 </dates>
 </vuln>

<vuln vid="90becf7c-1acf-11e7-970f-002590263bf5">
 <topic>xen-kernel -- broken check in memory_exchange() permits PV guest breakout</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.7.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-206.html">
	 The XSA-29 fix introduced an insufficient check on XENMEM_exchange
	 input, allowing the caller to drive hypervisor memory accesses
	 outside of the guest provided input/output arrays.
	 A malicious or buggy 64-bit PV guest may be able to access all of
	 system memory, allowing for all of privilege escalation, host
	 crashes, and information leaks.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-7228</cvename>
 <url>https://xenbits.xen.org/xsa/advisory-212.html</url>
 </references>
 <dates>
 <discovery>2017-04-04</discovery>
 <entry>2017-04-06</entry>
 </dates>
 </vuln>

<vuln vid="04f29189-1a05-11e7-bc6e-b499baebfeaf">
 <topic>cURL -- potential memory disclosure</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>6.5</ge><lt>7.53.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports:
	<blockquote cite="https://curl.haxx.se/docs/adv_20170403.html">
	 There were two bugs in curl's parser for the command line option
	 --write-out (or -w for short) that would skip the end of string
	 zero byte if the string ended in a % (percent) or \ (backslash),
	 and it would read beyond that buffer in the heap memory and it
	 could then potentially output pieces of that memory to the
	 terminal or the target file etc..
	 This flaw only exists in the command line tool.
	 We are not aware of any exploit of this flaw.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/adv_20170403.html</url>
 <cvename>CVE-2017-7407</cvename>
 </references>
 <dates>
 <discovery>2017-04-03</discovery>
 <entry>2017-04-05</entry>
 <modified>2017-04-06</modified>
 </dates>
 </vuln>

<vuln vid="dc880d6c-195d-11e7-8c63-0800277dcc69">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-django</name>
	<name>py33-django</name>
	<name>py34-django</name>
	<name>py35-django</name>
	<name>py36-django</name>
	<range><lt>1.8.18</lt></range>
 </package>
 <package>
	<name>py27-django18</name>
	<name>py33-django18</name>
	<name>py34-django18</name>
	<name>py35-django18</name>
	<name>py36-django18</name>
	<range><lt>1.8.18</lt></range>
 </package>
 <package>
	<name>py27-django19</name>
	<name>py33-django19</name>
	<name>py34-django19</name>
	<name>py35-django19</name>
	<name>py36-django19</name>
	<range><lt>1.9.13</lt></range>
 </package>
 <package>
	<name>py27-django110</name>
	<name>py33-django110</name>
	<name>py34-django110</name>
	<name>py35-django110</name>
	<name>py36-django110</name>
	<range><lt>1.10.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django team reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2017/apr/04/security-releases/">
	 These release addresses two security issues detailed below. We
	 encourage all users of Django to upgrade as soon as possible.
	<ul>
	<li>Open redirect and possible XSS attack via user-supplied numeric
	 redirect URLs</li>
	 <li>Open redirect vulnerability in django.views.static.serve()</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2017/apr/04/security-releases/</url>
 <cvename>CVE-2017-7233</cvename>
 <cvename>CVE-2017-7234</cvename>
 </references>
 <dates>
 <discovery>2017-04-04</discovery>
 <entry>2017-04-04</entry>
 </dates>
 </vuln>

<vuln vid="356b02e9-1954-11e7-9608-001999f8d30b">
 <topic>asterisk -- Buffer overflow in CDR's set user</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.14.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 No size checking is done when setting the user field
	 on a CDR. Thus, it is possible for someone to use an
	 arbitrarily large string and write past the end of the
	 user field storage buffer. This allows the possibility
	 of remote code injection.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2017-001.html</url>
 <url>https://issues.asterisk.org/jira/browse/ASTERISK-26897</url>
 </references>
 <dates>
 <discovery>2017-03-27</discovery>
 <entry>2017-04-04</entry>
 </dates>
 </vuln>

<vuln vid="057e6616-1885-11e7-bb4d-a0d3c19bfa21">
 <topic>NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler</topic>
 <affects>
 <package>
	<name>nvidia-driver</name>
	<range><lt>375.39</lt></range>
 </package>
 <package>
	<name>nvidia-driver-340</name>
	<range><lt>340.102</lt></range>
 </package>
 <package>
	<name>nvidia-driver-304</name>
	<range><lt>304.135</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVIDIA Unix security team reports:
	<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/4398">
	 NVIDIA GPU Display Driver contains vulnerabilities in the
	 kernel mode layer handler where multiple integer overflows,
	 improper access control, and improper validation of a user
	 input may cause a denial of service or potential escalation
	 of privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-0309</cvename>
 <cvename>CVE-2017-0310</cvename>
 <cvename>CVE-2017-0311</cvename>
 <cvename>CVE-2017-0318</cvename>
 <cvename>CVE-2017-0321</cvename>
 <url>http://nvidia.custhelp.com/app/answers/detail/a_id/4398</url>
 </references>
 <dates>
 <discovery>2017-02-14</discovery>
 <entry>2017-04-04</entry>
 </dates>
 </vuln>

<vuln vid="7cf058d8-158d-11e7-ba2c-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>57.0.2987.133</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html">
	 5 security fixes in this release, including:
	 <ul>
	 <li>[698622] Critical CVE-2017-5055: Use after free in printing. Credit to
	 Wadih Matar</li>
	 <li>[699166] High CVE-2017-5054: Heap buffer overflow in V8. Credit to
	 Nicolas Trippar of Zimperium zLabs</li>
	 <li>[662767] High CVE-2017-5052: Bad cast in Blink. Credit to
	 JeongHoon Shin</li>
	 <li>[705445] High CVE-2017-5056: Use after free in Blink. Credit to
	 anonymous</li>
	 <li>[702058] High CVE-2017-5053: Out of bounds memory access in V8. Credit to
	 Team Sniper (Keen Lab and PC Mgr) reported through ZDI (ZDI-CAN-4587)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5055</cvename>
 <cvename>CVE-2017-5054</cvename>
 <cvename>CVE-2017-5052</cvename>
 <cvename>CVE-2017-5056</cvename>
 <cvename>CVE-2017-5053</cvename>
 <url>https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html</url>
 </references>
 <dates>
 <discovery>2017-03-29</discovery>
 <entry>2017-03-30</entry>
 </dates>
 </vuln>

<vuln vid="47873d72-14eb-11e7-970f-002590263bf5">
 <topic>xen-tools -- xenstore denial of service via repeated update</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><lt>4.7.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-206.html">
	 Unprivileged guests may be able to stall progress of the control
	 domain or driver domain, possibly leading to a Denial of Service
	 (DoS) of the entire host.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://xenbits.xen.org/xsa/advisory-206.html</url>
 </references>
 <dates>
 <discovery>2017-03-28</discovery>
 <entry>2017-03-30</entry>
 </dates>
 </vuln>

<vuln vid="68611303-149e-11e7-b9bb-6805ca0b3d42">
 <topic>phpMyAdmin -- bypass 'no password' restriction</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>4.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-8/">
	 <h3>Summary</h3>
	 Bypass $cfg['Servers'][$i]['AllowNoPassword']
	 <h3>Description</h3>
	 A vulnerability was discovered where the restrictions
	 caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are
	 bypassed under certain PHP versions. This can allow the
	 login of users who have no password set even if the
	 administrator has set $cfg['Servers'][$i]['AllowNoPassword']
	 to false (which is also the default).
	 This behavior depends on the PHP version used (it seems
	 PHP 5 is affected, while PHP 7.0 is not).
	 <h3>Severity</h3>
	 We consider this vulnerability to be of moderate severity.
	 <h3>Mitigation factor</h3>
	 Set a password for all users.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2017-8/</url>
 </references>
 <dates>
 <discovery>2017-03-28</discovery>
 <entry>2017-03-29</entry>
 </dates>
 </vuln>

<vuln vid="2826317b-10ec-11e7-944e-000c292e4fd8">
 <topic>samba -- symlink race allows access outside share definition</topic>
 <affects>
 <package>
	<name>samba36</name>
	<range><ge>3.6.0</ge><le>3.6.25_4</le></range>
 </package>
 <package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><le>4.0.26</le></range>
 </package>
 <package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><le>4.1.23</le></range>
 </package>
 <package>
	<name>samba42</name>
	<range><ge>4.2.0</ge><le>4.2.14</le></range>
 </package>
 <package>
	<name>samba43</name>
	<range><ge>4.3.0</ge><le>4.3.13</le></range>
 </package>
 <package>
	<name>samba44</name>
	<range><ge>4.4.0</ge><lt>4.4.12</lt></range>
 </package>
 <package>
	<name>samba45</name>
	<range><ge>4.5.0</ge><lt>4.5.7</lt></range>
 </package>
 <package>
	<name>samba46</name>
	<range><ge>4.6.0</ge><lt>4.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samba team reports:
	<blockquote cite="https://www.samba.org/samba/security/CVE-2017-2619.html">
	 A time-of-check, time-of-use race condition
	 can allow clients to access non-exported parts
	 of the file system via symlinks.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.samba.org/samba/security/CVE-2017-2619.html</url>
 <cvename>CVE-2017-2619</cvename>
 </references>
 <dates>
 <discovery>2017-03-23</discovery>
 <entry>2017-03-24</entry>
 </dates>
 </vuln>

<vuln vid="af19ecd0-0f6a-11e7-970f-002590263bf5">
 <topic>xen-tools -- Cirrus VGA Heap overflow via display refresh</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><lt>4.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-211.html">
	 A privileged user within the guest VM can cause a heap overflow in
	 the device model process, potentially escalating their privileges to
	 that of the device model process.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9603</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-211.html</url>
 </references>
 <dates>
 <discovery>2017-03-14</discovery>
 <entry>2017-03-23</entry>
 </dates>
 </vuln>

<vuln vid="06f931c0-0be0-11e7-b4bf-5404a68ad561">
 <topic>irssi -- use-after-free potential code execution</topic>
 <affects>
 <package>
	<name>irssi</name>
	<range><gt>0.8.21,1</gt><lt>1.0.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The irssi project reports:
	<blockquote cite="https://irssi.org/security/irssi_sa_2017_03.txt">
	 Use after free while producing list of netjoins (CWE-416).
 This issue was found and reported to us by APic.
 This issue usually leads to segmentation faults.
 Targeted code execution should be difficult.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://irssi.org/security/irssi_sa_2017_03.txt</url>
 <cvename>CVE-2017-7191</cvename>
 </references>
 <dates>
 <discovery>2017-03-11</discovery>
 <entry>2017-03-18</entry>
 </dates>
 </vuln>

<vuln vid="7c27192f-0bc3-11e7-9940-b499baebfeaf">
 <topic>mysql -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>mariadb55-client</name>
	<range><le>5.5.54</le></range>
 </package>
 <package>
	<name>mariadb100-client</name>
	<range><lt>10.0.30</lt></range>
 </package>
 <package>
	<name>mariadb101-client</name>
	<range><lt>10.1.22</lt></range>
 </package>
 <package>
	<name>mysql55-client</name>
	<range><le>5.5.54</le></range>
 </package>
 <package>
	<name>mysql56-client</name>
	<range><lt>5.6.21</lt></range>
 </package>
 <package>
	<name>mysql57-client</name>
	<range><lt>5.7.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Openwall reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2017/02/11/11">
	 C client library for MySQL (libmysqlclient.so) has
	 use-after-free defect which can cause crash of applications
	 using that MySQL client.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2017/02/11/11</url>
 <cvename>CVE-2017-3302</cvename>
 </references>
 <dates>
 <discovery>2017-01-27</discovery>
 <entry>2017-03-18</entry>
 </dates>
 </vuln>

<vuln vid="5f453b69-abab-4e76-b6e5-2ed0bafcaee3">
 <topic>firefox -- integer overflow in createImageBitmap()</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>52.0.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-08/">
	 An integer overflow in createImageBitmap() was reported
	 through the Pwn2Own contest. The fix for this vulnerability
	 disables the experimental extensions to the
	 createImageBitmap API. This function runs in the content
	 sandbox, requiring a second vulnerability to compromise a
	 user's computer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5428</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2017-08/</url>
 </references>
 <dates>
 <discovery>2017-03-17</discovery>
 <entry>2017-03-18</entry>
 </dates>
 </vuln>

<vuln vid="df45b4bd-0b7f-11e7-970f-002590263bf5">
 <topic>moodle -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moodle29</name>
	<range><le>2.9.9</le></range>
 </package>
 <package>
	<name>moodle30</name>
	<range><lt>3.0.9</lt></range>
 </package>
 <package>
	<name>moodle31</name>
	<range><lt>3.1.5</lt></range>
 </package>
 <package>
	<name>moodle32</name>
	<range><lt>3.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marina Glancy reports:
	<blockquote cite="https://moodle.org/news/#p1408104">
	 In addition to a number of bug fixes and small improvements,
	 security vulnerabilities have been discovered and fixed. We highly
	 recommend that you upgrade your sites as soon as possible.
	 Upgrading should be very straightforward. As per our usual policy,
	 admins of all registered Moodle sites will be notified of security
	 issue details directly via email and we'll publish details more
	 widely in a week.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://moodle.org/news/#p1408104</url>
 </references>
 <dates>
 <discovery>2017-03-13</discovery>
 <entry>2017-03-18</entry>
 </dates>
 </vuln>

<vuln vid="f72d98d1-0b7e-11e7-970f-002590263bf5">
 <topic>moodle -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moodle29</name>
	<range><le>2.9.9</le></range>
 </package>
 <package>
	<name>moodle30</name>
	<range><lt>3.0.8</lt></range>
 </package>
 <package>
	<name>moodle31</name>
	<range><lt>3.1.4</lt></range>
 </package>
 <package>
	<name>moodle32</name>
	<range><lt>3.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marina Glancy reports:
	<blockquote cite="https://moodle.org/security/">
	 <ul>
	 <li>MSA-17-0001: System file inclusion when adding own preset
	 file in Boost theme</li>
	 <li>MSA-17-0002: Incorrect sanitation of attributes in forums
	 </li>
	 <li>MSA-17-0003: PHPMailer vulnerability in no-reply address
	 </li>
	 <li>MSA-17-0004: XSS in assignment submission page</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-2576</cvename>
 <cvename>CVE-2017-2578</cvename>
 <cvename>CVE-2016-10045</cvename>
 <url>https://moodle.org/security/</url>
 </references>
 <dates>
 <discovery>2017-01-17</discovery>
 <entry>2017-03-18</entry>
 <modified>2020-06-24</modified>
 </dates>
 </vuln>

<vuln vid="2730c668-0b1c-11e7-8d52-6cf0497db129">
 <topic>drupal8 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal8</name>
	<range><lt>8.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/SA-2017-001">
	 CVE-2017-6377: Editor module incorrectly checks access to inline private files
	 CVE-2017-6379: Some admin paths were not protected with a CSRF token
	 CVE-2017-6381: Remote code execution
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-6377</cvename>
 <cvename>CVE-2017-6379</cvename>
 <cvename>CVE-2017-6381</cvename>
 <url>https://www.drupal.org/SA-2017-001</url>
 </references>
 <dates>
 <discovery>2017-03-15</discovery>
 <entry>2017-03-17</entry>
 </dates>
 </vuln>

<vuln vid="9b973e97-0a99-11e7-ace7-080027ef73ec">
 <topic>PuTTY -- integer overflow permits memory overwrite by forwarded ssh-agent connections</topic>
 <affects>
 <package>
	<name>putty</name>
	<range><lt>0.68</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon G. Tatham reports:
	<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html">
	 Many versions of PuTTY prior to 0.68 have a heap-corrupting integer
	 overflow bug in the ssh_agent_channel_data function which processes
	 messages sent by remote SSH clients to a forwarded agent connection. [...]
	 This bug is only exploitable at all if you have enabled SSH
	 agent forwarding, which is turned off by default. Moreover, an
	 attacker able to exploit this bug would have to have already be able
	 to connect to the Unix-domain socket representing the forwarded
	 agent connection. Since any attacker with that capability would
	 necessarily already be able to generate signatures with your agent's
	 stored private keys, you should in normal circumstances be defended
	 against this vulnerability by the same precautions you and your
	 operating system were already taking to prevent untrusted people
	 from accessing your SSH agent.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html</url>
 <cvename>CVE-2017-6542</cvename>
 </references>
 <dates>
 <discovery>2017-01-29</discovery>
 <entry>2017-03-16</entry>
 </dates>
 </vuln>

<vuln vid="4ffb633c-0a3b-11e7-a9f2-0011d823eebd">
 <topic>Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>25.0.0.127</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-07.html">
	 <ul>
	 <li>These updates resolve a buffer overflow vulnerability that
	 could lead to code execution (CVE-2017-2997).</li>
	 <li>These updates resolve memory corruption vulnerabilities that
	 could lead to code execution (CVE-2017-2998, CVE-2017-2999).</li>
	 <li>These updates resolve a random number generator vulnerability
	 used for constant blinding that could lead to information
	 disclosure (CVE-2017-3000).</li>
	 <li>These updates resolve use-after-free vulnerabilities that
	 could lead to code execution (CVE-2017-3001, CVE-2017-3002,
	 CVE-2017-3003).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-2997</cvename>
 <cvename>CVE-2017-2998</cvename>
 <cvename>CVE-2017-2999</cvename>
 <cvename>CVE-2017-3000</cvename>
 <cvename>CVE-2017-3001</cvename>
 <cvename>CVE-2017-3002</cvename>
 <cvename>CVE-2017-3003</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb17-07.html</url>
 </references>
 <dates>
 <discovery>2017-03-14</discovery>
 <entry>2017-03-16</entry>
 </dates>
 </vuln>

<vuln vid="f41e3e54-076b-11e7-a9f2-0011d823eebd">
 <topic>mbed TLS (PolarSSL) -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mbedtls</name>
	<range><lt>2.4.2</lt></range>
 </package>
 <package>
	<name>polarssl13</name>
	<range><lt>1.3.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Janos Follath reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01">
	 <ul>
	 <li>If a malicious peer supplies a certificate with a specially
	 crafted secp224k1 public key, then an attacker can cause the
	 server or client to attempt to free block of memory held on
	 stack. Depending on the platform, this could result in a Denial
	 of Service (client crash) or potentially could be exploited to
	 allow remote code execution with the same privileges as the host
	 application.</li>
	 <li>If the client and the server both support MD5 and the client
	 can be tricked to authenticate to a malicious server, then the
	 malicious server can impersonate the client. To launch this man
	 in the middle attack, the adversary has to compute a
	 chosen-prefix MD5 collision in real time. This is very expensive
	 computationally, but can be practical. Depending on the
	 platform, this could result in a Denial of Service (client crash)
	 or potentially could be exploited to allow remote code execution
	 with the same privileges as the host application.</li>
	 <li>A bug in the logic of the parsing of a PEM encoded Certificate
	 Revocation List in mbedtls_x509_crl_parse() can result in an
	 infinite loop. In versions before 1.3.10 the same bug results in
	 an infinite recursion stack overflow that usually crashes the
	 application. Methods and means of acquiring the CRLs is not part
	 of the TLS handshake and in the strict TLS setting this
	 vulnerability cannot be triggered remotely. The vulnerability
	 cannot be triggered unless the application explicitly calls
	 mbedtls_x509_crl_parse() or mbedtls_x509_crl_parse_file()on a PEM
	 formatted CRL of untrusted origin. In which case the
	 vulnerability can be exploited to launch a denial of service
	 attack against the application.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01</url>
 </references>
 <dates>
 <discovery>2017-03-11</discovery>
 <entry>2017-03-12</entry>
 </dates>
 </vuln>

<vuln vid="a505d397-0758-11e7-8d8b-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>57.0.2987.98</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html">
	 36 security fixes in this release
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5030</cvename>
 <cvename>CVE-2017-5031</cvename>
 <cvename>CVE-2017-5032</cvename>
 <cvename>CVE-2017-5029</cvename>
 <cvename>CVE-2017-5034</cvename>
 <cvename>CVE-2017-5035</cvename>
 <cvename>CVE-2017-5036</cvename>
 <cvename>CVE-2017-5037</cvename>
 <cvename>CVE-2017-5039</cvename>
 <cvename>CVE-2017-5040</cvename>
 <cvename>CVE-2017-5041</cvename>
 <cvename>CVE-2017-5033</cvename>
 <cvename>CVE-2017-5042</cvename>
 <cvename>CVE-2017-5038</cvename>
 <cvename>CVE-2017-5043</cvename>
 <cvename>CVE-2017-5044</cvename>
 <cvename>CVE-2017-5045</cvename>
 <cvename>CVE-2017-5046</cvename>
 <url>https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2017-03-09</discovery>
 <entry>2017-03-12</entry>
 </dates>
 </vuln>

<vuln vid="89cf8cd2-0698-11e7-aa3f-001b216d295b">
 <topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic>
 <affects>
 <package>
	<name>bouncycastle15</name>
	<range><ge>1.51</ge><lt>1.56</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Legion of the Bouncy Castle reports:
	<blockquote cite="https://www.bouncycastle.org/releasenotes.html">
	 Release: 1.56
	 2.1.4 Security Related Changes and CVE's Addressed by this Release: (multiple)
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/215507</freebsdpr>
 <url>https://www.bouncycastle.org/releasenotes.html</url>
 </references>
 <dates>
 <discovery>2016-12-23</discovery>
 <entry>2017-03-12</entry>
 </dates>
 </vuln>

<vuln vid="41fe4724-06a2-11e7-8e3e-5453ed2e2b49">
 <topic>kde-runtime -- kdesu: displayed command truncated by unicode string terminator</topic>
 <affects>
 <package>
	<name>kde-runtime</name>
	<range><lt>4.14.3_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Albert Aastals Cid reports:
	<blockquote cite="https://www.kde.org/info/security/advisory-20160930-1.txt">
	 A maliciously crafted command line for kdesu can result in the
	 user only seeing part of the commands that will actually get executed
	 as super user.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-7787</cvename>
 <mlist>http://www.openwall.com/lists/oss-security/2016/09/29/7</mlist>
 <url>https://www.kde.org/info/security/advisory-20160930-1.txt</url>
 </references>
 <dates>
 <discovery>2016-09-30</discovery>
 <entry>2017-03-11</entry>
 </dates>
 </vuln>

<vuln vid="e550fc62-069a-11e7-8e3e-5453ed2e2b49">
 <topic>kdepimlibs -- directory traversal on KTNEF</topic>
 <affects>
 <package>
	<name>kdepimlibs</name>
	<range><lt>4.14.10_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Albert Aastals Cid reports:
	<blockquote cite="https://www.kde.org/info/security/advisory-20170227-1.txt">
	 A directory traversal issue was found in KTNEF which can be
	 exploited by tricking a user into opening a malicious winmail.dat
	 file. The issue allows to write files with the permission of the user
	 opening the winmail.dat file during extraction.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.kde.org/info/security/advisory-20170227-1.txt</url>
 </references>
 <dates>
 <discovery>2017-02-27</discovery>
 <entry>2017-03-11</entry>
 </dates>
 </vuln>

<vuln vid="f714d8ab-028e-11e7-8042-50e549ebab6c">
 <topic>kio: Information Leak when accessing https when using a malicious PAC file</topic>
 <affects>
 <package>
	<name>kdelibs</name>
	<range><lt>4.14.29_10</lt></range>
 </package>
 <package>
	<name>kf5-kio</name>
	<range><lt>5.31.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Albert Astals Cid reports:
 <blockquote cite="https://www.kde.org/info/security/advisory-20170228-1.txt">
	 Using a malicious PAC file, and then using exfiltration methods in the PAC
	 function FindProxyForURL() enables the attacker to expose full https URLs.
	 This is a security issue since https URLs may contain sensitive
	 information in the URL authentication part (user:password@host), and in the
	 path and the query (e.g. access tokens).
	 This attack can be carried out remotely (over the LAN) since proxy settings
	 allow "Detect Proxy Configuration Automatically".
	 This setting uses WPAD to retrieve the PAC file, and an attacker who has access
	 to the victim's LAN can interfere with the WPAD protocols (DHCP/DNS+HTTP)
	 and inject his/her own malicious PAC instead of the legitimate one.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.kde.org/info/security/advisory-20170228-1.txt</url>
 </references>
 <dates>
 <discovery>2017-02-28</discovery>
 <entry>2017-03-11</entry>
 </dates>
 </vuln>

<vuln vid="82752070-0349-11e7-b48d-00e04c1ea73d">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.7.3,1</lt></range>
	</package>
	<package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.7.3</lt></range>
	</package>
	</affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/">
		WordPress versions 4.7.2 and earlier are affected by six security issues.
		<ul>
		<li>Cross-site scripting (XSS) via media file metadata.</li>
		<li>Control characters can trick redirect URL validation.</li>
		<li>Unintended files can be deleted by administrators using the
			plugin deletion functionality.</li>
		<li>Cross-site scripting (XSS) via video URL in YouTube embeds.</li>
		<li>Cross-site scripting (XSS) via taxonomy term names.</li>
		<li>Cross-site request forgery (CSRF) in Press This leading to
			excessive use of server resources.</li>
	</ul>
	</blockquote>
 </body>
 </description>
 <references>
	<url>http://www.openwall.com/lists/oss-security/2017/03/07/3</url>
	<url>https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2017-03-07</discovery>
 <entry>2017-03-07</entry>
 </dates>
 </vuln>

<vuln vid="96eca031-1313-4daf-9be2-9d6e1c4f1eb5">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>52.0_1,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.49</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><ge>46.0,1</ge><lt>52.0,1</lt></range>
	<range><lt>45.8.0_1,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><ge>46.0,2</ge><lt>52.0,2</lt></range>
	<range><lt>45.8.0_1,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><ge>46.0</ge><lt>52.0</lt></range>
	<range><lt>45.8.0_1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><ge>46.0</ge><lt>52.0</lt></range>
	<range><lt>45.8.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-05/">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5400</cvename>
 <cvename>CVE-2017-5401</cvename>
 <cvename>CVE-2017-5402</cvename>
 <cvename>CVE-2017-5403</cvename>
 <cvename>CVE-2017-5404</cvename>
 <cvename>CVE-2017-5406</cvename>
 <cvename>CVE-2017-5407</cvename>
 <cvename>CVE-2017-5410</cvename>
 <cvename>CVE-2017-5411</cvename>
 <cvename>CVE-2017-5409</cvename>
 <cvename>CVE-2017-5408</cvename>
 <cvename>CVE-2017-5412</cvename>
 <cvename>CVE-2017-5413</cvename>
 <cvename>CVE-2017-5414</cvename>
 <cvename>CVE-2017-5415</cvename>
 <cvename>CVE-2017-5416</cvename>
 <cvename>CVE-2017-5417</cvename>
 <cvename>CVE-2017-5425</cvename>
 <cvename>CVE-2017-5426</cvename>
 <cvename>CVE-2017-5427</cvename>
 <cvename>CVE-2017-5418</cvename>
 <cvename>CVE-2017-5419</cvename>
 <cvename>CVE-2017-5420</cvename>
 <cvename>CVE-2017-5405</cvename>
 <cvename>CVE-2017-5421</cvename>
 <cvename>CVE-2017-5422</cvename>
 <cvename>CVE-2017-5399</cvename>
 <cvename>CVE-2017-5398</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2017-05/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2017-06/</url>
 </references>
 <dates>
 <discovery>2017-03-07</discovery>
 <entry>2017-03-07</entry>
 </dates>
 </vuln>

<vuln vid="71ebbc50-01c1-11e7-ae1b-002590263bf5">
 <topic>codeigniter -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>codeigniter</name>
	<range><lt>3.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The CodeIgniter changelog reports:
	<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
	 Fixed an XSS vulnerability in Security Library method xss_clean().
	 
	 Fixed a possible file inclusion vulnerability in Loader Library
	 method vars().
	 Fixed a possible remote code execution vulnerability in the Email
	 Library when ‘mail’ or ‘sendmail’ are used (thanks to Paul Buonopane
	 from NamePros).
	 Added protection against timing side-channel attacks in Security
	 Library method csrf_verify().
	 Added protection against BREACH attacks targeting the CSRF token
	 field generated by Form Helper function form_open().
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.codeigniter.com/user_guide/changelog.html</url>
 </references>
 <dates>
 <discovery>2017-01-09</discovery>
 <entry>2017-03-05</entry>
 </dates>
 </vuln>

<vuln vid="7b35a77a-0151-11e7-ae1b-002590263bf5">
 <topic>ikiwiki -- authentication bypass vulnerability</topic>
 <affects>
 <package>
	<name>ikiwiki</name>
	<range><lt>3.20170111</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ikiwiki reports:
	<blockquote cite="https://ikiwiki.info/security/#index48h2">
	 The ikiwiki maintainers discovered further flaws similar to
	 CVE-2016-9646 in the passwordauth plugin's use of
	 CGI::FormBuilder, with a more serious impact:
	 An attacker who can log in to a site with a password can log in as
	 a different and potentially more privileged user.
	 An attacker who can create a new account can set arbitrary fields
	 in the user database for that account
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-0356</cvename>
 <url>https://ikiwiki.info/security/#index48h2</url>
 </references>
 <dates>
 <discovery>2017-01-11</discovery>
 <entry>2017-03-05</entry>
 </dates>
 </vuln>

<vuln vid="5ed094a0-0150-11e7-ae1b-002590263bf5">
 <topic>ikiwiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ikiwiki</name>
	<range><lt>3.20161229</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10026">
	 ikiwiki 3.20161219 does not properly check if a revision changes
	 the access permissions for a page on sites with the git and
	 recentchanges plugins and the CGI interface enabled, which allows
	 remote attackers to revert certain changes by leveraging permissions
	 to change the page before the revision was made.
	</blockquote>
	<blockquote cite="https://ikiwiki.info/security/#index47h2">
	 When CGI::FormBuilder-&gt;field("foo") is called in list context
	 (and in particular in the arguments to a subroutine that takes named
	 arguments), it can return zero or more values for foo from the CGI
	 request, rather than the expected single value. This breaks the
	 usual Perl parsing convention for named arguments, similar to
	 CVE-2014-1572 in Bugzilla (which was caused by a similar API design
	 issue in CGI.pm).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-10026</cvename>
 <cvename>CVE-2016-9645</cvename>
 <cvename>CVE-2016-9646</cvename>
 <url>https://ikiwiki.info/security/#index46h2</url>
 <url>https://ikiwiki.info/security/#index47h2</url>
 </references>
 <dates>
 <discovery>2016-12-19</discovery>
 <entry>2017-03-05</entry>
 </dates>
 </vuln>

<vuln vid="f4eb9a25-fde0-11e6-9ad0-b8aeed92ecc4">
 <topic>potrace -- multiple memory failure</topic>
 <affects>
 <package>
	<name>potrace</name>
	<range><lt>1.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	potrace reports:
	<blockquote cite="https://sourceforge.net/p/potrace/news/2017/02/potrace-114-released/">
	 CVE-2016-8685: invalid memory access in findnext
	 CVE-2016-8686: memory allocation failure
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://sourceforge.net/p/potrace/news/2017/02/potrace-114-released/</url>
 <cvename>CVE-2016-8685</cvename>
 <cvename>CVE-2016-8686</cvename>
 </references>
 <dates>
 <discovery>2016-10-15</discovery>
 <entry>2017-02-28</entry>
 </dates>
 </vuln>

<vuln vid="765d165b-fbfe-11e6-aae7-5404a68ad561">
 <topic>MPD -- buffer overflows in http output</topic>
 <affects>
 <package>
	<name>musicpd</name>
	<range><lt>0.20.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MPD project reports:
	<blockquote cite="http://git.musicpd.org/cgit/master/mpd.git/plain/NEWS?h=v0.20.5">
	 httpd: fix two buffer overflows in IcyMetaData length calculation
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://git.musicpd.org/cgit/master/mpd.git/plain/NEWS?h=v0.20.5</url>
 </references>
 <dates>
 <discovery>2017-02-18</discovery>
 <entry>2017-02-26</entry>
 </dates>
 </vuln>

<vuln vid="311e4b1c-f8ee-11e6-9940-b499baebfeaf">
 <topic>cURL -- ocsp status validation error</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.52.0</ge><lt>7.53.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports:
	<blockquote cite="https://curl.haxx.se/docs/adv_20170222.html">
	 SSL_VERIFYSTATUS ignored 
	 curl and libcurl support "OCSP stapling", also known as the TLS
	 Certificate Status Request extension (using the
	 CURLOPT_SSL_VERIFYSTATUS option). When telling curl to use this
	 feature, it uses that TLS extension to ask for a fresh proof of
	 the server's certificate's validity. If the server doesn't support
	 the extension, or fails to provide said proof, curl is expected to
	 return an error. 
	 Due to a coding mistake, the code that checks for a test success or
	 failure, ends up always thinking there's valid proof, even when
	 there is none or if the server doesn't support the TLS extension in
	 question. Contrary to how it used to function and contrary to how
	 this feature is documented to work. 
	 This could lead to users not detecting when a server's certificate
	 goes invalid or otherwise be mislead that the server is in a better
	 shape than it is in reality.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/adv_20170222.html</url>
 <cvename>CVE-2017-2629</cvename>
 </references>
 <dates>
 <discovery>2017-02-22</discovery>
 <entry>2017-02-22</entry>
 </dates>
 </vuln>

<vuln vid="8cbd9c08-f8b9-11e6-ae1b-002590263bf5">
 <topic>xen-tools -- cirrus_bitblt_cputovideo does not check if memory region is safe</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><lt>4.7.1_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-209.html">
	 In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine
	 cirrus_bitblt_cputovideo fails to check whether the specified
	 memory region is safe. A malicious guest administrator can cause
	 an out of bounds memory write, very likely exploitable as a
	 privilege escalation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-2620</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-209.html</url>
 </references>
 <dates>
 <discovery>2017-02-21</discovery>
 <entry>2017-02-22</entry>
 </dates>
 </vuln>

<vuln vid="786a7d87-f826-11e6-9436-14dae9d5a9d2">
 <topic>fbsdmon -- information disclosure vulnerability</topic>
 <affects>
 <package>
	<name>fbsdmon</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Alan Somers reports:
	<blockquote cite="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217099">
	 The web site used by this port, http://fbsdmon.org, has been taken over by cybersquatters. That means that users are sending their system info to an unknown party.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217099</url>
 </references>
 <dates>
 <discovery>2017-02-14</discovery>
 <entry>2017-02-21</entry>
 </dates>
 </vuln>

<vuln vid="f1075415-f5e9-11e6-a4e2-5404a68ad561">
 <topic>wavpack -- multiple invalid memory reads</topic>
 <affects>
 <package>
	<name>wavpack</name>
	<range><lt>5.1.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	David Bryant reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2017/01/23/4">
	 global buffer overread in read_code / read_words.c
	 heap out of bounds read in WriteCaffHeader / caff.c
	 heap out of bounds read in unreorder_channels / wvunpack.c
	 heap oob read in read_new_config_info / open_utils.c
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2017/01/23/4</url>
 <cvename>CVE-2016-10169</cvename>
 <cvename>CVE-2016-10170</cvename>
 <cvename>CVE-2016-10171</cvename>
 <cvename>CVE-2016-10172</cvename>
 <url>https://github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc</url>
 </references>
 <dates>
 <discovery>2017-01-21</discovery>
 <entry>2017-02-18</entry>
 </dates>
 </vuln>

<vuln vid="8fedf75c-ef2f-11e6-900e-003048f78448">
 <topic>optipng -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>optipng</name>
	<range><lt>0.7.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7802">
	 ifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2191">
	 The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of delta escapes in a crafted BMP image.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3981">
	 Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3982">
	 Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, which triggers a heap-based buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7802</cvename>
 <cvename>CVE-2016-2191</cvename>
 <cvename>CVE-2016-3981</cvename>
 <cvename>CVE-2016-3982</cvename>
 </references>
 <dates>
 <discovery>2015-10-09</discovery>
 <entry>2017-02-16</entry>
 </dates>
 </vuln>

<vuln vid="1a802ba9-f444-11e6-9940-b499baebfeaf">
 <topic>openssl -- crash on handshake</topic>
 <affects>
 <package>
	<name>openssl-devel</name>
	<range><lt>1.1.0e</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20170216.txt">
	 Severity: High 
	 During a renegotiation handshake if the Encrypt-Then-Mac
	 extension is negotiated where it was not in the original
	 handshake (or vice-versa) then this can cause OpenSSL to
	 crash (dependent on ciphersuite). Both clients and servers
	 are affected. 
	 This issue does not affect OpenSSL version 1.0.2.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20170216.txt</url>
 <cvename>CVE-2017-3733</cvename>
 </references>
 <dates>
 <discovery>2017-02-16</discovery>
 <entry>2017-02-16</entry>
 </dates>
 </vuln>

<vuln vid="077bbadf-f2f4-11e6-92a7-902b34361349">
 <topic>diffoscope -- arbitrary file write</topic>
 <affects>
 <package>
	<name>py34-diffoscope</name>
	<name>py35-diffoscope</name>
	<name>py36-diffoscope</name>
	<range><ge>67</ge><lt>76</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ximin Luo reports:
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723">
	 [v67] introduced a security hole where diffoscope may write to
	 arbitrary locations on disk depending on the contents of an
	 untrusted archive.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-0359</cvename>
 <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723</url>
 </references>
 <dates>
 <discovery>2017-02-09</discovery>
 <entry>2017-02-14</entry>
 <modified>2017-02-16</modified>
 </dates>
 </vuln>

<vuln vid="7f9b696f-f11b-11e6-b50e-5404a68ad561">
 <topic>ffmpeg -- heap overflow in lavf/mov.c</topic>
 <affects>
 <package>
	<name>ffmpeg</name>
	<range><lt>3.2.4,1</lt></range>
 </package>
 <package>
	<name>mythtv</name>
	<name>mythtv-frontend</name>
	
	<range><lt>29.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	FFmpeg security reports:
	<blockquote cite="https://www.ffmpeg.org/security.html">
	 FFmpeg 3.2.4 fixes the following vulnerabilities:
	 CVE-2017-5024, CVE-2017-5025
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5024</cvename>
 <url>https://www.ffmpeg.org/security.html</url>
 <url>https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html</url>
 <cvename>CVE-2017-5025</cvename>
 <url>https://www.ffmpeg.org/security.html</url>
 <url>https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2017-01-25</discovery>
 <entry>2017-02-12</entry>
 <modified>2018-03-25</modified>
 </dates>
 </vuln>

<vuln vid="79bbb8f8-f049-11e6-8a6a-bcaec565249c">
 <topic>gtk-vnc -- bounds checking vulnerabilities</topic>
 <affects>
 <package>
	<name>gtk-vnc</name>
	<range><lt>0.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Daniel P. Berrange reports:
	<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2017-February/msg00015.html">
	 CVE-2017-5884 - fix bounds checking for RRE, hextile and
	 copyrect encodings
	 CVE-2017-5885 - fix color map index bounds checking.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mail.gnome.org/archives/ftp-release-list/2017-February/msg00015.html</url>
 <cvename>CVE-2017-5884</cvename>
 <cvename>CVE-2017-5885</cvename>
 </references>
 <dates>
 <discovery>2017-02-09</discovery>
 <entry>2017-02-11</entry>
 </dates>
 </vuln>

<vuln vid="a73aba9a-effe-11e6-ae1b-002590263bf5">
 <topic>xen-tools -- oob access in cirrus bitblt copy</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><lt>4.7.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-208.html">
	 When doing bitblt copy backwards, qemu should negate the blit
	 width. This avoids an oob access before the start of video
	 memory.
	 A malicious guest administrator can cause an out of bounds memory
	 access, possibly leading to information disclosure or privilege
	 escalation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-2615</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-208.html</url>
 </references>
 <dates>
 <discovery>2017-02-10</discovery>
 <entry>2017-02-11</entry>
 </dates>
 </vuln>

<vuln vid="fb74eacc-ec8a-11e6-bc8a-0011d823eebd">
 <topic>tiff -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>tiff</name>
	<range><lt>4.0.7</lt></range>
 </package>
 <package>
	<name>linux-c6-libtiff</name>
	<name>linux-c6-tiff</name>
	<range><lt>3.9.4_5</lt></range>
 </package>
 <package>
	<name>linux-c7-libtiff</name>
	<name>linux-c7-tiff</name>
	<range><lt>4.0.3_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libtiff project reports:
	<blockquote cite="http://simplesystems.org/libtiff/v4.0.7.html">
	 Multiple flaws have been discovered in libtiff library and
	 utilities.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://simplesystems.org/libtiff/v4.0.7.html</url>
 <cvename>CVE-2016-9533</cvename>
 <cvename>CVE-2016-9534</cvename>
 <cvename>CVE-2016-9535</cvename>
 <cvename>CVE-2015-8870</cvename>
 <cvename>CVE-2016-5652</cvename>
 <cvename>CVE-2016-9540</cvename>
 <cvename>CVE-2016-9537</cvename>
 <cvename>CVE-2016-9536</cvename>
 </references>
 <dates>
 <discovery>2016-11-19</discovery>
 <entry>2017-02-06</entry>
 </dates>
 </vuln>

<vuln vid="2b63e964-eb04-11e6-9ac1-a4badb2f4699">
 <topic>mantis -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>mantis</name>
	<range><lt>1.2.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wdollman reports:
	<blockquote cite="https://mantisbt.org/bugs/view.php?id=21611">
	 The value of the view_type parameter on the
	 view_all_bug_page.php page is not encoded before being displayed on the
	 page.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mantisbt.org/bugs/view.php?id=21611</url>
 <cvename>CVE-2016-6837</cvename>
 <freebsdpr>ports/216662</freebsdpr>
 </references>
 <dates>
 <discovery>2016-08-15</discovery>
 <entry>2017-02-04</entry>
 </dates>
 </vuln>

<vuln vid="b4ecf774-eb01-11e6-9ac1-a4badb2f4699">
 <topic>guile2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>guile2</name>
	<range><lt>2.0.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ludovic Courtès reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/10/11/1">
	 The REPL server is vulnerable to
	 the HTTP inter-protocol attack
	 The ‘mkdir’ procedure of GNU Guile, an implementation of
	 the Scheme programming language, temporarily changed the process’ umask
	 to zero. During that time window, in a multithreaded application, other
	 threads could end up creating files with insecure permissions.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2016/10/11/1</url>
 <url>http://www.openwall.com/lists/oss-security/2016/10/12/2</url>
 <cvename>CVE-2016-8605</cvename>
 <cvename>CVE-2016-8606</cvename>
 <freebsdpr>ports/216663</freebsdpr>
 </references>
 <dates>
 <discovery>2016-10-12</discovery>
 <entry>2017-02-04</entry>
 </dates>
 </vuln>

<vuln vid="c6932dd4-eaff-11e6-9ac1-a4badb2f4699">
 <topic>chicken -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chicken</name>
	<range><lt>4.12,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Peter Bex reports:
	<blockquote cite="http://lists.nongnu.org/archive/html/chicken-announce/2016-08/msg00001.html">
	 A buffer overflow error was found in the POSIX unit's procedures
	 process-execute and process-spawn.
	 Additionally, a memory leak existed in this code, which would be
	 triggered when an error is raised during argument and environment
	 processing.
	</blockquote>
	<blockquote cite="http://lists.nongnu.org/archive/html/chicken-announce/2016-12/msg00000.html">
	 Irregex versions before 0.9.6 contain a resource exhaustion
	 vulnerability: when compiling deeply nested regexes containing the
	 "+" operator due to exponential expansion behaviour.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.nongnu.org/archive/html/chicken-announce/2016-08/msg00001.html</url>
 <cvename>CVE-2016-6830</cvename>
 <cvename>CVE-2016-6831</cvename>
 <cvename>CVE-2016-9954</cvename>
 <freebsdpr>ports/216661</freebsdpr>
 </references>
 <dates>
 <discovery>2016-08-12</discovery>
 <entry>2017-02-04</entry>
 <modified>2017-03-05</modified>
 </dates>
 </vuln>

<vuln vid="a130bd8c-eafe-11e6-9ac1-a4badb2f4699">
 <topic>libebml -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libebml</name>
	<range><lt>1.3.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mortiz Bunkus reports:
	<blockquote cite="https://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html">
	 Multiple invalid memory accesses vulnerabilities.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html</url>
 <cvename>CVE-2015-8789</cvename>
 <cvename>CVE-2015-8790</cvename>
 <cvename>CVE-2015-8791</cvename>
 <freebsdpr>ports/216659</freebsdpr>
 </references>
 <dates>
 <discovery>2015-10-20</discovery>
 <entry>2017-02-04</entry>
 </dates>
 </vuln>

<vuln vid="5b1631dc-eafd-11e6-9ac1-a4badb2f4699">
 <topic>freeimage -- code execution vulnerability</topic>
 <affects>
 <package>
	<name>freeimage</name>
	<range><lt>3.16.0_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	TALOS reports:
	<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0189/">
	 An exploitable out-of-bounds write vulnerability exists in
	 the XMP image handling functionality of the FreeImage library.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.talosintelligence.com/reports/TALOS-2016-0189/</url>
 <cvename>CVE-2016-5684</cvename>
 <freebsdpr>ports/216657</freebsdpr>
 </references>
 <dates>
 <discovery>2016-10-03</discovery>
 <entry>2017-02-04</entry>
 <modified>2018-04-14</modified>
 </dates>
 </vuln>

<vuln vid="5a9b3d70-48e2-4267-b196-83064cb14fe0">
 <topic>shotwell -- failure to encrypt authentication</topic>
 <affects>
 <package>
	<name>shotwell</name>
	<range><lt>0.24.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jens Georg reports:
	<blockquote cite="https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html">
	 I have just released Shotwell 0.24.5 and 0.25.4 which turn
	 on HTTPS encryption all over the publishing plugins.
	 Users using Tumblr and Yandex.Fotki publishing are strongly
	 advised to change their passwords and reauthenticate Shotwell
	 to those services after upgrade.
	 Users of Picasa and Youtube publishing are strongly advised
	 to reauthenticate (Log out and back in) Shotwell to those
	 services after upgrade.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html</url>
 </references>
 <dates>
 <discovery>2017-01-31</discovery>
 <entry>2017-02-01</entry>
 </dates>
 </vuln>

<vuln vid="5cfa9d0c-73d7-4642-af4f-28fbed9e9404">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>2.44</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>2.32.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-02-01">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-2598</cvename>
 <cvename>CVE-2017-2599</cvename>
 <cvename>CVE-2017-2600</cvename>
 <cvename>CVE-2011-4969</cvename>
 <cvename>CVE-2017-2601</cvename>
 <cvename>CVE-2015-0886</cvename>
 <cvename>CVE-2017-2602</cvename>
 <cvename>CVE-2017-2603</cvename>
 <cvename>CVE-2017-2604</cvename>
 <cvename>CVE-2017-2605</cvename>
 <cvename>CVE-2017-2606</cvename>
 <cvename>CVE-2017-2607</cvename>
 <cvename>CVE-2017-2608</cvename>
 <cvename>CVE-2017-2609</cvename>
 <cvename>CVE-2017-2610</cvename>
 <cvename>CVE-2017-2611</cvename>
 <cvename>CVE-2017-2612</cvename>
 <cvename>CVE-2017-2613</cvename>
 <url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-02-01</url>
 </references>
 <dates>
 <discovery>2017-02-01</discovery>
 <entry>2017-02-01</entry>
 </dates>
 </vuln>

<vuln vid="14ea4458-e5cd-11e6-b56d-38d547003487">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.7.2,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aaron D. Campbell reports:
	<blockquote cite="https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/">
	 WordPress versions 4.7.1 and earlier are affected by three security
	 issues:
	 <ul>
	 <li>The user interface for assigning taxonomy terms in Press This is
	 shown to users who do not have permissions to use it.</li>
	 <li>WP_Query is vulnerable to a SQL injection (SQLi) when passing
	 unsafe data. WordPress core is not directly vulnerable to this
	 issue, but we’ve added hardening to prevent plugins and
	 themes from accidentally causing a vulnerability.</li>
	 <li>A cross-site scripting (XSS) vulnerability was discovered in the
	 posts list table.</li>
	 <li>An unauthenticated privilege escalation vulnerability was
	 discovered in a REST API endpoint.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5610</cvename>
 <cvename>CVE-2017-5611</cvename>
 <cvename>CVE-2017-5612</cvename>
 <url>http://www.openwall.com/lists/oss-security/2017/01/28/5</url>
 <url>https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/</url>
 <url>https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/</url>
 </references>
 <dates>
 <discovery>2017-01-26</discovery>
 <entry>2017-01-29</entry>
 </dates>
 </vuln>

<vuln vid="6e83b2f3-e4e3-11e6-9ac1-a4badb2f4699">
 <topic>nfsen -- remote command execution</topic>
 <affects>
 <package>
	<name>nfsen</name>
	<range><lt>1.3.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Peter Haag reports:
	<blockquote cite="https://sourceforge.net/p/nfsen/mailman/message/35623845/">
	 A remote attacker with access to the web interface to
	 execute arbitrary commands on the host operating system.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://sourceforge.net/p/nfsen/mailman/message/35623845/</url>
 </references>
 <dates>
 <discovery>2017-01-24</discovery>
 <entry>2017-01-27</entry>
 </dates>
 </vuln>

<vuln vid="4b9ca994-e3d9-11e6-813d-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>56.0.2924.76</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html">
	 51 security fixes in this release
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5007</cvename>
 <cvename>CVE-2017-5006</cvename>
 <cvename>CVE-2017-5008</cvename>
 <cvename>CVE-2017-5010</cvename>
 <cvename>CVE-2017-5011</cvename>
 <cvename>CVE-2017-5009</cvename>
 <cvename>CVE-2017-5012</cvename>
 <cvename>CVE-2017-5013</cvename>
 <cvename>CVE-2017-5014</cvename>
 <cvename>CVE-2017-5015</cvename>
 <cvename>CVE-2017-5019</cvename>
 <cvename>CVE-2017-5016</cvename>
 <cvename>CVE-2017-5017</cvename>
 <cvename>CVE-2017-5018</cvename>
 <cvename>CVE-2017-2020</cvename>
 <cvename>CVE-2017-2021</cvename>
 <cvename>CVE-2017-2022</cvename>
 <cvename>CVE-2017-2023</cvename>
 <cvename>CVE-2017-2024</cvename>
 <cvename>CVE-2017-2025</cvename>
 <cvename>CVE-2017-2026</cvename>
 <url>https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2017-01-25</discovery>
 <entry>2017-01-26</entry>
 </dates>
 </vuln>

<vuln vid="d455708a-e3d3-11e6-9940-b499baebfeaf">
 <topic>OpenSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2k,1</lt></range>
 </package>
 <package>
	<name>openssl-devel</name>
	<range><lt>1.1.0d</lt></range>
 </package>
 <package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_13</lt></range>
 </package>
 <package>
	<name>linux-c7-openssl-libs</name>
	<range><lt>1.0.1e_3</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_8</lt></range>
	<range><ge>10.3</ge><lt>10.3_17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20170126.txt">
	 <ul>
	 <li>Truncated packet could crash via OOB read (CVE-2017-3731)</li>
	 <li>Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)</li>
	 <li>BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)</li>
	 <li>Montgomery multiplication may produce incorrect results (CVE-2016-7055)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20170126.txt</url>
 <cvename>CVE-2016-7055</cvename>
 <cvename>CVE-2017-3730</cvename>
 <cvename>CVE-2017-3731</cvename>
 <cvename>CVE-2017-3732</cvename>
 <freebsdsa>SA-17:02.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2017-01-26</discovery>
 <entry>2017-01-26</entry>
 <modified>2017-05-26</modified>
 </dates>
 </vuln>

<vuln vid="e60169c4-aa86-46b0-8ae2-0d81f683df09">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>51.0_1,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.48</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>45.7.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>45.7.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>45.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-01/">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5373</cvename>
 <cvename>CVE-2017-5374</cvename>
 <cvename>CVE-2017-5375</cvename>
 <cvename>CVE-2017-5376</cvename>
 <cvename>CVE-2017-5377</cvename>
 <cvename>CVE-2017-5378</cvename>
 <cvename>CVE-2017-5379</cvename>
 <cvename>CVE-2017-5380</cvename>
 <cvename>CVE-2017-5381</cvename>
 <cvename>CVE-2017-5382</cvename>
 <cvename>CVE-2017-5383</cvename>
 <cvename>CVE-2017-5384</cvename>
 <cvename>CVE-2017-5385</cvename>
 <cvename>CVE-2017-5386</cvename>
 <cvename>CVE-2017-5387</cvename>
 <cvename>CVE-2017-5388</cvename>
 <cvename>CVE-2017-5389</cvename>
 <cvename>CVE-2017-5390</cvename>
 <cvename>CVE-2017-5391</cvename>
 <cvename>CVE-2017-5392</cvename>
 <cvename>CVE-2017-5393</cvename>
 <cvename>CVE-2017-5394</cvename>
 <cvename>CVE-2017-5395</cvename>
 <cvename>CVE-2017-5396</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2017-01/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2017-02/</url>
 </references>
 <dates>
 <discovery>2017-01-24</discovery>
 <entry>2017-01-24</entry>
 </dates>
 </vuln>

<vuln vid="7721562b-e20a-11e6-b2e2-6805ca0b3d42">
 <topic>phpMyAdmin -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.6.0</ge><lt>4.6.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-1/">
	 Open redirect
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-2/">
	 php-gettext code execution
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-3/">
	 DOS vulnerability in table editing
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-4/">
	 CSS injection in themes
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-5/">
	 Cookie attribute injection attack
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-6/">
	 SSRF in replication
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-7/">
	 DOS in replication status
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2017-1</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2017-2</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2017-3</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2017-4</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2017-5</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2017-6</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2017-7</url>
 <cvename>CVE-2015-8980</cvename>
 </references>
 <dates>
 <discovery>2017-01-24</discovery>
 <entry>2017-01-24</entry>
 </dates>
 </vuln>

<vuln vid="a4b7def1-e165-11e6-9d84-90e2ba9881c8">
 <topic>Intel(R) NVMUpdate -- Intel(R) Ethernet Controller X710/XL710 NVM Security Vulnerability</topic>
 <affects>
 <package>
	<name>intel-nvmupdate</name>
	<range><lt>5.05</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Intel Corporation reports:
	<blockquote cite="https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00063&amp;languageid=en-fr">
	 A security vulnerability in the Intel(R) Ethernet Controller X710
	 and Intel(R) Ethernet Controller XL710 family of products
	 (Fortville) has been found in the Non-Volatile Flash Memory (NVM)
	 image.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00063&amp;languageid=en-fr</url>
 <cvename>CVE-2016-8106</cvename>
 </references>
 <dates>
 <discovery>2017-01-09</discovery>
 <entry>2017-01-23</entry>
 </dates>
 </vuln>

<vuln vid="709e025a-de8b-11e6-a9a5-b499baebfeaf">
 <topic>PHP -- undisclosed vulnerabilities</topic>
 <affects>
 <package>
	<name>php56</name>
	<range><lt>5.6.30</lt></range>
 </package>
 <package>
	<name>php70</name>
	<range><lt>7.0.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP project reports:
	<blockquote cite="http://php.net/archive/2017.php#id2017-01-19-2">
	 The PHP development team announces the immediate availability of
	 PHP 7.0.15. This is a security release. Several security bugs were
	 fixed in this release.
	</blockquote>
	<blockquote cite="http://php.net/archive/2017.php#id2017-01-19-3">
	 The PHP development team announces the immediate availability of
	 PHP 5.6.30. This is a security release. Several security bugs were
	 fixed in this release.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://php.net/archive/2017.php#id2017-01-19-2</url>
 <url>http://php.net/archive/2017.php#id2017-01-19-3</url>
 </references>
 <dates>
 <discovery>2017-01-19</discovery>
 <entry>2017-01-19</entry>
 <modified>2017-01-20</modified>
 </dates>
 </vuln>

<vuln vid="57facd35-ddf6-11e6-915d-001b3856973b">
 <topic>icoutils -- check_offset overflow on 64-bit systems</topic>
 <affects>
 <package>
	<name>icoutils</name>
	<range><lt>0.31.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Choongwoo Han reports:
	<blockquote cite="http://seclists.org/oss-sec/2017/q1/38">
	 An exploitable crash exists in the wrestool utility on 64-bit systems
	 where the result of subtracting two pointers exceeds the size of int.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5208</cvename>
 <cvename>CVE-2017-5331</cvename>
 <cvename>CVE-2017-5332</cvename>
 <cvename>CVE-2017-5333</cvename>
 <url>http://seclists.org/oss-sec/2017/q1/38</url>
 </references>
 <dates>
 <discovery>2017-01-03</discovery>
 <entry>2017-01-19</entry>
 </dates>
 </vuln>

<vuln vid="4d2f9d09-ddb7-11e6-a9a5-b499baebfeaf">
 <topic>mysql -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb55-server</name>
	<range><lt>5.5.54</lt></range>
 </package>
 <package>
	<name>mariadb100-server</name>
	<range><lt>10.0.30</lt></range>
 </package>
 <package>
	<name>mariadb101-server</name>
	<range><lt>10.1.22</lt></range>
 </package>
 <package>
	<name>mysql55-server</name>
	<range><lt>5.5.54</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.35</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL">
	 No further details have been provided in the Critical Patch Update
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL</url>
 <cvename>CVE-2016-8318</cvename>
 <cvename>CVE-2017-3312</cvename>
 <cvename>CVE-2017-3258</cvename>
 <cvename>CVE-2017-3273</cvename>
 <cvename>CVE-2017-3244</cvename>
 <cvename>CVE-2017-3257</cvename>
 <cvename>CVE-2017-3238</cvename>
 <cvename>CVE-2017-3256</cvename>
 <cvename>CVE-2017-3291</cvename>
 <cvename>CVE-2017-3265</cvename>
 <cvename>CVE-2017-3251</cvename>
 <cvename>CVE-2017-3313</cvename>
 <cvename>CVE-2017-3243</cvename>
 <cvename>CVE-2016-8327</cvename>
 <cvename>CVE-2017-3317</cvename>
 <cvename>CVE-2017-3318</cvename>
 <cvename>CVE-2017-3319</cvename>
 <cvename>CVE-2017-3320</cvename>
 </references>
 <dates>
 <discovery>2017-01-18</discovery>
 <entry>2017-01-18</entry>
 <modified>2017-03-14</modified>
 </dates>
 </vuln>

<vuln vid="e3200958-dd6c-11e6-ae1b-002590263bf5">
 <topic>powerdns -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>powerdns</name>
	<range><lt>3.4.11</lt></range>
	<range><ge>4.0.0</ge><lt>4.0.2</lt></range>
 </package>
 <package>
	<name>powerdns-recursor</name>
	<range><lt>3.7.4</lt></range>
	<range><ge>4.0.0</ge><lt>4.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS reports:
	<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/">
	 2016-02: Crafted queries can cause abnormal CPU usage
	</blockquote>
	<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/">
	 2016-03: Denial of service via the web server
	</blockquote>
	<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/">
	 2016-04: Insufficient validation of TSIG signatures
	</blockquote>
	<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/">
	 2016-05: Crafted zone record can cause a denial of service
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-7068</cvename>
 <cvename>CVE-2016-7072</cvename>
 <cvename>CVE-2016-7073</cvename>
 <cvename>CVE-2016-7074</cvename>
 <cvename>CVE-2016-2120</cvename>
 <freebsdpr>ports/216135</freebsdpr>
 <freebsdpr>ports/216136</freebsdpr>
 <url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/</url>
 <url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/</url>
 <url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/</url>
 <url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/</url>
 <url>https://blog.powerdns.com/2017/01/13/powerdns-authoritative-server-4-0-2-released/</url>
 <url>https://blog.powerdns.com/2017/01/13/powerdns-recursor-4-0-4-released/</url>
 </references>
 <dates>
 <discovery>2016-12-15</discovery>
 <entry>2017-01-18</entry>
 </dates>
 </vuln>

<vuln vid="4af92a40-db33-11e6-ae1b-002590263bf5">
 <topic>groovy -- remote execution of untrusted code/DoS vulnerability</topic>
 <affects>
 <package>
	<name>groovy</name>
	<range><ge>1.7.0</ge><lt>2.4.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Groovy project reports:
	<blockquote cite="http://groovy-lang.org/security.html">
	 When an application with Groovy on classpath uses standard Java
	 serialization mechanisms, e.g. to communicate between servers or to
	 store local data, it is possible for an attacker to bake a special
	 serialized object that will execute code directly when deserialized.
	 All applications which rely on serialization and do not isolate the
	 code which deserializes objects are subject to this vulnerability.
	 This is similar to CVE-2015-3253 but this exploit involves extra
	 wrapping of objects and catching of exceptions which are now safe
	 guarded against.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-6814</cvename>
 <url>http://groovy-lang.org/security.html</url>
 </references>
 <dates>
 <discovery>2016-09-20</discovery>
 <entry>2017-01-15</entry>
 </dates>
 </vuln>

<vuln vid="6aa956fb-d97f-11e6-a071-001e67f15f5a">
 <topic>RabbitMQ -- Authentication vulnerability</topic>
 <affects>
 <package>
	<name>rabbitmq</name>
	<range><ge>3.0.0</ge><lt>3.5.8</lt></range>
	<range><ge>3.6.0</ge><lt>3.6.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pivotal.io reports:
	<blockquote cite="https://pivotal.io/security/cve-2016-9877">
	MQTT (MQ Telemetry Transport) connection authentication with a
	 username/password pair succeeds if an existing username is
	 provided but the password is omitted from the connection
	 request. Connections that use TLS with a client-provided
	 certificate are not affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9877</cvename>
 <url>https://pivotal.io/security/cve-2016-9877</url>
 <url>https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_6</url>
 </references>
 <dates>
 <discovery>2016-12-06</discovery>
 <entry>2017-01-15</entry>
 </dates>
 </vuln>

<vuln vid="b180d1fb-dac6-11e6-ae1b-002590263bf5">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.7.1,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aaron D. Campbell reports:
	<blockquote cite="https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/">
	 WordPress versions 4.7 and earlier are affected by eight security
	 issues...
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5487</cvename>
 <cvename>CVE-2017-5488</cvename>
 <cvename>CVE-2017-5489</cvename>
 <cvename>CVE-2017-5490</cvename>
 <cvename>CVE-2017-5491</cvename>
 <cvename>CVE-2017-5492</cvename>
 <cvename>CVE-2017-5493</cvename>
 <url>http://www.openwall.com/lists/oss-security/2017/01/14/6</url>
 <url>https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2017-01-11</discovery>
 <entry>2017-01-15</entry>
 </dates>
 </vuln>

<vuln vid="e5186c65-d729-11e6-a9a5-b499baebfeaf">
 <topic>mysql -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql57-client</name>
	<name>mysql57-server</name>
	<range><lt>5.7.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html">
	 Local security vulnerability in 'Server: Packaging' sub component.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>93617</bid>
 <cvename>CVE-2016-5625</cvename>
 <url>http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html</url>
 </references>
 <dates>
 <discovery>2016-10-18</discovery>
 <entry>2017-01-14</entry>
 <modified>2017-01-15</modified>
 </dates>
 </vuln>

<vuln vid="22373c43-d728-11e6-a9a5-b499baebfeaf">
 <topic>MySQL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb55-client</name>
	<name>mariadb55-server</name>
	<range><lt>5.5.52</lt></range>
 </package>
 <package>
	<name>mariadb100-client</name>
	<name>mariadb100-server</name>
	<range><lt>10.0.28</lt></range>
 </package>
 <package>
	<name>mariadb101-client</name>
	<name>mariadb101-server</name>
	<range><lt>10.1.18</lt></range>
 </package>
 <package>
	<name>mysql55-client</name>
	<name>mysql55-server</name>
	<range><lt>5.5.52</lt></range>
 </package>
 <package>
	<name>mysql56-client</name>
	<name>mysql56-server</name>
	<range><lt>5.6.33</lt></range>
 </package>
 <package>
	<name>mysql57-client</name>
	<name>mysql57-server</name>
	<range><lt>5.7.15</lt></range>
 </package>
 <package>
	<name>percona55-client</name>
	<name>percona55-server</name>
	<range><lt>5.5.51.38.2</lt></range>
 </package>
 <package>
	<name>percona56-client</name>
	<name>percona56-server</name>
	<range><lt>5.6.32.78.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MySQL project reports:
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL">
	 <ul>
	 <li>CVE-2016-3492: Remote security vulnerability in 'Server: Optimizer'
	 sub component.</li>
	 <li>CVE-2016-5616, CVE-2016-6663: Race condition allows local users with
	 certain permissions to gain privileges by leveraging use of my_copystat
	 by REPAIR TABLE to repair a MyISAM table.</li>
	 <li>CVE-2016-5617, CVE-2016-6664: mysqld_safe, when using file-based
	 logging, allows local users with access to the mysql account to gain
	 root privileges via a symlink attack on error logs and possibly other
	 files.</li>
	 <li>CVE-2016-5624: Remote security vulnerability in 'Server: DML' sub
	 component.</li>
	 <li>CVE-2016-5626: Remote security vulnerability in 'Server: GIS' sub
	 component.</li>
	 <li>CVE-2016-5629: Remote security vulnerability in 'Server: Federated'
	 sub component.</li>
	 <li>CVE-2016-8283: Remote security vulnerability in 'Server: Types' sub
	 component.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL</url>
 <url>https://mariadb.com/kb/en/mariadb/mariadb-10028-release-notes/</url>
 <url>https://mariadb.com/kb/en/mariadb/mariadb-5552-release-notes/</url>
 <url>https://mariadb.com/kb/en/mariadb/mariadb-10118-release-notes/</url>
 <cvename>CVE-2016-3492</cvename>
 <cvename>CVE-2016-5616</cvename>
 <cvename>CVE-2016-5617</cvename>
 <cvename>CVE-2016-5624</cvename>
 <cvename>CVE-2016-5626</cvename>
 <cvename>CVE-2016-5629</cvename>
 <cvename>CVE-2016-6663</cvename>
 <cvename>CVE-2016-6664</cvename>
 <cvename>CVE-2016-8283</cvename>
 </references>
 <dates>
 <discovery>2016-09-13</discovery>
 <entry>2017-01-14</entry>
 </dates>
 </vuln>

<vuln vid="a93c3287-d8fd-11e6-be5c-001fbc0f280f">
 <topic>Ansible -- Command execution on Ansible controller from host</topic>
 <affects>
 <package>
	<name>ansible</name>
	<range><gt>1.9.6_1</gt><lt>2.2.0.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Computest reports:
	<blockquote cite="https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt">
	 Computest found and exploited several issues
	 that allow a compromised host to execute commands
	 on the Ansible controller and thus gain access
	 to other hosts controlled by that controller.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9587</cvename>
 <url>https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt</url>
 <url>https://lwn.net/Articles/711357/</url>
 </references>
 <dates>
 <discovery>2017-01-09</discovery>
 <entry>2017-01-12</entry>
 </dates>
 </vuln>

<vuln vid="7ae0be99-d8bb-11e6-9b7f-d43d7e971a1b">
 <topic>phpmailer -- Remote Code Execution</topic>
 <affects>
 <package>
	<name>phpmailer</name>
	<range><lt>5.2.22</lt></range>
 </package>
 <package>
	<name>tt-rss</name>
	<range><lt>2017.01.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/95328/discuss">
	 PHPMailer is prone to an local information-disclosure vulnerability.
 Attackers can exploit this issue to obtain sensitive information
 that may aid in launching further attacks.
	 </blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/bid/95328/discuss</url>
 <cvename>CVE-2017-5223</cvename>
 </references>
 <dates>
 <discovery>2017-01-10</discovery>
 <entry>2017-01-12</entry>
 </dates>
 </vuln>

<vuln vid="d4c7e9a9-d893-11e6-9b4d-d050996490d0">
 <topic>BIND -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><lt>9.9.9P5</lt></range>
 </package>
 <package>
	<name>bind910</name>
	<range><lt>9.10.4P5</lt></range>
 </package>
 <package>
	<name>bind911</name>
	<range><lt>9.11.0P2</lt></range>
 </package>
 <package>
	<name>bind9-devel</name>
	<range><le>9.12.0.a.2016.12.28</le></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>10.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01439/0">
	 A malformed query response received by a recursive
	 server in response to a query of RTYPE ANY could
	 trigger an assertion failure while named is attempting
	 to add the RRs in the query response to the cache.
	</blockquote>
	<blockquote cite="https://kb.isc.org/article/AA-01440/0">
	 Depending on the type of query and the EDNS options
	 in the query they receive, DNSSEC-enabled authoritative
	 servers are expected to include RRSIG and other RRsets
	 in their responses to recursive servers.
	 DNSSEC-validating servers will also make specific queries
	 for DS and other RRsets.
	 Whether DNSSEC-validating or not, an error in processing
	 malformed query responses that contain DNSSEC-related
	 RRsets that are inconsistent with other RRsets in the
	 same query response can trigger an assertion failure.
	 Although the combination of properties which triggers
	 the assertion should not occur in normal traffic, it
	 is potentially possible for the assertion to be triggered
	 deliberately by an attacker sending a specially-constructed
	 answer.
	</blockquote>
	<blockquote cite="https://kb.isc.org/article/AA-01441/0">
	 An unusually-formed answer containing a DS resource
	 record could trigger an assertion failure. While the
	 combination of properties which triggers the assertion
	 should not occur in normal traffic, it is potentially
	 possible for the assertion to be triggered deliberately
	 by an attacker sending a specially-constructed answer
	 having the required properties.
	</blockquote>
	<blockquote cite="https://kb.isc.org/article/AA-01442/0">
	 An error in handling certain queries can cause an
	 assertion failure when a server is using the
	 nxdomain-redirect feature to cover a zone for which
	 it is also providing authoritative service.
	 A vulnerable server could be intentionally stopped
	 by an attacker if it was using a configuration that
	 met the criteria for the vulnerability and if the
	 attacker could cause it to accept a query that
	 possessed the required attributes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9131</cvename>
 <cvename>CVE-2016-9147</cvename>
 <cvename>CVE-2016-9444</cvename>
 <cvename>CVE-2016-9778</cvename>
 <url>https://kb.isc.org/article/AA-01439/0</url>
 <url>https://kb.isc.org/article/AA-01440/0</url>
 <url>https://kb.isc.org/article/AA-01441/0</url>
 <url>https://kb.isc.org/article/AA-01442/0</url>
 </references>
 <dates>
 <discovery>2017-01-11</discovery>
 <entry>2017-01-12</entry>
 </dates>
 </vuln>

<vuln vid="2c948527-d823-11e6-9171-14dae9d210b8">
 <topic>FreeBSD -- OpenSSH multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssh-portable</name>
	<range><lt>7.3.p1_5,1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_7</lt></range>
	<range><ge>10.3</ge><lt>10.3_16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The ssh-agent(1) agent supports loading a PKCS#11 module
	from outside a trusted whitelist. An attacker can request
	loading of a PKCS#11 module across forwarded agent-socket.
	[CVE-2016-10009]
	When privilege separation is disabled, forwarded Unix
	domain sockets would be created by sshd(8) with the privileges
	of 'root' instead of the authenticated user. [CVE-2016-10010]
	<h1>Impact:</h1>
	A remote attacker who have control of a forwarded
	agent-socket on a remote system and have the ability to
	write files on the system running ssh-agent(1) agent can
	run arbitrary code under the same user credential. Because
	the attacker must already have some control on both systems,
	it is relatively hard to exploit this vulnerability in a
	practical attack. [CVE-2016-10009]
	When privilege separation is disabled (on FreeBSD,
	privilege separation is enabled by default and has to be
	explicitly disabled), an authenticated attacker can potentially
	gain root privileges on systems running OpenSSH server.
	[CVE-2016-10010]
 </body>
 </description>
 <references>
 <cvename>CVE-2016-10009</cvename>
 <cvename>CVE-2016-10010</cvename>
 <freebsdsa>SA-17:01.openssh</freebsdsa>
 </references>
 <dates>
 <discovery>2017-01-11</discovery>
 <entry>2017-01-11</entry>
 <modified>2017-01-13</modified>
 </dates>
 </vuln>

<vuln vid="7caebe30-d7f1-11e6-a9a5-b499baebfeaf">
 <topic>openssl -- timing attack vulnerability</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2</lt></range>
 </package>
 <package>
	<name>libressl</name>
	<range><lt>2.4.4_1</lt></range>
 </package>
 <package>
	<name>libressl-devel</name>
	<range><lt>2.5.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cesar Pereida Garcia reports:
	<blockquote cite="http://seclists.org/oss-sec/2017/q1/52">
	 The signing function in crypto/ecdsa/ecdsa_ossl.c in certain OpenSSL
	 versions and forks is vulnerable to timing attacks when signing with the
	 standardized elliptic curve P-256 despite featuring constant-time curve
	 operations and modular inversion. A software defect omits setting the
	 BN_FLG_CONSTTIME flag for nonces, failing to take a secure code path in
	 the BN_mod_inverse method and therefore resulting in a cache-timing attack
	 vulnerability. 
	 A malicious user with local access can recover ECDSA P-256 private keys.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2017/q1/52</url>
 <cvename>CVE-2016-7056</cvename>
 </references>
 <dates>
 <discovery>2017-01-10</discovery>
 <entry>2017-01-11</entry>
 <modified>2017-01-11</modified>
 </dates>
 </vuln>

<vuln vid="2a7bdc56-d7a3-11e6-ae1b-002590263bf5">
 <topic>flash -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplayer</name>
	<range><lt>24.0.0.194</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-02.html">
	 These updates resolve a security bypass vulnerability that could
	 lead to information disclosure (CVE-2017-2938).
	 These updates resolve use-after-free vulnerabilities that could
	 lead to code execution (CVE-2017-2932, CVE-2017-2936,
	 CVE-2017-2937).
	 These updates resolve heap buffer overflow vulnerabilities that
	 could lead to code execution (CVE-2017-2927, CVE-2017-2933,
	 CVE-2017-2934, CVE-2017-2935).
	 These updates resolve memory corruption vulnerabilities that could
	 lead to code execution (CVE-2017-2925, CVE-2017-2926, CVE-2017-2928,
	 CVE-2017-2930, CVE-2017-2931).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-2925</cvename>
 <cvename>CVE-2017-2926</cvename>
 <cvename>CVE-2017-2927</cvename>
 <cvename>CVE-2017-2928</cvename>
 <cvename>CVE-2017-2930</cvename>
 <cvename>CVE-2017-2931</cvename>
 <cvename>CVE-2017-2932</cvename>
 <cvename>CVE-2017-2933</cvename>
 <cvename>CVE-2017-2934</cvename>
 <cvename>CVE-2017-2935</cvename>
 <cvename>CVE-2017-2936</cvename>
 <cvename>CVE-2017-2937</cvename>
 <cvename>CVE-2017-2938</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb17-02.html</url>
 </references>
 <dates>
 <discovery>2017-01-10</discovery>
 <entry>2017-01-11</entry>
 </dates>
 </vuln>

<vuln vid="ab804e60-d693-11e6-9171-14dae9d210b8">
 <topic>moinmoin -- XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>moinmoin</name>
	<range><lt>1.9.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Thomas Waldmann reports:
	<blockquote cite="http://hg.moinmo.in/moin/1.9/file/1.9.9/docs/CHANGES">
	<ul>
	 <li>fix XSS in AttachFile view (multifile related) CVE-2016-7148</li>
	 <li>fix XSS in GUI editor's attachment dialogue CVE-2016-7146</li>
	 <li>fix XSS in GUI editor's link dialogue CVE-2016-9119</li>
	</ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://hg.moinmo.in/moin/1.9/file/1.9.9/docs/CHANGES</url>
 <cvename>CVE-2016-7148</cvename>
 <cvename>CVE-2016-7146</cvename>
 <cvename>CVE-2016-9119</cvename>
 <freebsdpr>ports/214937</freebsdpr>
 </references>
 <dates>
 <discovery>2016-10-31</discovery>
 <entry>2017-01-09</entry>
 </dates>
 </vuln>

<vuln vid="64be967a-d379-11e6-a071-001e67f15f5a">
 <topic>libvncserver -- multiple buffer overflows</topic>
 <affects>
 <package>
	<name>libvncserver</name>
	<range><lt>0.9.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libvnc server reports:
	<blockquote cite="https://github.com/LibVNC/libvncserver/pull/137">
	 Two unrelated buffer overflows can be used by a malicious server to overwrite parts of the heap and crash the client (or possibly execute arbitrary code).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/LibVNC/libvncserver/pull/137</url>
 <cvename>CVE-2016-9941</cvename>
 <cvename>CVE-2016-9942</cvename>
 <freebsdpr>ports/215805</freebsdpr>
 </references>
 <dates>
 <discovery>2016-11-24</discovery>
 <entry>2017-01-09</entry>
 </dates>
 </vuln>

<vuln vid="83041ca7-d690-11e6-9171-14dae9d210b8">
 <topic>libdwarf -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libdwarf</name>
	<range><lt>20161124</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Christian Rebischke reports:
	<blockquote cite="https://lwn.net/Articles/708092/">
	 libdwarf is vulnerable to multiple issues including
	 arbitrary code execution, information disclosure and denial of
	 service.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lwn.net/Articles/708092/</url>
 <cvename>CVE-2016-5027</cvename>
 <cvename>CVE-2016-5028</cvename>
 <cvename>CVE-2016-5029</cvename>
 <cvename>CVE-2016-5030</cvename>
 <cvename>CVE-2016-5031</cvename>
 <cvename>CVE-2016-5032</cvename>
 <cvename>CVE-2016-5033</cvename>
 <cvename>CVE-2016-5035</cvename>
 <cvename>CVE-2016-5037</cvename>
 <cvename>CVE-2016-5040</cvename>
 <cvename>CVE-2016-5041</cvename>
 <cvename>CVE-2016-5043</cvename>
 <cvename>CVE-2016-5044</cvename>
 <cvename>CVE-2016-7510</cvename>
 <cvename>CVE-2016-7511</cvename>
 <cvename>CVE-2016-8679</cvename>
 <cvename>CVE-2016-8680</cvename>
 <cvename>CVE-2016-8681</cvename>
 <cvename>CVE-2016-9275</cvename>
 <cvename>CVE-2016-9276</cvename>
 <cvename>CVE-2016-9480</cvename>
 <cvename>CVE-2016-9558</cvename>
 </references>
 <dates>
 <discovery>2016-12-04</discovery>
 <entry>2017-01-09</entry>
 </dates>
 </vuln>

<vuln vid="03532a19-d68e-11e6-9171-14dae9d210b8">
 <topic>lynx -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>lynx</name>
	<range><lt>2.8.8.2_5,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote>
	 Lynx is vulnerable to POODLE by still supporting vulnerable
	 version of SSL. Lynx is also vulnerable to URL attacks by incorrectly
	 parsing hostnames ending with an '?'.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://hg.java.net/hg/solaris-userland~gate/file/bc5351dcb9ac/components/lynx/patches/02-init-openssl.patch</url>
 <url>https://hg.java.net/hg/solaris-userland~gate/file/0a979060f73b/components/lynx/patches/05-fix-CVE-2016-9179.patch</url>
 <cvename>CVE-2014-3566</cvename>
 <cvename>CVE-2016-9179</cvename>
 <freebsdpr>ports/215464</freebsdpr>
 </references>
 <dates>
 <discovery>2016-10-26</discovery>
 <entry>2017-01-09</entry>
 </dates>
 </vuln>

<vuln vid="91e039ed-d689-11e6-9171-14dae9d210b8">
 <topic>hdf5 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>hdf5</name>
	<range><lt>1.10.0</lt></range>
 </package>
 <package>
	<name>hdf5-18</name>
	<range><lt>1.8.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Talos Security reports:
	<blockquote cite="http://blog.talosintel.com/2016/11/hdf5-vulns.html">
	<ul>
	 <li>CVE-2016-4330 (TALOS-2016-0176) - HDF5 Group libhdf5 H5T_ARRAY Code Execution Vulnerability</li>
	 <li>CVE-2016-4331 (TALOS-2016-0177) - HDF5 Group libhdf5 H5Z_NBIT Code Execution Vulnerability</li>
	 <li>CVE-2016-4332 (TALOS-2016-0178) - HDF5 Group libhdf5 Shareable Message Type Code Execution Vulnerability</li>
	 <li>CVE-2016-4333 (TALOS-2016-0179) - HDF5 Group libhdf5 H5T_COMPOUND Code Execution Vulnerability</li>
	</ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.talosintel.com/2016/11/hdf5-vulns.html</url>
 <cvename>CVE-2016-4330</cvename>
 <cvename>CVE-2016-4331</cvename>
 <cvename>CVE-2016-4332</cvename>
 <cvename>CVE-2016-4333</cvename>
 </references>
 <dates>
 <discovery>2016-11-17</discovery>
 <entry>2017-01-09</entry>
 </dates>
 </vuln>

<vuln vid="e1ff4c5e-d687-11e6-9171-14dae9d210b8">
 <topic>End of Life Ports</topic>
 <affects>
 <package>
	<name>py27-django16</name>
	<name>py33-django16</name>
	<name>py34-django16</name>
	<name>py35-django16</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>drupal6</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 These packages have reached End of Life status and/or have
	 been removed from the Ports Tree. They may contain undocumented
	 security issues. Please take caution and find alternative
	 software as soon as possible.
 </body>
 </description>
 <references>
 <freebsdpr>ports/211975</freebsdpr>
 </references>
 <dates>
 <discovery>2017-01-06</discovery>
 <entry>2017-01-06</entry>
 </dates>
 </vuln>

<vuln vid="c218873d-d444-11e6-84ef-f0def167eeea">
 <topic>Use-After-Free Vulnerability in pcsc-lite</topic>
 <affects>
 <package>
	<name>pcsc-lite</name>
	<range><ge>1.6.0</ge><lt>1.8.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Peter Wu on Openwall mailing-list reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2017/01/03/2">
	 The issue allows a local attacker to cause a Denial of Service,
	 but can potentially result in Privilege Escalation since
	 the daemon is running as root. while any local user can
	 connect to the Unix socket.
	 Fixed by patch which is released with hpcsc-lite 1.8.20.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-10109</cvename>
 <url>http://www.openwall.com/lists/oss-security/2017/01/03/2</url>
 </references>
 <dates>
 <discovery>2017-01-03</discovery>
 <entry>2017-01-06</entry>
 <modified>2017-01-10</modified>
 </dates>
 </vuln>

<vuln vid="0c5369fc-d671-11e6-a9a5-b499baebfeaf">
 <topic>GnuTLS -- Memory corruption vulnerabilities</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>3.5.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GnuTLS project reports:
	<blockquote cite="http://www.gnutls.org/news.html#2017-01-09">
	 <ul>
	 <li>It was found using the OSS-FUZZ fuzzer infrastructure that
	 decoding a specially crafted OpenPGP certificate could lead
	 to heap and stack overflows. (GNUTLS-SA-2017-2)</li>
	 <li>It was found using the OSS-FUZZ fuzzer infrastructure that
	 decoding a specially crafted X.509 certificate with Proxy
	 Certificate Information extension present could lead to a
	 double free. (GNUTLS-SA-2017-1)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.gnutls.org/news.html#2017-01-09</url>
 <url>http://www.gnutls.org/security.html#GNUTLS-SA-2017-2</url>
 <url>http://www.gnutls.org/security.html#GNUTLS-SA-2017-1</url>
 </references>
 <dates>
 <discovery>2017-01-09</discovery>
 <entry>2017-01-09</entry>
 </dates>
 </vuln>

<vuln vid="e5ec2767-d529-11e6-ae1b-002590263bf5">
 <topic>tomcat -- information disclosure vulnerability</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><lt>6.0.49</lt></range>
 </package>
 <package>
	<name>tomcat7</name>
	<range><lt>7.0.74</lt></range>
 </package>
 <package>
	<name>tomcat8</name>
	<range><lt>8.0.40</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation reports:
	<blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40">
	 Important: Information Disclosure CVE-2016-8745
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-8745</cvename>
 <freebsdpr>ports/215865</freebsdpr>
 <url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.49</url>
 <url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.74</url>
 <url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40</url>
 </references>
 <dates>
 <discovery>2017-01-05</discovery>
 <entry>2017-01-07</entry>
 <modified>2017-03-18</modified>
 </dates>
 </vuln>

<vuln vid="0b9af110-d529-11e6-ae1b-002590263bf5">
 <topic>tomcat -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><lt>6.0.48</lt></range>
 </package>
 <package>
	<name>tomcat7</name>
	<range><lt>7.0.73</lt></range>
 </package>
 <package>
	<name>tomcat8</name>
	<range><lt>8.0.39</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation reports:
	<blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39">
	 Important: Remote Code Execution CVE-2016-8735
	 Important: Information Disclosure CVE-2016-6816
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-8735</cvename>
 <cvename>CVE-2016-6816</cvename>
 <freebsdpr>ports/214599</freebsdpr>
 <url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48</url>
 <url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73</url>
 <url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39</url>
 </references>
 <dates>
 <discovery>2016-11-22</discovery>
 <entry>2017-01-07</entry>
 <modified>2017-03-18</modified>
 </dates>
 </vuln>

<vuln vid="3ae106e2-d521-11e6-ae1b-002590263bf5">
 <topic>tomcat -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><lt>6.0.47</lt></range>
 </package>
 <package>
	<name>tomcat7</name>
	<range><lt>7.0.72</lt></range>
 </package>
 <package>
	<name>tomcat8</name>
	<range><lt>8.0.37</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation reports:
	<blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37">
	 Low: Unrestricted Access to Global Resources CVE-2016-6797
	 Low: Security Manager Bypass CVE-2016-6796
	 Low: System Property Disclosure CVE-2016-6794
	 Low: Security Manager Bypass CVE-2016-5018
	 Low: Timing Attack CVE-2016-0762
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-6797</cvename>
 <cvename>CVE-2016-6796</cvename>
 <cvename>CVE-2016-6794</cvename>
 <cvename>CVE-2016-5018</cvename>
 <cvename>CVE-2016-0762</cvename>
 <url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47</url>
 <url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72</url>
 <url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37</url>
 </references>
 <dates>
 <discovery>2016-10-27</discovery>
 <entry>2017-01-07</entry>
 <modified>2017-03-18</modified>
 </dates>
 </vuln>

<vuln vid="3d6be69b-d365-11e6-a071-001e67f15f5a">
 <topic>Irssi -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>irssi</name>
	<range><lt>0.8.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Irssi reports:
	<blockquote cite="https://irssi.org/security/irssi_sa_2017_01.txt">
	 Five vulnerabilities have been located in Irssi
	 <ul>
	 <li>A NULL pointer dereference in the nickcmp function found by
	 Joseph Bisch. (CWE-690)</li>
	 <li>Use after free when receiving invalid nick message (Issue #466,
	 CWE-146)</li>
	 <li>Out of bounds read in certain incomplete control codes found
	 by Joseph Bisch. (CWE-126)</li>
	 <li>Out of bounds read in certain incomplete character sequences
	 found by Hanno Böck and independently by J. Bisch. (CWE-126)</li>
	 <li>Out of bounds read when Printing the value '%['. Found by
	 Hanno Böck. (CWE-126)</li>
	 </ul>
	 These issues may result in denial of service (remote crash).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2017-5193</cvename>
 <cvename>CVE-2017-5194</cvename>
 <cvename>CVE-2017-5195</cvename>
 <cvename>CVE-2017-5196</cvename>
 <cvename>CVE-2017-5356</cvename>
 <freebsdpr>ports/215800</freebsdpr>
 <url>https://irssi.org/security/irssi_sa_2017_01.txt</url>
 </references>
 <dates>
 <discovery>2017-01-03</discovery>
 <entry>2017-01-05</entry>
 <modified>2017-01-15</modified>
 </dates>
 </vuln>

<vuln vid="496160d3-d3be-11e6-ae1b-002590263bf5">
 <topic>codeigniter -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>codeigniter</name>
	<range><lt>3.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The CodeIgniter changelog reports:
	<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
	 Fixed a number of new vulnerabilities in Security Library method
	 xss_clean().
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.codeigniter.com/user_guide/changelog.html</url>
 </references>
 <dates>
 <discovery>2016-10-28</discovery>
 <entry>2017-01-06</entry>
 </dates>
 </vuln>

<vuln vid="5e439ee7-d3bd-11e6-ae1b-002590263bf5">
 <topic>codeigniter -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>codeigniter</name>
	<range><lt>3.1.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The CodeIgniter changelog reports:
	<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
	 Fixed an SQL injection in the ‘odbc’ database driver.
	 Updated set_realpath() Path Helper function to filter-out php://
	 wrapper inputs.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.codeigniter.com/user_guide/changelog.html</url>
 </references>
 <dates>
 <discovery>2016-07-26</discovery>
 <entry>2017-01-06</entry>
 </dates>
 </vuln>

<vuln vid="eafa3aec-211b-4dd4-9b8a-a664a3f0917a">
 <topic>w3m -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>w3m</name>
	<name>w3m-img</name>
	<name>ja-w3m</name>
	<name>ja-w3m-img</name>
	<range><lt>0.5.3.20170102</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple remote code execution and denial of service conditions present.
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2016/q4/452</url>
 <url>http://seclists.org/oss-sec/2016/q4/516</url>
 <cvename>CVE-2016-9422</cvename>
 <cvename>CVE-2016-9423</cvename>
 <cvename>CVE-2016-9424</cvename>
 <cvename>CVE-2016-9425</cvename>
 <cvename>CVE-2016-9426</cvename>
 <cvename>CVE-2016-9428</cvename>
 <cvename>CVE-2016-9429</cvename>
 <cvename>CVE-2016-9430</cvename>
 <cvename>CVE-2016-9431</cvename>
 <cvename>CVE-2016-9432</cvename>
 <cvename>CVE-2016-9433</cvename>
 <cvename>CVE-2016-9434</cvename>
 <cvename>CVE-2016-9435</cvename>
 <cvename>CVE-2016-9436</cvename>
 <cvename>CVE-2016-9437</cvename>
 <cvename>CVE-2016-9438</cvename>
 <cvename>CVE-2016-9439</cvename>
 <cvename>CVE-2016-9440</cvename>
 <cvename>CVE-2016-9441</cvename>
 <cvename>CVE-2016-9442</cvename>
 <cvename>CVE-2016-9443</cvename>
 <cvename>CVE-2016-9622</cvename>
 <cvename>CVE-2016-9623</cvename>
 <cvename>CVE-2016-9624</cvename>
 <cvename>CVE-2016-9625</cvename>
 <cvename>CVE-2016-9626</cvename>
 <cvename>CVE-2016-9627</cvename>
 <cvename>CVE-2016-9628</cvename>
 <cvename>CVE-2016-9629</cvename>
 <cvename>CVE-2016-9630</cvename>
 <cvename>CVE-2016-9631</cvename>
 <cvename>CVE-2016-9632</cvename>
 <cvename>CVE-2016-9633</cvename>
 </references>
 <dates>
 <discovery>2016-11-03</discovery>
 <entry>2017-01-01</entry>
 <modified>2017-01-09</modified>
 </dates>
 </vuln>

<vuln vid="d0b12952-cb86-11e6-906f-0cc47a065786">
 <topic>h2o -- Use-after-free vulnerability</topic>
 <affects>
 <package>
	<name>h2o</name>
	<range><lt>2.0.4_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kazuho Oku reports:
	<blockquote cite="https://github.com/h2o/h2o/issues?q=label%3Avulnerability">
	 A use-after-free vulnerability exists in H2O up to and including
	 version 2.0.4 / 2.1.0-beta3 that can be used by a remote attacker to
	 mount DoS attacks and / or information theft.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/h2o/h2o/releases/tag/v2.0.5</url>
 <url>https://github.com/h2o/h2o/issues/1144</url>
 </references>
 <dates>
 <discovery>2016-09-09</discovery>
 <entry>2016-12-29</entry>
 </dates>
 </vuln>

<vuln vid="1b61ecef-cdb9-11e6-a9a5-b499baebfeaf">
 <topic>PHP -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php70</name>
	<range><lt>7.0.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Check Point reports:
	<blockquote cite="http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7/">
	 ... discovered 3 fresh and previously unknown vulnerabilities
	 (CVE-2016-7479, CVE-2016-7480, CVE-2016-7478) in the PHP 7
	 unserialize mechanism.
	 The first two vulnerabilities allow attackers to take full control
	 over servers, allowing them to do anything they want with the
	 website, from spreading malware to defacing it or stealing customer
	 data.
	 The last vulnerability generates a Denial of Service attack which
	 basically hangs the website, exhausts its memory consumption, and
	 shuts it down.
	 The PHP security team issued fixes for two of the vulnerabilities
	 on the 13th of October and 1st of December.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7/</url>
 <cvename>CVE-2016-7478</cvename>
 <cvename>CVE-2016-7479</cvename>
 <cvename>CVE-2016-7480</cvename>
 </references>
 <dates>
 <discovery>2016-12-27</discovery>
 <entry>2016-12-29</entry>
 <modified>2017-01-04</modified>
 </dates>
 </vuln>

<vuln vid="6972668d-cdb7-11e6-a9a5-b499baebfeaf">
 <topic>PHP -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php70</name>
	<range><lt>7.0.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP project reports:
	<blockquote cite="http://php.net/ChangeLog-7.php#7.0.14">
	 <ul>
	 <li>Use After Free Vulnerability in unserialize() (CVE-2016-9936)</li>
	 <li>Invalid read when wddx decodes empty boolean element
	 (CVE-2016-9935)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://php.net/ChangeLog-7.php#7.0.14</url>
 <cvename>CVE-2016-9935</cvename>
 <cvename>CVE-2016-9936</cvename>
 </references>
 <dates>
 <discovery>2016-12-08</discovery>
 <entry>2016-12-29</entry>
 </dates>
 </vuln>

<vuln vid="3c4693de-ccf7-11e6-a9a5-b499baebfeaf">
 <topic>phpmailer -- Remote Code Execution</topic>
 <affects>
 <package>
	<name>phpmailer</name>
	<range><lt>5.2.20</lt></range>
 </package>
 <package>
	<name>tt-rss</name>
	<range><lt>29.12.2016.04.37</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Legal Hackers reports:
	<blockquote cite="https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html">
	 An independent research uncovered a critical vulnerability in
	 PHPMailer that could potentially be used by (unauthenticated)
	 remote attackers to achieve remote arbitrary code execution in
	 the context of the web server user and remotely compromise the
	 target web application.
	 To exploit the vulnerability an attacker could target common
	 website components such as contact/feedback forms, registration
	 forms, password email resets and others that send out emails with
	 the help of a vulnerable version of the PHPMailer class.
	 The first patch of the vulnerability CVE-2016-10033 was incomplete.
	 This advisory demonstrates the bypass of the patch. The bypass allows
	 to carry out Remote Code Execution on all current versions (including
	 5.2.19).
	 </blockquote>
 </body>
 </description>
 <references>
 <url>https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html</url>
 <cvename>CVE-2016-10045</cvename>
 </references>
 <dates>
 <discovery>2016-12-28</discovery>
 <entry>2016-12-28</entry>
 </dates>
 </vuln>

<vuln vid="e4bc323f-cc73-11e6-b704-000c292e4fd8">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba36</name>
	<range><ge>3.6.0</ge><le>3.6.25_4</le></range>
 </package>
 <package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><le>4.0.26</le></range>
 </package>
 <package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><le>4.1.23</le></range>
 </package>
 <package>
	<name>samba42</name>
	<range><ge>4.2.0</ge><le>4.2.14</le></range>
 </package>
 <package>
	<name>samba43</name>
	<range><ge>4.3.0</ge><lt>4.3.13</lt></range>
 </package>
 <package>
	<name>samba44</name>
	<range><ge>4.4.0</ge><lt>4.4.8</lt></range>
 </package>
 <package>
	<name>samba45</name>
	<range><ge>4.5.0</ge><lt>4.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samba team reports:
	<blockquote cite="https://www.samba.org/samba/latest_news.html#4.5.3">
	 [CVE-2016-2123] Authenticated users can supply malicious dnsRecord attributes
	 on DNS objects and trigger a controlled memory corruption.
	 [CVE-2016-2125] Samba client code always requests a forwardable ticket
	 when using Kerberos authentication. This means the target server, which must be in the current or trusted
	 domain/realm, is given a valid general purpose Kerberos "Ticket Granting Ticket" (TGT), which can be used to
	 fully impersonate the authenticated user or service.
	 [CVE-2016-2126] A remote, authenticated, attacker can cause the winbindd process
	 to crash using a legitimate Kerberos ticket due to incorrect handling of the PAC checksum.
	 A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2123</cvename>
 <url>https://www.samba.org/samba/security/CVE-2016-2123.html</url>
 <cvename>CVE-2016-2125</cvename>
 <url>https://www.samba.org/samba/security/CVE-2016-2125.html</url>
 <cvename>CVE-2016-2126</cvename>
 <url>https://www.samba.org/samba/security/CVE-2016-2126.html</url>
 </references>
 <dates>
 <discovery>2016-12-19</discovery>
 <entry>2016-12-26</entry>
 <modified>2016-12-26</modified>
 </dates>
 </vuln>

<vuln vid="244c8288-cc4a-11e6-a475-bcaec524bf84">
 <topic>upnp -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>upnp</name>
	<range><lt>1.6.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthew Garett reports:
	<blockquote cite="https://twitter.com/mjg59/status/755062278513319936">
	 Reported this to upstream 8 months ago without response,
	 so: libupnp's default behaviour allows anyone to write to your
	 filesystem. Seriously. Find a device running a libupnp based server
	 (Shodan says there's rather a lot), and POST a file to /testfile.
	 Then GET /testfile ... and yeah if the server is running as root
	 (it is) and is using / as the web root (probably not, but maybe)
	 this gives full host fs access.
	</blockquote>
	Scott Tenaglia reports:
	<blockquote cite="https://sourceforge.net/p/pupnp/bugs/133/">
	 There is a heap buffer overflow vulnerability in the
	 create_url_list function in upnp/src/gena/gena_device.c.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://twitter.com/mjg59/status/755062278513319936</url>
 <url>https://sourceforge.net/p/pupnp/bugs/133/</url>
 <cvename>CVE-2016-6255</cvename>
 <cvename>CVE-2016-8863</cvename>
 </references>
 <dates>
 <discovery>2016-02-23</discovery>
 <entry>2016-12-27</entry>
 </dates>
 </vuln>

<vuln vid="c7656d4c-cb60-11e6-a9a5-b499baebfeaf">
 <topic>phpmailer -- Remote Code Execution</topic>
 <affects>
 <package>
	<name>phpmailer</name>
	<range><lt>5.2.18</lt></range>
 </package>
 <package>
	<name>tt-rss</name>
	<range><lt>26.12.2016.07.29</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Legal Hackers reports:
	<blockquote cite="http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html">
	 An independent research uncovered a critical vulnerability in
	 PHPMailer that could potentially be used by (unauthenticated)
	 remote attackers to achieve remote arbitrary code execution in
	 the context of the web server user and remotely compromise the
	 target web application.
	 To exploit the vulnerability an attacker could target common
	 website components such as contact/feedback forms, registration
	 forms, password email resets and others that send out emails with
	 the help of a vulnerable version of the PHPMailer class.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html</url>
 <url>https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md</url>
 <cvename>CVE-2016-10033</cvename>
 </references>
 <dates>
 <discovery>2016-12-26</discovery>
 <entry>2016-12-26</entry>
 </dates>
 </vuln>

<vuln vid="e7002b26-caaa-11e6-a76a-9f7324e5534e">
 <topic>exim -- DKIM private key leak</topic>
 <affects>
 <package>
	<name>exim</name>
	<range><gt>4.69</gt><lt>4.87.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Exim project reports:
	<blockquote cite="https://exim.org/static/doc/CVE-2016-9963.txt">
	 Exim leaks the private DKIM signing key to the log files.
	 Additionally, if the build option EXPERIMENTAL_DSN_INFO=yes is used,
	 the key material is included in the bounce message.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://exim.org/static/doc/CVE-2016-9963.txt</url>
 <cvename>CVE-2016-9963</cvename>
 </references>
 <dates>
 <discovery>2016-12-15</discovery>
 <entry>2016-12-25</entry>
 </dates>
 </vuln>

<vuln vid="c40ca16c-4d9f-4d70-8b6c-4d53aeb8ead4">
 <topic>cURL -- uninitialized random vulnerability</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.52.0</ge><lt>7.52.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Project curl Security Advisory:
	<blockquote cite="https://curl.haxx.se/docs/adv_20161223.html">
	 libcurl's (new) internal function that returns a good 32bit
	 random value was implemented poorly and overwrote the pointer
	 instead of writing the value into the buffer the pointer
	 pointed to.
	 This random value is used to generate nonces for Digest and
	 NTLM authentication, for generating boundary strings in HTTP
	 formposts and more. Having a weak or virtually non-existent
	 random there makes these operations vulnerable.
	 This function is brand new in 7.52.0 and is the result of an
	 overhaul to make sure libcurl uses strong random as much as
	 possible - provided by the backend TLS crypto libraries when
	 present. The faulty function was introduced in this commit.
	 We are not aware of any exploit of this flaw.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/adv_20161223.html</url>
 <cvename>CVE-2016-9594</cvename>
 </references>
 <dates>
 <discovery>2016-12-23</discovery>
 <entry>2016-12-24</entry>
 </dates>
 </vuln>

<vuln vid="41f8af15-c8b9-11e6-ae1b-002590263bf5">
 <topic>squid -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><ge>3.1</ge><lt>3.5.23</lt></range>
 </package>
 <package>
	<name>squid-devel</name>
	<range><ge>4.0</ge><lt>4.0.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid security advisory 2016:10 reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_10.txt">
	 Due to incorrect comparison of request headers Squid can deliver
	 responses containing private data to clients it should not have
	 reached.
	 This problem allows a remote attacker to discover private and
	 sensitive information about another clients browsing session.
	 Potentially including credentials which allow access to further
	 sensitive resources. This problem only affects Squid configured
	 to use the Collapsed Forwarding feature. It is of particular
	 importance for HTTPS reverse-proxy sites with Collapsed
	 Forwarding.
	</blockquote>
	Squid security advisory 2016:11 reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_11.txt">
	 Due to incorrect HTTP conditional request handling Squid can
	 deliver responses containing private data to clients it should not
	 have reached.
	 This problem allows a remote attacker to discover private and
	 sensitive information about another clients browsing session.
	 Potentially including credentials which allow access to further
	 sensitive resources..
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-10002</cvename>
 <cvename>CVE-2016-10003</cvename>
 <freebsdpr>ports/215416</freebsdpr>
 <freebsdpr>ports/215418</freebsdpr>
 <url>http://www.squid-cache.org/Advisories/SQUID-2016_10.txt</url>
 <url>http://www.squid-cache.org/Advisories/SQUID-2016_11.txt</url>
 </references>
 <dates>
 <discovery>2016-12-16</discovery>
 <entry>2016-12-23</entry>
 </dates>
 </vuln>

<vuln vid="c11629d3-c8ad-11e6-ae1b-002590263bf5">
 <topic>vim -- arbitrary command execution</topic>
 <affects>
 <package>
	<name>vim</name>
	<name>vim-console</name>
	<name>vim-lite</name>
	<range><lt>8.0.0056</lt></range>
 </package>
 <package>
	<name>neovim</name>
	<range><lt>0.1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1248">
	 vim before patch 8.0.0056 does not properly validate values for the
	 'filetype', 'syntax' and 'keymap' options, which may result in the
	 execution of arbitrary code if a file with a specially crafted
	 modeline is opened.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1248</cvename>
 <bid>94478</bid>
 <url>https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a</url>
 <url>https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040</url>
 </references>
 <dates>
 <discovery>2016-11-22</discovery>
 <entry>2016-12-23</entry>
 </dates>
 </vuln>

<vuln vid="c290f093-c89e-11e6-821e-68f7288bdf41">
 <topic>Pligg CMS -- XSS Vulnerability</topic>
 <affects>
 <package>
	<name>pligg</name>
	<range><le>2.0.2,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Netsparker reports: 
	<blockquote cite="https://www.netsparker.com/web-applications-advisories/ns-15-011-xss-vulnerability-identified-in-pligg-cms/">
	 Proof of Concept URL for XSS in Pligg CMS:
	 Page: groups.php
	 Parameter Name: keyword
	 Parameter Type: GET
	 Attack Pattern: http://example.com/pligg-cms-2.0.2/groups.php?view=search&amp;keyword='+alert(0x000D82)+'
	 For more information on cross-site scripting vulnerabilities read the article Cross-site Scripting (XSS).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.netsparker.com/web-applications-advisories/ns-15-011-xss-vulnerability-identified-in-pligg-cms/</url>
 </references>
 <dates>
 <discovery>2015-05-13</discovery>
 <entry>2016-12-22</entry>
 </dates>
 </vuln>

<vuln vid="fcedcdbb-c86e-11e6-b1cf-14dae9d210b8">
 <topic>FreeBSD -- Multiple vulnerabilities of ntp</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_6</lt></range>
	<range><ge>10.3</ge><lt>10.3_15</lt></range>
	<range><ge>10.2</ge><lt>10.2_28</lt></range>
	<range><ge>10.1</ge><lt>10.1_45</lt></range>
	<range><ge>9.3</ge><lt>9.3_53</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Multiple vulnerabilities have been discovered in the NTP
	suite:
	CVE-2016-9311: Trap crash, Reported by Matthew Van Gundy
	of Cisco ASIG.
	CVE-2016-9310: Mode 6 unauthenticated trap information
	disclosure and DDoS vector. Reported by Matthew Van Gundy
	of Cisco ASIG.
	CVE-2016-7427: Broadcast Mode Replay Prevention DoS.
	Reported by Matthew Van Gundy of Cisco ASIG.
	CVE-2016-7428: Broadcast Mode Poll Interval Enforcement
	DoS. Reported by Matthew Van Gundy of Cisco ASIG.
	CVE-2016-7431: Regression: 010-origin: Zero Origin
	Timestamp Bypass. Reported by Sharon Goldberg and Aanchal
	Malhotra of Boston University.
	CVE-2016-7434: Null pointer dereference in
	_IO_str_init_static_internal(). Reported by Magnus Stubman.
	CVE-2016-7426: Client rate limiting and server responses.
	Reported by Miroslav Lichvar of Red Hat.
	CVE-2016-7433: Reboot sync calculation problem. Reported
	independently by Brian Utterback of Oracle, and by Sharon
	Goldberg and Aanchal Malhotra of Boston University.
	<h1>Impact:</h1>
	A remote attacker who can send a specially crafted packet
	to cause a NULL pointer dereference that will crash ntpd,
	resulting in a Denial of Service. [CVE-2016-9311]
	An exploitable configuration modification vulnerability
	exists in the control mode (mode 6) functionality of ntpd.
	If, against long-standing BCP recommendations, "restrict
	default noquery ..." is not specified, a specially crafted
	control mode packet can set ntpd traps, providing information
	disclosure and DDoS amplification, and unset ntpd traps,
	disabling legitimate monitoring by an attacker from remote.
	[CVE-2016-9310]
	An attacker with access to the NTP broadcast domain can
	periodically inject specially crafted broadcast mode NTP
	packets into the broadcast domain which, while being logged
	by ntpd, can cause ntpd to reject broadcast mode packets
	from legitimate NTP broadcast servers. [CVE-2016-7427]
	An attacker with access to the NTP broadcast domain can
	send specially crafted broadcast mode NTP packets to the
	broadcast domain which, while being logged by ntpd, will
	cause ntpd to reject broadcast mode packets from legitimate
	NTP broadcast servers. [CVE-2016-7428]
	Origin timestamp problems were fixed in ntp 4.2.8p6.
	However, subsequent timestamp validation checks introduced
	a regression in the handling of some Zero origin timestamp
	checks. [CVE-2016-7431]
	If ntpd is configured to allow mrulist query requests
	from a server that sends a crafted malicious packet, ntpd
	will crash on receipt of that crafted malicious mrulist
	query packet. [CVE-2016-7434]
	An attacker who knows the sources (e.g., from an IPv4
	refid in server response) and knows the system is (mis)configured
	in this way can periodically send packets with spoofed
	source address to keep the rate limiting activated and
	prevent ntpd from accepting valid responses from its sources.
	[CVE-2016-7426]
	Ntp Bug 2085 described a condition where the root delay
	was included twice, causing the jitter value to be higher
	than expected. Due to a misinterpretation of a small-print
	variable in The Book, the fix for this problem was incorrect,
	resulting in a root distance that did not include the peer
	dispersion. The calculations and formulas have been reviewed
	and reconciled, and the code has been updated accordingly.
	[CVE-2016-7433]
 </body>
 </description>
 <references>
 <cvename>CVE-2016-7426</cvename>
 <cvename>CVE-2016-7427</cvename>
 <cvename>CVE-2016-7428</cvename>
 <cvename>CVE-2016-7431</cvename>
 <cvename>CVE-2016-7433</cvename>
 <cvename>CVE-2016-7434</cvename>
 <cvename>CVE-2016-9310</cvename>
 <cvename>CVE-2016-9311</cvename>
 <freebsdsa>SA-16:39.ntp</freebsdsa>
 </references>
 <dates>
 <discovery>2016-12-22</discovery>
 <entry>2016-12-22</entry>
 </dates>
 </vuln>

<vuln vid="42880202-c81c-11e6-a9a5-b499baebfeaf">
 <topic>cURL -- buffer overflow</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.1</ge><lt>7.52</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports:
	<blockquote cite="https://curl.haxx.se/docs/vuln-7.51.0.html">
	 <h2>printf floating point buffer overflow</h2>
	 libcurl's implementation of the printf() functions triggers a
	 buffer overflow when doing a large floating point output. The bug
	 occurs when the conversion outputs more than 255 bytes.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/vuln-7.51.0.html</url>
 <cvename>CVE-2016-9586</cvename>
 </references>
 <dates>
 <discovery>2016-12-21</discovery>
 <entry>2016-12-22</entry>
 </dates>
 </vuln>

<vuln vid="624b45c0-c7f3-11e6-ae1b-002590263bf5">
 <topic>Joomla! -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><ge>1.6.0</ge><lt>3.6.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="https://developer.joomla.org/security-centre/664-20161201-core-elevated-privileges.html">
	 <h2>[20161201] - Core - Elevated Privileges</h2>
	 Incorrect use of unfiltered data stored to the session on a form
	 validation failure allows for existing user accounts to be modified;
	 to include resetting their username, password, and user group
	 assignments.
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/665-20161202-core-shell-upload.html">
	 <h2>[20161202] - Core - Shell Upload</h2>
	 Inadequate filesystem checks allowed files with alternative PHP
	 file extensions to be uploaded.
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/666-20161203-core-information-disclosure.html">
	 <h2>[20161203] - Core - Information Disclosure</h2>
	 Inadequate ACL checks in the Beez3 com_content article layout
	 override enables a user to view restricted content.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9836</cvename>
 <cvename>CVE-2016-9837</cvename>
 <cvename>CVE-2016-9838</cvename>
 <url>https://developer.joomla.org/security-centre/664-20161201-core-elevated-privileges.html</url>
 <url>https://developer.joomla.org/security-centre/665-20161202-core-shell-upload.html</url>
 <url>https://developer.joomla.org/security-centre/666-20161203-core-information-disclosure.html</url>
 <url>https://www.joomla.org/announcements/release-news/5693-joomla-3-6-5-released.html</url>
 </references>
 <dates>
 <discovery>2016-12-06</discovery>
 <entry>2016-12-22</entry>
 </dates>
 </vuln>

<vuln vid="a27d234a-c7f2-11e6-ae1b-002590263bf5">
 <topic>Joomla! -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><ge>3.4.4</ge><lt>3.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html">
	 <h2>[20161001] - Core - Account Creation</h2>
	 Inadequate checks allows for users to register on a site when
	 registration has been disabled.
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/660-20161002-core-elevated-privileges.html">
	 <h2>[20161002] - Core - Elevated Privilege</h2>
	 Incorrect use of unfiltered data allows for users to register on a
	 site with elevated privileges.
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.html">
	 <h2>[20161003] - Core - Account Modifications</h2>
	 Incorrect use of unfiltered data allows for existing user accounts
	 to be modified; to include resetting their username, password, and
	 user group assignments.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-8869</cvename>
 <cvename>CVE-2016-8870</cvename>
 <cvename>CVE-2016-9081</cvename>
 <url>https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html</url>
 <url>https://developer.joomla.org/security-centre/660-20161002-core-elevated-privileges.html</url>
 <url>https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.html</url>
 <url>https://www.joomla.org/announcements/release-news/5678-joomla-3-6-4-released.html</url>
 </references>
 <dates>
 <discovery>2016-10-25</discovery>
 <entry>2016-12-22</entry>
 </dates>
 </vuln>

<vuln vid="f0806cad-c7f1-11e6-ae1b-002590263bf5">
 <topic>Joomla! -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><ge>1.6.0</ge><lt>3.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="https://developer.joomla.org/security-centre/652-20160801-core-core-acl-violations.html">
	 <h2>[20160801] - Core - ACL Violation</h2>
	 Inadequate ACL checks in com_content provide potential read access
	 to data which should be access restricted to users with edit_own
	 level.
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/653-20160802-core-xss-vulnerability.html">
	 <h2>[20160802] - Core - XSS Vulnerability</h2>
	 Inadequate escaping leads to XSS vulnerability in mail component.
	 
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/654-20160803-core-csrf.html">
	 <h2>[20160803] - Core - CSRF</h2>
	 Add additional CSRF hardening in com_joomlaupdate.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://developer.joomla.org/security-centre/652-20160801-core-core-acl-violations.html</url>
 <url>https://developer.joomla.org/security-centre/653-20160802-core-xss-vulnerability.html</url>
 <url>https://developer.joomla.org/security-centre/654-20160803-core-csrf.html</url>
 <url>https://www.joomla.org/announcements/release-news/5665-joomla-3-6-1-released.html</url>
 </references>
 <dates>
 <discovery>2016-08-03</discovery>
 <entry>2016-12-22</entry>
 </dates>
 </vuln>

<vuln vid="c0ef061a-c7f0-11e6-ae1b-002590263bf5">
 <topic>Joomla! -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><ge>1.5.0</ge><lt>3.4.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="https://developer.joomla.org/security-centre/639-20151206-core-session-hardening.html">
	 <h2>[20151206] - Core - Session Hardening</h2>
	 The Joomla Security Strike team has been following up on the
	 critical security vulnerability patched last week. Since the recent
	 update it has become clear that the root cause is a bug in PHP
	 itself. This was fixed by PHP in September of 2015 with the releases
	 of PHP 5.4.45, 5.5.29, 5.6.13 (Note that this is fixed in all
	 versions of PHP 7 and has been back-ported in some specific Linux
	 LTS versions of PHP 5.3). This fixes the bug across all supported
	 PHP versions.
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/640-20151207-core-sql-injection.html">
	 <h2>[20151207] - Core - SQL Injection</h2>
	 Inadequate filtering of request data leads to a SQL Injection
	 vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://developer.joomla.org/security-centre/639-20151206-core-session-hardening.html</url>
 <url>https://developer.joomla.org/security-centre/640-20151207-core-sql-injection.html</url>
 <url>https://www.joomla.org/announcements/release-news/5643-joomla-3-4-7.html</url>
 </references>
 <dates>
 <discovery>2015-12-21</discovery>
 <entry>2016-12-22</entry>
 </dates>
 </vuln>

<vuln vid="3ae078ca-c7eb-11e6-ae1b-002590263bf5">
 <topic>xen-kernel -- x86 PV guests may be able to mask interrupts</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.7.1_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-202.html">
	 Certain PV guest kernel operations (page table writes in
	 particular) need emulation, and use Xen's general x86 instruction
	 emulator. This allows a malicious guest kernel which asynchronously
	 modifies its instruction stream to effect the clearing of EFLAGS.IF
	 from the state used to return to guest context.
	 A malicious guest kernel administrator can cause a host hang or
	 crash, resulting in a Denial of Service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-10024</cvename>
 <url>https://xenbits.xen.org/xsa/advisory-202.html</url>
 </references>
 <dates>
 <discovery>2016-12-21</discovery>
 <entry>2016-12-22</entry>
 </dates>
 </vuln>

<vuln vid="862d6ab3-c75e-11e6-9f98-20cf30e32f6d">
 <topic>Apache httpd -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache Software Foundation reports:
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
 <cvename>CVE-2016-8743</cvename>
 <cvename>CVE-2016-2161</cvename>
 <cvename>CVE-2016-0736</cvename>
 <cvename>CVE-2016-8740</cvename>
 <cvename>CVE-2016-5387</cvename>
 </references>
 <dates>
 <discovery>2016-12-20</discovery>
 <entry>2016-12-21</entry>
 <modified>2016-12-22</modified>
 </dates>
 </vuln>

<vuln vid="942433db-c661-11e6-ae1b-002590263bf5">
 <topic>xen-kernel -- x86: Mishandling of SYSCALL singlestep during emulation</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.7.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-204.html">
	 The typical behaviour of singlestepping exceptions is determined at
	 the start of the instruction, with a #DB trap being raised at the
	 end of the instruction. SYSCALL (and SYSRET, although we don't
	 implement it) behave differently because the typical behaviour
	 allows userspace to escalate its privilege. (This difference in
	 behaviour seems to be undocumented.) Xen wrongly raised the
	 exception based on the flags at the start of the instruction.
	 Guest userspace which can invoke the instruction emulator can use
	 this flaw to escalate its privilege to that of the guest kernel.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-10013</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-204.html</url>
 </references>
 <dates>
 <discovery>2016-12-19</discovery>
 <entry>2016-12-20</entry>
 </dates>
 </vuln>

<vuln vid="e47ab5db-c333-11e6-ae1b-002590263bf5">
 <topic>atheme-services -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>atheme-services</name>
	<range><lt>7.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9773">
	 modules/chanserv/flags.c in Atheme before 7.2.7 allows remote
	 attackers to modify the Anope FLAGS behavior by registering and
	 dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4478">
	 Buffer overflow in the xmlrpc_char_encode function in
	 modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows
	 remote attackers to cause a denial of service via vectors related
	 to XMLRPC response encoding.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/209217</freebsdpr>
 <cvename>CVE-2014-9773</cvename>
 <cvename>CVE-2016-4478</cvename>
 <url>https://github.com/atheme/atheme/commit/87580d767868360d2fed503980129504da84b63e</url>
 <url>https://github.com/atheme/atheme/commit/c597156adc60a45b5f827793cd420945f47bc03b</url>
 </references>
 <dates>
 <discovery>2016-01-09</discovery>
 <entry>2016-12-16</entry>
 </dates>
 </vuln>

<vuln vid="512c0ffd-cd39-4da4-b2dc-81ff4ba8e238">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>50.1.0_1,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.47</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>45.6.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>45.6.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>45.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/">
	CVE-2016-9894: Buffer overflow in SkiaGL
	CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements
	CVE-2016-9895: CSP bypass using marquee tag
	CVE-2016-9896: Use-after-free with WebVR
	CVE-2016-9897: Memory corruption in libGLES
	CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees
	CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs
	CVE-2016-9904: Cross-origin information leak in shared atoms
	CVE-2016-9901: Data from Pocket server improperly sanitized before execution
	CVE-2016-9902: Pocket extension does not validate the origin of events
	CVE-2016-9903: XSS injection vulnerability in add-ons SDK
	CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1
	CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9894</cvename>
 <cvename>CVE-2016-9899</cvename>
 <cvename>CVE-2016-9895</cvename>
 <cvename>CVE-2016-9896</cvename>
 <cvename>CVE-2016-9897</cvename>
 <cvename>CVE-2016-9898</cvename>
 <cvename>CVE-2016-9900</cvename>
 <cvename>CVE-2016-9904</cvename>
 <cvename>CVE-2016-9901</cvename>
 <cvename>CVE-2016-9902</cvename>
 <cvename>CVE-2016-9903</cvename>
 <cvename>CVE-2016-9080</cvename>
 <cvename>CVE-2016-9893</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-94/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-95/</url>
 </references>
 <dates>
 <discovery>2016-12-13</discovery>
 <entry>2016-12-14</entry>
 </dates>
 </vuln>

<vuln vid="54e50cd9-c1a8-11e6-ae1b-002590263bf5">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.6.1,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jeremy Felt reports:
	<blockquote cite="https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/">
	 WordPress versions 4.6 and earlier are affected by two security
	 issues: a cross-site scripting vulnerability via image filename,
	 reported by SumOfPwn researcher Cengiz Han Sahin; and a path
	 traversal vulnerability in the upgrade package uploader, reported
	 by Dominik Schilling from the WordPress security team.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2016-09-07</discovery>
 <entry>2016-12-14</entry>
 </dates>
 </vuln>

<vuln vid="80a897a2-c1a6-11e6-ae1b-002590263bf5">
 <topic>xen-kernel -- x86 CMPXCHG8B emulation fails to ignore operand size override</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.7.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-200.html">
	 The x86 instruction CMPXCHG8B is supposed to ignore legacy operand
	 size overrides; it only honors the REX.W override (making it
	 CMPXCHG16B). So, the operand size is always 8 or 16. When support
	 for CMPXCHG16B emulation was added to the instruction emulator,
	 this restriction on the set of possible operand sizes was relied on
	 in some parts of the emulation; but a wrong, fully general, operand
	 size value was used for other parts of the emulation. As a result,
	 if a guest uses a supposedly-ignored operand size prefix, a small
	 amount of hypervisor stack data is leaked to the guests: a 96 bit
	 leak to guests running in 64-bit mode; or, a 32 bit leak to other
	 guests.
	 A malicious unprivileged guest may be able to obtain sensitive
	 information from the host.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9932</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-200.html</url>
 </references>
 <dates>
 <discovery>2016-12-13</discovery>
 <entry>2016-12-14</entry>
 </dates>
 </vuln>

<vuln vid="2d56308b-c0a8-11e6-a9a5-b499baebfeaf">
 <topic>PHP -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php56</name>
	<range><lt>5.6.29</lt></range>
 </package>
 <package>
	<name>php70</name>
	<range><lt>7.0.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP project reports:
	<blockquote cite="http://php.net/archive/2016.php#id2016-12-08-1">
	 This is a security release. Several security bugs were fixed in
	 this release.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://php.net/archive/2016.php#id2016-12-08-1</url>
 <url>http://php.net/archive/2016.php#id2016-12-08-2</url>
 </references>
 <dates>
 <discovery>2016-12-12</discovery>
 <entry>2016-12-12</entry>
 </dates>
 </vuln>

<vuln vid="c0b13887-be44-11e6-b04f-001999f8d30b">
 <topic>asterisk -- Authentication Bypass</topic>
 <affects>
 <package>
	<name>asterisk11</name>
	<range><lt>11.25.1</lt></range>
 </package>
 <package>
	<name>asterisk13</name>
	<range><lt>13.13.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 The chan_sip channel driver has a liberal definition
	 for whitespace when attempting to strip the content between
	 a SIP header name and a colon character. Rather than
	 following RFC 3261 and stripping only spaces and horizontal
	 tabs, Asterisk treats any non-printable ASCII character
	 as if it were whitespace.
	 This mostly does not pose a problem until Asterisk is
	 placed in tandem with an authenticating SIP proxy. In
	 such a case, a crafty combination of valid and invalid
	 To headers can cause a proxy to allow an INVITE request
	 into Asterisk without authentication since it believes
	 the request is an in-dialog request. However, because of
	 the bug described above, the request will look like an
	 out-of-dialog request to Asterisk. Asterisk will then
	 process the request as a new call. The result is that
	 Asterisk can process calls from unvetted sources without
	 any authentication.
	 If you do not use a proxy for authentication, then
	 this issue does not affect you.
	 If your proxy is dialog-aware (meaning that the proxy
	 keeps track of what dialogs are currently valid), then
	 this issue does not affect you.
	 If you use chan_pjsip instead of chan_sip, then this
	 issue does not affect you.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.digium.com/pub/security/ASTERISK-2016-009.html</url>
 </references>
 <dates>
 <discovery>2016-11-28</discovery>
 <entry>2016-12-09</entry>
 </dates>
 </vuln>

<vuln vid="9e6640fe-be3a-11e6-b04f-001999f8d30b">
 <topic>asterisk -- Crash on SDP offer or answer from endpoint using Opus</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><ge>13.12.0</ge><lt>13.13.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 If an SDP offer or answer is received with the Opus
	 codec and with the format parameters separated using a
	 space the code responsible for parsing will recursively
	 call itself until it crashes. This occurs as the code
	 does not properly handle spaces separating the parameters.
	 This does NOT require the endpoint to have Opus configured
	 in Asterisk. This also does not require the endpoint to
	 be authenticated. If guest is enabled for chan_sip or
	 anonymous in chan_pjsip an SDP offer or answer is still
	 processed and the crash occurs.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2016-008.html</url>
 </references>
 <dates>
 <discovery>2016-11-11</discovery>
 <entry>2016-12-09</entry>
 </dates>
 </vuln>

<vuln vid="eab68cff-bc0c-11e6-b2ca-001b3856973b">
 <topic>cryptopp -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cryptopp</name>
	<range><lt>5.6.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple sources report:
	<blockquote cite="https://eprint.iacr.org/2015/368">
	 CVE-2015-2141: The InvertibleRWFunction::CalculateInverse function
	 in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key
	 operations for the Rabin-Williams digital signature algorithm, which
	 allows remote attackers to obtain private keys via a timing attack.
	 Fixed in 5.6.3.
	</blockquote>
	<blockquote cite="https://github.com/weidai11/cryptopp/issues/146">
	 CVE-2016-3995: Incorrect implementation of Rijndael timing attack
	 countermeasure. Fixed in 5.6.4.
	</blockquote>
	<blockquote cite="https://github.com/weidai11/cryptopp/issues/277">
	 CVE-2016-7420: Library built without -DNDEBUG could egress sensitive
	 information to the filesystem via a core dump if an assert was triggered.
	 Fixed in 5.6.5.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://eprint.iacr.org/2015/368</url>
 <url>https://github.com/weidai11/cryptopp/issues/146</url>
 <url>https://github.com/weidai11/cryptopp/issues/277</url>
 <cvename>CVE-2015-2141</cvename>
 <cvename>CVE-2016-3995</cvename>
 <cvename>CVE-2016-7420</cvename>
 </references>
 <dates>
 <discovery>2015-02-27</discovery>
 <entry>2016-12-06</entry>
 </dates>
 </vuln>

<vuln vid="e722e3c6-bbee-11e6-b1cf-14dae9d210b8">
 <topic>FreeBSD -- bhyve(8) virtual machine escape</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_4</lt></range>
	<range><ge>10.3</ge><lt>10.3_13</lt></range>
	<range><ge>10.2</ge><lt>10.2_26</lt></range>
	<range><ge>10.1</ge><lt>10.1_43</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The bounds checking of accesses to guest memory greater
	than 4GB by device emulations is subject to integer
	overflow.
	<h1>Impact:</h1>
	For a bhyve virtual machine with more than 3GB of guest
	memory configured, a malicious guest could craft device
	descriptors that could give it access to the heap of the
	bhyve process. Since the bhyve process is running as root,
	this may allow guests to obtain full control of the hosts
	they're running on.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1889</cvename>
 <freebsdsa>SA-16:38.bhyve</freebsdsa>
 </references>
 <dates>
 <discovery>2016-12-06</discovery>
 <entry>2016-12-06</entry>
 </dates>
 </vuln>

<vuln vid="0282269d-bbee-11e6-b1cf-14dae9d210b8">
 <topic>FreeBSD -- link_ntoa(3) buffer overflow</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_5</lt></range>
	<range><ge>10.3</ge><lt>10.3_14</lt></range>
	<range><ge>10.2</ge><lt>10.2_27</lt></range>
	<range><ge>10.1</ge><lt>10.1_44</lt></range>
	<range><ge>9.3</ge><lt>9.3_52</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A specially crafted argument can trigger a static buffer
	overflow in the library, with possibility to rewrite following
	static buffers that belong to other library functions.
	<h1>Impact:</h1>
	Due to very limited use of the function in the existing
	applications, and limited length of the overflow, exploitation
	of the vulnerability does not seem feasible. None of the
	utilities and daemons in the base system are known to be
	vulnerable. However, careful review of third party software
	that may use the function was not performed.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-6559</cvename>
 <freebsdsa>SA-16:37.libc</freebsdsa>
 </references>
 <dates>
 <discovery>2016-12-06</discovery>
 <entry>2016-12-06</entry>
 <modified>2016-12-08</modified>
 </dates>
 </vuln>

<vuln vid="e00304d2-bbed-11e6-b1cf-14dae9d210b8">
 <topic>FreeBSD -- Possible login(1) argument injection in telnetd(8)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_4</lt></range>
	<range><ge>10.3</ge><lt>10.3_13</lt></range>
	<range><ge>10.2</ge><lt>10.2_26</lt></range>
	<range><ge>10.1</ge><lt>10.1_43</lt></range>
	<range><ge>9.3</ge><lt>9.3_51</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	An unexpected sequence of memory allocation failures
	combined with insufficient error checking could result in
	the construction and execution of an argument sequence that
	was not intended.
	<h1>Impact:</h1>
	An attacker who controls the sequence of memory allocation
	failures and success may cause login(1) to run without
	authentication and may be able to cause misbehavior of
	login(1) replacements.
	No practical way of controlling these memory allocation
	failures is known at this time.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1888</cvename>
 <freebsdsa>SA-16:36.telnetd</freebsdsa>
 </references>
 <dates>
 <discovery>2016-12-06</discovery>
 <entry>2016-12-06</entry>
 </dates>
 </vuln>

<vuln vid="cb0bf1ec-bb92-11e6-a9a5-b499baebfeaf">
 <topic>Apache httpd -- denial of service in HTTP/2</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><ge>2.4.17</ge><le>2.4.23_1</le></range>
 </package>
 <package>
	<name>mod_http2-devel</name>
	<range><lt>1.8.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mod_http2 reports:
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/httpd-announce/201612.mbox/%3C1A097A43-7CCB-4BA1-861F-E0C7EEE83A4B%40apache.org%3E">
	 The Apache HTTPD web server (from 2.4.17-2.4.23) did not apply
	 limitations on request headers correctly when experimental module
	 for the HTTP/2 protocol is used to access a resource.
	 The net result is that a the server allocates too much memory
	 instead of denying the request. This can lead to memory exhaustion
	 of the server by a properly crafted request.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://mail-archives.apache.org/mod_mbox/httpd-announce/201612.mbox/%3C1A097A43-7CCB-4BA1-861F-E0C7EEE83A4B%40apache.org%3E</url>
 <url>https://github.com/icing/mod_h2/releases/tag/v1.8.3</url>
 <cvename>CVE-2016-8740</cvename>
 </references>
 <dates>
 <discovery>2016-12-06</discovery>
 <entry>2016-12-06</entry>
 </dates>
 </vuln>

<vuln vid="603fe0a1-bb26-11e6-8e5a-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>55.0.2883.75</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/12/stable-channel-update-for-desktop.html">
	 36 security fixes in this release
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9651</cvename>
 <cvename>CVE-2016-5208</cvename>
 <cvename>CVE-2016-5207</cvename>
 <cvename>CVE-2016-5206</cvename>
 <cvename>CVE-2016-5205</cvename>
 <cvename>CVE-2016-5204</cvename>
 <cvename>CVE-2016-5209</cvename>
 <cvename>CVE-2016-5203</cvename>
 <cvename>CVE-2016-5210</cvename>
 <cvename>CVE-2016-5212</cvename>
 <cvename>CVE-2016-5211</cvename>
 <cvename>CVE-2016-5213</cvename>
 <cvename>CVE-2016-5214</cvename>
 <cvename>CVE-2016-5216</cvename>
 <cvename>CVE-2016-5215</cvename>
 <cvename>CVE-2016-5217</cvename>
 <cvename>CVE-2016-5218</cvename>
 <cvename>CVE-2016-5219</cvename>
 <cvename>CVE-2016-5221</cvename>
 <cvename>CVE-2016-5220</cvename>
 <cvename>CVE-2016-5222</cvename>
 <cvename>CVE-2016-9650</cvename>
 <cvename>CVE-2016-5223</cvename>
 <cvename>CVE-2016-5226</cvename>
 <cvename>CVE-2016-5225</cvename>
 <cvename>CVE-2016-5224</cvename>
 <cvename>CVE-2016-9652</cvename>
 <url>https://googlechromereleases.blogspot.nl/2016/12/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2016-12-01</discovery>
 <entry>2016-12-05</entry>
 </dates>
 </vuln>

<vuln vid="e1f67063-aab4-11e6-b2d3-60a44ce6887b">
 <topic>ImageMagick7 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ImageMagick7</name>
	<name>ImageMagick7-nox11</name>
	<range><lt>7.0.3.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple sources report:
	<blockquote cite="https://github.com/ImageMagick/ImageMagick/issues/296">
	 CVE-2016-9298: heap overflow in WaveletDenoiseImage(), fixed in ImageMagick7-7.0.3.6, discovered 2016-10-31
	</blockquote>
	<blockquote cite="https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/">
	 CVE-2016-8866: memory allocation failure in AcquireMagickMemory (incomplete previous fix for CVE-2016-8862), not fixed yet with the release of this announcement, re-discovered 2016-10-13.
	</blockquote>
	<blockquote cite="https://blogs.gentoo.org/ago/2016/10/17/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c/">
	 CVE-2016-8862: memory allocation failure in AcquireMagickMemory, initially partially fixed in ImageMagick7-7.0.3.3, discovered 2016-09-14.
	</blockquote>
 </body>
 </description>
 <references>
	<url>https://github.com/ImageMagick/ImageMagick/issues/296</url>
	<url>https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/</url>
	<url>https://blogs.gentoo.org/ago/2016/10/17/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c/</url>
	<cvename>CVE-2016-9298</cvename>
	<cvename>CVE-2016-8866</cvename>
	<cvename>CVE-2016-8862</cvename>
	<freebsdpr>ports/214514</freebsdpr>
 </references>
 <dates>
 <discovery>2016-09-14</discovery>
 <entry>2016-12-04</entry>
 </dates>
 </vuln>

<vuln vid="bc4898d5-a794-11e6-b2d3-60a44ce6887b">
 <topic>Pillow -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-pillow</name>
	<name>py33-pillow</name>
	<name>py34-pillow</name>
	<name>py35-pillow</name>
	<range><lt>3.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pillow reports:
	<blockquote cite="http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html">
	 Pillow prior to 3.3.2 may experience integer overflow
	 errors in map.c when reading specially crafted image files. This may
	 lead to memory disclosure or corruption.
	 Pillow prior to 3.3.2 and PIL 1.1.7 (at least) do not check
	 for negative image sizes in ImagingNew in Storage.c. A negative image
	 size can lead to a smaller allocation than expected, leading to arbi
	 trary writes.
	</blockquote>
 </body>
 </description>
 <references>
	<url>http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html</url>
	<url>https://github.com/python-pillow/Pillow/issues/2105</url>
	<cvename>CVE-2016-9189</cvename>
	<cvename>CVE-2016-9190</cvename>
	<freebsdpr>ports/214410</freebsdpr>
 </references>
 <dates>
 <discovery>2016-09-06</discovery>
 <entry>2016-12-04</entry>
 </dates>
 </vuln>

<vuln vid="19d35b0f-ba73-11e6-b1cf-14dae9d210b8">
 <topic>ImageMagick -- heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.9.6.4,1</lt></range>
 </package>
 <package>
	<name>ImageMagick7</name>
	<name>ImageMagick7-nox11</name>
	<range><lt>7.0.3.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bastien Roucaries reports:
	<blockquote cite="http://seclists.org/oss-sec/2016/q4/413">
	 Imagemagick before 3cbfb163cff9e5b8cdeace8312e9bfee810ed02b
	 suffer from a heap overflow in WaveletDenoiseImage(). This problem is
	 easily trigerrable from a Perl script.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2016/q4/413</url>
 <url>https://github.com/ImageMagick/ImageMagick/issues/296</url>
 <cvename>CVE-2016-9298</cvename>
 <freebsdpr>ports/214517</freebsdpr>
 <freebsdpr>ports/214511</freebsdpr>
 <freebsdpr>ports/214520</freebsdpr>
 </references>
 <dates>
 <discovery>2016-11-13</discovery>
 <entry>2016-12-04</entry>
 </dates>
 </vuln>

<vuln vid="e5dcb942-ba6f-11e6-b1cf-14dae9d210b8">
 <topic>py-cryptography -- vulnerable HKDF key generation</topic>
 <affects>
 <package>
	<name>py27-cryptography</name>
	<name>py33-cryptography</name>
	<name>py34-cryptography</name>
	<name>py35-cryptography</name>
	<range><lt>1.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Alex Gaynor reports:
	<blockquote cite="https://github.com/pyca/cryptography/commit/b94cacf2ae6e75e4007a79709bbf5360435b512d">
	 Fixed a bug where ``HKDF`` would return an empty
	 byte-string if used with a ``length`` less than
	 ``algorithm.digest_size``.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/pyca/cryptography/commit/b94cacf2ae6e75e4007a79709bbf5360435b512d</url>
 <cvename>CVE-2016-9243</cvename>
 <freebsdpr>ports/214915</freebsdpr>
 </references>
 <dates>
 <discovery>2016-11-05</discovery>
 <entry>2016-12-04</entry>
 <modified>2016-12-06</modified>
 </dates>
 </vuln>

<vuln vid="a228c7a0-ba66-11e6-b1cf-14dae9d210b8">
 <topic>qemu -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<name>qemu-sbruno</name>
	<range><lt>2.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Daniel P. Berrange reports:
	<blockquote cite="https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html">
	 The VNC server websockets decoder will read and buffer data
	 from websockets clients until it sees the end of the HTTP headers,
	 as indicated by \r\n\r\n. In theory this allows a malicious to
	 trick QEMU into consuming an arbitrary amount of RAM.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html</url>
 <cvename>CVE-2015-1779</cvename>
 <freebsdpr>ports/206725</freebsdpr>
 </references>
 <dates>
 <discovery>2015-03-23</discovery>
 <entry>2016-12-04</entry>
 <modified>2016-12-06</modified>
 </dates>
 </vuln>

<vuln vid="59f79c99-ba4d-11e6-ae1b-002590263bf5">
 <topic>xen-tools -- delimiter injection vulnerabilities in pygrub</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><lt>4.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-198.html">
	 pygrub, the boot loader emulator, fails to quote (or sanity check)
	 its results when reporting them to its caller.
	 A malicious guest administrator can obtain the contents of
	 sensitive host files (an information leak). Additionally, a
	 malicious guest administrator can cause files on the host to be
	 removed, causing a denial of service. In some unusual host
	 configurations, ability to remove certain files may be usable for
	 privilege escalation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9379</cvename>
 <cvename>CVE-2016-9380</cvename>
 <freebsdpr>ports/214936</freebsdpr>
 <url>https://xenbits.xen.org/xsa/advisory-198.html</url>
 </references>
 <dates>
 <discovery>2016-11-22</discovery>
 <entry>2016-12-04</entry>
 </dates>
 </vuln>

<vuln vid="58685e23-ba4d-11e6-ae1b-002590263bf5">
 <topic>xen-tools -- qemu incautious about shared ring processing</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><lt>4.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-197.html">
	 The compiler can emit optimizations in qemu which can lead to
	 double fetch vulnerabilities. Specifically data on the rings shared
	 between qemu and the hypervisor (which the guest under control can
	 obtain mappings of) can be fetched twice (during which time the
	 guest can alter the contents) possibly leading to arbitrary code
	 execution in qemu.
	 Malicious administrators can exploit this vulnerability to take
	 over the qemu process, elevating its privilege to that of the qemu
	 process.
	 In a system not using a device model stub domain (or other
	 techniques for deprivileging qemu), malicious guest administrators
	 can thus elevate their privilege to that of the host.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9381</cvename>
 <freebsdpr>ports/214936</freebsdpr>
 <url>https://xenbits.xen.org/xsa/advisory-197.html</url>
 </references>
 <dates>
 <discovery>2016-11-22</discovery>
 <entry>2016-12-04</entry>
 </dates>
 </vuln>

<vuln vid="56f0f11e-ba4d-11e6-ae1b-002590263bf5">
 <topic>xen-kernel -- x86 64-bit bit test instruction emulation broken</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-195.html">
	 The x86 instructions BT, BTC, BTR, and BTS, when used with a
	 destination memory operand and a source register rather than an
	 immediate operand, access a memory location offset from that
	 specified by the memory operand as specified by the high bits of
	 the register source.
	 A malicious guest can modify arbitrary memory, allowing for
	 arbitrary code execution (and therefore privilege escalation
	 affecting the whole host), a crash of the host (leading to a DoS),
	 or information leaks. The vulnerability is sometimes exploitable
	 by unprivileged guest user processes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9383</cvename>
 <freebsdpr>ports/214936</freebsdpr>
 <url>https://xenbits.xen.org/xsa/advisory-195.html</url>
 </references>
 <dates>
 <discovery>2016-11-22</discovery>
 <entry>2016-12-04</entry>
 </dates>
 </vuln>

<vuln vid="5555120d-ba4d-11e6-ae1b-002590263bf5">
 <topic>xen-kernel -- guest 32-bit ELF symbol table load leaking host data</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><ge>4.7</ge><lt>4.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-194.html">
	 Along with their main kernel binary, unprivileged guests may
	 arrange to have their Xen environment load (kernel) symbol tables
	 for their use. The ELF image metadata created for this purpose has a
	 few unused bytes when the symbol table binary is in 32-bit ELF
	 format. These unused bytes were not properly cleared during symbol
	 table loading.
	 A malicious unprivileged guest may be able to obtain sensitive
	 information from the host.
	 The information leak is small and not under the control of the
	 guest, so effectively exploiting this vulnerability is probably
	 difficult.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9384</cvename>
 <freebsdpr>ports/214936</freebsdpr>
 <url>https://xenbits.xen.org/xsa/advisory-194.html</url>
 </references>
 <dates>
 <discovery>2016-11-22</discovery>
 <entry>2016-12-04</entry>
 </dates>
 </vuln>

<vuln vid="53dbd096-ba4d-11e6-ae1b-002590263bf5">
 <topic>xen-kernel -- x86 segment base write emulation lacking canonical address checks</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><ge>4.4</ge><lt>4.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-193.html">
	 Both writes to the FS and GS register base MSRs as well as the
	 WRFSBASE and WRGSBASE instructions require their input values to be
	 canonical, or a #GP fault will be raised. When the use of those
	 instructions by the hypervisor was enabled, the previous guard
	 against #GP faults (having recovery code attached) was accidentally
	 removed.
	 A malicious guest administrator can crash the host, leading to a
	 DoS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9385</cvename>
 <freebsdpr>ports/214936</freebsdpr>
 <url>https://xenbits.xen.org/xsa/advisory-193.html</url>
 </references>
 <dates>
 <discovery>2016-11-22</discovery>
 <entry>2016-12-04</entry>
 </dates>
 </vuln>

<vuln vid="523bb0b7-ba4d-11e6-ae1b-002590263bf5">
 <topic>xen-kernel -- x86 task switch to VM86 mode mis-handled</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-192.html">
	 LDTR, just like TR, is purely a protected mode facility. Hence even
	 when switching to a VM86 mode task, LDTR loading needs to follow
	 protected mode semantics. This was violated by the code.
	 On SVM (AMD hardware): a malicious unprivileged guest process can
	 escalate its privilege to that of the guest operating system.
	 On both SVM and VMX (Intel hardware): a malicious unprivileged
	 guest process can crash the guest.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9382</cvename>
 <freebsdpr>ports/214936</freebsdpr>
 <url>https://xenbits.xen.org/xsa/advisory-192.html</url>
 </references>
 <dates>
 <discovery>2016-11-22</discovery>
 <entry>2016-12-04</entry>
 </dates>
 </vuln>

<vuln vid="50ac2e96-ba4d-11e6-ae1b-002590263bf5">
 <topic>xen-kernel -- x86 null segments not always treated as unusable</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-191.html">
	 The Xen x86 emulator erroneously failed to consider the unusability
	 of segments when performing memory accesses.
	 The intended behaviour is as follows: The user data segment (%ds,
	 %es, %fs and %gs) selectors may be NULL in 32-bit to prevent access.
	 In 64-bit, NULL has a special meaning for user segments, and there
	 is no way of preventing access. However, in both 32-bit and 64-bit,
	 a NULL LDT system segment is intended to prevent access.
	 On Intel hardware, loading a NULL selector zeros the base as well
	 as most attributes, but sets the limit field to its largest possible
	 value. On AMD hardware, loading a NULL selector zeros the attributes,
	 leaving the stale base and limit intact.
	 Xen may erroneously permit the access using unexpected base/limit
	 values.
	 Ability to exploit this vulnerability on Intel is easy, but on AMD
	 depends in a complicated way on how the guest kernel manages LDTs.
	 
	 An unprivileged guest user program may be able to elevate its
	 privilege to that of the guest operating system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9386</cvename>
 <freebsdpr>ports/214936</freebsdpr>
 <url>https://xenbits.xen.org/xsa/advisory-191.html</url>
 </references>
 <dates>
 <discovery>2016-11-22</discovery>
 <entry>2016-12-04</entry>
 </dates>
 </vuln>

<vuln vid="4d7cf654-ba4d-11e6-ae1b-002590263bf5">
 <topic>xen-kernel -- CR0.TS and CR0.EM not always honored for x86 HVM guests</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-190.html">
	 Instructions touching FPU, MMX, or XMM registers are required to
	 raise a Device Not Available Exception (#NM) when either CR0.EM or
	 CR0.TS are set. (Their AVX or AVX-512 extensions would consider only
	 CR0.TS.) While during normal operation this is ensured by the
	 hardware, if a guest modifies instructions while the hypervisor is
	 preparing to emulate them, the #NM delivery could be missed.
	 Guest code in one task may thus (unintentionally or maliciously)
	 read or modify register state belonging to another task in the same
	 VM.
	 A malicious unprivileged guest user may be able to obtain or
	 corrupt sensitive information (including cryptographic material) in
	 other programs in the same guest.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-7777</cvename>
 <freebsdpr>ports/214936</freebsdpr>
 <url>https://xenbits.xen.org/xsa/advisory-190.html</url>
 </references>
 <dates>
 <discovery>2016-10-04</discovery>
 <entry>2016-12-04</entry>
 </dates>
 </vuln>

<vuln vid="4bf57137-ba4d-11e6-ae1b-002590263bf5">
 <topic>xen-kernel -- use after free in FIFO event channel code</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><ge>4.4</ge><lt>4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-188.html">
	 When the EVTCHNOP_init_control operation is called with a bad guest
	 frame number, it takes an error path which frees a control structure
	 without also clearing the corresponding pointer. Certain subsequent
	 operations (EVTCHNOP_expand_array or another EVTCHNOP_init_control),
	 upon finding the non-NULL pointer, continue operation assuming it
	 points to allocated memory.
	 A malicious guest administrator can crash the host, leading to a
	 DoS. Arbitrary code execution (and therefore privilege escalation),
	 and information leaks, cannot be excluded.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-7154</cvename>
 <freebsdpr>ports/214936</freebsdpr>
 <url>https://xenbits.xen.org/xsa/advisory-188.html</url>
 </references>
 <dates>
 <discovery>2016-09-08</discovery>
 <entry>2016-12-04</entry>
 </dates>
 </vuln>

<vuln vid="4aae54be-ba4d-11e6-ae1b-002590263bf5">
 <topic>xen-kernel -- x86 HVM: Overflow of sh_ctxt-&gt;seg_reg[]</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-187.html">
	 x86 HVM guests running with shadow paging use a subset of the x86
	 emulator to handle the guest writing to its own pagetables. There
	 are situations a guest can provoke which result in exceeding the
	 space allocated for internal state.
	 A malicious HVM guest administrator can cause Xen to fail a bug
	 check, causing a denial of service to the host.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-7094</cvename>
 <freebsdpr>ports/214936</freebsdpr>
 <url>https://xenbits.xen.org/xsa/advisory-187.html</url>
 </references>
 <dates>
 <discovery>2016-09-08</discovery>
 <entry>2016-12-04</entry>
 </dates>
 </vuln>

<vuln vid="49211361-ba4d-11e6-ae1b-002590263bf5">
 <topic>xen-kernel -- x86: Mishandling of instruction pointer truncation during emulation</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><eq>4.5.3</eq></range>
	<range><eq>4.6.3</eq></range>
	<range><ge>4.7.0</ge><lt>4.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-186.html">
	 When emulating HVM instructions, Xen uses a small i-cache for
	 fetches from guest memory. The code that handles cache misses does
	 not check if the address from which it fetched lies within the cache
	 before blindly writing to it. As such it is possible for the guest
	 to overwrite hypervisor memory.
	 It is currently believed that the only way to trigger this bug is
	 to use the way that Xen currently incorrectly wraps CS:IP in 16 bit
	 modes. The included patch prevents such wrapping.
	 A malicious HVM guest administrator can escalate their privilege to
	 that of the host.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-7093</cvename>
 <freebsdpr>ports/214936</freebsdpr>
 <url>https://xenbits.xen.org/xsa/advisory-186.html</url>
 </references>
 <dates>
 <discovery>2016-09-08</discovery>
 <entry>2016-12-04</entry>
 </dates>
 </vuln>

<vuln vid="45ca25b5-ba4d-11e6-ae1b-002590263bf5">
 <topic>xen-kernel -- x86: Disallow L3 recursive pagetable for 32-bit PV guests</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="https://xenbits.xen.org/xsa/advisory-185.html">
	 On real hardware, a 32-bit PAE guest must leave the USER and RW bit
	 clear in L3 pagetable entries, but the pagetable walk behaves as if
	 they were set. (The L3 entries are cached in processor registers,
	 and don't actually form part of the pagewalk.)
	 When running a 32-bit PV guest on a 64-bit Xen, Xen must always OR
	 in the USER and RW bits for L3 updates for the guest to observe
	 architectural behaviour. This is unsafe in combination with
	 recursive pagetables.
	 As there is no way to construct an L3 recursive pagetable in native
	 32-bit PAE mode, disallow this option in 32-bit PV guests.
	 A malicious 32-bit PV guest administrator can escalate their
	 privilege to that of the host.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-7092</cvename>
 <freebsdpr>ports/214936</freebsdpr>
 <url>https://xenbits.xen.org/xsa/advisory-185.html</url>
 </references>
 <dates>
 <discovery>2016-09-08</discovery>
 <entry>2016-12-04</entry>
 </dates>
 </vuln>

<vuln vid="7fff2b16-b0ee-11e6-86b8-589cfc054129">
 <topic>wireshark -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>tshark</name>
 <range><lt>2.2.2</lt></range>
 </package>
 <package>
 <name>tshark-lite</name>
 <range><lt>2.2.2</lt></range>
 </package>
 <package>
 <name>wireshark</name>
 <range><lt>2.2.2</lt></range>
 </package>
 <package>
 <name>wireshark-lite</name>
 <range><lt>2.2.2</lt></range>
 </package>
 <package>
	<name>wireshark-qt5</name>
	<range><lt>2.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wireshark project reports:
	<blockquote cite="://www.wireshark.org/docs/relnotes/wireshark-2.2.2.html">
	 Wireshark project is releasing Wireshark 2.2.2, which addresses:
	 <ul>
	 <li>wnpa-sec-2016-58: Profinet I/O long loop - CVE-2016-9372</li>
	 <li>wnpa-sec-2016-59: AllJoyn crash - CVE-2016-9374</li>
	 <li>wnpa-sec-2016-60: OpenFlow crash - CVE-2016-9376</li>
	 <li>wnpa-sec-2016-61: DCERPC crash - CVE-2016-9373</li>
	 <li>wnpa-sec-2016-62: DTN infinite loop - CVE-2016-9375</li>
	 </ul>
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://www.wireshark.org/docs/relnotes/wireshark-2.2.2.html</url>
 <cvename>CVE-2016-9372</cvename>
 <cvename>CVE-2016-9373</cvename>
 <cvename>CVE-2016-9374</cvename>
 <cvename>CVE-2016-9375</cvename>
 <cvename>CVE-2016-9376</cvename>
 </references>
 <dates>
 <discovery>2016-11-16</discovery>
 <entry>2016-12-01</entry>
 </dates>
 </vuln>

<vuln vid="18f39fb6-7400-4063-acaf-0806e92c094f">
 <topic>Mozilla -- SVG Animation Remote Code Execution</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>50.0.2,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>45.5.1,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>45.5.1,2</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.46</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.46</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>45.5.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>45.5.1</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>45.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/">
	 A use-after-free vulnerability in SVG Animation has been
	 discovered. An exploit built on this vulnerability has been
	 discovered in the wild targeting Firefox and Tor Browser
	 users on Windows.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9079</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/</url>
 </references>
 <dates>
 <discovery>2016-11-30</discovery>
 <entry>2016-12-01</entry>
 <modified>2016-12-16</modified>
 </dates>
 </vuln>

<vuln vid="479c5b91-b6cc-11e6-a04e-3417eb99b9a0">
 <topic>wget -- Access List Bypass / Race Condition</topic>
 <affects>
 <package>
	<name>wget</name>
	<range><le>1.17</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dawid Golunski reports:
	<blockquote cite="https://legalhackers.com/advisories/Wget-Exploit-ACL-bypass-RaceCond-CVE-2016-7098.html">
	 GNU wget in version 1.17 and earlier, when used in
	 mirroring/recursive mode, is affected by a Race Condition
	 vulnerability that might allow remote attackers to bypass intended
	 wget access list restrictions specified with -A parameter.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7098</url>
 <cvename>CVE-2016-7098</cvename>
 </references>
 <dates>
 <discovery>2016-11-24</discovery>
 <entry>2016-11-30</entry>
 </dates>
 </vuln>

<vuln vid="48e83187-b6e9-11e6-b6cf-5453ed2e2b49">
 <topic>p7zip -- Null pointer dereference</topic>
 <affects>
 <package>
	<name>p7zip</name>
	<range><lt>15.14_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9296">
	 A null pointer dereference bug affects the 16.02 and many old
	 versions of p7zip. A lack of null pointer check for the variable
	 <code>folders.PackPositions</code> in function
	 <code>CInArchive::ReadAndDecodePackedStreams</code>, as used in
	 the 7z.so library and in 7z applications, will cause a crash and a
	 denial of service when decoding malformed 7z files.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9296</cvename>
 <url>https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db/</url>
 <url>https://sourceforge.net/p/p7zip/bugs/185/</url>
 <url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9296</url>
 </references>
 <dates>
 <discovery>2016-07-17</discovery>
 <entry>2016-11-30</entry>
 </dates>
 </vuln>

<vuln vid="ac256985-b6a9-11e6-a3bf-206a8a720317">
 <topic>subversion -- Unrestricted XML entity expansion in mod_dontdothat and Subversionclients using http(s)</topic>
 <affects>
 <package>
	<name>subversion18</name>
	<range><lt>1.8.17</lt></range>
 </package>
 <package>
	<name>subversion</name>
	<range><lt>1.9.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation reports:
	<blockquote cite="http://subversion.apache.org/security/CVE-2016-8734-advisory.txt">
	 The mod_dontdothat module of subversion and subversion clients using
	 http(s):// are vulnerable to a denial-of-service attack, caused by
	 exponential XML entity expansion. The attack targets XML parsers
	 causing targeted process to consume excessive amounts of resources.
	 The attack is also known as the "billions of laughs attack."
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://subversion.apache.org/security/CVE-2016-8734-advisory.txt</url>
 <cvename>CVE-2016-8734</cvename>
 </references>
 <dates>
 <discovery>2016-11-29</discovery>
 <entry>2016-11-29</entry>
 </dates>
 </vuln>

<vuln vid="18449f92-ab39-11e6-8011-005056925db4">
 <topic>libwww -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libwww</name>
	<range><lt>5.4.0_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3183">
	 The HTBoundary_put_block function in HTBound.c for W3C libwww
	 (w3c-libwww) allows remote servers to cause a denial of service
	 (segmentation fault) via a crafted multipart/byteranges MIME message
	 that triggers an out-of-bounds read.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560">
	 The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1,
	 as used in the XML-Twig module for Perl, allows context-dependent
	 attackers to cause a denial of service (application crash) via an XML
	 document with malformed UTF-8 sequences that trigger a buffer
	 over-read, related to the doProlog function in lib/xmlparse.c, a
	 different vulnerability than CVE-2009-2625 and CVE-2009-3720.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720">
	 The updatePosition function in lib/xmltok_impl.c in libexpat in
	 Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other
	 software, allows context-dependent attackers to cause a denial of
	 service (application crash) via an XML document with crafted UTF-8
	 sequences that trigger a buffer over-read, a different vulnerability
	 than CVE-2009-2625.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>15035</bid>
 <cvename>CVE-2005-3183</cvename>
 <cvename>CVE-2009-3560</cvename>
 <cvename>CVE-2009-3720</cvename>
 <freebsdpr>ports/214546</freebsdpr>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=170518</url>
 </references>
 <dates>
 <discovery>2005-10-12</discovery>
 <entry>2016-11-29</entry>
 </dates>
 </vuln>

<vuln vid="f90fce70-ecfa-4f4d-9ee8-c476dbf4bf0e">
 <topic>mozilla -- data: URL can inherit wrong origin after an HTTP redirect</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>50.0.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-91/">
	 Redirection from an HTTP connection to a data: URL
	 assigns the referring site's origin to the data: URL in some
	 circumstances. This can result in same-origin violations
	 against a domain if it loads resources from malicious
	 sites. Cross-origin setting of cookies has been demonstrated
	 without the ability to read them.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9078</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-91/</url>
 </references>
 <dates>
 <discovery>2016-11-28</discovery>
 <entry>2016-11-29</entry>
 </dates>
 </vuln>

<vuln vid="125f5958-b611-11e6-a9a5-b499baebfeaf">
 <topic>Roundcube -- arbitrary command execution</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><lt>1.2.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Roundcube project reports
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-9920">
	 steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before
	 1.2.3, when no SMTP server is configured and the sendmail program is
	 enabled, does not properly restrict the use of custom envelope-from
	 addresses on the sendmail command line, which allows remote
	 authenticated users to execute arbitrary code via a modified HTTP
	 request that sends a crafted e-mail message.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9920</cvename>
 <bid>94858</bid>
 <url>http://www.openwall.com/lists/oss-security/2016/12/08/17</url>
 <url>https://github.com/roundcube/roundcubemail/wiki/Changelog#release-123</url>
 </references>
 <dates>
 <discovery>2016-11-29</discovery>
 <entry>2016-11-29</entry>
 <modified>2016-12-14</modified>
 </dates>
 </vuln>

<vuln vid="8db24888-b2f5-11e6-8153-00248c0c745d">
 <topic>Drupal Code -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><ge>7.0</ge><lt>7.52</lt></range>
 </package>
 <package>
	<name>drupal8</name>
	<range><ge>8.0.0</ge><lt>8.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal development team reports:
	<blockquote cite="https://www.drupal.org/SA-CORE-2016-005">
	 <h3>Inconsistent name for term access query (Less critical - Drupal
	 7 and Drupal 8)</h3>
	 Drupal provides a mechanism to alter database SELECT queries before
	 they are executed. Contributed and custom modules may use this
	 mechanism to restrict access to certain entities by implementing
	 hook_query_alter() or hook_query_TAG_alter() in order to add
	 additional conditions. Queries can be distinguished by means of
	 query tags. As the documentation on EntityFieldQuery::addTag()
	 suggests, access-tags on entity queries normally follow the form
	 ENTITY_TYPE_access (e.g. node_access). However, the taxonomy
	 module's access query tag predated this system and used term_access
	 as the query tag instead of taxonomy_term_access.
	 As a result, before this security release modules wishing to
	 restrict access to taxonomy terms may have implemented an
	 unsupported tag, or needed to look for both tags (term_access and
	 taxonomy_term_access) in order to be compatible with queries
	 generated both by Drupal core as well as those generated by
	 contributed modules like Entity Reference. Otherwise information
	 on taxonomy terms might have been disclosed to unprivileged users.
	 
	 <h3>Incorrect cache context on password reset page (Less critical -
	 Drupal 8)</h3>
	 The user password reset form does not specify a proper cache
	 context, which can lead to cache poisoning and unwanted content on
	 the page.
	 <h3>Confirmation forms allow external URLs to be injected (Moderately
	 critical - Drupal 7)</h3>
	 Under certain circumstances, malicious users could construct a URL
	 to a confirmation form that would trick users into being redirected
	 to a 3rd party website after interacting with the form, thereby
	 exposing the users to potential social engineering attacks.
	 <h3>Denial of service via transliterate mechanism (Moderately critical
	 - Drupal 8)</h3>
	 A specially crafted URL can cause a denial of service via the
	 transliterate mechanism.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9449</cvename>
 <cvename>CVE-2016-9450</cvename>
 <cvename>CVE-2016-9451</cvename>
 <cvename>CVE-2016-9452</cvename>
 </references>
 <dates>
 <discovery>2016-11-16</discovery>
 <entry>2016-11-25</entry>
 <modified>2016-11-27</modified>
 </dates>
 </vuln>

<vuln vid="6fe72178-b2e3-11e6-8b2a-6805ca0b3d42">
 <topic>phpMyAdmin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.6.0</ge><lt>4.6.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Please reference CVE/URL list for details
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-57/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-58/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-59/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-60/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-61/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-62/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-63/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-64/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-65/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-66/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-67/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-68/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-69/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-70/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-71/</url>
 <cvename>CVE-2016-6632</cvename>
 <cvename>CVE-2016-6633</cvename>
 <cvename>CVE-2016-4412</cvename>
 </references>
 <dates>
 <discovery>2016-11-25</discovery>
 <entry>2016-11-25</entry>
 </dates>
 </vuln>

<vuln vid="dc596a17-7a9e-11e6-b034-f0def167eeea">
 <topic>Remote-Code-Execution vulnerability in mysql and its variants CVE 2016-6662</topic>
 <affects>
 <package>
	<name>mysql57-client</name>
	<name>mysql57-server</name>
	<range><lt>5.7.15</lt></range>
 </package>
 <package>
	<name>mysql56-client</name>
	<name>mysql56-server</name>
	<range><lt>5.6.33</lt></range>
 </package>
 <package>
	<name>mysql55-client</name>
	<name>mysql55-server</name>
	<range><lt>5.5.52</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	LegalHackers' reports:
	<blockquote cite="http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html">
	 RCE Bugs discovered in MySQL and its variants like MariaDB.
	 It works by manipulating my.cnf files and using --malloc-lib.
	 The bug seems fixed in MySQL 5.7.15 by Oracle
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html</url>
 <url>https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html</url>
 </references>
 <dates>
 <discovery>2016-09-12</discovery>
 <entry>2016-11-24</entry>
 <modified>2016-11-24</modified>
 </dates>
 </vuln>

<vuln vid="8db8d62a-b08b-11e6-8eba-d050996490d0">
 <topic>ntp -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ntp</name>
	<range><lt>4.2.8p9</lt></range>
 </package>
 <package>
	<name>ntp-devel</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Network Time Foundation reports:
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#November_2016_ntp_4_2_8p9_NTP_Se">
	 NTF's NTP Project is releasing ntp-4.2.8p9, which addresses:
	 <ul>
	 <li>1 HIGH severity vulnerability that only affects Windows</li>
	 <li>2 MEDIUM severity vulnerabilities</li>
	 <li>2 MEDIUM/LOW severity vulnerabilities</li>
	 <li>5 LOW severity vulnerabilities</li>
	 <li>28 other non-security fixes and improvements</li>
	 </ul>
	 All of the security issues in this release are listed in
	 <a href="http://www.kb.cert.org/vuls/id/633847">VU#633847</a>.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-7426</cvename>
 <cvename>CVE-2016-7427</cvename>
 <cvename>CVE-2016-7428</cvename>
 <cvename>CVE-2016-7429</cvename>
 <cvename>CVE-2016-7431</cvename>
 <cvename>CVE-2016-7433</cvename>
 <cvename>CVE-2016-7434</cvename>
 <cvename>CVE-2016-9310</cvename>
 <cvename>CVE-2016-9311</cvename>
 <cvename>CVE-2016-9312</cvename>
 <url>http://support.ntp.org/bin/view/Main/SecurityNotice#November_2016_ntp_4_2_8p9_NTP_Se</url>
 <url>http://www.kb.cert.org/vuls/id/633847</url>
 </references>
 <dates>
 <discovery>2016-11-21</discovery>
 <entry>2016-11-22</entry>
 </dates>
 </vuln>

<vuln vid="81fc7705-b002-11e6-b20a-14dae9d5a9d2">
 <topic>teeworlds -- Remote code execution</topic>
 <affects>
 <package>
	<name>teeworlds</name>
	<range><lt>0.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Teeworlds project reports:
	<blockquote cite="https://www.teeworlds.com/?page=news&amp;id=12086">
	 Attacker controlled memory-writes and possibly arbitrary code
	 execution on the client, abusable by any server the client joins
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.teeworlds.com/?page=news&amp;id=12086</url>
 </references>
 <dates>
 <discovery>2016-11-13</discovery>
 <entry>2016-11-21</entry>
 </dates>
 </vuln>

<vuln vid="27eee66d-9474-44a5-b830-21ec12a1c307">
 <topic>jenkins -- Remote code execution vulnerability in remoting module</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><le>2.31</le></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><le>2.19.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16">
	 An unauthenticated remote code execution vulnerability allowed
	 attackers to transfer a serialized Java object to the Jenkins CLI,
	 making Jenkins connect to an attacker-controlled LDAP server, which
	 in turn can send a serialized payload leading to code execution,
	 bypassing existing protection mechanisms.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9299</cvename>
 <url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16</url>
 </references>
 <dates>
 <discovery>2016-11-11</discovery>
 <entry>2016-11-16</entry>
 </dates>
 </vuln>

<vuln vid="f6565fbf-ab9e-11e6-ae1b-002590263bf5">
 <topic>moodle -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moodle29</name>
	<range><lt>2.9.9</lt></range>
 </package>
 <package>
	<name>moodle30</name>
	<range><lt>3.0.7</lt></range>
 </package>
 <package>
	<name>moodle31</name>
	<range><lt>3.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marina Glancy reports:
	<blockquote cite="https://moodle.org/security/">
	 <ul>
	 <li>MSA-16-0023: Question engine allows access to files that
	 should not be available</li>
	 <li>MSA-16-0024: Non-admin site managers may accidentally edit
	 admins via web services</li>
	 <li>MSA-16-0025: Capability to view course notes is checked in
	 the wrong context</li>
	 <li>MSA-16-0026: When debugging is enabled, error exceptions
	 returned from webservices could contain private data</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-8642</cvename>
 <cvename>CVE-2016-8643</cvename>
 <cvename>CVE-2016-8644</cvename>
 <url>https://moodle.org/security/</url>
 </references>
 <dates>
 <discovery>2016-11-14</discovery>
 <entry>2016-11-16</entry>
 <modified>2016-11-27</modified>
 </dates>
 </vuln>

<vuln vid="ab02f981-ab9e-11e6-ae1b-002590263bf5">
 <topic>moodle -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moodle29</name>
	<range><lt>2.9.8</lt></range>
 </package>
 <package>
	<name>moodle30</name>
	<range><lt>3.0.6</lt></range>
 </package>
 <package>
	<name>moodle31</name>
	<range><lt>3.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marina Glancy reports:
	<blockquote cite="https://moodle.org/security/">
	 <ul>
	 <li>MSA-16-0022: Web service tokens should be invalidated when
	 the user password is changed or forced to be changed.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-7038</cvename>
 <url>https://moodle.org/security/</url>
 </references>
 <dates>
 <discovery>2016-09-12</discovery>
 <entry>2016-11-16</entry>
 </dates>
 </vuln>

<vuln vid="d1853110-07f4-4645-895b-6fd462ad0589">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>50.0_1,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.47</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>45.5.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>45.5.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>45.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-89/">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5289</cvename>
 <cvename>CVE-2016-5290</cvename>
 <cvename>CVE-2016-5291</cvename>
 <cvename>CVE-2016-5292</cvename>
 <cvename>CVE-2016-5293</cvename>
 <cvename>CVE-2016-5294</cvename>
 <cvename>CVE-2016-5295</cvename>
 <cvename>CVE-2016-5296</cvename>
 <cvename>CVE-2016-5297</cvename>
 <cvename>CVE-2016-5298</cvename>
 <cvename>CVE-2016-5299</cvename>
 <cvename>CVE-2016-9061</cvename>
 <cvename>CVE-2016-9062</cvename>
 <cvename>CVE-2016-9063</cvename>
 <cvename>CVE-2016-9064</cvename>
 <cvename>CVE-2016-9065</cvename>
 <cvename>CVE-2016-9066</cvename>
 <cvename>CVE-2016-9067</cvename>
 <cvename>CVE-2016-9068</cvename>
 <cvename>CVE-2016-9070</cvename>
 <cvename>CVE-2016-9071</cvename>
 <cvename>CVE-2016-9072</cvename>
 <cvename>CVE-2016-9073</cvename>
 <cvename>CVE-2016-9074</cvename>
 <cvename>CVE-2016-9075</cvename>
 <cvename>CVE-2016-9076</cvename>
 <cvename>CVE-2016-9077</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-89/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-90/</url>
 </references>
 <dates>
 <discovery>2016-11-15</discovery>
 <entry>2016-11-16</entry>
 </dates>
 </vuln>

<vuln vid="a8e9d834-a916-11e6-b9b4-bcaec524bf84">
 <topic>lives -- insecure files permissions</topic>
 <affects>
 <package>
	<name>lives</name>
	<range><lt>2.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian reports:
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756565">
	 smogrify script creates insecure temporary files.
	</blockquote>
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798043">
	 lives creates and uses world-writable directory.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756565</url>
 <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798043</url>
 </references>
 <dates>
 <discovery>2016-07-30</discovery>
 <entry>2016-11-12</entry>
 </dates>
 </vuln>

<vuln vid="50751310-a763-11e6-a881-b499baebfeaf">
 <topic>openssl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl-devel</name>
	<range><lt>1.1.0c</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20161110.txt">
	 <ul>
	 <li>ChaCha20/Poly1305 heap-buffer-overflow (CVE-2016-7054) 
	 Severity: High 
	 TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS
	 attack by corrupting larger payloads. This can result in an OpenSSL crash. This
	 issue is not considered to be exploitable beyond a DoS.</li>
	 <li>CMS Null dereference (CVE-2016-7053) 
	 Severity: Medium 
	 Applications parsing invalid CMS structures can crash with a NULL pointer
	 dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type
	 in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure
	 callback if an attempt is made to free certain invalid encodings. Only CHOICE
	 structures using a callback which do not handle NULL value are affected.</li>
	 <li>Montgomery multiplication may produce incorrect results (CVE-2016-7055)i 
	 Severity: Low 
	 There is a carry propagating bug in the Broadwell-specific Montgomery
	 multiplication procedure that handles input lengths divisible by, but
	 longer than 256 bits.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20161110.txt</url>
 <cvename>CVE-2016-7054</cvename>
 <cvename>CVE-2016-7053</cvename>
 <cvename>CVE-2016-7055</cvename>
 </references>
 <dates>
 <discovery>2016-11-10</discovery>
 <entry>2016-11-10</entry>
 <modified>2016-11-11</modified>
 </dates>
 </vuln>

<vuln vid="a3473f5a-a739-11e6-afaa-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>54.0.2840.100</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop_9.html">
	 4 security fixes in this release, including:
	 <ul>
	 <li>[643948] High CVE-2016-5199: Heap corruption in FFmpeg. Credit to
	 Paul Mehta</li>
	 <li>[658114] High CVE-2016-5200: Out of bounds memory access in V8. Credit to
	 Choongwoo Han</li>
	 <li>[660678] Medium CVE-2016-5201: Info leak in extensions. Credit to
	 Rob Wu</li>
	 <li>[662843] CVE-2016-5202: Various fixes from internal audits,
	 fuzzing and other initiatives</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5199</cvename>
 <cvename>CVE-2016-5200</cvename>
 <cvename>CVE-2016-5201</cvename>
 <cvename>CVE-2016-5202</cvename>
 <url>https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop_9.html</url>
 </references>
 <dates>
 <discovery>2016-11-09</discovery>
 <entry>2016-11-10</entry>
 </dates>
 </vuln>

<vuln vid="96f6bf10-a731-11e6-95ca-0011d823eebd">
 <topic>flash -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<name>linux-c7-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.644</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-37.html">
	 <ul>
	 <li>These updates resolve type confusion vulnerabilities that
	 could lead to code execution (CVE-2016-7860, CVE-2016-7861,
	 CVE-2016-7865).</li>
	 <li>These updates resolve use-after-free vulnerabilities that
	 could lead to code execution (CVE-2016-7857, CVE-2016-7858,
	 CVE-2016-7859, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb16-37.html</url>
 <cvename>CVE-2016-7857</cvename>
 <cvename>CVE-2016-7858</cvename>
 <cvename>CVE-2016-7859</cvename>
 <cvename>CVE-2016-7860</cvename>
 <cvename>CVE-2016-7861</cvename>
 <cvename>CVE-2016-7862</cvename>
 <cvename>CVE-2016-7863</cvename>
 <cvename>CVE-2016-7864</cvename>
 <cvename>CVE-2016-7865</cvename>
 </references>
 <dates>
 <discovery>2016-11-08</discovery>
 <entry>2016-11-10</entry>
 </dates>
 </vuln>

<vuln vid="10968dfd-a687-11e6-b2d3-60a44ce6887b">
 <topic>gitlab -- Directory traversal via "import/export" feature</topic>
 <affects>
 <package>
	<name>gitlab</name>
	<range><ge>8.10.0</ge><le>8.10.12</le></range>
	<range><ge>8.11.0</ge><le>8.11.9</le></range>
	<range><ge>8.12.0</ge><le>8.12.7</le></range>
	<range><ge>8.13.0</ge><le>8.13.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab reports:
	<blockquote cite="https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/">
	The import/export feature did not properly check for symbolic links
	 in user-provided archives and therefore it was possible for an
	 authenticated user to retrieve the contents of any file
	 accessible to the GitLab service account. This included
	 sensitive files such as those that contain secret tokens used
	 by the GitLab service to authenticate users.
	</blockquote>
 </body>
 </description>
 <references>
	<url>https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/</url>
	<cvename>CVE-2016-9086</cvename>
	<freebsdpr>ports/214360</freebsdpr>
 </references>
 <dates>
 <discovery>2016-11-02</discovery>
 <entry>2016-11-09</entry>
 <modified>2017-05-18</modified>
 </dates>
 </vuln>

<vuln vid="ae9cb9b8-a203-11e6-a265-3065ec8fd3ec">
 <topic>chromium -- out-of-bounds memory access</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>54.0.2840.90</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop.html">
	 [659475] High CVE-2016-5198: Out of bounds memory access in V8.
	 Credit to Tencent Keen Security Lab, working with Trend Micro's
	 Zero Day Initiative.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5198</cvename>
 <url>https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2016-11-01</discovery>
 <entry>2016-11-03</entry>
 </dates>
 </vuln>

<vuln vid="0fcd3af0-a0fe-11e6-b1cf-14dae9d210b8">
 <topic>FreeBSD -- OpenSSL Remote DoS vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.3</ge><lt>10.3_12</lt></range>
	<range><ge>10.2</ge><lt>10.2_25</lt></range>
	<range><ge>10.1</ge><lt>10.1_42</lt></range>
	<range><ge>9.3</ge><lt>9.3_50</lt></range>
 </package>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2i,1</lt></range>
 </package>
 <package>
	<name>openssl-devel</name>
	<range><lt>1.1.0a</lt></range>
 </package>
 <package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_13</lt></range>
 </package>
 <package>
	<name>linux-c7-openssl-libs</name>
	<range><lt>1.0.1e_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to improper handling of alert packets, OpenSSL would
	consume an excessive amount of CPU time processing undefined
	alert messages.
	<h1>Impact:</h1>
	A remote attacker who can initiate handshakes with an
	OpenSSL based server can cause the server to consume a lot
	of computation power with very little bandwidth usage, and
	may be able to use this technique in a leveraged Denial of
	Service attack.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-8610</cvename>
 <freebsdsa>SA-16:35.openssl</freebsdsa>
 <url>http://seclists.org/oss-sec/2016/q4/224</url>
 </references>
 <dates>
 <discovery>2016-11-02</discovery>
 <entry>2016-11-02</entry>
 <modified>2017-02-22</modified>
 </dates>
 </vuln>

<vuln vid="cb116651-79db-4c09-93a2-c38f9df46724">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-django</name>
	<name>py33-django</name>
	<name>py34-django</name>
	<name>py35-django</name>
	<range><lt>1.8.16</lt></range>
 </package>
 <package>
	<name>py27-django18</name>
	<name>py33-django18</name>
	<name>py34-django18</name>
	<name>py35-django18</name>
	<range><lt>1.8.16</lt></range>
 </package>
 <package>
	<name>py27-django19</name>
	<name>py33-django19</name>
	<name>py34-django19</name>
	<name>py35-django19</name>
	<range><lt>1.9.11</lt></range>
 </package>
 <package>
	<name>py27-django110</name>
	<name>py33-django110</name>
	<name>py34-django110</name>
	<name>py35-django110</name>
	<range><lt>1.10.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Django project reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2016/nov/01/security-releases/">
	 Today the Django team released Django 1.10.3, Django 1.9.11,
	 and 1.8.16. These releases addresses two security issues
	 detailed below. We encourage all users of Django to upgrade
	 as soon as possible.
	 <ul>
	 <li>User with hardcoded password created when running tests on Oracle</li>
	 <li>DNS rebinding vulnerability when DEBUG=True</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2016/nov/01/security-releases/</url>
 <cvename>CVE-2016-9013</cvename>
 <cvename>CVE-2016-9014</cvename>
 </references>
 <dates>
 <discovery>2016-11-01</discovery>
 <entry>2016-11-02</entry>
 </dates>
 </vuln>

<vuln vid="765feb7d-a0d1-11e6-a881-b499baebfeaf">
 <topic>cURL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.1</ge><lt>7.51.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	 <ul>
	 <li>cookie injection for other servers</li>
	 <li>case insensitive password comparison</li>
	 <li>OOB write via unchecked multiplication</li>
	 <li>double-free in curl_maprintf</li>
	 <li>double-free in krb5 code</li>
	 <li>glob parser write/read out of bounds</li>
	 <li>curl_getdate read out of bounds</li>
	 <li>URL unescape heap overflow via integer truncation</li>
	 <li>Use-after-free via shared cookies</li>
	 <li>invalid URL parsing with '#'</li>
	 <li>IDNA 2003 makes curl use wrong host</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/security.html</url>
 <cvename>CVE-2016-8615</cvename>
 <cvename>CVE-2016-8616</cvename>
 <cvename>CVE-2016-8617</cvename>
 <cvename>CVE-2016-8618</cvename>
 <cvename>CVE-2016-8619</cvename>
 <cvename>CVE-2016-8620</cvename>
 <cvename>CVE-2016-8621</cvename>
 <cvename>CVE-2016-8622</cvename>
 <cvename>CVE-2016-8623</cvename>
 <cvename>CVE-2016-8624</cvename>
 <cvename>CVE-2016-8625</cvename>
 </references>
 <dates>
 <discovery>2016-11-02</discovery>
 <entry>2016-11-02</entry>
 </dates>
 </vuln>

<vuln vid="0b8d01a4-a0d2-11e6-9ca2-d050996490d0">
 <topic>BIND -- Remote Denial of Service vulnerability</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><lt>9.9.9P4</lt></range>
 </package>
 <package>
	<name>bind910</name>
	<range><lt>9.10.4P4</lt></range>
 </package>
 <package>
	<name>bind911</name>
	<range><lt>9.11.0P1</lt></range>
 </package>
 <package>
	<name>bind9-devel</name>
	<range><le>9.12.0.a.2016.10.21</le></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_50</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01434/">
	 A defect in BIND's handling of responses containing
	 a DNAME answer can cause a resolver to exit after
	 encountering an assertion failure in db.c or
	 resolver.c
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-8864</cvename>
 <freebsdsa>SA-16:34.bind</freebsdsa>
 <url>https://kb.isc.org/article/AA-01434/</url>
 </references>
 <dates>
 <discovery>2016-11-01</discovery>
 <entry>2016-11-02</entry>
 </dates>
 </vuln>

<vuln vid="f4bf713f-6ac7-4b76-8980-47bf90c5419f">
 <topic>memcached -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>memcached</name>
	<range><lt>1.4.33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cisco Talos reports:
	<blockquote cite="http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html">
	 Multiple integer overflow vulnerabilities exist within Memcached
	 that could be exploited to achieve remote code execution on the
	 targeted system. These vulnerabilities manifest in various Memcached
	 functions that are used in inserting, appending, prepending, or
	 modifying key-value data pairs. Systems which also have Memcached
	 compiled with support for SASL authentication are also vulnerable to
	 a third flaw due to how Memcached handles SASL authentication
	 commands.
	 An attacker could exploit these vulnerabilities by sending a
	 specifically crafted Memcached command to the targeted server.
	 Additionally, these vulnerabilities could also be exploited to leak
	 sensitive process information which an attacker could use to bypass
	 common exploitation mitigations, such as ASLR, and can be triggered
	 multiple times. This enables reliable exploitation which makes these
	 vulnerabilities severe.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html</url>
 <cvename>CVE-2016-8704</cvename>
 <cvename>CVE-2016-8705</cvename>
 <cvename>CVE-2016-8706</cvename>
 </references>
 <dates>
 <discovery>2016-10-31</discovery>
 <entry>2016-11-02</entry>
 </dates>
 </vuln>

<vuln vid="9bc14850-a070-11e6-a881-b499baebfeaf">
 <topic>MySQL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb55-server</name>
	<name>mysql55-server</name>
	<range><lt>5.5.53</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.34</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MariaDB project reports:
	<blockquote cite="https://mariadb.com/kb/en/mariadb/mariadb-5553-release-notes/">
	 Fixes for the following security vulnerabilities:
	 <ul>
	 <li>CVE-2016-7440</li>
	 <li>CVE-2016-5584</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mariadb.com/kb/en/mariadb/mariadb-5553-release-notes/</url>
 <cvename>CVE-2016-7440</cvename>
 <cvename>CVE-2016-5584</cvename>
 </references>
 <dates>
 <discovery>2016-10-17</discovery>
 <entry>2016-11-01</entry>
 </dates>
 </vuln>

<vuln vid="9118961b-9fa5-11e6-a265-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>54.0.2840.59</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/10/stable-channel-update-for-desktop.html">
	 21 security fixes in this release, including:
	 <ul>
	 <li>[645211] High CVE-2016-5181: Universal XSS in Blink. Credit to
	 Anonymous</li>
	 <li>[638615] High CVE-2016-5182: Heap overflow in Blink. Credit to
	 Giwan Go of STEALIEN</li>
	 <li>[645122] High CVE-2016-5183: Use after free in PDFium. Credit
	 to Anonymous</li>
	 <li>[630654] High CVE-2016-5184: Use after free in PDFium. Credit
	 to Anonymous</li>
	 <li>[621360] High CVE-2016-5185: Use after free in Blink. Credit to
	 cloudfuzzer</li>
	 <li>[639702] High CVE-2016-5187: URL spoofing. Credit to Luan
	 Herrera</li>
	 <li>[565760] Medium CVE-2016-5188: UI spoofing. Credit to Luan
	 Herrera</li>
	 <li>[633885] Medium CVE-2016-5192: Cross-origin bypass in Blink.
	 Credit to haojunhou@gmail.com</li>
	 <li>[646278] Medium CVE-2016-5189: URL spoofing. Credit to xisigr
	 of Tencent's Xuanwu Lab</li>
	 <li>[644963] Medium CVE-2016-5186: Out of bounds read in DevTools.
	 Credit to Abdulrahman Alqabandi (@qab)</li>
	 <li>[639126] Medium CVE-2016-5191: Universal XSS in Bookmarks.
	 Credit to Gareth Hughes</li>
	 <li>[642067] Medium CVE-2016-5190: Use after free in Internals.
	 Credit to Atte Kettunen of OUSPG</li>
	 <li>[639658] Low CVE-2016-5193: Scheme bypass. Credit to Yuyang
	 ZHOU (martinzhou96)</li>
	 <li>[654782] CVE-2016-5194: Various fixes from internal audits,
	 fuzzing and other initiatives</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5181</cvename>
 <cvename>CVE-2016-5182</cvename>
 <cvename>CVE-2016-5183</cvename>
 <cvename>CVE-2016-5184</cvename>
 <cvename>CVE-2016-5185</cvename>
 <cvename>CVE-2016-5186</cvename>
 <cvename>CVE-2016-5187</cvename>
 <cvename>CVE-2016-5188</cvename>
 <cvename>CVE-2016-5189</cvename>
 <cvename>CVE-2016-5190</cvename>
 <cvename>CVE-2016-5191</cvename>
 <cvename>CVE-2016-5192</cvename>
 <cvename>CVE-2016-5193</cvename>
 <cvename>CVE-2016-5194</cvename>
 <url>https://googlechromereleases.blogspot.nl/2016/10/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2016-10-12</discovery>
 <entry>2016-10-31</entry>
 </dates>
 </vuln>

<vuln vid="9c135c7e-9fa4-11e6-a265-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>53.0.2785.143</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_29.html">
	 3 security fixes in this release, including:
	 <ul>
	 <li>[642496] High CVE-2016-5177: Use after free in V8. Credit to
	 Anonymous</li>
	 <li>[651092] CVE-2016-5178: Various fixes from internal audits,
fuzzing and other initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5177</cvename>
 <cvename>CVE-2016-5178</cvename>
 <url>https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_29.html</url>
 </references>
 <dates>
 <discovery>2016-09-29</discovery>
 <entry>2016-10-31</entry>
 </dates>
 </vuln>

<vuln vid="6a2cfcdc-9dea-11e6-a298-14dae9d210b8">
 <topic>FreeBSD -- OpenSSH Remote Denial of Service vulnerability</topic>
 <affects>
 <package>
	<name>openssh-portable</name>
	<range><lt>7.3p1_1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_3</lt></range>
	<range><ge>10.3</ge><lt>10.3_12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When processing the SSH_MSG_KEXINIT message, the server
	could allocate up to a few hundreds of megabytes of memory
	per each connection, before any authentication take place.
	<h1>Impact:</h1>
	A remote attacker may be able to cause a SSH server to
	allocate an excessive amount of memory. Note that the default
	MaxStartups setting on FreeBSD will limit the effectiveness
	of this attack.
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2016/q4/191</url>
 <cvename>CVE-2016-8858</cvename>
 <freebsdsa>SA-16:33.openssh</freebsdsa>
 </references>
 <dates>
 <discovery>2016-10-19</discovery>
 <entry>2016-10-29</entry>
 <modified>2016-11-02</modified>
 </dates>
 </vuln>

<vuln vid="2e4fbc9a-9d23-11e6-a298-14dae9d210b8">
 <topic>sudo -- Potential bypass of sudo_noexec.so via wordexp()</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><ge>1.6.8</ge><lt>1.8.18p1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Todd C. Miller reports:
	<blockquote cite="https://www.sudo.ws/alerts/noexec_wordexp.html">
	 A flaw exists in sudo's noexec functionality that may allow
	 a user with sudo privileges to run additional commands even when the
	 NOEXEC tag has been applied to a command that uses the wordexp()
	 function.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.sudo.ws/alerts/noexec_wordexp.html</url>
 <cvename>CVE-2016-7076</cvename>
 </references>
 <dates>
 <discovery>2016-10-28</discovery>
 <entry>2016-10-28</entry>
 </dates>
 </vuln>

<vuln vid="ac18046c-9b08-11e6-8011-005056925db4">
 <topic>Axis2 -- Security vulnerabilities on dependency Apache HttpClient</topic>
 <affects>
 <package>
	<name>axis2</name>
	<range><lt>1.7.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache Axis2 reports:
	<blockquote cite="http://axis.apache.org/axis2/java/core/release-notes/1.7.4.html">
	 Apache Axis2 1.7.4 is a maintenance release that includes fixes for
		several issues, including the following security issues:
		Session fixation (AXIS2-4739) and XSS (AXIS2-5683) vulnerabilities
		affecting the admin console.
		A dependency on an Apache HttpClient version affected by known security
		vulnerabilities (CVE-2012-6153 and CVE-2014-3577); see AXIS2-5757.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://axis.apache.org/axis2/java/core/release-notes/1.7.4.html</url>
 <url>https://issues.apache.org/jira/browse/AXIS2-4739</url>
 <url>https://issues.apache.org/jira/browse/AXIS2-5683</url>
 <url>https://issues.apache.org/jira/browse/AXIS2-5757</url>
 <cvename>CVE-2012-6153</cvename>
 <cvename>CVE-2014-3577</cvename>
 </references>
 <dates>
 <discovery>2012-12-06</discovery>
 <entry>2016-10-28</entry>
 </dates>
 </vuln>

<vuln vid="28bb6ee5-9b5c-11e6-b799-19bef72f4b7c">
 <topic>node.js -- ares_create_query single byte out of buffer write</topic>
 <affects>
 <package>
	<name>node010</name>
	<range><lt>0.10.48</lt></range>
 </package>
 <package>
	<name>node012</name>
	<range><lt>0.12.17</lt></range>
 </package>
 <package>
	<name>node4</name>
	<range><lt>4.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js has released new versions containing the following security fix:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/">
	 The following releases all contain fixes for CVE-2016-5180 "ares_create_query single
	 byte out of buffer write": Node.js v0.10.48 (Maintenance), Node.js v0.12.17 (Maintenance),
	Node.js v4.6.1 (LTS "Argon")
	 
	 While this is not a critical update, all users of these release lines should upgrade at
		their earliest convenience.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/</url>
 <cvename>CVE-2016-5180</cvename>
 <freebsdpr>ports/213800</freebsdpr>
 </references>
 <dates>
 <discovery>2016-10-18</discovery>
 <entry>2016-10-26</entry>
 </dates>
 </vuln>

<vuln vid="27180c99-9b5c-11e6-b799-19bef72f4b7c">
 <topic>node.js -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>node</name>
	<range><ge>6.0.0</ge><lt>6.9.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Node.js v6.9.0 LTS contains the following security fixes, specific to v6.x:
	<blockquote cite="https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/">
	 Disable auto-loading of openssl.cnf: Don't automatically attempt to load an OpenSSL
	 configuration file, from the OPENSSL_CONF environment variable or from the default
	 location for the current platform. Always triggering a configuration file load attempt
	 may allow an attacker to load compromised OpenSSL configuration into a Node.js process
	 if they are able to place a file in a default location.
	 
	 Patched V8 arbitrary memory read (CVE-2016-5172): The V8 parser mishandled scopes,
	 potentially allowing an attacker to obtain sensitive information from arbitrary memory
	 locations via crafted JavaScript code. This vulnerability would require an attacker to
	 be able to execute arbitrary JavaScript code in a Node.js process.
	 
	 Create a unique v8_inspector WebSocket address: Generate a UUID for each execution of
	 the inspector. This provides additional security to prevent unauthorized clients from
	 connecting to the Node.js process via the v8_inspector port when running with --inspect.
	 Since the debugging protocol allows extensive access to the internals of a running process,
	 and the execution of arbitrary code, it is important to limit connections to authorized
	 tools only. Note that the v8_inspector protocol in Node.js is still considered an
	 experimental feature. Vulnerability originally reported by Jann Horn.
	 
	 All of these vulnerabilities are considered low-severity for Node.js users, however,
	 users of Node.js v6.x should upgrade at their earliest convenience.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/</url>
 <cvename>CVE-2016-5172</cvename>
 </references>
 <dates>
 <discovery>2016-10-18</discovery>
 <entry>2016-10-28</entry>
 </dates>
 </vuln>

<vuln vid="c5c6e293-9cc7-11e6-823f-b8aeed92ecc4">
 <topic>urllib3 -- certificate verification failure</topic>
 <affects>
 <package>
	<name>py-urllib3</name>
	<range><lt>1.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	urllib3 reports:
	<blockquote cite="https://github.com/shazow/urllib3/blob/1.18.1/CHANGES.rst">
	 CVE-2016-9015: Certification verification failure
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-9015</cvename>
 <url>https://github.com/shazow/urllib3/blob/1.18.1/CHANGES.rst</url>
 </references>
 <dates>
 <discovery>2016-10-27</discovery>
 <entry>2016-10-28</entry>
 </dates>
 </vuln>

<vuln vid="de6d01d5-9c44-11e6-ba67-0011d823eebd">
 <topic>flash -- remote code execution</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6-flashplugin</name>
	<name>linux-c7-flashplugin</name>
	<range><lt>11.2r202.643</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-36.html">
	 Adobe has released security updates for Adobe Flash Player for
	 Windows, Macintosh, Linux and Chrome OS. These updates address a
	 critical vulnerability that could potentially allow an attacker to
	 take control of the affected system.
	 Adobe is aware of a report that an exploit for CVE-2016-7855
	 exists in the wild, and is being used in limited, targeted attacks
	 against users running Windows versions 7, 8.1 and 10.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-7855</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb16-36.html</url>
 </references>
 <dates>
 <discovery>2016-10-26</discovery>
 <entry>2016-10-27</entry>
 </dates>
 </vuln>

<vuln vid="a479a725-9adb-11e6-a298-14dae9d210b8">
 <topic>FreeBSD -- bhyve - privilege escalation vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.0</ge><lt>11.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	An unchecked array reference in the VGA device emulation
	code could potentially allow guests access to the heap of
	the bhyve process. Since the bhyve process is running as
	root, this may allow guests to obtain full control of the
	hosts they are running on.
	<h1>Impact:</h1>
	For bhyve virtual machines with the "fbuf" framebuffer
	device configured, if exploited, a malicious guest could
	obtain full access to not just the host system, but to other
	virtual machines running on the system.
 </body>
 </description>
 <references>
 <freebsdsa>SA-16:32.bhyve</freebsdsa>
 </references>
 <dates>
 <discovery>2016-10-25</discovery>
 <entry>2016-10-25</entry>
 <modified>2016-10-25</modified>
 </dates>
 </vuln>

<vuln vid="2482c798-93c6-11e6-846f-bc5ff4fb5ea1">
 <topic>flash -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<name>linux-c7-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.637</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-32.html">
	 Adobe has released security updates for Adobe Flash Player for
	 Windows, Macintosh, Linux and ChromeOS. These updates address
	 critical vulnerabilities that could potentially allow an attacker
	 to take control of the affected system.
	 These updates resolve a type confusion vulnerability that could
	 lead to code execution (CVE-2016-6992).
	 These updates resolve use-after-free vulnerabilities that could
	 lead to code execution (CVE-2016-6981, CVE-2016-6987).
	 These updates resolve a security bypass vulnerability
	 (CVE-2016-4286).
	 These updates resolve memory corruption vulnerabilities that could
	 lead to code execution (CVE-2016-4273, CVE-2016-6982,
	 CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986,
	 CVE-2016-6989, CVE-2016-6990).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4273</cvename>
 <cvename>CVE-2016-4286</cvename>
 <cvename>CVE-2016-6981</cvename>
 <cvename>CVE-2016-6982</cvename>
 <cvename>CVE-2016-6983</cvename>
 <cvename>CVE-2016-6984</cvename>
 <cvename>CVE-2016-6985</cvename>
 <cvename>CVE-2016-6986</cvename>
 <cvename>CVE-2016-6987</cvename>
 <cvename>CVE-2016-6989</cvename>
 <cvename>CVE-2016-6990</cvename>
 <cvename>CVE-2016-6992</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb16-32.html</url>
 </references>
 <dates>
 <discovery>2016-10-11</discovery>
 <entry>2016-10-24</entry>
 </dates>
 </vuln>

<vuln vid="aaa9f3db-13b5-4a0e-9ed7-e5ab287098fa">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>49.0.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-87/">
	 CVE-2016-5287: Crash in nsTArray_base&lt;T&gt;::SwapArrayElements
	 CVE-2016-5288: Web content can read cache entries
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5287</cvename>
 <cvename>CVE-2016-5288</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-87/</url>
 </references>
 <dates>
 <discovery>2016-10-20</discovery>
 <entry>2016-10-21</entry>
 </dates>
 </vuln>

<vuln vid="0baadc45-92d0-11e6-8011-005056925db4">
 <topic>Axis2 -- Cross-site scripting (XSS) vulnerability</topic>
 <affects>
 <package>
	<name>axis2</name>
	<range><lt>1.7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache Axis2 reports:
	<blockquote cite="http://axis.apache.org/axis2/java/core/release-notes/1.7.3.html">
	Apache Axis2 1.7.3 is a security release that contains a fix
	 for CVE-2010-3981. That security vulnerability affects the admin console
	 that is part of the Axis2 Web application and was originally reported
	 for SAP BusinessObjects (which includes a version of Axis2). That report
	 didn’t mention Axis2 at all and the Axis2 project only recently became
	 aware (thanks to Devesh Bhatt and Nishant Agarwala) that the issue
	 affects Apache Axis2 as well.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://axis.apache.org/axis2/java/core/release-notes/1.7.3.html</url>
 <cvename>CVE-2010-3981</cvename>
 <freebsdpr>ports/213546</freebsdpr>
 </references>
 <dates>
 <discovery>2010-10-18</discovery>
 <entry>2016-10-18</entry>
 </dates>
 </vuln>

<vuln vid="c1dc55dc-9556-11e6-b154-3065ec8fd3ec">
 <topic>Tor -- remote denial of service</topic>
 <affects>
 <package>
	<name>tor</name>
	<range><lt>0.2.8.9</lt></range>
 </package>
 <package>
	<name>tor-devel</name>
	<range><lt>0.2.9.4-alpha</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Tor Blog reports:
	<blockquote cite="https://blog.torproject.org/blog/tor-0289-released-important-fixes">
	 Prevent a class of security bugs caused by treating the contents
	 of a buffer chunk as if they were a NUL-terminated string. At least
	 one such bug seems to be present in all currently used versions of
	 Tor, and would allow an attacker to remotely crash most Tor
	 instances, especially those compiled with extra compiler hardening.
	 With this defense in place, such bugs can't crash Tor, though we
	 should still fix them as they occur. Closes ticket 20384
	 (TROVE-2016-10-001).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blog.torproject.org/blog/tor-0289-released-important-fixes</url>
 </references>
 <dates>
 <discovery>2016-10-17</discovery>
 <entry>2016-10-18</entry>
 </dates>
 </vuln>

<vuln vid="43f1c867-654a-11e6-8286-00248c0c745d">
 <topic>Rails 4 -- Possible XSS Vulnerability in Action View</topic>
 <affects>
 <package>
	<name>rubygem-actionview</name>
	<range><gt>3.0.0</gt><lt>4.2.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby Security team reports:
	<blockquote cite="https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE">
	 There is a possible XSS vulnerability in Action View. Text declared as "HTML
safe" will not have quotes escaped when used as attribute values in tag
helpers. This vulnerability has been assigned the CVE identifier
CVE-2016-6316.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE</url>
 <cvename>CVE-2016-6316</cvename>
 </references>
 <dates>
 <discovery>2016-08-11</discovery>
 <entry>2016-08-18</entry>
 </dates>
 </vuln>

<vuln vid="7e61cf44-6549-11e6-8286-00248c0c745d">
 <topic>Rails 4 -- Unsafe Query Generation Risk in Active Record</topic>
 <affects>
 <package>
	<name>rubygem-activerecord4</name>
	<range><gt>4.2.0</gt><lt>4.2.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby Security team reports:
	<blockquote cite="https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA">
	 There is a vulnerability when Active Record is used in conjunction with JSON
parameter parsing. This vulnerability has been assigned the CVE identifier
CVE-2016-6317. This vulnerability is similar to CVE-2012-2660, CVE-2012-2694
and CVE-2013-0155.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA</url>
 <cvename>CVE-2016-6317</cvename>
 </references>
 <dates>
 <discovery>2016-08-11</discovery>
 <entry>2016-08-18</entry>
 </dates>
 </vuln>

<vuln vid="f471032a-8700-11e6-8d93-00248c0c745d">
 <topic>PHP -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php70</name>
	<range><lt>7.0.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP reports:
	<blockquote cite="http://php.net/ChangeLog-7.php#7.0.11">
	<ul>
	 <li>Fixed bug #73007 (add locale length check)</li>
	 <li>Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields)</li>
	 <li>Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)</li>
	 <li>Fixed bug #73029 (Missing type check when unserializing SplArray)</li>
	 <li>Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)</li>
	 <li>Fixed bug #72860 (wddx_deserialize use-after-free)</li>
	 <li>Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element)</li>
	</ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://php.net/ChangeLog-7.php#7.0.11</url>
 <cvename>CVE-2016-7416</cvename>
 <cvename>CVE-2016-7412</cvename>
 <cvename>CVE-2016-7414</cvename>
 <cvename>CVE-2016-7417</cvename>
 <cvename>CVE-2016-7413</cvename>
 <cvename>CVE-2016-7418</cvename>
 </references>
 <dates>
 <discovery>2016-09-15</discovery>
 <entry>2016-09-30</entry>
 </dates>
 </vuln>

<vuln vid="8d5180a6-86fe-11e6-8d93-00248c0c745d">
 <topic>PHP -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php56</name>
	<range><lt>5.6.26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP reports:
	<blockquote cite="http://php.net/ChangeLog-5.php#5.6.26">
	<ul>
	 <li>Fixed bug #73007 (add locale length check)</li>
	 <li>Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields)</li>
	 <li>Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)</li>
	 <li>Fixed bug #73029 (Missing type check when unserializing SplArray)</li>
	 <li>Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)</li>
	 <li>Fixed bug #72860 (wddx_deserialize use-after-free)</li>
	 <li>Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element)</li>
	</ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://php.net/ChangeLog-5.php#5.6.26</url>
 <cvename>CVE-2016-7416</cvename>
 <cvename>CVE-2016-7412</cvename>
 <cvename>CVE-2016-7414</cvename>
 <cvename>CVE-2016-7417</cvename>
 <cvename>CVE-2016-7411</cvename>
 <cvename>CVE-2016-7413</cvename>
 <cvename>CVE-2016-7418</cvename>
 </references>
 <dates>
 <discovery>2016-09-16</discovery>
 <entry>2016-09-30</entry>
 </dates>
 </vuln>

<vuln vid="ad479f89-9020-11e6-a590-14dae9d210b8">
 <topic>file-roller -- path traversal vulnerability</topic>
 <affects>
 <package>
	<name>file-roller</name>
	<range><ge>3.5.4,1</ge><lt>3.20.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/09/08/4">
	 File Roller 3.5.4 through 3.20.2 was affected by a path
	 traversal bug that could result in deleted files if a user
	 were tricked into opening a malicious archive.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2016/09/08/4</url>
 <cvename>CVE-2016-7162</cvename>
 <freebsdpr>ports/213199</freebsdpr>
 </references>
 <dates>
 <discovery>2016-09-08</discovery>
 <entry>2016-10-12</entry>
 <modified>2016-10-18</modified>
 </dates>
 </vuln>

<vuln vid="7d40edd1-901e-11e6-a590-14dae9d210b8">
 <topic>VirtualBox -- undisclosed vulnerabilities</topic>
 <affects>
 <package>
	<name>virtualbox-ose</name>
	<range><ge>5.0</ge><lt>5.0.8</lt></range>
	<range><ge>4.3</ge><lt>4.3.32</lt></range>
	<range><ge>4.2</ge><lt>4.2.34</lt></range>
	<range><ge>4.1</ge><lt>4.1.42</lt></range>
	<range><ge>4.0</ge><lt>4.0.34</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports reports:
	<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html">
	 Unspecified vulnerability in the Oracle VM VirtualBox
	 component in Oracle Virtualization VirtualBox prior to 4.0.34, 4.1.42,
	 4.2.34, 4.3.32, and 5.0.8, when using a Windows guest, allows local
	 users to affect availability via unknown vectors related to Core.
	 Unspecified vulnerability in the Oracle VM VirtualBox
	 component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42,
	 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature
	 (RDP) enabled, allows remote attackers to affect availability via
	 unknown vectors related to Core.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html</url>
 <cvename>CVE-2015-4813</cvename>
 <cvename>CVE-2015-4896</cvename>
 <freebsdpr>ports/204406</freebsdpr>
 </references>
 <dates>
 <discovery>2015-10-01</discovery>
 <entry>2016-10-12</entry>
 <modified>2016-10-18</modified>
 </dates>
 </vuln>

<vuln vid="10f7f782-901c-11e6-a590-14dae9d210b8">
 <topic>ImageMagick -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.9.5.10,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian reports:
	<blockquote cite="https://www.debian.org/security/2016/dsa-3675">
	 Various memory handling problems and cases of missing or
	 incomplete input sanitizing may result in denial of service or the
	 execution of arbitrary code if malformed SIXEL, PDB, MAP, SGI, TIFF and
	 CALS files are processed.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.debian.org/security/2016/dsa-3675</url>
 <freebsdpr>ports/213032</freebsdpr>
 </references>
 <dates>
 <discovery>2016-09-23</discovery>
 <entry>2016-10-12</entry>
 <modified>2016-10-18</modified>
 </dates>
 </vuln>

<vuln vid="2a526c78-84ab-11e6-a4a1-60a44ce6887b">
 <topic>libgd -- integer overflow which could lead to heap buffer overflow</topic>
 <affects>
 <package>
 <name>gd</name>
 <range><le>2.2.3</le></range>
 </package>
 <package>
 <name>php70-gd</name>
 <range><le>7.0.11</le></range>
 </package>
 <package>
 <name>php56-gd</name>
 <range><le>5.6.26</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 LibGD reports:
 <blockquote cite="https://github.com/libgd/libgd/issues/308">
	 An integer overflow issue was found in function gdImageWebpCtx of file gd_webp.c which could lead to heap buffer overflow.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/libgd/libgd/issues/308</url>
 <url>https://bugs.php.net/bug.php?id=73003</url>
 <freebsdpr>ports/213023</freebsdpr>
 </references>
 <dates>
 <discovery>2016-09-02</discovery>
 <entry>2016-10-11</entry>
 <modified>2016-10-18</modified>
 </dates>
 </vuln>

<vuln vid="cb3f036d-8c7f-11e6-924a-60a44ce6887b">
 <topic>libvncserver -- multiple security vulnerabilities</topic>
 <affects>
 <package>
 <name>libvncserver</name>
 <range><lt>0.9.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Nicolas Ruff reports:
 <blockquote cite="http://seclists.org/oss-sec/2014/q3/639">
	 Integer overflow in MallocFrameBuffer() on client side.
	 Lack of malloc() return value checking on client side.
	 Server crash on a very large ClientCutText message.
	 Server crash when scaling factor is set to zero.
	 Multiple stack overflows in File Transfer feature.
 </blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2014/q3/639</url>
 <cvename>CVE-2014-6051</cvename>
 <cvename>CVE-2014-6052</cvename>
 <cvename>CVE-2014-6053</cvename>
 <cvename>CVE-2014-6054</cvename>
 <cvename>CVE-2014-6055</cvename>
 <freebsdpr>ports/212380</freebsdpr>
 </references>
 <dates>
 <discovery>2014-09-23</discovery>
 <entry>2016-10-11</entry>
 <modified>2016-10-18</modified>
 </dates>
 </vuln>

<vuln vid="ab947396-9018-11e6-a590-14dae9d210b8">
 <topic>openoffice -- information disclosure vulnerability</topic>
 <affects>
 <package>
	<name>apache-openoffice</name>
	<name>apache-openoffice-devel</name>
	<range><lt>4.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache reports:
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2014-3575.html">
	 The exposure exploits the way OLE previews are generated to
	 embed arbitrary file data into a specially crafted document when it is
	 opened. Data exposure is possible if the updated document is distributed
	 to other parties.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openoffice.org/security/cves/CVE-2014-3575.html</url>
 <cvename>CVE-2014-3575</cvename>
 <freebsdpr>ports/212379</freebsdpr>
 </references>
 <dates>
 <discovery>2014-08-21</discovery>
 <entry>2016-10-12</entry>
 <modified>2016-10-18</modified>
 </dates>
 </vuln>

<vuln vid="47157c14-9013-11e6-a590-14dae9d210b8">
 <topic>mupdf -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mupdf</name>
	<range><lt>1.9a_1,1</lt></range>
 </package>
 <package>
	<name>llpp</name>
	<range><lt>22_2</lt></range>
 </package>
 <package>
	<name>zathura-pdf-mupdf</name>
	<range><lt>0.3.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tobias Kortkamp reports:
	<blockquote cite="http://openbsd-archive.7691.n7.nabble.com/mupdf-CVE-2016-6525-amp-CVE-2016-6265-td302904.html">
	 Heap-based buffer overflow in the pdf_load_mesh_params
	 function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a
	 denial of service (crash) or execute arbitrary code via a large decode
	 array.
	Use-after-free vulnerability in the pdf_load_xref function in
	 pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of
	 service (crash) via a crafted PDF file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://openbsd-archive.7691.n7.nabble.com/mupdf-CVE-2016-6525-amp-CVE-2016-6265-td302904.html</url>
 <url>http://bugs.ghostscript.com/show_bug.cgi?id=696941</url>
 <url>http://bugs.ghostscript.com/show_bug.cgi?id=696954</url>
 <cvename>CVE-2016-6525</cvename>
 <cvename>CVE-2016-6265</cvename>
 <freebsdpr>ports/212207</freebsdpr>
 </references>
 <dates>
 <discovery>2016-08-27</discovery>
 <entry>2016-10-12</entry>
 <modified>2016-10-18</modified>
 </dates>
 </vuln>

<vuln vid="b7d56d0b-7a11-11e6-af78-589cfc0654e1">
 <topic>openjpeg -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openjpeg</name>
	<range><lt>2.1.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tencent's Xuanwu LAB reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/09/08/2">
	 A Heap Buffer Overflow (Out-of-Bounds Write) issue was found in
	 function opj_dwt_interleave_v of dwt.c. This vulnerability allows
	 remote attackers to execute arbitrary code on vulnerable installations
	 of OpenJPEG.
	 An integer overflow issue exists in function opj_pi_create_decode of
	 pi.c. It can lead to Out-Of-Bounds Read and Out-Of-Bounds Write in
	 function opj_pi_next_cprl of pi.c (function opj_pi_next_lrcp,
	 opj_pi_next_rlcp, opj_pi_next_rpcl, opj_pi_next_pcrl may also be
	 vulnerable). This vulnerability allows remote attackers to execute
	 arbitrary code on vulnerable installations of OpenJPEG.
 </blockquote>
 </body>
 </description>
 <references>
 <url>"http://www.openwall.com/lists/oss-security/2016/09/08/2"</url>
 <url>"http://www.openwall.com/lists/oss-security/2016/09/08/3"</url>
 <cvename>CVE-2016-5157</cvename>
 <cvename>CVE-2016-7163</cvename>
 </references>
 <dates>
 <discovery>2016-09-08</discovery>
 <entry>2016-10-11</entry>
 </dates>
 </vuln>

<vuln vid="fa175f30-8c75-11e6-924a-60a44ce6887b">
 <topic>redis -- sensitive information leak through command history file</topic>
 <affects>
 <package>
 <name>redis</name>
 <name>redis-devel</name>
 <range><lt>3.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Redis team reports:
 <blockquote cite="https://github.com/antirez/redis/pull/1418">
	 The redis-cli history file (in linenoise) is created with the
	 default OS umask value which makes it world readable in most systems
	 and could potentially expose authentication credentials to other
	 users.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/antirez/redis/pull/1418</url>
 <url>https://github.com/antirez/redis/issues/3284</url>
 <cvename>CVE-2013-7458</cvename>
 </references>
 <dates>
 <discovery>2013-11-30</discovery>
 <entry>2016-10-11</entry>
 </dates>
 </vuln>

<vuln vid="1a71a972-8ee7-11e6-a590-14dae9d210b8">
 <topic>FreeBSD -- Multiple libarchive vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_1</lt></range>
	<range><ge>10.3</ge><lt>10.3_10</lt></range>
	<range><ge>10.2</ge><lt>10.2_23</lt></range>
	<range><ge>10.1</ge><lt>10.1_40</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Flaws in libarchive's handling of symlinks and hard links
	allow overwriting files outside the extraction directory,
	or permission changes to a directory outside the extraction
	directory.
	<h1>Impact:</h1>
	An attacker who can control freebsd-update's or portsnap's
	input to tar(1) can change file content or permissions on
	files outside of the update tool's working sandbox.
 </body>
 </description>
 <references>
 <freebsdsa>SA-16:31.libarchive</freebsdsa>
 </references>
 <dates>
 <discovery>2016-10-05</discovery>
 <entry>2016-10-10</entry>
 </dates>
 </vuln>

<vuln vid="e7dcd69d-8ee6-11e6-a590-14dae9d210b8">
 <topic>FreeBSD -- Multiple portsnap vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_1</lt></range>
	<range><ge>10.3</ge><lt>10.3_10</lt></range>
	<range><ge>10.2</ge><lt>10.2_23</lt></range>
	<range><ge>10.1</ge><lt>10.1_40</lt></range>
	<range><ge>9.3</ge><lt>9.3_48</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Flaws in portsnap's verification of downloaded tar files
	allows additional files to be included without causing the
	verification to fail. Portsnap may then use or execute these
	files.
	<h1>Impact:</h1>
	An attacker who can conduct man in the middle attack on
	the network at the time when portsnap is run can cause
	portsnap to execute arbitrary commands under the credentials
	of the user who runs portsnap, typically root.
 </body>
 </description>
 <references>
 <freebsdsa>SA-16:30.portsnap</freebsdsa>
 </references>
 <dates>
 <discovery>2016-10-10</discovery>
 <entry>2016-10-10</entry>
 </dates>
 </vuln>

<vuln vid="ce808022-8ee6-11e6-a590-14dae9d210b8">
 <topic>FreeBSD -- Heap overflow vulnerability in bspatch</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_1</lt></range>
	<range><ge>10.3</ge><lt>10.3_10</lt></range>
	<range><ge>10.2</ge><lt>10.2_23</lt></range>
	<range><ge>10.1</ge><lt>10.1_40</lt></range>
	<range><ge>9.3</ge><lt>9.3_48</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The implementation of bspatch is susceptible to integer
	overflows with carefully crafted input, potentially allowing
	an attacker who can control the patch file to write at
	arbitrary locations in the heap. This issue was partially
	addressed in FreeBSD-SA-16:25.bspatch, but some possible
	integer overflows remained.
	<h1>Impact:</h1>
	An attacker who can control the patch file can cause a
	crash or run arbitrary code under the credentials of the
	user who runs bspatch, in many cases, root.
 </body>
 </description>
 <references>
 <freebsdsa>SA-16:29.bspatch</freebsdsa>
 </references>
 <dates>
 <discovery>2016-10-10</discovery>
 <entry>2016-10-10</entry>
 </dates>
 </vuln>

<vuln vid="aeb7874e-8df1-11e6-a082-5404a68ad561">
 <topic>mkvtoolnix -- code execution via specially crafted files</topic>
 <affects>
 <package>
	<name>mkvtoolnix</name>
	<range><lt>9.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Moritz Bunkus reports:
	<blockquote cite="https://mkvtoolnix.download/doc/ChangeLog">
	 most of the bugs fixed on 2016-09-06 and 2016-09-07 for
	 issue #1780 are potentially exploitable. The scenario is arbitrary
	 code execution with specially-crafted files.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mkvtoolnix.download/doc/ChangeLog</url>
 </references>
 <dates>
 <discovery>2016-09-07</discovery>
 <entry>2016-10-09</entry>
 </dates>
 </vuln>

<vuln vid="1cf65085-a760-41d2-9251-943e1af62eb8">
 <topic>X.org libraries -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libX11</name>
	<range><lt>1.6.4,1</lt></range>
 </package>
 <package>
	<name>libXfixes</name>
	<range><lt>5.0.3</lt></range>
 </package>
 <package>
	<name>libXi</name>
	<range><lt>1.7.7,1</lt></range>
 </package>
 <package>
	<name>libXrandr</name>
	<range><lt>1.5.1</lt></range>
 </package>
 <package>
	<name>libXrender</name>
	<range><lt>0.9.10</lt></range>
 </package>
 <package>
	<name>libXtst</name>
	<range><lt>1.2.3</lt></range>
 </package>
 <package>
	<name>libXv</name>
	<range><lt>1.0.11,1</lt></range>
 </package>
 <package>
	<name>libXvMC</name>
	<range><lt>1.0.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthieu Herrb reports:
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2016-October/002720.html">
	 Tobias Stoeckmann from the OpenBSD project has discovered a
	 number of issues in the way various X client libraries handle
	 the responses they receive from servers, and has worked with
	 X.Org's security team to analyze, confirm, and fix these issues.
	 These issue come in addition to the ones discovered by Ilja van
	 Sprundel in 2013.

Most of these issues stem from the client libraries trusting
	 the server to send correct protocol data, and not verifying
	 that the values will not overflow or cause other damage. Most
	 of the time X clients and servers are run by the same user, with
	 the server more privileged than the clients, so this is not a
	 problem, but there are scenarios in which a privileged client
	 can be connected to an unprivileged server, for instance,
	 connecting a setuid X client (such as a screen lock program)
	 to a virtual X server (such as Xvfb or Xephyr) which the user
	 has modified to return invalid data, potentially allowing the
	 user to escalate their privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.x.org/archives/xorg-announce/2016-October/002720.html</url>
 <cvename>CVE-2016-5407</cvename>
 </references>
 <dates>
 <discovery>2016-10-04</discovery>
 <entry>2016-10-07</entry>
 <modified>2016-10-10</modified>
 </dates>
 </vuln>

<vuln vid="c8d902b1-8550-11e6-81e7-d050996490d0">
 <topic>BIND -- Remote Denial of Service vulnerability</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><lt>9.9.9P3</lt></range>
 </package>
 <package>
	<name>bind910</name>
	<range><lt>9.10.4P3</lt></range>
 </package>
 <package>
	<name>bind911</name>
	<range><lt>9.11.0.rc3</lt></range>
 </package>
 <package>
	<name>bind9-devel</name>
	<range><lt>9.12.0.a.2016.09.10</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_48</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01419">
	 Testing by ISC has uncovered a critical error condition
	 which can occur when a nameserver is constructing a
	 response. A defect in the rendering of messages into
	 packets can cause named to exit with an assertion
	 failure in buffer.c while constructing a response
	 to a query that meets certain criteria.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2776</cvename>
 <freebsdsa>SA-16:28.bind</freebsdsa>
 <url>https://kb.isc.org/article/AA-01419</url>
 </references>
 <dates>
 <discovery>2016-09-27</discovery>
 <entry>2016-09-28</entry>
 <modified>2016-10-10</modified>
 </dates>
 </vuln>

<vuln vid="bb022643-84fb-11e6-a4a1-60a44ce6887b">
 <topic>django -- CSRF protection bypass on a site with Google Analytics</topic>
 <affects>
 <package>
 <name>py-django19</name>
 <range><lt>1.9.10</lt></range>
 </package>
 <package>
 <name>py-django18</name>
 <range><lt>1.8.15</lt></range>
 </package>
 <package>
 <name>py-django</name>
 <range><lt>1.8.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Django Software Foundation reports:
 <blockquote cite="https://www.djangoproject.com/weblog/2016/sep/26/security-releases/">
	 An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection.
 </blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2016/sep/26/security-releases/</url>
 <cvename>CVE-2016-7401</cvename>
 </references>
 <dates>
 <discovery>2016-09-26</discovery>
 <entry>2016-09-27</entry>
 </dates>
 </vuln>

<vuln vid="91a337d8-83ed-11e6-bf52-b499baebfeaf">
 <topic>OpenSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2j,1</lt></range>
 </package>
 <package>
	<name>openssl-devel</name>
	<range><lt>1.1.0b</lt></range>
 </package>
 <package>
	<name>libressl</name>
	<range><lt>2.4.3</lt></range>
 </package>
 <package>
	<name>libressl-devel</name>
	<range><lt>2.4.3</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>11.0</ge><lt>11.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20160926.txt">
	 Critical vulnerability in OpenSSL 1.1.0a 
	 Fix Use After Free for large message sizes (CVE-2016-6309)
	 Moderate vulnerability in OpenSSL 1.0.2i 
	 Missing CRL sanity check (CVE-2016-7052)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20160926.txt</url>
 <cvename>CVE-2016-6309</cvename>
 <cvename>CVE-2016-7052</cvename>
 <freebsdsa>SA-16:27.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2016-09-26</discovery>
 <entry>2016-09-26</entry>
 <modified>2016-10-10</modified>
 </dates>
 </vuln>

<vuln vid="43eaa656-80bc-11e6-bf52-b499baebfeaf">
 <topic>OpenSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl-devel</name>
	<range><ge>1.1.0</ge><lt>1.1.0_1</lt></range>
 </package>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2i,1</lt></range>
 </package>
 <package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_11</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.3</ge><lt>10.3_8</lt></range>
	<range><ge>10.2</ge><lt>10.2_21</lt></range>
	<range><ge>10.1</ge><lt>10.1_38</lt></range>
	<range><ge>9.3</ge><lt>9.3_46</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20160922.txt">
	 High: OCSP Status Request extension unbounded memory growth
	 SSL_peek() hang on empty record
	 SWEET32 Mitigation
	 OOB write in MDC2_Update()
	 Malformed SHA512 ticket DoS
	 OOB write in BN_bn2dec()
	 OOB read in TS_OBJ_print_bio()
	 Pointer arithmetic undefined behaviour
	 Constant time flag not preserved in DSA signing
	 DTLS buffered message DoS
	 DTLS replay protection DoS
	 Certificate message OOB reads
	 Excessive allocation of memory in tls_get_message_header()
	 Excessive allocation of memory in dtls1_preprocess_fragment()
	 NB: LibreSSL is only affected by CVE-2016-6304
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20160922.txt</url>
 <cvename>CVE-2016-6304</cvename>
 <cvename>CVE-2016-6305</cvename>
 <cvename>CVE-2016-2183</cvename>
 <cvename>CVE-2016-6303</cvename>
 <cvename>CVE-2016-6302</cvename>
 <cvename>CVE-2016-2182</cvename>
 <cvename>CVE-2016-2180</cvename>
 <cvename>CVE-2016-2177</cvename>
 <cvename>CVE-2016-2178</cvename>
 <cvename>CVE-2016-2179</cvename>
 <cvename>CVE-2016-2181</cvename>
 <cvename>CVE-2016-6306</cvename>
 <cvename>CVE-2016-6307</cvename>
 <cvename>CVE-2016-6308</cvename>
 <freebsdsa>SA-16:26.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2016-09-22</discovery>
 <entry>2016-09-22</entry>
 <modified>2016-10-11</modified>
 </dates>
 </vuln>

<vuln vid="e78261e4-803d-11e6-a590-14dae9d210b8">
 <topic>irssi -- heap corruption and missing boundary checks</topic>
 <affects>
 <package>
	<name>irssi</name>
	<name>zh-irssi</name>
	<range><ge>0.8.17</ge><lt>0.8.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Irssi reports:
	<blockquote cite="https://irssi.org/security/irssi_sa_2016.txt">
	 Remote crash and heap corruption. Remote code execution seems
	 difficult since only Nuls are written.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://irssi.org/security/irssi_sa_2016.txt</url>
 <cvename>CVE-2016-7044</cvename>
 <cvename>CVE-2016-7045</cvename>
 </references>
 <dates>
 <discovery>2016-09-21</discovery>
 <entry>2016-09-21</entry>
 <modified>2016-09-22</modified>
 </dates>
 </vuln>

<vuln vid="2c57c47e-8bb3-4694-83c8-9fc3abad3964">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>49.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.46</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>45.4.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>45.4.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>45.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-85/">
	 CVE-2016-2827 - Out-of-bounds read in mozilla::net::IsValidReferrerPolicy [low]
	 CVE-2016-5256 - Memory safety bugs fixed in Firefox 49 [critical]
	 CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 [critical]
	 CVE-2016-5270 - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString [high]
	 CVE-2016-5271 - Out-of-bounds read in PropertyProvider::GetSpacingInternal [low]
	 CVE-2016-5272 - Bad cast in nsImageGeometryMixin [high]
	 CVE-2016-5273 - crash in mozilla::a11y::HyperTextAccessible::GetChildOffset [high]
	 CVE-2016-5274 - use-after-free in nsFrameManager::CaptureFrameState [high]
	 CVE-2016-5275 - global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions [critical]
	 CVE-2016-5276 - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList [high]
	 CVE-2016-5277 - Heap-use-after-free in nsRefreshDriver::Tick [high]
	 CVE-2016-5278 - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame [critical]
	 CVE-2016-5279 - Full local path of files is available to web pages after drag and drop [moderate]
	 CVE-2016-5280 - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap [high]
	 CVE-2016-5281 - use-after-free in DOMSVGLength [high]
	 CVE-2016-5282 - Don't allow content to request favicons from non-whitelisted schemes [moderate]
	 CVE-2016-5283 - &lt;iframe src&gt; fragment timing attack can reveal cross-origin data [high]
	 CVE-2016-5284 - Add-on update site certificate pin expiration [high]
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2827</cvename>
 <cvename>CVE-2016-5256</cvename>
 <cvename>CVE-2016-5257</cvename>
 <cvename>CVE-2016-5270</cvename>
 <cvename>CVE-2016-5271</cvename>
 <cvename>CVE-2016-5272</cvename>
 <cvename>CVE-2016-5273</cvename>
 <cvename>CVE-2016-5274</cvename>
 <cvename>CVE-2016-5275</cvename>
 <cvename>CVE-2016-5276</cvename>
 <cvename>CVE-2016-5277</cvename>
 <cvename>CVE-2016-5278</cvename>
 <cvename>CVE-2016-5279</cvename>
 <cvename>CVE-2016-5280</cvename>
 <cvename>CVE-2016-5281</cvename>
 <cvename>CVE-2016-5282</cvename>
 <cvename>CVE-2016-5283</cvename>
 <cvename>CVE-2016-5284</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-85/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-86/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-88/</url>
 </references>
 <dates>
 <discovery>2016-09-13</discovery>
 <entry>2016-09-20</entry>
 <modified>2016-10-21</modified>
 </dates>
 </vuln>

<vuln vid="653a8059-7c49-11e6-9242-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>53.0.2785.113</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_13.html">
	 Several security fixes in this release, including:
	 <ul>
	 <li>[641101] High CVE-2016-5170: Use after free in Blink.Credit to
	 Anonymous</li>
	 <li>[643357] High CVE-2016-5171: Use after free in Blink. Credit to
	 Anonymous</li>
	 <li>[616386] Medium CVE-2016-5172: Arbitrary Memory Read in v8.
	 Credit to Choongwoo Han</li>
	 <li>[468931] Medium CVE-2016-5173: Extension resource access.
	 Credit to Anonymous</li>
	 <li>[579934] Medium CVE-2016-5174: Popup not correctly suppressed.
	 Credit to Andrey Kovalev (@L1kvID) Yandex Security Team</li>
	 <li>[646394] CVE-2016-5175: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5170</cvename>
 <cvename>CVE-2016-5171</cvename>
 <cvename>CVE-2016-5172</cvename>
 <cvename>CVE-2016-5173</cvename>
 <cvename>CVE-2016-5174</cvename>
 <cvename>CVE-2016-5175</cvename>
 <url>https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_13.html</url>
 </references>
 <dates>
 <discovery>2016-09-13</discovery>
 <entry>2016-09-16</entry>
 </dates>
 </vuln>

<vuln vid="b64a7389-7c27-11e6-8aaa-5404a68ad561">
 <topic>Remote-Code-Execution vulnerability in mysql and its variants CVE 2016-6662</topic>
 <affects>
 <package>
	<name>mysql57-client</name>
	<name>mysql57-server</name>
	<range><lt>5.7.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	LegalHackers' reports:
	<blockquote cite="http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html">
	 RCE Bugs discovered in MySQL and its variants like MariaDB.
	 It works by manipulating my.cnf files and using --malloc-lib.
	 The bug seems fixed in MySQL 5.7.15 by Oracle
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-6662</cvename>
 <url>http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html</url>
 <url>https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html</url>
 </references>
 <dates>
 <discovery>2016-09-12</discovery>
 <entry>2016-09-14</entry>
 </dates>
 </vuln>

<vuln vid="bc19dcca-7b13-11e6-b99e-589cfc0654e1">
 <topic>dropbear -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dropbear</name>
	<range><lt>2016.74</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matt Johnston reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/09/15/2">
	 If specific usernames including "%" symbols can be created on a system
	 (validated by getpwnam()) then an attacker could run arbitrary code as root
	 when connecting to Dropbear server.

A dbclient user who can control username or host arguments could potentially
	 run arbitrary code as the dbclient user. This could be a problem if scripts
	 or webpages pass untrusted input to the dbclient program.
	 dropbearconvert import of OpenSSH keys could run arbitrary code as
	 the local dropbearconvert user when parsing malicious key files.
	 dbclient could run arbitrary code as the local dbclient user if
	 particular -m or -c arguments are provided. This could be an issue where
	 dbclient is used in scripts.
	 dbclient or dropbear server could expose process memory to the
	 running user if compiled with DEBUG_TRACE and running with -v
	</blockquote>
 </body>
 </description>
 <references>
 <url>"http://www.openwall.com/lists/oss-security/2016/09/15/2"</url>
 <cvename>CVE-2016-7406</cvename>
 <cvename>CVE-2016-7407</cvename>
 <cvename>CVE-2016-7408</cvename>
 <cvename>CVE-2016-7409</cvename>
 </references>
 <dates>
 <discovery>2016-07-12</discovery>
 <entry>2016-09-15</entry>
 </dates>
 </vuln>

<vuln vid="08664d42-7989-11e6-b7a8-74d02b9a84d5">
 <topic>h2o -- fix DoS attack vector</topic>
 <affects>
 <package>
	<name>h2o</name>
	<range>
	 <lt>2.0.4</lt>
	</range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Frederik Deweerdt reported a denial-of-service attack vector
	due to an unhandled error condition during socket connection.
 </body>
 </description>
 <references>
 <url>https://github.com/h2o/h2o/issues/1077</url>
 <cvename>CVE-2016-4864</cvename>
 </references>
 <dates>
 <discovery>2016-06-09</discovery>
 <entry>2016-09-14</entry>
 </dates>
 </vuln>

<vuln vid="b018121b-7a4b-11e6-bf52-b499baebfeaf">
 <topic>cURL -- Escape and unescape integer overflows</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.11.1</ge><lt>7.50.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports
	<blockquote cite="https://curl.haxx.se/docs/adv_20160914.html">
	 The four libcurl functions curl_escape(), curl_easy_escape(),
	 curl_unescape and curl_easy_unescape perform string URL percent
	 escaping and unescaping. They accept custom string length inputs
	 in signed integer arguments.
	 The provided string length arguments were not properly checked
	 and due to arithmetic in the functions, passing in the length
	 0xffffffff (2^32-1 or UINT_MAX or even just -1) would end up
	 causing an allocation of zero bytes of heap memory that curl
	 would attempt to write gigabytes of data into.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://curl.haxx.se/docs/adv_20160914.html</url>
 <cvename>CVE-2016-7167</cvename>
 </references>
 <dates>
 <discovery>2016-09-14</discovery>
 <entry>2016-09-14</entry>
 </dates>
 </vuln>

<vuln vid="769ba449-79e1-11e6-bf75-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>53.0.2785.92</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop_31.html">
	 33 security fixes in this release
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5147</cvename>
 <cvename>CVE-2016-5148</cvename>
 <cvename>CVE-2016-5149</cvename>
 <cvename>CVE-2016-5150</cvename>
 <cvename>CVE-2016-5151</cvename>
 <cvename>CVE-2016-5152</cvename>
 <cvename>CVE-2016-5153</cvename>
 <cvename>CVE-2016-5154</cvename>
 <cvename>CVE-2016-5155</cvename>
 <cvename>CVE-2016-5156</cvename>
 <cvename>CVE-2016-5157</cvename>
 <cvename>CVE-2016-5158</cvename>
 <cvename>CVE-2016-5159</cvename>
 <cvename>CVE-2016-5160</cvename>
 <cvename>CVE-2016-5161</cvename>
 <cvename>CVE-2016-5162</cvename>
 <cvename>CVE-2016-5163</cvename>
 <cvename>CVE-2016-5164</cvename>
 <cvename>CVE-2016-5165</cvename>
 <cvename>CVE-2016-5166</cvename>
 <cvename>CVE-2016-5167</cvename>
 <url>https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop_31.html</url>
 </references>
 <dates>
 <discovery>2016-08-31</discovery>
 <entry>2016-09-13</entry>
 </dates>
 </vuln>

<vuln vid="958b9cee-79da-11e6-bf75-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>52.0.2743.116</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop.html">
	 10 security fixes in this release, including:
	 <ul>
	 <li>[629542] High CVE-2016-5141 Address bar spoofing. Credit to
	 anonymous</li>
	 <li>[626948] High CVE-2016-5142 Use-after-free in Blink. Credit to
	 anonymous</li>
	 <li>[625541] High CVE-2016-5139 Heap overflow in pdfium. Credit to
	 GiWan Go of Stealien</li>
	 <li>[619405] High CVE-2016-5140 Heap overflow in pdfium. Credit to
	 Ke Liu of Tencent's Xuanwu LAB</li>
	 <li>[623406] Medium CVE-2016-5145 Same origin bypass for images in
	 Blink. Credit to anonymous</li>
	 <li>[619414] Medium CVE-2016-5143 Parameter sanitization failure in
	 DevTools. Credit to Gregory Panakkal</li>
	 <li>[618333] Medium CVE-2016-5144 Parameter sanitization failure in
	 DevTools. Credit to Gregory Panakkal</li>
	 <li>[633486] CVE-2016-5146: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5139</cvename>
 <cvename>CVE-2016-5140</cvename>
 <cvename>CVE-2016-5141</cvename>
 <cvename>CVE-2016-5142</cvename>
 <cvename>CVE-2016-5143</cvename>
 <cvename>CVE-2016-5144</cvename>
 <cvename>CVE-2016-5145</cvename>
 <cvename>CVE-2016-5146</cvename>
 <url>https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop.html</url>
 </references>
 <dates>
 <discovery>2016-08-03</discovery>
 <entry>2016-09-13</entry>
 </dates>
 </vuln>

<vuln vid="856b88bf-7984-11e6-81e7-d050996490d0">
 <topic>mysql -- Remote Root Code Execution</topic>
 <affects>
 <package>
	<name>mariadb55-server</name>
	<range><lt>5.5.51</lt></range>
 </package>
 <package>
	<name>mariadb100-server</name>
	<range><lt>10.0.27</lt></range>
 </package>
 <package>
	<name>mariadb101-server</name>
	<range><lt>10.1.17</lt></range>
 </package>
 <package>
	<name>mysql55-server</name>
	<range><lt>5.5.52</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.33</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.15</lt></range>
 </package>
 <package>
	<name>percona55-server</name>
	<range><lt>5.5.51.38.1</lt></range>
 </package>
 <package>
	<name>percona56-server</name>
	<range><lt>5.6.32.78.0</lt></range>
 </package>
 <package>
	<name>percona57-server</name>
	<range><lt>5.7.14.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dawid Golunski reports:
	<blockquote cite="http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt">
	 An independent research has revealed multiple severe MySQL
	 vulnerabilities. This advisory focuses on a critical
	 vulnerability with a CVEID of CVE-2016-6662 which can allow
	 attackers to (remotely) inject malicious settings into MySQL
	 configuration files (my.cnf) leading to critical
	 consequences.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-6662</cvename>
 <url>http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt</url>
 <url>https://jira.mariadb.org/browse/MDEV-10465</url>
 <url>https://www.percona.com/blog/2016/09/12/percona-server-critical-update-cve-2016-6662/</url>
 <url>https://www.percona.com/blog/2016/09/12/database-affected-cve-2016-6662/</url>
 <url>https://www.psce.com/blog/2016/09/12/how-to-quickly-patch-mysql-server-against-cve-2016-6662/</url>
 </references>
 <dates>
 <discovery>2016-09-12</discovery>
 <entry>2016-09-13</entry>
 </dates>
 </vuln>

<vuln vid="331eabb3-85b1-466a-a2af-66ac864d395a">
 <topic>wolfssl -- leakage of private key information</topic>
 <affects>
 <package>
 <name>wolfssl</name>
 <range><lt>3.6.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Florian Weimer of Redhat discovered that an optimization in
 RSA signature validation can result in disclosure of the
 server's private key under certain fault conditions.
 </body>
 </description>
 <references>
 <url>https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html</url>
 <url>https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/</url>
 <cvename>CVE-2015-7744</cvename>
 </references>
 <dates>
 <discovery>2015-09-17</discovery>
 <entry>2016-01-05</entry>
 </dates>
 </vuln>

<vuln vid="3d1372e1-7822-4fd8-b56e-5ee832afbd96">
 <topic>wolfssl -- DDoS amplification in DTLS</topic>
 <affects>
 <package>
 <name>wolfssl</name>
 <range><lt>3.6.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Sebastian Ramacher identified an error in wolfSSL's implementation
 of the server side of the DTLS handshake, which could be abused
 for DDoS amplification or a DoS on the DTLS server itself.
 </body>
 </description>
 <references>
 <url>https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html</url>
 <url>https://github.com/IAIK/wolfSSL-DoS</url>
 <cvename>CVE-2015-6925</cvename>
 </references>
 <dates>
 <discovery>2015-09-18</discovery>
 <entry>2016-01-05</entry>
 </dates>
 </vuln>

<vuln vid="a0128291-7690-11e6-95a8-0011d823eebd">
 <topic>gnutls -- OCSP validation issue</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>3.4.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	gnutls.org reports:
	<blockquote cite="https://gnutls.org/security.html#GNUTLS-SA-2016-3">
	 Stefan Bühler discovered an issue that affects validation
	 of certificates using OCSP responses, which can falsely report a
	 certificate as valid under certain circumstances.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://gnutls.org/security.html#GNUTLS-SA-2016-3</url>
 </references>
 <dates>
 <discovery>2016-09-08</discovery>
 <entry>2016-09-09</entry>
 </dates>
 </vuln>

<vuln vid="aa1aefe3-6e37-47db-bfda-343ef4acb1b5">
 <topic>Mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>48.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.45</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>45.3.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>45.3.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>45.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox48">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-0718</cvename>
 <cvename>CVE-2016-2830</cvename>
 <cvename>CVE-2016-2835</cvename>
 <cvename>CVE-2016-2836</cvename>
 <cvename>CVE-2016-2837</cvename>
 <cvename>CVE-2016-2838</cvename>
 <cvename>CVE-2016-2839</cvename>
 <cvename>CVE-2016-5250</cvename>
 <cvename>CVE-2016-5251</cvename>
 <cvename>CVE-2016-5252</cvename>
 <cvename>CVE-2016-5253</cvename>
 <cvename>CVE-2016-5254</cvename>
 <cvename>CVE-2016-5255</cvename>
 <cvename>CVE-2016-5258</cvename>
 <cvename>CVE-2016-5259</cvename>
 <cvename>CVE-2016-5260</cvename>
 <cvename>CVE-2016-5261</cvename>
 <cvename>CVE-2016-5262</cvename>
 <cvename>CVE-2016-5263</cvename>
 <cvename>CVE-2016-5264</cvename>
 <cvename>CVE-2016-5265</cvename>
 <cvename>CVE-2016-5266</cvename>
 <cvename>CVE-2016-5267</cvename>
 <cvename>CVE-2016-5268</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-62/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-63/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-64/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-65/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-66/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-67/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-68/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-69/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-70/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-71/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-72/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-73/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-74/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-75/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-76/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-77/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-78/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-79/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-80/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-81/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-82/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-83/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-84/</url>
 </references>
 <dates>
 <discovery>2016-08-02</discovery>
 <entry>2016-09-07</entry>
 <modified>2016-09-20</modified>
 </dates>
 </vuln>

<vuln vid="5cb18881-7604-11e6-b362-001999f8d30b">
 <topic>asterisk -- RTP Resource Exhaustion</topic>
 <affects>
 <package>
	<name>asterisk11</name>
	<range><lt>11.23.1</lt></range>
 </package>
 <package>
	<name>asterisk13</name>
	<range><lt>13.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 The overlap dialing feature in chan_sip allows chan_sip
	 to report to a device that the number that has been dialed
	 is incomplete and more digits are required. If this
	 functionality is used with a device that has performed
	 username/password authentication RTP resources are leaked.
	 This occurs because the code fails to release the old RTP
	 resources before allocating new ones in this scenario.
	 If all resources are used then RTP port exhaustion will
	 occur and no RTP sessions are able to be set up.
	 If overlap dialing support is not needed the "allowoverlap"
	 option can be set to no. This will stop any usage of the
	 scenario which causes the resource exhaustion.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2016-007.html</url>
 </references>
 <dates>
 <discovery>2016-08-05</discovery>
 <entry>2016-09-08</entry>
 </dates>
 </vuln>

<vuln vid="7fda7920-7603-11e6-b362-001999f8d30b">
 <topic>asterisk -- Crash on ACK from unknown endpoint</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><ge>13.10.0</ge><lt>13.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 Asterisk can be crashed remotely by sending an ACK to
	 it from an endpoint username that Asterisk does not
	 recognize. Most SIP request types result in an "artificial"
	 endpoint being looked up, but ACKs bypass this lookup.
	 The resulting NULL pointer results in a crash when
	 attempting to determine if ACLs should be applied.
	 This issue was introduced in the Asterisk 13.10 release
	 and only affects that release.
	 This issue only affects users using the PJSIP stack
	 with Asterisk. Those users that use chan_sip are
	 unaffected.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2016-006.html</url>
 </references>
 <dates>
 <discovery>2016-08-03</discovery>
 <entry>2016-09-08</entry>
 </dates>
 </vuln>

<vuln vid="70c85c93-743c-11e6-a590-14dae9d210b8">
 <topic>inspircd -- authentication bypass vulnerability</topic>
 <affects>
 <package>
	<name>inspircd</name>
	<range><lt>2.0.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adam reports:
	<blockquote cite="http://www.inspircd.org/2016/09/03/v2023-released.html">
	 A serious vulnerability exists in when using m_sasl in
	 combination with any services that support SASL EXTERNAL.
	 To be vulnerable you must have m_sasl loaded, and have services which
	 support SASL EXTERNAL authentication.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.inspircd.org/2016/09/03/v2023-released.html</url>
 </references>
 <dates>
 <discovery>2016-09-03</discovery>
 <entry>2016-09-06</entry>
 </dates>
 </vuln>

<vuln vid="9e50dcc3-740b-11e6-94a2-080027ef73ec">
 <topic>mailman -- CSRF hardening in parts of the web interface</topic>
 <affects>
 <package>
	<name>mailman</name>
	<range><lt>2.1.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The late Tokio Kikuchi reported:
	<blockquote cite="https://bugs.launchpad.net/mailman/+bug/775294">
	 We may have to set lifetime for input forms because of recent
	 activities on cross-site request forgery (CSRF). The form lifetime
	 is successfully deployed in frameworks like web.py or plone etc.
	 Proposed branch lp:~tkikuchi/mailman/form-lifetime implement
	 lifetime in admin, admindb, options and edithtml interfaces.
	 [...]
	</blockquote>
	<blockquote cite="https://launchpad.net/mailman/2.1/2.1.15">
	 The web admin interface has been hardened against CSRF attacks by
	 adding a hidden, encrypted token with a time stamp to form submissions
	 and not accepting authentication by cookie if the token is missing,
	 invalid or older than the new mm_cfg.py setting FORM_LIFETIME which
	 defaults to one hour. Posthumous thanks go to Tokio Kikuchi for this implementation [...].
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.launchpad.net/mailman/+bug/775294</url>
 <url>https://launchpad.net/mailman/2.1/2.1.15</url>
 <cvename>CVE-2016-7123</cvename>
 </references>
 <dates>
 <discovery>2011-05-02</discovery>
 <entry>2016-09-06</entry>
 </dates>
 </vuln>

<vuln vid="adccefd1-7080-11e6-a2cb-c80aa9043978">
 <topic>openssh -- sshd -- remote valid user discovery and PAM /bin/login attack</topic>
 <affects>
 <package>
	<name>openssh-portable</name>
	<range><lt>7.3.p1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSH project reports:
	<blockquote cite="http://www.openssh.com/txt/release-7.3">
	 * sshd(8): Mitigate timing differences in password authentication
	 that could be used to discern valid from invalid account names
	 when long passwords were sent and particular password hashing
	 algorithms are in use on the server. CVE-2016-6210, reported by
	 EddieEzra.Harari at verint.com
	 
	 * sshd(8): (portable only) Ignore PAM environment vars when
	 UseLogin=yes. If PAM is configured to read user-specified
	 environment variables and UseLogin=yes in sshd_config, then a
	 hostile local user may attack /bin/login via LD_PRELOAD or
	 similar environment variables set via PAM. CVE-2015-8325,
	 found by Shayan Sadigh.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openssh.com/txt/release-7.3</url>
 <cvename>CVE-2016-6210</cvename>
 <cvename>CVE-2015-8325</cvename>
 </references>
 <dates>
 <discovery>2016-08-01</discovery>
 <entry>2016-09-01</entry>
 </dates>
 </vuln>

<vuln vid="b11ab01b-6e19-11e6-ab24-080027ef73ec">
 <topic>mailman -- CSRF protection enhancements</topic>
 <affects>
 <package>
	<name>mailman</name>
	<range><lt>2.1.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mark Sapiro reports:
	<blockquote cite="http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668">
	 CSRF protection has been extended to the user options page. This
	 was actually fixed by Tokio Kikuchi as part of the fix for LP:
	 #775294 and intended for Mailman 2.1.15, but that fix wasn't
	 completely merged at the time. The full fix also addresses the
	 admindb, and edithtml pages as well as the user options page and the
	 previously fixed admin pages. Thanks to Nishant Agarwala for reporting the issue.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668</url>
 <url>https://mail.python.org/pipermail/mailman-announce/2016-August/000226.html</url>
 <cvename>CVE-2016-6893</cvename>
 </references>
 <dates>
 <discovery>2016-08-19</discovery>
 <entry>2016-08-29</entry>
 </dates>
 </vuln>

<vuln vid="e195679d-045b-4953-bb33-be0073ba2ac6">
 <topic>libxml2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.9.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Daniel Veillard reports:
	<blockquote cite="https://mail.gnome.org/archives/xml/2016-May/msg00023.html">
	 More format string warnings with possible format string
	 vulnerability (David Kilzer)
	 Avoid building recursive entities (Daniel Veillard)
	 Heap-based buffer overread in htmlCurrentChar (Pranjal Jumde)
	 Heap-based buffer-underreads due to xmlParseName (David Kilzer)
	 Heap use-after-free in xmlSAX2AttributeNs (Pranjal Jumde)
	 Heap use-after-free in htmlParsePubidLiteral and
	 htmlParseSystemiteral (Pranjal Jumde)
	 Fix some format string warnings with possible format string
	 vulnerability (David Kilzer)
	 Detect change of encoding when parsing HTML names (Hugh Davenport)
	 Fix inappropriate fetch of entities content (Daniel Veillard)
	 Bug 759398: Heap use-after-free in xmlDictComputeFastKey
	 (Pranjal Jumde)
	 Bug 758605: Heap-based buffer overread in xmlDictAddString
	 (Pranjal Jumde)
	 Bug 758588: Heap-based buffer overread in
	 xmlParserPrintFileContextInternal (David Kilzer)
	 Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup
	 (Pranjal Jumde)
	 Add missing increments of recursion depth counter to XML parser.
	 (Peter Simons)
	 Fix NULL pointer deref in XPointer range-to
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mail.gnome.org/archives/xml/2016-May/msg00023.html</url>
 <url>https://bugzilla.gnome.org/show_bug.cgi?id=759398</url>
 <url>https://bugzilla.gnome.org/show_bug.cgi?id=758605</url>
 <url>https://bugzilla.gnome.org/show_bug.cgi?id=758588</url>
 <url>https://bugzilla.gnome.org/show_bug.cgi?id=757711</url>
 <url>https://git.gnome.org/browse/libxml2/patch/?id=d8083bf77955b7879c1290f0c0a24ab8cc70f7fb</url>
 <cvename>CVE-2016-1762</cvename>
 <cvename>CVE-2016-1833</cvename>
 <cvename>CVE-2016-1834</cvename>
 <cvename>CVE-2016-1835</cvename>
 <cvename>CVE-2016-1836</cvename>
 <cvename>CVE-2016-1837</cvename>
 <cvename>CVE-2016-1838</cvename>
 <cvename>CVE-2016-1839</cvename>
 <cvename>CVE-2016-1840</cvename>
 <cvename>CVE-2016-3627</cvename>
 <cvename>CVE-2016-3705</cvename>
 <cvename>CVE-2016-4449</cvename>
 <cvename>CVE-2016-4483</cvename>
 </references>
 <dates>
 <discovery>2016-05-23</discovery>
 <entry>2016-08-28</entry>
 </dates>
 </vuln>

<vuln vid="4472ab39-6c66-11e6-9ca5-50e549ebab6c">
 <topic>kdelibs -- directory traversal vulnerability</topic>
 <affects>
 <package>
	<name>kdelibs</name>
	<range><lt>4.14.10_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	David Faure reports:
	<blockquote cite="https://www.kde.org/info/security/advisory-20160724-1.txt">
	 A maliciously crafted archive (.zip or .tar.bz2) with "../" in the
	 file paths could be offered for download via the KNewStuff
	 framework (e.g. on www.kde-look.org), and upon extraction would
	 install files anywhere in the user's home directory.
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2016-6232</cvename>
 <url>https://www.kde.org/info/security/advisory-20160724-1.txt</url>
 </references>
 <dates>
 <discovery>2016-07-24</discovery>
 <entry>2016-08-27</entry>
 </dates>
 </vuln>

<vuln vid="f5035ead-688b-11e6-8b1d-c86000169601">
 <topic>eog -- out-of-bounds write</topic>
 <affects>
 <package>
	<name>eog</name>
	<range><lt>3.18.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Felix Riemann reports:
	<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2016-August/msg00123.html">
	 CVE-2016-6855 out-of-bounds write in eog 3.10.2.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mail.gnome.org/archives/ftp-release-list/2016-August/msg00123.html</url>
 <cvename>CVE-2016-6855</cvename>
 </references>
 <dates>
 <discovery>2016-08-21</discovery>
 <entry>2016-08-22</entry>
 </dates>
 </vuln>

<vuln vid="44989c29-67d1-11e6-8b1d-c86000169601">
 <topic>fontconfig -- insufficiently cache file validation</topic>
 <affects>
 <package>
	<name>fontconfig</name>
	<range><lt>1.12.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian security team reports:
	<blockquote cite="https://packetstormsecurity.com/files/138236/Debian-Security-Advisory-3644-1.html">
	 Tobias Stoeckmann discovered that cache files are insufficiently
	 validated in fontconfig, a generic font configuration library. An
	 attacker can trigger arbitrary free() calls, which in turn allows
	 double free attacks and therefore arbitrary code execution. In
	 combination with setuid binaries using crafted cache files, this
	 could allow privilege escalation.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://packetstormsecurity.com/files/138236/Debian-Security-Advisory-3644-1.html</url>
 <cvename>CVE-2016-5384</cvename>
 </references>
 <dates>
 <discovery>2016-08-05</discovery>
 <entry>2016-08-21</entry>
 </dates>
 </vuln>

<vuln vid="7fe7df75-6568-11e6-a590-14dae9d210b8">
 <topic>End of Life Ports</topic>
 <affects>
 <package>
	<name>python32</name>
	<name>python31</name>
	<name>python30</name>
	<name>python26</name>
	<name>python25</name>
	<name>python24</name>
	<name>python23</name>
	<name>python22</name>
	<name>python21</name>
	<name>python20</name>
	<name>python15</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>php54</name>
	<name>php53</name>
	<name>php52</name>
	<name>php5</name>
	<name>php4</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>perl5</name>
	<range><lt>5.18</lt></range>
 </package>
 <package>
	<name>perl5.16</name>
	<name>perl5.14</name>
	<name>perl5.12</name>
	<name>perl</name> 
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>ruby</name>
	<name>ruby_static</name>
	<range><lt>2.1,1</lt></range>
 </package>
 <package>
	<name>unifi2</name>
	<name>unifi3</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>apache21</name>
	<name>apache20</name>
	<name>apache13</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>tomcat55</name>
	<name>tomcat41</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>mysql51-client</name>
	<name>mysql51-server</name>
	<name>mysql50-client</name>
	<name>mysql50-server</name>
	<name>mysql41-client</name>
	<name>mysql41-server</name>
	<name>mysql40-client</name>
	<name>mysql40-server</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>postgresql90-client</name>
	<name>postgresql90-server</name>
	<name>postgresql84-client</name>
	<name>postgresql84-server</name>
	<name>postgresql83-client</name>
	<name>postgresql83-server</name>
	<name>postgresql82-client</name>
	<name>postgresql82-server</name>
	<name>postgresql81-client</name>
	<name>postgresql81-server</name>
	<name>postgresql80-client</name>
	<name>postgresql80-server</name>
	<name>postgresql74-client</name>
	<name>postgresql74-server</name>
	<name>postgresql73-client</name>
	<name>postgresql73-server</name>
	<name>postgresql72-client</name>
	<name>postgresql72-server</name>
	<name>postgresql71-client</name>
	<name>postgresql71-server</name>
	<name>postgresql7-client</name>
	<name>postgresql7-server</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 These packages have reached End of Life status and/or have
	 been removed from the Ports Tree. They may contain undocumented
	 security issues. Please take caution and find alternative
	 software as soon as possible.
 </body>
 </description>
 <references>
 <freebsdpr>ports/211975</freebsdpr>
 </references>
 <dates>
 <discovery>2016-08-18</discovery>
 <entry>2016-08-18</entry>
 <modified>2016-10-18</modified>
 </dates>
 </vuln>

<vuln vid="e1c71d8d-64d9-11e6-b38a-25a46b33f2ed">
 <topic>gnupg -- attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output</topic>
 <affects>
 <package>
	<name>gnupg1</name>
	<range><lt>1.4.21</lt></range>
 </package>
 <package>
	<name>libgcrypt</name>
	<range><lt>1.7.3</lt></range>
 </package>
 <package>
	<name>linux-c6-libgcrypt</name>
	<range><lt>1.4.5_4</lt></range>
 </package>
 <package>
	<name>linux-c7-libgcrypt</name>
	<range><lt>1.5.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Werner Koch reports:
	<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html">
	 There was a bug in the mixing functions of Libgcrypt's random
	 number generator: An attacker who obtains 4640 bits from the RNG can
	 trivially predict the next 160 bits of output. This bug exists since
	 1998 in all GnuPG and Libgcrypt versions.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html</url>
 <cvename>CVE-2016-6313</cvename>
 </references>
 <dates>
 <discovery>2016-08-17</discovery>
 <entry>2016-08-18</entry>
 <modified>2016-11-30</modified>
 </dates>
 </vuln>

<vuln vid="ef70b201-645d-11e6-9cdc-6805ca0b3d42">
 <topic>phpmyadmin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><ge>4.6.0</ge><lt>4.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpmyadmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-29/">
	 Weakness with cookie encryption
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-30/">
	 Multiple XSS vulnerabilities
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-31/">
	 Multiple XSS vulnerabilities
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-32/">
	 PHP code injection
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-33/">
	 Full path disclosure
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-34/">
	 SQL injection attack
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-35/">
	 Local file exposure
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-36/">
	 Local file exposure through symlinks with
	 UploadDir
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-37/">
	 Path traversal with SaveDir and UploadDir
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-38/">
	 Multiple XSS vulnerabilities
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-39/">
	 SQL injection attack
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-40/">
	 SQL injection attack
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-41/">
	 Denial of service (DOS) attack in transformation
	 feature
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-42/">
	 SQL injection attack as control user
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-43/">
	 Unvalidated data passed to unserialize()
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-45/">
	 DOS attack with forced persistent connections
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-46/">
	 Denial of service (DOS) attack by for loops
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-47/">
	 IPv6 and proxy server IP-based authentication rule
	 circumvention
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-48/">
	 Detect if user is logged in
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-49/">
	 Bypass URL redirect protection
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-50/">
	 Referrer leak in url.php
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-51/">
	 Reflected File Download attack
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-52/">
	 ArbitraryServerRegexp bypass
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-53/">
	 Denial of service (DOS) attack by changing password to a
	 very long string
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-54/">
	 Remote code execution vulnerability when run as CGI
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-55/">
	 <h3>Summary</h3>
	 Denial of service (DOS) attack with dbase extension
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-56/">
	 Remote code execution vulnerability when PHP is running
	 with dbase extension
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-29/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-30/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-31/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-32/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-33/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-34/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-35/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-36/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-37/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-38/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-39/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-40/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-41/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-42/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-43/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-45/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-46/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-47/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-48/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-49/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-50/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-51/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-52/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-53/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-54/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-55/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-56/</url>
 <cvename>CVE-2016-6606</cvename>
 <cvename>CVE-2016-6607</cvename>
 <cvename>CVE-2016-6608</cvename>
 <cvename>CVE-2016-6609</cvename>
 <cvename>CVE-2016-6610</cvename>
 <cvename>CVE-2016-6611</cvename>
 <cvename>CVE-2016-6612</cvename>
 <cvename>CVE-2016-6613</cvename>
 <cvename>CVE-2016-6614</cvename>
 <cvename>CVE-2016-6615</cvename>
 <cvename>CVE-2016-6616</cvename>
 <cvename>CVE-2016-6617</cvename>
 <cvename>CVE-2016-6618</cvename>
 <cvename>CVE-2016-6619</cvename>
 <cvename>CVE-2016-6620</cvename>
 <cvename>CVE-2016-6622</cvename>
 <cvename>CVE-2016-6623</cvename>
 <cvename>CVE-2016-6624</cvename>
 <cvename>CVE-2016-6625</cvename>
 <cvename>CVE-2016-6626</cvename>
 <cvename>CVE-2016-6627</cvename>
 <cvename>CVE-2016-6628</cvename>
 <cvename>CVE-2016-6629</cvename>
 <cvename>CVE-2016-6630</cvename>
 <cvename>CVE-2016-6631</cvename>
 <cvename>CVE-2016-6632</cvename>
 <cvename>CVE-2016-6633</cvename>
 </references>
 <dates>
 <discovery>2016-08-17</discovery>
 <entry>2016-08-17</entry>
 </dates>
 </vuln>

<vuln vid="f7dd2d09-625e-11e6-828b-fcaa14edc6a6">
 <topic>TeamSpeak Server 3 -- Multiple vulnerabilities including Remote Code Execution</topic>
 <affects>
 <package>
	<name>teamspeak3-server</name>
	<range><le>3.0.13_1,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hanz Jenson audit report:
	<blockquote cite="http://seclists.org/fulldisclosure/2016/Aug/61">
		I found 10 vulnerabilities. Some of these are critical and allow remote code
		execution. For the average user, that means that these vulnerabilities can be
		exploited by a malicious attacker in order to take over any Teamspeak server,
		not only becoming serveradmin, but getting a shell on the affected machine.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/fulldisclosure/2016/Aug/61</url>
 </references>
 <dates>
 <discovery>2016-08-12</discovery>
 <entry>2016-08-14</entry>
 </dates>
 </vuln>

<vuln vid="df502a2f-61f6-11e6-a461-643150d3111d">
 <topic>puppet-agent MCollective plugin -- Remote Code Execution vulnerability</topic>
 <affects>
 <package>
	<name>mcollective-puppet-agent</name>
	<range><lt>1.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Puppet reports:
	<blockquote cite="https://puppet.com/security/cve/cve-2015-7331">
	 Puppet Enterprise previously included a puppet-agent MCollective plugin that allowed you to pass the `--server` argument to MCollective. This insecure argument enabled remote code execution via connection to an untrusted host. The puppet-agent MCollective version included in PE 2016.2.1, this option is disabled by default.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://puppet.com/security/cve/cve-2015-7331</url>
 <cvename>CVE-2015-7331</cvename>
 </references>
 <dates>
 <discovery>2016-08-09</discovery>
 <entry>2016-08-15</entry>
 </dates>
 </vuln>

<vuln vid="7d4f4955-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Heap vulnerability in bspatch</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.3</ge><lt>10.3_6</lt></range>
	<range><ge>10.2</ge><lt>10.2_20</lt></range>
	<range><ge>10.1</ge><lt>10.1_37</lt></range>
	<range><ge>9.3</ge><lt>9.3_45</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The implementation of bspatch does not check for a
	negative value on numbers of bytes read from the diff and
	extra streams, allowing an attacker who can control the
	patch file to write at arbitrary locations in the heap.
	This issue was first discovered by The Chromium Project
	and reported independently by Lu Tung-Pin to the FreeBSD
	project.
	<h1>Impact:</h1>
	An attacker who can control the patch file can cause a
	crash or run arbitrary code under the credentials of the
	user who runs bspatch, in many cases, root.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-9862</cvename>
 <freebsdsa>SA-16:25.bspatch</freebsdsa>
 </references>
 <dates>
 <discovery>2016-07-25</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="7cfcea05-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Multiple ntp vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.3</ge><lt>10.3_5</lt></range>
	<range><ge>10.2</ge><lt>10.2_19</lt></range>
	<range><ge>10.1</ge><lt>10.1_36</lt></range>
	<range><ge>9.3</ge><lt>9.3_44</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Multiple vulnerabilities have been discovered in the NTP
	suite:
	The fix for Sec 3007 in ntp-4.2.8p7 contained a bug that
	could cause ntpd to crash. [CVE-2016-4957, Reported by
	Nicolas Edet of Cisco]
	An attacker who knows the origin timestamp and can send
	a spoofed packet containing a CRYPTO-NAK to an ephemeral
	peer target before any other response is sent can demobilize
	that association. [CVE-2016-4953, Reported by Miroslav
	Lichvar of Red Hat]
	An attacker who is able to spoof packets with correct
	origin timestamps from enough servers before the expected
	response packets arrive at the target machine can affect
	some peer variables and, for example, cause a false leap
	indication to be set. [CVE-2016-4954, Reported by Jakub
	Prokes of Red Hat]
	An attacker who is able to spoof a packet with a correct
	origin timestamp before the expected response packet arrives
	at the target machine can send a CRYPTO_NAK or a bad MAC
	and cause the association's peer variables to be cleared.
	If this can be done often enough, it will prevent that
	association from working. [CVE-2016-4955, Reported by
	Miroslav Lichvar of Red Hat]
	The fix for NtpBug2978 does not cover broadcast associations,
	so broadcast clients can be triggered to flip into interleave
	mode. [CVE-2016-4956, Reported by Miroslav Lichvar of Red
	Hat.]
	<h1>Impact:</h1>
	Malicious remote attackers may be able to break time
	synchronization, or cause the ntpd(8) daemon to crash.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4953</cvename>
 <cvename>CVE-2016-4954</cvename>
 <cvename>CVE-2016-4955</cvename>
 <cvename>CVE-2016-4956</cvename>
 <cvename>CVE-2016-4957</cvename>
 <freebsdsa>SA-16:24.ntp</freebsdsa>
 </references>
 <dates>
 <discovery>2016-06-04</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="7cad4795-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Kernel stack disclosure in 4.3BSD compatibility layer</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.3</ge><lt>10.3_4</lt></range>
	<range><ge>10.2</ge><lt>10.2_18</lt></range>
	<range><ge>10.1</ge><lt>10.1_35</lt></range>
	<range><ge>9.3</ge><lt>9.3_43</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The implementation of historic stat(2) system call does
	not clear the output struct before copying it out to
	userland.
	<h1>Impact:</h1>
	An unprivileged user can read a portion of uninitialised
	kernel stack data, which may contain sensitive information,
	such as the stack guard, portions of the file cache or
	terminal buffers, which an attacker might leverage to obtain
	elevated privileges.
 </body>
 </description>
 <references>
 <freebsdsa>SA-16:21.43bsd</freebsdsa>
 </references>
 <dates>
 <discovery>2016-05-31</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="7c5d64dd-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Kernel stack disclosure in Linux compatibility layer</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.3</ge><lt>10.3_4</lt></range>
	<range><ge>10.2</ge><lt>10.2_18</lt></range>
	<range><ge>10.1</ge><lt>10.1_35</lt></range>
	<range><ge>9.3</ge><lt>9.3_43</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The implementation of the TIOCGSERIAL ioctl(2) does not
	clear the output struct before copying it out to userland.
	The implementation of the Linux sysinfo() system call
	does not clear the output struct before copying it out to
	userland.
	<h1>Impact:</h1>
	An unprivileged user can read a portion of uninitialised
	kernel stack data, which may contain sensitive information,
	such as the stack guard, portions of the file cache or
	terminal buffers, which an attacker might leverage to obtain
	elevated privileges.
 </body>
 </description>
 <references>
 <freebsdsa>SA-16:20.linux</freebsdsa>
 </references>
 <dates>
 <discovery>2016-05-31</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="7c0bac69-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Incorrect argument handling in sendmsg(2)</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.3</ge><lt>10.3_3</lt></range>
	<range><ge>10.2</ge><lt>10.2_17</lt></range>
	<range><ge>10.1</ge><lt>10.1_34</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Incorrect argument handling in the socket code allows
	malicious local user to overwrite large portion of the
	kernel memory.
	<h1>Impact:</h1>
	Malicious local user may crash kernel or execute arbitrary
	code in the kernel, potentially gaining superuser privileges.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1887</cvename>
 <freebsdsa>SA-16:19.sendmsg</freebsdsa>
 </references>
 <dates>
 <discovery>2016-05-17</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="7bbc0e8c-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Buffer overflow in keyboard driver</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.3</ge><lt>10.3_3</lt></range>
	<range><ge>10.2</ge><lt>10.2_17</lt></range>
	<range><ge>10.1</ge><lt>10.1_34</lt></range>
	<range><ge>9.3</ge><lt>9.3_42</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Incorrect signedness comparison in the ioctl(2) handler
	allows a malicious local user to overwrite a portion of the
	kernel memory.
	<h1>Impact:</h1>
	A local user may crash the kernel, read a portion of
	kernel memory and execute arbitrary code in kernel context.
	The result of executing an arbitrary kernel code is privilege
	escalation.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1886</cvename>
 <freebsdsa>SA-16:18.atkbd</freebsdsa>
 </references>
 <dates>
 <discovery>2016-05-17</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="7b6a11b5-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Incorrect argument validation in sysarch(2)</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>11.0</ge><lt>11.0_2</lt></range>
	<range><ge>10.3</ge><lt>10.3_11</lt></range>
	<range><ge>10.2</ge><lt>10.2_24</lt></range>
	<range><ge>10.1</ge><lt>10.1_41</lt></range>
	<range><ge>9.3</ge><lt>9.3_49</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A special combination of sysarch(2) arguments, specify
	a request to uninstall a set of descriptors from the LDT.
	The start descriptor is cleared and the number of descriptors
	are provided. Due to lack of sufficient bounds checking
	during argument validity verification, unbound zero'ing of
	the process LDT and adjacent memory can be initiated from
	usermode.
	<h1>Impact:</h1>
	This vulnerability could cause the kernel to panic. In
	addition it is possible to perform a local Denial of Service
	against the system by unprivileged processes.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1885</cvename>
 <freebsdsa>SA-16:15.sysarch</freebsdsa>
 </references>
 <dates>
 <discovery>2016-03-16</discovery>
 <entry>2016-08-11</entry>
 <modified>2016-10-25</modified>
 </dates>
 </vuln>

<vuln vid="7b1a4a27-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Multiple OpenSSL vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_13</lt></range>
	<range><ge>10.1</ge><lt>10.1_30</lt></range>
	<range><ge>9.3</ge><lt>9.3_38</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A cross-protocol attack was discovered that could lead
	to decryption of TLS sessions by using a server supporting
	SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA
	padding oracle. Note that traffic between clients and
	non-vulnerable servers can be decrypted provided another
	server supporting SSLv2 and EXPORT ciphers (even with a
	different protocol such as SMTP, IMAP or POP3) shares the
	RSA keys of the non-vulnerable server. This vulnerability
	is known as DROWN. [CVE-2016-0800]
	A double free bug was discovered when OpenSSL parses
	malformed DSA private keys and could lead to a DoS attack
	or memory corruption for applications that receive DSA
	private keys from untrusted sources. This scenario is
	considered rare. [CVE-2016-0705]
	The SRP user database lookup method SRP_VBASE_get_by_user
	had confusing memory management semantics; the returned
	pointer was sometimes newly allocated, and sometimes owned
	by the callee. The calling code has no way of distinguishing
	these two cases. [CVE-2016-0798]
	In the BN_hex2bn function, the number of hex digits is
	calculated using an int value |i|. Later |bn_expand| is
	called with a value of |i * 4|. For large values of |i|
	this can result in |bn_expand| not allocating any memory
	because |i * 4| is negative. This can leave the internal
	BIGNUM data field as NULL leading to a subsequent NULL
	pointer dereference. For very large values of |i|, the
	calculation |i * 4| could be a positive value smaller than
	|i|. In this case memory is allocated to the internal BIGNUM
	data field, but it is insufficiently sized leading to heap
	corruption. A similar issue exists in BN_dec2bn. This could
	have security consequences if BN_hex2bn/BN_dec2bn is ever
	called by user applications with very large untrusted hex/dec
	data. This is anticipated to be a rare occurrence.
	[CVE-2016-0797]
	The internal |fmtstr| function used in processing a "%s"
	formatted string in the BIO_*printf functions could overflow
	while calculating the length of a string and cause an
	out-of-bounds read when printing very long strings.
	[CVE-2016-0799]
	A side-channel attack was found which makes use of
	cache-bank conflicts on the Intel Sandy-Bridge microarchitecture
	which could lead to the recovery of RSA keys. [CVE-2016-0702]
	s2_srvr.c did not enforce that clear-key-length is 0 for
	non-export ciphers. If clear-key bytes are present for these
	ciphers, they displace encrypted-key bytes. [CVE-2016-0703]
	s2_srvr.c overwrites the wrong bytes in the master key
	when applying Bleichenbacher protection for export cipher
	suites. [CVE-2016-0704]
	<h1>Impact:</h1>
	Servers that have SSLv2 protocol enabled are vulnerable
	to the "DROWN" attack which allows a remote attacker to
	fast attack many recorded TLS connections made to the server,
	even when the client did not make any SSLv2 connections
	themselves.
	An attacker who can supply malformed DSA private keys
	to OpenSSL applications may be able to cause memory corruption
	which would lead to a Denial of Service condition.
	[CVE-2016-0705]
	An attacker connecting with an invalid username can cause
	memory leak, which could eventually lead to a Denial of
	Service condition. [CVE-2016-0798]
	An attacker who can inject malformed data into an
	application may be able to cause memory corruption which
	would lead to a Denial of Service condition. [CVE-2016-0797,
	CVE-2016-0799]
	A local attacker who has control of code in a thread
	running on the same hyper-threaded core as the victim thread
	which is performing decryptions could recover RSA keys.
	[CVE-2016-0702]
	An eavesdropper who can intercept SSLv2 handshake can
	conduct an efficient divide-and-conquer key recovery attack
	and use the server as an oracle to determine the SSLv2
	master-key, using only 16 connections to the server and
	negligible computation. [CVE-2016-0703]
	An attacker can use the Bleichenbacher oracle, which
	enables more efficient variant of the DROWN attack.
	[CVE-2016-0704]
 </body>
 </description>
 <references>
 <cvename>CVE-2016-0702</cvename>
 <cvename>CVE-2016-0703</cvename>
 <cvename>CVE-2016-0704</cvename>
 <cvename>CVE-2016-0705</cvename>
 <cvename>CVE-2016-0797</cvename>
 <cvename>CVE-2016-0798</cvename>
 <cvename>CVE-2016-0799</cvename>
 <cvename>CVE-2016-0800</cvename>
 <freebsdsa>SA-16:12.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2016-03-10</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="7ac28df1-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Linux compatibility layer issetugid(2) system call</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.2</ge><lt>10.2_11</lt></range>
	<range><ge>10.1</ge><lt>10.1_28</lt></range>
	<range><ge>9.3</ge><lt>9.3_35</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A programming error in the Linux compatibility layer
	could cause the issetugid(2) system call to return incorrect
	information.
	<h1>Impact:</h1>
	If an application relies on output of the issetugid(2)
	system call and that information is incorrect, this could
	lead to a privilege escalation.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1883</cvename>
 <freebsdsa>SA-16:10.linux</freebsdsa>
 </references>
 <dates>
 <discovery>2016-01-27</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="7a31dfba-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Insecure default snmpd.config permissions</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_9</lt></range>
	<range><ge>10.1</ge><lt>10.1_26</lt></range>
	<range><ge>9.3</ge><lt>9.3_33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The SNMP protocol supports an authentication model called
	USM, which relies on a shared secret. The default permission
	of the snmpd configuration file, /etc/snmpd.config, is
	weak and does not provide adequate protection against local
	unprivileged users.
	<h1>Impact:</h1>
	A local user may be able to read the shared secret, if
	configured and used by the system administrator.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5677</cvename>
 <freebsdsa>SA-16:06.bsnmpd</freebsdsa>
 </references>
 <dates>
 <discovery>2016-01-14</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="79dfc135-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- TCP MD5 signature denial of service</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.2</ge><lt>10.2_9</lt></range>
	<range><ge>10.1</ge><lt>10.1_26</lt></range>
	<range><ge>9.3</ge><lt>9.3_33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A programming error in processing a TCP connection with
	both TCP_MD5SIG and TCP_NOOPT socket options may lead to
	kernel crash.
	<h1>Impact:</h1>
	A local attacker can crash the kernel, resulting in a
	denial-of-service.
	A remote attack is theoretically possible, if server has
	a listening socket with TCP_NOOPT set, and server is either
	out of SYN cache entries, or SYN cache is disabled by
	configuration.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1882</cvename>
 <freebsdsa>SA-16:05.tcp</freebsdsa>
 </references>
 <dates>
 <discovery>2016-01-14</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="798f63e0-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Linux compatibility layer setgroups(2) system call</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.2</ge><lt>10.2_9</lt></range>
	<range><ge>10.1</ge><lt>10.1_26</lt></range>
	<range><ge>9.3</ge><lt>9.3_33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A programming error in the Linux compatibility layer
	setgroups(2) system call can lead to an unexpected results,
	such as overwriting random kernel memory contents.
	<h1>Impact:</h1>
	It is possible for a local attacker to overwrite portions
	of kernel memory, which may result in a privilege escalation
	or cause a system panic.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1881</cvename>
 <freebsdsa>SA-16:04.linux</freebsdsa>
 </references>
 <dates>
 <discovery>2016-01-14</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="793fb19c-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Linux compatibility layer incorrect futex handling</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.2</ge><lt>10.2_9</lt></range>
	<range><ge>10.1</ge><lt>10.1_26</lt></range>
	<range><ge>9.3</ge><lt>9.3_33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A programming error in the handling of Linux futex robust
	lists may result in incorrect memory locations being
	accessed.
	<h1>Impact:</h1>
	It is possible for a local attacker to read portions of
	kernel memory, which may result in a privilege escalation.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1880</cvename>
 <freebsdsa>SA-16:03.linux</freebsdsa>
 </references>
 <dates>
 <discovery>2016-01-14</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="78f06a6c-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- SCTP ICMPv6 error message vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.2</ge><lt>10.2_9</lt></range>
	<range><ge>10.1</ge><lt>10.1_26</lt></range>
	<range><ge>9.3</ge><lt>9.3_33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A lack of proper input checks in the ICMPv6 processing
	in the SCTP stack can lead to either a failed kernel assertion
	or to a NULL pointer dereference. In either case, a kernel
	panic will follow.
	<h1>Impact:</h1>
	A remote, unauthenticated attacker can reliably trigger
	a kernel panic in a vulnerable system running IPv6. Any
	kernel compiled with both IPv6 and SCTP support is vulnerable.
	There is no requirement to have an SCTP socket open.
	IPv4 ICMP processing is not impacted by this vulnerability.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1879</cvename>
 <freebsdsa>SA-16:01.sctp</freebsdsa>
 </references>
 <dates>
 <discovery>2016-01-14</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="0e5d6969-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- rpcbind(8) remote denial of service [REVISED]</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_5</lt></range>
	<range><ge>10.1</ge><lt>10.1_22</lt></range>
	<range><ge>9.3</ge><lt>9.3_28</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	In rpcbind(8), netbuf structures are copied directly,
	which would result in two netbuf structures that reference
	to one shared address buffer. When one of the two netbuf
	structures is freed, access to the other netbuf structure
	would result in an undefined result that may crash the
	rpcbind(8) daemon.
	<h1>Impact:</h1>
	A remote attacker who can send specifically crafted
	packets to the rpcbind(8) daemon can cause it to crash,
	resulting in a denial of service condition.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7236</cvename>
 <freebsdsa>SA-15:24.rpcbind</freebsdsa>
 </references>
 <dates>
 <discovery>2015-09-29</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="0dfa5dde-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Local privilege escalation in IRET handler</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.1</ge><lt>10.1_19</lt></range>
	<range><ge>9.3</ge><lt>9.3_24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	If the kernel-mode IRET instruction generates an #SS or
	#NP exception, but the exception handler does not properly
	ensure that the right GS register base for kernel is reloaded,
	the userland GS segment may be used in the context of the
	kernel exception handler.
	<h1>Impact:</h1>
	By causing an IRET with #SS or #NP exceptions, a local
	attacker can cause the kernel to use an arbitrary GS base,
	which may allow escalated privileges or panic the system.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5675</cvename>
 <freebsdsa>SA-15:21.amd64</freebsdsa>
 </references>
 <dates>
 <discovery>2015-08-25</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="0da8a68e-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Multiple integer overflows in expat (libbsdxml) XML parser</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_18</lt></range>
	<range><ge>10.2</ge><lt>10.2_1</lt></range>
	<range><ge>9.3</ge><lt>9.3_23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Multiple integer overflows have been discovered in the
	XML_GetBuffer() function in the expat library.
	<h1>Impact:</h1>
	The integer overflows may be exploited by using specifically
	crafted XML data and lead to infinite loop, or a heap buffer
	overflow, which results in a Denial of Service condition,
	or enables remote attackers to execute arbitrary code.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1283</cvename>
 <freebsdsa>SA-15:20.expat</freebsdsa>
 </references>
 <dates>
 <discovery>2015-08-18</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="0d584493-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- routed(8) remote denial of service vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_17</lt></range>
	<range><ge>9.3</ge><lt>9.3_22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The input path in routed(8) will accept queries from any
	source and attempt to answer them. However, the output path
	assumes that the destination address for the response is
	on a directly connected network.
	<h1>Impact:</h1>
	Upon receipt of a query from a source which is not on a
	directly connected network, routed(8) will trigger an
	assertion and terminate. The affected system's routing table
	will no longer be updated. If the affected system is a
	router, its routes will eventually expire from other routers'
	routing tables, and its networks will no longer be reachable
	unless they are also connected to another router.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5674</cvename>
 <freebsdsa>SA-15:19.routed</freebsdsa>
 </references>
 <dates>
 <discovery>2015-08-05</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="0d090952-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- shell injection vulnerability in patch(1)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to insufficient sanitization of the input patch
	stream, it is possible for a patch file to cause patch(1)
	to pass certain ed(1) scripts to the ed(1) editor, which
	would run commands.
	<h1>Impact:</h1>
	This issue could be exploited to execute arbitrary
	commands as the user invoking patch(1) against a specially
	crafted patch file, which could be leveraged to obtain
	elevated privileges.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1418</cvename>
 <freebsdsa>SA-15:18.bsdpatch</freebsdsa>
 </references>
 <dates>
 <discovery>2015-08-05</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="0cb9d5bb-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Resource exhaustion in TCP reassembly</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.1</ge><lt>10.1_16</lt></range>
	<range><ge>9.3</ge><lt>9.3_21</lt></range>
	<range><ge>8.4</ge><lt>8.4_35</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	There is a mistake with the introduction of VNET, which
	converted the global limit on the number of segments that
	could belong to reassembly queues into a per-VNET limit.
	Because mbufs are allocated from a global pool, in the
	presence of a sufficient number of VNETs, the total number
	of mbufs attached to reassembly queues can grow to the total
	number of mbufs in the system, at which point all network
	traffic would cease.
	<h1>Impact:</h1>
	An attacker who can establish concurrent TCP connections
	across a sufficient number of VNETs and manipulate the
	inbound packet streams such that the maximum number of mbufs
	are enqueued on each reassembly queue can cause mbuf cluster
	exhaustion on the target system, resulting in a Denial of
	Service condition.
	As the default per-VNET limit on the number of segments
	that can belong to reassembly queues is 1/16 of the total
	number of mbuf clusters in the system, only systems that
	have 16 or more VNET instances are vulnerable.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1417</cvename>
 <freebsdsa>SA-15:15.tcp</freebsdsa>
 </references>
 <dates>
 <discovery>2015-07-28</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="0c6759dd-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- shell injection vulnerability in patch(1)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to insufficient sanitization of the input patch
	stream, it is possible for a patch file to cause patch(1)
	to run commands in addition to the desired SCCS or RCS
	commands.
	<h1>Impact:</h1>
	This issue could be exploited to execute arbitrary
	commands as the user invoking patch(1) against a specially
	crafted patch file, which could be leveraged to obtain
	elevated privileges.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1416</cvename>
 <freebsdsa>SA-15:14.bsdpatch</freebsdsa>
 </references>
 <dates>
 <discovery>2015-07-28</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="0c064c43-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Resource exhaustion due to sessions stuck in LAST_ACK state</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.1</ge><lt>10.1_15</lt></range>
	<range><ge>9.3</ge><lt>9.3_20</lt></range>
	<range><ge>8.4</ge><lt>8.4_34</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	TCP connections transitioning to the LAST_ACK state can
	become permanently stuck due to mishandling of protocol
	state in certain situations, which in turn can lead to
	accumulated consumption and eventual exhaustion of system
	resources, such as mbufs and sockets.
	<h1>Impact:</h1>
	An attacker who can repeatedly establish TCP connections
	to a victim system (for instance, a Web server) could create
	many TCP connections that are stuck in LAST_ACK state and
	cause resource exhaustion, resulting in a denial of service
	condition. This may also happen in normal operation where
	no intentional attack is conducted, but an attacker who can
	send specifically crafted packets can trigger this more
	reliably.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5358</cvename>
 <freebsdsa>SA-15:13.tcp</freebsdsa>
 </references>
 <dates>
 <discovery>2015-07-21</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="0bb55a18-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Denial of Service with IPv6 Router Advertisements</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.1</ge><lt>10.1_9</lt></range>
	<range><ge>9.3</ge><lt>9.3_13</lt></range>
	<range><ge>8.4</ge><lt>8.4_27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The Neighbor Discover Protocol allows a local router to
	advertise a suggested Current Hop Limit value of a link,
	which will replace Current Hop Limit on an interface connected
	to the link on the FreeBSD system.
	<h1>Impact:</h1>
	When the Current Hop Limit (similar to IPv4's TTL) is
	small, IPv6 packets may get dropped before they reached
	their destinations.
	By sending specifically crafted Router Advertisement
	packets, an attacker on the local network can cause the
	FreeBSD system to lose the ability to communicate with
	another IPv6 node on a different network.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2923</cvename>
 <freebsdsa>SA-15:09.ipv6</freebsdsa>
 </references>
 <dates>
 <discovery>2015-04-07</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="0b65f297-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Insecure default GELI keyfile permissions</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The default permission set by bsdinstall(8) installer
	when configuring full disk encrypted ZFS is too open.
	<h1>Impact:</h1>
	A local attacker may be able to get a copy of the geli(8)
	provider's keyfile which is located at a fixed location.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1415</cvename>
 <freebsdsa>SA-15:08.bsdinstall</freebsdsa>
 </references>
 <dates>
 <discovery>2015-04-07</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="0afe8b29-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Integer overflow in IGMP protocol</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.1</ge><lt>10.1_9</lt></range>
	<range><ge>9.3</ge><lt>9.3_13</lt></range>
	<range><ge>8.4</ge><lt>8.4_27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	An integer overflow in computing the size of IGMPv3 data
	buffer can result in a buffer which is too small for the
	requested operation.
	<h1>Impact:</h1>
	An attacker who can send specifically crafted IGMP packets
	could cause a denial of service situation by causing the
	kernel to crash.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1414</cvename>
 <freebsdsa>SA-15:04.igmp</freebsdsa>
 </references>
 <dates>
 <discovery>2015-02-25</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="0aad3ce5-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- SCTP stream reset vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.1</ge><lt>10.1_5</lt></range>
	<range><ge>10.0</ge><lt>10.0_17</lt></range>
	<range><ge>9.3</ge><lt>9.3_9</lt></range>
	<range><ge>8.4</ge><lt>8.4_23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The input validation of received SCTP RE_CONFIG chunks
	is insufficient, and can result in a NULL pointer deference
	later.
	<h1>Impact:</h1>
	A remote attacker who can send a malformed SCTP packet
	to a FreeBSD system that serves SCTP can cause a kernel
	panic, resulting in a Denial of Service.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8613</cvename>
 <freebsdsa>SA-15:03.sctp</freebsdsa>
 </references>
 <dates>
 <discovery>2015-01-27</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="0a5cf6d8-600a-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- SCTP SCTP_SS_VALUE kernel memory corruption and disclosure</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.1</ge><lt>10.1_5</lt></range>
	<range><ge>10.0</ge><lt>10.0_17</lt></range>
	<range><ge>9.3</ge><lt>9.3_9</lt></range>
	<range><ge>8.4</ge><lt>8.4_23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to insufficient validation of the SCTP stream ID,
	which serves as an array index, a local unprivileged attacker
	can read or write 16-bits of kernel memory.
	<h1>Impact:</h1>
	An unprivileged process can read or modify 16-bits of
	memory which belongs to the kernel. This may lead to
	exposure of sensitive information or allow privilege
	escalation.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8612</cvename>
 <freebsdsa>SA-15:02.kmem</freebsdsa>
 </references>
 <dates>
 <discovery>2015-01-27</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="74ded00e-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Buffer overflow in stdio</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A programming error in the standard I/O library's
	__sflush() function could erroneously adjust the buffered
	stream's internal state even when no write actually occurred
	in the case when write(2) system call returns an error.
	<h1>Impact:</h1>
	The accounting mismatch would accumulate, if the caller
	does not check for stream status and will eventually lead
	to a heap buffer overflow.
	Such overflows may lead to data corruption or the execution
	of arbitrary code at the privilege level of the calling
	program.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8611</cvename>
 <freebsdsa>SA-14:27.stdio</freebsdsa>
 </references>
 <dates>
 <discovery>2014-12-10</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="7488378d-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Remote command execution in ftp(1)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_12</lt></range>
	<range><ge>9.3</ge><lt>9.3_5</lt></range>
	<range><ge>9.2</ge><lt>9.2_15</lt></range>
	<range><ge>9.1</ge><lt>9.1_22</lt></range>
	<range><ge>8.4</ge><lt>8.4_19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A malicious HTTP server could cause ftp(1) to execute
	arbitrary commands.
	<h1>Impact:</h1>
	When operating on HTTP URIs, the ftp(1) client follows
	HTTP redirects, and uses the part of the path after the
	last '/' from the last resource it accesses as the output
	filename if '-o' is not specified.
	If the output file name provided by the server begins
	with a pipe ('|'), the output is passed to popen(3), which
	might be used to execute arbitrary commands on the ftp(1)
	client machine.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8517</cvename>
 <freebsdsa>SA-14:26.ftp</freebsdsa>
 </references>
 <dates>
 <discovery>2014-11-04</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="74389f22-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Kernel stack disclosure in setlogin(2) / getlogin(2)</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.0</ge><lt>10.0_12</lt></range>
	<range><ge>9.3</ge><lt>9.3_5</lt></range>
	<range><ge>9.2</ge><lt>9.2_15</lt></range>
	<range><ge>9.1</ge><lt>9.1_22</lt></range>
	<range><ge>8.4</ge><lt>8.4_19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When setlogin(2) is called while setting up a new login
	session, the login name is copied into an uninitialized
	stack buffer, which is then copied into a buffer of the
	same size in the session structure. The getlogin(2) system
	call returns the entire buffer rather than just the portion
	occupied by the login name associated with the session.
	<h1>Impact:</h1>
	An unprivileged user can access this memory by calling
	getlogin(2) and reading beyond the terminating NUL character
	of the resulting string. Up to 16 (FreeBSD 8) or 32 (FreeBSD
	9 and 10) bytes of kernel memory may be leaked in this
	manner for each invocation of setlogin(2).
	This memory may contain sensitive information, such as
	portions of the file cache or terminal buffers, which an
	attacker might leverage to obtain elevated privileges.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8476</cvename>
 <freebsdsa>SA-14:25.setlogin</freebsdsa>
 </references>
 <dates>
 <discovery>2014-11-04</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="73e9a137-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Denial of service attack against sshd(8)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_12</lt></range>
	<range><ge>9.2</ge><lt>9.2_15</lt></range>
	<range><ge>9.1</ge><lt>9.1_22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Although OpenSSH is not multithreaded, when OpenSSH is
	compiled with Kerberos support, the Heimdal libraries bring
	in the POSIX thread library as a dependency. Due to incorrect
	library ordering while linking sshd(8), symbols in the C
	library which are shadowed by the POSIX thread library may
	not be resolved correctly at run time.
	Note that this problem is specific to the FreeBSD build
	system and does not affect other operating systems or the
	version of OpenSSH available from the FreeBSD ports tree.
	<h1>Impact:</h1>
	An incorrectly linked sshd(8) child process may deadlock
	while handling an incoming connection. The connection may
	then time out or be interrupted by the client, leaving the
	deadlocked sshd(8) child process behind. Eventually, the
	sshd(8) parent process stops accepting new connections.
	An attacker may take advantage of this by repeatedly
	connecting and then dropping the connection after having
	begun, but not completed, the authentication process.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8475</cvename>
 <freebsdsa>SA-14:24.sshd</freebsdsa>
 </references>
 <dates>
 <discovery>2014-11-04</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="73964eac-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- memory leak in sandboxed namei lookup</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.0</ge><lt>10.0_10</lt></range>
	<range><ge>9.3</ge><lt>9.3_3</lt></range>
	<range><ge>9.2</ge><lt>9.2_13</lt></range>
	<range><ge>9.1</ge><lt>9.1_20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The namei facility will leak a small amount of kernel
	memory every time a sandboxed process looks up a nonexistent
	path name.
	<h1>Impact:</h1>
	A remote attacker that can cause a sandboxed process
	(for instance, a web server) to look up a large number of
	nonexistent path names can cause memory exhaustion.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3711</cvename>
 <freebsdsa>SA-14:22.namei</freebsdsa>
 </references>
 <dates>
 <discovery>2014-10-21</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="734233f4-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- routed(8) remote denial of service vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_10</lt></range>
	<range><ge>9.3</ge><lt>9.3_3</lt></range>
	<range><ge>9.2</ge><lt>9.2_13</lt></range>
	<range><ge>9.1</ge><lt>9.1_20</lt></range>
	<range><ge>8.4</ge><lt>8.4_17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The input path in routed(8) will accept queries from any
	source and attempt to answer them. However, the output path
	assumes that the destination address for the response is
	on a directly connected network.
	<h1>Impact:</h1>
	Upon receipt of a query from a source which is not on a
	directly connected network, routed(8) will trigger an
	assertion and terminate. The affected system's routing table
	will no longer be updated. If the affected system is a
	router, its routes will eventually expire from other routers'
	routing tables, and its networks will no longer be reachable
	unless they are also connected to another router.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3955</cvename>
 <freebsdsa>SA-14:21.routed</freebsdsa>
 </references>
 <dates>
 <discovery>2014-10-21</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="72ee7111-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- rtsold(8) remote buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_10</lt></range>
	<range><ge>9.3</ge><lt>9.3_3</lt></range>
	<range><ge>9.2</ge><lt>9.2_13</lt></range>
	<range><ge>9.1</ge><lt>9.1_20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to a missing length check in the code that handles
	DNS parameters, a malformed router advertisement message
	can result in a stack buffer overflow in rtsold(8).
	<h1>Impact:</h1>
	Receipt of a router advertisement message with a malformed
	DNSSL option, for instance from a compromised host on the
	same network, can cause rtsold(8) to crash.
	While it is theoretically possible to inject code into
	rtsold(8) through malformed router advertisement messages,
	it is normally compiled with stack protection enabled,
	rendering such an attack extremely difficult.
	When rtsold(8) crashes, the existing DNS configuration
	will remain in force, and the kernel will continue to receive
	and process periodic router advertisements.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3954</cvename>
 <freebsdsa>SA-14:20.rtsold</freebsdsa>
 </references>
 <dates>
 <discovery>2014-10-21</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="729c4a9f-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Denial of Service in TCP packet processing</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.0</ge><lt>10.0_9</lt></range>
	<range><ge>9.3</ge><lt>9.3_2</lt></range>
	<range><ge>9.2</ge><lt>9.2_12</lt></range>
	<range><ge>9.1</ge><lt>9.1_19</lt></range>
	<range><ge>8.4</ge><lt>8.4_16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When a segment with the SYN flag for an already existing
	connection arrives, the TCP stack tears down the connection,
	bypassing a check that the sequence number in the segment
	is in the expected window.
	<h1>Impact:</h1>
	An attacker who has the ability to spoof IP traffic can
	tear down a TCP connection by sending only 2 packets, if
	they know both TCP port numbers. In case one of the two
	port numbers is unknown, a successful attack requires less
	than 2**17 packets spoofed, which can be generated within
	less than a second on a decent connection to the Internet.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0230</cvename>
 <freebsdsa>SA-14:19.tcp</freebsdsa>
 </references>
 <dates>
 <discovery>2014-09-16</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="7240de58-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Kernel memory disclosure in control messages and SCTP</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.0</ge><lt>10.0_7</lt></range>
	<range><ge>9.2</ge><lt>9.2_10</lt></range>
	<range><ge>9.1</ge><lt>9.1_17</lt></range>
	<range><ge>8.4</ge><lt>8.4_14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Buffer between control message header and data may not
	be completely initialized before being copied to userland.
	[CVE-2014-3952]
	Three SCTP cmsgs, SCTP_SNDRCV, SCTP_EXTRCV and SCTP_RCVINFO,
	have implicit padding that may not be completely initialized
	before being copied to userland. In addition, three SCTP
	notifications, SCTP_PEER_ADDR_CHANGE, SCTP_REMOTE_ERROR and
	SCTP_AUTHENTICATION_EVENT, have padding in the returning
	data structure that may not be completely initialized before
	being copied to userland. [CVE-2014-3953]
	<h1>Impact:</h1>
	An unprivileged local process may be able to retrieve
	portion of kernel memory.
	For the generic control message, the process may be able
	to retrieve a maximum of 4 bytes of kernel memory.
	For SCTP, the process may be able to retrieve 2 bytes
	of kernel memory for all three control messages, plus 92
	bytes for SCTP_SNDRCV and 76 bytes for SCTP_EXTRCV. If the
	local process is permitted to receive SCTP notification, a
	maximum of 112 bytes of kernel memory may be returned to
	userland.
	This information might be directly useful, or it might
	be leveraged to obtain elevated privileges in some way. For
	example, a terminal buffer might include a user-entered
	password.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3952</cvename>
 <cvename>CVE-2014-3953</cvename>
 <freebsdsa>SA-14:17.kmem</freebsdsa>
 </references>
 <dates>
 <discovery>2014-07-08</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="70140f20-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Multiple vulnerabilities in file(1) and libmagic(3)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_6</lt></range>
	<range><ge>9.2</ge><lt>9.2_9</lt></range>
	<range><ge>9.1</ge><lt>9.1_16</lt></range>
	<range><ge>8.4</ge><lt>8.4_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A specifically crafted Composite Document File (CDF)
	file can trigger an out-of-bounds read or an invalid pointer
	dereference. [CVE-2012-1571]
	A flaw in regular expression in the awk script detector
	makes use of multiple wildcards with unlimited repetitions.
	[CVE-2013-7345]
	A malicious input file could trigger infinite recursion
	in libmagic(3). [CVE-2014-1943]
	A specifically crafted Portable Executable (PE) can
	trigger out-of-bounds read. [CVE-2014-2270]
	<h1>Impact:</h1>
	An attacker who can cause file(1) or any other applications
	using the libmagic(3) library to be run on a maliciously
	constructed input can the application to crash or consume
	excessive CPU resources, resulting in a denial-of-service.
 </body>
 </description>
 <references>
 <cvename>CVE-2012-1571</cvename>
 <cvename>CVE-2013-7345</cvename>
 <cvename>CVE-2014-1943</cvename>
 <cvename>CVE-2014-2270</cvename>
 <freebsdsa>SA-14:16.file</freebsdsa>
 </references>
 <dates>
 <discovery>2014-06-24</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="6f91a709-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- iconv(3) NULL pointer dereference and out-of-bounds array access</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A NULL pointer dereference in the initialization code
	of the HZ module and an out of bounds array access in the
	initialization code of the VIQR module make iconv_open(3)
	calls involving HZ or VIQR result in an application crash.
	<h1>Impact:</h1>
	Services where an attacker can control the arguments of
	an iconv_open(3) call can be caused to crash resulting in
	a denial-of-service. For example, an email encoded in HZ
	may cause an email delivery service to crash if it converts
	emails to a more generic encoding like UTF-8 before applying
	filtering rules.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3951</cvename>
 <freebsdsa>SA-14:15.iconv</freebsdsa>
 </references>
 <dates>
 <discovery>2014-06-24</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="6e8f9003-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Incorrect error handling in PAM policy parser</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.2</ge><lt>9.2_7</lt></range>
	<range><ge>10.0</ge><lt>10.0_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The OpenPAM library searches for policy definitions in
	several locations. While doing so, the absence of a policy
	file is a soft failure (handled by searching in the next
	location) while the presence of an invalid file is a hard
	failure (handled by returning an error to the caller).
	The policy parser returns the same error code (ENOENT)
	when a syntactically valid policy references a non-existent
	module as when the requested policy file does not exist.
	The search loop regards this as a soft failure and looks
	for the next similarly-named policy, without discarding the
	partially-loaded configuration.
	A similar issue can arise if a policy contains an include
	directive that refers to a non-existent policy.
	<h1>Impact:</h1>
	If a module is removed, or the name of a module is
	misspelled in the policy file, the PAM library will proceed
	with a partially loaded configuration. Depending on the
	exact circumstances, this may result in a fail-open scenario
	where users are allowed to log in without a password, or
	with an incorrect password.
	In particular, if a policy references a module installed
	by a package or port, and that package or port is being
	reinstalled or upgraded, there is a brief window of time
	during which the module is absent and policies that use it
	may fail open. This can be especially damaging to Internet-facing
	SSH servers, which are regularly subjected to brute-force
	scans.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3879</cvename>
 <freebsdsa>SA-14:13.pam</freebsdsa>
 </references>
 <dates>
 <discovery>2014-06-03</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="6e04048b-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- ktrace kernel memory disclosure</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>9.2</ge><lt>9.2_7</lt></range>
	<range><ge>9.1</ge><lt>9.1_14</lt></range>
	<range><ge>8.4</ge><lt>8.4_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to an overlooked merge to -STABLE branches, the size
	for page fault kernel trace entries was set incorrectly.
	<h1>Impact:</h1>
	A user who can enable kernel process tracing could end
	up reading the contents of kernel memory.
	Such memory might contain sensitive information, such
	as portions of the file cache or terminal buffers. This
	information might be directly useful, or it might be leveraged
	to obtain elevated privileges in some way; for example, a
	terminal buffer might include a user-entered password.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3873</cvename>
 <freebsdsa>SA-14:12.ktrace</freebsdsa>
 </references>
 <dates>
 <discovery>2014-06-03</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="6d9eadaf-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- sendmail improper close-on-exec flag handling</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_4</lt></range>
	<range><ge>9.2</ge><lt>9.2_7</lt></range>
	<range><ge>9.1</ge><lt>9.1_14</lt></range>
	<range><ge>8.4</ge><lt>8.4_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	There is a programming error in sendmail(8) that prevented
	open file descriptors have close-on-exec properly set.
	Consequently a subprocess will be able to access all open
	files that the parent process have open.
	<h1>Impact:</h1>
	A local user who can execute their own program for mail
	delivery will be able to interfere with an open SMTP
	connection.
 </body>
 </description>
 <references>
 <freebsdsa>SA-14:11.sendmail</freebsdsa>
 </references>
 <dates>
 <discovery>2014-06-03</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="6d472244-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- TCP reassembly vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>8.4</ge><lt>8.4_9</lt></range>
	<range><ge>8.3</ge><lt>8.3_16</lt></range>
	<range><ge>9.2</ge><lt>9.2_5</lt></range>
	<range><ge>9.1</ge><lt>9.1_12</lt></range>
	<range><ge>10.0</ge><lt>10.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	FreeBSD may add a reassemble queue entry on the stack
	into the segment list when the reassembly queue reaches its
	limit. The memory from the stack is undefined after the
	function returns. Subsequent iterations of the reassembly
	function will attempt to access this entry.
	<h1>Impact:</h1>
	An attacker who can send a series of specifically crafted
	packets with a connection could cause a denial of service
	situation by causing the kernel to crash.
	Additionally, because the undefined on stack memory may
	be overwritten by other kernel threads, while extremely
	difficult, it may be possible for an attacker to construct
	a carefully crafted attack to obtain portion of kernel
	memory via a connected socket. This may result in the
	disclosure of sensitive information such as login credentials,
	etc. before or even without crashing the system.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3000</cvename>
 <freebsdsa>SA-14:08.tcp</freebsdsa>
 </references>
 <dates>
 <discovery>2014-04-30</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="6b6ca5b6-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- devfs rules not applied by default for jails</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The default devfs rulesets are not loaded on boot, even
	when jails are used. Device nodes will be created in the
	jail with their normal default access permissions, while
	most of them should be hidden and inaccessible.
	<h1>Impact:</h1>
	Jailed processes can get access to restricted resources
	on the host system. For jailed processes running with
	superuser privileges this implies access to all devices on
	the system. This level of access could lead to information
	leakage and privilege escalation.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3001</cvename>
 <freebsdsa>SA-14:07.devfs</freebsdsa>
 </references>
 <dates>
 <discovery>2014-04-30</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="6a384960-6007-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Deadlock in the NFS server</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>10.0</ge><lt>10.0_1</lt></range>
	<range><ge>9.2</ge><lt>9.2_4</lt></range>
	<range><ge>9.1</ge><lt>9.1_11</lt></range>
	<range><ge>8.4</ge><lt>8.4_8</lt></range>
	<range><ge>8.3</ge><lt>8.3_15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The kernel holds a lock over the source directory vnode
	while trying to convert the target directory file handle
	to a vnode, which needs to be returned with the lock held,
	too. This order may be in violation of normal lock order,
	which in conjunction with other threads that grab locks in
	the right order, constitutes a deadlock condition because
	no thread can proceed.
	<h1>Impact:</h1>
	An attacker on a trusted client could cause the NFS
	server become deadlocked, resulting in a denial of service.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1453</cvename>
 <freebsdsa>SA-14:05.nfsserver</freebsdsa>
 </references>
 <dates>
 <discovery>2014-04-08</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="4c96ecf2-5fd9-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- bsnmpd remote denial of service vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.2</ge><lt>9.2_3</lt></range>
	<range><ge>9.1</ge><lt>9.1_10</lt></range>
	<range><ge>8.4</ge><lt>8.4_7</lt></range>
	<range><ge>8.3</ge><lt>8.3_14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem Description:
	The bsnmpd(8) daemon is prone to a stack-based
	 buffer-overflow when it has received a specifically crafted
	 GETBULK PDU request.
	Impact:
	This issue could be exploited to execute arbitrary code in
	 the context of the service daemon, or crash the service daemon, causing
	 a denial-of-service.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1452</cvename>
 <freebsdsa>SA-14:01.bsnmpd</freebsdsa>
 </references>
 <dates>
 <discovery>2014-01-14</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="ca16fd0b-5fd1-11e6-a6f2-6cc21735f730">
 <topic>PostgreSQL -- Denial-of-Service and Code Injection Vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql91-server</name>
	<range><ge>9.1.0</ge><lt>9.1.23</lt></range>
 </package>
 <package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.18</lt></range>
 </package>
 <package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.11</lt></range>
 </package>
 <package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.9</lt></range>
 </package>
 <package>
	<name>postgresql95-server</name>
	<range><ge>9.5.0</ge><lt>9.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL project reports:
	<blockquote cite="http://www.postgresql.org/about/news/1688/">
	 
	 Security Fixes nested CASE expressions +
	 database and role names with embedded special characters
	 
	 <ul>
	 <li>CVE-2016-5423: certain nested CASE expressions can cause the
	 server to crash.
	 </li>
	 <li>CVE-2016-5424: database and role names with embedded special
	 characters can allow code injection during administrative operations
	 like pg_dumpall.
	 </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5423</cvename>
 <cvename>CVE-2016-5424</cvename>
 </references>
 <dates>
 <discovery>2016-08-11</discovery>
 <entry>2016-08-11</entry>
 </dates>
 </vuln>

<vuln vid="28bf62ef-5e2c-11e6-a15f-00248c0c745d">
 <topic>piwik -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>piwik</name>
	<range><lt>2.16.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Piwik reports:
	<blockquote cite="https://piwik.org/changelog/piwik-2-16-2/">
	 We have identified and fixed several XSS security issues in this release.
	</blockquote>
 </body>
 </description>
 <references>
 <url>We have identified and fixed several XSS security issues in this release.</url>
 </references>
 <dates>
 <discovery>2016-08-03</discovery>
 <entry>2016-08-09</entry>
 </dates>
 </vuln>

<vuln vid="7d08e608-5e95-11e6-b334-002590263bf5">
 <topic>BIND,Knot,NSD,PowerDNS -- denial over service via oversized zone transfers</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><le>9.9.9P2</le></range>
 </package>
 <package>
	<name>bind910</name>
	<range><le>9.10.4P2</le></range>
 </package>
 <package>
	<name>bind911</name>
	<range><le>9.11.0.b2</le></range>
 </package>
 <package>
	<name>bind9-devel</name>
	<range><le>9.12.0.a.2016.11.02</le></range>
 </package>
 <package>
	<name>knot</name>
	<name>knot1</name>
	<range><lt>1.6.8</lt></range>
 </package>
 <package>
	<name>knot2</name>
	<range><lt>2.3.0</lt></range>
 </package>
 <package>
	<name>nsd</name>
	<range><lt>4.1.11</lt></range>
 </package>
 <package>
	<name>powerdns</name>
	<range><lt>4.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01390">
	 DNS protocols were designed with the assumption that a certain
	 amount of trust could be presumed between the operators of primary
	 and secondary servers for a given zone. However, in current
	 practice some organizations have scenarios which require them to
	 accept zone data from sources that are not fully trusted (for
	 example: providers of secondary name service). A party who is
	 allowed to feed data into a zone (e.g. by AXFR, IXFR, or Dynamic DNS
	 updates) can overwhelm the server which is accepting data by
	 intentionally or accidentally exhausting that server's memory.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-6170</cvename>
 <cvename>CVE-2016-6171</cvename>
 <cvename>CVE-2016-6172</cvename>
 <cvename>CVE-2016-6173</cvename>
 <url>https://kb.isc.org/article/AA-01390</url>
 <mlist>http://www.openwall.com/lists/oss-security/2016/07/06/4</mlist>
 </references>
 <dates>
 <discovery>2016-07-06</discovery>
 <entry>2016-08-10</entry>
 <modified>2017-04-24</modified>
 </dates>
 </vuln>

<vuln vid="dd48d9b9-5e7e-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Kernel memory disclosure in sctp(4)</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>9.1</ge><lt>9.1_6</lt></range>
	<range><ge>8.4</ge><lt>8.4_3</lt></range>
	<range><ge>8.3</ge><lt>8.3_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem Description:
	When initializing the SCTP state cookie being sent in INIT-ACK chunks,
	 a buffer allocated from the kernel stack is not completely initialized.
	Impact:
	Fragments of kernel memory may be included in SCTP packets and
	 transmitted over the network. For each SCTP session, there are two
	 separate instances in which a 4-byte fragment may be transmitted.
	This memory might contain sensitive information, such as portions of the
	 file cache or terminal buffers. This information might be directly
	 useful, or it might be leveraged to obtain elevated privileges in
	 some way. For example, a terminal buffer might include a user-entered
	 password.
 </body>
 </description>
 <references>
 <freebsdsa>SA-13:10.sctp</freebsdsa>
 <cvename>CVE-2013-5209</cvename>
 </references>
 <dates>
 <discovery>2013-08-22</discovery>
 <entry>2016-08-09</entry>
 </dates>
 </vuln>

<vuln vid="0844632f-5e78-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- integer overflow in IP_MSFILTER</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>9.1</ge><lt>9.1_6</lt></range>
	<range><ge>8.4</ge><lt>8.4_3</lt></range>
	<range><ge>8.3</ge><lt>8.3_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem Description:
	An integer overflow in computing the size of a temporary
	 buffer can result in a buffer which is too small for the requested
	 operation.
	Impact:
	An unprivileged process can read or write pages of memory
	 which belong to the kernel. These may lead to exposure of sensitive
	 information or allow privilege escalation.
 </body>
 </description>
 <references>
 <cvename>CVE-2013-3077</cvename>
 <freebsdsa>SA-13:09.ip_multicast</freebsdsa>
 </references>
 <dates>
 <discovery>2013-08-22</discovery>
 <entry>2016-08-09</entry>
 </dates>
 </vuln>

<vuln vid="e5d2442d-5e76-11e6-a6c3-14dae9d210b8">
 <topic>FreeBSD -- Incorrect privilege validation in the NFS server</topic>
 <affects>
 <package>
	<name>FreeBSD-kernel</name>
	<range><ge>9.1</ge><lt>9.1_5</lt></range>
	<range><ge>8.3</ge><lt>8.3_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem Description:
	The kernel incorrectly uses client supplied credentials
	 instead of the one configured in exports(5) when filling out the
	 anonymous credential for a NFS export, when -network or -host
	 restrictions are used at the same time.
	Impact:
	The remote client may supply privileged credentials (e.g. the
	 root user) when accessing a file under the NFS share, which will bypass
	 the normal access checks.
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4851</cvename>
 <freebsdsa>SA-13:08.nfsserver</freebsdsa>
 </references>
 <dates>
 <discovery>2013-07-06</discovery>
 <entry>2016-08-09</entry>
 </dates>
 </vuln>

<vuln vid="6da45e38-5b55-11e6-8859-000c292ee6b8">
 <topic>collectd -- Network plugin heap overflow</topic>
 <affects>
 <package>
	<name>collectd5</name>
	<range><lt>5.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The collectd Project reports:
	<blockquote cite="http://collectd.org/news.shtml#news98">
	 Emilien Gaspar has identified a heap overflow in collectd's
	 network plugin which can be triggered remotely and is potentially
	 exploitable.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-6254</cvename>
 <url>http://collectd.org/news.shtml#news98</url>
 </references>
 <dates>
 <discovery>2016-07-26</discovery>
 <entry>2016-08-05</entry>
 </dates>
 </vuln>

<vuln vid="3ddcb42b-5b78-11e6-b334-002590263bf5">
 <topic>moodle -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moodle28</name>
	<range><le>2.8.12</le></range>
 </package>
 <package>
	<name>moodle29</name>
	<range><lt>2.9.7</lt></range>
 </package>
 <package>
	<name>moodle30</name>
	<range><lt>3.0.5</lt></range>
 </package>
 <package>
	<name>moodle31</name>
	<range><lt>3.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marina Glancy reports:
	<blockquote cite="https://moodle.org/security/">
	 <ul>
	 <li>MSA-16-0019: Glossary search displays entries without
	 checking user permissions to view them</li>
	 <li>MSA-16-0020: Text injection in email headers</li>
	 <li>MSA-16-0021: Unenrolled user still receives event monitor
	 notifications even though they can no longer access course</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5012</cvename>
 <cvename>CVE-2016-5013</cvename>
 <cvename>CVE-2016-5014</cvename>
 <url>https://moodle.org/security/</url>
 </references>
 <dates>
 <discovery>2016-07-19</discovery>
 <entry>2016-08-06</entry>
 </dates>
 </vuln>

<vuln vid="7a31e0de-5b6d-11e6-b334-002590263bf5">
 <topic>bind -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><lt>9.9.9P2</lt></range>
 </package>
 <package>
	<name>bind910</name>
	<range><lt>9.10.4P2</lt></range>
 </package>
 <package>
	<name>bind911</name>
	<range><lt>9.11.0.b2</lt></range>
 </package>
 <package>
	<name>bind9-devel</name>
	<range><lt>9.12.0.a.2016.07.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01393">
	 A query name which is too long can cause a segmentation fault in
	 lwresd.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2775</cvename>
 <url>https://kb.isc.org/article/AA-01393</url>
 </references>
 <dates>
 <discovery>2016-07-18</discovery>
 <entry>2016-08-06</entry>
 </dates>
 </vuln>

<vuln vid="610101ea-5b6a-11e6-b334-002590263bf5">
 <topic>wireshark -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>wireshark-qt5</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>2.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wireshark development team reports:
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.5.html">
	 The following vulnerabilities have been fixed:
	 <ul>
	 <li>wnpa-sec-2016-41
	 PacketBB crash. (Bug 12577)</li>
	 <li>wnpa-sec-2016-42
	 WSP infinite loop. (Bug 12594)</li>
	 <li>wnpa-sec-2016-44
	 RLC long loop. (Bug 12660)</li>
	 <li>wnpa-sec-2016-45
	 LDSS dissector crash. (Bug 12662)</li>
	 <li>wnpa-sec-2016-46
	 RLC dissector crash. (Bug 12664)</li>
	 <li>wnpa-sec-2016-47
	 OpenFlow long loop. (Bug 12659)</li>
	 <li>wnpa-sec-2016-48
	 MMSE, WAP, WBXML, and WSP infinite loop. (Bug 12661)</li>
	 <li>wnpa-sec-2016-49
	 WBXML crash. (Bug 12663)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-6505</cvename>
 <cvename>CVE-2016-6506</cvename>
 <cvename>CVE-2016-6508</cvename>
 <cvename>CVE-2016-6509</cvename>
 <cvename>CVE-2016-6510</cvename>
 <cvename>CVE-2016-6511</cvename>
 <cvename>CVE-2016-6512</cvename>
 <cvename>CVE-2016-6513</cvename>
 <url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.5.html</url>
 <url>http://www.openwall.com/lists/oss-security/2016/08/01/4</url>
 </references>
 <dates>
 <discovery>2016-07-27</discovery>
 <entry>2016-08-06</entry>
 </dates>
 </vuln>

<vuln vid="3e08047f-5a6c-11e6-a6c3-14dae9d210b8">
 <topic>p5-XSLoader -- local arbitrary code execution</topic>
 <affects>
 <package>
	<name>p5-XSLoader</name>
	<range><lt>0.22</lt></range>
 </package>
 <package>
	<name>perl5</name>
	<name>perl5.18</name>
	<name>perl5.20</name>
	<name>perl5.22</name>
	<name>perl5.24</name>
	<name>perl5-devel</name>
	<range><lt>5.18.4_24</lt></range>
	<range><ge>5.20</ge><lt>5.20.3_15</lt></range>
	<range><ge>5.21</ge><lt>5.22.3.r2</lt></range>
	<range><ge>5.23</ge><lt>5.24.1.r2</lt></range>
	<range><ge>5.25</ge><lt>5.25.2.87</lt></range>
 </package>
 <package>
	<name>perl</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jakub Wilk reports:
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829578">
	 XSLoader tries to load code from a subdirectory in the cwd when
	 called inside a string eval
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829578</url>
 <cvename>CVE-2016-6185</cvename>
 </references>
 <dates>
 <discovery>2016-06-30</discovery>
 <entry>2016-08-04</entry>
 <modified>2016-08-22</modified>
 </dates>
 </vuln>

<vuln vid="72bfbb09-5a6a-11e6-a6c3-14dae9d210b8">
 <topic>perl -- local arbitrary code execution</topic>
 <affects>
 <package>
	<name>perl5</name>
	<name>perl5.18</name>
	<name>perl5.20</name>
	<name>perl5.22</name>
	<name>perl5.24</name>
	<name>perl5-devel</name>
	<range><lt>5.18.4_23</lt></range>
	<range><ge>5.20</ge><lt>5.20.3_14</lt></range>
	<range><ge>5.21</ge><lt>5.22.3.r2</lt></range>
	<range><ge>5.23</ge><lt>5.24.1.r2</lt></range>
	<range><ge>5.25</ge><lt>5.25.3.18</lt></range>
 </package>
 <package>
	<name>perl</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sawyer X reports:
	<blockquote cite="http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html">
	 Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do
	 not properly remove . (period) characters from the end of the includes
	 directory array, which might allow local users to gain privileges via a
	 Trojan horse module under the current working directory.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html</url>
 <cvename>CVE-2016-1238</cvename>
 </references>
 <dates>
 <discovery>2016-07-21</discovery>
 <entry>2016-08-04</entry>
 <modified>2016-08-22</modified>
 </dates>
 </vuln>

<vuln vid="556d2286-5a51-11e6-a6c3-14dae9d210b8">
 <topic>gd -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gd</name>
	<range><lt>2.2.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pierre Joye reports:
	<blockquote cite="https://github.com/libgd/libgd/releases/tag/gd-2.2.3">
	 <ul>
	 <li>fix php bug 72339, Integer Overflow in _gd2GetHeader
	 (CVE-2016-5766)</li>
	 <li>gd: Buffer over-read issue when parsing crafted TGA
	 file (CVE-2016-6132)</li>
	 <li>Integer overflow error within _gdContributionsAlloc()
	 (CVE-2016-6207)</li>
	 <li>fix php bug 72494, invalid color index not handled, can
	 lead to crash ( CVE-2016-6128)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/libgd/libgd/releases/tag/gd-2.2.3</url>
 <cvename>CVE-2016-5766</cvename>
 <cvename>CVE-2016-6132</cvename>
 <cvename>CVE-2016-6207</cvename>
 <cvename>CVE-2016-6128</cvename>
 </references>
 <dates>
 <discovery>2016-07-21</discovery>
 <entry>2016-08-04</entry>
 </dates>
 </vuln>

<vuln vid="e4bc70fc-5a2f-11e6-a1bc-589cfc0654e1">
 <topic>Vulnerabilities in Curl</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.32.0</ge><lt>7.50.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Curl security team reports:
	<blockquote cite="https://curl.haxx.se/docs/security.html">
	 CVE-2016-5419 - TLS session resumption client cert bypass
	 CVE-2016-5420 - Re-using connections with wrong client cert
	 CVE-2016-5421 - use of connection struct after free
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5419</cvename>
 <cvename>CVE-2016-5420</cvename>
 <cvename>CVE-2016-5421</cvename>
 <url>https://curl.haxx.se/docs/adv_20160803A.html</url>
 <url>https://curl.haxx.se/docs/adv_20160803B.html</url>
 <url>https://curl.haxx.se/docs/adv_20160803C.html</url>
 </references>
 <dates>
 <discovery>2016-08-03</discovery>
 <entry>2016-08-04</entry>
 </dates>
 </vuln>

<vuln vid="ef0033ad-5823-11e6-80cc-001517f335e2">
 <topic>lighttpd - multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>lighttpd</name>
	<range><lt>1.4.41</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Lighttpd Project reports:
	<blockquote cite="http://www.lighttpd.net/2016/7/31/1.4.41/">
	 Security fixes for Lighttpd:
	 <ul>
	 <li>security: encode quoting chars in HTML and XML</li>
	 <li>security: ensure gid != 0 if server.username is set, but not server.groupname</li>
	 <li>security: disable stat_cache if server.follow-symlink = “disable”</li>
	 <li>security: httpoxy defense: do not emit HTTP_PROXY to CGI env</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.lighttpd.net/2016/7/31/1.4.41/</url>
 <freebsdpr>ports/211495</freebsdpr>
 </references>
 <dates>
 <discovery>2016-07-31</discovery>
 <entry>2016-08-03</entry>
 </dates>
 </vuln>

<vuln vid="06574c62-5854-11e6-b334-002590263bf5">
 <topic>xen-tools -- virtio: unbounded memory allocation issue</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><lt>4.7.0_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-184.html">
	 A guest can submit virtio requests without bothering to wait for
	 completion and is therefore not bound by virtqueue size...
	 A malicious guest administrator can cause unbounded memory
	 allocation in QEMU, which can cause an Out-of-Memory condition
	 in the domain running qemu. Thus, a malicious guest administrator
	 can cause a denial of service affecting the whole host.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5403</cvename>
 <freebsdpr>ports/211482</freebsdpr>
 <url>http://xenbits.xen.org/xsa/advisory-184.html</url>
 </references>
 <dates>
 <discovery>2016-07-27</discovery>
 <entry>2016-08-02</entry>
 </dates>
 </vuln>

<vuln vid="04cf89e3-5854-11e6-b334-002590263bf5">
 <topic>xen-kernel -- x86: Missing SMAP whitelisting in 32-bit exception / event delivery</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><gt>4.5</gt><lt>4.7.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-183.html">
	 Supervisor Mode Access Prevention is a hardware feature designed
	 to make an Operating System more robust, by raising a pagefault
	 rather than accidentally following a pointer into userspace.
	 However, legitimate accesses into userspace require whitelisting,
	 and the exception delivery mechanism for 32bit PV guests wasn't
	 whitelisted.
	 A malicious 32-bit PV guest kernel can trigger a safety check,
	 crashing the hypervisor and causing a denial of service to other
	 VMs on the host.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-6259</cvename>
 <freebsdpr>ports/211482</freebsdpr>
 <url>http://xenbits.xen.org/xsa/advisory-183.html</url>
 </references>
 <dates>
 <discovery>2016-07-26</discovery>
 <entry>2016-08-02</entry>
 </dates>
 </vuln>

<vuln vid="032aa524-5854-11e6-b334-002590263bf5">
 <topic>xen-kernel -- x86: Privilege escalation in PV guests</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.7.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-182.html">
	 The PV pagetable code has fast-paths for making updates to
	 pre-existing pagetable entries, to skip expensive re-validation
	 in safe cases (e.g. clearing only Access/Dirty bits). The bits
	 considered safe were too broad, and not actually safe.
	 A malicious PV guest administrator can escalate their privilege to
	 that of the host.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-6258</cvename>
 <freebsdpr>ports/211482</freebsdpr>
 <url>http://xenbits.xen.org/xsa/advisory-182.html</url>
 </references>
 <dates>
 <discovery>2016-07-26</discovery>
 <entry>2016-08-02</entry>
 </dates>
 </vuln>

<vuln vid="cb5189eb-572f-11e6-b334-002590263bf5">
 <topic>libidn -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libidn</name>
	<range><lt>1.33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Josefsson reports:
	<blockquote cite="https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html">
	 libidn: Fix out-of-bounds stack read in idna_to_ascii_4i.
	 idn: Solve out-of-bounds-read when reading one zero byte as input.
	 Also replaced fgets with getline.
	 libidn: stringprep_utf8_nfkc_normalize reject invalid UTF-8. It was
	 always documented to only accept UTF-8 data, but now it doesn't
	 crash when presented with such data.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-6261</cvename>
 <cvename>CVE-2015-8948</cvename>
 <cvename>CVE-2016-6262</cvename>
 <cvename>CVE-2016-6263</cvename>
 <url>https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html</url>
 <url>http://www.openwall.com/lists/oss-security/2016/07/21/4</url>
 </references>
 <dates>
 <discovery>2016-07-20</discovery>
 <entry>2016-07-31</entry>
 </dates>
 </vuln>

<vuln vid="6fb8a90f-c9d5-4d14-b940-aed3d63c2edc">
 <topic>The GIMP -- Use after Free vulnerability</topic>
 <affects>
 <package>
	<name>gimp-app</name>
	<range><lt>2.8.18,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GIMP team reports:
	<blockquote cite="https://mail.gnome.org/archives/gimp-developer-list/2016-July/msg00020.html">
	 A Use-after-free vulnerability was found in the xcf_load_image function.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mail.gnome.org/archives/gimp-developer-list/2016-July/msg00020.html</url>
 <url>https://bugzilla.gnome.org/show_bug.cgi?id=767873</url>
 <cvename>CVE-2016-4994</cvename>
 </references>
 <dates>
 <discovery>2016-06-20</discovery>
 <entry>2016-07-19</entry>
 </dates>
 </vuln>

<vuln vid="cb09a7aa-5344-11e6-a7bd-14dae9d210b8">
 <topic>xercesi-c3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xerces-c3</name>
	<range><lt>3.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache reports:
	<blockquote cite="https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt">
	 The Xerces-C XML parser fails to successfully parse a
	 DTD that is deeply nested, and this causes a stack overflow, which
	 makes a denial of service attack against many applications possible
	 by an unauthenticated attacker.
	 Also, CVE-2016-2099: Use-after-free vulnerability in
	 validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier
	 allows context-dependent attackers to have unspecified impact via an
	 invalid character in an XML document.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt</url>
 <url>http://www.openwall.com/lists/oss-security/2016/05/09/7</url>
 <cvename>CVE-2016-2099</cvename>
 <cvename>CVE-2016-4463</cvename>
 </references>
 <dates>
 <discovery>2016-05-09</discovery>
 <entry>2016-07-26</entry>
 </dates>
 </vuln>

<vuln vid="b6402385-533b-11e6-a7bd-14dae9d210b8">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php55</name>
	<range><lt>5.5.38</lt></range>
 </package>
 <package>
	<name>php56</name>
	<range><lt>5.6.24</lt></range>
 </package>
 <package>
	<name>php70</name>
	<range><lt>7.0.9</lt></range>
 </package>
 <package>
	<name>php70-curl</name>
	<range><lt>7.0.9</lt></range>
 </package>
 <package>
	<name>php55-bz2</name>
	<range><lt>5.5.38</lt></range>
 </package>
 <package>
	<name>php56-bz2</name>
	<range><lt>5.6.24</lt></range>
 </package>
 <package>
	<name>php70-bz2</name>
	<range><lt>7.0.9</lt></range>
 </package>
 <package>
	<name>php55-exif</name>
	<range><lt>5.5.38</lt></range>
 </package>
 <package>
	<name>php56-exif</name>
	<range><lt>5.6.24</lt></range>
 </package>
 <package>
	<name>php70-exif</name>
	<range><lt>7.0.9</lt></range>
 </package>
 <package>
	<name>php55-gd</name>
	<range><lt>5.5.38</lt></range>
 </package>
 <package>
	<name>php56-gd</name>
	<range><lt>5.6.24</lt></range>
 </package>
 <package>
	<name>php70-gd</name>
	<range><lt>7.0.9</lt></range>
 </package>
 <package>
	<name>php70-mcrypt</name>
	<range><lt>7.0.9</lt></range>
 </package>
 <package>
	<name>php55-odbc</name>
	<range><lt>5.5.38</lt></range>
 </package>
 <package>
	<name>php56-odbc</name>
	<range><lt>5.6.24</lt></range>
 </package>
 <package>
	<name>php70-odbc</name>
	<range><lt>7.0.9</lt></range>
 </package>
 <package>
	<name>php55-snmp</name>
	<range><lt>5.5.38</lt></range>
 </package>
 <package>
	<name>php56-snmp</name>
	<range><lt>5.6.24</lt></range>
 </package>
 <package>
	<name>php70-snmp</name>
	<range><lt>7.0.9</lt></range>
 </package>
 <package>
	<name>php55-xmlrpc</name>
	<range><lt>5.5.38</lt></range>
 </package>
 <package>
	<name>php56-xmlrpc</name>
	<range><lt>5.6.24</lt></range>
 </package>
 <package>
	<name>php70-xmlrpc</name>
	<range><lt>7.0.9</lt></range>
 </package>
 <package>
	<name>php55-zip</name>
	<range><lt>5.5.38</lt></range>
 </package>
 <package>
	<name>php56-zip</name>
	<range><lt>5.6.24</lt></range>
 </package>
 <package>
	<name>php70-zip</name>
	<range><lt>7.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP reports:
	<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.38">
	 <ul>
	 <li>Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined columns)</li>
	 <li>Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).</li>
	 <li>Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).</li>
	 <li>Fixed bug #72519 (imagegif/output out-of-bounds access).</li>
	 <li>Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).</li>
	 <li>Fixed bug #72533 (locale_accept_from_http out-of-bounds access).</li>
	 <li>Fixed bug #72541 (size_t overflow lead to heap corruption).</li>
	 <li>Fixed bug #72551, bug #72552 (Incorrect casting from size_t to int lead to heap overflow in mdecrypt_generic).</li>
	 <li>Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).</li>
	 <li>Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications).</li>
	 <li>Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).</li>
	 <li>Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).</li>
	 <li>Fixed bug #72613 (Inadequate error handling in bzread()).</li>
	 <li>Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.php.net/ChangeLog-5.php#5.5.38</url>
 <url>http://www.php.net/ChangeLog-5.php#5.6.24</url>
 <url>http://www.php.net/ChangeLog-7.php#7.0.8</url>
 <url>http://seclists.org/oss-sec/2016/q3/121</url>
 <cvename>CVE-2015-8879</cvename>
 <cvename>CVE-2016-5385</cvename>
 <cvename>CVE-2016-5399</cvename>
 <cvename>CVE-2016-6288</cvename>
 <cvename>CVE-2016-6289</cvename>
 <cvename>CVE-2016-6290</cvename>
 <cvename>CVE-2016-6291</cvename>
 <cvename>CVE-2016-6292</cvename>
 <cvename>CVE-2016-6294</cvename>
 <cvename>CVE-2016-6295</cvename>
 <cvename>CVE-2016-6296</cvename>
 <cvename>CVE-2016-6297</cvename>
 </references>
 <dates>
 <discovery>2016-07-21</discovery>
 <entry>2016-07-26</entry>
 </dates>
 </vuln>

<vuln vid="6fae9fe1-5048-11e6-8aa7-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>52.0.2743.82</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html">
	 48 security fixes in this release, including:
	 <ul>
	 <li>[610600] High CVE-2016-1706: Sandbox escape in PPAPI. Credit to
	 Pinkie Pie xisigr of Tencent's Xuanwu Lab</li>
	 <li>[613949] High CVE-2016-1708: Use-after-free in Extensions.
	 Credit to Adam Varsan</li>
	 <li>[614934] High CVE-2016-1709: Heap-buffer-overflow in sfntly.
	 Credit to ChenQin of Topsec Security Team</li>
	 <li>[616907] High CVE-2016-1710: Same-origin bypass in Blink.
	 Credit to Mariusz Mlynski</li>
	 <li>[617495] High CVE-2016-1711: Same-origin bypass in Blink.
	 Credit to Mariusz Mlynski</li>
	 <li>[618237] High CVE-2016-5127: Use-after-free in Blink. Credit
	 to cloudfuzzer</li>
	 <li>[619166] High CVE-2016-5128: Same-origin bypass in V8. Credit
	 to Anonymous</li>
	 <li>[620553] High CVE-2016-5129: Memory corruption in V8. Credit to
	 Jeonghoon Shin</li>
	 <li>[623319] High CVE-2016-5130: URL spoofing. Credit to Wadih
	 Matar</li>
	 <li>[623378] High CVE-2016-5131: Use-after-free in libxml. Credit
	 to Nick Wellnhofer</li>
	 <li>[607543] Medium CVE-2016-5132: Limited same-origin bypass in
	 Service Workers. Credit to Ben Kelly</li>
	 <li>[613626] Medium CVE-2016-5133: Origin confusion in proxy
	 authentication. Credit to Patch Eudor</li>
	 <li>[593759] Medium CVE-2016-5134: URL leakage via PAC script.
	 Credit to Paul Stone</li>
	 <li>[605451] Medium CVE-2016-5135: Content-Security-Policy bypass.
	 Credit to kingxwy</li>
	 <li>[625393] Medium CVE-2016-5136: Use after free in extensions.
	 Credit to Rob Wu</li>
	 <li>[625945] Medium CVE-2016-5137: History sniffing with HSTS and
	 CSP. Credit to Xiaoyin Liu</li>
	 <li>[629852] CVE-2016-1705: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1705</cvename>
 <cvename>CVE-2016-1706</cvename>
 <cvename>CVE-2016-1708</cvename>
 <cvename>CVE-2016-1709</cvename>
 <cvename>CVE-2016-1710</cvename>
 <cvename>CVE-2016-1711</cvename>
 <cvename>CVE-2016-5127</cvename>
 <cvename>CVE-2016-5128</cvename>
 <cvename>CVE-2016-5129</cvename>
 <cvename>CVE-2016-5130</cvename>
 <cvename>CVE-2016-5131</cvename>
 <cvename>CVE-2016-5132</cvename>
 <cvename>CVE-2016-5133</cvename>
 <cvename>CVE-2016-5134</cvename>
 <cvename>CVE-2016-5135</cvename>
 <cvename>CVE-2016-5136</cvename>
 <cvename>CVE-2016-5137</cvename>
 <url>https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html</url>
 </references>
 <dates>
 <discovery>2016-07-20</discovery>
 <entry>2016-07-22</entry>
 </dates>
 </vuln>

<vuln vid="62d45229-4fa0-11e6-9d13-206a8a720317">
 <topic>krb5 -- KDC denial of service vulnerability</topic>
 <affects>
 <package>
	<name>krb5-113</name>
	<range><lt>1.13.6</lt></range>
 </package>
 <package>
	<name>krb5-114</name>
	<range><lt>1.14.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Major changes in krb5 1.14.3 and krb5 1.13.6:
	<blockquote cite="http://web.mit.edu/kerberos/krb5-1.14/">
	 Fix a rare KDC denial of service vulnerability when anonymous
	 client principals are restricted to obtaining TGTs only
	 [CVE-2016-3120] .
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3120</cvename>
 <url>http://web.mit.edu/kerberos/krb5-1.14/</url>
 </references>
 <dates>
 <discovery>2016-07-20</discovery>
 <entry>2016-07-21</entry>
 <modified>2016-07-26</modified>
 </dates>
 </vuln>

<vuln vid="72f71e26-4f69-11e6-ac37-ac9e174be3af">
 <topic>Apache OpenOffice 4.1.2 -- Memory Corruption Vulnerability (Impress Presentations)</topic>
 <affects>
 <package>
	<name>apache-openoffice</name>
	<range><lt>4.1.2_8</lt></range>
 </package>
 <package>
	<name>apache-openoffice-devel</name>
	<range><lt>4.2.1753426,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache OpenOffice Project reports:
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2016-1513.html">
	 An OpenDocument Presentation .ODP or Presentation Template
	 .OTP file can contain invalid presentation elements that lead
	 to memory corruption when the document is loaded in Apache
	 OpenOffice Impress. The defect may cause the document to appear
	 as corrupted and OpenOffice may crash in a recovery-stuck mode
	 requiring manual intervention. A crafted exploitation of the
	 defect can allow an attacker to cause denial of service
	 (memory corruption and application crash) and possible
	 execution of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1513</cvename>
 <url>http://www.openoffice.org/security/cves/CVE-2015-4551.html</url>
 </references>
 <dates>
 <discovery>2016-07-17</discovery>
 <entry>2016-07-21</entry>
 </dates>
 </vuln>

<vuln vid="ca5cb202-4f51-11e6-b2ec-b499baebfeaf">
 <topic>MySQL -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb55-server</name>
	<range><le>5.5.49</le></range>
 </package>
 <package>
	<name>mariadb100-server</name>
	<range><le>10.0.25</le></range>
 </package>
 <package>
	<name>mariadb101-server</name>
	<range><le>10.1.14</le></range>
 </package>
 <package>
	<name>mysql55-server</name>
	<range><le>5.5.49</le></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.30</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.12_1</lt></range>
 </package>
 <package>
	<name>percona55-server</name>
	<range><le>5.5.49</le></range>
 </package>
 <package>
	<name>percona56-server</name>
	<range><le>5.6.30</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL">
	 The quarterly Critical Patch Update contains 22 new security fixes for
	 Oracle MySQL 5.5.49, 5.6.30, 5.7.13 and earlier
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL</url>
 <cvename>CVE-2016-3477</cvename>
 <cvename>CVE-2016-3440</cvename>
 <cvename>CVE-2016-2105</cvename>
 <cvename>CVE-2016-3471</cvename>
 <cvename>CVE-2016-3486</cvename>
 <cvename>CVE-2016-3501</cvename>
 <cvename>CVE-2016-3518</cvename>
 <cvename>CVE-2016-3521</cvename>
 <cvename>CVE-2016-3588</cvename>
 <cvename>CVE-2016-3615</cvename>
 <cvename>CVE-2016-3614</cvename>
 <cvename>CVE-2016-5436</cvename>
 <cvename>CVE-2016-3459</cvename>
 <cvename>CVE-2016-5437</cvename>
 <cvename>CVE-2016-3424</cvename>
 <cvename>CVE-2016-5439</cvename>
 <cvename>CVE-2016-5440</cvename>
 <cvename>CVE-2016-5441</cvename>
 <cvename>CVE-2016-5442</cvename>
 <cvename>CVE-2016-5443</cvename>
 <cvename>CVE-2016-5444</cvename>
 <cvename>CVE-2016-3452</cvename>
 </references>
 <dates>
 <discovery>2016-07-20</discovery>
 <entry>2016-07-21</entry>
 <modified>2016-08-08</modified>
 </dates>
 </vuln>

<vuln vid="3caf4e6c-4cef-11e6-a15f-00248c0c745d">
 <topic>typo3 -- Missing access check in Extbase</topic>
 <affects>
 <package>
 <name>typo3</name>
 <range><lt>7.6.8</lt></range>
 </package>
 <package>
 <name>typo3-lts</name>
 <range><lt>6.2.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	TYPO3 reports:
	<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/">
	 Extbase request handling fails to implement a proper access check for
 requested controller/ action combinations, which makes it possible for an
 attacker to execute arbitrary Extbase actions by crafting a special request. To
 successfully exploit this vulnerability, an attacker must have access to at
 least one Extbase plugin or module action in a TYPO3 installation. The missing
 access check inevitably leads to information disclosure or remote code
 execution, depending on the action that an attacker is able to execute.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5091</cvename>
 <url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/</url>
 <url>https://wiki.typo3.org/TYPO3_CMS_7.6.8</url>
 <url>https://wiki.typo3.org/TYPO3_CMS_6.2.24</url>
 </references>
 <dates>
 <discovery>2016-05-24</discovery>
 <entry>2016-07-18</entry>
 </dates>
 </vuln>

<vuln vid="00cb1469-4afc-11e6-97ea-002590263bf5">
 <topic>atutor -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>atutor</name>
	<range><lt>2.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ATutor reports:
	<blockquote cite="https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2">
	 Security Fixes: Added a new layer of security over all php
	 superglobals, fixed several XSS, CSRF, and SQL injection
	 vulnerabilities.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2</url>
 </references>
 <dates>
 <discovery>2016-07-01</discovery>
 <entry>2016-07-16</entry>
 </dates>
 </vuln>

<vuln vid="ffa8ca79-4afb-11e6-97ea-002590263bf5">
 <topic>atutor -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>atutor</name>
	<range><lt>2.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ATutor reports:
	<blockquote cite="https://github.com/atutor/ATutor/releases/tag/atutor_2_2_1">
	 Security Fixes: A number of minor XSS vulnerabilities discovered in
	 the previous version of ATutor have been corrected.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/atutor/ATutor/releases/tag/atutor_2_2_1</url>
 </references>
 <dates>
 <discovery>2016-01-30</discovery>
 <entry>2016-07-16</entry>
 </dates>
 </vuln>

<vuln vid="a522d6ac-4aed-11e6-97ea-002590263bf5">
 <topic>flash -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.632</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-25.htmL">
	 These updates resolve a race condition vulnerability that could
	 lead to information disclosure (CVE-2016-4247).
	 These updates resolve type confusion vulnerabilities that could
	 lead to code execution (CVE-2016-4223, CVE-2016-4224,
	 CVE-2016-4225).
	 These updates resolve use-after-free vulnerabilities that could
	 lead to code execution (CVE-2016-4173, CVE-2016-4174, CVE-2016-4222,
	 CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229,
	 CVE-2016-4230, CVE-2016-4231, CVE-2016-4248).
	 These updates resolve a heap buffer overflow vulnerability that
	 could lead to code execution (CVE-2016-4249).
	 These updates resolve memory corruption vulnerabilities that could
	 lead to code execution (CVE-2016-4172, CVE-2016-4175, CVE-2016-4179,
	 CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183,
	 CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
	 CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217,
	 CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221,
	 CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236,
	 CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
	 CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244,
	 CVE-2016-4245, CVE-2016-4246).
	 These updates resolve a memory leak vulnerability (CVE-2016-4232).
	 
	 These updates resolve stack corruption vulnerabilities that could
	 lead to code execution (CVE-2016-4176, CVE-2016-4177).
	 These updates resolve a security bypass vulnerability that could
	 lead to information disclosure (CVE-2016-4178).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4172</cvename>
 <cvename>CVE-2016-4173</cvename>
 <cvename>CVE-2016-4174</cvename>
 <cvename>CVE-2016-4175</cvename>
 <cvename>CVE-2016-4176</cvename>
 <cvename>CVE-2016-4177</cvename>
 <cvename>CVE-2016-4178</cvename>
 <cvename>CVE-2016-4179</cvename>
 <cvename>CVE-2016-4180</cvename>
 <cvename>CVE-2016-4181</cvename>
 <cvename>CVE-2016-4182</cvename>
 <cvename>CVE-2016-4183</cvename>
 <cvename>CVE-2016-4184</cvename>
 <cvename>CVE-2016-4185</cvename>
 <cvename>CVE-2016-4186</cvename>
 <cvename>CVE-2016-4187</cvename>
 <cvename>CVE-2016-4188</cvename>
 <cvename>CVE-2016-4189</cvename>
 <cvename>CVE-2016-4190</cvename>
 <cvename>CVE-2016-4217</cvename>
 <cvename>CVE-2016-4218</cvename>
 <cvename>CVE-2016-4219</cvename>
 <cvename>CVE-2016-4220</cvename>
 <cvename>CVE-2016-4221</cvename>
 <cvename>CVE-2016-4222</cvename>
 <cvename>CVE-2016-4223</cvename>
 <cvename>CVE-2016-4224</cvename>
 <cvename>CVE-2016-4225</cvename>
 <cvename>CVE-2016-4226</cvename>
 <cvename>CVE-2016-4227</cvename>
 <cvename>CVE-2016-4228</cvename>
 <cvename>CVE-2016-4229</cvename>
 <cvename>CVE-2016-4230</cvename>
 <cvename>CVE-2016-4231</cvename>
 <cvename>CVE-2016-4232</cvename>
 <cvename>CVE-2016-4233</cvename>
 <cvename>CVE-2016-4234</cvename>
 <cvename>CVE-2016-4235</cvename>
 <cvename>CVE-2016-4236</cvename>
 <cvename>CVE-2016-4237</cvename>
 <cvename>CVE-2016-4238</cvename>
 <cvename>CVE-2016-4239</cvename>
 <cvename>CVE-2016-4240</cvename>
 <cvename>CVE-2016-4241</cvename>
 <cvename>CVE-2016-4242</cvename>
 <cvename>CVE-2016-4243</cvename>
 <cvename>CVE-2016-4244</cvename>
 <cvename>CVE-2016-4245</cvename>
 <cvename>CVE-2016-4246</cvename>
 <cvename>CVE-2016-4247</cvename>
 <cvename>CVE-2016-4248</cvename>
 <cvename>CVE-2016-4249</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb16-25.html</url>
 </references>
 <dates>
 <discovery>2016-07-12</discovery>
 <entry>2016-07-16</entry>
 </dates>
 </vuln>

<vuln vid="3159cd70-4aaa-11e6-a7bd-14dae9d210b8">
 <topic>libreoffice -- use-after-free vulnerability</topic>
 <affects>
 <package>
	<name>libreoffice</name>
	<range><lt>5.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Talos reports:
	<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0126/">
	 An exploitable Use After Free vulnerability exists in the
	 RTF parser LibreOffice. A specially crafted file can cause a use after
	 free resulting in a possible arbitrary code execution. To exploit the
	 vulnerability a malicious file needs to be opened by the user via
	 vulnerable application.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.talosintelligence.com/reports/TALOS-2016-0126/</url>
 <url>http://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/</url>
 <cvename>CVE-2016-4324</cvename>
 </references>
 <dates>
 <discovery>2016-06-27</discovery>
 <entry>2016-07-15</entry>
 </dates>
 </vuln>

<vuln vid="0ab66088-4aa5-11e6-a7bd-14dae9d210b8">
 <topic>tiff -- buffer overflow</topic>
 <affects>
 <package>
	<name>tiff</name>
	<range><lt>4.0.6_2</lt></range>
 </package>
 <package>
	<name>linux-c6-tiff</name>
	<range><lt>3.9.4_2</lt></range>
 </package>
 <package>
	<name>linux-f10-tiff</name>
	<range><ge>*</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mathias Svensson reports:
	<blockquote cite="https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2">
	 potential buffer write overrun in PixarLogDecode() on
	 corrupted/unexpected images
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2</url>
 <cvename>CVE-2016-5314</cvename>
 <cvename>CVE-2016-5320</cvename>
 <cvename>CVE-2016-5875</cvename>
 </references>
 <dates>
 <discovery>2016-06-28</discovery>
 <entry>2016-07-15</entry>
 <modified>2016-09-06</modified>
 </dates>
 </vuln>

<vuln vid="d706a3a3-4a7c-11e6-97f7-5453ed2e2b49">
 <topic>p7zip -- out-of-bounds read vulnerability</topic>
 <affects>
 <package>
	<name>p7zip</name>
	<range><lt>15.14_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cisco Talos reports:
	<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0094/">
	 An out-of-bounds read vulnerability exists in the way 7-Zip
	 handles Universal Disk Format (UDF) files.
	 Central to 7-Zip’s processing of UDF files is the
	 CInArchive::ReadFileItem method. Because volumes can have more than
	 one partition map, their objects are kept in an object vector. To
	 start looking for an item, this method tries to reference the proper
	 object using the partition map’s object vector and the "PartitionRef"
	 field from the Long Allocation Descriptor. Lack of checking whether
	 the "PartitionRef" field is bigger than the available amount of
	 partition map objects causes a read out-of-bounds and can lead, in
	 some circumstances, to arbitrary code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2335</cvename>
 <url>http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html</url>
 </references>
 <dates>
 <discovery>2016-05-11</discovery>
 <entry>2016-07-15</entry>
 </dates>
 </vuln>

<vuln vid="a9bcaf57-4a7b-11e6-97f7-5453ed2e2b49">
 <topic>p7zip -- heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>p7zip</name>
	<range><lt>15.14_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cisco Talos reports:
	<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0093/">
	 An exploitable heap overflow vulnerability exists in the
	 NArchive::NHfs::CHandler::ExtractZlibFile method functionality of
	 7zip that can lead to arbitrary code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2334</cvename>
 <url>http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html</url>
 </references>
 <dates>
 <discovery>2016-05-11</discovery>
 <entry>2016-07-15</entry>
 </dates>
 </vuln>

<vuln vid="4729c849-4897-11e6-b704-000c292e4fd8">
 <topic>samba -- client side SMB2/3 required signing can be downgraded</topic>
 <affects>
 <package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><le>4.0.26</le></range>
 </package>
 <package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><le>4.1.23</le></range>
 </package>
 <package>
	<name>samba42</name>
	<range><ge>4.2.0</ge><lt>4.2.14</lt></range>
 </package>
 <package>
	<name>samba43</name>
	<range><ge>4.3.0</ge><lt>4.3.11</lt></range>
 </package>
 <package>
	<name>samba44</name>
	<range><ge>4.4.0</ge><lt>4.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samba team reports:
	<blockquote cite="https://www.samba.org/samba/security/CVE-2016-2119.html">
	 A man in the middle attack can disable client signing over
	 SMB2/3, even if enforced by configuration parameters.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2119</cvename>
 <url>https://www.samba.org/samba/security/CVE-2016-2119.html</url>
 </references>
 <dates>
 <discovery>2016-07-07</discovery>
 <entry>2016-07-13</entry>
 </dates>
 </vuln>

<vuln vid="3fcd52b2-4510-11e6-a15f-00248c0c745d">
 <topic>ruby-saml -- XML signature wrapping attack</topic>
 <affects>
 <package>
	<name>rubygem-ruby-saml</name>
	<range><lt>1.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RubySec reports:
	<blockquote cite="http://rubysec.com/advisories/CVE-2016-5697/">
	 ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack
	 in the specific scenario where there was a signature that referenced at the same
	 time 2 elements (but past the scheme validator process since 1 of the element was
	 inside the encrypted assertion).
 ruby-saml users must update to 1.3.0, which implements 3 extra validations to
 mitigate this kind of attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5697</cvename>
 <url>http://rubysec.com/advisories/CVE-2016-5697/</url>
 <url>https://github.com/onelogin/ruby-saml/commit/a571f52171e6bfd87db59822d1d9e8c38fb3b995</url>
 </references>
 <dates>
 <discovery>2016-06-24</discovery>
 <entry>2016-07-08</entry>
 </dates>
 </vuln>

<vuln vid="7d64d00c-43e3-11e6-ab34-002590263bf5">
 <topic>quassel -- remote denial of service</topic>
 <affects>
 <package>
	<name>quassel</name>
	<range><lt>0.12.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4414">
	 The onReadyRead function in core/coreauthhandler.cpp in Quassel
	 before 0.12.4 allows remote attackers to cause a denial of service
	 (NULL pointer dereference and crash) via invalid handshake data.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4414</cvename>
 <url>http://quassel-irc.org/node/129</url>
 <url>https://github.com/quassel/quassel/commit/e678873</url>
 <url>http://www.openwall.com/lists/oss-security/2016/04/30/2</url>
 <url>http://www.openwall.com/lists/oss-security/2016/04/30/4</url>
 </references>
 <dates>
 <discovery>2016-04-24</discovery>
 <entry>2016-07-07</entry>
 </dates>
 </vuln>

<vuln vid="e9d1e040-42c9-11e6-9608-20cf30e32f6d">
 <topic>apache24 -- X509 Client certificate based authentication can be bypassed when HTTP/2 is used</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><ge>2.4.18</ge><lt>2.4.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache Software Foundation reports:
	<blockquote cite="INSERT URL HERE">
	 The Apache HTTPD web server (from 2.4.18-2.4.20) did not validate a X509
	 client certificate correctly when experimental module for the HTTP/2
	 protocol is used to access a resource.
	 The net result is that a resource that should require a valid client
	 certificate in order to get access can be accessed without that credential.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4979</cvename>
 <url>http://mail-archives.apache.org/mod_mbox/httpd-announce/201607.mbox/CVE-2016-4979-68283</url>
 </references>
 <dates>
 <discovery>2016-07-01</discovery>
 <entry>2016-07-05</entry>
 </dates>
 </vuln>

<vuln vid="e800cd4b-4212-11e6-942d-bc5ff45d0f28">
 <topic>xen-tools -- Unrestricted qemu logging</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><lt>4.7.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-180.html">
	 When the libxl toolstack launches qemu for HVM guests, it pipes the
	 output of stderr to a file in /var/log/xen. This output is not
	 rate-limited in any way. The guest can easily cause qemu to print
	 messages to stderr, causing this file to become arbitrarily large.
	 
	 The disk containing the logfile can be exhausted, possibly causing a
	 denial-of-service (DoS).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3672</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-180.html</url>
 </references>
 <dates>
 <discovery>2016-05-23</discovery>
 <entry>2016-07-04</entry>
 </dates>
 </vuln>

<vuln vid="e6ce6f50-4212-11e6-942d-bc5ff45d0f28">
 <topic>xen-tools -- QEMU: Banked access to VGA memory (VBE) uses inconsistent bounds checks</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><lt>4.7.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-179.html">
	 Qemu VGA module allows banked access to video memory using the
	 window at 0xa00000 and it supports different access modes with
	 different address calculations.
	 Qemu VGA module allows guest to edit certain registers in 'vbe'
	 and 'vga' modes.
	 A privileged guest user could use CVE-2016-3710 to exceed the bank
	 address window and write beyond the said memory area, potentially
	 leading to arbitrary code execution with privileges of the Qemu
	 process. If the system is not using stubdomains, this will be in
	 domain 0.
	 A privileged guest user could use CVE-2016-3712 to cause potential
	 integer overflow or OOB read access issues in Qemu, resulting in a DoS
	 of the guest itself. More dangerous effect, such as data leakage or
	 code execution, are not known but cannot be ruled out.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3710</cvename>
 <cvename>CVE-2016-3712</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-179.html</url>
 </references>
 <dates>
 <discovery>2016-05-09</discovery>
 <entry>2016-07-04</entry>
 </dates>
 </vuln>

<vuln vid="e589ae90-4212-11e6-942d-bc5ff45d0f28">
 <topic>xen-tools -- Unsanitised driver domain input in libxl device handling</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><lt>4.7.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-178.html">
	 libxl's device-handling code freely uses and trusts information
	 from the backend directories in xenstore.
	 A malicious driver domain can deny service to management tools.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4963</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-178.html</url>
 </references>
 <dates>
 <discovery>2016-06-02</discovery>
 <entry>2016-07-04</entry>
 </dates>
 </vuln>

<vuln vid="e43b210a-4212-11e6-942d-bc5ff45d0f28">
 <topic>xen-kernel -- x86 software guest page walk PS bit handling flaw</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-176.html">
	 The Page Size (PS) page table entry bit exists at all page table
	 levels other than L1. Its meaning is reserved in L4, and
	 conditionally reserved in L3 and L2 (depending on hardware
	 capabilities). The software page table walker in the hypervisor,
	 however, so far ignored that bit in L4 and (on respective hardware)
	 L3 entries, resulting in pages to be treated as page tables which
	 the guest OS may not have designated as such. If the page in
	 question is writable by an unprivileged user, then that user will
	 be able to map arbitrary guest memory.
	 On vulnerable OSes, guest user mode code may be able to establish
	 mappings of arbitrary memory inside the guest, allowing it to
	 elevate its privileges inside the guest.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4480</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-176.html</url>
 </references>
 <dates>
 <discovery>2016-05-17</discovery>
 <entry>2016-07-04</entry>
 </dates>
 </vuln>

<vuln vid="e2fca11b-4212-11e6-942d-bc5ff45d0f28">
 <topic>xen-tools -- Unsanitised guest input in libxl device handling code</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><lt>4.7.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-175.html">
	 Various parts of libxl device-handling code inappropriately use
	 information from (partially) guest controlled areas of xenstore.
	 A malicious guest administrator can cause denial of service by
	 resource exhaustion.
	 A malicious guest administrator can confuse and/or deny service to
	 management facilities.
	 A malicious guest administrator of a guest configured with channel
	 devices may be able to escalate their privilege to that of the
	 backend domain (i.e., normally, to that of the host).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4962</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-175.html</url>
 </references>
 <dates>
 <discovery>2016-06-02</discovery>
 <entry>2016-07-04</entry>
 </dates>
 </vuln>

<vuln vid="d51ced72-4212-11e6-942d-bc5ff45d0f28">
 <topic>xen-kernel -- x86 shadow pagetables: address width overflow</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><ge>3.4</ge><lt>4.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-173.html">
	 In the x86 shadow pagetable code, the guest frame number of a
	 superpage mapping is stored in a 32-bit field. If a shadowed guest
	 can cause a superpage mapping of a guest-physical address at or
	 above 2^44 to be shadowed, the top bits of the address will be lost,
	 causing an assertion failure or NULL dereference later on, in code
	 that removes the shadow.
	 A HVM guest using shadow pagetables can cause the host to crash.
	 
	 A PV guest using shadow pagetables (i.e. being migrated) with PV
	 superpages enabled (which is not the default) can crash the host, or
	 corrupt hypervisor memory, and so a privilege escalation cannot be
	 ruled out.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3960</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-173.html</url>
 </references>
 <dates>
 <discovery>2016-04-18</discovery>
 <entry>2016-07-04</entry>
 </dates>
 </vuln>

<vuln vid="313e9557-41e8-11e6-ab34-002590263bf5">
 <topic>wireshark -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>wireshark-qt5</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>2.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wireshark development team reports:
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.4.html">
	 The following vulnerabilities have been fixed:
	 <ul>
	 <li>wnpa-sec-2016-29
	 The SPOOLS dissector could go into an infinite loop. Discovered
	 by the CESG.</li>
	 <li>wnpa-sec-2016-30
	 The IEEE 802.11 dissector could crash. (Bug 11585)</li>
	 <li>wnpa-sec-2016-31
	 The IEEE 802.11 dissector could crash. Discovered by Mateusz
	 Jurczyk. (Bug 12175)</li>
	 <li>wnpa-sec-2016-32
	 The UMTS FP dissector could crash. (Bug 12191)</li>
	 <li>wnpa-sec-2016-33
	 Some USB dissectors could crash. Discovered by Mateusz
	 Jurczyk. (Bug 12356)</li>
	 <li>wnpa-sec-2016-34
	 The Toshiba file parser could crash. Discovered by iDefense
	 Labs. (Bug 12394)</li>
	 <li>wnpa-sec-2016-35
	 The CoSine file parser could crash. Discovered by iDefense
	 Labs. (Bug 12395)</li>
	 <li>wnpa-sec-2016-36
	 The NetScreen file parser could crash. Discovered by iDefense
	 Labs. (Bug 12396)</li>
	 <li>wnpa-sec-2016-37
	 The Ethernet dissector could crash. (Bug 12440)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5350</cvename>
 <cvename>CVE-2016-5351</cvename>
 <cvename>CVE-2016-5352</cvename>
 <cvename>CVE-2016-5353</cvename>
 <cvename>CVE-2016-5354</cvename>
 <cvename>CVE-2016-5355</cvename>
 <cvename>CVE-2016-5356</cvename>
 <cvename>CVE-2016-5357</cvename>
 <cvename>CVE-2016-5358</cvename>
 <url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.4.html</url>
 <url>http://www.openwall.com/lists/oss-security/2016/06/09/4</url>
 </references>
 <dates>
 <discovery>2016-06-07</discovery>
 <entry>2016-07-04</entry>
 </dates>
 </vuln>

<vuln vid="8656cf5f-4170-11e6-8dfe-002590263bf5">
 <topic>moodle -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moodle28</name>
	<range><lt>2.8.12</lt></range>
 </package>
 <package>
	<name>moodle29</name>
	<range><lt>2.9.6</lt></range>
 </package>
 <package>
	<name>moodle30</name>
	<range><lt>3.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marina Glancy reports:
	<blockquote cite="https://moodle.org/security/">
	 <ul>
	 <li>MSA-16-0013: Users are able to change profile fields that
	 were locked by the administrator.</li>
	 <li>MSA-16-0015: Information disclosure of hidden forum names
	 and sub-names.</li>
	 <li>MSA-16-0016: User can view badges of other users without
	 proper permissions.</li>
	 <li>MSA-16-0017: Course idnumber not protected from teacher
	 restore.</li>
	 <li>MSA-16-0018: CSRF in script marking forum posts as read.
	 </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3729</cvename>
 <cvename>CVE-2016-3731</cvename>
 <cvename>CVE-2016-3732</cvename>
 <cvename>CVE-2016-3733</cvename>
 <cvename>CVE-2016-3734</cvename>
 <url>https://moodle.org/security/</url>
 </references>
 <dates>
 <discovery>2016-05-18</discovery>
 <entry>2016-07-03</entry>
 </dates>
 </vuln>

<vuln vid="ad9b77f6-4163-11e6-b05b-14dae9d210b8">
 <topic>icingaweb2 -- remote code execution</topic>
 <affects>
 <package>
	<name>icingaweb2</name>
	<range><lt>2.3.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Eric Lippmann reports:
	<blockquote cite="https://www.icinga.org/2016/06/23/icinga-web-2-v2-3-4-v2-2-2-and-v2-1-4-releases/">
	 Possibility of remote code execution via the remote command
	 transport.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.icinga.org/2016/06/23/icinga-web-2-v2-3-4-v2-2-2-and-v2-1-4-releases/</url>
 </references>
 <dates>
 <discovery>2016-06-23</discovery>
 <entry>2016-07-03</entry>
 </dates>
 </vuln>

<vuln vid="a5c204b5-4153-11e6-8dfe-002590263bf5">
 <topic>hive -- authorization logic vulnerability</topic>
 <affects>
 <package>
	<name>hive</name>
	<range><lt>2.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sushanth Sowmyan reports:
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/hive-user/201601.mbox/%3C20160128205008.2154F185EB%40minotaur.apache.org%3E">
	 Some partition-level operations exist that do not explicitly also
	 authorize privileges of the parent table. This can lead to issues when
	 the parent table would have denied the operation, but no denial occurs
	 because the partition-level privilege is not checked by the
	 authorization framework, which defines authorization entities only
	 from the table level upwards.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7521</cvename>
 <url>http://mail-archives.apache.org/mod_mbox/hive-user/201601.mbox/%3C20160128205008.2154F185EB%40minotaur.apache.org%3E</url>
 </references>
 <dates>
 <discovery>2016-01-28</discovery>
 <entry>2016-07-03</entry>
 </dates>
 </vuln>

<vuln vid="546deeea-3fc6-11e6-a671-60a44ce6887b">
 <topic>SQLite3 -- Tempdir Selection Vulnerability</topic>
 <affects>
 <package>
	<name>sqlite3</name>
	<range><lt>3.13.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	KoreLogic security reports:
	<blockquote cite="https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt">
	 Affected versions of SQLite reject potential tempdir locations if
	 they are not readable, falling back to '.'. Thus, SQLite will favor
	 e.g. using cwd for tempfiles on such a system, even if cwd is an
	 unsafe location. Notably, SQLite also checks the permissions of
	 '.', but ignores the results of that check.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-6153</cvename>
 <freebsdpr>ports/209827</freebsdpr>
 <url>https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt</url>
 <url>http://openwall.com/lists/oss-security/2016/07/01/2</url>
 <url>http://www.sqlite.org/cgi/src/info/67985761aa93fb61</url>
 <url>http://www.sqlite.org/cgi/src/info/b38fe522cfc971b3</url>
 <url>http://www.sqlite.org/cgi/src/info/614bb709d34e1148</url>
 </references>
 <dates>
 <discovery>2016-07-01</discovery>
 <entry>2016-07-03</entry>
 </dates>
 </vuln>

<vuln vid="8d5368ef-40fe-11e6-b2ec-b499baebfeaf">
 <topic>Python -- smtplib StartTLS stripping vulnerability</topic>
 <affects>
 <package>
	<name>python27</name>
	<range><lt>2.7.12</lt></range>
 </package>
 <package>
	<name>python33</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>python34</name>
	<range><lt>3.4.5</lt></range>
 </package>
 <package>
	<name>python35</name>
	<range><lt>3.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Red Hat reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0772">
	 A vulnerability in smtplib allowing MITM attacker to perform a
	 startTLS stripping attack. smtplib does not seem to raise an exception
	 when the remote end (smtp server) is capable of negotiating starttls but
	 fails to respond with 220 (ok) to an explicit call of SMTP.starttls().
	 This may allow a malicious MITM to perform a startTLS stripping attack
	 if the client code does not explicitly check the response code for startTLS.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0772</url>
 <cvename>CVE-2016-0772</cvename>
 </references>
 <dates>
 <discovery>2016-06-14</discovery>
 <entry>2016-07-03</entry>
 </dates>
 </vuln>

<vuln vid="e7028e1d-3f9b-11e6-81f9-6805ca0b3d42">
 <topic>phpMyAdmin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><ge>4.6.0</ge><lt>4.6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Please reference CVE/URL list for details
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-17/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-18/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-19/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-20/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-21/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-22/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-23/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-24/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-25/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-26/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-27/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-28/</url>
 <cvename>CVE-2016-5701</cvename>
 <cvename>CVE-2016-5702</cvename>
 <cvename>CVE-2016-5703</cvename>
 <cvename>CVE-2016-5704</cvename>
 <cvename>CVE-2016-5705</cvename>
 <cvename>CVE-2016-5706</cvename>
 <cvename>CVE-2016-5730</cvename>
 <cvename>CVE-2016-5731</cvename>
 <cvename>CVE-2016-5732</cvename>
 <cvename>CVE-2016-5733</cvename>
 <cvename>CVE-2016-5734</cvename>
 <cvename>CVE-2016-5739</cvename>
 </references>
 <dates>
 <discovery>2016-06-23</discovery>
 <entry>2016-07-01</entry>
 </dates>
 </vuln>

<vuln vid="f1c219ba-3f14-11e6-b3c8-14dae9d210b8">
 <topic>haproxy -- denial of service</topic>
 <affects>
 <package>
	<name>haproxy</name>
	<range><ge>1.6.0</ge><lt>1.6.5_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	HAproxy reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/06/09/5">
	 HAproxy 1.6.x before 1.6.6, when a deny comes from a
	 reqdeny rule, allows remote attackers to cause a denial of service
	 (uninitialized memory access and crash) or possibly have unspecified
	 other impact via unknown vectors.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2016/06/09/5</url>
 <cvename>CVE-2016-5360</cvename>
 </references>
 <dates>
 <discovery>2016-06-09</discovery>
 <entry>2016-06-30</entry>
 </dates>
 </vuln>

<vuln vid="093584f2-3f14-11e6-b3c8-14dae9d210b8">
 <topic>libtorrent-rasterbar -- denial of service</topic>
 <affects>
 <package>
	<name>libtorrent-rasterbar</name>
	<range><lt>1.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Brandon Perry reports:
	<blockquote cite="https://github.com/arvidn/libtorrent/issues/780">
	 The parse_chunk_header function in libtorrent before 1.1.1
	 allows remote attackers to cause a denial of service (crash) via a
	 crafted (1) HTTP response or possibly a (2) UPnP broadcast.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/arvidn/libtorrent/issues/780</url>
 <cvename>CVE-2016-5301</cvename>
 </references>
 <dates>
 <discovery>2016-06-03</discovery>
 <entry>2016-06-30</entry>
 </dates>
 </vuln>

<vuln vid="ff76f0e0-3f11-11e6-b3c8-14dae9d210b8">
 <topic>expat2 -- denial of service</topic>
 <affects>
 <package>
	<name>expat</name>
	<range><lt>2.1.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adam Maris reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1344251">
	 It was found that original patch for issues CVE-2015-1283
	 and CVE-2015-2716 used overflow checks that could be optimized out by
	 some compilers applying certain optimization settings, which can cause
	 the vulnerability to remain even after applying the patch.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1344251</url>
 <cvename>CVE-2016-4472</cvename>
 </references>
 <dates>
 <discovery>2016-06-09</discovery>
 <entry>2016-06-30</entry>
 <modified>2016-11-30</modified>
 </dates>
 </vuln>

<vuln vid="875e4cf8-3f0e-11e6-b3c8-14dae9d210b8">
 <topic>dnsmasq -- denial of service</topic>
 <affects>
 <package>
	<name>dnsmasq</name>
	<range><lt>2.76,1</lt></range>
 </package>
 <package>
	<name>dnsmasq-devel</name>
	<range><lt>2.76.0test1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 reports:
	<blockquote cite="http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010479.html">
	 Dnsmasq before 2.76 allows remote servers to cause a denial
	 of service (crash) via a reply with an empty DNS address that has an (1)
	 A or (2) AAAA record defined locally.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010479.html</url>
 <url>http://www.openwall.com/lists/oss-security/2016/06/03/7</url>
 <cvename>CVE-2015-8899</cvename>
 </references>
 <dates>
 <discovery>2016-04-18</discovery>
 <entry>2016-06-30</entry>
 <modified>2016-06-30</modified>
 </dates>
 </vuln>

<vuln vid="a61374fc-3a4d-11e6-a671-60a44ce6887b">
 <topic>Python -- HTTP Header Injection in Python urllib</topic>
 <affects>
 <package>
	<name>python27</name>
	<range><lt>2.7.10</lt></range>
 </package>
 <package>
	<name>python33</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>python34</name>
	<range><lt>3.4.4</lt></range>
 </package>
 <package>
	<name>python35</name>
	<range><lt>3.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Guido Vranken reports:
	<blockquote cite="https://bugs.python.org/issue22928">
	 HTTP header injection in urrlib2/urllib/httplib/http.client with
	 newlines in header values, where newlines have a semantic consequence of
	 denoting the start of an additional header line.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.python.org/issue22928</url>
 <url>http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html</url>
 <url>http://www.openwall.com/lists/oss-security/2016/06/14/7</url>
 <cvename>CVE-2016-5699</cvename>
 </references>
 <dates>
 <discovery>2014-11-24</discovery>
 <entry>2016-06-30</entry>
 <modified>2016-07-04</modified>
 </dates>
 </vuln>

<vuln vid="0ca24682-3f03-11e6-b3c8-14dae9d210b8">
 <topic>openssl -- denial of service</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2_14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177">
	 OpenSSL through 1.0.2h incorrectly uses pointer arithmetic
	 for heap-buffer boundary checks, which might allow remote attackers to
	 cause a denial of service (integer overflow and application crash) or
	 possibly have unspecified other impact by leveraging unexpected malloc
	 behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177</url>
 <url>ihttps://bugzilla.redhat.com/show_bug.cgi?id=1341705</url>
 <url>https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/</url>
 <cvename>CVE-2016-2177</cvename>
 </references>
 <dates>
 <discovery>2016-06-01</discovery>
 <entry>2016-06-30</entry>
 </dates>
 </vuln>

<vuln vid="cbceeb49-3bc7-11e6-8e82-002590263bf5">
 <topic>Apache Commons FileUpload -- denial of service (DoS) vulnerability</topic>
 <affects>
 <package>
	<name>tomcat7</name>
	<range><lt>7.0.70</lt></range>
 </package>
 <package>
	<name>tomcat8</name>
	<range><lt>8.0.36</lt></range>
 </package>
 <package>
	<name>apache-struts</name>
	<range><lt>2.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mark Thomas reports:
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/tomcat-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832%40apache.org%3E">
	 CVE-2016-3092 is a denial of service vulnerability that has been
	 corrected in the Apache Commons FileUpload component. It occurred
	 when the length of the multipart boundary was just below the size of
	 the buffer (4096 bytes) used to read the uploaded file. This caused
	 the file upload process to take several orders of magnitude longer
	 than if the boundary length was the typical tens of bytes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3092</cvename>
 <freebsdpr>ports/209669</freebsdpr>
 <url>http://tomcat.apache.org/security-7.html</url>
 <url>http://tomcat.apache.org/security-8.html</url>
 <url>http://mail-archives.apache.org/mod_mbox/tomcat-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832%40apache.org%3E</url>
 <url>http://jvn.jp/en/jp/JVN89379547/index.html</url>
 </references>
 <dates>
 <discovery>2016-06-20</discovery>
 <entry>2016-06-26</entry>
 <modified>2017-08-10</modified>
 </dates>
 </vuln>

<vuln vid="bfcc23b6-3b27-11e6-8e82-002590263bf5">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.5.3,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adam Silverstein reports:
	<blockquote cite="https://wordpress.org/news/2016/06/wordpress-4-5-3/">
	 WordPress 4.5.3 is now available. This is a security release for
	 all previous versions and we strongly encourage you to update your
	 sites immediately.
	 WordPress versions 4.5.2 and earlier are affected by several
	 security issues: redirect bypass in the customizer, reported by
	 Yassine Aboukir; two different XSS problems via attachment names,
	 reported by Jouko Pynnönenand Divyesh Prajapati; revision history
	 information disclosure, reported independently by John Blackbourn
	 from the WordPress security team and by Dan Moen from the Wordfence
	 Research Team; oEmbed denial of service reported by Jennifer Dodd
	 from Automattic; unauthorized category removal from a post, reported
	 by David Herrera from Alley Interactive; password change via stolen
	 cookie, reported by Michael Adams from the WordPress security team;
	 and some less secure sanitize_file_name edge cases reported by Peter
	 Westwood of the WordPress security team.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5832</cvename>
 <cvename>CVE-2016-5833</cvename>
 <cvename>CVE-2016-5834</cvename>
 <cvename>CVE-2016-5835</cvename>
 <cvename>CVE-2016-5836</cvename>
 <cvename>CVE-2016-5837</cvename>
 <cvename>CVE-2016-5838</cvename>
 <cvename>CVE-2016-5839</cvename>
 <freebsdpr>ports/210480</freebsdpr>
 <freebsdpr>ports/210581</freebsdpr>
 <url>https://wordpress.org/news/2016/06/wordpress-4-5-3/</url>
 <url>http://www.openwall.com/lists/oss-security/2016/06/23/9</url>
 </references>
 <dates>
 <discovery>2016-06-18</discovery>
 <entry>2016-06-25</entry>
 </dates>
 </vuln>

<vuln vid="66d77c58-3b1d-11e6-8e82-002590263bf5">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php55</name>
	<name>php55-gd</name>
	<name>php55-mbstring</name>
	<name>php55-wddx</name>
	<name>php55-zip</name>
	<range><lt>5.5.37</lt></range>
 </package>
 <package>
	<name>php56</name>
	<name>php56-gd</name>
	<name>php56-mbstring</name>
	<name>php56-phar</name>
	<name>php56-wddx</name>
	<name>php56-zip</name>
	<range><lt>5.6.23</lt></range>
 </package>
 <package>
	<name>php70</name>
	<name>php70-gd</name>
	<name>php70-mbstring</name>
	<name>php70-phar</name>
	<name>php70-wddx</name>
	<name>php70-zip</name>
	<range><lt>7.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP Group reports:
	<blockquote cite="http://php.net/ChangeLog-5.php#5.5.37">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8874</cvename>
 <cvename>CVE-2016-5766</cvename>
 <cvename>CVE-2016-5767</cvename>
 <cvename>CVE-2016-5768</cvename>
 <cvename>CVE-2016-5769</cvename>
 <cvename>CVE-2016-5770</cvename>
 <cvename>CVE-2016-5771</cvename>
 <cvename>CVE-2016-5772</cvename>
 <cvename>CVE-2016-5773</cvename>
 <freebsdpr>ports/210491</freebsdpr>
 <freebsdpr>ports/210502</freebsdpr>
 <url>http://php.net/ChangeLog-5.php#5.5.37</url>
 <url>http://php.net/ChangeLog-5.php#5.6.23</url>
 <url>http://php.net/ChangeLog-7.php#7.0.8</url>
 </references>
 <dates>
 <discovery>2016-06-23</discovery>
 <entry>2016-06-25</entry>
 </dates>
 </vuln>

<vuln vid="4a0d9b53-395d-11e6-b3c8-14dae9d210b8">
 <topic>libarchive -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libarchive</name>
	<range><lt>3.2.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hanno Bock and Cisco Talos report:
	<blockquote cite="http://openwall.com/lists/oss-security/2016/06/23/6">
	 <ul>
	 <li>Out of bounds heap read in RAR parser</li>
	 <li>Signed integer overflow in ISO parser</li>
	 <li>TALOS-2016-0152 [CVE-2016-4300]: 7-Zip
	 read_SubStreamsInfo Integer Overflow</li>
	 <li>TALOS-2016-0153 [CVE-2016-4301]: mtree parse_device Stack
	 Based Buffer Overflow</li>
	 <li>TALOS-2016-0154 [CVE-2016-4302]: Libarchive Rar RestartModel
	 Heap Overflow</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://openwall.com/lists/oss-security/2016/06/23/6</url>
 <url>https://github.com/libarchive/libarchive/issues/521</url>
 <url>https://github.com/libarchive/libarchive/issues/717#event-697151157</url>
 <url>http://blog.talosintel.com/2016/06/the-poisoned-archives.html</url>
 <cvename>CVE-2015-8934</cvename>
 <cvename>CVE-2016-4300</cvename>
 <cvename>CVE-2016-4301</cvename>
 <cvename>CVE-2016-4302</cvename>
 </references>
 <dates>
 <discovery>2016-06-23</discovery>
 <entry>2016-06-23</entry>
 </dates>
 </vuln>

<vuln vid="22775cdd-395a-11e6-b3c8-14dae9d210b8">
 <topic>piwik -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>piwik</name>
	<range><lt>2.16.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Piwik reports:
	<blockquote cite="http://piwik.org/changelog/piwik-2-16-1/">
	 The Piwik Security team is grateful for the responsible
	 disclosures by our security researchers: Egidio Romano (granted a
	 critical security bounty), James Kettle and Paweł Bartunek (XSS) and
	 Emanuel Bronshtein (limited XSS).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://piwik.org/changelog/piwik-2-16-1/</url>
 </references>
 <dates>
 <discovery>2016-04-11</discovery>
 <entry>2016-06-23</entry>
 </dates>
 </vuln>

<vuln vid="6df56c60-3738-11e6-a671-60a44ce6887b">
 <topic>wget -- HTTP to FTP redirection file name confusion vulnerability</topic>
 <affects>
 <package>
	<name>wget</name>
	<range><lt>1.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Giuseppe Scrivano reports:
	<blockquote cite="http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html">
	 On a server redirect from HTTP to a FTP resource, wget would trust the
	 HTTP server and uses the name in the redirected URL as the destination
	 filename.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html</url>
 <cvename>CVE-2016-4971</cvename>
 </references>
 <dates>
 <discovery>2016-06-09</discovery>
 <entry>2016-06-21</entry>
 </dates>
 </vuln>

<vuln vid="1a2aa04f-3718-11e6-b3c8-14dae9d210b8">
 <topic>libxslt -- Denial of Service</topic>
 <affects>
 <package>
	<name>libxslt</name>
	<range><lt>1.1.29</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google reports:
	<blockquote cite="http://seclists.org/bugtraq/2016/Jun/81">
	 <ul>
	 <li>[583156] Medium CVE-2016-1683: Out-of-bounds access in libxslt.
	 Credit to Nicolas Gregoire.</li>
	 <li>[583171] Medium CVE-2016-1684: Integer overflow in libxslt.
	 Credit to Nicolas Gregoire.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html</url>
 <cvename>CVE-2016-1683</cvename>
 <cvename>CVE-2016-1684</cvename>
 </references>
 <dates>
 <discovery>2016-05-25</discovery>
 <entry>2016-06-20</entry>
 </dates>
 </vuln>

<vuln vid="0e3dfdde-35c4-11e6-8e82-002590263bf5">
 <topic>flash -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.626</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-18.html">
	 These updates resolve type confusion vulnerabilities that could
	 lead to code execution (CVE-2016-4144, CVE-2016-4149).
	 These updates resolve use-after-free vulnerabilities that could
	 lead to code execution (CVE-2016-4142, CVE-2016-4143, CVE-2016-4145,
	 CVE-2016-4146, CVE-2016-4147, CVE-2016-4148).
	 These updates resolve heap buffer overflow vulnerabilities that
	 could lead to code execution (CVE-2016-4135, CVE-2016-4136,
	 CVE-2016-4138).
	 These updates resolve memory corruption vulnerabilities that could
	 lead to code execution (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,
	 CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129,
	 CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133,
	 CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150,
	 CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154,
	 CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171).
	 These updates resolve a vulnerability in the directory search path
	 used to find resources that could lead to code execution
	 (CVE-2016-4140).
	 These updates resolve a vulnerability that could be exploited to
	 bypass the same-origin-policy and lead to information disclosure
	 (CVE-2016-4139).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4122</cvename>
 <cvename>CVE-2016-4123</cvename>
 <cvename>CVE-2016-4124</cvename>
 <cvename>CVE-2016-4125</cvename>
 <cvename>CVE-2016-4127</cvename>
 <cvename>CVE-2016-4128</cvename>
 <cvename>CVE-2016-4129</cvename>
 <cvename>CVE-2016-4130</cvename>
 <cvename>CVE-2016-4131</cvename>
 <cvename>CVE-2016-4132</cvename>
 <cvename>CVE-2016-4133</cvename>
 <cvename>CVE-2016-4134</cvename>
 <cvename>CVE-2016-4135</cvename>
 <cvename>CVE-2016-4136</cvename>
 <cvename>CVE-2016-4137</cvename>
 <cvename>CVE-2016-4138</cvename>
 <cvename>CVE-2016-4139</cvename>
 <cvename>CVE-2016-4140</cvename>
 <cvename>CVE-2016-4141</cvename>
 <cvename>CVE-2016-4142</cvename>
 <cvename>CVE-2016-4143</cvename>
 <cvename>CVE-2016-4144</cvename>
 <cvename>CVE-2016-4145</cvename>
 <cvename>CVE-2016-4146</cvename>
 <cvename>CVE-2016-4147</cvename>
 <cvename>CVE-2016-4148</cvename>
 <cvename>CVE-2016-4149</cvename>
 <cvename>CVE-2016-4150</cvename>
 <cvename>CVE-2016-4151</cvename>
 <cvename>CVE-2016-4152</cvename>
 <cvename>CVE-2016-4153</cvename>
 <cvename>CVE-2016-4154</cvename>
 <cvename>CVE-2016-4155</cvename>
 <cvename>CVE-2016-4156</cvename>
 <cvename>CVE-2016-4166</cvename>
 <cvename>CVE-2016-4171</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb16-18.html</url>
 </references>
 <dates>
 <discovery>2016-06-16</discovery>
 <entry>2016-06-19</entry>
 </dates>
 </vuln>

<vuln vid="0c6b008d-35c4-11e6-8e82-002590263bf5">
 <topic>flash -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.621</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-15.html">
	 These updates resolve type confusion vulnerabilities that could
	 lead to code execution (CVE-2016-1105, CVE-2016-4117).
	 These updates resolve use-after-free vulnerabilities that could
	 lead to code execution (CVE-2016-1097, CVE-2016-1106, CVE-2016-1107,
	 CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,
	 CVE-2016-4110, CVE-2016-4121).
	 These updates resolve a heap buffer overflow vulnerability that
	 could lead to code execution (CVE-2016-1101).
	 These updates resolve a buffer overflow vulnerability that could
	 lead to code execution (CVE-2016-1103).
	 These updates resolve memory corruption vulnerabilities that could
	 lead to code execution (CVE-2016-1096, CVE-2016-1098, CVE-2016-1099,
	 CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109,
	 CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,
	 CVE-2016-4115, CVE-2016-4120, CVE-2016-4160, CVE-2016-4161,
	 CVE-2016-4162, CVE-2016-4163).
	 These updates resolve a vulnerability in the directory search path
	 used to find resources that could lead to code execution
	 (CVE-2016-4116).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1096</cvename>
 <cvename>CVE-2016-1097</cvename>
 <cvename>CVE-2016-1098</cvename>
 <cvename>CVE-2016-1099</cvename>
 <cvename>CVE-2016-1100</cvename>
 <cvename>CVE-2016-1101</cvename>
 <cvename>CVE-2016-1102</cvename>
 <cvename>CVE-2016-1103</cvename>
 <cvename>CVE-2016-1104</cvename>
 <cvename>CVE-2016-1105</cvename>
 <cvename>CVE-2016-1106</cvename>
 <cvename>CVE-2016-1107</cvename>
 <cvename>CVE-2016-1108</cvename>
 <cvename>CVE-2016-1109</cvename>
 <cvename>CVE-2016-1110</cvename>
 <cvename>CVE-2016-4108</cvename>
 <cvename>CVE-2016-4109</cvename>
 <cvename>CVE-2016-4110</cvename>
 <cvename>CVE-2016-4111</cvename>
 <cvename>CVE-2016-4112</cvename>
 <cvename>CVE-2016-4113</cvename>
 <cvename>CVE-2016-4114</cvename>
 <cvename>CVE-2016-4115</cvename>
 <cvename>CVE-2016-4116</cvename>
 <cvename>CVE-2016-4117</cvename>
 <cvename>CVE-2016-4120</cvename>
 <cvename>CVE-2016-4121</cvename>
 <cvename>CVE-2016-4160</cvename>
 <cvename>CVE-2016-4161</cvename>
 <cvename>CVE-2016-4162</cvename>
 <cvename>CVE-2016-4163</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb16-15.html</url>
 </references>
 <dates>
 <discovery>2016-05-12</discovery>
 <entry>2016-06-19</entry>
 </dates>
 </vuln>

<vuln vid="07888b49-35c4-11e6-8e82-002590263bf5">
 <topic>flash -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.616</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-10.html">
	 These updates harden a mitigation against JIT spraying attacks that
	 could be used to bypass memory layout randomization mitigations
	 (CVE-2016-1006).
	 These updates resolve type confusion vulnerabilities that could
	 lead to code execution (CVE-2016-1015, CVE-2016-1019).
	 These updates resolve use-after-free vulnerabilities that could
	 lead to code execution (CVE-2016-1011, CVE-2016-1013, CVE-2016-1016,
	 CVE-2016-1017, CVE-2016-1031).
	 These updates resolve memory corruption vulnerabilities that could
	 lead to code execution (CVE-2016-1012, CVE-2016-1020, CVE-2016-1021,
	 CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025,
	 CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029,
	 CVE-2016-1032, CVE-2016-1033).
	 These updates resolve a stack overflow vulnerability that could
	 lead to code execution (CVE-2016-1018).
	 These updates resolve a security bypass vulnerability
	 (CVE-2016-1030).
	 These updates resolve a vulnerability in the directory search path
	 used to find resources that could lead to code execution
	 (CVE-2016-1014).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1006</cvename>
 <cvename>CVE-2016-1011</cvename>
 <cvename>CVE-2016-1012</cvename>
 <cvename>CVE-2016-1013</cvename>
 <cvename>CVE-2016-1014</cvename>
 <cvename>CVE-2016-1015</cvename>
 <cvename>CVE-2016-1016</cvename>
 <cvename>CVE-2016-1017</cvename>
 <cvename>CVE-2016-1018</cvename>
 <cvename>CVE-2016-1019</cvename>
 <cvename>CVE-2016-1020</cvename>
 <cvename>CVE-2016-1021</cvename>
 <cvename>CVE-2016-1022</cvename>
 <cvename>CVE-2016-1023</cvename>
 <cvename>CVE-2016-1024</cvename>
 <cvename>CVE-2016-1025</cvename>
 <cvename>CVE-2016-1026</cvename>
 <cvename>CVE-2016-1027</cvename>
 <cvename>CVE-2016-1028</cvename>
 <cvename>CVE-2016-1029</cvename>
 <cvename>CVE-2016-1030</cvename>
 <cvename>CVE-2016-1031</cvename>
 <cvename>CVE-2016-1032</cvename>
 <cvename>CVE-2016-1033</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb16-10.html</url>
 </references>
 <dates>
 <discovery>2016-04-07</discovery>
 <entry>2016-06-19</entry>
 </dates>
 </vuln>

<vuln vid="d59ebed4-34be-11e6-be25-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>51.0.2704.103</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="https://googlechromereleases.blogspot.nl/2016/06/stable-channel-update_16.html">
	 3 security fixes in this release, including:
	 <ul>
	 <li>[620742] CVE-2016-1704: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1704</cvename>
 <url>https://googlechromereleases.blogspot.nl/2016/06/stable-channel-update_16.html</url>
 </references>
 <dates>
 <discovery>2016-06-16</discovery>
 <entry>2016-06-17</entry>
 </dates>
 </vuln>

<vuln vid="1d0f6852-33d8-11e6-a671-60a44ce6887b">
 <topic>Python -- Integer overflow in zipimport module</topic>
 <affects>
 <package>
 <name>python35</name>
 <range><lt>3.5.1_3</lt></range>
 </package>
 <package>
 <name>python34</name>
 <range><lt>3.4.4_3</lt></range>
 </package>
 <package>
 <name>python33</name>
 <range><lt>3.3.6_5</lt></range>
 </package>
 <package>
 <name>python27</name>
 <range><lt>2.7.11_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Python reports:
 <blockquote cite="http://bugs.python.org/issue26171">
 Possible integer overflow and heap corruption in
 zipimporter.get_data()
 </blockquote>
 </body>
 </description>
 <references>
 <url>http://bugs.python.org/issue26171</url>
 <cvename>CVE-2016-5636</cvename>
 </references>
 <dates>
 <discovery>2016-01-21</discovery>
 <entry>2016-06-17</entry>
 </dates>
 </vuln>

<vuln vid="7932548e-3427-11e6-8e82-002590263bf5">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.44</lt></range>
 </package>
 <package>
	<name>drupal8</name>
	<range><lt>8.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/SA-CORE-2016-002">
	 <ul>
	 <li>Saving user accounts can sometimes grant the user all roles
	 (User module - Drupal 7 - Moderately Critical)</li>
	 <li>Views can allow unauthorized users to see Statistics
	 information (Views module - Drupal 8 - Less Critical)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-6211</cvename>
 <cvename>CVE-2016-6212</cvename>
 <url>https://www.drupal.org/SA-CORE-2016-002</url>
 <url>http://www.openwall.com/lists/oss-security/2016/07/13/7</url>
 </references>
 <dates>
 <discovery>2016-06-15</discovery>
 <entry>2016-06-17</entry>
 <modified>2016-07-16</modified>
 </dates>
 </vuln>

<vuln vid="ac0900df-31d0-11e6-8e82-002590263bf5">
 <topic>botan -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>botan110</name>
	<range><lt>1.10.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jack Lloyd reports:
	<blockquote cite="https://lists.randombit.net/pipermail/botan-devel/2016-April/002101.html">
	 Botan 1.10.13 has been released backporting some side channel
	 protections for ECDSA signatures (CVE-2016-2849) and PKCS #1 RSA
	 decryption (CVE-2015-7827).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2849</cvename>
 <cvename>CVE-2015-7827</cvename>
 <url>https://lists.randombit.net/pipermail/botan-devel/2016-April/002101.html</url>
 </references>
 <dates>
 <discovery>2016-04-28</discovery>
 <entry>2016-06-14</entry>
 </dates>
 </vuln>

<vuln vid="f771880c-31cf-11e6-8e82-002590263bf5">
 <topic>botan -- cryptographic vulnerability</topic>
 <affects>
 <package>
	<name>botan110</name>
	<range><lt>1.10.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9742">
	 The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x
	 before 1.11.9 improperly uses a single random base, which makes it
	 easier for remote attackers to defeat cryptographic protection
	 mechanisms via a DH group.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-9742</cvename>
 </references>
 <dates>
 <discovery>2014-04-11</discovery>
 <entry>2016-06-14</entry>
 </dates>
 </vuln>

<vuln vid="6d402857-2fba-11e6-9f31-5404a68ad561">
 <topic>VLC -- Possibly remote code execution via crafted file</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><lt>2.2.4,4</lt></range>
 </package>
 <package>
	<name>vlc-qt4</name>
	<range><lt>2.2.4,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The VLC project reports:
	<blockquote cite="https://www.videolan.org/developers/vlc-branch/NEWS">
	 Fix out-of-bound write in adpcm QT IMA codec (CVE-2016-5108)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5108</cvename>
 </references>
 <dates>
 <discovery>2016-05-25</discovery>
 <entry>2016-06-11</entry>
 </dates>
 </vuln>

<vuln vid="97e86d10-2ea7-11e6-ae88-002590263bf5">
 <topic>roundcube -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><lt>1.1.5_1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Roundcube reports:
	<blockquote cite="https://github.com/roundcube/roundcubemail/wiki/Changelog">
	 Fix XSS issue in href attribute on area tag (#5240).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5103</cvename>
 <freebsdpr>ports/209841</freebsdpr>
 <url>https://github.com/roundcube/roundcubemail/issues/5240</url>
 <url>http://seclists.org/oss-sec/2016/q2/414</url>
 </references>
 <dates>
 <discovery>2016-05-06</discovery>
 <entry>2016-06-10</entry>
 </dates>
 </vuln>

<vuln vid="6f0529e2-2e82-11e6-b2ec-b499baebfeaf">
 <topic>OpenSSL -- vulnerability in DSA signing</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2_13</lt></range>
 </package>
 <package>
	<name>libressl</name>
	<range><lt>2.2.9</lt></range>
	<range><ge>2.3.0</ge><lt>2.3.6</lt></range>
 </package>
 <package>
	<name>libressl-devel</name>
	<range><lt>2.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL team reports:
	<blockquote cite="https://git.openssl.org/?p=openssl.git;a=commit;h=399944622df7bd81af62e67ea967c470534090e2">
	 Operations in the DSA signing algorithm should run in constant time
	 in order to avoid side channel attacks. A flaw in the OpenSSL DSA
	 implementation means that a non-constant time codepath is followed for
	 certain operations. This has been demonstrated through a cache-timing
	 attack to be sufficient for an attacker to recover the private DSA key.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://git.openssl.org/?p=openssl.git;a=commit;h=399944622df7bd81af62e67ea967c470534090e2</url>
 <cvename>CVE-2016-2178</cvename>
 </references>
 <dates>
 <discovery>2016-06-09</discovery>
 <entry>2016-06-09</entry>
 <modified>2016-12-20</modified>
 </dates>
 </vuln>

<vuln vid="c9c252f5-2def-11e6-ae88-002590263bf5">
 <topic>expat -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>expat</name>
	<range><lt>2.1.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sebastian Pipping reports:
	<blockquote cite="https://sourceforge.net/p/expat/code_git/ci/07cc2fcacf81b32b2e06aa918df51756525240c0/">
	 CVE-2012-6702 -- Resolve troublesome internal call to srand that
	 was introduced with Expat 2.1.0 when addressing CVE-2012-0876
	 (issue #496)
	 CVE-2016-5300 -- Use more entropy for hash initialization than the
	 original fix to CVE-2012-0876.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-6702</cvename>
 <cvename>CVE-2016-5300</cvename>
 <freebsdpr>ports/210155</freebsdpr>
 <url>https://sourceforge.net/p/expat/code_git/ci/07cc2fcacf81b32b2e06aa918df51756525240c0/</url>
 <url>http://www.openwall.com/lists/oss-security/2016/03/18/3</url>
 </references>
 <dates>
 <discovery>2016-03-18</discovery>
 <entry>2016-06-09</entry>
 <modified>2016-11-06</modified>
 </dates>
 </vuln>

<vuln vid="d6bbf2d8-2cfc-11e6-800b-080027468580">
 <topic>iperf3 -- buffer overflow</topic>
 <affects>
 <package>
	<name>iperf3</name>
	<range><ge>3.1</ge><lt>3.1.3</lt></range>
	<range><ge>3.0</ge><lt>3.0.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ESnet reports:
	<blockquote cite="https://raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.asc">
	 A malicious process can connect to an iperf3 server and,
	 by sending a malformed message on the control channel,
	 corrupt the server process's heap area. This can lead to a
	 crash (and a denial of service), or theoretically a remote
	 code execution as the user running the iperf3 server. A
	 malicious iperf3 server could potentially mount a similar
	 attack on an iperf3 client.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4303</cvename>
 <url>https://raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.asc</url>
 </references>
 <dates>
 <discovery>2016-06-08</discovery>
 <entry>2016-06-08</entry>
 </dates>
 </vuln>

<vuln vid="9c196cfd-2ccc-11e6-94b0-0011d823eebd">
 <topic>gnutls -- file overwrite by setuid programs</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><ge>3.4.12</ge><lt>3.4.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	gnutls.org reports:
	<blockquote cite="https://gnutls.org/security.html#GNUTLS-SA-2016-1">
	 Setuid programs using GnuTLS 3.4.12 could potentially allow an
	 attacker to overwrite and corrupt arbitrary files in the
	 filesystem.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://gnutls.org/security.html#GNUTLS-SA-2016-1</url>
 </references>
 <dates>
 <discovery>2016-06-06</discovery>
 <entry>2016-06-07</entry>
 </dates>
 </vuln>

<vuln vid="32166082-53fa-41fa-b081-207e7a989a0a">
 <topic>NSS -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>nss</name>
	<range><lt>3.23</lt></range>
 </package>
 <package>
	<name>linux-c6-nss</name>
	<name>linux-c7-nss</name>
	<range><lt>3.21.3</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.44</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-61/">
	 Mozilla has updated the version of Network Security
	 Services (NSS) library used in Firefox to NSS 3.23. This
	 addresses four moderate rated networking security issues
	 reported by Mozilla engineers Tyson Smith and Jed Davis.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2834</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-61/</url>
 <url>https://hg.mozilla.org/projects/nss/rev/1ba7cd83c672</url>
 <url>https://hg.mozilla.org/projects/nss/rev/8d78a5ae260a</url>
 <url>https://hg.mozilla.org/projects/nss/rev/5fde729fdbff</url>
 <url>https://hg.mozilla.org/projects/nss/rev/329932eb1700</url>
 </references>
 <dates>
 <discovery>2016-06-07</discovery>
 <entry>2016-06-07</entry>
 <modified>2016-11-23</modified>
 </dates>
 </vuln>

<vuln vid="8065d37b-8e7c-4707-a608-1b0a2b8509c3">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>47.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.44</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>45.2.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>45.2.0,2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>45.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox47">
	MFSA 2016-49 Miscellaneous memory safety hazards (rv:47.0 /
	 rv:45.2)
	MFSA 2016-50 Buffer overflow parsing HTML5 fragments
	MFSA 2016-51 Use-after-free deleting tables from a
	 contenteditable document
	MFSA 2016-52 Addressbar spoofing though the SELECT element
	MFSA 2016-54 Partial same-origin-policy through setting
	 location.host through data URI
	MFSA 2016-56 Use-after-free when textures are used in WebGL
	 operations after recycle pool destruction
	MFSA 2016-57 Incorrect icon displayed on permissions
	 notifications
	MFSA 2016-58 Entering fullscreen and persistent pointerlock
	 without user permission
	MFSA 2016-59 Information disclosure of disabled plugins
	 through CSS pseudo-classes
	MFSA 2016-60 Java applets bypass CSP protections
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2815</cvename>
 <cvename>CVE-2016-2818</cvename>
 <cvename>CVE-2016-2819</cvename>
 <cvename>CVE-2016-2821</cvename>
 <cvename>CVE-2016-2822</cvename>
 <cvename>CVE-2016-2825</cvename>
 <cvename>CVE-2016-2828</cvename>
 <cvename>CVE-2016-2829</cvename>
 <cvename>CVE-2016-2831</cvename>
 <cvename>CVE-2016-2832</cvename>
 <cvename>CVE-2016-2833</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-49/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-50/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-51/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-52/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-54/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-56/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-57/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-58/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-59/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-60/</url>
 </references>
 <dates>
 <discovery>2016-06-07</discovery>
 <entry>2016-06-07</entry>
 </dates>
 </vuln>

<vuln vid="c039a761-2c29-11e6-8912-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>51.0.2704.79</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/06/stable-channel-update.html">
	 15 security fixes in this release, including:
	 <ul>
	 <li>601073] High CVE-2016-1696: Cross-origin bypass in Extension
	 bindings. Credit to anonymous.</li>
	 <li>[613266] High CVE-2016-1697: Cross-origin bypass in Blink.
	 Credit to Mariusz Mlynski.</li>
	 <li>[603725] Medium CVE-2016-1698: Information leak in Extension
	 bindings. Credit to Rob Wu.</li>
	 <li>[607939] Medium CVE-2016-1699: Parameter sanitization failure
	 in DevTools. Credit to Gregory Panakkal.</li>
	 <li>[608104] Medium CVE-2016-1700: Use-after-free in Extensions.
	 Credit to Rob Wu.</li>
	 <li>[608101] Medium CVE-2016-1701: Use-after-free in Autofill.
	 Credit to Rob Wu.</li>
	 <li>[609260] Medium CVE-2016-1702: Out-of-bounds read in Skia.
	 Credit to cloudfuzzer.</li>
	 <li>[616539] CVE-2016-1703: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1695</cvename>
 <cvename>CVE-2016-1696</cvename>
 <cvename>CVE-2016-1697</cvename>
 <cvename>CVE-2016-1698</cvename>
 <cvename>CVE-2016-1699</cvename>
 <cvename>CVE-2016-1700</cvename>
 <cvename>CVE-2016-1701</cvename>
 <cvename>CVE-2016-1702</cvename>
 <cvename>CVE-2016-1703</cvename>
 <url>http://googlechromereleases.blogspot.nl/2016/06/stable-channel-update.html</url>
 </references>
 <dates>
 <discovery>2016-06-01</discovery>
 <entry>2016-06-06</entry>
 </dates>
 </vuln>

<vuln vid="bcbd3fe0-2b46-11e6-ae88-002590263bf5">
 <topic>openafs -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openafs</name>
	<range><lt>1.6.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenAFS development team reports:
	<blockquote cite="http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt">
	 Foreign users can bypass access controls to create groups as
	 system:administrators, including in the user namespace and the
	 system: namespace.
	</blockquote>
	<blockquote cite="http://www.openafs.org/pages/security/OPENAFS-SA-2016-002.txt">
	 The contents of uninitialized memory are sent on the wire when
	 clients perform certain RPCs. Depending on the RPC, the information
	 leaked may come from kernel memory or userspace.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2860</cvename>
 <cvename>CVE-2016-4536</cvename>
 <freebsdpr>ports/209534</freebsdpr>
 <url>http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt</url>
 <url>http://www.openafs.org/pages/security/OPENAFS-SA-2016-002.txt</url>
 </references>
 <dates>
 <discovery>2016-03-16</discovery>
 <entry>2016-06-05</entry>
 </dates>
 </vuln>

<vuln vid="2e8fe57e-2b46-11e6-ae88-002590263bf5">
 <topic>openafs -- local DoS vulnerability</topic>
 <affects>
 <package>
	<name>openafs</name>
	<range><lt>1.6.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenAFS development team reports:
	<blockquote cite="https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16">
	 Avoid a potential denial of service issue, by fixing a bug in
	 pioctl logic that allowed a local user to overrun a kernel buffer
	 with a single NUL byte.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8312</cvename>
 <url>https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16</url>
 </references>
 <dates>
 <discovery>2016-03-16</discovery>
 <entry>2016-06-05</entry>
 </dates>
 </vuln>

<vuln vid="0297b260-2b3b-11e6-ae88-002590263bf5">
 <topic>ikiwiki -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>ikiwiki</name>
	<range><lt>3.20160509</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4561">
	 Cross-site scripting (XSS) vulnerability in the cgierror function
	 in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers
	 to inject arbitrary web script or HTML via unspecified vectors
	 involving an error message.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4561</cvename>
 <freebsdpr>ports/209593</freebsdpr>
 </references>
 <dates>
 <discovery>2016-05-04</discovery>
 <entry>2016-06-05</entry>
 </dates>
 </vuln>

<vuln vid="65bb1858-27de-11e6-b714-74d02b9a84d5">
 <topic>h2o -- use after free on premature connection close</topic>
 <affects>
 <package>
	<name>h2o</name>
	<range><lt>1.7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Newsha reports:
	<blockquote cite="http://h2o.examp1e.net/vulnerabilities.html">
	 When H2O tries to disconnect a premature HTTP/2 connection, it
	 calls free(3) to release memory allocated for the connection and
	 immediately after then touches the memory. No malloc-related
	 operation is performed by the same thread between the time it calls
	 free and the time the memory is touched. Fixed by Frederik
	 Deweerdt.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://h2o.examp1e.net/vulnerabilities.html</url>
 </references>
 <dates>
 <discovery>2016-05-17</discovery>
 <entry>2016-06-01</entry>
 </dates>
 </vuln>

<vuln vid="36cf7670-2774-11e6-af29-f0def16c5c1b">
 <topic>nginx -- a specially crafted request might result in worker process crash</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><ge>1.4.0</ge><lt>1.8.1_3,2</lt></range>
	<range><ge>1.10.0,2</ge><lt>1.10.1,2</lt></range>
 </package>
 <package>
	<name>nginx-devel</name>
	<range><ge>1.3.9</ge><lt>1.9.15_1</lt></range>
	<range><ge>1.10.0</ge><lt>1.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Maxim Dounin reports:
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html">
	 A problem was identified in nginx code responsible for saving
	 client request body to a temporary file. A specially crafted
	 request might result in worker process crash due to a NULL
	 pointer dereference while writing client request body to a
	 temporary file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html</url>
 <cvename>CVE-2016-4450</cvename>
 </references>
 <dates>
 <discovery>2016-05-31</discovery>
 <entry>2016-05-31</entry>
 <modified>2016-06-05</modified>
 </dates>
 </vuln>

<vuln vid="6167b341-250c-11e6-a6fb-003048f2e514">
 <topic>cacti -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>0.8.8h</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Cacti Group, Inc. reports:
	<blockquote cite="http://www.cacti.net/release_notes_0_8_8h.php">
	 Changelog
	 <ul>
	 <li>bug:0002667: Cacti SQL Injection Vulnerability</li>
	 <li>bug:0002673: CVE-2016-3659 - Cacti graph_view.php SQL Injection
	 Vulnerability</li>
	 <li>bug:0002656: Authentication using web authentication as a user
	 not in the cacti database allows complete access (regression)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3659</cvename>
 <url>http://www.cacti.net/release_notes_0_8_8h.php</url>
 <url>http://bugs.cacti.net/view.php?id=2673</url>
 <url>http://seclists.org/fulldisclosure/2016/Apr/4</url>
 <url>http://packetstormsecurity.com/files/136547/Cacti-0.8.8g-SQL-Injection.html</url>
 </references>
 <dates>
 <discovery>2016-04-04</discovery>
 <entry>2016-05-28</entry>
 </dates>
 </vuln>

<vuln vid="b53bbf58-257f-11e6-9f4d-20cf30e32f6d">
 <topic>openvswitch -- MPLS buffer overflow</topic>
 <affects>
 <package>
	<name>openvswitch</name>
	<range><ge>2.2.0</ge><lt>2.3.3</lt></range>
	<range><ge>2.4.0</ge><lt>2.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Open vSwitch reports:
	<blockquote cite="http://openvswitch.org/pipermail/announce/2016-March/000082.html">
	 Multiple versions of Open vSwitch are vulnerable to remote buffer
	 overflow attacks, in which crafted MPLS packets could overflow the
	 buffer reserved for MPLS labels in an OVS internal data structure.
	 The MPLS packets that trigger the vulnerability and the potential for
	 exploitation vary depending on version:
	Open vSwitch 2.1.x and earlier are not vulnerable.
	In Open vSwitch 2.2.x and 2.3.x, the MPLS buffer overflow can be
	 exploited for arbitrary remote code execution.
	In Open vSwitch 2.4.x, the MPLS buffer overflow does not obviously lead
	 to a remote code execution exploit, but testing shows that it can allow a
	 remote denial of service. See the mitigation section for details.
	Open vSwitch 2.5.x is not vulnerable.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2074</cvename>
 <url>http://openvswitch.org/pipermail/announce/2016-March/000082.html</url>
 <url>http://openvswitch.org/pipermail/announce/2016-March/000083.html</url>
 </references>
 <dates>
 <discovery>2016-03-28</discovery>
 <entry>2016-05-29</entry>
 <modified>2016-07-03</modified>
 </dates>
 </vuln>

<vuln vid="1a6bbb95-24b8-11e6-bd31-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>51.0.2704.63</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update_25.html">
	 42 security fixes in this release
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1672</cvename>
 <cvename>CVE-2016-1673</cvename>
 <cvename>CVE-2016-1674</cvename>
 <cvename>CVE-2016-1675</cvename>
 <cvename>CVE-2016-1672</cvename>
 <cvename>CVE-2016-1677</cvename>
 <cvename>CVE-2016-1678</cvename>
 <cvename>CVE-2016-1679</cvename>
 <cvename>CVE-2016-1680</cvename>
 <cvename>CVE-2016-1681</cvename>
 <cvename>CVE-2016-1682</cvename>
 <cvename>CVE-2016-1685</cvename>
 <cvename>CVE-2016-1686</cvename>
 <cvename>CVE-2016-1687</cvename>
 <cvename>CVE-2016-1688</cvename>
 <cvename>CVE-2016-1689</cvename>
 <cvename>CVE-2016-1690</cvename>
 <cvename>CVE-2016-1691</cvename>
 <cvename>CVE-2016-1692</cvename>
 <cvename>CVE-2016-1693</cvename>
 <cvename>CVE-2016-1694</cvename>
 <cvename>CVE-2016-1695</cvename>
 <url>http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update_25.html</url>
 </references>
 <dates>
 <discovery>2016-05-25</discovery>
 <entry>2016-05-28</entry>
 <modified>2016-06-20</modified>
 </dates>
 </vuln>

<vuln vid="4dfafa16-24ba-11e6-bd31-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>50.0.2661.102</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update.html">
	 5 security fixes in this release, including:
	 <ul>
	 <li>[605766] High CVE-2016-1667: Same origin bypass in DOM. Credit
	 to Mariusz Mlynski.</li>
	 <li>[605910] High CVE-2016-1668: Same origin bypass in Blink V8
	 bindings. Credit to Mariusz Mlynski.</li>
	 <li>[606115] High CVE-2016-1669: Buffer overflow in V8. Credit to
	 Choongwoo Han.</li>
	 <li>[578882] Medium CVE-2016-1670: Race condition in loader. Credit
	 to anonymous.</li>
	 <li>[586657] Medium CVE-2016-1671: Directory traversal using the
	 file scheme on Android. Credit to Jann Horn.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1667</cvename>
 <cvename>CVE-2016-1668</cvename>
 <cvename>CVE-2016-1669</cvename>
 <cvename>CVE-2016-1670</cvename>
 <cvename>CVE-2016-1671</cvename>
 <url>http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update.html</url>
 </references>
 <dates>
 <discovery>2016-05-11</discovery>
 <entry>2016-05-28</entry>
 </dates>
 </vuln>

<vuln vid="7da1da96-24bb-11e6-bd31-3065ec8fd3ec">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>50.0.2661.94</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_28.html">
	 9 security fixes in this release, including:
	 <ul>
	 <li>[574802] High CVE-2016-1660: Out-of-bounds write in Blink.
	 Credit to Atte Kettunen of OUSPG.</li>
	 <li>[601629] High CVE-2016-1661: Memory corruption in cross-process
	 frames. Credit to Wadih Matar.</li>
	 <li>[603732] High CVE-2016-1662: Use-after-free in extensions.
	 Credit to Rob Wu.</li>
	 <li>[603987] High CVE-2016-1663: Use-after-free in Blink's V8
	 bindings. Credit to anonymous.</li>
	 <li>[597322] Medium CVE-2016-1664: Address bar spoofing. Credit to
	 Wadih Matar.</li>
	 <li>[606181] Medium CVE-2016-1665: Information leak in V8. Credit
	 to HyungSeok Han.</li>
	 <li>[607652] CVE-2016-1666: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1660</cvename>
 <cvename>CVE-2016-1661</cvename>
 <cvename>CVE-2016-1662</cvename>
 <cvename>CVE-2016-1663</cvename>
 <cvename>CVE-2016-1664</cvename>
 <cvename>CVE-2016-1665</cvename>
 <cvename>CVE-2016-1666</cvename>
 <url>http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_28.html</url>
 </references>
 <dates>
 <discovery>2016-04-28</discovery>
 <entry>2016-05-28</entry>
 </dates>
 </vuln>

<vuln vid="6b110175-246d-11e6-8dd3-002590263bf5">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php70-gd</name>
	<name>php70-intl</name>
	<range><lt>7.0.7</lt></range>
 </package>
 <package>
	<name>php56</name>
	<name>php56-gd</name>
	<range><lt>5.6.22</lt></range>
 </package>
 <package>
	<name>php55</name>
	<name>php55-gd</name>
	<name>php55-phar</name>
	<range><lt>5.5.36</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP Group reports:
	<blockquote cite="http://php.net/ChangeLog-5.php#5.5.36">
	 <ul><li>Core:
	 <ul>
	 <li>Fixed bug #72114 (Integer underflow / arbitrary null write in
	 fread/gzread). (CVE-2016-5096) (PHP 5.5/5.6 only)</li>
	 <li>Fixed bug #72135 (Integer Overflow in php_html_entities).
	 (CVE-2016-5094) (PHP 5.5/5.6 only)</li>
	 </ul></li>
	 <li>GD:
	 <ul>
	 <li>Fixed bug #72227 (imagescale out-of-bounds read).
	 (CVE-2013-7456)</li>
	 </ul></li>
	 <li>Intl:
	 <ul>
	 <li>Fixed bug #72241 (get_icu_value_internal out-of-bounds read).
	 (CVE-2016-5093)</li>
	 </ul></li>
	 <li>Phar:
	 <ul>
	 <li>Fixed bug #71331 (Uninitialized pointer in
	 phar_make_dirstream()). (CVE-2016-4343) (PHP 5.5 only)</li>
	 </ul></li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-5096</cvename>
 <cvename>CVE-2016-5094</cvename>
 <cvename>CVE-2013-7456</cvename>
 <cvename>CVE-2016-5093</cvename>
 <cvename>CVE-2016-4343</cvename>
 <freebsdpr>ports/209779</freebsdpr>
 <url>http://php.net/ChangeLog-7.php#7.0.7</url>
 <url>http://php.net/ChangeLog-5.php#5.6.22</url>
 <url>http://php.net/ChangeLog-5.php#5.5.36</url>
 </references>
 <dates>
 <discovery>2016-05-26</discovery>
 <entry>2016-05-28</entry>
 </dates>
 </vuln>

<vuln vid="00ec1be1-22bb-11e6-9ead-6805ca0b3d42">
 <topic>phpmyadmin -- XSS and sensitive data leakage</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><ge>4.6.0</ge><lt>4.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpmyadmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-14/">
	 <h2>Description</h2>
	 Because user SQL queries are part of the URL, sensitive
	 information made as part of a user query can be exposed by
	 clicking on external links to attackers monitoring user GET
	 query parameters or included in the webserver logs.
	 <h2>Severity</h2>
	 We consider this to be non-critical.
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-16/">
	 <h2>Description</h2>
	 A specially crafted attack could allow for special HTML
	 characters to be passed as URL encoded values and displayed
	 back as special characters in the page.
	 <h2>Severity</h2>
	 We consider this to be non-critical.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-14/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-16/</url>
 <cvename>CVE-2016-5097</cvename>
 <cvename>CVE-2016-5099</cvename>
 </references>
 <dates>
 <discovery>2016-05-25</discovery>
 <entry>2016-05-25</entry>
 <modified>2016-05-26</modified>
 </dates>
 </vuln>

<vuln vid="b50f53ce-2151-11e6-8dd3-002590263bf5">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki123</name>
	<range><lt>1.23.14</lt></range>
 </package>
 <package>
	<name>mediawiki124</name>
	<range><le>1.24.6</le></range>
 </package>
 <package>
	<name>mediawiki125</name>
	<range><lt>1.25.6</lt></range>
 </package>
 <package>
	<name>mediawiki126</name>
	<range><lt>1.26.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawiki reports:
	<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-May/000188.html">
	 Security fixes:
	 T122056: Old tokens are remaining valid within a new session
	 T127114: Login throttle can be tricked using non-canonicalized
	 usernames
	 T123653: Cross-domain policy regexp is too narrow
	 T123071: Incorrectly identifying http link in a's href
	 attributes, due to m modifier in regex
	 T129506: MediaWiki:Gadget-popups.js isn't renderable
	 T125283: Users occasionally logged in as different users after
	 SessionManager deployment
	 T103239: Patrol allows click catching and patrolling of any
	 page
	 T122807: [tracking] Check php crypto primatives
	 T98313: Graphs can leak tokens, leading to CSRF
	 T130947: Diff generation should use PoolCounter
	 T133507: Careless use of $wgExternalLinkTarget is insecure
	 T132874: API action=move is not rate limited
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-May/000188.html</url>
 </references>
 <dates>
 <discovery>2016-05-20</discovery>
 <entry>2016-05-24</entry>
 </dates>
 </vuln>

<vuln vid="967b852b-1e28-11e6-8dd3-002590263bf5">
 <topic>hostapd and wpa_supplicant -- psk configuration parameter update allowing arbitrary data to be written</topic>
 <affects>
 <package>
	<name>wpa_supplicant</name>
	<range><lt>2.5_2</lt></range>
 </package>
 <package>
	<name>hostapd</name>
	<range><lt>2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jouni Malinen reports:
	<blockquote cite="http://w1.fi/security/2016-1/psk-parameter-config-update.txt">
	 psk configuration parameter update allowing arbitrary data to be
	 written (2016-1 - CVE-2016-4476/CVE-2016-4477).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4476</cvename>
 <cvename>CVE-2016-4477</cvename>
 <freebsdpr>ports/209564</freebsdpr>
 <url>http://w1.fi/security/2016-1/psk-parameter-config-update.txt</url>
 </references>
 <dates>
 <discovery>2016-05-02</discovery>
 <entry>2016-05-20</entry>
 <modified>2017-03-22</modified>
 </dates>
 </vuln>

<vuln vid="57b3aba7-1e25-11e6-8dd3-002590263bf5">
 <topic>expat -- denial of service vulnerability on malformed input</topic>
 <affects>
 <package>
	<name>expat</name>
	<range><lt>2.1.1</lt></range>
 </package>
 <package>
	<name>linux-c6-expat</name>
	<range><lt>2.0.1_3</lt></range>
 </package>
 <package>
	<name>linux-c7-expat</name>
	<range><lt>2.1.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gustavo Grieco reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/05/17/12">
	 The Expat XML parser mishandles certain kinds of malformed input
	 documents, resulting in buffer overflows during processing and error
	 reporting. The overflows can manifest as a segmentation fault or as
	 memory corruption during a parse operation. The bugs allow for a
	 denial of service attack in many applications by an unauthenticated
	 attacker, and could conceivably result in remote code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-0718</cvename>
 <freebsdpr>ports/209360</freebsdpr>
 <url>http://www.openwall.com/lists/oss-security/2016/05/17/12</url>
 </references>
 <dates>
 <discovery>2016-05-17</discovery>
 <entry>2016-05-20</entry>
 <modified>2016-11-30</modified>
 </dates>
 </vuln>

<vuln vid="036d6c38-1c5b-11e6-b9e0-20cf30e32f6d">
 <topic>Bugzilla security issues</topic>
 <affects>
 <package>
	<name>bugzilla44</name>
	<range><lt>4.4.12</lt></range>
 </package>
 <package>
	<name>bugzilla50</name>
	<range><lt>5.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bugzilla Security Advisory
	<blockquote cite="https://www.bugzilla.org/security/4.4.11/">
	 A specially crafted bug summary could trigger XSS in dependency graphs.
	 Due to an incorrect parsing of the image map generated by the dot script,
	 a specially crafted bug summary could trigger XSS in dependency graphs.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2803</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1253263</url>
 </references>
 <dates>
 <discovery>2016-03-03</discovery>
 <entry>2016-05-17</entry>
 </dates>
 </vuln>

<vuln vid="0dc8be9e-19af-11e6-8de0-080027ef73ec">
 <topic>OpenVPN -- Buffer overflow in PAM authentication and DoS through port sharing</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><lt>2.3.11</lt></range>
 </package>
 <package>
	<name>openvpn-polarssl</name>
	<range><lt>2.3.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samuli Seppänen reports:
	<blockquote cite="https://sourceforge.net/p/openvpn/mailman/message/35076507/">
	 OpenVPN 2.3.11 [...] fixes two vulnerabilities: a port-share bug
	 with DoS potential and a buffer overflow by user supplied data when
	 using pam authentication.[...]
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://sourceforge.net/p/openvpn/mailman/message/35076507/</url>
 <url>https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.11</url>
 </references>
 <dates>
 <discovery>2016-03-03</discovery>
 <entry>2016-05-14</entry>
 </dates>
 </vuln>

<vuln vid="82b702e0-1907-11e6-857b-00221503d280">
 <topic>imagemagick -- buffer overflow</topic>
 <affects>
 <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.9.4.1,1</lt></range>
 </package>
 <package>
	<name>ImageMagick7</name>
	<name>ImageMagick7-nox11</name>
	<range><ge>7.0.0.0.b20150715</ge><lt>7.0.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ImageMagick reports:
	<blockquote cite="http://legacy.imagemagick.org/script/changelog.php">
	 Fix a buffer overflow in magick/drag.c/DrawStrokePolygon().
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://legacy.imagemagick.org/script/changelog.php</url>
 </references>
 <dates>
 <discovery>2016-05-09</discovery>
 <entry>2016-05-13</entry>
 </dates>
 </vuln>

<vuln vid="e387834a-17ef-11e6-9947-7054d2909b71">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><le>2.2</le></range>
 </package>
 <package>
	<name>jenkins2</name>
	<range><le>2.2</le></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><le>1.651.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11">
	 <h1>Description</h1>
	 <h5>SECURITY-170 / CVE-2016-3721</h5>
	 Arbitrary build parameters are passed to build scripts as environment variables
	 <h5>SECURITY-243 / CVE-2016-3722</h5>
	 Malicious users with multiple user accounts can prevent other users from logging in
	 <h5>SECURITY-250 / CVE-2016-3723</h5>
	 Information on installed plugins exposed via API
	 <h5>SECURITY-266 / CVE-2016-3724</h5>
	 Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration
	 <h5>SECURITY-273 / CVE-2016-3725</h5>
	 Regular users can trigger download of update site metadata
	 <h5>SECURITY-276 / CVE-2016-3726</h5>
	 Open redirect to scheme-relative URLs
	 <h5>SECURITY-281 / CVE-2016-3727</h5>
	 Granting the permission to read node configurations allows access to overall system configuration
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3721</cvename>
 <cvename>CVE-2016-3722</cvename>
 <cvename>CVE-2016-3723</cvename>
 <cvename>CVE-2016-3724</cvename>
 <cvename>CVE-2016-3725</cvename>
 <cvename>CVE-2016-3726</cvename>
 <cvename>CVE-2016-3727</cvename>
 <url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11</url>
 </references>
 <dates>
 <discovery>2016-05-11</discovery>
 <entry>2016-05-12</entry>
 </dates>
 </vuln>

<vuln vid="d9f99491-1656-11e6-94fa-002590263bf5">
 <topic>perl5 -- taint mechanism bypass vulnerability</topic>
 <affects>
 <package>
	<name>perl5</name>
	<range><lt>5.18.4_21</lt></range>
	<range><ge>5.20.0</ge><lt>5.20.3_12</lt></range>
	<range><ge>5.22.0</ge><lt>5.22.1_8</lt></range>
 </package>
 <package>
	<name>perl5.18</name>
	<range><ge>5.18.0</ge><lt>5.18.4_21</lt></range>
 </package>
 <package>
	<name>perl5.20</name>
	<range><ge>5.20.0</ge><lt>5.20.3_12</lt></range>
 </package>
 <package>
	<name>perl5.22</name>
	<range><ge>5.22.0</ge><lt>5.22.1_8</lt></range>
 </package>
 <package>
	<name>perl</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2381">
	 Perl might allow context-dependent attackers to bypass the taint
	 protection mechanism in a child process via duplicate environment
	 variables in envp.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2381</cvename>
 <freebsdpr>ports/208879</freebsdpr>
 </references>
 <dates>
 <discovery>2016-04-08</discovery>
 <entry>2016-05-10</entry>
 <modified>2016-08-22</modified>
 </dates>
 </vuln>

<vuln vid="3686917b-164d-11e6-94fa-002590263bf5">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.5.2,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Helen Hou-Sandi reports:
	<blockquote cite="https://wordpress.org/news/2016/05/wordpress-4-5-2/">
	 WordPress 4.5.2 is now available. This is a security release for
	 all previous versions and we strongly encourage you to update your
	 sites immediately.
	 WordPress versions 4.5.1 and earlier are affected by a SOME
	 vulnerability through Plupload, the third-party library WordPress
	 uses for uploading files. WordPress versions 4.2 through 4.5.1 are
	 vulnerable to reflected XSS using specially crafted URIs through
	 MediaElement.js, the third-party library used for media players.
	 MediaElement.js and Plupload have also released updates fixing
	 these issues.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4566</cvename>
 <cvename>CVE-2016-4567</cvename>
 <url>https://wordpress.org/news/2016/05/wordpress-4-5-2/</url>
 <url>http://www.openwall.com/lists/oss-security/2016/05/07/7</url>
 </references>
 <dates>
 <discovery>2016-05-06</discovery>
 <entry>2016-05-10</entry>
 </dates>
 </vuln>

<vuln vid="2b4c8e1f-1609-11e6-b55e-b499baebfeaf">
 <topic>libarchive -- RCE vulnerability</topic>
 <affects>
 <package>
	<name>libarchive</name>
	<range><lt>3.2.0,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The libarchive project reports:
	<blockquote cite="https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7">
	 Heap-based buffer overflow in the zip_read_mac_metadata function
	 in archive_read_support_format_zip.c in libarchive before 3.2.0
	 allows remote attackers to execute arbitrary code via crafted
	 entry-size values in a ZIP archive.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1541</cvename>
 <url>https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7</url>
 </references>
 <dates>
 <discovery>2016-05-01</discovery>
 <entry>2016-05-09</entry>
 <modified>2016-05-10</modified>
 </dates>
 </vuln>

<vuln vid="25e5205b-1447-11e6-9ead-6805ca0b3d42">
 <topic>squid -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><ge>3.0.0</ge><lt>3.5.18</lt></range>
 </package>
 <package>
	<name>squid-devel</name>
	<range><ge>4.0.0</ge><lt>4.0.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The squid development team reports:
	Please reference CVE/URL list for details
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4553</cvename>
 <cvename>CVE-2016-4554</cvename>
 <cvename>CVE-2016-4555</cvename>
 <cvename>CVE-2016-4556</cvename>
 <url>http://www.squid-cache.org/Advisories/SQUID-2016_7.txt</url>
 <url>http://www.squid-cache.org/Advisories/SQUID-2016_8.txt</url>
 <url>http://www.squid-cache.org/Advisories/SQUID-2016_9.txt</url>
 </references>
 <dates>
 <discovery>2016-05-06</discovery>
 <entry>2016-05-07</entry>
 <modified>2016-05-09</modified>
 </dates>
 </vuln>

<vuln vid="0d724b05-687f-4527-9c03-af34d3b094ec">
 <topic>ImageMagick -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.9.3.9_1,1</lt></range>
 </package>
 <package>
	<name>ImageMagick7</name>
	<name>ImageMagick7-nox11</name>
	<range><ge>7.0.0.0.b20150715</ge><lt>7.0.1.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Openwall reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/05/03/18">
	 Insufficient filtering for filename passed to delegate's command
	 allows remote code execution during conversion of several file
	 formats. Any service which uses ImageMagick to process user
	 supplied images and uses default delegates.xml / policy.xml,
	 may be vulnerable to this issue.
	 It is possible to make ImageMagick perform a HTTP GET or FTP
	 request
	 It is possible to delete files by using ImageMagick's 'ephemeral'
	 pseudo protocol which deletes files after reading.
	 It is possible to move image files to file with any extension
	 in any folder by using ImageMagick's 'msl' pseudo protocol.
	 msl.txt and image.gif should exist in known location - /tmp/
	 for PoC (in real life it may be web service written in PHP,
	 which allows to upload raw txt files and process images with
	 ImageMagick).
	 It is possible to get content of the files from the server
	 by using ImageMagick's 'label' pseudo protocol.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3714</cvename>
 <cvename>CVE-2016-3715</cvename>
 <cvename>CVE-2016-3716</cvename>
 <cvename>CVE-2016-3717</cvename>
 <cvename>CVE-2016-3718</cvename>
 <url>http://www.openwall.com/lists/oss-security/2016/05/03/18</url>
 <url>https://imagetragick.com/</url>
 </references>
 <dates>
 <discovery>2016-05-03</discovery>
 <entry>2016-05-06</entry>
 <modified>2016-05-07</modified>
 </dates>
 </vuln>

<vuln vid="a6cd01fa-11bd-11e6-bb3c-9cb654ea3e1c">
 <topic>jansson -- local denial of service vulnerabilities</topic>
 <affects>
 <package>
	<name>jansson</name>
	<range><lt>2.7_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	QuickFuzz reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/05/01/5">
	 A crash caused by stack exhaustion parsing a JSON was found.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2016/05/01/5</url>
 <url>http://www.openwall.com/lists/oss-security/2016/05/02/1</url>
 <cvename>CVE-2016-4425</cvename>
 </references>
 <dates>
 <discovery>2016-05-01</discovery>
 <entry>2016-05-04</entry>
 </dates>
 </vuln>

<vuln vid="01d729ca-1143-11e6-b55e-b499baebfeaf">
 <topic>OpenSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2_11</lt></range>
 </package>
 <package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_8</lt></range>
 </package>
 <package>
	<name>libressl</name>
	<range><ge>2.3.0</ge><lt>2.3.4</lt></range>
	<range><lt>2.2.7</lt></range>
 </package>
 <package>
	<name>libressl-devel</name>
	<range><lt>2.3.4</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.3</ge><lt>10.3_2</lt></range>
	<range><ge>10.2</ge><lt>10.2_16</lt></range>
	<range><ge>10.1</ge><lt>10.1_33</lt></range>
	<range><ge>9.3</ge><lt>9.3_41</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20160503.txt">
	 Memory corruption in the ASN.1 encoder
	 Padding oracle in AES-NI CBC MAC check
	 EVP_EncodeUpdate overflow
	 EVP_EncryptUpdate overflow
	 ASN.1 BIO excessive memory allocation
	 EBCDIC overread (OpenSSL only)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv/20160503.txt</url>
 <url>https://marc.info/?l=openbsd-tech&amp;m=146228598730414</url>
 <cvename>CVE-2016-2105</cvename>
 <cvename>CVE-2016-2106</cvename>
 <cvename>CVE-2016-2107</cvename>
 <cvename>CVE-2016-2108</cvename>
 <cvename>CVE-2016-2109</cvename>
 <cvename>CVE-2016-2176</cvename>
 <freebsdsa>SA-16:17.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2016-05-03</discovery>
 <entry>2016-05-03</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="be72e773-1131-11e6-94fa-002590263bf5">
 <topic>gitlab -- privilege escalation via "impersonate" feature</topic>
 <affects>
 <package>
	<name>gitlab</name>
	<range><ge>8.2.0</ge><lt>8.2.5</lt></range>
	<range><ge>8.3.0</ge><lt>8.3.9</lt></range>
	<range><ge>8.4.0</ge><lt>8.4.10</lt></range>
	<range><ge>8.5.0</ge><lt>8.5.12</lt></range>
	<range><ge>8.6.0</ge><lt>8.6.8</lt></range>
	<range><ge>8.7.0</ge><lt>8.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GitLab reports:
	<blockquote cite="https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/">
	 During an internal code review, we discovered a critical security
	 flaw in the "impersonate" feature of GitLab. Added in GitLab 8.2,
	 this feature was intended to allow an administrator to simulate
	 being logged in as any other user.
	 A part of this feature was not properly secured and it was possible
	 for any authenticated user, administrator or not, to "log in" as any
	 other user, including administrators. Please see the issue for more
	 details.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4340</cvename>
 <freebsdpr>ports/209225</freebsdpr>
 <url>https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/</url>
 <url>https://gitlab.com/gitlab-org/gitlab-ce/issues/15548</url>
 </references>
 <dates>
 <discovery>2016-05-02</discovery>
 <entry>2016-05-03</entry>
 </dates>
 </vuln>

<vuln vid="5764c634-10d2-11e6-94fa-002590263bf5">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php70</name>
	<name>php70-bcmath</name>
	<name>php70-exif</name>
	<name>php70-gd</name>
	<name>php70-xml</name>
	<range><lt>7.0.6</lt></range>
 </package>
 <package>
	<name>php56</name>
	<name>php56-bcmath</name>
	<name>php56-exif</name>
	<name>php56-gd</name>
	<name>php56-xml</name>
	<range><lt>5.6.21</lt></range>
 </package>
 <package>
	<name>php55</name>
	<name>php55-bcmath</name>
	<name>php55-exif</name>
	<name>php55-gd</name>
	<name>php55-xml</name>
	<range><lt>5.5.35</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP Group reports:
	<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.35">
	 <ul><li>BCMath:
	 <ul>
	 <li>Fixed bug #72093 (bcpowmod accepts negative scale and corrupts
	 _one_ definition).</li>
	 </ul></li>
	 <li>Exif:
	 <ul>
	 <li>Fixed bug #72094 (Out of bounds heap read access in exif header
	 processing).</li>
	 </ul></li>
	 <li>GD:
	 <ul>
	 <li>Fixed bug #71912 (libgd: signedness vulnerability).
	 (CVE-2016-3074)</li>
	 </ul></li>
	 <li>Intl:
	 <ul>
	 <li>Fixed bug #72061 (Out-of-bounds reads in zif_grapheme_stripos
	 with negative offset).</li>
	 </ul></li>
	 <li>XML:
	 <ul>
	 <li>Fixed bug #72099 (xml_parse_into_struct segmentation fault).
	 </li>
	 </ul></li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3074</cvename>
 <freebsdpr>ports/209145</freebsdpr>
 <url>http://www.php.net/ChangeLog-7.php#7.0.6</url>
 <url>http://www.php.net/ChangeLog-5.php#5.6.21</url>
 <url>http://www.php.net/ChangeLog-5.php#5.5.35</url>
 </references>
 <dates>
 <discovery>2016-04-28</discovery>
 <entry>2016-05-03</entry>
 </dates>
 </vuln>

<vuln vid="a1134048-10c6-11e6-94fa-002590263bf5">
 <topic>libksba -- local denial of service vulnerabilities</topic>
 <affects>
 <package>
	<name>libksba</name>
	<range><lt>1.3.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Martin Prpic, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/04/29/5">
	 Denial of Service due to stack overflow in src/ber-decoder.c.
	 Integer overflow in the BER decoder src/ber-decoder.c.
	 Integer overflow in the DN decoder src/dn.c.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4353</cvename>
 <cvename>CVE-2016-4354</cvename>
 <cvename>CVE-2016-4355</cvename>
 <cvename>CVE-2016-4356</cvename>
 <url>http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=07116a314f4dcd4d96990bbd74db95a03a9f650a</url>
 <url>http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=aea7b6032865740478ca4b706850a5217f1c3887</url>
 <url>http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=243d12fdec66a4360fbb3e307a046b39b5b4ffc3</url>
 <url>https://security.gentoo.org/glsa/201604-04</url>
 <mlist>http://www.openwall.com/lists/oss-security/2016/04/29/5</mlist>
 </references>
 <dates>
 <discovery>2015-04-08</discovery>
 <entry>2016-05-03</entry>
 </dates>
 </vuln>

<vuln vid="7e36c369-10c0-11e6-94fa-002590263bf5">
 <topic>wireshark -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>wireshark-qt5</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>2.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wireshark development team reports:
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html">
	 The following vulnerabilities have been fixed:
	 <ul>
	 <li>wnpa-sec-2016-19
	 The NCP dissector could crash. (Bug 11591)</li>
	 <li>wnpa-sec-2016-20
	 TShark could crash due to a packet reassembly bug. (Bug 11799)
		</li>
	 <li>wnpa-sec-2016-21
	 The IEEE 802.11 dissector could crash. (Bug 11824, Bug 12187)
		</li>
	 <li>wnpa-sec-2016-22
	 The PKTC dissector could crash. (Bug 12206)</li>
	 <li>wnpa-sec-2016-23
	 The PKTC dissector could crash. (Bug 12242)</li>
	 <li>wnpa-sec-2016-24
	 The IAX2 dissector could go into an infinite loop. (Bug
		12260)</li>
	 <li>wnpa-sec-2016-25
	 Wireshark and TShark could exhaust the stack. (Bug 12268)
		</li>
	 <li>wnpa-sec-2016-26
	 The GSM CBCH dissector could crash. (Bug 12278)</li>
	 <li>wnpa-sec-2016-27
	 MS-WSP dissector crash. (Bug 12341)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4076</cvename>
 <cvename>CVE-2016-4077</cvename>
 <cvename>CVE-2016-4078</cvename>
 <cvename>CVE-2016-4079</cvename>
 <cvename>CVE-2016-4080</cvename>
 <cvename>CVE-2016-4081</cvename>
 <cvename>CVE-2016-4006</cvename>
 <cvename>CVE-2016-4082</cvename>
 <cvename>CVE-2016-4083</cvename>
 <cvename>CVE-2016-4084</cvename>
 <url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html</url>
 <url>http://www.openwall.com/lists/oss-security/2016/04/25/2</url>
 </references>
 <dates>
 <discovery>2016-04-22</discovery>
 <entry>2016-05-02</entry>
 <modified>2016-07-04</modified>
 </dates>
 </vuln>

<vuln vid="78abc022-0fee-11e6-9a1c-0014a5a57822">
 <topic>mercurial -- arbitrary code execution vulnerability</topic>
 <affects>
 <package>
	<name>mercurial</name>
	<range><lt>3.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mercurial reports:
	<blockquote cite="https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29">
	 CVE-2016-3105: Arbitrary code execution when converting
	 Git repos
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3105</cvename>
 <url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29</url>
 </references>
 <dates>
 <discovery>2016-05-01</discovery>
 <entry>2016-05-01</entry>
 </dates>
 </vuln>

<vuln vid="8c2b2f11-0ebe-11e6-b55e-b499baebfeaf">
 <topic>MySQL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mariadb55-server</name>
	<range><lt>5.5.49</lt></range>
 </package>
 <package>
	<name>mariadb100-server</name>
	<range><lt>10.0.25</lt></range>
 </package>
 <package>
	<name>mariadb101-server</name>
	<range><lt>10.1.12</lt></range>
 </package>
 <package>
	<name>mysql55-server</name>
	<range><lt>5.5.49</lt></range>
 </package>
 <package>
	<name>mysql56-server</name>
	<range><lt>5.6.30</lt></range>
 </package>
 <package>
	<name>mysql57-server</name>
	<range><lt>5.7.12</lt></range>
 </package>
 <package>
	<name>percona55-server</name>
	<range><lt>5.5.49</lt></range>
 </package>
 <package>
	<name>percona-server</name>
	<range><lt>5.6.30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports reports:
	<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL">
	 Critical Patch Update contains 31 new security fixes for Oracle MySQL
	 5.5.48, 5.6.29, 5.7.11 and earlier
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL</url>
 <url>https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/</url>
 <url>https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/</url>
 <url>https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/</url>
 <cvename>CVE-2016-0705</cvename>
 <cvename>CVE-2016-0639</cvename>
 <cvename>CVE-2015-3194</cvename>
 <cvename>CVE-2016-0640</cvename>
 <cvename>CVE-2016-0641</cvename>
 <cvename>CVE-2016-3461</cvename>
 <cvename>CVE-2016-2047</cvename>
 <cvename>CVE-2016-0642</cvename>
 <cvename>CVE-2016-0643</cvename>
 <cvename>CVE-2016-0644</cvename>
 <cvename>CVE-2016-0646</cvename>
 <cvename>CVE-2016-0647</cvename>
 <cvename>CVE-2016-0648</cvename>
 <cvename>CVE-2016-0649</cvename>
 <cvename>CVE-2016-0650</cvename>
 <cvename>CVE-2016-0652</cvename>
 <cvename>CVE-2016-0653</cvename>
 <cvename>CVE-2016-0654</cvename>
 <cvename>CVE-2016-0655</cvename>
 <cvename>CVE-2016-0656</cvename>
 <cvename>CVE-2016-0657</cvename>
 <cvename>CVE-2016-0658</cvename>
 <cvename>CVE-2016-0651</cvename>
 <cvename>CVE-2016-0659</cvename>
 <cvename>CVE-2016-0661</cvename>
 <cvename>CVE-2016-0662</cvename>
 <cvename>CVE-2016-0663</cvename>
 <cvename>CVE-2016-0665</cvename>
 <cvename>CVE-2016-0666</cvename>
 <cvename>CVE-2016-0667</cvename>
 <cvename>CVE-2016-0668</cvename>
 </references>
 <dates>
 <discovery>2016-04-19</discovery>
 <entry>2016-04-30</entry>
 </dates>
 </vuln>

<vuln vid="f2d4f879-0d7c-11e6-925f-6805ca0b3d42">
 <topic>logstash -- password disclosure vulnerability</topic>
 <affects>
 <package>
	<name>logstash</name>
	<range><ge>2.1.0</ge><lt>2.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Logstash developers report:
	<blockquote cite="https://www.elastic.co/blog/logstash-2.3.1-and-2.2.4-released#Passwords_Printed_in_Log_Files_under_Some_Conditions_18">
	 <h2>Passwords Printed in Log Files under Some Conditions</h2>
	 It was discovered that, in Logstash 2.1.0+, log messages
	 generated by a stalled pipeline during shutdown will print
	 plaintext contents of password fields. While investigating
	 this issue we also discovered that debug logging has
	 included this data for quite some time. Our latest releases
	 fix both leaks. You will want to scrub old log files if this
	 is of particular concern to you. This was fixed in issue
	 #4965
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.elastic.co/blog/logstash-2.3.1-and-2.2.4-released#Passwords_Printed_in_Log_Files_under_Some_Conditions_18</url>
 <url>https://github.com/elastic/logstash/pull/4965</url>
 </references>
 <dates>
 <discovery>2016-04-01</discovery>
 <entry>2016-04-28</entry>
 </dates>
 </vuln>

<vuln vid="c8174b63-0d3a-11e6-b06e-d43d7eed0ce2">
 <topic>subversion -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><ge>1.9.0</ge><lt>1.9.4</lt></range>
	<range><ge>1.0.0</ge><lt>1.8.15</lt></range>
 </package>
 <package>
	<name>subversion18</name>
	<range><ge>1.0.0</ge><lt>1.8.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion project reports:
	<blockquote cite="http://subversion.apache.org/security/CVE-2016-2167-advisory.txt">
	 svnserve, the svn:// protocol server, can optionally use the Cyrus
	 SASL library for authentication, integrity protection, and encryption.
	 Due to a programming oversight, authentication against Cyrus SASL
	 would permit the remote user to specify a realm string which is
	 a prefix of the expected realm string.
	</blockquote>
	<blockquote cite="http://subversion.apache.org/security/CVE-2016-2168-advisory.txt">
	 Subversion's httpd servers are vulnerable to a remotely triggerable crash
	 in the mod_authz_svn module. The crash can occur during an authorization
	 check for a COPY or MOVE request with a specially crafted header value.
	 This allows remote attackers to cause a denial of service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2167</cvename>
 <url>http://subversion.apache.org/security/CVE-2016-2167-advisory.txt</url>
 <cvename>CVE-2016-2168</cvename>
 <url>http://subversion.apache.org/security/CVE-2016-2168-advisory.txt</url>
 </references>
 <dates>
 <discovery>2016-04-21</discovery>
 <entry>2016-04-28</entry>
 </dates>
 </vuln>

<vuln vid="b2487d9a-0c30-11e6-acd0-d050996490d0">
 <topic>ntp -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ntp</name>
	<range><lt>4.2.8p7</lt></range>
 </package>
 <package>
	<name>ntp-devel</name>
	<range><lt>4.3.92</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.3</ge><lt>10.3_1</lt></range>
	<range><ge>10.2</ge><lt>10.2_15</lt></range>
	<range><ge>10.1</ge><lt>10.1_32</lt></range>
	<range><ge>9.3</ge><lt>9.3_40</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Network Time Foundation reports:
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security">
	 NTF's NTP Project has been notified of the following low-
	 and medium-severity vulnerabilities that are fixed in
	 ntp-4.2.8p7, released on Tuesday, 26 April 2016:
	 <ul>
	 <li>Bug 3020 / CVE-2016-1551: Refclock impersonation
	 vulnerability, AKA: refclock-peering. Reported by
	 Matt Street and others of Cisco ASIG</li>
	 <li>Bug 3012 / CVE-2016-1549: Sybil vulnerability:
	 ephemeral association attack, AKA: ntp-sybil -
	 MITIGATION ONLY. Reported by Matthew Van Gundy
	 of Cisco ASIG</li>
	 <li>Bug 3011 / CVE-2016-2516: Duplicate IPs on
	 unconfig directives will cause an assertion botch.
	 Reported by Yihan Lian of the Cloud Security Team,
	 Qihoo 360</li>
	 <li>Bug 3010 / CVE-2016-2517: Remote configuration
	 trustedkey/requestkey values are not properly
	 validated. Reported by Yihan Lian of the Cloud
	 Security Team, Qihoo 360</li>
	 <li>Bug 3009 / CVE-2016-2518: Crafted addpeer with
	 hmode &gt; 7 causes array wraparound with MATCH_ASSOC.
	 Reported by Yihan Lian of the Cloud Security Team,
	 Qihoo 360</li>
	 <li>Bug 3008 / CVE-2016-2519: ctl_getitem() return
	 value not always checked. Reported by Yihan Lian
	 of the Cloud Security Team, Qihoo 360</li>
	 <li>Bug 3007 / CVE-2016-1547: Validate crypto-NAKs,
	 AKA: nak-dos. Reported by Stephen Gray and
	 Matthew Van Gundy of Cisco ASIG</li>
	 <li>Bug 2978 / CVE-2016-1548: Interleave-pivot -
	 MITIGATION ONLY. Reported by Miroslav Lichvar of
	 RedHat and separately by Jonathan Gardner of
	 Cisco ASIG.</li>
	 <li>Bug 2952 / CVE-2015-7704: KoD fix: peer
	 associations were broken by the fix for
	 NtpBug2901, AKA: Symmetric active/passive mode
	 is broken. Reported by Michael Tatarinov,
	 NTP Project Developer Volunteer</li>
	 <li>Bug 2945 / Bug 2901 / CVE-2015-8138: Zero
	 Origin Timestamp Bypass, AKA: Additional KoD Checks.
	 Reported by Jonathan Gardner of Cisco ASIG</li>
	 <li>Bug 2879 / CVE-2016-1550: Improve NTP security
	 against buffer comparison timing attacks,
	 authdecrypt-timing, AKA: authdecrypt-timing.
	 Reported independently by Loganaden Velvindron,
	 and Matthew Van Gundy and Stephen Gray of
	 Cisco ASIG.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-16:16.ntp</freebsdsa>
 <cvename>CVE-2015-7704</cvename>
 <cvename>CVE-2015-8138</cvename>
 <cvename>CVE-2016-1547</cvename>
 <cvename>CVE-2016-1548</cvename>
 <cvename>CVE-2016-1549</cvename>
 <cvename>CVE-2016-1550</cvename>
 <cvename>CVE-2016-1551</cvename>
 <cvename>CVE-2016-2516</cvename>
 <cvename>CVE-2016-2517</cvename>
 <cvename>CVE-2016-2518</cvename>
 <cvename>CVE-2016-2519</cvename>
 <url>http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security</url>
 </references>
 <dates>
 <discovery>2016-04-26</discovery>
 <entry>2016-04-27</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="92d44f83-a7bf-41cf-91ee-3d1b8ecf579f">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<name>linux-firefox</name>
	<range><lt>46.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.43</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><ge>39.0,1</ge><lt>45.1.0,1</lt></range>
	<range><lt>38.8.0,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><ge>39.0</ge><lt>45.1.0</lt></range>
	<range><lt>38.8.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox46">
	MFSA 2016-39 Miscellaneous memory safety hazards (rv:46.0 /
	 rv:45.1 / rv:38.8)
	MFSA 2016-42 Use-after-free and buffer overflow
	 in Service Workers
	MFSA 2016-44 Buffer overflow in libstagefright with
	 CENC offsets
	MFSA 2016-45 CSP not applied to pages sent with
	 multipart/x-mixed-replace
	MFSA 2016-46 Elevation of privilege with
	 chrome.tabs.update API in web extensions
	MFSA 2016-47 Write to invalid HashMap entry through
	 JavaScript.watch()
	MFSA 2016-48 Firefox Health Reports could accept events
	 from untrusted domains
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2804</cvename>
 <cvename>CVE-2016-2805</cvename>
 <cvename>CVE-2016-2806</cvename>
 <cvename>CVE-2016-2807</cvename>
 <cvename>CVE-2016-2808</cvename>
 <cvename>CVE-2016-2811</cvename>
 <cvename>CVE-2016-2812</cvename>
 <cvename>CVE-2016-2814</cvename>
 <cvename>CVE-2016-2816</cvename>
 <cvename>CVE-2016-2817</cvename>
 <cvename>CVE-2016-2820</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-39/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-42/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-44/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-45/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-46/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-47/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-48/</url>
 </references>
 <dates>
 <discovery>2016-04-26</discovery>
 <entry>2016-04-26</entry>
 </dates>
 </vuln>

<vuln vid="f87a9376-0943-11e6-8fc4-00a0986f28c4">
 <topic>phpmyfaq -- cross-site request forgery vulnerability</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><lt>2.8.27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyFAQ team reports:
	<blockquote cite="http://www.phpmyfaq.de/security/advisory-2016-04-11">
	 The vulnerability exists due to application does not properly
	 verify origin of HTTP requests in "Interface Translation"
	 functionality.: A remote unauthenticated attacker can create
	 a specially crafted malicious web page with CSRF exploit, trick
	 a logged-in administrator to visit the page, spoof the HTTP
	 request, as if it was coming from the legitimate user, inject
	 and execute arbitrary PHP code on the target system with privileges
	 of the webserver.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyfaq.de/security/advisory-2016-04-11</url>
 <url>https://www.htbridge.com/advisory/HTB23300</url>
 </references>
 <dates>
 <discovery>2016-04-11</discovery>
 <entry>2016-04-23</entry>
 </dates>
 </vuln>

<vuln vid="1b0d2938-0766-11e6-94fa-002590263bf5">
 <topic>libtasn1 -- denial of service parsing malicious DER certificates</topic>
 <affects>
 <package>
	<name>libtasn1</name>
	<range><lt>4.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GNU Libtasn1 NEWS reports:
	<blockquote cite="http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=blob_plain;f=NEWS;hb=e9bcdc86b920d72c9cffc2570d14eea2f6365b37">
	 Fixes to avoid an infinite recursion when decoding without the
	 ASN1_DECODE_FLAG_STRICT_DER flag. Reported by Pascal Cuoq.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4008</cvename>
 <url>http://www.openwall.com/lists/oss-security/2016/04/13/3</url>
 <url>http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=blob_plain;f=NEWS;hb=e9bcdc86b920d72c9cffc2570d14eea2f6365b37</url>
 </references>
 <dates>
 <discovery>2016-04-11</discovery>
 <entry>2016-04-21</entry>
 </dates>
 </vuln>

<vuln vid="e05bfc92-0763-11e6-94fa-002590263bf5">
 <topic>squid -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>3.5.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid security advisory 2016:5 reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_5.txt">
	 Due to incorrect buffer management Squid cachemgr.cgi tool is
	 vulnerable to a buffer overflow when processing remotely supplied
	 inputs relayed to it from Squid.
	 This problem allows any client to seed the Squid manager reports
	 with data that will cause a buffer overflow when processed by the
	 cachemgr.cgi tool. However, this does require manual administrator
	 actions to take place. Which greatly reduces the impact and
	 possible uses.
	</blockquote>
	Squid security advisory 2016:6 reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_6.txt">
	 Due to buffer overflow issues Squid is vulnerable to a denial of
	 service attack when processing ESI responses. Due to incorrect input
	 validation Squid is vulnerable to public information disclosure of
	 the server stack layout when processing ESI responses. Due to
	 incorrect input validation and buffer overflow Squid is vulnerable
	 to remote code execution when processing ESI responses.
	 These problems allow ESI components to be used to perform a denial
	 of service attack on the Squid service and all other services on the
	 same machine. Under certain build conditions these problems allow
	 remote clients to view large sections of the server memory. However,
	 the bugs are exploitable only if you have built and configured the
	 ESI features to be used by a reverse-proxy and if the ESI components
	 being processed by Squid can be controlled by an attacker.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-4051</cvename>
 <cvename>CVE-2016-4052</cvename>
 <cvename>CVE-2016-4053</cvename>
 <cvename>CVE-2016-4054</cvename>
 <freebsdpr>ports/208939</freebsdpr>
 <url>http://www.squid-cache.org/Advisories/SQUID-2016_5.txt</url>
 <url>http://www.squid-cache.org/Advisories/SQUID-2016_6.txt</url>
 </references>
 <dates>
 <discovery>2016-04-20</discovery>
 <entry>2016-04-21</entry>
 </dates>
 </vuln>

<vuln vid="253c6889-06f0-11e6-925f-6805ca0b3d42">
 <topic>ansible -- use of predictable paths in lxc_container</topic>
 <affects>
 <package>
	<name>ansible</name>
	<range><ge>2.0.0.0</ge><lt>2.0.2.0</lt></range>
 </package>
 <package>
	<name>ansible1</name>
	<range><lt>1.9.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ansible developers report:
	<blockquote cite="https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4">
	 CVE-2016-3096: do not use predictable paths in lxc_container

<ul>
	 <li>do not use a predictable filename for the LXC attach
	 script</li>
	 <li>don't use predictable filenames for LXC attach script
	 logging</li>
	 <li>don't set a predictable archive_path</li>
	 </ul>

this should prevent symlink attacks which could result
	 in

<ul>
	 <li>data corruption</li>
	 <li>data leakage</li>
	 <li>privilege escalation</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3096</cvename>
 <url>https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1322925</url>
 </references>
 <dates>
 <discovery>2016-04-02</discovery>
 <entry>2016-04-20</entry>
 </dates>
 </vuln>

<vuln vid="a733b5ca-06eb-11e6-817f-3085a9a4510d">
 <topic>proftpd -- vulnerability in mod_tls</topic>
 <affects>
 <package>
	<name>proftpd</name>
	<range><lt>1.3.5b</lt></range>
	<range><eq>1.3.6.r1</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3125">
	 The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before
	 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which
	 might cause a weaker than intended Diffie-Hellman (DH) key to be used
	 and consequently allow attackers to have unspecified impact via
	 unknown vectors.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3125</cvename>
 </references>
 <dates>
 <discovery>2016-03-08</discovery>
 <entry>2016-04-20</entry>
 </dates>
 </vuln>

<vuln vid="6d8505f0-0614-11e6-b39c-00262d5ed8ee">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>50.0.2661.75</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html">
	 20 security fixes in this release, including:
	 <ul>
	 <li>[590275] High CVE-2016-1652: Universal XSS in extension
	 bindings. Credit to anonymous.</li>
	 <li>[589792] High CVE-2016-1653: Out-of-bounds write in V8. Credit
	 to Choongwoo Han.</li>
	 <li>[591785] Medium CVE-2016-1651: Out-of-bounds read in Pdfium
	 JPEG2000 decoding. Credit to kdot working with HP's Zero Day
	 Initiative.</li>
	 <li>[589512] Medium CVE-2016-1654: Uninitialized memory read in
	 media. Credit to Atte Kettunen of OUSPG.</li>
	 <li>[582008] Medium CVE-2016-1655: Use-after-free related to
	 extensions. Credit to Rob Wu.</li>
	 <li>[570750] Medium CVE-2016-1656: Android downloaded file path
	 restriction bypass. Credit to Dzmitry Lukyanenko.</li>
	 <li>[567445] Medium CVE-2016-1657: Address bar spoofing. Credit to
	 Luan Herrera.</li>
	 <li>[573317] Low CVE-2016-1658: Potential leak of sensitive
	 information to malicious extensions. Credit to Antonio Sanso
	 (@asanso) of Adobe.</li>
	 <li>[602697] CVE-2016-1659: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1651</cvename>
 <cvename>CVE-2016-1652</cvename>
 <cvename>CVE-2016-1653</cvename>
 <cvename>CVE-2016-1654</cvename>
 <cvename>CVE-2016-1655</cvename>
 <cvename>CVE-2016-1656</cvename>
 <cvename>CVE-2016-1657</cvename>
 <cvename>CVE-2016-1658</cvename>
 <cvename>CVE-2016-1659</cvename>
 <url>http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html</url>
 </references>
 <dates>
 <discovery>2016-04-13</discovery>
 <entry>2016-04-19</entry>
 </dates>
 </vuln>

<vuln vid="976567f6-05c5-11e6-94fa-002590263bf5">
 <topic>hostapd and wpa_supplicant -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wpa_supplicant</name>
	<range><lt>2.5_1</lt></range>
 </package>
 <package>
	<name>hostapd</name>
	<range><lt>2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jouni Malinen reports:
	<blockquote cite="http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt">
	 wpa_supplicant unauthorized WNM Sleep Mode GTK control. (2015-6 -
	 CVE-2015-5310)
	</blockquote>
	<blockquote cite="http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt">
	 EAP-pwd missing last fragment length validation. (2015-7 -
	 CVE-2015-5315)
	</blockquote>
	<blockquote cite="http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt">
	 EAP-pwd peer error path failure on unexpected Confirm message.
	 (2015-8 - CVE-2015-5316)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5310</cvename>
 <cvename>CVE-2015-5315</cvename>
 <cvename>CVE-2015-5316</cvename>
 <freebsdpr>ports/208482</freebsdpr>
 <url>http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt</url>
 <url>http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt</url>
 <url>http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt</url>
 </references>
 <dates>
 <discovery>2015-11-10</discovery>
 <entry>2016-04-19</entry>
 <modified>2017-03-22</modified>
 </dates>
 </vuln>

<vuln vid="092156c9-04d7-11e6-b1ce-002590263bf5">
 <topic>dhcpcd -- remote code execution/denial of service</topic>
 <affects>
 <package>
	<name>dhcpcd</name>
	<range><lt>6.9.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7912">
	 The get_option function in dhcp.c in dhcpcd before 6.2.0, as used
	 in dhcpcd 5.x in Android before 5.1 and other products, does not
	 validate the relationship between length fields and the amount of
	 data, which allows remote DHCP servers to execute arbitrary code or
	 cause a denial of service (memory corruption) via a large length
	 value of an option in a DHCPACK message.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-7912</cvename>
 <url>http://roy.marples.name/projects/dhcpcd/info/d71cfd8aa203bffe</url>
 </references>
 <dates>
 <discovery>2015-06-19</discovery>
 <entry>2016-04-17</entry>
 </dates>
 </vuln>

<vuln vid="6ec9f210-0404-11e6-9aee-bc5ff4fb5ea1">
 <topic>dhcpcd -- remote code execution/denial of service</topic>
 <affects>
 <package>
	<name>dhcpcd</name>
	<range><lt>6.10.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7913">
	 The print_option function in dhcp-common.c in dhcpcd through 6.9.1,
	 as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other
	 products, misinterprets the return value of the snprintf function,
	 which allows remote DHCP servers to execute arbitrary code or cause
	 a denial of service (memory corruption) via a crafted message.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-7913</cvename>
 <freebsdpr>ports/208702</freebsdpr>
 <url>http://roy.marples.name/projects/dhcpcd/info/528541c4c619520e</url>
 </references>
 <dates>
 <discovery>2016-01-22</discovery>
 <entry>2016-04-17</entry>
 </dates>
 </vuln>

<vuln vid="e21474c6-031a-11e6-aa86-001999f8d30b">
 <topic>PJSIP -- TCP denial of service in PJProject</topic>
 <affects>
 <package>
	<name>pjsip</name>
	<range><le>2.4.5</le></range>
 </package>
 <package>
	<name>pjsip-extsrtp</name>
	<range><le>2.4.5</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 PJProject has a limit on the number of TCP connections
	 that it can accept. Furthermore, PJProject does not close
	 TCP connections it accepts. By default, this value is
	 approximately 60.
	 An attacker can deplete the number of allowed TCP
	 connections by opening TCP connections and sending no
	 data to Asterisk.
	 If PJProject has been compiled in debug mode, then
	 once the number of allowed TCP connections has been
	 depleted, the next attempted TCP connection to Asterisk
	 will crash due to an assertion in PJProject.
	 If PJProject has not been compiled in debug mode, then
	 any further TCP connection attempts will be rejected.
	 This makes Asterisk unable to process TCP SIP traffic.
	 Note that this only affects TCP/TLS, since UDP is
	 connectionless.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2016-005.html</url>
 </references>
 <dates>
 <discovery>2016-02-15</discovery>
 <entry>2016-04-15</entry>
 </dates>
 </vuln>

<vuln vid="ee50726e-0319-11e6-aa86-001999f8d30b">
 <topic>asterisk -- Long Contact URIs in REGISTER requests can crash Asterisk</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 Asterisk may crash when processing an incoming REGISTER
	 request if that REGISTER contains a Contact header with
	 a lengthy URI.
	 This crash will only happen for requests that pass
	 authentication. Unauthenticated REGISTER requests will
	 not result in a crash occurring.
	 This vulnerability only affects Asterisk when using
	 PJSIP as its SIP stack. The chan_sip module does not have
	 this problem.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2016-004.html</url>
 </references>
 <dates>
 <discovery>2016-01-19</discovery>
 <entry>2016-04-15</entry>
 </dates>
 </vuln>

<vuln vid="f2217cdf-01e4-11e6-b1ce-002590263bf5">
 <topic>go -- remote denial of service</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.6.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jason Buberel reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/04/05/2">
	 Go has an infinite loop in several big integer routines that makes
	 Go programs vulnerable to remote denial of service attacks. Programs
	 using HTTPS client authentication or the Go ssh server libraries are
	 both exposed to this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3959</cvename>
 <url>http://www.openwall.com/lists/oss-security/2016/04/05/2</url>
 <url>https://golang.org/cl/21533</url>
 </references>
 <dates>
 <discovery>2016-04-05</discovery>
 <entry>2016-04-14</entry>
 </dates>
 </vuln>

<vuln vid="a636fc26-00d9-11e6-b704-000c292e4fd8">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba36</name>
	<range><ge>3.6.0</ge><le>3.6.25_3</le></range>
 </package>
 <package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><le>4.0.26</le></range>
 </package>
 <package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><le>4.1.23</le></range>
 </package>
 <package>
	<name>samba42</name>
	<range><ge>4.2.0</ge><lt>4.2.11</lt></range>
 </package>
 <package>
	<name>samba43</name>
	<range><ge>4.3.0</ge><lt>4.3.8</lt></range>
 </package>
 <package>
	<name>samba44</name>
	<range><ge>4.4.0</ge><lt>4.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samba team reports:
	<blockquote cite="https://www.samba.org/samba/latest_news.html#4.4.2">
	 [CVE-2015-5370] Errors in Samba DCE-RPC code can lead to denial of service
	 (crashes and high cpu consumption) and man in the middle attacks.
	 [CVE-2016-2110] The feature negotiation of NTLMSSP is not downgrade protected.
	 A man in the middle is able to clear even required flags, especially
	 NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL.
	 [CVE-2016-2111] When Samba is configured as Domain Controller it allows remote
	 attackers to spoof the computer name of a secure channel's endpoints, and obtain
	 sensitive session information, by running a crafted application and leveraging
	 the ability to sniff network traffic.
	 [CVE-2016-2112] A man in the middle is able to downgrade LDAP connections
	 to no integrity protection.
	 [CVE-2016-2113] Man in the middle attacks are possible for client triggered LDAP
	 connections (with ldaps://) and ncacn_http connections (with https://).
	 [CVE-2016-2114] Due to a bug Samba doesn't enforce required smb signing, even if explicitly configured.
	 [CVE-2016-2115] The protection of DCERPC communication over ncacn_np (which is
	 the default for most the file server related protocols) is inherited from the underlying SMB connection.
	 [CVE-2016-2118] a.k.a. BADLOCK. A man in the middle can intercept any DCERPC traffic
	 between a client and a server in order to impersonate the client and get the same privileges
	 as the authenticated user account. This is most problematic against active directory domain controllers.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5370</cvename>
 <url>https://www.samba.org/samba/security/CVE-2015-5370.html</url>
 <cvename>CVE-2016-2110</cvename>
 <url>https://www.samba.org/samba/security/CVE-2016-2110.html</url>
 <cvename>CVE-2016-2111</cvename>
 <url>https://www.samba.org/samba/security/CVE-2016-2111.html</url>
 <cvename>CVE-2016-2112</cvename>
 <url>https://www.samba.org/samba/security/CVE-2016-2112.html</url>
 <cvename>CVE-2016-2113</cvename>
 <url>https://www.samba.org/samba/security/CVE-2016-2113.html</url>
 <cvename>CVE-2016-2114</cvename>
 <url>https://www.samba.org/samba/security/CVE-2016-2114.html</url>
 <cvename>CVE-2016-2115</cvename>
 <url>https://www.samba.org/samba/security/CVE-2016-2115.html</url>
 <cvename>CVE-2016-2118</cvename>
 <url>https://www.samba.org/samba/security/CVE-2016-2118.html</url>
 </references>
 <dates>
 <discovery>2016-04-12</discovery>
 <entry>2016-04-12</entry>
 <modified>2016-04-12</modified>
 </dates>
 </vuln>

<vuln vid="482d40cb-f9a3-11e5-92ce-002590263bf5">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php70</name>
	<name>php70-fileinfo</name>
	<name>php70-mbstring</name>
	<name>php70-phar</name>
	<name>php70-snmp</name>
	<range><lt>7.0.5</lt></range>
 </package>
 <package>
	<name>php56</name>
	<name>php56-fileinfo</name>
	<name>php56-mbstring</name>
	<name>php56-phar</name>
	<name>php56-snmp</name>
	<range><lt>5.6.20</lt></range>
 </package>
 <package>
	<name>php55</name>
	<name>php55-fileinfo</name>
	<name>php55-mbstring</name>
	<name>php55-phar</name>
	<name>php55-snmp</name>
	<range><lt>5.5.34</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP Group reports:
	<blockquote cite="http://php.net/ChangeLog-7.php#7.0.5">
	 <ul><li>Fileinfo:
	 <ul>
	 <li>Fixed bug #71527 (Buffer over-write in finfo_open with
	 malformed magic file).</li>
	 </ul></li>
	 <li>mbstring:
	 <ul>
	 <li>Fixed bug #71906 (AddressSanitizer: negative-size-param (-1)
	 in mbfl_strcut).</li>
	 </ul></li>
	 <li>Phar:
	 <ul>
	 <li>Fixed bug #71860 (Invalid memory write in phar on filename with
	 \0 in name).</li>
	 </ul></li>
	 <li>SNMP:
	 <ul>
	 <li>Fixed bug #71704 (php_snmp_error() Format String Vulnerability).
	 </li>
	 </ul></li>
	 <li>Standard:
	 <ul>
	 <li>Fixed bug #71798 (Integer Overflow in php_raw_url_encode).</li>
	 </ul></li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/208465</freebsdpr>
 <url>http://php.net/ChangeLog-7.php#7.0.5</url>
 <url>http://php.net/ChangeLog-5.php#5.6.20</url>
 <url>http://php.net/ChangeLog-5.php#5.5.34</url>
 </references>
 <dates>
 <discovery>2016-03-31</discovery>
 <entry>2016-04-03</entry>
 </dates>
 </vuln>

<vuln vid="497b82e0-f9a0-11e5-92ce-002590263bf5">
 <topic>pcre -- heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>pcre</name>
	<range><lt>8.38_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283">
	 The pcre_compile2 function in pcre_compile.c in PCRE 8.38
	 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'&lt;((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/
	 pattern and related patterns with named subgroups, which allows
	 remote attackers to cause a denial of service (heap-based buffer
	 overflow) or possibly have unspecified other impact via a crafted
	 regular expression, as demonstrated by a JavaScript RegExp object
	 encountered by Konqueror.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1283</cvename>
 <freebsdpr>ports/208260</freebsdpr>
 <url>https://bugs.exim.org/show_bug.cgi?id=1767</url>
 </references>
 <dates>
 <discovery>2016-02-27</discovery>
 <entry>2016-04-03</entry>
 </dates>
 </vuln>

<vuln vid="df328fac-f942-11e5-92ce-002590263bf5">
 <topic>py-djblets -- Self-XSS vulnerability</topic>
 <affects>
 <package>
	<name>py27-djblets</name>
	<name>py32-djblets</name>
	<name>py33-djblets</name>
	<name>py34-djblets</name>
	<name>py35-djblets</name>
	<range><lt>0.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Djblets Release Notes reports:
	<blockquote cite="https://www.reviewboard.org/docs/releasenotes/djblets/0.9.2/">
	 A recently-discovered vulnerability in the datagrid templates allows an
	 attacker to generate a URL to any datagrid page containing malicious code
	 in a column sorting value. If the user visits that URL and then clicks
	 that column, the code will execute.
	 The cause of the vulnerability was due to a template not escaping
	 user-provided values.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.reviewboard.org/docs/releasenotes/djblets/0.9.2/</url>
 </references>
 <dates>
 <discovery>2016-03-01</discovery>
 <entry>2016-04-03</entry>
 </dates>
 </vuln>

<vuln vid="a430e15d-f93f-11e5-92ce-002590263bf5">
 <topic>moodle -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moodle28</name>
	<range><lt>2.8.11</lt></range>
 </package>
 <package>
	<name>moodle29</name>
	<range><lt>2.9.5</lt></range>
 </package>
 <package>
	<name>moodle30</name>
	<range><lt>3.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marina Glancy reports:
	<blockquote cite="https://moodle.org/security/">
	 <ul>
	 <li>MSA-16-0003: Incorrect capability check when displaying
	 users emails in Participants list</li>
	 <li>MSA-16-0004: XSS from profile fields from external db
	 </li>
	 <li>MSA-16-0005: Reflected XSS in mod_data advanced search
	 </li>
	 <li>MSA-16-0006: Hidden courses are shown to students in Event
	 Monitor</li>
	 <li>MSA-16-0007: Non-Editing Instructor role can edit exclude
	 checkbox in Single View</li>
	 <li>MSA-16-0008: External function get_calendar_events return
	 events that pertains to hidden activities</li>
	 <li>MSA-16-0009: CSRF in Assignment plugin management page
	 </li>
	 <li>MSA-16-0010: Enumeration of category details possible without
	 authentication</li>
	 <li>MSA-16-0011: Add no referrer to links with _blank target
	 attribute</li>
	 <li>MSA-16-0012: External function mod_assign_save_submission
	 does not check due dates</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2151</cvename>
 <cvename>CVE-2016-2152</cvename>
 <cvename>CVE-2016-2153</cvename>
 <cvename>CVE-2016-2154</cvename>
 <cvename>CVE-2016-2155</cvename>
 <cvename>CVE-2016-2156</cvename>
 <cvename>CVE-2016-2157</cvename>
 <cvename>CVE-2016-2158</cvename>
 <cvename>CVE-2016-2190</cvename>
 <cvename>CVE-2016-2159</cvename>
 <url>https://moodle.org/security/</url>
 </references>
 <dates>
 <discovery>2016-03-21</discovery>
 <entry>2016-04-03</entry>
 </dates>
 </vuln>

<vuln vid="297117ba-f92d-11e5-92ce-002590263bf5">
 <topic>squid -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>3.5.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid security advisory 2016:3 reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_3.txt">
	 Due to a buffer overrun Squid pinger binary is vulnerable to
	 denial of service or information leak attack when processing
	 ICMPv6 packets.
	 This bug also permits the server response to manipulate other
	 ICMP and ICMPv6 queries processing to cause information leak.
	 This bug allows any remote server to perform a denial of service
	 attack on the Squid service by crashing the pinger. This may
	 affect Squid HTTP routing decisions. In some configurations,
	 sub-optimal routing decisions may result in serious service
	 degradation or even transaction failures.
	 If the system does not contain buffer-overrun protection leading
	 to that crash this bug will instead allow attackers to leak
	 arbitrary amounts of information from the heap into Squid log
	 files. This is of higher importance than usual because the pinger
	 process operates with root priviliges.
	</blockquote>
	Squid security advisory 2016:4 reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_4.txt">
	 Due to incorrect bounds checking Squid is vulnerable to a denial
	 of service attack when processing HTTP responses.
	 This problem allows a malicious client script and remote server
	 delivering certain unusual HTTP response syntax to trigger a
	 denial of service for all clients accessing the Squid service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3947</cvename>
 <cvename>CVE-2016-3948</cvename>
 <freebsdpr>ports/208463</freebsdpr>
 <url>http://www.squid-cache.org/Advisories/SQUID-2016_3.txt</url>
 <url>http://www.squid-cache.org/Advisories/SQUID-2016_4.txt</url>
 </references>
 <dates>
 <discovery>2016-03-28</discovery>
 <entry>2016-04-02</entry>
 </dates>
 </vuln>

<vuln vid="97a24d2e-f74c-11e5-8458-6cc21735f730">
 <topic>PostgreSQL -- minor security problems.</topic>
 <affects>
 <package>
	<name>postgresql95-server</name>
	<name>postgresql95-contrib</name>
	<range><ge>9.5.0</ge><lt>9.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL project reports:
	<blockquote cite="http://www.postgresql.org/about/news/1656/">
	 Security Fixes for RLS, BRIN
	 
	 This release closes security hole CVE-2016-2193
	 (https://access.redhat.com/security/cve/CVE-2016-2193), where a query
	 plan might get reused for more than one ROLE in the same session.
	 This could cause the wrong set of Row Level Security (RLS) policies to
	 be used for the query.
	 
	 The update also fixes CVE-2016-3065
	 (https://access.redhat.com/security/cve/CVE-2016-3065), a server crash
	 bug triggered by using `pageinspect` with BRIN index pages. Since an
	 attacker might be able to expose a few bytes of server memory, this
	 crash is being treated as a security issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2193</cvename>
 <cvename>CVE-2016-3065</cvename>
 </references>
 <dates>
 <discovery>2016-03-01</discovery>
 <entry>2016-03-31</entry>
 </dates>
 </vuln>

<vuln vid="f7b3d1eb-f738-11e5-a710-0011d823eebd">
 <topic>flash -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.577</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-08.html">
	 These updates resolve integer overflow vulnerabilities that
	 could lead to code execution (CVE-2016-0963, CVE-2016-0993,
	 CVE-2016-1010).
	 These updates resolve use-after-free vulnerabilities that could
	 lead to code execution (CVE-2016-0987, CVE-2016-0988,
	 CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995,
	 CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999,
	 CVE-2016-1000).
	 These updates resolve a heap overflow vulnerability that could
	 lead to code execution (CVE-2016-1001).
	 These updates resolve memory corruption vulnerabilities that
	 could lead to code execution (CVE-2016-0960, CVE-2016-0961,
	 CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992,
	 CVE-2016-1002, CVE-2016-1005).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-0960</cvename>
 <cvename>CVE-2016-0961</cvename>
 <cvename>CVE-2016-0962</cvename>
 <cvename>CVE-2016-0963</cvename>
 <cvename>CVE-2016-0986</cvename>
 <cvename>CVE-2016-0987</cvename>
 <cvename>CVE-2016-0988</cvename>
 <cvename>CVE-2016-0989</cvename>
 <cvename>CVE-2016-0990</cvename>
 <cvename>CVE-2016-0991</cvename>
 <cvename>CVE-2016-0992</cvename>
 <cvename>CVE-2016-0993</cvename>
 <cvename>CVE-2016-0994</cvename>
 <cvename>CVE-2016-0995</cvename>
 <cvename>CVE-2016-0996</cvename>
 <cvename>CVE-2016-0997</cvename>
 <cvename>CVE-2016-0998</cvename>
 <cvename>CVE-2016-0999</cvename>
 <cvename>CVE-2016-1000</cvename>
 <cvename>CVE-2016-1001</cvename>
 <cvename>CVE-2016-1002</cvename>
 <cvename>CVE-2016-1005</cvename>
 <cvename>CVE-2016-1010</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb16-08.html</url>
 </references>
 <dates>
 <discovery>2016-03-10</discovery>
 <entry>2016-03-31</entry>
 </dates>
 </vuln>

<vuln vid="4cd9b19f-f66d-11e5-b94c-001999f8d30b">
 <topic>Multiple vulnerabilities in Botan</topic>
 <affects>
 <package>
	<name>botan110</name>
	<range><lt>1.10.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The botan developers reports:
	<blockquote cite="http://botan.randombit.net/security.html">
	 Infinite loop in modular square root algorithm - The ressol function implements the Tonelli-Shanks algorithm for finding square roots could be sent into a nearly infinite loop due to a misplaced conditional check. This could occur if a composite modulus is provided, as this algorithm is only defined for primes. This function is exposed to attacker controlled input via the OS2ECP function during ECC point decompression.
	 Heap overflow on invalid ECC point - The PointGFp constructor did not check that the affine coordinate arguments were less than the prime, but then in curve multiplication assumed that both arguments if multiplied would fit into an integer twice the size of the prime.
	 The bigint_mul and bigint_sqr functions received the size of the output buffer, but only used it to dispatch to a faster algorithm in cases where there was sufficient output space to call an unrolled multiplication function.
	 The result is a heap overflow accessible via ECC point decoding, which accepted untrusted inputs. This is likely exploitable for remote code execution.
	 On systems which use the mlock pool allocator, it would allow an attacker to overwrite memory held in secure_vector objects. After this point the write will hit the guard page at the end of the mmapped region so it probably could not be used for code execution directly, but would allow overwriting adjacent key material.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://botan.randombit.net/security.html</url>
 <cvename>CVE-2016-2194</cvename>
 <cvename>CVE-2016-2195</cvename>
 </references>
 <dates>
 <discovery>2016-02-01</discovery>
 <entry>2016-03-31</entry>
 </dates>
 </vuln>

<vuln vid="2004616d-f66c-11e5-b94c-001999f8d30b">
 <topic>Botan BER Decoder vulnerabilities</topic>
 <affects>
 <package>
	<name>botan110</name>
	<range><lt>1.10.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The botan developers reports:
	<blockquote cite="http://botan.randombit.net/">
	 Excess memory allocation in BER decoder - The BER decoder would allocate a fairly arbitrary amount of memory in a length field, even if there was no chance the read request would succeed. This might cause the process to run out of memory or invoke the OOM killer.
	 Crash in BER decoder - The BER decoder would crash due to reading from offset 0 of an empty vector if it encountered a BIT STRING which did not contain any data at all. This can be used to easily crash applications reading untrusted ASN.1 data, but does not seem exploitable for code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://botan.randombit.net/security.html</url>
 <cvename>CVE-2015-5726</cvename>
 <cvename>CVE-2015-5727</cvename>
 </references>
 <dates>
 <discovery>2015-08-03</discovery>
 <entry>2016-03-31</entry>
 </dates>
 </vuln>

<vuln vid="e1085b15-f609-11e5-a230-0014a5a57822">
 <topic>mercurial -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mercurial</name>
	<range><lt>2.7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mercurial reports:
	<blockquote cite="https://www.mercurial-scm.org/pipermail/mercurial/2016-March/049452.html">
	 CVE-2016-3630: Remote code execution in binary delta decoding
	 CVE-2016-3068: Arbitrary code execution with Git subrepos
	 CVE-2016-3069: Arbitrary code execution when converting
	 Git repos
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3630</cvename>
 <cvename>CVE-2016-3068</cvename>
 <cvename>CVE-2016-3069</cvename>
 <url>https://www.mercurial-scm.org/pipermail/mercurial/2016-March/049452.html</url>
 </references>
 <dates>
 <discovery>2016-03-29</discovery>
 <entry>2016-03-29</entry>
 </dates>
 </vuln>

<vuln vid="8be8ca39-ae70-4422-bf1a-d8fae6911c5e">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>49.0.2623.108</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html">
	 [594574] High CVE-2016-1646: Out-of-bounds read in V8.
	 [590284] High CVE-2016-1647: Use-after-free in Navigation.
	 [590455] High CVE-2016-1648: Use-after-free in Extensions.
	 [597518] CVE-2016-1650: Various fixes from internal audits,
	 fuzzing and other initiatives.
	 Multiple vulnerabilities in V8 fixed at the tip of the
	 4.9 branch
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1646</cvename>
 <cvename>CVE-2016-1647</cvename>
 <cvename>CVE-2016-1648</cvename>
 <cvename>CVE-2016-1649</cvename>
 <cvename>CVE-2016-1650</cvename>
 <url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html</url>
 </references>
 <dates>
 <discovery>2016-03-24</discovery>
 <entry>2016-03-29</entry>
 </dates>
 </vuln>

<vuln vid="5c288f68-c7ca-4c0d-b7dc-1ec6295200b3">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>49.0.2623.87</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html">
	 [589838] High CVE-2016-1643: Type confusion in Blink.
	 [590620] High CVE-2016-1644: Use-after-free in Blink.
	 [587227] High CVE-2016-1645: Out-of-bounds write in PDFium.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1643</cvename>
 <cvename>CVE-2016-1644</cvename>
 <cvename>CVE-2016-1645</cvename>
 <url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html</url>
 </references>
 <dates>
 <discovery>2016-03-08</discovery>
 <entry>2016-03-29</entry>
 </dates>
 </vuln>

<vuln vid="cd409df7-f483-11e5-92ce-002590263bf5">
 <topic>bind -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>bind910</name>
	<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
 </package>
 <package>
	<name>bind9-devel</name>
	<range><lt>9.11.0.a20160309</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01351">
	 A response containing multiple DNS cookies causes servers with
	 cookie support enabled to exit with an assertion failure.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2088</cvename>
 <url>https://kb.isc.org/article/AA-01351</url>
 </references>
 <dates>
 <discovery>2016-03-09</discovery>
 <entry>2016-03-28</entry>
 </dates>
 </vuln>

<vuln vid="cba246d2-f483-11e5-92ce-002590263bf5">
 <topic>bind -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>bind98</name>
	<range><le>9.8.8</le></range>
 </package>
 <package>
	<name>bind99</name>
	<range><ge>9.9.0</ge><lt>9.9.8P4</lt></range>
 </package>
 <package>
	<name>bind910</name>
	<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
 </package>
 <package>
	<name>bind9-devel</name>
	<range><lt>9.11.0.a20160309</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_38</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01353">
	 A problem parsing resource record signatures for DNAME resource
	 records can lead to an assertion failure in resolver.c or db.c
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1286</cvename>
 <freebsdsa>SA-16:13.bind</freebsdsa>
 <url>https://kb.isc.org/article/AA-01353</url>
 </references>
 <dates>
 <discovery>2016-03-09</discovery>
 <entry>2016-03-28</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="c9075321-f483-11e5-92ce-002590263bf5">
 <topic>bind -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>bind98</name>
	<range><le>9.8.8</le></range>
 </package>
 <package>
	<name>bind99</name>
	<range><ge>9.9.0</ge><lt>9.9.8P4</lt></range>
 </package>
 <package>
	<name>bind910</name>
	<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
 </package>
 <package>
	<name>bind9-devel</name>
	<range><lt>9.11.0.a20160309</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_38</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01352">
	 An error parsing input received by the rndc control channel can
	 cause an assertion failure in sexpr.c or alist.c.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1285</cvename>
 <freebsdsa>SA-16:13.bind</freebsdsa>
 <url>https://kb.isc.org/article/AA-01352</url>
 </references>
 <dates>
 <discovery>2016-03-09</discovery>
 <entry>2016-03-28</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="6d25c306-f3bb-11e5-92ce-002590263bf5">
 <topic>salt -- Insecure configuration of PAM external authentication service</topic>
 <affects>
 <package>
	<name>py27-salt</name>
	<name>py32-salt</name>
	<name>py33-salt</name>
	<name>py34-salt</name>
	<name>py35-salt</name>
	<range><lt>2015.5.10</lt></range>
	<range><ge>2015.8.0</ge><lt>2015.8.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SaltStack reports:
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html">
	 This issue affects all Salt versions prior to 2015.8.8/2015.5.10
	 when PAM external authentication is enabled. This issue involves
	 passing an alternative PAM authentication service with a command
	 that is sent to LocalClient, enabling the attacker to bypass the
	 configured authentication service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-3176</cvename>
 <url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html</url>
 </references>
 <dates>
 <discovery>2016-03-17</discovery>
 <entry>2016-03-27</entry>
 </dates>
 </vuln>

<vuln vid="a258604d-f2aa-11e5-b4a9-ac220bdcec59">
 <topic>activemq -- Unsafe deserialization</topic>
 <affects>
 <package>
	<name>activemq</name>
	<range><lt>5.13.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Alvaro Muatoz, Matthias Kaiser and Christian Schneider reports:
	<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt">
	 JMS Object messages depends on Java Serialization for
	 marshaling/unmashaling of the message payload. There are a couple of places
	 inside the broker where deserialization can occur, like web console or stomp
	 object message transformation. As deserialization of untrusted data can lead to
	 security flaws as demonstrated in various reports, this leaves the broker
	 vulnerable to this attack vector. Additionally, applications that consume
	 ObjectMessage type of messages can be vulnerable as they deserialize objects on
	 ObjectMessage.getObject() calls.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt</url>
 <cvename>CVE-2015-5254</cvename>
 </references>
 <dates>
 <discovery>2016-01-08</discovery>
 <entry>2016-03-25</entry>
 </dates>
 </vuln>

<vuln vid="950b2d60-f2a9-11e5-b4a9-ac220bdcec59">
 <topic>activemq -- Web Console Clickjacking</topic>
 <affects>
 <package>
	<name>activemq</name>
	<range><lt>5.13.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michael Furman reports:
	<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt">
	 The web based administration console does not set the
	 X-Frame-Options header in HTTP responses. This allows the console to be embedded
	 in a frame or iframe which could then be used to cause a user to perform an
	 unintended action in the console.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt</url>
 <cvename>CVE-2016-0734</cvename>
 </references>
 <dates>
 <discovery>2016-03-10</discovery>
 <entry>2016-03-25</entry>
 </dates>
 </vuln>

<vuln vid="a6cc5753-f29e-11e5-b4a9-ac220bdcec59">
 <topic>activemq -- Web Console Cross-Site Scripting</topic>
 <affects>
 <package>
	<name>activemq</name>
	<range><lt>5.13.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Vladimir Ivanov (Positive Technologies) reports:
	<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt">
	 Several instances of cross-site scripting vulnerabilities were
	 identified to be present in the web based administration console as well as the
	 ability to trigger a Java memory dump into an arbitrary folder. The root cause
	 of these issues are improper user data output validation and incorrect
	 permissions configured on Jolokia.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt</url>
 <cvename>CVE-2016-0782</cvename>
 </references>
 <dates>
 <discovery>2016-03-10</discovery>
 <entry>2016-03-25</entry>
 </dates>
 </vuln>

<vuln vid="7033b42d-ef09-11e5-b766-14dae9d210b8">
 <topic>pcre -- stack buffer overflow</topic>
 <affects>
 <package>
	<name>pcre</name>
	<range><lt>8.38</lt></range>
 </package>
 <package>
	<name>pcre2</name>
	<range><lt>10.20_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Philip Hazel reports:
	<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1791">
	 PCRE does not validate that handling the (*ACCEPT) verb
	 will occur within the bounds of the cworkspace stack buffer, leading to
	 a stack buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.exim.org/show_bug.cgi?id=1791</url>
 <cvename>CVE-2016-3191</cvename>
 </references>
 <dates>
 <discovery>2016-02-09</discovery>
 <entry>2016-03-21</entry>
 <modified>2016-03-21</modified>
 </dates>
 </vuln>

<vuln vid="c428de09-ed69-11e5-92ce-002590263bf5">
 <topic>kamailio -- SEAS Module Heap overflow</topic>
 <affects>
 <package>
	<name>kamailio</name>
	<range><lt>4.3.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stelios Tsampas reports:
	<blockquote cite="http://seclists.org/oss-sec/2016/q1/338">
	 A (remotely exploitable) heap overflow vulnerability was found in
	 Kamailio v4.3.4.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2385</cvename>
 <url>https://github.com/kamailio/kamailio/commit/f50c9c853e7809810099c970780c30b0765b0643</url>
 <url>https://census-labs.com/news/2016/03/30/kamailio-seas-heap-overflow/</url>
 <url>http://seclists.org/oss-sec/2016/q1/338</url>
 </references>
 <dates>
 <discovery>2016-02-15</discovery>
 <entry>2016-03-19</entry>
 <modified>2016-04-03</modified>
 </dates>
 </vuln>

<vuln vid="5dd39f26-ed68-11e5-92ce-002590263bf5">
 <topic>hadoop2 -- unauthorized disclosure of data vulnerability</topic>
 <affects>
 <package>
	<name>hadoop2</name>
	<range><ge>2.6</ge><lt>2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Arun Suresh reports:
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/browser">
	 RPC traffic from clients, potentially including authentication
	 credentials, may be intercepted by a malicious user with access to
	 run tasks or containers on a cluster.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1776</cvename>
 <url>http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/browser</url>
 </references>
 <dates>
 <discovery>2016-02-15</discovery>
 <entry>2016-03-19</entry>
 </dates>
 </vuln>

<vuln vid="d2a84feb-ebe0-11e5-92ce-002590263bf5">
 <topic>git -- integer overflow</topic>
 <affects>
 <package>
	<name>git</name>
	<range><lt>2.4.11</lt></range>
	<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
	<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
	<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
 </package>
 <package>
	<name>git-gui</name>
	<range><lt>2.4.11</lt></range>
	<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
	<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
	<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
 </package>
 <package>
	<name>git-lite</name>
	<range><lt>2.4.11</lt></range>
	<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
	<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
	<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
 </package>
 <package>
	<name>git-subversion</name>
	<range><lt>2.4.11</lt></range>
	<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
	<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
	<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian reports:
	<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2016-2324">
	 integer overflow due to a loop which adds more to "len".
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2324</cvename>
 <url>https://security-tracker.debian.org/tracker/CVE-2016-2324</url>
 <url>https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d</url>
 </references>
 <dates>
 <discovery>2016-02-24</discovery>
 <entry>2016-03-18</entry>
 </dates>
 </vuln>

<vuln vid="93ee802e-ebde-11e5-92ce-002590263bf5">
 <topic>git -- potential code execution</topic>
 <affects>
 <package>
	<name>git</name>
	<range><lt>2.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian reports:
	<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2016-2315">
	 "int" is the wrong data type for ... nlen assignment.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2315</cvename>
 <url>http://www.openwall.com/lists/oss-security/2016/03/15/6</url>
 <url>https://marc.info/?l=oss-security&amp;m=145809217306686&amp;w=2</url>
 <url>https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305</url>
 <url>https://security-tracker.debian.org/tracker/CVE-2016-2315</url>
 </references>
 <dates>
 <discovery>2015-09-24</discovery>
 <entry>2016-03-17</entry>
 </dates>
 </vuln>

<vuln vid="6d33b3e5-ea03-11e5-85be-14dae9d210b8">
 <topic>node -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>node</name>
	<range><lt>5.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jeremiah Senkpiel reports:
	<blockquote cite="https://github.com/nodejs/node/commit/805f054cc7791c447dbb960fbf3b179ea05294ac">
	 <ul>
	 <li>Fix a double-free defect in parsing malformed DSA keys
	 that may potentially be used for DoS or memory corruption attacks.</li>
	 <li>Fix a defect that can cause memory corruption in
	 certain very rare cases</li>
	 <li>Fix a defect that makes the CacheBleed Attack possible</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/nodejs/node/commit/805f054cc7791c447dbb960fbf3b179ea05294ac</url>
 <cvename>CVE-2016-0702</cvename>
 <cvename>CVE-2016-0705</cvename>
 <cvename>CVE-2016-0797</cvename>
 </references>
 <dates>
 <discovery>2016-03-02</discovery>
 <entry>2016-03-14</entry>
 </dates>
 </vuln>

<vuln vid="8eb78cdc-e9ec-11e5-85be-14dae9d210b8">
 <topic>dropbear -- authorized_keys command= bypass</topic>
 <affects>
 <package>
	<name>dropbear</name>
	<range><lt>2016.72</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matt Johnson reports:
	<blockquote cite="https://matt.ucc.asn.au/dropbear/CHANGES">
	 Validate X11 forwarding input. Could allow bypass of
	 authorized_keys command= restrictions
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://matt.ucc.asn.au/dropbear/CHANGES</url>
 <cvename>CVE-2016-3116</cvename>
 </references>
 <dates>
 <discovery>2016-03-11</discovery>
 <entry>2016-03-14</entry>
 </dates>
 </vuln>

<vuln vid="77b7ffb7-e937-11e5-8bed-5404a68ad561">
 <topic>jpgraph2 -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>jpgraph2</name>
	<range><lt>3.0.7_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Martin Barbella reports:
	<blockquote cite="http://www.securityfocus.com/archive/1/archive/1/508586/100/0/threaded">
	 JpGraph is an object oriented library for PHP that can be used to create
	 various types of graphs which also contains support for client side
	 image maps.

The GetURLArguments function for the JpGraph's Graph class does not
	 properly sanitize the names of get and post variables, leading to a
	 cross site scripting vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/archive/1/archive/1/508586/100/0/threaded</url>
 </references>
 <dates>
 <discovery>2009-12-22</discovery>
 <entry>2016-03-13</entry>
 </dates>
 </vuln>

<vuln vid="5af511e5-e928-11e5-92ce-002590263bf5">
 <topic>php7 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php70</name>
	<name>php70-soap</name>
	<range><lt>7.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP Group reports:
	<blockquote cite="http://php.net/ChangeLog-7.php#7.0.4">
	 <ul><li>Core:
	 <ul>
	 <li>Fixed bug #71637 (Multiple Heap Overflow due to integer
	 overflows in xml/filter_url/addcslashes).</li>
	 </ul></li>
	 <li>SOAP:
	 <ul>
	 <li>Fixed bug #71610 (Type Confusion Vulnerability - SOAP /
	 make_http_soap_request()).</li>
	 </ul></li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://php.net/ChangeLog-7.php#7.0.4</url>
 </references>
 <dates>
 <discovery>2016-03-03</discovery>
 <entry>2016-03-13</entry>
 </dates>
 </vuln>

<vuln vid="e991ef79-e920-11e5-92ce-002590263bf5">
 <topic>php5 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php55-phar</name>
	<name>php55-wddx</name>
	<range><lt>5.5.33</lt></range>
 </package>
 <package>
	<name>php56-phar</name>
	<name>php56-wddx</name>
	<range><lt>5.6.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP Group reports:
	<blockquote cite="http://php.net/ChangeLog-5.php#5.6.19">
	 <ul><li>Phar:
	 <ul>
	 <li>Fixed bug #71498 (Out-of-Bound Read in phar_parse_zipfile()).
	 </li>
	 </ul></li>
	 <li>WDDX:
	 <ul>
	 <li>Fixed bug #71587 (Use-After-Free / Double-Free in WDDX
	 Deserialize).</li>
	 </ul></li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://php.net/ChangeLog-5.php#5.6.19</url>
 <url>http://php.net/ChangeLog-5.php#5.5.33</url>
 </references>
 <dates>
 <discovery>2016-03-03</discovery>
 <entry>2016-03-13</entry>
 </dates>
 </vuln>

<vuln vid="e4644df8-e7da-11e5-829d-c80aa9043978">
 <topic>openssh -- command injection when X11Forwarding is enabled</topic>
 <affects>
 <package>
	<name>openssh-portable</name>
	<range><lt>7.2.p2,1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_14</lt></range>
	<range><ge>10.1</ge><lt>10.1_31</lt></range>
	<range><ge>9.3</ge><lt>9.3_39</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSH project reports:
	<blockquote cite="http://www.openssh.com/txt/x11fwd.adv">
	 Missing sanitisation of untrusted input allows an
	 authenticated user who is able to request X11 forwarding
	 to inject commands to xauth(1).
	 
	 Injection of xauth commands grants the ability to read
	 arbitrary files under the authenticated user's privilege,
	 Other xauth commands allow limited information leakage,
	 file overwrite, port probing and generally expose xauth(1),
	 which was not written with a hostile user in mind, as an
	 attack surface.
	 
	 Mitigation:
	 Set X11Forwarding=no in sshd_config. This is the default.
	 For authorized_keys that specify a "command" restriction,
	 also set the "restrict" (available in OpenSSH &gt;=7.2) or
	 "no-x11-forwarding" restrictions.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openssh.com/txt/x11fwd.adv</url>
 <cvename>CVE-2016-3115</cvename>
 <freebsdsa>SA-16:14.openssh</freebsdsa>
 </references>
 <dates>
 <discovery>2016-03-11</discovery>
 <entry>2016-03-11</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="70c44cd0-e717-11e5-85be-14dae9d210b8">
 <topic>quagga -- stack based buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>quagga</name>
	<range><lt>1.0.20160309</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Donald Sharp reports:
	<blockquote cite="https://www.kb.cert.org/vuls/id/270232">
	 A malicious BGP peer may execute arbitrary code in
	 particularly configured remote bgpd hosts.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.kb.cert.org/vuls/id/270232</url>
 <url>http://savannah.nongnu.org/forum/forum.php?forum_id=8476</url>
 <cvename>CVE-2016-2342</cvename>
 </references>
 <dates>
 <discovery>2016-01-27</discovery>
 <entry>2016-03-10</entry>
 </dates>
 </vuln>

<vuln vid="d71831ef-e6f8-11e5-85be-14dae9d210b8">
 <topic>ricochet -- information disclosure</topic>
 <affects>
 <package>
	<name>ricochet</name>
	<range><lt>1.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	special reports:
	<blockquote cite="https://github.com/ricochet-im/ricochet/releases/tag/v1.1.2">
	 By sending a nickname with some HTML tags in a contact
	 request, an attacker could cause Ricochet to make network requests
	 without Tor after the request is accepted, which would reveal the user's
	 IP address.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/ricochet-im/ricochet/releases/tag/v1.1.2</url>
 </references>
 <dates>
 <discovery>2016-02-15</discovery>
 <entry>2016-03-10</entry>
 </dates>
 </vuln>

<vuln vid="77e0b631-e6cf-11e5-85be-14dae9d210b8">
 <topic>pidgin-otr -- use after free</topic>
 <affects>
 <package>
	<name>pidgin-otr</name>
	<range><lt>4.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hanno Bock reports:
	<blockquote cite="http://seclists.org/oss-sec/2016/q1/572">
	 The pidgin-otr plugin version 4.0.2 fixes a heap use after
	 free error.
	 The bug is triggered when a user tries to authenticate a buddy and
	 happens in the function create_smp_dialog.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2016/q1/572</url>
 <url>https://bugs.otr.im/issues/88</url>
 <url>https://bugs.otr.im/issues/128</url>
 <cvename>CVE-2015-8833</cvename>
 </references>
 <dates>
 <discovery>2015-04-04</discovery>
 <entry>2016-03-10</entry>
 </dates>
 </vuln>

<vuln vid="c2b1652c-e647-11e5-85be-14dae9d210b8">
 <topic>libotr -- integer overflow</topic>
 <affects>
 <package>
	<name>libotr</name>
	<range><lt>4.1.1</lt></range>
 </package>
 <package>
	<name>libotr3</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	X41 D-Sec reports:
	<blockquote cite="https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/">
	 A remote attacker may crash or execute arbitrary code in
	 libotr by sending large OTR messages.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/</url>
 <cvename>CVE-2016-2851</cvename>
 </references>
 <dates>
 <discovery>2016-02-17</discovery>
 <entry>2016-03-09</entry>
 <modified>2016-03-09</modified>
 </dates>
 </vuln>

<vuln vid="1bcfd963-e483-41b8-ab8e-bad5c3ce49c9">
 <topic>brotli -- buffer overflow</topic>
 <affects>
 <package>
	<name>brotli</name>
	<range><ge>0.3.0</ge><lt>0.3.0_1</lt></range>
	<range><lt>0.2.0_2</lt></range>
 </package>
 <package>
	<name>libbrotli</name>
	<range><lt>0.3.0_3</lt></range>
 </package>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>48.0.2564.109</lt></range>
 </package>
 <package>
	<name>firefox</name>
	<name>linux-firefox</name>
	<range><lt>45.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.42</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>38.7.0,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>38.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html">
	 [583607] High CVE-2016-1624: Buffer overflow in Brotli. Credit to lukezli.
	</blockquote>
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-30/">
	 Security researcher Luke Li reported a pointer underflow
	 bug in the Brotli library's decompression that leads to a
	 buffer overflow. This results in a potentially exploitable
	 crash when triggered.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1624</cvename>
 <cvename>CVE-2016-1968</cvename>
 <url>https://github.com/google/brotli/commit/37a320dd81db8d546cd24a45b4c61d87b45dcade</url>
 <url>https://chromium.googlesource.com/chromium/src/+/7716418a27d561ee295a99f11fd3865580748de2%5E!/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-30/</url>
 <url>https://hg.mozilla.org/releases/mozilla-release/rev/4a5d8ade4e3e</url>
 </references>
 <dates>
 <discovery>2016-02-08</discovery>
 <entry>2016-03-08</entry>
 <modified>2016-03-08</modified>
 </dates>
 </vuln>

<vuln vid="2225c5b4-1e5a-44fc-9920-b3201c384a15">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<name>linux-firefox</name>
	<range><lt>45.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.42</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>38.7.0,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>38.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox45">
	 MFSA 2016-16 Miscellaneous memory safety hazards (rv:45.0
	 / rv:38.7)
	 MFSA 2016-17 Local file overwriting and potential
	 privilege escalation through CSP reports
	 MFSA 2016-18 CSP reports fail to strip location
	 information for embedded iframe pages
	 MFSA 2016-19 Linux video memory DOS with Intel
	 drivers
	 MFSA 2016-20 Memory leak in libstagefright when deleting
	 an array during MP4 processing
	 MFSA 2016-21 Displayed page address can be overridden
	 MFSA 2016-22 Service Worker Manager out-of-bounds read in
	 Service Worker Manager
	 MFSA 2016-23 Use-after-free in HTML5 string parser
	 MFSA 2016-24 Use-after-free in SetBody
	 MFSA 2016-25 Use-after-free when using multiple WebRTC
	 data channels
	 MFSA 2016-26 Memory corruption when modifying a file
	 being read by FileReader
	 MFSA 2016-27 Use-after-free during XML
	 transformations
	 MFSA 2016-28 Addressbar spoofing though history
	 navigation and Location protocol property
	 MFSA 2016-29 Same-origin policy violation using
	 perfomance.getEntries and history navigation with session
	 restore
	 MFSA 2016-31 Memory corruption with malicious NPAPI
	 plugin
	 MFSA 2016-32 WebRTC and LibVPX vulnerabilities found
	 through code inspection
	 MFSA 2016-33 Use-after-free in GetStaticInstance in
	 WebRTC
	 MFSA 2016-34 Out-of-bounds read in HTML parser following
	 a failed allocation
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1952</cvename>
 <cvename>CVE-2016-1953</cvename>
 <cvename>CVE-2016-1954</cvename>
 <cvename>CVE-2016-1955</cvename>
 <cvename>CVE-2016-1956</cvename>
 <cvename>CVE-2016-1957</cvename>
 <cvename>CVE-2016-1958</cvename>
 <cvename>CVE-2016-1959</cvename>
 <cvename>CVE-2016-1960</cvename>
 <cvename>CVE-2016-1961</cvename>
 <cvename>CVE-2016-1962</cvename>
 <cvename>CVE-2016-1963</cvename>
 <cvename>CVE-2016-1964</cvename>
 <cvename>CVE-2016-1965</cvename>
 <cvename>CVE-2016-1966</cvename>
 <cvename>CVE-2016-1967</cvename>
 <cvename>CVE-2016-1970</cvename>
 <cvename>CVE-2016-1971</cvename>
 <cvename>CVE-2016-1972</cvename>
 <cvename>CVE-2016-1973</cvename>
 <cvename>CVE-2016-1974</cvename>
 <cvename>CVE-2016-1975</cvename>
 <cvename>CVE-2016-1976</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-16/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-17/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-18/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-19/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-20/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-21/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-22/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-23/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-24/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-25/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-26/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-27/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-28/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-29/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-31/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-32/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-33/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-34/</url>
 </references>
 <dates>
 <discovery>2016-03-08</discovery>
 <entry>2016-03-08</entry>
 <modified>2016-03-08</modified>
 </dates>
 </vuln>

<vuln vid="adffe823-e692-4921-ae9c-0b825c218372">
 <topic>graphite2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>graphite2</name>
	<range><lt>1.3.6</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>45.0,1</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>38.7.0</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.42</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-37/">
	 Security researcher Holger Fuhrmannek and Mozilla
	 security engineer Tyson Smith reported a number of security
	 vulnerabilities in the Graphite 2 library affecting version
	 1.3.5.

The issue reported by Holger Fuhrmannek is a mechanism to
	    induce stack corruption with a malicious graphite font. This
	    leads to a potentially exploitable crash when the font is
	    loaded.

Tyson Smith used the Address Sanitizer tool in concert with
	 a custom software fuzzer to find a series of uninitialized
	 memory, out-of-bounds read, and out-of-bounds write errors
	 when working with fuzzed graphite fonts.
	</blockquote>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-38/">
	 Security researcher James Clawson used the Address
	 Sanitizer tool to discover an out-of-bounds write in the
	 Graphite 2 library when loading a crafted Graphite font
	 file. This results in a potentially exploitable crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-37/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-38/</url>
 <cvename>CVE-2016-1969</cvename>
 <cvename>CVE-2016-1977</cvename>
 <cvename>CVE-2016-2790</cvename>
 <cvename>CVE-2016-2791</cvename>
 <cvename>CVE-2016-2792</cvename>
 <cvename>CVE-2016-2793</cvename>
 <cvename>CVE-2016-2794</cvename>
 <cvename>CVE-2016-2795</cvename>
 <cvename>CVE-2016-2796</cvename>
 <cvename>CVE-2016-2797</cvename>
 <cvename>CVE-2016-2798</cvename>
 <cvename>CVE-2016-2799</cvename>
 <cvename>CVE-2016-2800</cvename>
 <cvename>CVE-2016-2801</cvename>
 <cvename>CVE-2016-2802</cvename>
 </references>
 <dates>
 <discovery>2016-03-08</discovery>
 <entry>2016-03-08</entry>
 <modified>2016-03-14</modified>
 </dates>
 </vuln>

<vuln vid="c4292768-5273-4f17-a267-c5fe35125ce4">
 <topic>NSS -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>nss</name>
	<range><ge>3.20</ge><lt>3.21.1</lt></range>
	<range><lt>3.19.2.3</lt></range>
 </package>
 <package>
	<name>linux-c6-nss</name>
	<range><ge>3.20</ge><lt>3.21.0_1</lt></range>
	<range><lt>3.19.2.3</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>45.0,1</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>38.7.0</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.42</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-35/">
	 Security researcher Francis Gabriel reported a heap-based
	 buffer overflow in the way the Network Security Services
	 (NSS) libraries parsed certain ASN.1 structures. An attacker
	 could create a specially-crafted certificate which, when
	 parsed by NSS, would cause it to crash or execute arbitrary
	 code with the permissions of the user.
	</blockquote>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-36/">
	 Mozilla developer Tim Taubert used the Address Sanitizer
	 tool and software fuzzing to discover a use-after-free
	 vulnerability while processing DER encoded keys in the
	 Network Security Services (NSS) libraries. The vulnerability
	 overwrites the freed memory with zeroes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1950</cvename>
 <cvename>CVE-2016-1979</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-35/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-36/</url>
 <url>https://hg.mozilla.org/projects/nss/rev/b9a31471759d</url>
 <url>https://hg.mozilla.org/projects/nss/rev/7033b1193c94</url>
 </references>
 <dates>
 <discovery>2016-03-08</discovery>
 <entry>2016-03-08</entry>
 <modified>2016-09-05</modified>
 </dates>
 </vuln>

<vuln vid="75091516-6f4b-4059-9884-6727023dc366">
 <topic>NSS -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>nss</name>
	<name>linux-c6-nss</name>
	<range><lt>3.21</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>44.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.41</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-07/">
	 Security researcher Hanno Böck reported that calculations
	 with mp_div and mp_exptmod in Network Security Services
	 (NSS) can produce wrong results in some circumstances. These
	 functions are used within NSS for a variety of cryptographic
	 division functions, leading to potential cryptographic
	 weaknesses.
	</blockquote>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-15/">
	 Mozilla developer Eric Rescorla reported that a failed
	 allocation during DHE and ECDHE handshakes would lead to a
	 use-after-free vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1938</cvename>
 <cvename>CVE-2016-1978</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-07/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-15/</url>
 <url>https://hg.mozilla.org/projects/nss/rev/a555bf0fc23a</url>
 <url>https://hg.mozilla.org/projects/nss/rev/a245a4ccd354</url>
 </references>
 <dates>
 <discovery>2016-01-26</discovery>
 <entry>2016-03-08</entry>
 </dates>
 </vuln>

<vuln vid="f9e6c0d1-e4cc-11e5-b2bd-002590263bf5">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-django</name>
	<name>py32-django</name>
	<name>py33-django</name>
	<name>py34-django</name>
	<name>py35-django</name>
	<range><lt>1.8.10</lt></range>
 </package>
 <package>
	<name>py27-django18</name>
	<name>py32-django18</name>
	<name>py33-django18</name>
	<name>py34-django18</name>
	<name>py35-django18</name>
	<range><lt>1.8.10</lt></range>
 </package>
 <package>
	<name>py27-django19</name>
	<name>py32-django19</name>
	<name>py33-django19</name>
	<name>py34-django19</name>
	<name>py35-django19</name>
	<range><lt>1.9.3</lt></range>
 </package>
 <package>
	<name>py27-django-devel</name>
	<name>py32-django-devel</name>
	<name>py33-django-devel</name>
	<name>py34-django-devel</name>
	<name>py35-django-devel</name>
	<range><le>20150709,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Graham reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/">
	 Malicious redirect and possible XSS attack via user-supplied
	 redirect URLs containing basic auth
	 User enumeration through timing difference on password hasher work
	 factor upgrade
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2512</cvename>
 <cvename>CVE-2016-2513</cvename>
 <url>https://www.djangoproject.com/weblog/2016/mar/01/security-releases/</url>
 </references>
 <dates>
 <discovery>2016-03-01</discovery>
 <entry>2016-03-08</entry>
 </dates>
 </vuln>

<vuln vid="fef03980-e4c6-11e5-b2bd-002590263bf5">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.4.2,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samuel Sidler reports:
	<blockquote cite="https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/">
	 WordPress 4.4.2 is now available. This is a security release for
	 all previous versions and we strongly encourage you to update your
	 sites immediately.
	 WordPress versions 4.4.1 and earlier are affected by two security
	 issues: a possible SSRF for certain local URIs, reported by Ronni
	 Skansing; and an open redirection attack, reported by Shailesh
	 Suthar.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2221</cvename>
 <cvename>CVE-2016-2222</cvename>
 <url>http://www.openwall.com/lists/oss-security/2016/02/04/6</url>
 <url>https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2016-02-02</discovery>
 <entry>2016-03-08</entry>
 </dates>
 </vuln>

<vuln vid="7f0fbb30-e462-11e5-a3f3-080027ef73ec">
 <topic>PuTTY - old-style scp downloads may allow remote code execution</topic>
 <affects>
 <package>
	<name>putty</name>
	<range><lt>0.67</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon G. Tatham reports:
	<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html">
	 Many versions of PSCP prior to 0.67 have a stack corruption
	 vulnerability in their treatment of the 'sink' direction (i.e.
	 downloading from server to client) of the old-style SCP protocol.
	 
	 In order for this vulnerability to be exploited, the user must
	 connect to a malicious server and attempt to download any file.[...]
	 you can work around it in a vulnerable PSCP by using the -sftp
	 option to force the use of the newer SFTP protocol, provided your
	 server supports that protocol.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html</url>
 <cvename>CVE-2016-2563</cvename>
 <url>https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563</url>
 </references>
 <dates>
 <discovery>2016-02-26</discovery>
 <entry>2016-03-07</entry>
 </dates>
 </vuln>

<vuln vid="12d1b5a6-e39d-11e5-9f77-5453ed2e2b49">
 <topic>websvn -- reflected cross-site scripting</topic>
 <affects>
 <package>
	<name>websvn</name>
	<range><lt>2.3.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sebastien Delafond reports:
	<blockquote cite="https://lists.debian.org/debian-security-announce/2016/msg00060.html">
	 Jakub Palaczynski discovered that websvn, a web viewer for
	 Subversion repositories, does not correctly sanitize user-supplied
	 input, which allows a remote user to run reflected cross-site
	 scripting attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2511</cvename>
 <url>https://lists.debian.org/debian-security-announce/2016/msg00060.html</url>
 <url>http://seclists.org/fulldisclosure/2016/Feb/99</url>
 </references>
 <dates>
 <discovery>2016-02-22</discovery>
 <entry>2016-03-06</entry>
 </dates>
 </vuln>

<vuln vid="f69e1f09-e39b-11e5-9f77-5453ed2e2b49">
 <topic>websvn -- information disclosure</topic>
 <affects>
 <package>
	<name>websvn</name>
	<range><lt>2.3.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Thijs Kinkhorst reports:
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682">
	 James Clawson reported:
	 "Arbitrary files with a known path can be accessed in websvn by
	 committing a symlink to a repository and then downloading the file
	 (using the download link).
	 An attacker must have write access to the repo, and the download
	 option must have been enabled in the websvn config file."
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-6892</cvename>
 <url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6892</url>
 <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682</url>
 </references>
 <dates>
 <discovery>2015-01-18</discovery>
 <entry>2016-03-06</entry>
 </dates>
 </vuln>

<vuln vid="5a016dd0-8aa8-490e-a596-55f4cc17e4ef">
 <topic>rails -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-actionpack</name>
	<range><lt>3.2.22.2</lt></range>
 </package>
 <package>
	<name>rubygem-actionpack4</name>
	<range><lt>4.2.5.2</lt></range>
 </package>
 <package>
	<name>rubygem-actionview</name>
	<range><lt>4.2.5.2</lt></range>
 </package>
 <package>
	<name>rubygem-rails</name>
	<range><lt>3.2.22.2</lt></range>
 </package>
 <package>
	<name>rubygem-rails4</name>
	<range><lt>4.2.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails blog:
	<blockquote cite="http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/">
	 Rails 4.2.5.2, 4.1.14.2, and 3.2.22.2 have been released! These
	 contain the following important security fixes, and it is
		recommended that users upgrade as soon as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2097</cvename>
 <cvename>CVE-2016-2098</cvename>
 <url>https://groups.google.com/d/msg/rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ</url>
 <url>https://groups.google.com/d/msg/rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ</url>
 <url>http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/</url>
 </references>
 <dates>
 <discovery>2016-02-29</discovery>
 <entry>2016-03-06</entry>
 </dates>
 </vuln>

<vuln vid="f85fa236-e2a6-412e-b5c7-c42120892de5">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>49.0.2623.75</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html">
	 [560011] High CVE-2016-1630: Same-origin bypass in Blink.
	 [569496] High CVE-2016-1631: Same-origin bypass in Pepper Plugin.
	 [549986] High CVE-2016-1632: Bad cast in Extensions.
	 [572537] High CVE-2016-1633: Use-after-free in Blink.
	 [559292] High CVE-2016-1634: Use-after-free in Blink.
	 [585268] High CVE-2016-1635: Use-after-free in Blink.
	 [584155] High CVE-2016-1636: SRI Validation Bypass.
	 [555544] Medium CVE-2016-1637: Information Leak in Skia.
	 [585282] Medium CVE-2016-1638: WebAPI Bypass.
	 [572224] Medium CVE-2016-1639: Use-after-free in WebRTC.
	 [550047] Medium CVE-2016-1640: Origin confusion in Extensions UI.
	 [583718] Medium CVE-2016-1641: Use-after-free in Favicon.
	 [591402] CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives.
	 Multiple vulnerabilities in V8 fixed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1630</cvename>
 <cvename>CVE-2016-1631</cvename>
 <cvename>CVE-2016-1632</cvename>
 <cvename>CVE-2016-1633</cvename>
 <cvename>CVE-2016-1634</cvename>
 <cvename>CVE-2016-1635</cvename>
 <cvename>CVE-2016-1636</cvename>
 <cvename>CVE-2016-1637</cvename>
 <cvename>CVE-2016-1638</cvename>
 <cvename>CVE-2016-1639</cvename>
 <cvename>CVE-2016-1640</cvename>
 <cvename>CVE-2016-1641</cvename>
 <cvename>CVE-2016-1642</cvename>
 <url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html</url>
 </references>
 <dates>
 <discovery>2016-03-02</discovery>
 <entry>2016-03-05</entry>
 </dates>
 </vuln>

<vuln vid="6b3591ea-e2d2-11e5-a6be-5453ed2e2b49">
 <topic>libssh -- weak Diffie-Hellman secret generation</topic>
 <affects>
 <package>
	<name>libssh</name>
	<range><lt>0.7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Andreas Schneider reports:
	<blockquote cite="https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/">
	 libssh versions 0.1 and above have a bits/bytes confusion bug and
	 generate an abnormally short ephemeral secret for the
	 diffie-hellman-group1 and diffie-hellman-group14 key exchange
	 methods. The resulting secret is 128 bits long, instead of the
	 recommended sizes of 1024 and 2048 bits respectively. There are
	 practical algorithms (Baby steps/Giant steps, Pollard’s rho) that can
	 solve this problem in O(2^63) operations.
	 Both client and server are are vulnerable, pre-authentication.
	 This vulnerability could be exploited by an eavesdropper with enough
	 resources to decrypt or intercept SSH sessions. The bug was found
	 during an internal code review by Aris Adamantiadis of the libssh
	 team.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-0739</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0739</url>
 <url>https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/</url>
 </references>
 <dates>
 <discovery>2016-02-23</discovery>
 <entry>2016-03-05</entry>
 </dates>
 </vuln>

<vuln vid="7d09b9ee-e0ba-11e5-abc4-6fb07af136d2">
 <topic>exim -- local privillege escalation</topic>
 <affects>
 <package>
	<name>exim</name>
	<range><lt>4.86.2</lt></range>
	<range><lt>4.85.2</lt></range>
	<range><lt>4.84.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Exim development team reports:
	<blockquote cite="https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html">
	All installations having Exim set-uid root and using 'perl_startup' are
	vulnerable to a local privilege escalation. Any user who can start an
	instance of Exim (and this is normally any user) can gain root
	privileges. If you do not use 'perl_startup' you should be safe.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1531</cvename>
 <url>https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html</url>
 </references>
 <dates>
 <discovery>2016-02-26</discovery>
 <entry>2016-03-02</entry>
 </dates>
 </vuln>

<vuln vid="db3301be-e01c-11e5-b2bd-002590263bf5">
 <topic>cacti -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>0.8.8g</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Cacti Group, Inc. reports:
	<blockquote cite="http://www.cacti.net/release_notes_0_8_8g.php">
	 Changelog
	 <ul>
	 <li>bug:0002652: CVE-2015-8604: SQL injection in graphs_new.php</li>
	 <li>bug:0002655: CVE-2015-8377: SQL injection vulnerability in the
	 host_new_graphs_save function in graphs_new.php</li>
	 <li>bug:0002656: Authentication using web authentication as a user
	 not in the cacti database allows complete access</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8377</cvename>
 <cvename>CVE-2015-8604</cvename>
 <cvename>CVE-2016-2313</cvename>
 <url>http://www.cacti.net/release_notes_0_8_8g.php</url>
 <url>http://bugs.cacti.net/view.php?id=2652</url>
 <url>http://bugs.cacti.net/view.php?id=2655</url>
 <url>http://bugs.cacti.net/view.php?id=2656</url>
 <url>http://www.openwall.com/lists/oss-security/2016/02/09/3</url>
 </references>
 <dates>
 <discovery>2016-02-21</discovery>
 <entry>2016-03-02</entry>
 </dates>
 </vuln>

<vuln vid="f682a506-df7c-11e5-81e4-6805ca0b3d42">
 <topic>phpmyadmin -- multiple XSS and a man-in-the-middle vulnerability</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-10/">
	 XSS vulnerability in SQL parser.
	 Using a crafted SQL query, it is possible to trigger an XSS
	 attack through the SQL query page.
	 We consider this vulnerability to be non-critical.
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-11/">
	 Multiple XSS vulnerabilities.
	 By sending a specially crafted URL as part of the HOST
	 header, it is possible to trigger an XSS attack.
	 A weakness was found that allows an XSS attack with Internet
	 Explorer versions older than 8 and Safari on Windows using a
	 specially crafted URL.
	 Using a crafted SQL query, it is possible to trigger an XSS
	 attack through the SQL query page.
	 Using a crafted parameter value, it is possible to trigger
	 an XSS attack in user accounts page.
	 Using a crafted parameter value, it is possible to trigger
	 an XSS attack in zoom search page.
	 We consider this vulnerability to be non-critical.
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-12/">
	 Multiple XSS vulnerabilities.
	 With a crafted table/column name it is possible to trigger
	 an XSS attack in the database normalization page.
	 With a crafted parameter it is possible to trigger an XSS
	 attack in the database structure page.
	 With a crafted parameter it is possible to trigger an XSS
	 attack in central columns page.
	 We consider this vulnerability to be non-critical.
	</blockquote>
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-13/">
	 Vulnerability allowing man-in-the-middle attack on API
	 call to GitHub.
	 A vulnerability in the API call to GitHub can be exploited
	 to perform a man-in-the-middle attack.
	 We consider this vulnerability to be serious.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-10/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-11/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-12/</url>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-13/</url>
 <cvename>CVE-2016-2559</cvename>
 <cvename>CVE-2016-2560</cvename>
 <cvename>CVE-2016-2561</cvename>
 <cvename>CVE-2016-2562</cvename>
 </references>
 <dates>
 <discovery>2016-02-29</discovery>
 <entry>2016-03-01</entry>
 </dates>
 </vuln>

<vuln vid="45117749-df55-11e5-b2bd-002590263bf5">
 <topic>wireshark -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>wireshark-qt5</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>2.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wireshark development team reports:
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.2.html">
	 The following vulnerabilities have been fixed:
	 <ul>
	 <li>wnpa-sec-2016-02
	 ASN.1 BER dissector crash. (Bug 11828) CVE-2016-2522</li>
	 <li>wnpa-sec-2016-03
	 DNP dissector infinite loop. (Bug 11938) CVE-2016-2523</li>
	 <li>wnpa-sec-2016-04
	 X.509AF dissector crash. (Bug 12002) CVE-2016-2524</li>
	 <li>wnpa-sec-2016-05
	 HTTP/2 dissector crash. (Bug 12077) CVE-2016-2525</li>
	 <li>wnpa-sec-2016-06
	 HiQnet dissector crash. (Bug 11983) CVE-2016-2526</li>
	 <li>wnpa-sec-2016-07
	 3GPP TS 32.423 Trace file parser crash. (Bug 11982)
		CVE-2016-2527</li>
	 <li>wnpa-sec-2016-08
	 LBMC dissector crash. (Bug 11984) CVE-2016-2528</li>
	 <li>wnpa-sec-2016-09
	 iSeries file parser crash. (Bug 11985) CVE-2016-2529</li>
	 <li>wnpa-sec-2016-10
	 RSL dissector crash. (Bug 11829) CVE-2016-2530
		CVE-2016-2531</li>
	 <li>wnpa-sec-2016-11
	 LLRP dissector crash. (Bug 12048) CVE-2016-2532</li>
	 <li>wnpa-sec-2016-12
	 Ixia IxVeriWave file parser crash. (Bug 11795)</li>
	 <li>wnpa-sec-2016-13
	 IEEE 802.11 dissector crash. (Bug 11818)</li>
	 <li>wnpa-sec-2016-14
	 GSM A-bis OML dissector crash. (Bug 11825)</li>
	 <li>wnpa-sec-2016-15
	 ASN.1 BER dissector crash. (Bug 12106)</li>
	 <li>wnpa-sec-2016-16
	 SPICE dissector large loop. (Bug 12151)</li>
	 <li>wnpa-sec-2016-17
	 NFS dissector crash.</li>
	 <li>wnpa-sec-2016-18
	 ASN.1 BER dissector crash. (Bug 11822)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2522</cvename>
 <cvename>CVE-2016-2523</cvename>
 <cvename>CVE-2016-2524</cvename>
 <cvename>CVE-2016-2525</cvename>
 <cvename>CVE-2016-2526</cvename>
 <cvename>CVE-2016-2527</cvename>
 <cvename>CVE-2016-2528</cvename>
 <cvename>CVE-2016-2529</cvename>
 <cvename>CVE-2016-2530</cvename>
 <cvename>CVE-2016-2531</cvename>
 <cvename>CVE-2016-2532</cvename>
 <cvename>CVE-2016-4415</cvename>
 <cvename>CVE-2016-4416</cvename>
 <cvename>CVE-2016-4417</cvename>
 <cvename>CVE-2016-4418</cvename>
 <cvename>CVE-2016-4419</cvename>
 <cvename>CVE-2016-4420</cvename>
 <cvename>CVE-2016-4421</cvename>
 <url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.2.html</url>
 <url>http://www.openwall.com/lists/oss-security/2016/05/01/1</url>
 </references>
 <dates>
 <discovery>2016-02-26</discovery>
 <entry>2016-03-01</entry>
 <modified>2016-07-04</modified>
 </dates>
 </vuln>

<vuln vid="42c2c422-df55-11e5-b2bd-002590263bf5">
 <topic>wireshark -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>wireshark-qt5</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>2.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wireshark development team reports:
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.1.html">
	 The following vulnerabilities have been fixed:
	 <ul>
	 <li>wnpa-sec-2015-31
	 NBAP dissector crashes. (Bug 11602, Bug 11835, Bug 11841)
		</li>
	 <li>wnpa-sec-2015-37
	 NLM dissector crash.</li>
	 <li>wnpa-sec-2015-39
	 BER dissector crash.</li>
	 <li>wnpa-sec-2015-40
	 Zlib decompression crash. (Bug 11548)</li>
	 <li>wnpa-sec-2015-41
	 SCTP dissector crash. (Bug 11767)</li>
	 <li>wnpa-sec-2015-42
	 802.11 decryption crash. (Bug 11790, Bug 11826)</li>
	 <li>wnpa-sec-2015-43
	 DIAMETER dissector crash. (Bug 11792)</li>
	 <li>wnpa-sec-2015-44
	 VeriWave file parser crashes. (Bug 11789, Bug 11791)</li>
	 <li>wnpa-sec-2015-45
	 RSVP dissector crash. (Bug 11793)</li>
	 <li>wnpa-sec-2015-46
	 ANSI A and GSM A dissector crashes. (Bug 11797)</li>
	 <li>wnpa-sec-2015-47
	 Ascend file parser crash. (Bug 11794)</li>
	 <li>wnpa-sec-2015-48
	 NBAP dissector crash. (Bug 11815)</li>
	 <li>wnpa-sec-2015-49
	 RSL dissector crash. (Bug 11829)</li>
	 <li>wnpa-sec-2015-50
	 ZigBee ZCL dissector crash. (Bug 11830)</li>
	 <li>wnpa-sec-2015-51
	 Sniffer file parser crash. (Bug 11827)</li>
	 <li>wnpa-sec-2015-52
	 NWP dissector crash. (Bug 11726)</li>
	 <li>wnpa-sec-2015-53
	 BT ATT dissector crash. (Bug 11817)</li>
	 <li>wnpa-sec-2015-54
	 MP2T file parser crash. (Bug 11820)</li>
	 <li>wnpa-sec-2015-55
	 MP2T file parser crash. (Bug 11821)</li>
	 <li>wnpa-sec-2015-56
	 S7COMM dissector crash. (Bug 11823)</li>
	 <li>wnpa-sec-2015-57
	 IPMI dissector crash. (Bug 11831)</li>
	 <li>wnpa-sec-2015-58
	 TDS dissector crash. (Bug 11846)</li>
	 <li>wnpa-sec-2015-59
	 PPI dissector crash. (Bug 11876)</li>
	 <li>wnpa-sec-2015-60
	 MS-WSP dissector crash. (Bug 11931)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.1.html</url>
 </references>
 <dates>
 <discovery>2015-12-29</discovery>
 <entry>2016-03-01</entry>
 </dates>
 </vuln>

<vuln vid="7bbc3016-de63-11e5-8fa8-14dae9d210b8">
 <topic>tomcat -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>tomcat7</name>
	<range><lt>7.0.68</lt></range>
 </package>
 <package>
	<name>tomcat8</name>
	<range><lt>8.0.30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mark Thomas reports:
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e">
	 <ul>
	 <li>CVE-2015-5346 Apache Tomcat Session fixation</li>
	 <li>CVE-2015-5351 Apache Tomcat CSRF token leak</li>
	 <li>CVE-2016-0763 Apache Tomcat Security Manager Bypass</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e</url>
 <url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF7B.1010901@apache.org%3e</url>
 <url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEFB2.9030605@apache.org%3e</url>
 <cvename>CVE-2015-5346</cvename>
 <cvename>CVE-2015-5351</cvename>
 <cvename>CVE-2016-0763</cvename>
 </references>
 <dates>
 <discovery>2016-02-22</discovery>
 <entry>2016-02-28</entry>
 </dates>
 </vuln>

<vuln vid="1f1124fe-de5c-11e5-8fa8-14dae9d210b8">
 <topic>tomcat -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><lt>6.0.45</lt></range>
 </package>
 <package>
	<name>tomcat7</name>
	<range><lt>7.0.68</lt></range>
 </package>
 <package>
	<name>tomcat8</name>
	<range><lt>8.0.30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mark Thomas reports:
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e">
	 <ul>
	 <li>CVE-2015-5345 Apache Tomcat Directory disclosure</li>
	 <li>CVE-2016-0706 Apache Tomcat Security Manager bypass</li>
	 <li>CVE-2016-0714 Apache Tomcat Security Manager Bypass</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e</url>
 <url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF6A.70703@apache.org%3e</url>
 <url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF4F.5090003@apache.org%3e</url>
 <cvename>CVE-2015-5345</cvename>
 <cvename>CVE-2015-5346</cvename>
 <cvename>CVE-2016-0706</cvename>
 <cvename>CVE-2016-0714</cvename>
 </references>
 <dates>
 <discovery>2016-02-22</discovery>
 <entry>2016-02-28</entry>
 <modified>2017-03-18</modified>
 </dates>
 </vuln>

<vuln vid="a7f2e9c6-de20-11e5-8458-6cc21735f730">
 <topic>xerces-c3 -- Parser Crashes on Malformed Input</topic>
 <affects>
 <package>
	<name>xerces-c3</name>
	<range><lt>3.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation reports:
	<blockquote cite="http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt">
	 The Xerces-C XML parser mishandles certain kinds of malformed input
	 documents, resulting in buffer overflows during processing and error
	 reporting. The overflows can manifest as a segmentation fault or as
	 memory corruption during a parse operation. The bugs allow for a
	 denial of service attack in many applications by an unauthenticated
	 attacker, and could conceivably result in remote code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-0729</cvename>
 <url>http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt</url>
 </references>
 <dates>
 <discovery>2016-02-25</discovery>
 <entry>2016-02-28</entry>
 </dates>
 </vuln>

<vuln vid="6b1d8a39-ddb3-11e5-8fa8-14dae9d210b8">
 <topic>django -- regression in permissions model</topic>
 <affects>
 <package>
	<name>py27-django19</name>
	<name>py33-django19</name>
	<name>py34-django19</name>
	<name>py35-django19</name>
	<range><lt>1.9.2</lt></range>
 </package>
 <package>
	<name>py27-django-devel</name>
	<name>py33-django-devel</name>
	<name>py34-django-devel</name>
	<name>py35-django-devel</name>
	<range><le>20150709,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Graham reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/">
	 User with "change" but not "add" permission can create
	 objects for ModelAdmin’s with save_as=True
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/</url>
 <cvename>CVE-2016-2048</cvename>
 </references>
 <dates>
 <discovery>2016-02-01</discovery>
 <entry>2016-02-28</entry>
 </dates>
 </vuln>

<vuln vid="81f9d6a4-ddaf-11e5-b2bd-002590263bf5">
 <topic>xen-kernel -- VMX: guest user mode may crash guest with non-canonical RIP</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.5.2_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-170.html">
	 VMX refuses attempts to enter a guest with an instruction pointer
	 which doesn't satisfy certain requirements. In particular, the
	 instruction pointer needs to be canonical when entering a guest
	 currently in 64-bit mode. This is the case even if the VM entry
	 information specifies an exception to be injected immediately (in
	 which case the bad instruction pointer would possibly never get used
	 for other than pushing onto the exception handler's stack).
	 Provided the guest OS allows user mode to map the virtual memory
	 space immediately below the canonical/non-canonical address
	 boundary, a non-canonical instruction pointer can result even from
	 normal user mode execution. VM entry failure, however, is fatal to
	 the guest.
	 Malicious HVM guest user mode code may be able to crash the
	 guest.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2271</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-170.html</url>
 </references>
 <dates>
 <discovery>2016-02-17</discovery>
 <entry>2016-02-28</entry>
 </dates>
 </vuln>

<vuln vid="80adc394-ddaf-11e5-b2bd-002590263bf5">
 <topic>xen-kernel -- VMX: intercept issue with INVLPG on non-canonical address</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><ge>3.3</ge><lt>4.5.2_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-168.html">
	 While INVLPG does not cause a General Protection Fault when used on
	 a non-canonical address, INVVPID in its "individual address"
	 variant, which is used to back the intercepted INVLPG in certain
	 cases, fails in such cases. Failure of INVVPID results in a
	 hypervisor bug check.
	 A malicious guest can crash the host, leading to a Denial of
	 Service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1571</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-168.html</url>
 </references>
 <dates>
 <discovery>2016-01-20</discovery>
 <entry>2016-02-28</entry>
 </dates>
 </vuln>

<vuln vid="7ed7c36f-ddaf-11e5-b2bd-002590263bf5">
 <topic>xen-kernel -- PV superpage functionality missing sanity checks</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><eq>3.4.0</eq></range>
	<range><eq>3.4.1</eq></range>
	<range><ge>4.1</ge><lt>4.5.2_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-167.html">
	 The PV superpage functionality lacks certain validity checks on
	 data being passed to the hypervisor by guests. This is the case
	 for the page identifier (MFN) passed to MMUEXT_MARK_SUPER and
	 MMUEXT_UNMARK_SUPER sub-ops of the HYPERVISOR_mmuext_op hypercall as
	 well as for various forms of page table updates.
	 Use of the feature, which is disabled by default, may have unknown
	 effects, ranging from information leaks through Denial of Service to
	 privilege escalation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1570</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-167.html</url>
 </references>
 <dates>
 <discovery>2016-01-20</discovery>
 <entry>2016-02-28</entry>
 </dates>
 </vuln>

<vuln vid="2d299950-ddb0-11e5-8fa8-14dae9d210b8">
 <topic>moodle -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moodle28</name>
	<range><lt>2.8.10</lt></range>
 </package>
 <package>
	<name>moodle29</name>
	<range><lt>2.9.4</lt></range>
 </package>
 <package>
	<name>moodle30</name>
	<range><lt>3.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marina Glancy reports:
	<blockquote cite="https://moodle.org/security/">
	 <ul>
	 <li>MSA-16-0001: Two enrolment-related web services don't
	 check course visibility</li>
	 <li>MSA-16-0002: XSS Vulnerability in course management
	 search</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://moodle.org/security/</url>
 <cvename>CVE-2016-0724</cvename>
 <cvename>CVE-2016-0725</cvename>
 </references>
 <dates>
 <discovery>2016-01-18</discovery>
 <entry>2016-02-28</entry>
 </dates>
 </vuln>

<vuln vid="6540c8f0-dca3-11e5-8fa8-14dae9d210b8">
 <topic>pitivi -- code execution</topic>
 <affects>
 <package>
	<name>pitivi</name>
	<range><lt>0.95</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Luke Farone reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/23/8">
	 Double-clicking a file in the user's media library with a
	 specially-crafted path or filename allows for arbitrary code execution
	 with the permissions of the user running Pitivi.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2015/12/23/8</url>
 <url>https://git.gnome.org/browse/pitivi/commit/?id=45a4c84edb3b4343f199bba1c65502e3f49f5bb2</url>
 <cvename>CVE-2015-0855</cvename>
 </references>
 <dates>
 <discovery>2015-09-13</discovery>
 <entry>2016-02-26</entry>
 </dates>
 </vuln>

<vuln vid="90c8385a-dc9f-11e5-8fa8-14dae9d210b8">
 <topic>giflib -- heap overflow</topic>
 <affects>
 <package>
	<name>giflib</name>
	<range><lt>5.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hans Jerry Illikainen reports:
	<blockquote cite="http://seclists.org/bugtraq/2015/Dec/114">
	 A heap overflow may occur in the giffix utility included in
	 giflib-5.1.1 when processing records of the type
	 `IMAGE_DESC_RECORD_TYPE' due to the allocated size of `LineBuffer'
	 equaling the value of the logical screen width, `GifFileIn-&gt;SWidth',
	 while subsequently having `GifFileIn-&gt;Image.Width' bytes of data written
	 to it.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/bugtraq/2015/Dec/114</url>
 <cvename>CVE-2015-7555</cvename>
 </references>
 <dates>
 <discovery>2015-12-21</discovery>
 <entry>2016-02-26</entry>
 </dates>
 </vuln>

<vuln vid="59a0af97-dbd4-11e5-8fa8-14dae9d210b8">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal6</name>
	<range><lt>6.38</lt></range>
 </package>
 <package>
	<name>drupal7</name>
	<range><lt>7.43</lt></range>
 </package>
 <package>
	<name>drupal8</name>
	<range><lt>8.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://www.drupal.org/SA-CORE-2016-001">
	 <ul>
	 <li>File upload access bypass and denial of service (File
	 module - Drupal 7 and 8 - Moderately Critical)</li>
	 <li>Brute force amplification attacks via XML-RPC (XML-RPC
	 server - Drupal 6 and 7 - Moderately Critical)</li>
	 <li>Open redirect via path manipulation (Base system -
	 Drupal 6, 7 and 8 - Moderately Critical) </li>
	 <li>Form API ignores access restrictions on submit buttons
	 (Form API - Drupal 6 - Critical)</li>
	 <li>HTTP header injection using line breaks (Base system -
	 Drupal 6 - Moderately Critical)</li>
	 <li>Open redirect via double-encoded 'destination'
	 parameter (Base system - Drupal 6 - Moderately Critical)</li>
	 <li>Reflected file download vulnerability (System module -
	 Drupal 6 and 7 - Moderately Critical)</li>
	 <li>Saving user accounts can sometimes grant the user all
	 roles (User module - Drupal 6 and 7 - Less Critical)</li>
	 <li>Email address can be matched to an account (User module
	 - Drupal 7 and 8 - Less Critical)</li>
	 <li>Session data truncation can lead to unserialization of
	 user provided data (Base system - Drupal 6 - Less Critical)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/SA-CORE-2016-001</url>
 </references>
 <dates>
 <discovery>2016-02-24</discovery>
 <entry>2016-02-25</entry>
 </dates>
 </vuln>

<vuln vid="7e01df39-db7e-11e5-b937-00e0814cab4e">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><le>1.650</le></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><le>1.642.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Security+Advisory+2016-02-24">
	 <h1>Description</h1>
	 <h5>SECURITY-232 / CVE-2016-0788(Remote code execution vulnerability in remoting module)</h5>
	 A vulnerability in the Jenkins remoting module allowed
	 unauthenticated remote attackers to open a JRMP listener on the
	 server hosting the Jenkins master process, which allowed arbitrary
	 code execution.
	 <h5>SECURITY-238 / CVE-2016-0789(HTTP response splitting vulnerability)</h5>
	 An HTTP response splitting vulnerability in the CLI command
	 documentation allowed attackers to craft Jenkins URLs that serve
	 malicious content.
	 <h5>SECURITY-241 / CVE-2016-0790(Non-constant time comparison of API token)</h5>
	 The verification of user-provided API tokens with the expected
	 value did not use a constant-time comparison algorithm, potentially
	 allowing attackers to use statistical methods to determine valid
	 API tokens using brute-force methods.
	 <h5>SECURITY-245 / CVE-2016-0791(Non-constant time comparison of CSRF crumbs)</h5>
	 The verification of user-provided CSRF crumbs with the expected
	 value did not use a constant-time comparison algorithm, potentially
	 allowing attackers to use statistical methods to determine valid
	 CSRF crumbs using brute-force methods.
	 <h5>SECURITY-247 / CVE-2016-0792(Remote code execution through remote API)</h5>
	 Jenkins has several API endpoints that allow low-privilege users
	 to POST XML files that then get deserialized by Jenkins.
	 Maliciously crafted XML files sent to these API endpoints could
	 result in arbitrary code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wiki.jenkins-ci.org/display/SECURITY/Security+Advisory+2016-02-24</url>
 </references>
 <dates>
 <discovery>2016-02-24</discovery>
 <entry>2016-02-25</entry>
 </dates>
 </vuln>

<vuln vid="660ebbf5-daeb-11e5-b2bd-002590263bf5">
 <topic>squid -- remote DoS in HTTP response processing</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>3.5.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid security advisory 2016:2 reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_2.txt">
	 Due to incorrect bounds checking Squid is vulnerable to a denial
	 of service attack when processing HTTP responses.
	 These problems allow remote servers delivering certain unusual
	 HTTP response syntax to trigger a denial of service for all
	 clients accessing the Squid service.
	 HTTP responses containing malformed headers that trigger this
	 issue are becoming common. We are not certain at this time if
	 that is a sign of malware or just broken server scripting.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2569</cvename>
 <cvename>CVE-2016-2570</cvename>
 <cvename>CVE-2016-2571</cvename>
 <freebsdpr>ports/207454</freebsdpr>
 <url>http://www.squid-cache.org/Advisories/SQUID-2016_2.txt</url>
 <url>http://www.openwall.com/lists/oss-security/2016/02/24/12</url>
 </references>
 <dates>
 <discovery>2016-02-24</discovery>
 <entry>2016-02-24</entry>
 <modified>2016-02-28</modified>
 </dates>
 </vuln>

<vuln vid="9e5bbffc-d8ac-11e5-b2bd-002590263bf5">
 <topic>bsh -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>bsh</name>
	<range><lt>2.0.b6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stian Soiland-Reyes reports:
	<blockquote cite="https://github.com/beanshell/beanshell/releases/tag/2.0b6">
	 This release fixes a remote code execution vulnerability that was
	 identified in BeanShell by Alvaro Muñoz and Christian Schneider.
	 The BeanShell team would like to thank them for their help and
	 contributions to this fix!
	 An application that includes BeanShell on the classpath may be
	 vulnerable if another part of the application uses Java
	 serialization or XStream to deserialize data from an untrusted
	 source.
	 A vulnerable application could be exploited for remote code
	 execution, including executing arbitrary shell commands.
	 This update fixes the vulnerability in BeanShell, but it is worth
	 noting that applications doing such deserialization might still be
	 insecure through other libraries. It is recommended that application
	 developers take further measures such as using a restricted class
	 loader when deserializing. See notes on Java serialization security
	 XStream security and How to secure deserialization from untrusted
	 input without using encryption or sealing.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2510</cvename>
 <freebsdpr>ports/207334</freebsdpr>
 <url>https://github.com/beanshell/beanshell/releases/tag/2.0b6</url>
 </references>
 <dates>
 <discovery>2016-02-18</discovery>
 <entry>2016-02-21</entry>
 </dates>
 </vuln>

<vuln vid="6171eb07-d8a9-11e5-b2bd-002590263bf5">
 <topic>libsrtp -- DoS via crafted RTP header vulnerability</topic>
 <affects>
 <package>
	<name>libsrtp</name>
	<range><lt>1.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libsrtp reports:
	<blockquote cite="https://github.com/cisco/libsrtp/commit/704a31774db0dd941094fd2b47c21638b8dc3de2">
	 Prevent potential DoS attack due to lack of bounds checking on RTP
	 header CSRC count and extension header length. Credit goes to
	 Randell Jesup and the Firefox team for reporting this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-6360</cvename>
 <freebsdpr>ports/207003</freebsdpr>
 <url>https://github.com/cisco/libsrtp/releases/tag/v1.5.3</url>
 <url>https://github.com/cisco/libsrtp/commit/704a31774db0dd941094fd2b47c21638b8dc3de2</url>
 <url>https://github.com/cisco/libsrtp/commit/be95365fbb4788b688cab7af61c65b7989055fb4</url>
 <url>https://github.com/cisco/libsrtp/commit/be06686c8e98cc7bd934e10abb6f5e971d03f8ee</url>
 <url>https://github.com/cisco/libsrtp/commit/cdc69f2acde796a4152a250f869271298abc233f</url>
 </references>
 <dates>
 <discovery>2015-11-02</discovery>
 <entry>2016-02-21</entry>
 </dates>
 </vuln>

<vuln vid="006e3b7c-d7d7-11e5-b85f-0018fe623f2b">
 <topic>jasper -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jasper</name>
	<range><lt>1.900.1_16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	oCERT reports:
	<blockquote cite="http://www.ocert.org/advisories/ocert-2014-012.html">
	 The library is affected by a double-free vulnerability in function
	 jas_iccattrval_destroy()
	 as well as a heap-based buffer overflow in function jp2_decode().
	 A specially crafted jp2 file can be used to trigger the vulnerabilities.
	</blockquote>
	oCERT reports:
	<blockquote cite="http://www.ocert.org/advisories/ocert-2015-001.html">
	 The library is affected by an off-by-one error in a buffer boundary check
	 in jpc_dec_process_sot(), leading to a heap based buffer overflow, as well
	 as multiple unrestricted stack memory use issues in jpc_qmfb.c, leading to
	 stack overflow.
	 A specially crafted jp2 file can be used to trigger the vulnerabilities.
	</blockquote>
	oCERT reports:
	<blockquote cite="http://www.ocert.org/advisories/ocert-2014-009.html">
	 Multiple off-by-one flaws, leading to heap-based buffer overflows, were
	 found in the way JasPer decoded JPEG 2000 files. A specially crafted file
	 could cause an application using JasPer to crash or,
	 possibly, execute arbitrary code.
	</blockquote>
	limingxing reports:
	<blockquote cite="http://seclists.org/oss-sec/2016/q1/233">
	 A vulnerability was found in the way the JasPer's jas_matrix_clip()
	 function parses certain JPEG 2000 image files. A specially crafted file
	 could cause an application using JasPer to crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.ocert.org/advisories/ocert-2014-012.html</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1173157</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1173162</url>
 <url>http://www.ocert.org/advisories/ocert-2015-001.html</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1179282</url>
 <url>http://www.ocert.org/advisories/ocert-2014-009.html</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1167537</url>
 <url>http://seclists.org/oss-sec/2016/q1/233</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1302636</url>
 <cvename>CVE-2014-8137</cvename>
 <cvename>CVE-2014-8138</cvename>
 <cvename>CVE-2014-8157</cvename>
 <cvename>CVE-2014-8158</cvename>
 <cvename>CVE-2014-9029</cvename>
 <cvename>CVE-2016-2089</cvename>
 </references>
 <dates>
 <discovery>2014-12-10</discovery>
 <entry>2016-02-20</entry>
 <modified>2016-02-24</modified>
 </dates>
 </vuln>

<vuln vid="368993bb-d685-11e5-8858-00262d5ed8ee">
 <topic>chromium -- same origin bypass</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>48.0.2564.116</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_18.html">
	 [583431] Critical CVE-2016-1629: Same-origin bypass in Blink
	 and Sandbox escape in Chrome. Credit to anonymous.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1629</cvename>
 <url>http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_18.html</url>
 </references>
 <dates>
 <discovery>2016-02-18</discovery>
 <entry>2016-02-18</entry>
 </dates>
 </vuln>

<vuln vid="2dd7e97e-d5e8-11e5-bcbd-bc5ff45d0f28">
 <topic>glibc -- getaddrinfo stack-based buffer overflow</topic>
 <affects>
 <package>
	<name>linux_base-c6</name>
	<name>linux_base-c6_64</name>
	<range><lt>6.7_1</lt></range>
 </package>
 <package>
	<name>linux_base-f10</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Fabio Olive Leite reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547">
	 A stack-based buffer overflow was found in libresolv when invoked
	 from nss_dns, allowing specially crafted DNS responses to seize
	 control of EIP in the DNS client. The buffer overflow occurs in the
	 functions send_dg (send datagram) and send_vc (send TCP) for the
	 NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC
	 family, or in some cases AF_INET6 family. The use of AF_UNSPEC (or
	 AF_INET6 in some cases) triggers the low-level resolver code to
	 send out two parallel queries for A and AAAA. A mismanagement of
	 the buffers used for those queries could result in the response of
	 a query writing beyond the alloca allocated buffer created by
	 __res_nquery.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7547</cvename>
 <freebsdpr>ports/207272</freebsdpr>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547</url>
 <url>https://blog.des.no/2016/02/freebsd-and-cve-2015-7547/</url>
 <url>https://googleonlinesecurity.blogspot.no/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html</url>
 <url>https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html</url>
 </references>
 <dates>
 <discovery>2016-02-16</discovery>
 <entry>2016-02-18</entry>
 </dates>
 </vuln>

<vuln vid="56562efb-d5e4-11e5-b2bd-002590263bf5">
 <topic>squid -- SSL/TLS processing remote DoS</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><ge>3.5.13</ge><lt>3.5.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid security advisory 2016:1 reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_1.txt">
	 Due to incorrectly handling server errors Squid is vulnerable to a
	 denial of service attack when connecting to TLS or SSL servers.
	 This problem allows any trusted client to perform a denial of
	 service attack on the Squid service regardless of whether TLS or
	 SSL is configured for use in the proxy.
	 Misconfigured client or server software may trigger this issue
	 to perform a denial of service unintentionally.
	 However, the bug is exploitable only if Squid is built using the
	 --with-openssl option.
	</blockquote>
	The FreeBSD port does not use SSL by default and is not vulnerable
	 in the default configuration.
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2390</cvename>
 <freebsdpr>ports/207294</freebsdpr>
 <url>http://www.squid-cache.org/Advisories/SQUID-2016_1.txt</url>
 </references>
 <dates>
 <discovery>2016-02-16</discovery>
 <entry>2016-02-18</entry>
 </dates>
 </vuln>

<vuln vid="dd563930-d59a-11e5-8fa8-14dae9d210b8">
 <topic>adminer -- remote code execution</topic>
 <affects>
 <package>
	<name>adminer</name>
	<range><lt>4.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jakub Vrana reports:
	<blockquote cite="https://github.com/vrana/adminer/commit/e5352cc5acad21513bb02677e2021b80bf7e7b8b">
	 Fix remote code execution in SQLite query
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/vrana/adminer/commit/e5352cc5acad21513bb02677e2021b80bf7e7b8b</url>
 </references>
 <dates>
 <discovery>2016-02-06</discovery>
 <entry>2016-02-17</entry>
 </dates>
 </vuln>

<vuln vid="18201a1c-d59a-11e5-8fa8-14dae9d210b8">
 <topic>adminer -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>adminer</name>
	<range><lt>4.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jakub Vrana reports:
	<blockquote cite="https://github.com/vrana/adminer/commit/4be0b6655e0bf415960659db2a6dd4e60eebbd66">
	 Fix XSS in indexes (non-MySQL only)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/vrana/adminer/commit/4be0b6655e0bf415960659db2a6dd4e60eebbd66</url>
 </references>
 <dates>
 <discovery>2015-11-08</discovery>
 <entry>2016-02-17</entry>
 </dates>
 </vuln>

<vuln vid="ad91ee9b-d599-11e5-8fa8-14dae9d210b8">
 <topic>adminer -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>adminer</name>
	<range><lt>4.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jakub Vrana reports:
	<blockquote cite="https://github.com/vrana/adminer/commit/596f8df373cd3efe5bcb6013858bd7a6bb5ecb2c">
	 Fix XSS in alter table
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/vrana/adminer/commit/596f8df373cd3efe5bcb6013858bd7a6bb5ecb2c</url>
 </references>
 <dates>
 <discovery>2015-08-05</discovery>
 <entry>2016-02-17</entry>
 </dates>
 </vuln>

<vuln vid="8cf54d73-d591-11e5-8fa8-14dae9d210b8">
 <topic>adminer -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>adminer</name>
	<range><lt>4.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jakub Vrana reports:
	<blockquote cite="https://github.com/vrana/adminer/commit/c990de3b3ee1816afb130bd0e1570577bf54a8e5">
	 Fix XSS in login form
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/vrana/adminer/commit/c990de3b3ee1816afb130bd0e1570577bf54a8e5</url>
 <url>https://sourceforge.net/p/adminer/bugs-and-features/436/</url>
 </references>
 <dates>
 <discovery>2015-01-30</discovery>
 <entry>2016-02-17</entry>
 </dates>
 </vuln>

<vuln vid="95b92e3b-d451-11e5-9794-e8e0b747a45a">
 <topic>libgcrypt -- side-channel attack on ECDH</topic>
 <affects>
 <package>
	<name>libgcrypt</name>
	<range><lt>1.6.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GnuPG reports:
	<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000384.html">
	 Mitigate side-channel attack on ECDH with Weierstrass curves.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7511</cvename>
 <url>https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000384.html</url>
 </references>
 <dates>
 <discovery>2016-02-09</discovery>
 <entry>2016-02-16</entry>
 </dates>
 </vuln>

<vuln vid="f1bf28c5-d447-11e5-b2bd-002590263bf5">
 <topic>xdelta3 -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>xdelta3</name>
	<range><lt>3.0.9,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stepan Golosunov reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/02/08/1">
	 Buffer overflow was found and fixed in xdelta3 binary diff tool
	 that allows arbitrary code execution from input files at least on
	 some systems.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-9765</cvename>
 <url>http://www.openwall.com/lists/oss-security/2016/02/08/1</url>
 <url>https://github.com/jmacd/xdelta-devel/commit/ef93ff74203e030073b898c05e8b4860b5d09ef2</url>
 </references>
 <dates>
 <discovery>2014-10-08</discovery>
 <entry>2016-02-16</entry>
 </dates>
 </vuln>

<vuln vid="172b22cb-d3f6-11e5-ac9e-485d605f4717">
 <topic>firefox -- Same-origin-policy violation using Service Workers with plugins</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>44.0.2,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>44.0.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox44.0.2">
	 MFSA 2016-13 Jason Pang of OneSignal reported that service workers intercept
	 responses to plugin network requests made through the browser. Plugins which
	 make security decisions based on the content of network requests can have these
	 decisions subverted if a service worker forges responses to those requests. For
	 example, a forged crossdomain.xml could allow a malicious site to violate the
	 same-origin policy using the Flash plugin.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1949</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-13/</url>
 </references>
 <dates>
 <discovery>2016-02-11</discovery>
 <entry>2016-02-15</entry>
 </dates>
 </vuln>

<vuln vid="07718e2b-d29d-11e5-a95f-b499baebfeaf">
 <topic>nghttp2 -- Out of memory in nghttpd, nghttp, and libnghttp2_asio</topic>
 <affects>
 <package>
	<name>nghttp2</name>
	<range><lt>1.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nghttp2 reports:
	<blockquote cite="https://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/">
	 Out of memory in nghttpd, nghttp, and libnghttp2_asio applications
	 due to unlimited incoming HTTP header fields.
	 nghttpd, nghttp, and libnghttp2_asio applications do not limit the memory usage
	 for the incoming HTTP header field. If peer sends specially crafted HTTP/2
	 HEADERS frames and CONTINUATION frames, they will crash with out of memory
	 error.
	 Note that libnghttp2 itself is not affected by this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/</url>
 <cvename>CVE-2016-1544</cvename>
 </references>
 <dates>
 <discovery>2016-02-03</discovery>
 <entry>2016-02-13</entry>
 </dates>
 </vuln>

<vuln vid="3aa8b781-d2c4-11e5-b2bd-002590263bf5">
 <topic>horde -- XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>horde</name>
	<range><lt>5.2.9</lt></range>
 </package>
 <package>
	<name>pear-Horde_Core</name>
	<range><lt>2.22.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Horde Team reports:
	<blockquote cite="http://lists.horde.org/archives/announce/2016/001149.html">
	 Fixed XSS vulnerabilities in menu bar and form renderer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8807</cvename>
 <cvename>CVE-2016-2228</cvename>
 <url>https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253</url>
 <url>https://bugs.horde.org/ticket/14213</url>
 <url>https://github.com/horde/horde/commit/f03301cf6edcca57121a15e80014c4d0f29d99a0</url>
 <url>https://github.com/horde/horde/commit/ab07a1b447de34e13983b4d7ceb18b58c3a358d8</url>
 <url>http://www.openwall.com/lists/oss-security/2016/02/06/4</url>
 <url>http://lists.horde.org/archives/announce/2016/001149.html</url>
 </references>
 <dates>
 <discovery>2016-02-02</discovery>
 <entry>2016-02-14</entry>
 </dates>
 </vuln>

<vuln vid="e8b6605b-d29f-11e5-8458-6cc21735f730">
 <topic>PostgreSQL -- Security Fixes for Regular Expressions, PL/Java.</topic>
 <affects>
 <package>
	<name>postgresql91-server</name>
	<range><ge>9.1.0</ge><lt>9.1.20</lt></range>
 </package>
 <package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.15</lt></range>
 </package>
 <package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.11</lt></range>
 </package>
 <package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.6</lt></range>
 </package>
 <package>
	<name>postgresql95-server</name>
	<range><ge>9.5.0</ge><lt>9.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL project reports:
	<blockquote cite="http://www.postgresql.org/about/news/1644/">
	 
	 Security Fixes for Regular Expressions, PL/Java
	 
	 <ul>
	 <li>CVE-2016-0773: This release closes security hole CVE-2016-0773,
	 an issue with regular expression (regex) parsing. Prior code allowed
	 users to pass in expressions which included out-of-range Unicode
	 characters, triggering a backend crash. This issue is critical for
	 PostgreSQL systems with untrusted users or which generate regexes
	 based on user input.
	 </li>
	 <li>CVE-2016-0766: The update also fixes CVE-2016-0766, a privilege
	 escalation issue for users of PL/Java. Certain custom configuration
	 settings (GUCS) for PL/Java will now be modifiable only by the
	 database superuser
	 </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-0773</cvename>
 <cvename>CVE-2016-0766</cvename>
 </references>
 <dates>
 <discovery>2016-02-08</discovery>
 <entry>2016-02-12</entry>
 </dates>
 </vuln>

<vuln vid="5d8e56c3-9e67-4d5b-81c9-3a409dfd705f">
 <topic>flash -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.569</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-04.html">
	 These updates resolve a type confusion vulnerability that
	 could lead to code execution (CVE-2016-0985).
	 These updates resolve use-after-free vulnerabilities that
	 could lead to code execution (CVE-2016-0973, CVE-2016-0974,
	 CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, CVE-2016-0984).
	 These updates resolve a heap buffer overflow vulnerability
	 that could lead to code execution (CVE-2016-0971).
	 These updates resolve memory corruption vulnerabilities
	 that could lead to code execution (CVE-2016-0964,
	 CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968,
	 CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976,
	 CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980,
	 CVE-2016-0981).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-0964</cvename>
 <cvename>CVE-2016-0965</cvename>
 <cvename>CVE-2016-0966</cvename>
 <cvename>CVE-2016-0967</cvename>
 <cvename>CVE-2016-0968</cvename>
 <cvename>CVE-2016-0969</cvename>
 <cvename>CVE-2016-0970</cvename>
 <cvename>CVE-2016-0971</cvename>
 <cvename>CVE-2016-0972</cvename>
 <cvename>CVE-2016-0973</cvename>
 <cvename>CVE-2016-0974</cvename>
 <cvename>CVE-2016-0975</cvename>
 <cvename>CVE-2016-0976</cvename>
 <cvename>CVE-2016-0977</cvename>
 <cvename>CVE-2016-0978</cvename>
 <cvename>CVE-2016-0979</cvename>
 <cvename>CVE-2016-0980</cvename>
 <cvename>CVE-2016-0981</cvename>
 <cvename>CVE-2016-0982</cvename>
 <cvename>CVE-2016-0983</cvename>
 <cvename>CVE-2016-0984</cvename>
 <cvename>CVE-2016-0985</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb16-04.html</url>
 </references>
 <dates>
 <discovery>2016-02-09</discovery>
 <entry>2016-02-10</entry>
 </dates>
 </vuln>

<vuln vid="515b4327-cf8a-11e5-96d6-14dae9d210b8">
 <topic>dnscrypt-proxy -- code execution</topic>
 <affects>
 <package>
	<name>dnscrypt-proxy</name>
	<range><ge>1.1.0</ge><lt>1.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Frank Denis reports:
	<blockquote cite="https://github.com/jedisct1/dnscrypt-proxy/blob/1d129f7d5f0d469308967cbe4eacb4a6919f1fa1/NEWS#L2-L8">
	 Malformed packets could lead to denial of service or code
	 execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/jedisct1/dnscrypt-proxy/blob/1d129f7d5f0d469308967cbe4eacb4a6919f1fa1/NEWS#L2-L8</url>
 </references>
 <dates>
 <discovery>2016-02-02</discovery>
 <entry>2016-02-10</entry>
 <modified>2016-02-14</modified>
 </dates>
 </vuln>

<vuln vid="36034227-cf81-11e5-9c2b-00262d5ed8ee">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>48.0.2564.109</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html">
	 6 security fixes in this release, including:
	 <ul>
	 <li>[546677] High CVE-2016-1622: Same-origin bypass in Extensions.
	 Credit to anonymous.</li>
	 <li>[577105] High CVE-2016-1623: Same-origin bypass in DOM. Credit
	 to Mariusz Mlynski.</li>
	 <li>[509313] Medium CVE-2016-1625: Navigation bypass in Chrome
	 Instant. Credit to Jann Horn.</li>
	 <li>[571480] Medium CVE-2016-1626: Out-of-bounds read in PDFium.
	 Credit to anonymous, working with HP's Zero Day Initiative.</li>
	 <li>[585517] CVE-2016-1627: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1622</cvename>
 <cvename>CVE-2016-1623</cvename>
 <cvename>CVE-2016-1625</cvename>
 <cvename>CVE-2016-1626</cvename>
 <cvename>CVE-2016-1627</cvename>
 <url>http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html</url>
 </references>
 <dates>
 <discovery>2016-02-08</discovery>
 <entry>2016-02-09</entry>
 <modified>2016-03-08</modified>
 </dates>
 </vuln>

<vuln vid="8f10fa04-cf6a-11e5-96d6-14dae9d210b8">
 <topic>graphite2 -- code execution vulnerability</topic>
 <affects>
 <package>
	<name>graphite2</name>
	<range><lt>1.3.5</lt></range>
 </package>
 <package>
	<name>silgraphite</name>
	<range><lt>2.3.1_4</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>38.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Talos reports:
	<blockquote cite="http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html">
	 <ul>
	 <li>An exploitable denial of service vulnerability exists
	 in the font handling of Libgraphite. A specially crafted font can cause
	 an out-of-bounds read potentially resulting in an information leak or
	 denial of service.</li>
	 <li>A specially crafted font can cause a buffer overflow
	 resulting in potential code execution.</li>
	 <li>An exploitable NULL pointer dereference exists in the
	 bidirectional font handling functionality of Libgraphite. A specially
	 crafted font can cause a NULL pointer dereference resulting in a
	 crash.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html</url>
 <url>http://www.talosintel.com/reports/TALOS-2016-0061/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-14/</url>
 <cvename>CVE-2016-1521</cvename>
 <cvename>CVE-2016-1522</cvename>
 <cvename>CVE-2016-1523</cvename>
 <cvename>CVE-2016-1526</cvename>
 </references>
 <dates>
 <discovery>2016-02-05</discovery>
 <entry>2016-02-09</entry>
 <modified>2016-03-08</modified>
 </dates>
 </vuln>

<vuln vid="1cecd5e0-c372-11e5-96d6-14dae9d210b8">
 <topic>xymon-server -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xymon-server</name>
	<range><lt>4.3.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	J.C. Cleaver reports:
	<blockquote cite="http://lists.xymon.com/pipermail/xymon/2016-February/042986.html">
	 <ul>
	 <li>CVE-2016-2054: Buffer overflow in xymond handling of
	 "config" command</li>
	 <li> CVE-2016-2055: Access to possibly confidential files
	 in the Xymon configuration directory</li>
	 <li>CVE-2016-2056: Shell command injection in the
	 "useradm" and "chpasswd" web applications</li>
	 <li>CVE-2016-2057: Incorrect permissions on IPC queues
	 used by the xymond daemon can bypass IP access filtering</li>
	 <li>CVE-2016-2058: Javascript injection in "detailed status
	 webpage" of monitoring items; XSS vulnerability via malformed
	 acknowledgment messages</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.xymon.com/pipermail/xymon/2016-February/042986.html</url>
 <cvename>CVE-2016-2054</cvename>
 <cvename>CVE-2016-2055</cvename>
 <cvename>CVE-2016-2056</cvename>
 <cvename>CVE-2016-2057</cvename>
 <cvename>CVE-2016-2058</cvename>
 </references>
 <dates>
 <discovery>2016-01-19</discovery>
 <entry>2016-02-09</entry>
 </dates>
 </vuln>

<vuln vid="85eb4e46-cf16-11e5-840f-485d605f4717">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php55</name>
	<name>php55-phar</name>
	<name>php55-wddx</name>
	<range><lt>5.5.32</lt></range>
 </package>
 <package>
	<name>php56</name>
	<name>php56-phar</name>
	<name>php56-wddx</name>
	<range><lt>5.6.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP reports:
	<blockquote cite="http://php.net/ChangeLog-5.php#5.6.18">
	 <ul><li>Core:
	 <ul>
	 <li>Fixed bug #71039 (exec functions ignore length but look for NULL
	 termination).</li>
	 <li>Fixed bug #71323 (Output of stream_get_meta_data can be
	 falsified by its input).</li>
	 <li>Fixed bug #71459 (Integer overflow in iptcembed()).</li>
	 </ul></li>
	 <li>PCRE:
	 <ul>
	 <li>Upgraded bundled PCRE library to 8.38.(CVE-2015-8383,
	 CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390,
	 CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)</li>
	 </ul></li>
	 <li>Phar:
	 <ul>
	 <li>Fixed bug #71354 (Heap corruption in tar/zip/phar parser).</li>
	 <li>Fixed bug #71391 (NULL Pointer Dereference in
	 phar_tar_setupmetadata()).</li>
	 <li>Fixed bug #71488 (Stack overflow when decompressing tar
	 archives). (CVE-2016-2554)</li>
	 </ul></li>
	 <li>WDDX:
	 <ul>
	 <li>Fixed bug #71335 (Type Confusion in WDDX Packet
	 Deserialization).</li>
	 </ul></li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8383</cvename>
 <cvename>CVE-2015-8386</cvename>
 <cvename>CVE-2015-8387</cvename>
 <cvename>CVE-2015-8389</cvename>
 <cvename>CVE-2015-8390</cvename>
 <cvename>CVE-2015-8391</cvename>
 <cvename>CVE-2015-8393</cvename>
 <cvename>CVE-2015-8394</cvename>
 <cvename>CVE-2016-2554</cvename>
 <url>http://php.net/ChangeLog-5.php#5.6.18</url>
 <url>http://php.net/ChangeLog-5.php#5.5.32</url>
 </references>
 <dates>
 <discovery>2016-02-04</discovery>
 <entry>2016-02-09</entry>
 <modified>2016-03-13</modified>
 </dates>
 </vuln>

<vuln vid="a8de962a-cf15-11e5-805c-5453ed2e2b49">
 <topic>py-imaging, py-pillow -- Buffer overflow in PCD decoder</topic>
 <affects>
 <package>
	<name>py27-pillow</name>
	<name>py33-pillow</name>
	<name>py34-pillow</name>
	<name>py35-pillow</name>
	<range><lt>2.9.0_1</lt></range>
 </package>
 <package>
	<name>py27-imaging</name>
	<range><lt>1.1.7_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Pillow maintainers report:
	<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
	 In all versions of Pillow, dating back at least to the last PIL
	 1.1.7 release, PcdDecode.c has a buffer overflow error.
	 The state.buffer for PcdDecode.c is allocated based on a 3 bytes
	 per pixel sizing, where PcdDecode.c wrote into the buffer assuming
	 4 bytes per pixel. This writes 768 bytes beyond the end of the
	 buffer into other Python object storage. In some cases, this causes
	 a segfault, in others an internal Python malloc error.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist>http://openwall.com/lists/oss-security/2016/02/02/5</mlist>
 <url>https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4</url>
 <url>https://github.com/python-pillow/Pillow/issues/568</url>
 </references>
 <dates>
 <discovery>2016-02-02</discovery>
 <entry>2016-02-09</entry>
 </dates>
 </vuln>

<vuln vid="0519db18-cf15-11e5-805c-5453ed2e2b49">
 <topic>py-pillow -- Integer overflow in Resample.c</topic>
 <affects>
 <package>
	<name>py27-pillow</name>
	<name>py33-pillow</name>
	<name>py34-pillow</name>
	<name>py35-pillow</name>
	<range><lt>2.9.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Pillow maintainers report:
	<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
	 If a large value was passed into the new size for an image, it is
	 possible to overflow an int32 value passed into malloc, leading the
	 malloc’d buffer to be undersized. These allocations are followed by
	 a loop that writes out of bounds. This can lead to corruption on
	 the heap of the Python process with attacker controlled float
	 data.
	 This issue was found by Ned Williamson.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/python-pillow/Pillow/commit/41fae6d9e2da741d2c5464775c7f1a609ea03798</url>
 <url>https://github.com/python-pillow/Pillow/issues/1710</url>
 </references>
 <dates>
 <discovery>2016-02-05</discovery>
 <entry>2016-02-09</entry>
 </dates>
 </vuln>

<vuln vid="6ea60e00-cf13-11e5-805c-5453ed2e2b49">
 <topic>py-imaging, py-pillow -- Buffer overflow in FLI decoding code</topic>
 <affects>
 <package>
	<name>py27-pillow</name>
	<name>py33-pillow</name>
	<name>py34-pillow</name>
	<name>py35-pillow</name>
	<range><lt>2.9.0_1</lt></range>
 </package>
 <package>
	<name>py27-imaging</name>
	<range><lt>1.1.7_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Pillow maintainers report:
	<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
	 In all versions of Pillow, dating back at least to the last PIL
	 1.1.7 release, FliDecode.c has a buffer overflow error.
	 There is a memcpy error where x is added to a target buffer
	 address. X is used in several internal temporary variable roles,
	 but can take a value up to the width of the image. Im-&gt;image[y]
	 is a set of row pointers to segments of memory that are the size of
	 the row. At the max y, this will write the contents of the line off
	 the end of the memory buffer, causing a segfault.
	 This issue was found by Alyssa Besseling at Atlassian.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-0775</cvename>
 <url>https://github.com/python-pillow/Pillow/commit/bcaaf97f4ff25b3b5b9e8efeda364e17e80858ec</url>
 </references>
 <dates>
 <discovery>2016-02-05</discovery>
 <entry>2016-02-09</entry>
 </dates>
 </vuln>

<vuln vid="53252879-cf11-11e5-805c-5453ed2e2b49">
 <topic>py-pillow -- Buffer overflow in TIFF decoding code</topic>
 <affects>
 <package>
	<name>py27-pillow</name>
	<name>py33-pillow</name>
	<name>py34-pillow</name>
	<name>py35-pillow</name>
	<range><lt>2.9.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Pillow maintainers report:
	<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
	 Pillow 3.1.0 and earlier when linked against libtiff &gt;= 4.0.0 on
	 x64 may overflow a buffer when reading a specially crafted tiff
	 file.
	 Specifically, libtiff &gt;= 4.0.0 changed the return type of
	 TIFFScanlineSize from int32 to machine dependent int32|64. If the
	 scanline is sized so that it overflows an int32, it may be
	 interpreted as a negative number, which will then pass the size check
	 in TiffDecode.c line 236. To do this, the logical scanline size has
	 to be &gt; 2gb, and for the test file, the allocated buffer size is 64k
	 against a roughly 4gb scan line size. Any image data over 64k is
	 written over the heap, causing a segfault.
	 This issue was found by security researcher FourOne.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-0740</cvename>
 <url>https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e</url>
 </references>
 <dates>
 <discovery>2016-02-04</discovery>
 <entry>2016-02-09</entry>
 </dates>
 </vuln>

<vuln vid="6ac79ed8-ccc2-11e5-932b-5404a68ad561">
 <topic>ffmpeg -- remote denial of service in JPEG2000 decoder</topic>
 <affects>
 <package>
	<name>ffmpeg</name>
	<range><lt>2.8.6,1</lt></range>
 </package>
 <package>
	<name>mplayer</name>
	<name>mencoder</name>
	<range>
	 <lt>1.2.r20151219_3</lt>
	</range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	FFmpeg security reports:
	<blockquote cite="https://www.ffmpeg.org/security.html">
	 FFmpeg 2.8.6 fixes the following vulnerabilities:
	 CVE-2016-2213
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-2213</cvename>
 <url>https://www.ffmpeg.org/security.html</url>
 </references>
 <dates>
 <discovery>2016-01-27</discovery>
 <entry>2016-02-06</entry>
 </dates>
 </vuln>

<vuln vid="448047e9-030e-4ce4-910b-f21a3ad5d9a0">
 <topic>shotwell -- not verifying certificates</topic>
 <affects>
 <package>
	<name>shotwell</name>
	<range><lt>0.22.0.99</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michael Catanzaro reports:
	<blockquote cite="https://mail.gnome.org/archives/distributor-list/2016-January/msg00000.html">
	 Shotwell has a serious security issue ("Shotwell does not
	 verify TLS certificates"). Upstream is no longer active and
	 I do not expect any further upstream releases unless someone
	 from the community steps up to maintain it.

What is the impact of the issue? If you ever used any of
	 the publish functionality (publish to Facebook, publish to
	 Flickr, etc.), your passwords may have been stolen; changing
	 them is not a bad idea.

What is the risk of the update? Regressions. The easiest
	 way to validate TLS certificates was to upgrade WebKit; it
	 seems to work but I don't have accounts with the online
	 services it supports, so I don't know if photo publishing
	 still works properly on all the services.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mail.gnome.org/archives/distributor-list/2016-January/msg00000.html</url>
 </references>
 <dates>
 <discovery>2016-01-06</discovery>
 <entry>2016-02-05</entry>
 </dates>
 </vuln>

<vuln vid="1091d2d1-cb2e-11e5-b14b-bcaec565249c">
 <topic>webkit -- UI spoof</topic>
 <affects>
 <package>
	<name>webkit-gtk2</name>
	<name>webkit-gtk3</name>
	<range><lt>2.4.9_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	webkit reports:
	<blockquote cite="http://webkitgtk.org/security/WSA-2015-0002.html">
	 The ScrollView::paint function in platform/scroll/ScrollView.cpp
	 in Blink, as used in Google Chrome before 35.0.1916.114, allows
	 remote attackers to spoof the UI by extending scrollbar painting
	 into the parent frame.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1748</cvename>
 <url>http://webkitgtk.org/security/WSA-2015-0002.html</url>
 </references>
 <dates>
 <discovery>2015-12-28</discovery>
 <entry>2016-02-04</entry>
 </dates>
 </vuln>

<vuln vid="e78bfc9d-cb1e-11e5-b251-0050562a4d7b">
 <topic>py-rsa -- Bleichenbacher'06 signature forgery vulnerability</topic>
 <affects>
 <package>
	<name>py27-rsa</name>
	<name>py32-rsa</name>
	<name>py33-rsa</name>
	<name>py34-rsa</name>
	<name>py35-rsa</name>
	<range><lt>3.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Filippo Valsorda reports:
	<blockquote cite="https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/">
	 
	 python-rsa is vulnerable to a straightforward variant of the
	 Bleichenbacher'06 attack against RSA signature verification
	 with low public exponent.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1494</cvename>
 <url>https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/</url>
 <url>https://bitbucket.org/sybren/python-rsa/pull-requests/14/security-fix-bb06-attack-in-verify-by</url>
 <url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1494</url>
 <url>http://www.openwall.com/lists/oss-security/2016/01/05/3</url>
 <url>http://www.openwall.com/lists/oss-security/2016/01/05/1</url>
 </references>
 <dates>
 <discovery>2016-01-05</discovery>
 <entry>2016-02-04</entry>
 </dates>
 </vuln>

<vuln vid="559f3d1b-cb1d-11e5-80a4-001999f8d30b">
 <topic>asterisk -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk</name>
	<range><lt>1.8.32.3_5</lt></range>
 </package>
 <package>
	<name>asterisk11</name>
	<range><lt>11.21.1</lt></range>
 </package>
 <package>
	<name>asterisk13</name>
	<range><lt>13.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 AST-2016-001 - BEAST vulnerability in HTTP server
	 AST-2016-002 - File descriptor exhaustion in chan_sip
	 AST-2016-003 - Remote crash vulnerability when receiving UDPTL FAX data
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2016-001.html</url>
 <cvename>CVE-2011-3389</cvename>
 <url>http://downloads.asterisk.org/pub/security/AST-2016-002.html</url>
 <cvename>CVE-2016-2316</cvename>
 <url>http://downloads.asterisk.org/pub/security/AST-2016-003.html</url>
 <cvename>CVE-2016-2232</cvename>
 </references>
 <dates>
 <discovery>2016-02-03</discovery>
 <entry>2016-02-04</entry>
 <modified>2016-03-07</modified>
 </dates>
 </vuln>

<vuln vid="0652005e-ca96-11e5-96d6-14dae9d210b8">
 <topic>salt -- code execution</topic>
 <affects>
 <package>
	<name>py27-salt</name>
	<name>py32-salt</name>
	<name>py33-salt</name>
	<name>py34-salt</name>
	<name>py35-salt</name>
	<range><ge>2015.8.0</ge><lt>2015.8.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SaltStack reports:
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html">
	 Improper handling of clear messages on the minion, which
	 could result in executing commands not sent by the master.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html</url>
 <url>https://github.com/saltstack/salt/pull/30613/files</url>
 <cvename>CVE-2016-1866</cvename>
 </references>
 <dates>
 <discovery>2016-01-25</discovery>
 <entry>2016-02-03</entry>
 </dates>
 </vuln>

<vuln vid="bb0ef21d-0e1b-461b-bc3d-9cba39948888">
 <topic>rails -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-actionpack</name>
	<range><lt>3.2.22.1</lt></range>
 </package>
 <package>
	<name>rubygem-actionpack4</name>
	<range><lt>4.2.5.1</lt></range>
 </package>
 <package>
	<name>rubygem-actionview</name>
	<range><lt>4.2.5.1</lt></range>
 </package>
 <package>
	<name>rubygem-activemodel4</name>
	<range><lt>4.2.5.1</lt></range>
 </package>
 <package>
	<name>rubygem-activerecord</name>
	<range><lt>3.2.22.1</lt></range>
 </package>
 <package>
	<name>rubygem-activerecord4</name>
	<range><lt>4.2.5.1</lt></range>
 </package>
 <package>
	<name>rubygem-rails</name>
	<range><lt>3.2.22.1</lt></range>
 </package>
 <package>
	<name>rubygem-rails-html-sanitizer</name>
	<range><lt>1.0.3</lt></range>
 </package>
 <package>
	<name>rubygem-rails4</name>
	<range><lt>4.2.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails blog:
	<blockquote cite="http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/">
	 Rails 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, and 3.2.22.1 have been
	 released! These contain important security fixes, and it is
	 recommended that users upgrade as soon as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7576</cvename>
 <cvename>CVE-2015-7577</cvename>
 <cvename>CVE-2015-7581</cvename>
 <cvename>CVE-2016-0751</cvename>
 <cvename>CVE-2016-0752</cvename>
 <cvename>CVE-2016-0753</cvename>
 <url>https://groups.google.com/d/msg/rubyonrails-security/ANv0HDHEC3k/mt7wNGxbFQAJ</url>
 <url>https://groups.google.com/d/msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ</url>
 <url>https://groups.google.com/d/msg/rubyonrails-security/dthJ5wL69JE/YzPnFelbFQAJ</url>
 <url>https://groups.google.com/d/msg/rubyonrails-security/9oLY_FCzvoc/w9oI9XxbFQAJ</url>
 <url>https://groups.google.com/d/msg/rubyonrails-security/335P1DcLG00/OfB9_LhbFQAJ</url>
 <url>https://groups.google.com/d/msg/rubyonrails-security/6jQVC1geukQ/8oYETcxbFQAJ</url>
 <url>http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/</url>
 </references>
 <dates>
 <discovery>2016-01-25</discovery>
 <entry>2016-02-02</entry>
 </dates>
 </vuln>

<vuln vid="a52a7172-c92e-11e5-96d6-14dae9d210b8">
 <topic>socat -- diffie hellman parameter was not prime</topic>
 <affects>
 <package>
	<name>socat</name>
	<range><ge>1.7.2.5</ge><lt>1.7.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	socat reports:
	<blockquote cite="http://www.dest-unreach.org/socat/contrib/socat-secadv7.html">
	 In the OpenSSL address implementation the hard coded 1024
	 bit DH p parameter was not prime. The effective cryptographic strength
	 of a key exchange using these parameters was weaker than the one one
	 could get by using a prime p. Moreover, since there is no indication of
	 how these parameters were chosen, the existence of a trapdoor that makes
	 possible for an eavesdropper to recover the shared secret from a key
	 exchange that uses them cannot be ruled out.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.dest-unreach.org/socat/contrib/socat-secadv7.html</url>
 </references>
 <dates>
 <discovery>2016-02-01</discovery>
 <entry>2016-02-01</entry>
 </dates>
 </vuln>

<vuln vid="4f00dac0-1e18-4481-95af-7aaad63fd303">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<name>linux-firefox</name>
	<range><lt>44.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.41</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>38.6.0,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>38.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox44">
	 MFSA 2016-01 Miscellaneous memory safety hazards (rv:44.0
	 / rv:38.6)
	 MFSA 2016-02 Out of Memory crash when parsing GIF format
	 images
	 MFSA 2016-03 Buffer overflow in WebGL after out of memory
	 allocation
	 MFSA 2016-04 Firefox allows for control characters to be
	 set in cookie names
	 MFSA 2016-06 Missing delay following user click events in
	 protocol handler dialog
	 MFSA 2016-09 Addressbar spoofing attacks
	 MFSA 2016-10 Unsafe memory manipulation found through
	 code inspection
	 MFSA 2016-11 Application Reputation service disabled in
	 Firefox 43
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7208</cvename>
 <cvename>CVE-2016-1930</cvename>
 <cvename>CVE-2016-1931</cvename>
 <cvename>CVE-2016-1933</cvename>
 <cvename>CVE-2016-1935</cvename>
 <cvename>CVE-2016-1937</cvename>
 <cvename>CVE-2016-1939</cvename>
 <cvename>CVE-2016-1942</cvename>
 <cvename>CVE-2016-1943</cvename>
 <cvename>CVE-2016-1944</cvename>
 <cvename>CVE-2016-1945</cvename>
 <cvename>CVE-2016-1946</cvename>
 <cvename>CVE-2016-1947</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-01/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-02/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-03/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-04/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-06/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-09/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-10/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2016-11/</url>
 </references>
 <dates>
 <discovery>2016-01-26</discovery>
 <entry>2016-02-01</entry>
 <modified>2016-03-08</modified>
 </dates>
 </vuln>

<vuln vid="e00d8b94-c88a-11e5-b5fe-002590263bf5">
 <topic>gdcm -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gdcm</name>
	<range><lt>2.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CENSUS S.A. reports:
	<blockquote cite="http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/">
	 GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are
	 prone to an integer overflow vulnerability which leads to a buffer
	 overflow and potentially to remote code execution.
	</blockquote>
	<blockquote cite="http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/">
	 GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are
	 prone to an out-of-bounds read vulnerability due to missing checks.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8396</cvename>
 <cvename>CVE-2015-8397</cvename>
 <url>http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/</url>
 <url>http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/</url>
 </references>
 <dates>
 <discovery>2015-12-23</discovery>
 <entry>2016-02-01</entry>
 </dates>
 </vuln>

<vuln vid="c1c18ee1-c711-11e5-96d6-14dae9d210b8">
 <topic>nginx -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><lt>1.8.1,2</lt></range>
 </package>
 <package>
	<name>nginx-devel</name>
	<range><lt>1.9.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Maxim Dounin reports:
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html">
	 Several problems in nginx resolver were identified, which
	 might allow an attacker to cause worker process crash, or might have
	 potential other impact if the "resolver" directive
	 is used in a configuration file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html</url>
 <cvename>CVE-2016-0742</cvename>
 <cvename>CVE-2016-0746</cvename>
 <cvename>CVE-2016-0747</cvename>
 </references>
 <dates>
 <discovery>2016-01-26</discovery>
 <entry>2016-01-30</entry>
 </dates>
 </vuln>

<vuln vid="a0d77bc8-c6a7-11e5-96d6-14dae9d210b8">
 <topic>typo3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>typo3</name>
	<range><lt>7.6.1</lt></range>
 </package>
 <package>
	<name>typo3-lts</name>
	<range><lt>6.2.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	TYPO3 Security Team reports:
	<blockquote cite="http://lists.typo3.org/pipermail/typo3-announce/2015/000351.html">
	 It has been discovered that TYPO3 CMS is susceptible to
	 Cross-Site Scripting and Cross-Site Flashing.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.typo3.org/pipermail/typo3-announce/2015/000351.html</url>
 <url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-010/</url>
 <url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-011/</url>
 <url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012/</url>
 <url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-013/</url>
 <url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-014/</url>
 <url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015/</url>
 </references>
 <dates>
 <discovery>2015-12-15</discovery>
 <entry>2016-01-29</entry>
 </dates>
 </vuln>

<vuln vid="93eadedb-c6a6-11e5-96d6-14dae9d210b8">
 <topic>nghttp2 -- use after free</topic>
 <affects>
 <package>
	<name>nghttp2</name>
	<range><lt>1.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	nghttp2 reports:
	<blockquote cite="https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/">
	 This release fixes heap-use-after-free bug in idle stream
	 handling code. We strongly recommend to upgrade the older installation
	 to this latest version as soon as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/</url>
 <cvename>CVE-2015-8659</cvename>
 </references>
 <dates>
 <discovery>2015-12-23</discovery>
 <entry>2016-01-29</entry>
 </dates>
 </vuln>

<vuln vid="3166222b-c6a4-11e5-96d6-14dae9d210b8">
 <topic>owncloud -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>owncloud</name>
	<range><lt>8.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Owncloud reports:
	<blockquote cite="https://owncloud.org/blog/owncloud-8-2-2-8-1-5-8-0-10-and-7-0-12-here-with-sharing-ldap-fixes/">
	 <ul>
	 <li>Reflected XSS in OCS provider discovery
	 (oC-SA-2016-001)</li>
	 <li>Information Exposure Through Directory Listing in the
	 file scanner (oC-SA-2016-002)</li>
	 <li>Disclosure of files that begin with ".v" due to
	 unchecked return value (oC-SA-2016-003)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://owncloud.org/blog/owncloud-8-2-2-8-1-5-8-0-10-and-7-0-12-here-with-sharing-ldap-fixes/</url>
 <url>https://owncloud.org/security/advisory/?id=oc-sa-2016-001</url>
 <url>https://owncloud.org/security/advisory/?id=oc-sa-2016-002</url>
 <url>https://owncloud.org/security/advisory/?id=oc-sa-2016-003</url>
 <cvename>CVE-2016-1498</cvename>
 <cvename>CVE-2016-1499</cvename>
 <cvename>CVE-2016-1500</cvename>
 </references>
 <dates>
 <discovery>2015-12-23</discovery>
 <entry>2016-01-29</entry>
 </dates>
 </vuln>

<vuln vid="ff824eea-c69c-11e5-96d6-14dae9d210b8">
 <topic>radicale -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-radicale</name>
	<name>py32-radicale</name>
	<name>py33-radicale</name>
	<name>py34-radicale</name>
	<range><lt>1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Radicale reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/06/4">
	 The multifilesystem backend allows access to arbitrary
	 files on all platforms.
	 Prevent regex injection in rights management.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2016/01/06/4</url>
 <cvename>CVE-2015-8747</cvename>
 <cvename>CVE-2015-8748</cvename>
 </references>
 <dates>
 <discovery>2015-12-24</discovery>
 <entry>2016-01-29</entry>
 </dates>
 </vuln>

<vuln vid="7a59e283-c60b-11e5-bf36-6805ca0b3d42">
 <topic>phpmyadmin -- XSS vulnerability in SQL editor</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-9/">
	 With a crafted SQL query, it is possible to trigger an
	 XSS attack in the SQL editor.
	 We consider this vulnerability to be non-critical.
	 This vulnerability can be triggered only by someone who is
	 logged in to phpMyAdmin, as the usual token protection
	 prevents non-logged-in users from accessing the required
	 pages.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-9/</url>
 <cvename>CVE-2016-2045</cvename>
 </references>
 <dates>
 <discovery>2016-01-28</discovery>
 <entry>2016-01-28</entry>
 </dates>
 </vuln>

<vuln vid="78b4ebfb-c60b-11e5-bf36-6805ca0b3d42">
 <topic>phpmyadmin -- Full path disclosure vulnerability in SQL parser</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-8/">
	 By calling a particular script that is part of phpMyAdmin
	 in an unexpected way, it is possible to trigger phpMyAdmin
	 to display a PHP error message which contains the full path
	 of the directory where phpMyAdmin is installed.
	 We consider this vulnerability to be non-critical.
	 This path disclosure is possible on servers where the
	 recommended setting of the PHP configuration directive
	 display_errors is set to on, which is against the
	 recommendations given in the PHP manual for a production
	 server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-8/</url>
 <cvename>CVE-2016-2044</cvename>
 </references>
 <dates>
 <discovery>2016-01-28</discovery>
 <entry>2016-01-28</entry>
 </dates>
 </vuln>

<vuln vid="7694927f-c60b-11e5-bf36-6805ca0b3d42">
 <topic>phpmyadmin -- XSS vulnerability in normalization page</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-7/">
	 With a crafted table name it is possible to trigger an
	 XSS attack in the database normalization page.
	 We consider this vulnerability to be non-critical.
	 This vulnerability can be triggered only by someone who is
	 logged in to phpMyAdmin, as the usual token protection
	 prevents non-logged-in users from accessing the required page.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-7/</url>
 <cvename>CVE-2016-2043</cvename>
 </references>
 <dates>
 <discovery>2016-01-28</discovery>
 <entry>2016-01-28</entry>
 </dates>
 </vuln>

<vuln vid="740badcb-c60b-11e5-bf36-6805ca0b3d42">
 <topic>phpmyadmin -- Multiple full path disclosure vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-6/">
	 By calling some scripts that are part of phpMyAdmin in an
	 unexpected way, it is possible to trigger phpMyAdmin to
	 display a PHP error message which contains the full path of
	 the directory where phpMyAdmin is installed.
	 We consider these vulnerabilities to be non-critical.
	 This path disclosure is possible on servers where the
	 recommended setting of the PHP configuration directive
	 display_errors is set to on, which is against the
	 recommendations given in the PHP manual for a production
	 server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-6/</url>
 <cvename>CVE-2016-2042</cvename>
 </references>
 <dates>
 <discovery>2016-01-28</discovery>
 <entry>2016-01-28</entry>
 </dates>
 </vuln>

<vuln vid="71b24d99-c60b-11e5-bf36-6805ca0b3d42">
 <topic>phpmyadmin -- Unsafe comparison of XSRF/CSRF token</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-5/">
	 The comparison of the XSRF/CSRF token parameter with the
	 value saved in the session is vulnerable to timing
	 attacks. Moreover, the comparison could be bypassed if the
	 XSRF/CSRF token matches a particular pattern.
	 We consider this vulnerability to be serious.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-5/</url>
 <cvename>CVE-2016-2041</cvename>
 </references>
 <dates>
 <discovery>2016-01-28</discovery>
 <entry>2016-01-28</entry>
 </dates>
 </vuln>

<vuln vid="6f0c2d1b-c60b-11e5-bf36-6805ca0b3d42">
 <topic>phpmyadmin -- Insecure password generation in JavaScript</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-4/">
	 Password suggestion functionality uses Math.random()
	 which does not provide cryptographically secure random
	 numbers.
	 We consider this vulnerability to be non-critical.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-4/</url>
 <cvename>CVE-2016-1927</cvename>
 </references>
 <dates>
 <discovery>2016-01-28</discovery>
 <entry>2016-01-28</entry>
 </dates>
 </vuln>

<vuln vid="6cc06eec-c60b-11e5-bf36-6805ca0b3d42">
 <topic>phpmyadmin -- Multiple XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-3/">
	 <ul>
	 <li>With a crafted table name it is possible to trigger
	 an XSS attack in the database search page.</li>
	 <li>With a crafted SET value or a crafted search query, it
	 is possible to trigger an XSS attacks in the zoom search
	 page.</li>
	 <li>With a crafted hostname header, it is possible to
	 trigger an XSS attacks in the home page.</li>
	 </ul>
	 We consider these vulnerabilities to be non-critical.
	 These vulnerabilities can be triggered only by someone
	 who is logged in to phpMyAdmin, as the usual token
	 protection prevents non-logged-in users from accessing the
	 required pages.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-3/</url>
 <cvename>CVE-2016-2040</cvename>
 </references>
 <dates>
 <discovery>2016-01-28</discovery>
 <entry>2016-01-28</entry>
 </dates>
 </vuln>

<vuln vid="60ab0e93-c60b-11e5-bf36-6805ca0b3d42">
 <topic>phpmyadmin -- Unsafe generation of XSRF/CSRF token</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-2/">
	 The XSRF/CSRF token is generated with a weak algorithm
	 using functions that do not return cryptographically secure
	 values.
	 We consider this vulnerability to be non-critical.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-2/</url>
 <cvename>CVE-2016-2039</cvename>
 </references>
 <dates>
 <discovery>2016-01-28</discovery>
 <entry>2016-01-28</entry>
 </dates>
 </vuln>

<vuln vid="5d6a204f-c60b-11e5-bf36-6805ca0b3d42">
 <topic>phpmyadmin -- Multiple full path disclosure vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-1/">
	 By calling some scripts that are part of phpMyAdmin in an
	 unexpected way, it is possible to trigger phpMyAdmin to
	 display a PHP error message which contains the full path of
	 the directory where phpMyAdmin is installed.
	 We consider these vulnerabilities to be non-critical.
	 This path disclosure is possible on servers where the
	 recommended setting of the PHP configuration directive
	 display_errors is set to on, which is against the
	 recommendations given in the PHP manual for a production
	 server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2016-1/</url>
 <cvename>CVE-2016-2038</cvename>
 </references>
 <dates>
 <discovery>2016-01-28</discovery>
 <entry>2016-01-28</entry>
 </dates>
 </vuln>

<vuln vid="50394bc9-c5fa-11e5-96a5-d93b343d1ff7">
 <topic>prosody -- user impersonation vulnerability</topic>
 <affects>
 <package>
	<name>prosody</name>
	<range><lt>0.9.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Prosody team reports:
 <blockquote cite="https://prosody.im/security/advisory_20160127/">
	 Adopt key generation algorithm from XEP-0185, to
	 prevent impersonation attacks (CVE-2016-0756)
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/206707</freebsdpr>
 <cvename>CVE-2016-0756</cvename>
 <url>https://prosody.im/security/advisory_20160127/</url>
 </references>
 <dates>
 <discovery>2016-01-27</discovery>
 <entry>2016-01-28</entry>
 </dates>
 </vuln>

<vuln vid="3679fd10-c5d1-11e5-b85f-0018fe623f2b">
 <topic>openssl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2_7</lt></range>
 </package>
 <package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.2f</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_12</lt></range>
	<range><ge>10.1</ge><lt>10.1_29</lt></range>
	<range><ge>9.3</ge><lt>9.3_36</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20160128.txt">
	 <ol>
	 <li>Historically OpenSSL only ever generated DH parameters based on "safe"
	 primes. More recently (in version 1.0.2) support was provided for
	 generating X9.42 style parameter files such as those required for RFC 5114
	 support. The primes used in such files may not be "safe". Where an
	 application is using DH configured with parameters based on primes that are
	 not "safe" then an attacker could use this fact to find a peer's private
	 DH exponent. This attack requires that the attacker complete multiple
	 handshakes in which the peer uses the same private DH exponent. For example
	 this could be used to discover a TLS server's private DH exponent if it's
	 reusing the private DH exponent or it's using a static DH ciphersuite.
	 OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in
	 TLS. It is not on by default. If the option is not set then the server
	 reuses the same private DH exponent for the life of the server process and
	 would be vulnerable to this attack. It is believed that many popular
	 applications do set this option and would therefore not be at risk.
	 (CVE-2016-0701)</li>
	 <li>A malicious client can negotiate SSLv2 ciphers that have been disabled on
	 the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
	 been disabled, provided that the SSLv2 protocol was not also disabled via
	 SSL_OP_NO_SSLv2.
	 (CVE-2015-3197)</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-16:11.openssl</freebsdsa>
 <cvename>CVE-2016-0701</cvename>
 <cvename>CVE-2015-3197</cvename>
 <url>https://www.openssl.org/news/secadv/20160128.txt</url>
 </references>
 <dates>
 <discovery>2016-01-22</discovery>
 <entry>2016-01-28</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="8b27f1bc-c509-11e5-a95f-b499baebfeaf">
 <topic>curl -- Credentials not checked</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.10.0</ge><lt>7.47.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports:
	<blockquote cite="http://curl.haxx.se/docs/adv_20160127A.html">
	 libcurl will reuse NTLM-authenticated proxy connections
	 without properly making sure that the connection was
	 authenticated with the same credentials as set for this
	 transfer.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://curl.haxx.se/docs/adv_20160127A.html</url>
 <cvename>CVE-2016-0755</cvename>
 </references>
 <dates>
 <discovery>2016-01-27</discovery>
 <entry>2016-01-27</entry>
 <modified>2017-02-06</modified>
 </dates>
 </vuln>

<vuln vid="fb754341-c3e2-11e5-b5fe-002590263bf5">
 <topic>wordpress -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.4.1,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aaron Jorbin reports:
	<blockquote cite="https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release/">
	 WordPress 4.4.1 is now available. This is a security release for
	 all previous versions and we strongly encourage you to update your
	 sites immediately.
	 WordPress versions 4.4 and earlier are affected by a cross-site
	 scripting vulnerability that could allow a site to be compromised.
	 This was reported by Crtc4L.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1564</cvename>
 <url>http://www.openwall.com/lists/oss-security/2016/01/08/3</url>
 <url>https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release/</url>
 </references>
 <dates>
 <discovery>2016-01-06</discovery>
 <entry>2016-01-26</entry>
 <modified>2016-03-08</modified>
 </dates>
 </vuln>

<vuln vid="a763a0e7-c3d9-11e5-b5fe-002590263bf5">
 <topic>privoxy -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>privoxy</name>
	<range><lt>3.0.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Privoxy Developers reports:
	<blockquote cite="http://www.privoxy.org/3.0.24/user-manual/whatsnew.html">
	 Prevent invalid reads in case of corrupt chunk-encoded content.
	 CVE-2016-1982. Bug discovered with afl-fuzz and AddressSanitizer.
	 
	 Remove empty Host headers in client requests. Previously they
	 would result in invalid reads. CVE-2016-1983. Bug discovered with
	 afl-fuzz and AddressSanitizer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1982</cvename>
 <cvename>CVE-2016-1983</cvename>
 <freebsdpr>ports/206504</freebsdpr>
 <url>http://www.privoxy.org/3.0.24/user-manual/whatsnew.html</url>
 <url>http://www.openwall.com/lists/oss-security/2016/01/21/4</url>
 </references>
 <dates>
 <discovery>2016-01-22</discovery>
 <entry>2016-01-26</entry>
 </dates>
 </vuln>

<vuln vid="d9e1b569-c3d8-11e5-b5fe-002590263bf5">
 <topic>privoxy -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>privoxy</name>
	<range><lt>3.0.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Privoxy Developers reports:
	<blockquote cite="http://www.privoxy.org/3.0.23/user-manual/whatsnew.html">
	 Fixed a DoS issue in case of client requests with incorrect
	 chunk-encoded body. When compiled with assertions enabled (the
	 default) they could previously cause Privoxy to abort(). Reported
	 by Matthew Daley. CVE-2015-1380.
	 Fixed multiple segmentation faults and memory leaks in the pcrs
	 code. This fix also increases the chances that an invalid pcrs
	 command is rejected as such. Previously some invalid commands would
	 be loaded without error. Note that Privoxy's pcrs sources (action
	 and filter files) are considered trustworthy input and should not be
	 writable by untrusted third-parties. CVE-2015-1381.
	 Fixed an 'invalid read' bug which could at least theoretically
	 cause Privoxy to crash. So far, no crashes have been observed.
	 CVE-2015-1382.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1380</cvename>
 <cvename>CVE-2015-1381</cvename>
 <cvename>CVE-2015-1382</cvename>
 <freebsdpr>ports/197089</freebsdpr>
 <url>http://www.privoxy.org/3.0.23/user-manual/whatsnew.html</url>
 <url>http://www.openwall.com/lists/oss-security/2015/01/26/4</url>
 </references>
 <dates>
 <discovery>2015-01-26</discovery>
 <entry>2016-01-26</entry>
 </dates>
 </vuln>

<vuln vid="89d4ed09-c3d7-11e5-b5fe-002590263bf5">
 <topic>privoxy -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>privoxy</name>
	<range><lt>3.0.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Privoxy Developers reports:
	<blockquote cite="http://www.privoxy.org/3.0.22/user-manual/whatsnew.html">
	 Fixed a memory leak when rejecting client connections due to the
	 socket limit being reached (CID 66382). This affected Privoxy 3.0.21
	 when compiled with IPv6 support (on most platforms this is the
	 default).
	 Fixed an immediate-use-after-free bug (CID 66394) and two
	 additional unconfirmed use-after-free complaints made by Coverity
	 scan (CID 66391, CID 66376).
	</blockquote>
	MITRE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1201">
	 Privoxy before 3.0.22 allows remote attackers to cause a denial
	 of service (file descriptor consumption) via unspecified vectors.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1030</cvename>
 <cvename>CVE-2015-1031</cvename>
 <cvename>CVE-2015-1201</cvename>
 <freebsdpr>ports/195468</freebsdpr>
 <url>http://www.privoxy.org/3.0.22/user-manual/whatsnew.html</url>
 <url>http://www.openwall.com/lists/oss-security/2015/01/11/1</url>
 </references>
 <dates>
 <discovery>2015-01-10</discovery>
 <entry>2016-01-26</entry>
 </dates>
 </vuln>

<vuln vid="ad82b0e9-c3d6-11e5-b5fe-002590263bf5">
 <topic>privoxy -- malicious server spoofing as proxy vulnerability</topic>
 <affects>
 <package>
	<name>privoxy</name>
	<range><lt>3.0.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Privoxy Developers reports:
	<blockquote cite="http://www.privoxy.org/3.0.21/user-manual/whatsnew.html">
	 Proxy authentication headers are removed unless the new directive
	 enable-proxy-authentication-forwarding is used. Forwarding the
	 headers potentially allows malicious sites to trick the user into
	 providing them with login information. Reported by Chris John Riley.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2503</cvename>
 <freebsdpr>ports/176813</freebsdpr>
 <url>http://www.privoxy.org/3.0.21/user-manual/whatsnew.html</url>
 </references>
 <dates>
 <discovery>2013-03-07</discovery>
 <entry>2016-01-26</entry>
 </dates>
 </vuln>

<vuln vid="2e8cdd36-c3cc-11e5-b5fe-002590263bf5">
 <topic>sudo -- potential privilege escalation via symlink misconfiguration</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><lt>1.8.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5602">
	 sudoedit in Sudo before 1.8.15 allows local users to gain
	 privileges via a symlink attack on a file whose full path is defined
	 using multiple wildcards in /etc/sudoers, as demonstrated by
	 "/home/*/*/file.txt."
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5602</cvename>
 <freebsdpr>ports/206590</freebsdpr>
 <url>https://www.exploit-db.com/exploits/37710/</url>
 <url>https://bugzilla.sudo.ws/show_bug.cgi?id=707</url>
 <url>http://www.sudo.ws/stable.html#1.8.15</url>
 </references>
 <dates>
 <discovery>2015-11-17</discovery>
 <entry>2016-01-26</entry>
 </dates>
 </vuln>

<vuln vid="99d3a8a5-c13c-11e5-96d6-14dae9d210b8">
 <topic>imlib2 -- denial of service vulnerabilities</topic>
 <affects>
 <package>
	<name>imlib2</name>
	<range><lt>1.4.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Enlightenment reports:
	<blockquote cite="https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog">
	 GIF loader: Fix segv on images without colormap
	 Prevent division-by-zero crashes.
	 Fix segfault when opening input/queue/id:000007,src:000000,op:flip1,pos:51 with feh
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog</url>
 <url>http://seclists.org/oss-sec/2016/q1/162</url>
 <cvename>CVE-2014-9762</cvename>
 <cvename>CVE-2014-9763</cvename>
 <cvename>CVE-2014-9764</cvename>
 </references>
 <dates>
 <discovery>2013-12-21</discovery>
 <entry>2016-01-22</entry>
 </dates>
 </vuln>

<vuln vid="b4578647-c12b-11e5-96d6-14dae9d210b8">
 <topic>bind -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><lt>9.9.8P3</lt></range>
 </package>
 <package>
	<name>bind910</name>
	<range><lt>9.10.3P3</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_35</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01335">
	 Specific APL data could trigger an INSIST in apl_42.c
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://kb.isc.org/article/AA-01335</url>
 <cvename>CVE-2015-8704</cvename>
 <freebsdsa>SA-16:08.bind</freebsdsa>
 </references>
 <dates>
 <discovery>2016-01-19</discovery>
 <entry>2016-01-22</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="371bbea9-3836-4832-9e70-e8e928727f8c">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>48.0.2564.82</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.de/2016/01/stable-channel-update_20.html">
	 This update includes 37 security fixes, including:
	 <ul>
	 <li>[497632] High CVE-2016-1612: Bad cast in V8.</li>
	 <li>[572871] High CVE-2016-1613: Use-after-free in PDFium.</li>
	 <li>[544691] Medium CVE-2016-1614: Information leak in Blink.</li>
	 <li>[468179] Medium CVE-2016-1615: Origin confusion in Omnibox.</li>
	 <li>[541415] Medium CVE-2016-1616: URL Spoofing.</li>
	 <li>[544765] Medium CVE-2016-1617: History sniffing with HSTS and
	 CSP.</li>
	 <li>[552749] Medium CVE-2016-1618: Weak random number generator in
	 Blink.</li>
	 <li>[557223] Medium CVE-2016-1619: Out-of-bounds read in
	 PDFium.</li>
	 <li>[579625] CVE-2016-1620: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 <li>Multiple vulnerabilities in V8 fixed at the tip of the 4.8
	 branch.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1612</cvename>
 <cvename>CVE-2016-1613</cvename>
 <cvename>CVE-2016-1614</cvename>
 <cvename>CVE-2016-1615</cvename>
 <cvename>CVE-2016-1616</cvename>
 <cvename>CVE-2016-1617</cvename>
 <cvename>CVE-2016-1618</cvename>
 <cvename>CVE-2016-1619</cvename>
 <cvename>CVE-2016-1620</cvename>
 <url>http://googlechromereleases.blogspot.de/2016/01/stable-channel-update_20.html</url>
 </references>
 <dates>
 <discovery>2016-01-20</discovery>
 <entry>2016-01-21</entry>
 </dates>
 </vuln>

<vuln vid="5237f5d7-c020-11e5-b397-d050996490d0">
 <topic>ntp -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ntp</name>
	<range><lt>4.2.8p6</lt></range>
 </package>
 <package>
	<name>ntp-devel</name>
	<range><lt>4.3.90</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_11</lt></range>
	<range><ge>10.1</ge><lt>10.1_28</lt></range>
	<range><ge>9.3</ge><lt>9.3_35</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Network Time Foundation reports:
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit">
	 NTF's NTP Project has been notified of the following low-
	 and medium-severity vulnerabilities that are fixed in
	 ntp-4.2.8p6, released on Tuesday, 19 January 2016:
	 <ul>
	 <li>Bug 2948 / CVE-2015-8158: Potential Infinite Loop
	 in ntpq. Reported by Cisco ASIG.</li>
	 <li>Bug 2945 / CVE-2015-8138: origin: Zero Origin
	 Timestamp Bypass. Reported by Cisco ASIG.</li>
	 <li>Bug 2942 / CVE-2015-7979: Off-path Denial of
	 Service (DoS) attack on authenticated broadcast
	 mode. Reported by Cisco ASIG.</li>
	 <li>Bug 2940 / CVE-2015-7978: Stack exhaustion in
	 recursive traversal of restriction list.
	 Reported by Cisco ASIG.</li>
	 <li>Bug 2939 / CVE-2015-7977: reslist NULL pointer
	 dereference. Reported by Cisco ASIG.</li>
	 <li>Bug 2938 / CVE-2015-7976: ntpq saveconfig command
	 allows dangerous characters in filenames.
	 Reported by Cisco ASIG.</li>
	 <li>Bug 2937 / CVE-2015-7975: nextvar() missing length
	 check. Reported by Cisco ASIG.</li>
	 <li>Bug 2936 / CVE-2015-7974: Skeleton Key: Missing
	 key check allows impersonation between authenticated
	 peers. Reported by Cisco ASIG.</li>
	 <li>Bug 2935 / CVE-2015-7973: Deja Vu: Replay attack on
	 authenticated broadcast mode. Reported by Cisco ASIG.</li>
	 </ul>
	 Additionally, mitigations are published for the following
	 two issues:
	 <ul>
	 <li>Bug 2947 / CVE-2015-8140: ntpq vulnerable to replay
	 attacks. Reported by Cisco ASIG.</li>
	 <li>Bug 2946 / CVE-2015-8139: Origin Leak: ntpq and ntpdc,
	 disclose origin. Reported by Cisco ASIG.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-16:09.ntp</freebsdsa>
 <cvename>CVE-2015-7973</cvename>
 <cvename>CVE-2015-7974</cvename>
 <cvename>CVE-2015-7975</cvename>
 <cvename>CVE-2015-7976</cvename>
 <cvename>CVE-2015-7977</cvename>
 <cvename>CVE-2015-7978</cvename>
 <cvename>CVE-2015-7979</cvename>
 <cvename>CVE-2015-8138</cvename>
 <cvename>CVE-2015-8139</cvename>
 <cvename>CVE-2015-8140</cvename>
 <cvename>CVE-2015-8158</cvename>
 <url>http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit</url>
 </references>
 <dates>
 <discovery>2016-01-20</discovery>
 <entry>2016-01-21</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="62c0dbbd-bfce-11e5-b5fe-002590263bf5">
 <topic>cgit -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cgit</name>
	<range><lt>0.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jason A. Donenfeld reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/14/6">
	 Reflected Cross Site Scripting and Header Injection in Mimetype
	 Query String.
	 Stored Cross Site Scripting and Header Injection in Filename
	 Parameter.
	 Integer Overflow resulting in Buffer Overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1899</cvename>
 <cvename>CVE-2016-1900</cvename>
 <cvename>CVE-2016-1901</cvename>
 <freebsdpr>ports/206417</freebsdpr>
 <url>http://lists.zx2c4.com/pipermail/cgit/2016-January/002817.html</url>
 <url>http://www.openwall.com/lists/oss-security/2016/01/14/6</url>
 </references>
 <dates>
 <discovery>2016-01-14</discovery>
 <entry>2016-01-20</entry>
 </dates>
 </vuln>

<vuln vid="314830d8-bf91-11e5-96d6-14dae9d210b8">
 <topic>bind -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>bind910</name>
	<range><lt>9.10.3P3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01336">
	 Problems converting OPT resource records and ECS options to
	 text format can cause BIND to terminate
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://kb.isc.org/article/AA-01336</url>
 <cvename>CVE-2015-8705</cvename>
 </references>
 <dates>
 <discovery>2016-01-19</discovery>
 <entry>2016-01-20</entry>
 <modified>2016-01-22</modified>
 </dates>
 </vuln>

<vuln vid="51358314-bec8-11e5-82cd-bcaec524bf84">
 <topic>claws-mail -- no bounds checking on the output buffer in conv_jistoeuc, conv_euctojis, conv_sjistoeuc</topic>
 <affects>
 <package>
	<name>claws-mail</name>
	<range><lt>3.13.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	DrWhax reports:
	<blockquote cite="http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3557">
	 So in codeconv.c there is a function for Japanese character set
	 conversion called conv_jistoeuc(). There is no bounds checking on
	 the output buffer, which is created on the stack with alloca()
	 Bug can be triggered by sending an email to TAILS_luser@riseup.net
	 or whatever.

Since my C is completely rusty, you might be able to make a better
	 judgment on the severity of this issue. Marking critical for now.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8614</cvename>
 <url>https://security-tracker.debian.org/tracker/CVE-2015-8614</url>
 </references>
 <dates>
 <discovery>2015-11-04</discovery>
 <entry>2016-01-19</entry>
 </dates>
 </vuln>

<vuln vid="7c63775e-be31-11e5-b5fe-002590263bf5">
 <topic>libarchive -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libarchive</name>
	<range><lt>3.1.2_5,1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.3</ge><lt>10.3_4</lt></range>
	<range><ge>10.2</ge><lt>10.2_18</lt></range>
	<range><ge>10.1</ge><lt>10.1_35</lt></range>
	<range><ge>9.3</ge><lt>9.3_43</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0211">
	 Integer signedness error in the archive_write_zip_data function in
	 archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when
	 running on 64-bit machines, allows context-dependent attackers to
	 cause a denial of service (crash) via unspecified vectors, which
	 triggers an improper conversion between unsigned and signed types,
	 leading to a buffer overflow.
	</blockquote>
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2304">
	 Absolute path traversal vulnerability in bsdcpio in libarchive
	 3.1.2 and earlier allows remote attackers to write to arbitrary
	 files via a full pathname in an archive.
	</blockquote>
	Libarchive issue tracker reports:
	<blockquote cite="https://github.com/libarchive/libarchive/issues/502">
	 Using a crafted tar file bsdtar can perform an out-of-bounds memory
	 read which will lead to a SEGFAULT. The issue exists when the
	 executable skips data in the archive. The amount of data to skip is
	 defined in byte offset [16-19] If ASLR is disabled, the issue can
	 lead to an infinite loop.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0211</cvename>
 <cvename>CVE-2015-2304</cvename>
 <freebsdpr>ports/200176</freebsdpr>
 <freebsdsa>SA-16:22.libarchive</freebsdsa>
 <freebsdsa>SA-16:23.libarchive</freebsdsa>
 <url>https://github.com/libarchive/libarchive/pull/110</url>
 <url>https://github.com/libarchive/libarchive/commit/5935715</url>
 <url>https://github.com/libarchive/libarchive/commit/2253154</url>
 <url>https://github.com/libarchive/libarchive/issues/502</url>
 <url>https://github.com/libarchive/libarchive/commit/3865cf2</url>
 <url>https://github.com/libarchive/libarchive/commit/e6c9668</url>
 <url>https://github.com/libarchive/libarchive/commit/24f5de6</url>
 </references>
 <dates>
 <discovery>2012-12-06</discovery>
 <entry>2016-01-18</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="6809c6db-bdeb-11e5-b5fe-002590263bf5">
 <topic>go -- information disclosure vulnerability</topic>
 <affects>
 <package>
	<name>go</name>
	<range><ge>1.5,1</ge><lt>1.5.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jason Buberel reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/13/7">
	 A security-related issue has been reported in Go's math/big
	 package. The issue was introduced in Go 1.5. We recommend that all
	 users upgrade to Go 1.5.3, which fixes the issue. Go programs must
	 be recompiled with Go 1.5.3 in order to receive the fix.
	 The Go team would like to thank Nick Craig-Wood for identifying the
	 issue.
	 This issue can affect RSA computations in crypto/rsa, which is used
	 by crypto/tls. TLS servers on 32-bit systems could plausibly leak
	 their RSA private key due to this issue. Other protocol
	 implementations that create many RSA signatures could also be
	 impacted in the same way.
	 Specifically, incorrect results in one part of the RSA Chinese
	 Remainder computation can cause the result to be incorrect in such a
	 way that it leaks one of the primes. While RSA blinding should
	 prevent an attacker from crafting specific inputs that trigger the
	 bug, on 32-bit systems the bug can be expected to occur at random
	 around one in 2^26 times. Thus collecting around 64 million
	 signatures (of known data) from an affected server should be enough
	 to extract the private key used.
	 On 64-bit systems, the frequency of the bug is so low (less than
	 one in 2^50) that it would be very difficult to exploit.
	 Nonetheless, everyone is strongly encouraged to upgrade.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8618</cvename>
 <url>http://www.openwall.com/lists/oss-security/2016/01/13/7</url>
 <url>https://go-review.googlesource.com/#/c/17672/</url>
 <url>https://go-review.googlesource.com/#/c/18491/</url>
 </references>
 <dates>
 <discovery>2016-01-13</discovery>
 <entry>2016-01-18</entry>
 </dates>
 </vuln>

<vuln vid="05eeb7e9-b987-11e5-83ef-14dae9d210b8">
 <topic>isc-dhcpd -- Denial of Service</topic>
 <affects>
 <package>
	<name>isc-dhcp41-server</name>
	<range><lt>4.1.e_10,2</lt></range>
 </package>
 <package>
	<name>isc-dhcp41-client</name>
	<range><lt>4.1.e_3,2</lt></range>
 </package>
 <package>
	<name>isc-dhcp41-relay</name>
	<range><lt>4.1.e_6,2</lt></range>
 </package>
 <package>
	<name>isc-dhcp42-client</name>
	<name>isc-dhcp42-server</name>
	<name>isc-dhcp42-relay</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>isc-dhcp43-client</name>
	<name>isc-dhcp43-server</name>
	<name>isc-dhcp43-relay</name>
	<range><lt>4.3.3.p1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01334">
	 A badly formed packet with an invalid IPv4 UDP length field
	 can cause a DHCP server, client, or relay program to terminate
	 abnormally.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://kb.isc.org/article/AA-01334</url>
 <cvename>CVE-2015-8605</cvename>
 </references>
 <dates>
 <discovery>2016-01-05</discovery>
 <entry>2016-01-12</entry>
 </dates>
 </vuln>

<vuln vid="3b5c2362-bd07-11e5-b7ef-5453ed2e2b49">
 <topic>libproxy -- stack-based buffer overflow</topic>
 <affects>
 
 <package>
	<name>libproxy</name>
	<range><ge>0.4.0</ge><lt>0.4.6_1</lt></range>
 </package>
 <package>
	<name>libproxy-gnome</name>
	<range><ge>0.4.0</ge><lt>0.4.6_2</lt></range>
 </package>
 <package>
	<name>libproxy-kde</name>
	<range><ge>0.4.0</ge><lt>0.4.6_6</lt></range>
 </package>
 <package>
	<name>libproxy-perl</name>
	<range><ge>0.4.0</ge><lt>0.4.6_3</lt></range>
 </package>
 <package>
	<name>libproxy-webkit</name>
	<range><ge>0.4.0</ge><lt>0.4.6_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tomas Hoger reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=864417#c0">
	 A buffer overflow flaw was discovered in the libproxy's
	 url::get_pac() used to download proxy.pac proxy auto-configuration
	 file. A malicious host hosting proxy.pac, or a man in the middle
	 attacker, could use this flaw to trigger a stack-based buffer
	 overflow in an application using libproxy, if proxy configuration
	 instructed it to download proxy.pac file from a remote HTTP
	 server.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4504</cvename>
 <url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4504</url>
 <mlist>http://www.openwall.com/lists/oss-security/2012/10/12/1</mlist>
 <url>https://github.com/libproxy/libproxy/commit/c440553c12836664afd24a24fb3a4d10a2facd2c</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=864417</url>
 <mlist>https://groups.google.com/forum/?fromgroups=#!topic/libproxy/VxZ8No7mT0E</mlist>
 </references>
 <dates>
 <discovery>2012-10-10</discovery>
 <entry>2016-01-17</entry>
 <modified>2016-01-18</modified>
 </dates>
 </vuln>

<vuln vid="046fedd1-bd01-11e5-bbf4-5404a68ad561">
 <topic>ffmpeg -- remote attacker can access local files</topic>
 <affects>
 <package>
	<name>ffmpeg</name>
	<range>
	 <gt>2.0,1</gt>
	 <lt>2.8.5,1</lt>
	</range>
 </package>
 <package>
	<name>mplayer</name>
	<name>mencoder</name>
	<range>
	 <lt>1.2.r20151219_2</lt>
	</range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Arch Linux reports:
	<blockquote cite="https://bugs.archlinux.org/task/47738">
	 ffmpeg has a vulnerability in the current version that allows the
	 attacker to create a specially crafted video file, downloading which
	 will send files from a user PC to a remote attacker server. The
	 attack does not even require the user to open that file — for
	 example, KDE Dolphin thumbnail generation is enough.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1897</cvename>
 <cvename>CVE-2016-1898</cvename>
 <freebsdpr>ports/206282</freebsdpr>
 <url>https://www.ffmpeg.org/security.html</url>
 </references>
 <dates>
 <discovery>2016-01-13</discovery>
 <entry>2016-01-17</entry>
 </dates>
 </vuln>

<vuln vid="6c808811-bb9a-11e5-a65c-485d605f4717">
 <topic>h2o -- directory traversal vulnerability</topic>
 <affects>
 <package>
	<name>h2o</name>
	<range><lt>1.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Yakuzo OKU reports:
	<blockquote cite="http://h2o.examp1e.net/vulnerabilities.html">
	 When redirect directive is used, this flaw allows a remote
	 attacker to inject response headers into an HTTP redirect response.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1133</cvename>
 <url>https://h2o.examp1e.net/vulnerabilities.html</url>
 </references>
 <dates>
 <discovery>2016-01-13</discovery>
 <entry>2016-01-15</entry>
 </dates>
 </vuln>

<vuln vid="dfe0cdc1-baf2-11e5-863a-b499baebfeaf">
 <topic>openssh -- information disclosure</topic>
 <affects>
 <package>
	<name>openssh-portable</name>
	<range>
	 <gt>5.4.p0,1</gt>
	 <lt>7.1.p2,1</lt>
	</range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_10</lt></range>
	<range><ge>10.1</ge><lt>10.1_27</lt></range>
	<range><ge>9.3</ge><lt>9.3_34</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSH reports:
	<blockquote cite="http://www.openssh.com/security.html">
	 OpenSSH clients between versions 5.4 and 7.1 are vulnerable to
	 information disclosure that may allow a malicious server to retrieve
	 information including under some circumstances, user's private keys.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openssh.com/security.html</url>
 <cvename>CVE-2016-0777</cvename>
 <cvename>CVE-2016-0778</cvename>
 <freebsdsa>SA-16:07</freebsdsa>
 </references>
 <dates>
 <discovery>2016-01-14</discovery>
 <entry>2016-01-14</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="842cd117-ba54-11e5-9728-002590263bf5">
 <topic>prosody -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>prosody</name>
	<range><lt>0.9.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Prosody Team reports:
	<blockquote cite="http://blog.prosody.im/prosody-0-9-9-security-release/">
	 Fix path traversal vulnerability in mod_http_files
	 (CVE-2016-1231)
	 Fix use of weak PRNG in generation of dialback secrets
	 (CVE-2016-1232)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1231</cvename>
 <cvename>CVE-2016-1232</cvename>
 <freebsdpr>ports/206150</freebsdpr>
 <url>http://blog.prosody.im/prosody-0-9-9-security-release/</url>
 </references>
 <dates>
 <discovery>2016-01-08</discovery>
 <entry>2016-01-14</entry>
 </dates>
 </vuln>

<vuln vid="a7a4e96c-ba50-11e5-9728-002590263bf5">
 <topic>kibana4 -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>kibana4</name>
	<name>kibana41</name>
	<range><lt>4.1.4</lt></range>
 </package>
 <package>
	<name>kibana42</name>
	<range><lt>4.2.2</lt></range>
 </package>
 <package>
	<name>kibana43</name>
	<range><lt>4.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Elastic reports:
	<blockquote cite="https://www.elastic.co/blog/kibana-4-3-1-and-4-2-2-and-4-1-4">
	 Fixes XSS vulnerability (CVE pending) - Thanks to Vladimir Ivanov
	 for responsibly reporting.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/205961</freebsdpr>
 <freebsdpr>ports/205962</freebsdpr>
 <freebsdpr>ports/205963</freebsdpr>
 <url>https://www.elastic.co/blog/kibana-4-3-1-and-4-2-2-and-4-1-4</url>
 </references>
 <dates>
 <discovery>2015-12-17</discovery>
 <entry>2016-01-13</entry>
 </dates>
 </vuln>

<vuln vid="333f655a-b93a-11e5-9efa-5453ed2e2b49">
 <topic>p5-PathTools -- File::Spec::canonpath loses taint</topic>
 <affects>
 <package>
	<name>p5-PathTools</name>
	<range>
	 <gt>3.4000</gt>
	 <lt>3.6200</lt>
	</range>
 </package>
 <package>
	<name>perl5</name>
	<name>perl5.20</name>
	<name>perl5.22</name>
	<name>perl5-devel</name>
	<range><ge>5.19.9</ge><lt>5.20.2</lt></range>
	<range><ge>5.21.0</ge><lt>5.22.2</lt></range>
	<range><ge>5.23.0</ge><lt>5.23.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ricardo Signes reports:
	<blockquote>
	 Beginning in PathTools 3.47 and/or perl 5.20.0, the
	 File::Spec::canonpath() routine returned untained strings even if
	 passed tainted input. This defect undermines the guarantee of taint
	 propagation, which is sometimes used to ensure that unvalidated
	 user input does not reach sensitive code.
	 This defect was found and reported by David Golden of MongoDB.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8607</cvename>
 <url>https://rt.perl.org/Public/Bug/Display.html?id=126862</url>
 </references>
 <dates>
 <discovery>2016-01-11</discovery>
 <entry>2016-01-12</entry>
 <modified>2016-08-22</modified>
 </dates>
 </vuln>

<vuln vid="6b771fe2-b84e-11e5-92f9-485d605f4717">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php55</name>
	<name>php55-gd</name>
	<name>php55-wddx</name>
	<name>php55-xmlrpc</name>
	<range><lt>5.5.31</lt></range>
 </package>
 <package>
	<name>php56</name>
	<name>php56-gd</name>
	<name>php56-soap</name>
	<name>php56-wddx</name>
	<name>php56-xmlrpc</name>
	<range><lt>5.6.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP reports:
	<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.31">
	 <ul><li>Core:
	 <ul>
	 <li>Fixed bug #70755 (fpm_log.c memory leak and buffer overflow).</li>
	 </ul></li>
	 <li>GD:
	 <ul>
	 <li>Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array
	 Index Out of Bounds).</li>
	 </ul></li>
	 <li>SOAP:
	 <ul>
	 <li>Fixed bug #70900 (SoapClient systematic out of memory error).</li>
	 </ul></li>
	 <li>Wddx
	 <ul>
	 <li>Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet
	 Deserialization).</li>
	 <li>Fixed bug #70741 (Session WDDX Packet Deserialization Type
	 Confusion Vulnerability).</li>
	 </ul></li>
	 <li>XMLRPC:
	 <ul>
	 <li>Fixed bug #70728 (Type Confusion Vulnerability in
	 PHP_to_XMLRPC_worker()).</li>
	 </ul></li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.php.net/ChangeLog-5.php#5.5.31</url>
 <url>http://www.php.net/ChangeLog-5.php#5.6.17</url>
 </references>
 <dates>
 <discovery>2016-01-07</discovery>
 <entry>2016-01-11</entry>
 </dates>
 </vuln>

<vuln vid="5f276780-b6ce-11e5-9731-5453ed2e2b49">
 <topic>pygments -- shell injection vulnerability</topic>
 <affects>
 <package>
	<name>py27-pygments</name>
	<name>py32-pygments</name>
	<name>py33-pygments</name>
	<name>py34-pygments</name>
	<name>py35-pygments</name>
	<range><lt>2.0.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8557">
	 The FontManager._get_nix_font_path function in formatters/img.py
	 in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute
	 arbitrary commands via shell metacharacters in a font name.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8557</cvename>
 <mlist>http://seclists.org/fulldisclosure/2015/Oct/4</mlist>
 <url>https://bitbucket.org/birkenfeld/pygments-main/commits/0036ab1c99e256298094505e5e92fdacdfc5b0a8</url>
 </references>
 <dates>
 <discovery>2015-09-28</discovery>
 <entry>2016-01-09</entry>
 </dates>
 </vuln>

<vuln vid="631fc042-b636-11e5-83ef-14dae9d210b8">
 <topic>polkit -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>polkit</name>
	<range><lt>0.113</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Colin Walters reports:
	<blockquote cite="http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html">
	 <ul>
	 <li>Integer overflow in the
	 authentication_agent_new_cookie function in PolicyKit (aka polkit)
	 before 0.113 allows local users to gain privileges by creating a large
	 number of connections, which triggers the issuance of a duplicate cookie
	 value.</li>
	 <li>The authentication_agent_new function in
	 polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka
	 polkit) before 0.113 allows local users to cause a denial of service
	 (NULL pointer dereference and polkitd daemon crash) by calling
	 RegisterAuthenticationAgent with an invalid object path.</li>
	 <li>The polkit_backend_action_pool_init function in
	 polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before
	 0.113 might allow local users to gain privileges via duplicate action
	 IDs in action descriptions.</li>
	 <li>PolicyKit (aka polkit) before 0.113 allows local
	 users to cause a denial of service (memory corruption and polkitd daemon
	 crash) and possibly gain privileges via unspecified vectors, related to
	 "javascript rule evaluation."</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html</url>
 <cvename>CVE-2015-4625</cvename>
 <cvename>CVE-2015-3218</cvename>
 <cvename>CVE-2015-3255</cvename>
 <cvename>CVE-2015-3256</cvename>
 </references>
 <dates>
 <discovery>2015-06-03</discovery>
 <entry>2016-01-08</entry>
 </dates>
 </vuln>

<vuln vid="b22b016b-b633-11e5-83ef-14dae9d210b8">
 <topic>librsync -- collision vulnerability</topic>
 <affects>
 <package>
	<name>librsync</name>
	<range><lt>1.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michael Samuel reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2014/07/28/1">
	 librsync before 1.0.0 uses a truncated MD4 checksum to
	 match blocks, which makes it easier for remote attackers to modify
	 transmitted data via a birthday attack.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2014/07/28/1</url>
 <cvename>CVE-2014-8242</cvename>
 </references>
 <dates>
 <discovery>2014-07-28</discovery>
 <entry>2016-01-08</entry>
 </dates>
 </vuln>

<vuln vid="4eae4f46-b5ce-11e5-8a2b-d050996490d0">
 <topic>ntp -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>ntp</name>
	<range><lt>4.2.8p5</lt></range>
 </package>
 <package>
	<name>ntp-devel</name>
	<range><lt>4.3.78</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_9</lt></range>
	<range><ge>10.1</ge><lt>10.1_26</lt></range>
	<range><ge>9.3</ge><lt>9.3_33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Network Time Foundation reports:
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit">
	 NTF's NTP Project has been notified of the following
	 1 medium-severity vulnerability that is fixed in
	 ntp-4.2.8p5, released on Thursday, 7 January 2016:
	 NtpBug2956: Small-step/Big-step CVE-2015-5300
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-16:02.ntp</freebsdsa>
 <cvename>CVE-2015-5300</cvename>
 <url>https://www.cs.bu.edu/~goldbe/NTPattack.html</url>
 <url>http://support.ntp.org/bin/view/Main/NtpBug2956</url>
 <url>http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit</url>
 </references>
 <dates>
 <discovery>2015-10-21</discovery>
 <entry>2016-01-08</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="df587aa2-b5a5-11e5-9728-002590263bf5">
 <topic>dhcpcd -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dhcpcd</name>
	<range><lt>6.10.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nico Golde reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/07/3">
	 heap overflow via malformed dhcp responses later in print_option
	 (via dhcp_envoption1) due to incorrect option length values.
	 Exploitation is non-trivial, but I'd love to be proven wrong.
	 invalid read/crash via malformed dhcp responses. not exploitable
	 beyond DoS as far as I can judge.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2016-1503</cvename>
 <cvename>CVE-2016-1504</cvename>
 <freebsdpr>ports/206015</freebsdpr>
 <url>http://roy.marples.name/projects/dhcpcd/info/76a1609352263bd9def1300d7ba990679571fa30</url>
 <url>http://roy.marples.name/projects/dhcpcd/info/595883e2a431f65d8fabf33059aa4689cca17403</url>
 <url>http://www.openwall.com/lists/oss-security/2016/01/07/3</url>
 </references>
 <dates>
 <discovery>2016-01-04</discovery>
 <entry>2016-01-08</entry>
 </dates>
 </vuln>

<vuln vid="4084168e-b531-11e5-a98c-0011d823eebd">
 <topic>mbedTLS/PolarSSL -- SLOTH attack on TLS 1.2 server authentication</topic>
 <affects>
 <package>
	<name>polarssl13</name>
	<range><lt>1.3.16</lt></range>
 </package>
 <package>
	<name>mbedtls</name>
	<range><lt>2.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ARM Limited reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released">
	 MD5 handshake signatures in TLS 1.2 are vulnerable to the SLOTH attack
	 on TLS 1.2 server authentication. They have been disabled by default.
	 Other attacks from the SLOTH paper do not apply to any version of mbed
	 TLS or PolarSSL.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released</url>
 </references>
 <dates>
 <discovery>2016-01-04</discovery>
 <entry>2016-01-07</entry>
 </dates>
 </vuln>

<vuln vid="6aa2d135-b40e-11e5-9728-002590263bf5">
 <topic>xen-kernel -- ioreq handling possibly susceptible to multiple read issue</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.5.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-166.html">
	 Single memory accesses in source code can be translated to multiple
	 ones in machine code by the compiler, requiring special caution when
	 accessing shared memory. Such precaution was missing from the
	 hypervisor code inspecting the state of I/O requests sent to the
	 device model for assistance.
	 Due to the offending field being a bitfield, it is however believed
	 that there is no issue in practice, since compilers, at least when
	 optimizing (which is always the case for non-debug builds), should find
	 it more expensive to extract the bit field value twice than to keep the
	 calculated value in a register.
	 This vulnerability is exposed to malicious device models. In
	 conventional Xen systems this means the qemu which service an HVM
	 domain. On such systems this vulnerability can only be exploited if
	 the attacker has gained control of the device model qemu via another
	 vulnerability.
	 Privilege escalation, host crash (Denial of Service), and leaked
	 information all cannot be excluded.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/205841</freebsdpr>
 <url>http://xenbits.xen.org/xsa/advisory-166.html</url>
 </references>
 <dates>
 <discovery>2015-12-17</discovery>
 <entry>2016-01-06</entry>
 </dates>
 </vuln>

<vuln vid="e839ca04-b40d-11e5-9728-002590263bf5">
 <topic>xen-kernel -- information leak in legacy x86 FPU/XMM initialization</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.5.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-165.html">
	 When XSAVE/XRSTOR are not in use by Xen to manage guest extended
	 register state, the initial values in the FPU stack and XMM
	 registers seen by the guest upon first use are those left there by
	 the previous user of those registers.
	 A malicious domain may be able to leverage this to obtain sensitive
	 information such as cryptographic keys from another domain.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8555</cvename>
 <freebsdpr>ports/205841</freebsdpr>
 <url>http://xenbits.xen.org/xsa/advisory-165.html</url>
 </references>
 <dates>
 <discovery>2015-12-17</discovery>
 <entry>2016-01-06</entry>
 </dates>
 </vuln>

<vuln vid="5d1d4473-b40d-11e5-9728-002590263bf5">
 <topic>xen-tools -- libxl leak of pv kernel and initrd on error</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><ge>4.1</ge><lt>4.5.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-160.html">
	 When constructing a guest which is configured to use a PV
	 bootloader which runs as a userspace process in the toolstack domain
	 (e.g. pygrub) libxl creates a mapping of the files to be used as
	 kernel and initial ramdisk when building the guest domain.
	 However if building the domain subsequently fails these mappings
	 would not be released leading to a leak of virtual address space in
	 the calling process, as well as preventing the recovery of the
	 temporary disk files containing the kernel and initial ramdisk.
	 For toolstacks which manage multiple domains within the same
	 process, an attacker who is able to repeatedly start a suitable
	 domain (or many such domains) can cause an out-of-memory condition in the
	 toolstack process, leading to a denial of service.
	 Under the same circumstances an attacker can also cause files to
	 accumulate on the toolstack domain filesystem (usually under /var in
	 dom0) used to temporarily store the kernel and initial ramdisk,
	 perhaps leading to a denial of service against arbitrary other
	 services using that filesystem.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8341</cvename>
 <freebsdpr>ports/205841</freebsdpr>
 <url>http://xenbits.xen.org/xsa/advisory-160.html</url>
 </references>
 <dates>
 <discovery>2015-12-08</discovery>
 <entry>2016-01-06</entry>
 </dates>
 </vuln>

<vuln vid="bcad3faa-b40c-11e5-9728-002590263bf5">
 <topic>xen-kernel -- XENMEM_exchange error handling issues</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.5.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-159.html">
	 Error handling in the operation may involve handing back pages to
	 the domain. This operation may fail when in parallel the domain gets
	 torn down. So far this failure unconditionally resulted in the host
	 being brought down due to an internal error being assumed. This is
	 CVE-2015-8339.
	 Furthermore error handling so far wrongly included the release of a
	 lock. That lock, however, was either not acquired or already released
	 on all paths leading to the error handling sequence. This is
	 CVE-2015-8340.
	 A malicious guest administrator may be able to deny service by
	 crashing the host or causing a deadlock.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8339</cvename>
 <cvename>CVE-2015-8340</cvename>
 <freebsdpr>ports/205841</freebsdpr>
 <url>http://xenbits.xen.org/xsa/advisory-159.html</url>
 </references>
 <dates>
 <discovery>2015-12-08</discovery>
 <entry>2016-01-06</entry>
 </dates>
 </vuln>

<vuln vid="b65e4914-b3bc-11e5-8255-5453ed2e2b49">
 <topic>tiff -- out-of-bounds read in CIE Lab image format</topic>
 <affects>
 <package>
	<name>tiff</name>
	<range><lt>4.0.6_1</lt></range>
 </package>
 <package>
	<name>linux-c6-tiff</name>
	<range><lt>3.9.4_2</lt></range>
 </package>
 <package>
	<name>linux-f10-tiff</name>
	<range><ge>*</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	zzf of Alibaba discovered an out-of-bounds vulnerability in the code
	 processing the LogLUV and CIE Lab image format files. An attacker
	 could create a specially-crafted TIFF file that could cause libtiff
	 to crash.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8683</cvename>
 <mlist>http://www.openwall.com/lists/oss-security/2015/12/25/2</mlist>
 </references>
 <dates>
 <discovery>2015-12-25</discovery>
 <entry>2016-01-05</entry>
 <modified>2016-09-06</modified>
 </dates>
 </vuln>

<vuln vid="bd349f7a-b3b9-11e5-8255-5453ed2e2b49">
 <topic>tiff -- out-of-bounds read in tif_getimage.c</topic>
 <affects>
 <package>
	<name>tiff</name>
	<range><lt>4.0.6_1</lt></range>
 </package>
 <package>
	<name>linux-c6-tiff</name>
	<range><lt>3.9.4_2</lt></range>
 </package>
 <package>
	<name>linux-f10-tiff</name>
	<range><ge>*</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	LMX of Qihoo 360 Codesafe Team discovered an out-of-bounds read in
	 tif_getimage.c. An attacker could create a specially-crafted TIFF
	 file that could cause libtiff to crash.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8665</cvename>
 <mlist>http://www.openwall.com/lists/oss-security/2015/12/24/2</mlist>
 </references>
 <dates>
 <discovery>2015-12-24</discovery>
 <entry>2016-01-05</entry>
 <modified>2016-09-06</modified>
 </dates>
 </vuln>

<vuln vid="86c3c66e-b2f5-11e5-863a-b499baebfeaf">
 <topic>unzip -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>unzip</name>
	<range><lt>6.0_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gustavo Grieco reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/07/4">
	 Two issues were found in unzip 6.0:
	 * A heap overflow triggered by unzipping a file with password
	 (e.g unzip -p -P x sigsegv.zip).
	 * A denegation of service with a file that never finishes unzipping
	 (e.g. unzip sigxcpu.zip).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2015/09/07/4</url>
 <freebsdpr>ports/204413</freebsdpr>
 <cvename>CVE-2015-7696</cvename>
 <cvename>CVE-2015-7697</cvename>
 </references>
 <dates>
 <discovery>2015-09-26</discovery>
 <entry>2016-01-04</entry>
 </dates>
 </vuln>

<vuln vid="bb961ff3-b3a4-11e5-8255-5453ed2e2b49">
 <topic>cacti -- SQL injection vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><le>0.8.8f_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8369">
	 SQL injection vulnerability in include/top_graph_header.php in
	 Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary
	 SQL commands via the rra_id parameter in a properties action to
	 graph.php.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8369</cvename>
 <url>http://bugs.cacti.net/view.php?id=2646</url>
 <url>http://svn.cacti.net/viewvc?view=rev&amp;revision=7767</url>
 <mlist>http://seclists.org/fulldisclosure/2015/Dec/8</mlist>
 </references>
 <dates>
 <discovery>2015-12-05</discovery>
 <entry>2016-01-05</entry>
 </dates>
 </vuln>

<vuln vid="59e7eb28-b309-11e5-af83-80ee73b5dcf5">
 <topic>kea -- unexpected termination while handling a malformed packet</topic>
 <affects>
 <package>
	<name>kea</name>
	<range><ge>0.9.2</ge><lt>1.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC Support reports:
	<blockquote cite="https://kb.isc.org/article/AA-01318/0/CVE-2015-8373-ISC-Kea%3A-unexpected-termination-while-handling-a-malformed-packet.html">
	 ISC Kea may terminate unexpectedly (crash) while handling
	 a malformed client packet. Related defects in the kea-dhcp4
	 and kea-dhcp6 servers can cause the server to crash during
	 option processing if a client sends a malformed packet.
	 An attacker sending a crafted malformed packet can cause
	 an ISC Kea server providing DHCP services to IPv4 or IPv6
	 clients to exit unexpectedly.
	 <ul>
	 <li>The kea-dhcp4 server is vulnerable only in versions
		 0.9.2 and 1.0.0-beta, and furthermore only when logging
		 at debug level 40 or higher. Servers running kea-dhcp4
		 versions 0.9.1 or lower, and servers which are not
		 logging or are logging at debug level 39 or below are
		 not vulnerable.</li>
	 <li>The kea-dhcp6 server is vulnerable only in versions
		 0.9.2 and 1.0.0-beta, and furthermore only when
		 logging at debug level 45 or higher. Servers running
		 kea-dhcp6 versions 0.9.1 or lower, and servers
		 which are not logging or are logging at debug level 44
		 or below are not vulnerable.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8373</cvename>
 <url>https://kb.isc.org/article/AA-01318/0/CVE-2015-8373-ISC-Kea%3A-unexpected-termination-while-handling-a-malformed-packet.html</url>
 </references>
 <dates>
 <discovery>2015-12-15</discovery>
 <entry>2016-01-04</entry>
 <modified>2016-01-05</modified>
 </dates>
 </vuln>

<vuln vid="84dc49b0-b267-11e5-8a5b-00262d5ed8ee">
 <topic>mini_httpd -- buffer overflow via snprintf</topic>
 <affects>
 <package>
	<name>mini_httpd</name>
	<range><lt>1.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ACME Updates reports:
	<blockquote cite="https://cxsecurity.com/acveshow/CVE-2015-1548">
	 mini_httpd 1.21 and earlier allows remote attackers to obtain
	 sensitive information from process memory via an HTTP request with
	 a long protocol string, which triggers an incorrect response size
	 calculation and an out-of-bounds read.
	 (rene) ACME, the author, claims that the vulnerability is fixed
	 *after* version 1.22, released on 2015-12-28
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1548</cvename>
 <url>https://cxsecurity.com/cveshow/CVE-2015-1548</url>
 <url>http://acme.com/updates/archive/192.html</url>
 </references>
 <dates>
 <discovery>2015-02-10</discovery>
 <entry>2016-01-03</entry>
 </dates>
 </vuln>

<vuln vid="1384f2fd-b1be-11e5-9728-002590263bf5">
 <topic>qemu -- denial of service vulnerability in Rocker switch emulation</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.50</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20160213</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/28/6">
	 Qemu emulator built with the Rocker switch emulation support is
	 vulnerable to an off-by-one error. It happens while processing
	 transmit(tx) descriptors in 'tx_consume' routine, if a descriptor
	 was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments.
	 
	 A privileged user inside guest could use this flaw to cause memory
	 leakage on the host or crash the Qemu process instance resulting in
	 DoS issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8701</cvename>
 <freebsdpr>ports/205813</freebsdpr>
 <freebsdpr>ports/205814</freebsdpr>
 <url>http://www.openwall.com/lists/oss-security/2015/12/28/6</url>
 <url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04629.html</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=007cd223de527b5f41278f2d886c1a4beb3e67aa</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/007cd223de527b5f41278f2d886c1a4beb3e67aa</url>
 </references>
 <dates>
 <discovery>2015-12-28</discovery>
 <entry>2016-01-03</entry>
 <modified>2016-07-06</modified>
 </dates>
 </vuln>

<vuln vid="152acff3-b1bd-11e5-9728-002590263bf5">
 <topic>qemu -- denial of service vulnerability in Q35 chipset emulation</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.50</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/24/1">
	 Qemu emulator built with the Q35 chipset based pc system emulator
	 is vulnerable to a heap based buffer overflow. It occurs during VM
	 guest migration, as more(16 bytes) data is moved into allocated
	 (8 bytes) memory area.
	 A privileged guest user could use this issue to corrupt the VM
	 guest image, potentially leading to a DoS. This issue affects q35
	 machine types.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8666</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/12/24/1</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=d9a3b33d2c9f996537b7f1d0246dee2d0120cefb</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/d9a3b33d2c9f996537b7f1d0246dee2d0120cefb</url>
 </references>
 <dates>
 <discovery>2015-11-19</discovery>
 <entry>2016-01-03</entry>
 <modified>2016-07-06</modified>
 </dates>
 </vuln>

<vuln vid="62ab8707-b1bc-11e5-9728-002590263bf5">
 <topic>qemu -- denial of service vulnerability in Human Monitor Interface support</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.0</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20160213</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/22/8">
	 Qemu emulator built with the Human Monitor Interface(HMP) support
	 is vulnerable to an OOB write issue. It occurs while processing
	 'sendkey' command in hmp_sendkey routine, if the command argument is
	 longer than the 'keyname_buf' buffer size.
	 A user/process could use this flaw to crash the Qemu process
	 instance resulting in DoS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8619</cvename>
 <freebsdpr>ports/205813</freebsdpr>
 <freebsdpr>ports/205814</freebsdpr>
 <url>http://www.openwall.com/lists/oss-security/2015/12/22/8</url>
 <url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02930.html</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=64ffbe04eaafebf4045a3ace52a360c14959d196</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/64ffbe04eaafebf4045a3ace52a360c14959d196</url>
 </references>
 <dates>
 <discovery>2015-12-23</discovery>
 <entry>2016-01-03</entry>
 <modified>2016-07-06</modified>
 </dates>
 </vuln>

<vuln vid="b3f9f8ef-b1bb-11e5-9728-002590263bf5">
 <topic>qemu -- denial of service vulnerability in MegaRAID SAS HBA emulation</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.0</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20160213</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/7">
	 Qemu emulator built with the SCSI MegaRAID SAS HBA emulation
	 support is vulnerable to a stack buffer overflow issue. It occurs
	 while processing the SCSI controller's CTRL_GET_INFO command. A
	 privileged guest user could use this flaw to crash the Qemu process
	 instance resulting in DoS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8613</cvename>
 <freebsdpr>ports/205813</freebsdpr>
 <freebsdpr>ports/205814</freebsdpr>
 <url>http://www.openwall.com/lists/oss-security/2015/12/21/7</url>
 <url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg03737.html</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=36fef36b91f7ec0435215860f1458b5342ce2811</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/36fef36b91f7ec0435215860f1458b5342ce2811</url>
 </references>
 <dates>
 <discovery>2015-12-21</discovery>
 <entry>2016-01-03</entry>
 <modified>2016-07-06</modified>
 </dates>
 </vuln>

<vuln vid="9ad8993e-b1ba-11e5-9728-002590263bf5">
 <topic>qemu -- denial of service vulnerability in VMWARE VMXNET3 NIC support</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.0</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20160213</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/15/4">
	 Qemu emulator built with a VMWARE VMXNET3 paravirtual NIC emulator
	 support is vulnerable to a memory leakage flaw. It occurs when a
	 guest repeatedly tries to activate the vmxnet3 device.
	 A privileged guest user could use this flaw to leak host memory,
	 resulting in DoS on the host.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8567</cvename>
 <cvename>CVE-2015-8568</cvename>
 <freebsdpr>ports/205813</freebsdpr>
 <freebsdpr>ports/205814</freebsdpr>
 <url>http://www.openwall.com/lists/oss-security/2015/12/15/4</url>
 <url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=aa4a3dce1c88ed51b616806b8214b7c8428b7470</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/aa4a3dce1c88ed51b616806b8214b7c8428b7470</url>
 </references>
 <dates>
 <discovery>2015-12-15</discovery>
 <entry>2016-01-03</entry>
 <modified>2016-07-06</modified>
 </dates>
 </vuln>

<vuln vid="60cb2055-b1b8-11e5-9728-002590263bf5">
 <topic>qemu -- denial of service vulnerability in USB EHCI emulation support</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.0</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/9">
	 Qemu emulator built with the USB EHCI emulation support is
	 vulnerable to an infinite loop issue. It occurs during communication
	 between host controller interface(EHCI) and a respective device
	 driver. These two communicate via a isochronous transfer descriptor
	 list(iTD) and an infinite loop unfolds if there is a closed loop in
	 this list.
	 A privileges user inside guest could use this flaw to consume
	 excessive CPU cycles &amp; resources on the host.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8558</cvename>
 <freebsdpr>ports/205814</freebsdpr>
 <url>http://www.openwall.com/lists/oss-security/2015/12/14/9</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=156a2e4dbffa85997636a7a39ef12da6f1b40254</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/156a2e4dbffa85997636a7a39ef12da6f1b40254</url>
 </references>
 <dates>
 <discovery>2015-12-14</discovery>
 <entry>2016-01-03</entry>
 </dates>
 </vuln>

<vuln vid="3fb06284-b1b7-11e5-9728-002590263bf5">
 <topic>qemu -- denial of service vulnerability in MSI-X support</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.0</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/2">
	 Qemu emulator built with the PCI MSI-X support is vulnerable to
	 null pointer dereference issue. It occurs when the controller
	 attempts to write to the pending bit array(PBA) memory region.
	 Because the MSI-X MMIO support did not define the .write method.
	 A privileges used inside guest could use this flaw to crash the
	 Qemu process resulting in DoS issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7549</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/12/14/2</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=43b11a91dd861a946b231b89b7542856ade23d1b</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/43b11a91dd861a946b231b89b7542856ade23d1b</url>
 </references>
 <dates>
 <discovery>2015-06-26</discovery>
 <entry>2016-01-03</entry>
 </dates>
 </vuln>

<vuln vid="67feba97-b1b5-11e5-9728-002590263bf5">
 <topic>qemu -- denial of service vulnerability in VNC</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.0</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/08/4">
	 Qemu emulator built with the VNC display driver support is
	 vulnerable to an arithmetic exception flaw. It occurs on the VNC
	 server side while processing the 'SetPixelFormat' messages from a
	 client.
	 A privileged remote client could use this flaw to crash the guest
	 resulting in DoS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8504</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/12/08/4</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3</url>
 </references>
 <dates>
 <discovery>2015-12-08</discovery>
 <entry>2016-01-03</entry>
 </dates>
 </vuln>

<vuln vid="405446f4-b1b3-11e5-9728-002590263bf5">
 <topic>qemu and xen-tools -- denial of service vulnerabilities in AMD PC-Net II NIC support</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.0</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
 </package>
 <package>
	<name>xen-tools</name>
	<range><lt>4.5.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/2">
	 Qemu emulator built with the AMD PC-Net II Ethernet Controller
	 support is vulnerable to a heap buffer overflow flaw. While
	 receiving packets in the loopback mode, it appends CRC code to the
	 receive buffer. If the data size given is same as the receive buffer
	 size, the appended CRC code overwrites 4 bytes beyond this
	 's-&gt;buffer' array.
	 A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
	 to crash the Qemu instance resulting in DoS or potentially execute
	 arbitrary code with privileges of the Qemu process on the host.
	</blockquote>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/3">
	 The AMD PC-Net II emulator(hw/net/pcnet.c), while receiving packets
	 from a remote host(non-loopback mode), fails to validate the
	 received data size, thus resulting in a buffer overflow issue. It
	 could potentially lead to arbitrary code execution on the host, with
	 privileges of the Qemu process. It requires the guest NIC to have
	 larger MTU limit.
	 A remote user could use this flaw to crash the guest instance
	 resulting in DoS or potentially execute arbitrary code on a remote
	 host with privileges of the Qemu process.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7504</cvename>
 <cvename>CVE-2015-7512</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/11/30/2</url>
 <url>http://www.openwall.com/lists/oss-security/2015/11/30/3</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=837f21aacf5a714c23ddaadbbc5212f9b661e3f7</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=8b98a2f07175d46c3f7217639bd5e03f2ec56343</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/837f21aacf5a714c23ddaadbbc5212f9b661e3f7</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/8b98a2f07175d46c3f7217639bd5e03f2ec56343</url>
 <url>http://xenbits.xen.org/xsa/advisory-162.html</url>
 </references>
 <dates>
 <discovery>2015-11-30</discovery>
 <entry>2016-01-03</entry>
 <modified>2016-01-06</modified>
 </dates>
 </vuln>

<vuln vid="b56fe6bb-b1b1-11e5-9728-002590263bf5">
 <topic>qemu -- denial of service vulnerabilities in eepro100 NIC support</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.5.50</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20160213</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/25/3">
	 Qemu emulator built with the i8255x (PRO100) emulation support is
	 vulnerable to an infinite loop issue. It could occur while
	 processing a chain of commands located in the Command Block List
	 (CBL). Each Command Block(CB) points to the next command in the
	 list. An infinite loop unfolds if the link to the next CB points
	 to the same block or there is a closed loop in the chain.
	 A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
	 to crash the Qemu instance resulting in DoS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8345</cvename>
 <freebsdpr>ports/205813</freebsdpr>
 <freebsdpr>ports/205814</freebsdpr>
 <url>http://www.openwall.com/lists/oss-security/2015/11/25/3</url>
 <url>https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=00837731d254908a841d69298a4f9f077babaf24</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/00837731d254908a841d69298a4f9f077babaf24</url>
 </references>
 <dates>
 <discovery>2015-10-16</discovery>
 <entry>2016-01-03</entry>
 <modified>2016-07-06</modified>
 </dates>
 </vuln>

<vuln vid="42cbd1e8-b152-11e5-9728-002590263bf5">
 <topic>qemu -- denial of service vulnerability in virtio-net support</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.1</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/18/5">
	 Qemu emulator built with the Virtual Network Device(virtio-net)
	 support is vulnerable to a DoS issue. It could occur while receiving
	 large packets over the tuntap/macvtap interfaces and when guest's
	 virtio-net driver did not support big/mergeable receive buffers.
	 An attacker on the local network could use this flaw to disable
	 guest's networking by sending a large number of jumbo frames to the
	 guest, exhausting all receive buffers and thus leading to a DoS
	 situation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7295</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/09/18/5</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=696317f1895e836d53b670c7b77b7be93302ba08</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/0cf33fb6b49a19de32859e2cdc6021334f448fb3</url>
 </references>
 <dates>
 <discovery>2015-09-18</discovery>
 <entry>2016-01-02</entry>
 </dates>
 </vuln>

<vuln vid="6aa3322f-b150-11e5-9728-002590263bf5">
 <topic>qemu -- denial of service vulnerabilities in NE2000 NIC support</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.0.1</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/15/2">
	 Qemu emulator built with the NE2000 NIC emulation support is
	 vulnerable to an infinite loop issue. It could occur when receiving
	 packets over the network.
	 A privileged user inside guest could use this flaw to crash the
	 Qemu instance resulting in DoS.
	</blockquote>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/15/3">
	 Qemu emulator built with the NE2000 NIC emulation support is
	 vulnerable to a heap buffer overflow issue. It could occur when
	 receiving packets over the network.
	 A privileged user inside guest could use this flaw to crash the
	 Qemu instance or potentially execute arbitrary code on the host.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5278</cvename>
 <cvename>CVE-2015-5279</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/09/15/2</url>
 <url>http://www.openwall.com/lists/oss-security/2015/09/15/3</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=5a1ccdfe44946e726b4c6fda8a4493b3931a68c1</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/737d2b3c41d59eb8f94ab7eb419b957938f24943</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/9bbdbc66e5765068dce76e9269dce4547afd8ad4</url>
 </references>
 <dates>
 <discovery>2015-09-15</discovery>
 <entry>2016-01-02</entry>
 </dates>
 </vuln>

<vuln vid="bbc97005-b14e-11e5-9728-002590263bf5">
 <topic>qemu -- denial of service vulnerability in IDE disk/CD/DVD-ROM emulation</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.1</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/10/1">
	 Qemu emulator built with the IDE disk and CD/DVD-ROM emulation
	 support is vulnerable to a divide by zero issue. It could occur
	 while executing an IDE command WIN_READ_NATIVE_MAX to determine
	 the maximum size of a drive.
	 A privileged user inside guest could use this flaw to crash the
	 Qemu instance resulting in DoS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-6855</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/09/10/1</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=63d761388d6fea994ca498c6e7a210851a99ad93</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/d9033e1d3aa666c5071580617a57bd853c5d794a</url>
 </references>
 <dates>
 <discovery>2015-09-09</discovery>
 <entry>2016-01-02</entry>
 </dates>
 </vuln>

<vuln vid="10bf8eed-b14d-11e5-9728-002590263bf5">
 <topic>qemu -- denial of service vulnerability in e1000 NIC support</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.0.1</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.5.50.g20151224</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/04/4">
	 Qemu emulator built with the e1000 NIC emulation support is
	 vulnerable to an infinite loop issue. It could occur while
	 processing transmit descriptor data when sending a network packet.
	 
	 A privileged user inside guest could use this flaw to crash the
	 Qemu instance resulting in DoS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-6815</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/09/04/4</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=3a56af1fbc17ff453f6e90fb08ce0c0e6fd0b61b</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/b947ac2bf26479e710489739c465c8af336599e7</url>
 </references>
 <dates>
 <discovery>2015-09-04</discovery>
 <entry>2016-01-02</entry>
 </dates>
 </vuln>

<vuln vid="8a560bcf-b14b-11e5-9728-002590263bf5">
 <topic>qemu -- denial of service vulnerability in VNC</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.1.0</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.2.50.g20141230</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/02/7">
	 Qemu emulator built with the VNC display driver is vulnerable to an
	 infinite loop issue. It could occur while processing a
	 CLIENT_CUT_TEXT message with specially crafted payload message.
	 A privileged guest user could use this flaw to crash the Qemu
	 process on the host, resulting in DoS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5239</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/09/02/7</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=f9a70e79391f6d7c2a912d785239ee8effc1922d</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/f9a70e79391f6d7c2a912d785239ee8effc1922d</url>
 </references>
 <dates>
 <discovery>2014-06-30</discovery>
 <entry>2016-01-02</entry>
 </dates>
 </vuln>

<vuln vid="2b3b4c27-b0c7-11e5-8d13-bc5ff45d0f28">
 <topic>qemu -- buffer overflow vulnerability in VNC</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.0.1</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.4.50.g20151011</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/21/6">
	 Qemu emulator built with the VNC display driver support is
	 vulnerable to a buffer overflow flaw leading to a heap memory
	 corruption issue. It could occur while refreshing the server
	 display surface via routine vnc_refresh_server_surface().
	 A privileged guest user could use this flaw to corrupt the heap
	 memory and crash the Qemu process instance OR potentially use it
	 to execute arbitrary code on the host.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5225</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/08/21/6</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=efec4dcd2552e85ed57f276b58f09fc385727450</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/eb8934b0418b3b1d125edddc4fc334a54334a49b</url>
 </references>
 <dates>
 <discovery>2015-08-17</discovery>
 <entry>2016-01-01</entry>
 </dates>
 </vuln>

<vuln vid="21e5abe3-b0c6-11e5-8d13-bc5ff45d0f28">
 <topic>qemu -- buffer overflow vulnerability in virtio-serial message exchanges</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.0</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.4.50.g20150814</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/06/3">
	 Qemu emulator built with the virtio-serial vmchannel support is
	 vulnerable to a buffer overflow issue. It could occur while
	 exchanging virtio control messages between guest and the host.
	 A malicious guest could use this flaw to corrupt few bytes of Qemu
	 memory area, potentially crashing the Qemu process.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5745</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/08/06/5</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=7882080388be5088e72c425b02223c02e6cb4295</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/7882080388be5088e72c425b02223c02e6cb4295</url>
 </references>
 <dates>
 <discovery>2015-08-06</discovery>
 <entry>2016-01-01</entry>
 </dates>
 </vuln>

<vuln vid="a267cd6c-b0c4-11e5-8d13-bc5ff45d0f28">
 <topic>qemu -- stack buffer overflow while parsing SCSI commands</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.0</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.4.50.g20150814</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Prasad J Pandit, Red Hat Product Security Team, reports:
	<blockquote cite="http://openwall.com/lists/oss-security/2015/07/23/6">
	 Qemu emulator built with the SCSI device emulation support is
	 vulnerable to a stack buffer overflow issue. It could occur while
	 parsing SCSI command descriptor block with an invalid operation
	 code.
	 A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
	 to crash the Qemu instance resulting in DoS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5158</cvename>
 <url>http://openwall.com/lists/oss-security/2015/07/23/6</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=c170aad8b057223b1139d72e5ce7acceafab4fa9</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/c170aad8b057223b1139d72e5ce7acceafab4fa9</url>
 </references>
 <dates>
 <discovery>2015-07-23</discovery>
 <entry>2016-01-01</entry>
 </dates>
 </vuln>

<vuln vid="aea8d90e-b0c1-11e5-8d13-bc5ff45d0f28">
 <topic>qemu -- code execution on host machine</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>2.4.0</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.4.50.g20150814</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Petr Matousek of Red Hat Inc. reports:
	<blockquote cite="http://openwall.com/lists/oss-security/2015/06/17/5">
	 Due converting PIO to the new memory read/write api we no longer
	 provide separate I/O region lenghts for read and write operations.
	 As a result, reading from PIT Mode/Command register will end with
	 accessing pit-&gt;channels with invalid index and potentially cause
	 memory corruption and/or minor information leak.
	 A privileged guest user in a guest with QEMU PIT emulation enabled
	 could potentially (tough unlikely) use this flaw to execute
	 arbitrary code on the host with the privileges of the hosting QEMU
	 process.
	 Please note that by default QEMU/KVM guests use in-kernel (KVM) PIT
	 emulation and are thus not vulnerable to this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3214</cvename>
 <url>http://openwall.com/lists/oss-security/2015/06/17/5</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=d4862a87e31a51de9eb260f25c9e99a75efe3235</url>
 <url>https://github.com/seanbruno/qemu-bsd-user/commit/d4862a87e31a51de9eb260f25c9e99a75efe3235</url>
 </references>
 <dates>
 <discovery>2015-06-17</discovery>
 <entry>2016-01-01</entry>
 </dates>
 </vuln>

<vuln vid="4b3a7e70-afce-11e5-b864-14dae9d210b8">
 <topic>mono -- DoS and code execution</topic>
 <affects>
 <package>
	<name>mono</name>
	<range><lt>4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NCC Group reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q4/543">
	 An attacker who can cause a carefully-chosen string to be
	 converted to a floating-point number can cause a crash and potentially
	 induce arbitrary code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2015/q4/543</url>
 <cvename>CVE-2009-0689</cvename>
 </references>
 <dates>
 <discovery>2015-12-19</discovery>
 <entry>2015-12-31</entry>
 </dates>
 </vuln>

<vuln vid="84c7ea88-bf04-4bdc-973b-36744bf540ab">
 <topic>flash -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.559</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-01.html">
	 These updates resolve a type confusion vulnerability that
	 could lead to code execution (CVE-2015-8644).

These updates resolve an integer overflow vulnerability
	 that could lead to code execution (CVE-2015-8651).

These updates resolve use-after-free vulnerabilities that
	 could lead to code execution (CVE-2015-8634, CVE-2015-8635,
	 CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641,
	 CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647,
	 CVE-2015-8648, CVE-2015-8649, CVE-2015-8650).

These updates resolve memory corruption vulnerabilities
	 that could lead to code execution (CVE-2015-8459,
	 CVE-2015-8460, CVE-2015-8636, CVE-2015-8645).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8459</cvename>
 <cvename>CVE-2015-8460</cvename>
 <cvename>CVE-2015-8634</cvename>
 <cvename>CVE-2015-8636</cvename>
 <cvename>CVE-2015-8638</cvename>
 <cvename>CVE-2015-8639</cvename>
 <cvename>CVE-2015-8640</cvename>
 <cvename>CVE-2015-8641</cvename>
 <cvename>CVE-2015-8642</cvename>
 <cvename>CVE-2015-8643</cvename>
 <cvename>CVE-2015-8644</cvename>
 <cvename>CVE-2015-8645</cvename>
 <cvename>CVE-2015-8646</cvename>
 <cvename>CVE-2015-8647</cvename>
 <cvename>CVE-2015-8648</cvename>
 <cvename>CVE-2015-8649</cvename>
 <cvename>CVE-2015-8650</cvename>
 <cvename>CVE-2015-8651</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb16-01.html</url>
 </references>
 <dates>
 <discovery>2015-12-28</discovery>
 <entry>2015-12-29</entry>
 </dates>
 </vuln>

<vuln vid="b808c3a8-ae30-11e5-b864-14dae9d210b8">
 <topic>inspircd -- DoS</topic>
 <affects>
 <package>
	<name>inspircd</name>
	<range><lt>2.0.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Inspircd reports:
	<blockquote cite="http://www.inspircd.org/2015/04/16/v2019-released.html">
	 This release fixes the issues discovered since 2.0.18,
	 containing multiple important stability and correctness related
	 improvements, including a fix for a bug which allowed malformed DNS
	 records to cause netsplits on a network.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.inspircd.org/2015/04/16/v2019-released.html</url>
 <url>https://github.com/inspircd/inspircd/commit/6058483d9fbc1b904d5ae7cfea47bfcde5c5b559</url>
 <url>http://comments.gmane.org/gmane.comp.security.oss.general/18464</url>
 <cvename>CVE-2015-8702</cvename>
 </references>
 <dates>
 <discovery>2015-04-16</discovery>
 <entry>2015-12-29</entry>
 <modified>2015-12-29</modified>
 </dates>
 </vuln>

<vuln vid="4bae544d-06a3-4352-938c-b3bcbca89298">
 <topic>ffmpeg -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libav</name>
	
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>gstreamer-ffmpeg</name>
	
	
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>handbrake</name>
	
	
	<range><lt>1.2.0</lt></range>
 </package>
 <package>
	<name>ffmpeg</name>
	<range><ge>2.8,1</ge><lt>2.8.4,1</lt></range>
	<range><lt>2.7.4,1</lt></range>
 </package>
 <package>
	<name>ffmpeg26</name>
	<range><lt>2.6.6</lt></range>
 </package>
 <package>
	<name>ffmpeg25</name>
	<range><lt>2.5.9</lt></range>
 </package>
 <package>
	<name>ffmpeg24</name>
	<range><lt>2.4.12</lt></range>
 </package>
 <package>
	<name>ffmpeg-devel</name>
	<name>ffmpeg23</name>
	<name>ffmpeg2</name>
	<name>ffmpeg1</name>
	<name>ffmpeg-011</name>
	<name>ffmpeg0</name>
	
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>avidemux</name>
	<name>avidemux2</name>
	<name>avidemux26</name>
	
	
	<range><le>2.6.11</le></range>
 </package>
 <package>
	<name>kodi</name>
	
	<range><lt>16.0</lt></range>
 </package>
 <package>
	<name>mplayer</name>
	<name>mencoder</name>
	
	<range><lt>1.2.r20151219_1</lt></range>
 </package>
 <package>
	<name>mythtv</name>
	<name>mythtv-frontend</name>
	
	<range><le>0.27.5,1</le></range>
 </package>
 <package>
	<name>plexhometheater</name>
	
	
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8662">
	 The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in
	 FFmpeg before 2.8.4 does not validate the number of
	 decomposition levels before proceeding with Discrete Wavelet
	 Transform decoding, which allows remote attackers to cause a
	 denial of service (out-of-bounds array access) or possibly
	 have unspecified other impact via crafted JPEG 2000
	 data.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8663">
	 The ff_get_buffer function in libavcodec/utils.c in
	 FFmpeg before 2.8.4 preserves width and height values after
	 a failure, which allows remote attackers to cause a denial
	 of service (out-of-bounds array access) or possibly have
	 unspecified other impact via a crafted .mov file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8662</cvename>
 <cvename>CVE-2015-8663</cvename>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75422280fbcdfbe9dc56bde5525b4d8b280f1bc5</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=abee0a1c60612e8638640a8a3738fffb65e16dbf</url>
 <url>https://ffmpeg.org/security.html</url>
 </references>
 <dates>
 <discovery>2015-12-20</discovery>
 <entry>2015-12-28</entry>
 <modified>2018-03-25</modified>
 </dates>
 </vuln>

<vuln vid="10f7bc76-0335-4a88-b391-0b05b3a8ce1c">
 <topic>NSS -- MD5 downgrade in TLS 1.2 signatures</topic>
 <affects>
 <package>
	<name>nss</name>
	<name>linux-c6-nss</name>
	<range><ge>3.20</ge><lt>3.20.2</lt></range>
	<range><lt>3.19.2.2</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>43.0.2,1</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>38.5.1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.40</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2015-150/">
	 Security researcher Karthikeyan Bhargavan reported an
	 issue in Network Security Services (NSS) where MD5
	 signatures in the server signature within the TLS 1.2
	 ServerKeyExchange message are still accepted. This is an
	 issue since NSS has officially disallowed the accepting MD5
	 as a hash algorithm in signatures since 2011. This issues
	 exposes NSS based clients such as Firefox to theoretical
	 collision-based forgery attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7575</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-150/</url>
 <url>https://hg.mozilla.org/projects/nss/rev/94e1157f3fbb</url>
 </references>
 <dates>
 <discovery>2015-12-22</discovery>
 <entry>2015-12-28</entry>
 </dates>
 </vuln>

<vuln vid="88f75070-abcf-11e5-83d3-6805ca0b3d42">
 <topic>phpMyAdmin -- path disclosure vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.5.0</ge><lt>4.5.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-6/">
	 By calling some scripts that are part of phpMyAdmin in an
	 unexpected way, it is possible to trigger phpMyAdmin to
	 display a PHP error message which contains the full path of
	 the directory where phpMyAdmin is installed.
	 We consider these vulnerabilities to be non-critical.
	 This path disclosure is possible on servers where the
	 recommended setting of the PHP configuration directive
	 display_errors is set to on, which is against the
	 recommendations given in the PHP manual for a production
	 server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2015-6/</url>
 <cvename>CVE-2015-8669</cvename>
 </references>
 <dates>
 <discovery>2015-12-25</discovery>
 <entry>2015-12-26</entry>
 </dates>
 </vuln>

<vuln vid="876768aa-ab1e-11e5-8a30-5453ed2e2b49">
 <topic>dpkg -- stack-based buffer overflow</topic>
 <affects>
 <package>
	<name>dpkg</name>
	<range><lt>1.16.17</lt></range>
	<range><lt>1.17.26</lt></range>
	<range><lt>1.18.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Salvatore Bonaccorso reports:
	<blockquote cite="https://lists.debian.org/debian-security-announce/2015/msg00312.html">
	 Hanno Boeck discovered a stack-based buffer overflow in the
	 dpkg-deb component of dpkg, the Debian package management system.
	 This flaw could potentially lead to arbitrary code execution if a
	 user or an automated system were tricked into processing a specially
	 crafted Debian binary package (.deb) in the old style Debian binary
	 package format.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0860</cvename>
 <url>http://openwall.com/lists/oss-security/2015/11/26/3</url>
 <url>https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/?id=f1aac7d933819569bf6f347c3c0d5a64a90bbce0</url>
 </references>
 <dates>
 <discovery>2015-11-26</discovery>
 <entry>2015-12-25</entry>
 </dates>
 </vuln>

<vuln vid="e1b5318c-aa4d-11e5-8f5c-002590263bf5">
 <topic>mantis -- information disclosure vulnerability</topic>
 <affects>
 <package>
	<name>mantis</name>
	<range><lt>1.2.19_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mantis reports:
	<blockquote cite="https://mantisbt.org/bugs/view.php?id=19873">
	 CVE-2015-5059: documentation in private projects can be seen by
	 every user
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5059</cvename>
 <freebsdpr>ports/201106</freebsdpr>
 <url>https://mantisbt.org/bugs/view.php?id=19873</url>
 <url>http://openwall.com/lists/oss-security/2015/06/25/3</url>
 </references>
 <dates>
 <discovery>2015-06-23</discovery>
 <entry>2015-12-24</entry>
 </dates>
 </vuln>

<vuln vid="f36bbd66-aa44-11e5-8f5c-002590263bf5">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki123</name>
	<range><lt>1.23.12</lt></range>
 </package>
 <package>
	<name>mediawiki124</name>
	<range><lt>1.24.5</lt></range>
 </package>
 <package>
	<name>mediawiki125</name>
	<range><lt>1.25.4</lt></range>
 </package>
 <package>
	<name>mediawiki126</name>
	<range><lt>1.26.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MediaWiki reports:
	<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html">
	 (T117899) SECURITY: $wgArticlePath can no longer be set to relative
	 paths that do not begin with a slash. This enabled trivial XSS
	 attacks. Configuration values such as "http://my.wiki.com/wiki/$1"
	 are fine, as are "/wiki/$1". A value such as "$1" or "wiki/$1" is
	 not and will now throw an error.
	 (T119309) SECURITY: Use hash_compare() for edit token comparison.
	 
	 (T118032) SECURITY: Don't allow cURL to interpret POST parameters
	 starting with '@' as file uploads.
	 (T115522) SECURITY: Passwords generated by User::randomPassword()
	 can no longer be shorter than $wgMinimalPasswordLength.
	 (T97897) SECURITY: Improve IP parsing and trimming. Previous
	 behavior could result in improper blocks being issued.
	 (T109724) SECURITY: Special:MyPage, Special:MyTalk,
	 Special:MyContributions and related pages no longer use HTTP
	 redirects and are now redirected by MediaWiki.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8622</cvename>
 <cvename>CVE-2015-8623</cvename>
 <cvename>CVE-2015-8624</cvename>
 <cvename>CVE-2015-8625</cvename>
 <cvename>CVE-2015-8626</cvename>
 <cvename>CVE-2015-8627</cvename>
 <cvename>CVE-2015-8628</cvename>
 <url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html</url>
 <url>https://phabricator.wikimedia.org/T117899</url>
 <url>https://phabricator.wikimedia.org/T119309</url>
 <url>https://phabricator.wikimedia.org/T118032</url>
 <url>https://phabricator.wikimedia.org/T115522</url>
 <url>https://phabricator.wikimedia.org/T97897</url>
 <url>https://phabricator.wikimedia.org/T109724</url>
 <url>http://www.openwall.com/lists/oss-security/2015/12/23/7</url>
 </references>
 <dates>
 <discovery>2015-12-18</discovery>
 <entry>2015-12-24</entry>
 </dates>
 </vuln>

<vuln vid="3b50881d-1860-4721-aab1-503290e23f6c">
 <topic>Ruby -- unsafe tainted string vulnerability</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>2.0.0,1</ge><lt>2.0.0.648,1</lt></range>
	<range><ge>2.1.0,1</ge><lt>2.1.8,1</lt></range>
	<range><ge>2.2.0,1</ge><lt>2.2.4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby developer reports:
	<blockquote cite="https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/">
	 There is an unsafe tainted string vulnerability in Fiddle and DL.
	 This issue was originally reported and fixed with CVE-2009-5147 in
		DL, but reappeared after DL was reimplemented using Fiddle and
		libffi.
	 And, about DL, CVE-2009-5147 was fixed at Ruby 1.9.1, but not
	 fixed at other branches, then rubies which bundled DL except Ruby
		1.9.1 are still vulnerable.
	</blockquote>
 </body>
 </description>
 <references>
	 <url>https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/</url>
	 <cvename>CVE-2015-7551</cvename>
 </references>
 <dates>
 <discovery>2015-12-16</discovery>
 <entry>2015-12-23</entry>
 </dates>
 </vuln>

<vuln vid="54075861-a95a-11e5-8b40-20cf30e32f6d">
 <topic>Bugzilla security issues</topic>
 <affects>
 <package>
	<name>bugzilla44</name>
	<range><lt>4.4.11</lt></range>
 </package>
 <package>
	<name>bugzilla50</name>
	<range><lt>5.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bugzilla Security Advisory
	<blockquote cite="https://www.bugzilla.org/security/4.2.15/">
	 During the generation of a dependency graph, the code for
	 the HTML image map is generated locally if a local dot
	 installation is used. With escaped HTML characters in a bug
	 summary, it is possible to inject unfiltered HTML code in
	 the map file which the CreateImagemap function generates.
	 This could be used for a cross-site scripting attack.
	 If an external HTML page contains a &lt;script&gt; element with
	 its src attribute pointing to a buglist in CSV format, some
	 web browsers incorrectly try to parse the CSV file as valid
	 JavaScript code. As the buglist is generated based on the
	 privileges of the user logged into Bugzilla, the external
	 page could collect confidential data contained in the CSV
	 file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8508</cvename>
 <cvename>CVE-2015-8509</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1221518</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1232785</url>
 </references>
 <dates>
 <discovery>2015-12-22</discovery>
 <entry>2015-12-23</entry>
 </dates>
 </vuln>

<vuln vid="d6c51737-a84b-11e5-8f5c-002590263bf5">
 <topic>librsvg2 -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>librsvg2</name>
	<range><lt>2.40.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adam Maris, Red Hat Product Security, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/5">
	 CVE-2015-7558: Stack exhaustion due to cyclic dependency causing to
	 crash an application was found in librsvg2 while parsing SVG file.
	 It has been fixed in 2.40.12 by many commits that has rewritten the
	 checks for cyclic references.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7558</cvename>
 <freebsdpr>ports/205502</freebsdpr>
 <url>http://www.openwall.com/lists/oss-security/2015/12/21/5</url>
 <url>https://bugzilla.redhat.com/1268243</url>
 </references>
 <dates>
 <discovery>2015-10-02</discovery>
 <entry>2015-12-22</entry>
 </dates>
 </vuln>

<vuln vid="da634091-a84a-11e5-8f5c-002590263bf5">
 <topic>librsvg2 -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>librsvg2</name>
	<range><lt>2.40.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adam Maris, Red Hat Product Security, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/5">
	 CVE-2015-7557: Out-of-bounds heap read in librsvg2 was found when
	 parsing SVG file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7557</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/12/21/5</url>
 <url>https://git.gnome.org/browse/librsvg/commit/rsvg-shapes.c?id=40af93e6eb1c94b90c3b9a0b87e0840e126bb8df</url>
 </references>
 <dates>
 <discovery>2015-02-06</discovery>
 <entry>2015-12-22</entry>
 </dates>
 </vuln>

<vuln vid="9e7306b9-a5c3-11e5-b864-14dae9d210b8">
 <topic>quassel -- remote denial of service</topic>
 <affects>
 <package>
 <name>quassel</name>
 <range><lt>0.12.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Pierre Schweitzer reports:
 <blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/12/1">
	 Any client sending the command "/op *" in a query will
	 cause the Quassel core to crash.
 </blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2015/12/12/1</url>
 <cvename>CVE-2015-8547</cvename>
 </references>
 <dates>
 <discovery>2015-11-22</discovery>
 <entry>2015-12-18</entry>
 </dates>
 </vuln>

<vuln vid="f714b4c9-a6c1-11e5-88d7-047d7b492d07">
 <topic>libvirt -- ACL bypass using ../ to access beyond storage pool</topic>
 <affects>
 <package>
	<name>libvirt</name>
	<range><ge>1.1.0</ge><lt>1.2.19_2</lt></range>
	<range><ge>1.2.20</ge><lt>1.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Libvit development team reports:
	<blockquote cite="http://security.libvirt.org/2015/0004.html">
	 Various virStorageVol* API operate on user-supplied volume names by
	 concatenating the volume name to the pool location. Note that the
	 virStoragePoolListVolumes API, when used on a storage pool backed by
	 a directory in a file system, will only list volumes immediately in
	 that directory (there is no traversal into subdirectories). However,
	 other APIs such as virStorageVolCreateXML were not checking if a
	 potential volume name represented one of the volumes that could be
	 returned by virStoragePoolListVolumes; because they were not rejecting
	 the use of '/' in a volume name.
	 Because no checking was done on volume names, a user could supply
	 a potential volume name of something like '../../../etc/passwd' to
	 attempt to access a file not belonging to the storage pool. When
	 fine-grained Access Control Lists (ACL) are in effect, a user with
	 storage_vol:create ACL permission but lacking domain:write permission
	 could thus abuse virStorageVolCreateXML and similar APIs to gain
	 access to files not normally permitted to that user. Fortunately, it
	 appears that the only APIs that could leak information or corrupt
	 files require read-write connection to libvirtd; and when ACLs are not
	 in use (the default without any further configuration), a user with
	 read-write access can already be considered to have full access to the
	 machine, and without an escalation of privilege there is no security
	 problem.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5313</cvename>
 <url>http://security.libvirt.org/2015/0004.html</url>
 </references>
 <dates>
 <discovery>2015-10-30</discovery>
 <entry>2015-12-20</entry>
 </dates>
 </vuln>

<vuln vid="ef434839-a6a4-11e5-8275-000c292e4fd8">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba36</name>
	<range><ge>3.6.0</ge><lt>3.6.25_2</lt></range>
 </package>
 <package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><le>4.0.26</le></range>
 </package>
 <package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><lt>4.1.22</lt></range>
 </package>
 <package>
	<name>samba42</name>
	<range><ge>4.2.0</ge><lt>4.2.7</lt></range>
 </package>
 <package>
	<name>samba43</name>
	<range><ge>4.3.0</ge><lt>4.3.3</lt></range>
 </package>
 <package>
	<name>ldb</name>
	<range><ge>1.0.0</ge><lt>1.1.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samba team reports:
	<blockquote cite="https://www.samba.org/samba/latest_news.html#4.3.3">
	 [CVE-2015-3223] Malicious request can cause Samba LDAP server to hang, spinning using CPU.
	 [CVE-2015-5330] Malicious request can cause Samba LDAP server
	 to return uninitialized memory that should not be part of the reply.
	 [CVE-2015-5296] Requesting encryption should also request
	 signing when setting up the connection to protect against man-in-the-middle attacks.
	 [CVE-2015-5299] A missing access control check in the VFS
	 shadow_copy2 module could allow unauthorized users to access snapshots.
	 [CVE-2015-7540] Malicious request can cause Samba LDAP server to return crash.
	 [CVE-2015-8467] Samba can expose Windows DCs to MS15-096
	 Denial of service via the creation of multiple machine accounts(The Microsoft issue is CVE-2015-2535).
	 [CVE-2015-5252] Insufficient symlink verification could allow data access outside share path.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3223</cvename>
 <url>https://www.samba.org/samba/security/CVE-2015-3223.html</url>
 <cvename>CVE-2015-5252</cvename>
 <url>https://www.samba.org/samba/security/CVE-2015-5252.html</url>
 <cvename>CVE-2015-5296</cvename>
 <url>https://www.samba.org/samba/security/CVE-2015-5296.html</url>
 <cvename>CVE-2015-5299</cvename>
 <url>https://www.samba.org/samba/security/CVE-2015-5299.html</url>
 <cvename>CVE-2015-5330</cvename>
 <url>https://www.samba.org/samba/security/CVE-2015-5330.html</url>
 <cvename>CVE-2015-7540</cvename>
 <url>https://www.samba.org/samba/security/CVE-2015-7540.html</url>
 <cvename>CVE-2015-8467</cvename>
 <url>https://www.samba.org/samba/security/CVE-2015-8467.html</url>
 </references>
 <dates>
 <discovery>2015-12-16</discovery>
 <entry>2015-12-19</entry>
 <modified>2016-02-05</modified>
 </dates>
 </vuln>

<vuln vid="bb7d4791-a5bf-11e5-a0e5-00262d5ed8ee">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>47.0.2526.106</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_15.html">
	 2 security fixes in this release, including:
	 <ul>
	 <li>[569486] CVE-2015-6792: Fixes from internal audits and
	 fuzzing.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-6792</cvename>
 <url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_15.html</url>
 </references>
 <dates>
 <discovery>2015-12-16</discovery>
 <entry>2015-12-18</entry>
 </dates>
 </vuln>

<vuln vid="7329938b-a4e6-11e5-b864-14dae9d210b8">
 <topic>cups-filters -- code execution</topic>
 <affects>
 <package>
	<name>cups-filters</name>
	<range><lt>1.4.0</lt></range>
 </package>
 <package>
	<name>foomatic-filters</name>
	<range><lt>4.0.17_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Till Kamppeter reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/13">
	 Cups Filters/Foomatic Filters does not consider semicolon
	 as an illegal escape character.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2015/12/14/13</url>
 <cvename>CVE-2015-8560</cvename>
 </references>
 <dates>
 <discovery>2015-12-12</discovery>
 <entry>2015-12-17</entry>
 </dates>
 </vuln>

<vuln vid="6dbae1a8-a4e6-11e5-b864-14dae9d210b8">
 <topic>cups-filters -- code execution</topic>
 <affects>
 <package>
	<name>cups-filters</name>
	<range><lt>1.2.0</lt></range>
 </package>
 <package>
	<name>foomatic-filters</name>
	<range><lt>4.0.17_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Salvatore Bonaccorso reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/13/2">
	 Cups Filters/Foomatic Filters does not consider backtick
	 as an illegal escape character.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2015/12/13/2</url>
 <cvename>CVE-2015-8327</cvename>
 </references>
 <dates>
 <discovery>2015-10-30</discovery>
 <entry>2015-12-17</entry>
 </dates>
 </vuln>

<vuln vid="1fbd6db1-a4e4-11e5-b864-14dae9d210b8">
 <topic>py-amf -- input sanitization errors</topic>
 <affects>
 <package>
	<name>py27-amf</name>
	<name>py32-amf</name>
	<name>py33-amf</name>
	<name>py34-amf</name>
	<range><lt>0.8.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	oCERT reports:
	<blockquote cite="http://www.ocert.org/advisories/ocert-2015-011.html">
	 A specially crafted AMF payload, containing malicious
	 references to XML external entities, can be used to trigger Denial of
	 Service (DoS) conditions or arbitrarily return the contents of files
	 that are accessible with the running application privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.ocert.org/advisories/ocert-2015-011.html</url>
 <cvename>CVE-2015-8549</cvename>
 </references>
 <dates>
 <discovery>2015-12-01</discovery>
 <entry>2015-12-17</entry>
 </dates>
 </vuln>

<vuln vid="a9f60ce8-a4e0-11e5-b864-14dae9d210b8">
 <topic>joomla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><lt>3.4.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html">
	 <h2>[20151201] - Core - Remote Code Execution Vulnerability</h2>
	 Browser information is not filtered properly while saving the
	 session values into the database which leads to a Remote Code
	 Execution vulnerability.
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/633-20151214-core-csrf-hardening.html">
	 <h2>[20151202] - Core - CSRF Hardening</h2>
	 Add additional CSRF hardening in com_templates.
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/634-20151214-core-directory-traversal.html">
	 <h2>[20151203] - Core - Directory Traversal</h2>
	 Failure to properly sanitize input data from the XML install file
	 located within an extension's package archive allows for directory
	 traversal.
	</blockquote>
	<blockquote cite="https://developer.joomla.org/security-centre/635-20151214-core-directory-traversal-2.html">
	 <h2>[20151204] - Core - Directory Traversal</h2>
	 Inadequate filtering of request data leads to a Directory Traversal
	 vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.joomla.org/announcements/release-news/5641-joomla-3-4-6-released.html</url>
 <cvename>CVE-2015-8562</cvename>
 <cvename>CVE-2015-8563</cvename>
 <cvename>CVE-2015-8564</cvename>
 <cvename>CVE-2015-8565</cvename>
 <url>https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html</url>
 <url>https://developer.joomla.org/security-centre/633-20151214-core-csrf-hardening.html</url>
 <url>https://developer.joomla.org/security-centre/634-20151214-core-directory-traversal.html</url>
 <url>https://developer.joomla.org/security-centre/635-20151214-core-directory-traversal-2.html</url>
 </references>
 <dates>
 <discovery>2015-12-14</discovery>
 <entry>2015-12-17</entry>
 <modified>2016-12-22</modified>
 </dates>
 </vuln>

<vuln vid="a8ec4db7-a398-11e5-85e9-14dae9d210b8">
 <topic>bind -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><lt>9.9.8P2</lt></range>
 </package>
 <package>
	<name>bind910</name>
	<range><lt>9.10.3P2</lt></range>
 </package>
 <package>
	<name>bind9-devel</name>
	<range><lt>9.11.0.a20151215</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_32</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01328/0/BIND-9.10.3-P2-Release-Notes.html">
	 Named is potentially vulnerable to the OpenSSL vulnerability described in CVE-2015-3193.
	 Incorrect reference counting could result in an INSIST
	 failure if a socket error occurred while performing a lookup. This flaw
	 is disclosed in CVE-2015-8461. [RT#40945]
	 Insufficient testing when parsing a message allowed records
	 with an incorrect class to be be accepted, triggering a REQUIRE failure
	 when those records were subsequently cached. This flaw is disclosed in
	 CVE-2015-8000. [RT #40987]
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://kb.isc.org/article/AA-01328/0/BIND-9.10.3-P2-Release-Notes.html</url>
 <url>https://kb.isc.org/article/AA-01317/0/CVE-2015-8000%3A-Responses-with-a-malformed-class-attribute-can-trigger-an-assertion-failure-in-db.c.html</url>
 <url>https://kb.isc.org/article/AA-01319/0/CVE-2015-8461%3A-A-race-condition-when-handling-socket-errors-can-lead-to-an-assertion-failure-in-resolver.c.html</url>
 <cvename>CVE-2015-3193</cvename>
 <cvename>CVE-2015-8000</cvename>
 <cvename>CVE-2015-8461</cvename>
 <freebsdsa>SA-15:27.bind</freebsdsa>
 </references>
 <dates>
 <discovery>2015-11-24</discovery>
 <entry>2015-12-16</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="2c2d1c39-1396-459a-91f5-ca03ee7c64c6">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>43.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>43.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.40</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.40</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>38.5.0,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>38.5.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>38.5.0</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>38.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	 MFSA 2015-134 Miscellaneous memory safety hazards
	 (rv:43.0 / rv:38.5)
	 MFSA 2015-135 Crash with JavaScript variable assignment
	 with unboxed objects
	 MFSA 2015-136 Same-origin policy violation using
	 perfomance.getEntries and history navigation
	 MFSA 2015-137 Firefox allows for control characters to be
	 set in cookies
	 MFSA 2015-138 Use-after-free in WebRTC when datachannel
	 is used after being destroyed
	 MFSA 2015-139 Integer overflow allocating extremely large
	 textures
	 MFSA 2015-140 Cross-origin information leak through web
	 workers error events
	 MFSA 2015-141 Hash in data URI is incorrectly parsed
	 MFSA 2015-142 DOS due to malformed frames in HTTP/2
	 MFSA 2015-143 Linux file chooser crashes on malformed
	 images due to flaws in Jasper library
	 MFSA 2015-144 Buffer overflows found through code
	 inspection
	 MFSA 2015-145 Underflow through code inspection
	 MFSA 2015-146 Integer overflow in MP4 playback in 64-bit
	 versions
	 MFSA 2015-147 Integer underflow and buffer overflow
	 processing MP4 metadata in libstagefright
	 MFSA 2015-148 Privilege escalation vulnerabilities in
	 WebExtension APIs
	 MFSA 2015-149 Cross-site reading attack through data and
	 view-source URIs
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7201</cvename>
 <cvename>CVE-2015-7202</cvename>
 <cvename>CVE-2015-7203</cvename>
 <cvename>CVE-2015-7204</cvename>
 <cvename>CVE-2015-7205</cvename>
 <cvename>CVE-2015-7207</cvename>
 <cvename>CVE-2015-7208</cvename>
 <cvename>CVE-2015-7210</cvename>
 <cvename>CVE-2015-7211</cvename>
 <cvename>CVE-2015-7212</cvename>
 <cvename>CVE-2015-7213</cvename>
 <cvename>CVE-2015-7214</cvename>
 <cvename>CVE-2015-7215</cvename>
 <cvename>CVE-2015-7216</cvename>
 <cvename>CVE-2015-7217</cvename>
 <cvename>CVE-2015-7218</cvename>
 <cvename>CVE-2015-7219</cvename>
 <cvename>CVE-2015-7220</cvename>
 <cvename>CVE-2015-7221</cvename>
 <cvename>CVE-2015-7222</cvename>
 <cvename>CVE-2015-7223</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-134/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-135/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-136/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-137/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-138/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-139/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-140/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-141/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-142/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-143/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-144/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-145/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-146/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-147/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-148/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-149/</url>
 </references>
 <dates>
 <discovery>2015-12-15</discovery>
 <entry>2015-12-15</entry>
 </dates>
 </vuln>

<vuln vid="a5934ba8-a376-11e5-85e9-14dae9d210b8">
 <topic>java -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openjdk8</name>
	<name>openjdk8-jre</name>
	<range><lt>8.66.17</lt></range>
 </package>
 <package>
	<name>openjdk7</name>
	<name>openjdk7-jre</name>
	<range><lt>7.91.02,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA">
	 This Critical Patch Update contains 25 new security fixes
	 for Oracle Java SE. 24 of these vulnerabilities may be remotely
	 exploitable without authentication, i.e., may be exploited over a
	 network without the need for a username and password.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA</url>
 <cvename>CVE-2015-4835</cvename>
 <cvename>CVE-2015-4881</cvename>
 <cvename>CVE-2015-4843</cvename>
 <cvename>CVE-2015-4883</cvename>
 <cvename>CVE-2015-4860</cvename>
 <cvename>CVE-2015-4805</cvename>
 <cvename>CVE-2015-4844</cvename>
 <cvename>CVE-2015-4901</cvename>
 <cvename>CVE-2015-4868</cvename>
 <cvename>CVE-2015-4810</cvename>
 <cvename>CVE-2015-4806</cvename>
 <cvename>CVE-2015-4871</cvename>
 <cvename>CVE-2015-4902</cvename>
 <cvename>CVE-2015-4840</cvename>
 <cvename>CVE-2015-4882</cvename>
 <cvename>CVE-2015-4842</cvename>
 <cvename>CVE-2015-4734</cvename>
 <cvename>CVE-2015-4903</cvename>
 <cvename>CVE-2015-4803</cvename>
 <cvename>CVE-2015-4893</cvename>
 <cvename>CVE-2015-4911</cvename>
 <cvename>CVE-2015-4872</cvename>
 <cvename>CVE-2015-4906</cvename>
 <cvename>CVE-2015-4916</cvename>
 <cvename>CVE-2015-4908</cvename>
 </references>
 <dates>
 <discovery>2015-10-20</discovery>
 <entry>2015-12-15</entry>
 <modified>2016-01-08</modified>
 </dates>
 </vuln>

<vuln vid="daadef86-a366-11e5-8b40-20cf30e32f6d">
 <topic>subversion -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>subversion17</name>
	<range><ge>1.7.0</ge><lt>1.7.22_1</lt></range>
 </package>
 <package>
	<name>subversion18</name>
	<range><ge>1.8.0</ge><lt>1.8.15</lt></range>
 </package>
 <package>
	<name>subversion</name>
	<range><ge>1.9.0</ge><lt>1.9.3</lt></range>
 </package>
 <package>
	<name>mod_dav_svn</name>
	<range><ge>1.7.0</ge><lt>1.7.22_1</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.15</lt></range>
	<range><ge>1.9.0</ge><lt>1.9.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion Project reports:
	<blockquote cite="http://subversion.apache.org/security/">
	 Remotely triggerable heap overflow and out-of-bounds read caused
	 by integer overflow in the svn:// protocol parser.
	 Remotely triggerable heap overflow and out-of-bounds read in
	 mod_dav_svn caused by integer overflow when parsing skel-encoded
	 request bodies.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5343</cvename>
 <url>http://subversion.apache.org/security/CVE-2015-5343-advisory.txt</url>
 <cvename>CVE-2015-5259</cvename>
 <url>http://subversion.apache.org/security/CVE-2015-5259-advisory.txt</url>
 </references>
 <dates>
 <discovery>2015-11-14</discovery>
 <entry>2015-12-15</entry>
 </dates>
 </vuln>

<vuln vid="72c145df-a1e0-11e5-8ad0-00262d5ed8ee">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>47.0.2526.80</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_8.html">
	 7 security fixes in this release, including:
	 <ul>
	 <li>[548273] High CVE-2015-6788: Type confusion in extensions.
	 Credit to anonymous.</li>
	 <li>[557981] High CVE-2015-6789: Use-after-free in Blink. Credit to
	 cloudfuzzer.</li>
	 <li>[542054] Medium CVE-2015-6790: Escaping issue in saved pages.
	 Credit to Inti De Ceukelaire.</li>
	 <li>[567513] CVE-2015-6791: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 <li>Multiple vulnerabilities in V8 fixed at the tip of the 4.7
	 branch (currently 4.7.80.23).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-6788</cvename>
 <cvename>CVE-2015-6789</cvename>
 <cvename>CVE-2015-6790</cvename>
 <cvename>CVE-2015-6791</cvename>
 <url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_8.html</url>
 </references>
 <dates>
 <discovery>2015-12-08</discovery>
 <entry>2015-12-13</entry>
 </dates>
 </vuln>

<vuln vid="33459061-a1d6-11e5-8794-bcaec565249c">
 <topic>freeimage -- multiple integer overflows</topic>
 <affects>
 <package>
	<name>freeimage</name>
	<range><lt>3.16.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pcheng pcheng reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/28/1">
	 An integer overflow issue in the FreeImage project was
	 reported and fixed recently.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0852</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/08/28/1</url>
 </references>
 <dates>
 <discovery>2015-08-28</discovery>
 <entry>2015-12-13</entry>
 </dates>
 </vuln>

<vuln vid="21bc4d71-9ed8-11e5-8f5c-002590263bf5">
 <topic>redmine -- information leak vulnerability</topic>
 <affects>
 <package>
	<name>redmine</name>
	<range><lt>2.6.9</lt></range>
	<range><ge>3.0.0</ge><lt>3.0.7</lt></range>
	<range><ge>3.1.0</ge><lt>3.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redmine reports:
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	 Data disclosure in atom feed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8537</cvename>
 <url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
 </references>
 <dates>
 <discovery>2015-12-05</discovery>
 <entry>2015-12-10</entry>
 <modified>2015-12-11</modified>
 </dates>
 </vuln>

<vuln vid="be63533c-9ed7-11e5-8f5c-002590263bf5">
 <topic>redmine -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>redmine</name>
	<range><lt>2.6.8</lt></range>
	<range><ge>3.0.0</ge><lt>3.0.6</lt></range>
	<range><ge>3.1.0</ge><lt>3.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redmine reports:
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	 Potential changeset message disclosure in issues API.
	 Data disclosure on the time logging form
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8346</cvename>
 <cvename>CVE-2015-8473</cvename>
 <url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
 <url>http://www.openwall.com/lists/oss-security/2015/11/25/12</url>
 <url>http://www.openwall.com/lists/oss-security/2015/12/03/7</url>
 </references>
 <dates>
 <discovery>2015-11-14</discovery>
 <entry>2015-12-10</entry>
 </dates>
 </vuln>

<vuln vid="3ec2e0bc-9ed7-11e5-8f5c-002590263bf5">
 <topic>redmine -- open redirect vulnerability</topic>
 <affects>
 <package>
	<name>redmine</name>
	<range><ge>2.5.1</ge><lt>2.6.7</lt></range>
	<range><ge>3.0.0</ge><lt>3.0.5</lt></range>
	<range><eq>3.1.0</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redmine reports:
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	 Open Redirect vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8474</cvename>
 <url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
 <url>http://www.openwall.com/lists/oss-security/2015/12/04/1</url>
 </references>
 <dates>
 <discovery>2015-09-20</discovery>
 <entry>2015-12-10</entry>
 </dates>
 </vuln>

<vuln vid="939a7086-9ed6-11e5-8f5c-002590263bf5">
 <topic>redmine -- potential XSS vulnerability</topic>
 <affects>
 <package>
	<name>redmine</name>
	<range><lt>2.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redmine reports:
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	 Potential XSS vulnerability when rendering some flash messages.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8477</cvename>
 <url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
 <url>http://www.openwall.com/lists/oss-security/2015/12/05/6</url>
 </references>
 <dates>
 <discovery>2015-02-19</discovery>
 <entry>2015-12-10</entry>
 </dates>
 </vuln>

<vuln vid="49def4b7-9ed6-11e5-8f5c-002590263bf5">
 <topic>redmine -- information leak vulnerability</topic>
 <affects>
 <package>
	<name>redmine</name>
	<range><lt>2.4.6</lt></range>
	<range><ge>2.5.0</ge><lt>2.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redmine reports:
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	 Potential data leak (project names) in the invalid form
	 authenticity token error screen.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
 </references>
 <dates>
 <discovery>2014-07-06</discovery>
 <entry>2015-12-10</entry>
 </dates>
 </vuln>

<vuln vid="c2efcd46-9ed5-11e5-8f5c-002590263bf5">
 <topic>redmine -- open redirect vulnerability</topic>
 <affects>
 <package>
	<name>redmine</name>
	<range><lt>2.4.5</lt></range>
	<range><eq>2.5.0</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redmine reports:
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	 Open Redirect vulnerability
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1985</cvename>
 <url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
 <url>https://jvn.jp/en/jp/JVN93004610/index.html</url>
 </references>
 <dates>
 <discovery>2014-03-29</discovery>
 <entry>2015-12-10</entry>
 </dates>
 </vuln>

<vuln vid="66ba5931-9ed5-11e5-8f5c-002590263bf5">
 <topic>redmine -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>redmine</name>
	<range><ge>2.1.0</ge><lt>2.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redmine reports:
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	 XSS vulnerability
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
 </references>
 <dates>
 <discovery>2012-09-30</discovery>
 <entry>2015-12-10</entry>
 </dates>
 </vuln>

<vuln vid="0e0385d1-9ed5-11e5-8f5c-002590263bf5">
 <topic>redmine -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>redmine</name>
	<range><lt>1.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redmine reports:
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	 Mass-assignment vulnerability that would allow an attacker to
	 bypass part of the security checks.
	 Persistent XSS vulnerability
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0327</cvename>
 <url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
 <url>http://jvn.jp/en/jp/JVN93406632/</url>
 </references>
 <dates>
 <discovery>2012-03-11</discovery>
 <entry>2015-12-10</entry>
 </dates>
 </vuln>

<vuln vid="ae377aeb-9ed4-11e5-8f5c-002590263bf5">
 <topic>redmine -- CSRF protection bypass</topic>
 <affects>
 <package>
	<name>redmine</name>
	<range><lt>1.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Redmine reports:
	<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
	 Vulnerability that would allow an attacker to bypass the CSRF
	 protection.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
 </references>
 <dates>
 <discovery>2011-12-10</discovery>
 <entry>2015-12-10</entry>
 </dates>
 </vuln>

<vuln vid="23af0425-9eac-11e5-b937-00e0814cab4e">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><le>1.641</le></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><le>1.625.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09">
	 <h1>Description</h1>
	 <h5>SECURITY-95 / CVE-2015-7536 (Stored XSS vulnerability through workspace files and archived artifacts)</h5>
	 In certain configurations, low privilege users were able to
	 create e.g. HTML files in workspaces and archived artifacts that
	 could result in XSS when accessed by other users. Jenkins now sends
	 Content-Security-Policy headers that enables sandboxing and
	 prohibits script execution by default.
	 <h5>SECURITY-225 / CVE-2015-7537 (CSRF vulnerability in some administrative actions)</h5>
	 Several administration/configuration related URLs could be
	 accessed using GET, which allowed attackers to circumvent CSRF
	 protection.
	 <h5>SECURITY-233 / CVE-2015-7538 (CSRF protection ineffective)</h5>
	 Malicious users were able to circumvent CSRF protection on any
	 URL by sending specially crafted POST requests.
	 <h5>SECURITY-234 / CVE-2015-7539 (Jenkins plugin manager vulnerable to MITM attacks)</h5>
	 While the Jenkins update site data is digitally signed, and the
	 signature verified by Jenkins, Jenkins did not verify the provided
	 SHA-1 checksums for the plugin files referenced in the update site
	 data. This enabled MITM attacks on the plugin manager, resulting
	 in installation of attacker-provided plugins.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09</url>
 </references>
 <dates>
 <discovery>2015-12-09</discovery>
 <entry>2015-12-09</entry>
 </dates>
 </vuln>

<vuln vid="c8842a84-9ddd-11e5-8c2f-c485083ca99c">
 <topic>flash -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.554</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-32.html">
	 
	 These updates resolve heap buffer overflow vulnerabilities that
	 could lead to code execution (CVE-2015-8438, CVE-2015-8446).

These updates resolve memory corruption vulnerabilities that
	 could lead to code execution (CVE-2015-8444, CVE-2015-8443,
	 CVE-2015-8417, CVE-2015-8416, CVE-2015-8451, CVE-2015-8047,
	 CVE-2015-8053, CVE-2015-8045, CVE-2015-8051, CVE-2015-8060,
	 CVE-2015-8419, CVE-2015-8408).

These updates resolve security bypass vulnerabilities
	 (CVE-2015-8453, CVE-2015-8440, CVE-2015-8409).

These updates resolve a stack overflow vulnerability that
	 could lead to code execution (CVE-2015-8407).

These updates resolve a type confusion vulnerability that
	 could lead to code execution (CVE-2015-8439).

These updates resolve an integer overflow vulnerability
	 that could lead to code execution (CVE-2015-8445).

These updates resolve a buffer overflow vulnerability that
	 could lead to code execution (CVE-2015-8415).

These updates resolve use-after-free vulnerabilities that
	 could lead to code execution (CVE-2015-8050, CVE-2015-8049,
	 CVE-2015-8437, CVE-2015-8450, CVE-2015-8449, CVE-2015-8448,
	 CVE-2015-8436, CVE-2015-8452, CVE-2015-8048, CVE-2015-8413,
	 CVE-2015-8412, CVE-2015-8410, CVE-2015-8411, CVE-2015-8424,
	 CVE-2015-8422, CVE-2015-8420, CVE-2015-8421, CVE-2015-8423,
	 CVE-2015-8425, CVE-2015-8433, CVE-2015-8432, CVE-2015-8431,
	 CVE-2015-8426, CVE-2015-8430, CVE-2015-8427, CVE-2015-8428,
	 CVE-2015-8429, CVE-2015-8434, CVE-2015-8435, CVE-2015-8414,
	 CVE-2015-8052, CVE-2015-8059, CVE-2015-8058, CVE-2015-8055,
	 CVE-2015-8057, CVE-2015-8056, CVE-2015-8061, CVE-2015-8067,
	 CVE-2015-8066, CVE-2015-8062, CVE-2015-8068, CVE-2015-8064,
	 CVE-2015-8065, CVE-2015-8063, CVE-2015-8405, CVE-2015-8404,
	 CVE-2015-8402, CVE-2015-8403, CVE-2015-8071, CVE-2015-8401,
	 CVE-2015-8406, CVE-2015-8069, CVE-2015-8070, CVE-2015-8441,
	 CVE-2015-8442, CVE-2015-8447).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb15-32.html</url>
 <cvename>CVE-2015-8045</cvename>
 <cvename>CVE-2015-8047</cvename>
 <cvename>CVE-2015-8048</cvename>
 <cvename>CVE-2015-8049</cvename>
 <cvename>CVE-2015-8050</cvename>
 <cvename>CVE-2015-8051</cvename>
 <cvename>CVE-2015-8052</cvename>
 <cvename>CVE-2015-8053</cvename>
 <cvename>CVE-2015-8054</cvename>
 <cvename>CVE-2015-8055</cvename>
 <cvename>CVE-2015-8056</cvename>
 <cvename>CVE-2015-8057</cvename>
 <cvename>CVE-2015-8058</cvename>
 <cvename>CVE-2015-8059</cvename>
 <cvename>CVE-2015-8060</cvename>
 <cvename>CVE-2015-8061</cvename>
 <cvename>CVE-2015-8062</cvename>
 <cvename>CVE-2015-8063</cvename>
 <cvename>CVE-2015-8064</cvename>
 <cvename>CVE-2015-8065</cvename>
 <cvename>CVE-2015-8066</cvename>
 <cvename>CVE-2015-8067</cvename>
 <cvename>CVE-2015-8068</cvename>
 <cvename>CVE-2015-8069</cvename>
 <cvename>CVE-2015-8070</cvename>
 <cvename>CVE-2015-8071</cvename>
 <cvename>CVE-2015-8401</cvename>
 <cvename>CVE-2015-8402</cvename>
 <cvename>CVE-2015-8403</cvename>
 <cvename>CVE-2015-8404</cvename>
 <cvename>CVE-2015-8405</cvename>
 <cvename>CVE-2015-8406</cvename>
 <cvename>CVE-2015-8407</cvename>
 <cvename>CVE-2015-8408</cvename>
 <cvename>CVE-2015-8409</cvename>
 <cvename>CVE-2015-8410</cvename>
 <cvename>CVE-2015-8411</cvename>
 <cvename>CVE-2015-8412</cvename>
 <cvename>CVE-2015-8413</cvename>
 <cvename>CVE-2015-8414</cvename>
 <cvename>CVE-2015-8415</cvename>
 <cvename>CVE-2015-8416</cvename>
 <cvename>CVE-2015-8417</cvename>
 <cvename>CVE-2015-8419</cvename>
 <cvename>CVE-2015-8420</cvename>
 <cvename>CVE-2015-8421</cvename>
 <cvename>CVE-2015-8422</cvename>
 <cvename>CVE-2015-8423</cvename>
 <cvename>CVE-2015-8424</cvename>
 <cvename>CVE-2015-8425</cvename>
 <cvename>CVE-2015-8426</cvename>
 <cvename>CVE-2015-8427</cvename>
 <cvename>CVE-2015-8428</cvename>
 <cvename>CVE-2015-8429</cvename>
 <cvename>CVE-2015-8430</cvename>
 <cvename>CVE-2015-8431</cvename>
 <cvename>CVE-2015-8432</cvename>
 <cvename>CVE-2015-8433</cvename>
 <cvename>CVE-2015-8434</cvename>
 <cvename>CVE-2015-8435</cvename>
 <cvename>CVE-2015-8436</cvename>
 <cvename>CVE-2015-8437</cvename>
 <cvename>CVE-2015-8438</cvename>
 <cvename>CVE-2015-8439</cvename>
 <cvename>CVE-2015-8440</cvename>
 <cvename>CVE-2015-8441</cvename>
 <cvename>CVE-2015-8442</cvename>
 <cvename>CVE-2015-8443</cvename>
 <cvename>CVE-2015-8444</cvename>
 <cvename>CVE-2015-8445</cvename>
 <cvename>CVE-2015-8446</cvename>
 <cvename>CVE-2015-8447</cvename>
 <cvename>CVE-2015-8448</cvename>
 <cvename>CVE-2015-8449</cvename>
 <cvename>CVE-2015-8450</cvename>
 <cvename>CVE-2015-8451</cvename>
 <cvename>CVE-2015-8452</cvename>
 <cvename>CVE-2015-8453</cvename>
 </references>
 <dates>
 <discovery>2015-12-08</discovery>
 <entry>2015-12-08</entry>
 </dates>
 </vuln>

<vuln vid="215e740e-9c56-11e5-90e7-b499baebfeaf">
 <topic>libressl -- NULL pointer dereference</topic>
 <affects>
 <package>
	<name>libressl</name>
	<range><lt>2.2.5</lt></range>
	<range><ge>2.3.0</ge><lt>2.3.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenBSD project reports:
	<blockquote cite="https://marc.info/?l=openbsd-announce&amp;t=144920914600002">
	 A NULL pointer deference could be triggered by a crafted
	 certificate sent to services configured to verify client
	 certificates on TLS/SSL connections.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://marc.info/?l=openbsd-announce&amp;t=144920914600002</url>
 <cvename>CVE-2015-3194</cvename>
 </references>
 <dates>
 <discovery>2015-12-03</discovery>
 <entry>2015-12-08</entry>
 </dates>
 </vuln>

<vuln vid="918a5d1f-9d40-11e5-8f5c-002590263bf5">
 <topic>KeePassX -- information disclosure</topic>
 <affects>
 <package>
	<name>KeePassX</name>
	<range><lt>0.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Yves-Alexis Perez reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/4">
	 Starting an export (using File / Export to / KeepassX XML file) and
	 cancelling it leads to KeepassX saving a cleartext XML file in
	 ~/.xml without any warning.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8378</cvename>
 <freebsdpr>ports/205105</freebsdpr>
 <url>http://www.openwall.com/lists/oss-security/2015/11/30/4</url>
 </references>
 <dates>
 <discovery>2015-07-08</discovery>
 <entry>2015-12-08</entry>
 </dates>
 </vuln>

<vuln vid="84fdd1bb-9d37-11e5-8f5c-002590263bf5">
 <topic>passenger -- client controlled header overwriting</topic>
 <affects>
 <package>
	<name>rubygem-passenger</name>
	<range><ge>5.0.0</ge><lt>5.0.22</lt></range>
	<range><lt>4.0.60</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Daniel Knoppel reports:
	<blockquote cite="https://blog.phusion.nl/2015/12/07/cve-2015-7519/">
	 It was discovered by the SUSE security team that it was possible,
	 in some cases, for clients to overwrite headers set by the server,
	 resulting in a medium level security issue. CVE-2015-7519 has been
	 assigned to this issue.
	 Affected use-cases:
	 Header overwriting may occur if all of the following conditions are met:
	 <ul>
	 <li>Apache integration mode, or standalone+builtin engine without
	 a filtering proxy</li>
	 <li>Ruby or Python applications only (Passenger 5); or any
	 application (Passenger 4)</li>
	 <li>The app depends on a request header containing a dash (-)</li>
	 <li>The header is supposed to be trusted (set by the server)</li>
	 <li>The client correctly guesses the header name</li>
	 </ul>
	 This vulnerability has been fixed by filtering out client headers
	 that do not consist of alphanumeric/dash characters (Nginx already
	 did this, so Passenger+Nginx was not affected). If your application
	 depends on headers that don't conform to this, you can add a
	 workaround in Apache specifically for those to convert them to a
	 dash-based format.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7519</cvename>
 <url>https://blog.phusion.nl/2015/12/07/cve-2015-7519/</url>
 </references>
 <dates>
 <discovery>2015-12-07</discovery>
 <entry>2015-12-07</entry>
 </dates>
 </vuln>

<vuln vid="e6b974ab-9d35-11e5-8f5c-002590263bf5">
 <topic>Salt -- information disclosure</topic>
 <affects>
 <package>
	<name>py27-salt</name>
	<range><lt>2015.8.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Salt release notes report:
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html">
	 CVE-2015-8034: Saving state.sls cache data to disk with insecure
	 permissions
	 This affects users of the state.sls function. The state run cache
	 on the minion was being created with incorrect permissions. This
	 file could potentially contain sensitive data that was inserted via
	 jinja into the state SLS files. The permissions for this file are
	 now being set correctly. Thanks to @zmalone for bringing this issue
	 to our attention.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8034</cvename>
 <url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html</url>
 </references>
 <dates>
 <discovery>2015-11-25</discovery>
 <entry>2015-12-07</entry>
 </dates>
 </vuln>

<vuln vid="6bc6eed2-9cca-11e5-8c2b-c335fa8985d7">
 <topic>libraw -- memory objects not properly initialized</topic>
 <affects>
 <package>
	<name>libraw</name>
	<range><lt>0.17.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ChenQin reports:
	<blockquote cite="http://seclists.org/fulldisclosure/2015/Nov/108">
	 The LibRaw raw image decoder has multiple vulnerabilities that can
	 cause memory errors which may lead to code execution or other
	 problems.
	 In CVE-2015-8367, LibRaw's phase_one_correct function does not
	 handle memory initialization correctly, which may cause other
	 problems.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.libraw.org/news/libraw-0-17-1</url>
 <url>https://github.com/LibRaw/LibRaw/commit/490ef94d1796f730180039e80997efe5c58db780</url>
 <mlist>http://seclists.org/fulldisclosure/2015/Nov/108</mlist>
 <cvename>CVE-2015-8367</cvename>
 </references>
 <dates>
 <discovery>2015-11-30</discovery>
 <entry>2015-12-07</entry>
 </dates>
 </vuln>

<vuln vid="db04bf07-9cc8-11e5-8c2b-c335fa8985d7">
 <topic>libraw -- index overflow in smal_decode_segment</topic>
 <affects>
 <package>
	<name>libraw</name>
	<range><lt>0.17.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ChenQin reports:
	<blockquote cite="http://seclists.org/fulldisclosure/2015/Nov/108">
	 The LibRaw raw image decoder has multiple vulnerabilities that can
	 cause memory errors which may lead to code execution or other
	 problems.
	 In CVE-2015-8366, LibRaw's smal_decode_segment function does not
	 handle indexes carefully, which can cause an index overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.libraw.org/news/libraw-0-17-1</url>
 <url>https://github.com/LibRaw/LibRaw/commit/89d065424f09b788f443734d44857289489ca9e2</url>
 <mlist>http://seclists.org/fulldisclosure/2015/Nov/108</mlist>
 <cvename>CVE-2015-8366</cvename>
 </references>
 <dates>
 <discovery>2015-11-30</discovery>
 <entry>2015-12-07</entry>
 </dates>
 </vuln>

<vuln vid="4c8d1d72-9b38-11e5-aece-d050996490d0">
 <topic>openssl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2_5</lt></range>
 </package>
 <package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.2e</lt></range>
 </package>
 <package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_7</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_8</lt></range>
	<range><ge>10.1</ge><lt>10.1_25</lt></range>
	<range><ge>9.3</ge><lt>9.3_31</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv/20151203.txt">
	 <ol>
	 <li>BN_mod_exp may produce incorrect results on x86_64
	 (CVE-2015-3193)</li>
	 <li>Certificate verify crash with missing PSS parameter
	 (CVE-2015-3194)</li>
	 <li>X509_ATTRIBUTE memory leak (CVE-2015-3195)</li>
	 <li>Race condition handling PSK identify hint
	 (CVE-2015-3196)</li>
	 <li>Anon DH ServerKeyExchange with 0 p parameter
	 (CVE-2015-1794)</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-15:26.openssl</freebsdsa>
 <cvename>CVE-2015-1794</cvename>
 <cvename>CVE-2015-3193</cvename>
 <cvename>CVE-2015-3194</cvename>
 <cvename>CVE-2015-3195</cvename>
 <cvename>CVE-2015-3196</cvename>
 <url>https://www.openssl.org/news/secadv/20151203.txt</url>
 </references>
 <dates>
 <discovery>2015-12-03</discovery>
 <entry>2015-12-05</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="8a90dc87-89f9-11e5-a408-00248c0c745d">
 <topic>PHPmailer -- SMTP injection vulnerability</topic>
 <affects>
 <package>
	<name>phpmailer</name>
	<range><lt>5.2.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHPMailer changelog reports:
	<blockquote cite="https://github.com/PHPMailer/PHPMailer/blob/v5.2.14/changelog.md">
	 Fix vulnerability that allowed email addresses with
	 line breaks (valid in RFC5322) to pass to SMTP, permitting
	 message injection at the SMTP level. Mitigated in both
	 the address validator and in the lower-level SMTP class.
	 Thanks to Takeshi Terada.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/PHPMailer/PHPMailer/blob/v5.2.14/changelog.md</url>
 </references>
 <dates>
 <discovery>2015-11-05</discovery>
 <entry>2015-12-03</entry>
 </dates>
 </vuln>

<vuln vid="b0da85af-21a3-4c15-a137-fe9e4bc86002">
 <topic>ffmpeg -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libav</name>
	
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>gstreamer-ffmpeg</name>
	
	
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>handbrake</name>
	
	
	<range><lt>1.2.0</lt></range>
 </package>
 <package>
	<name>ffmpeg</name>
	<range><ge>2.8,1</ge><lt>2.8.3,1</lt></range>
	<range><lt>2.7.3,1</lt></range>
 </package>
 <package>
	<name>ffmpeg26</name>
	<range><lt>2.6.5</lt></range>
 </package>
 <package>
	<name>ffmpeg25</name>
	<range><lt>2.5.9</lt></range>
 </package>
 <package>
	<name>ffmpeg24</name>
	<range><lt>2.4.12</lt></range>
 </package>
 <package>
	<name>ffmpeg-devel</name>
	<name>ffmpeg23</name>
	<name>ffmpeg2</name>
	<name>ffmpeg1</name>
	<name>ffmpeg-011</name>
	<name>ffmpeg0</name>
	
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>avidemux</name>
	<name>avidemux2</name>
	<name>avidemux26</name>
	
	
	<range><le>2.6.11</le></range>
 </package>
 <package>
	<name>kodi</name>
	
	<range><lt>16.0</lt></range>
 </package>
 <package>
	<name>mplayer</name>
	<name>mencoder</name>
	
	<range><lt>1.1.r20150822_7</lt></range>
 </package>
 <package>
	<name>mythtv</name>
	<name>mythtv-frontend</name>
	
	<range><le>0.27.5,1</le></range>
 </package>
 <package>
	<name>plexhometheater</name>
	
	
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6761">
	 The update_dimensions function in libavcodec/vp8.c in
	 FFmpeg through 2.8.1, as used in Google Chrome before
	 46.0.2490.71 and other products, relies on a
	 coefficient-partition count during multi-threaded operation,
	 which allows remote attackers to cause a denial of service
	 (race condition and memory corruption) or possibly have
	 unspecified other impact via a crafted WebM file.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8216">
	 The ljpeg_decode_yuv_scan function in
	 libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain
	 width and height checks, which allows remote attackers to
	 cause a denial of service (out-of-bounds array access) or
	 possibly have unspecified other impact via crafted MJPEG
	 data.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8217">
	 The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in
	 FFmpeg before 2.8.2 does not validate the Chroma Format
	 Indicator, which allows remote attackers to cause a denial
	 of service (out-of-bounds array access) or possibly have
	 unspecified other impact via crafted High Efficiency Video
	 Coding (HEVC) data.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8218">
	 The decode_uncompressed function in libavcodec/faxcompr.c
	 in FFmpeg before 2.8.2 does not validate uncompressed runs,
	 which allows remote attackers to cause a denial of service
	 (out-of-bounds array access) or possibly have unspecified
	 other impact via crafted CCITT FAX data.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8219">
	 The init_tile function in libavcodec/jpeg2000dec.c in
	 FFmpeg before 2.8.2 does not enforce minimum-value and
	 maximum-value constraints on tile coordinates, which allows
	 remote attackers to cause a denial of service (out-of-bounds
	 array access) or possibly have unspecified other impact via
	 crafted JPEG 2000 data.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8363">
	 The jpeg2000_read_main_headers function in
	 libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x
	 before 2.7.3, and 2.8.x through 2.8.2 does not enforce
	 uniqueness of the SIZ marker in a JPEG 2000 image, which
	 allows remote attackers to cause a denial of service
	 (out-of-bounds heap-memory access) or possibly have
	 unspecified other impact via a crafted image with two or
	 more of these markers.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8364">
	 Integer overflow in the ff_ivi_init_planes function in
	 libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3,
	 and 2.8.x through 2.8.2 allows remote attackers to cause a
	 denial of service (out-of-bounds heap-memory access) or
	 possibly have unspecified other impact via crafted image
	 dimensions in Indeo Video Interactive data.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8365">
	 The smka_decode_frame function in libavcodec/smacker.c in
	 FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through
	 2.8.2 does not verify that the data size is consistent with
	 the number of channels, which allows remote attackers to
	 cause a denial of service (out-of-bounds array access) or
	 possibly have unspecified other impact via crafted Smacker
	 data.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-6761</cvename>
 <cvename>CVE-2015-8216</cvename>
 <cvename>CVE-2015-8217</cvename>
 <cvename>CVE-2015-8218</cvename>
 <cvename>CVE-2015-8219</cvename>
 <cvename>CVE-2015-8363</cvename>
 <cvename>CVE-2015-8364</cvename>
 <cvename>CVE-2015-8365</cvename>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=dabea74d0e82ea80cd344f630497cafcb3ef872c</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d24888ef19ba38b787b11d1ee091a3d94920c76a</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=93f30f825c08477fe8f76be00539e96014cc83c8</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d4a731b84a08f0f3839eaaaf82e97d8d9c67da46</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=43492ff3ab68a343c1264801baa1d5a02de10167</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=44a7f17d0b20e6f8d836b2957e3e357b639f19a2</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=df91aa034b82b77a3c4e01791f4a2b2ff6c82066</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=4a9af07a49295e014b059c1ab624c40345af5892</url>
 <url>https://ffmpeg.org/security.html</url>
 </references>
 <dates>
 <discovery>2015-11-27</discovery>
 <entry>2015-12-02</entry>
 <modified>2018-03-25</modified>
 </dates>
 </vuln>

<vuln vid="548f74bd-993c-11e5-956b-00262d5ed8ee">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>47.0.2526.73</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html">
	 41 security fixes in this release, including:
	 <ul>
	 <li>[558589] Critical CVE-2015-6765: Use-after-free in AppCache.
	 Credit to anonymous.</li>
	 <li>[551044] High CVE-2015-6766: Use-after-free in AppCache.
	 Credit to anonymous.</li>
	 <li>[554908] High CVE-2015-6767: Use-after-free in AppCache.
	 Credit to anonymous.</li>
	 <li>[556724] High CVE-2015-6768: Cross-origin bypass in DOM.
	 Credit to Mariusz Mlynski.</li>
	 <li>[534923] High CVE-2015-6769: Cross-origin bypass in core.
	 Credit to Mariusz Mlynski.</li>
	 <li>[541206] High CVE-2015-6770: Cross-origin bypass in DOM.
	 Credit to Mariusz Mlynski.</li>
	 <li>[544991] High CVE-2015-6771: Out of bounds access in v8.
	 Credit to anonymous.</li>
	 <li>[546545] High CVE-2015-6772: Cross-origin bypass in DOM.
	 Credit to Mariusz Mlynski.</li>
	 <li>[554946] High CVE-2015-6764: Out of bounds access in v8.
	 Credit to Guang Gong of Qihoo 360 via pwn2own.</li>
	 <li>[491660] High CVE-2015-6773: Out of bounds access in Skia.
	 Credit to cloudfuzzer.</li>
	 <li>[549251] High CVE-2015-6774: Use-after-free in Extensions.
	 Credit to anonymous.</li>
	 <li>[529012] High CVE-2015-6775: Type confusion in PDFium.
	 Credit to Atte Kettunen of OUSPG.</li>
	 <li>[457480] High CVE-2015-6776: Out of bounds access in PDFium.
	 Credit to Hanno Böck.</li>
	 <li>[544020] High CVE-2015-6777: Use-after-free in DOM.
	 Credit to Long Liu of Qihoo 360Vulcan Team.</li>
	 <li>[514891] Medium CVE-2015-6778: Out of bounds access in PDFium.
	 Credit to Karl Skomski.</li>
	 <li>[528505] Medium CVE-2015-6779: Scheme bypass in PDFium.
	 Credit to Til Jasper Ullrich.</li>
	 <li>[490492] Medium CVE-2015-6780: Use-after-free in Infobars.
	 Credit to Khalil Zhani.</li>
	 <li>[497302] Medium CVE-2015-6781: Integer overflow in Sfntly.
	 Credit to miaubiz.</li>
	 <li>[536652] Medium CVE-2015-6782: Content spoofing in Omnibox.
	 Credit to Luan Herrera.</li>
	 <li>[537205] Medium CVE-2015-6783: Signature validation issue in
	 Android Crazy Linker. Credit to Michal Bednarski.</li>
	 <li>[503217] Low CVE-2015-6784: Escaping issue in saved pages.
	 Credit to Inti De Ceukelaire.</li>
	 <li>[534542] Low CVE-2015-6785: Wildcard matching issue in CSP.
	 Credit to Michael Ficarra / Shape Security.</li>
	 <li>[534570] Low CVE-2015-6786: Scheme bypass in CSP. Credit to
	 Michael Ficarra / Shape Security.</li>
	 <li>[563930] CVE-2015-6787: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 <li> Multiple vulnerabilities in V8 fixed at the tip of the 4.7
	 branch (currently 4.7.80.23).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-6765</cvename>
 <cvename>CVE-2015-6766</cvename>
 <cvename>CVE-2015-6767</cvename>
 <cvename>CVE-2015-6768</cvename>
 <cvename>CVE-2015-6769</cvename>
 <cvename>CVE-2015-6770</cvename>
 <cvename>CVE-2015-6771</cvename>
 <cvename>CVE-2015-6772</cvename>
 <cvename>CVE-2015-6773</cvename>
 <cvename>CVE-2015-6774</cvename>
 <cvename>CVE-2015-6775</cvename>
 <cvename>CVE-2015-6776</cvename>
 <cvename>CVE-2015-6777</cvename>
 <cvename>CVE-2015-6778</cvename>
 <cvename>CVE-2015-6779</cvename>
 <cvename>CVE-2015-6780</cvename>
 <cvename>CVE-2015-6781</cvename>
 <cvename>CVE-2015-6782</cvename>
 <cvename>CVE-2015-6783</cvename>
 <cvename>CVE-2015-6784</cvename>
 <cvename>CVE-2015-6785</cvename>
 <cvename>CVE-2015-6786</cvename>
 <cvename>CVE-2015-6787</cvename>
 <url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html</url>
 </references>
 <dates>
 <discovery>2015-12-01</discovery>
 <entry>2015-12-02</entry>
 </dates>
 </vuln>

<vuln vid="11351c82-9909-11e5-a9c8-14dae9d5a9d2">
 <topic>piwik -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>piwik</name>
	<range><lt>2.15.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Piwik changelog reports:
	<blockquote cite="http://piwik.org/changelog/piwik-2-15-0/">
	 This release is rated critical.

We are grateful for Security researchers who disclosed
	 security issues privately to the Piwik Security Response
	 team: Elamaran Venkatraman, Egidio Romano and Dmitriy
	 Shcherbatov. The following vulnerabilities were fixed:
	 XSS, CSRF, possible file inclusion in older PHP versions
	 (low impact), possible Object Injection Vulnerability
	 (low impact).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7815</cvename>
 <cvename>CVE-2015-7816</cvename>
 <url>http://piwik.org/changelog/piwik-2-15-0/</url>
 </references>
 <dates>
 <discovery>2015-11-17</discovery>
 <entry>2015-12-02</entry>
 </dates>
 </vuln>

<vuln vid="d62ec98e-97d8-11e5-8c0e-080027b00c2e">
 <topic>cyrus-imapd -- integer overflow in the start_octet addition</topic>
 <affects>
 <package>
	<name>cyrus-imapd25</name>
	<range><ge>2.5.0</ge><lt>2.5.7</lt></range>
 </package>
 <package>
	<name>cyrus-imapd24</name>
	<range><ge>2.4.0</ge><lt>2.4.18_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cyrus IMAP 2.5.7 Release Note states:
	<blockquote cite="https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.7.html">
	 CVE-2015-8077, CVE-2015-8078: protect against integer overflow in urlfetch range checks
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8078</cvename>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8078</url>
 <url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8078.html</url>
 <url>https://security-tracker.debian.org/tracker/CVE-2015-8078</url>
 <cvename>CVE-2015-8077</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8077</url>
 <url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8077.html</url>
 <url>https://security-tracker.debian.org/tracker/CVE-2015-8077</url>
 </references>
 <dates>
 <discovery>2015-11-04</discovery>
 <entry>2015-12-01</entry>
 </dates>
 </vuln>

<vuln vid="11c52bc6-97aa-11e5-b8df-14dae9d210b8">
 <topic>django -- information leak vulnerability</topic>
 <affects>
 <package>
	<name>py27-django</name>
	<name>py32-django</name>
	<name>py33-django</name>
	<name>py34-django</name>
	<range><lt>1.8.7</lt></range>
 </package>
 <package>
	<name>py27-django18</name>
	<name>py32-django18</name>
	<name>py33-django18</name>
	<name>py34-django18</name>
	<range><lt>1.8.7</lt></range>
 </package>
 <package>
	<name>py27-django17</name>
	<name>py32-django17</name>
	<name>py33-django17</name>
	<name>py34-django17</name>
	<range><lt>1.7.11</lt></range>
 </package>
 <package>
	<name>py27-django-devel</name>
	<name>py32-django-devel</name>
	<name>py33-django-devel</name>
	<name>py34-django-devel</name>
	<range><le>20150709,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Graham reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/">
	 If an application allows users to specify an unvalidated
	 format for dates and passes this format to the date filter, e.g. {{
	 last_updated|date:user_date_format }}, then a malicious user could
	 obtain any secret in the application's settings by specifying a settings
	 key instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y".
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/</url>
 <cvename>CVE-2015-8213</cvename>
 </references>
 <dates>
 <discovery>2015-11-24</discovery>
 <entry>2015-11-30</entry>
 <modified>2015-12-24</modified>
 </dates>
 </vuln>

<vuln vid="fb2475c2-9125-11e5-bd18-002590263bf5">
 <topic>kibana4 -- CSRF vulnerability</topic>
 <affects>
 <package>
	<name>kibana4</name>
	<name>kibana41</name>
	<range><ge>4.0.0</ge><lt>4.1.3</lt></range>
 </package>
 <package>
	<name>kibana42</name>
	<range><ge>4.2.0</ge><lt>4.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Elastic reports:
	<blockquote cite="https://www.elastic.co/community/security/">
	 Vulnerability Summary: Kibana versions prior to 4.1.3 and 4.2.1
	 are vulnerable to a CSRF attack.
	 Remediation Summary: Users should upgrade to 4.1.3 or 4.2.1.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8131</cvename>
 <url>https://www.elastic.co/community/security/</url>
 </references>
 <dates>
 <discovery>2015-11-17</discovery>
 <entry>2015-11-22</entry>
 </dates>
 </vuln>

<vuln vid="e359051d-90bd-11e5-bd18-002590263bf5">
 <topic>a2ps -- format string vulnerability</topic>
 <affects>
 <package>
	<name>a2ps</name>
	<range><lt>4.13b_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jong-Gwon Kim reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/16/4">
	 When user runs a2ps with malicious crafted pro(a2ps prologue) file,
	 an attacker can execute arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8107</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/11/16/4</url>
 </references>
 <dates>
 <discovery>2015-11-16</discovery>
 <entry>2015-11-22</entry>
 </dates>
 </vuln>

<vuln vid="ecc268f2-8fc2-11e5-918c-bcaec565249c">
 <topic>libxslt -- DoS vulnerability due to type confusing error</topic>
 <affects>
 <package>
	<name>libsxlt</name>
	<range><lt>1.1.28_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libxslt maintainer reports:
	<blockquote cite="https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617">
	 CVE-2015-7995:
	 http://www.openwall.com/lists/oss-security/2015/10/27/10
	 We need to check that the parent node is an element before
	 dereferencing its namespace.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7995</cvename>
 <url>https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617</url>
 </references>
 <dates>
 <discovery>2015-10-29</discovery>
 <entry>2015-11-20</entry>
 </dates>
 </vuln>

<vuln vid="e5423caf-8fb8-11e5-918c-bcaec565249c">
 <topic>libxml2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.9.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	reports:
	<blockquote cite="http://xmlsoft.org/news.html">
	 CVE-2015-5312 Another entity expansion issue (David Drysdale).
	 CVE-2015-7497 Avoid an heap buffer overflow in
	 xmlDictComputeFastQKey (David Drysdale).
	 CVE-2015-7498 Avoid processing entities after encoding
	 conversion failures (Daniel Veillard).
	 CVE-2015-7499 (1) Add xmlHaltParser() to stop the parser
	 (Daniel Veillard).
	 CVE-2015-7499 (2) Detect incoherency on GROW (Daniel
	 Veillard).
	 CVE-2015-7500 Fix memory access error due to incorrect
	 entities boundaries (Daniel Veillard).
	 CVE-2015-7941 (1) Stop parsing on entities boundaries
	 errors (Daniel Veillard).
	 CVE-2015-7941 (2) Cleanup conditional section error
	 handling (Daniel Veillard).
	 CVE-2015-7942 Another variation of overflow in
	 Conditional sections (Daniel Veillard).
	 CVE-2015-7942 (2) Fix an error in previous Conditional
	 section patch (Daniel Veillard).
	 CVE-2015-8035 Fix XZ compression support loop
	 (Daniel Veillard).
	 CVE-2015-8242 Buffer overead with HTML parser in push
	 mode (Hugh Davenport)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5312</cvename>
 <cvename>CVE-2015-7497</cvename>
 <cvename>CVE-2015-7498</cvename>
 <cvename>CVE-2015-7499</cvename>
 <cvename>CVE-2015-7500</cvename>
 <cvename>CVE-2015-7941</cvename>
 <cvename>CVE-2015-7942</cvename>
 <cvename>CVE-2015-8035</cvename>
 <cvename>CVE-2015-8241</cvename>
 <cvename>CVE-2015-8242</cvename>
 <url>http://xmlsoft.org/news.html</url>
 <url>http://www.openwall.com/lists/oss-security/2015/11/18/23</url>
 </references>
 <dates>
 <discovery>2015-11-20</discovery>
 <entry>2015-11-20</entry>
 </dates>
 </vuln>

<vuln vid="9d04936c-75f1-4a2c-9ade-4c1708be5df9">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>nspr</name>
	<range><lt>4.10.10</lt></range>
 </package>
 <package>
	<name>linux-c6-nspr</name>
	<range><lt>4.10.10</lt></range>
 </package>
 <package>
	<name>nss</name>
	<range><ge>3.20</ge><lt>3.20.1</lt></range>
	<range><ge>3.19.3</ge><lt>3.19.4</lt></range>
	<range><lt>3.19.2.1</lt></range>
 </package>
 <package>
	<name>firefox</name>
	<range><lt>42.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>42.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.39</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.39</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>38.4.0,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>38.4.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>38.4.0</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>38.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	 MFSA 2015-133 NSS and NSPR memory corruption issues
	 MFSA 2015-132 Mixed content WebSocket policy bypass
	 through workers
	 MFSA 2015-131 Vulnerabilities found through code
	 inspection
	 MFSA 2015-130 JavaScript garbage collection crash with
	 Java applet
	 MFSA 2015-129 Certain escaped characters in host of
	 Location-header are being treated as non-escaped
	 MFSA 2015-128 Memory corruption in libjar through zip
	 files
	 MFSA 2015-127 CORS preflight is bypassed when
	 non-standard Content-Type headers are received
	 MFSA 2015-126 Crash when accessing HTML tables with
	 accessibility tools on OS X
	 MFSA 2015-125 XSS attack through intents on Firefox for
	 Android
	 MFSA 2015-124 Android intents can be used on Firefox for
	 Android to open privileged files
	 MFSA 2015-123 Buffer overflow during image interactions
	 in canvas
	 MFSA 2015-122 Trailing whitespace in IP address hostnames
	 can bypass same-origin policy
	 MFSA 2015-121 Disabling scripts in Add-on SDK panels has
	 no effect
	 MFSA 2015-120 Reading sensitive profile files through
	 local HTML file on Android
	 MFSA 2015-119 Firefox for Android addressbar can be
	 removed after fullscreen mode
	 MFSA 2015-118 CSP bypass due to permissive Reader mode
	 whitelist
	 MFSA 2015-117 Information disclosure through NTLM
	 authentication
	 MFSA 2015-116 Miscellaneous memory safety hazards
	 (rv:42.0 / rv:38.4)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4513</cvename>
 <cvename>CVE-2015-4514</cvename>
 <cvename>CVE-2015-4515</cvename>
 <cvename>CVE-2015-4518</cvename>
 <cvename>CVE-2015-7181</cvename>
 <cvename>CVE-2015-7182</cvename>
 <cvename>CVE-2015-7183</cvename>
 <cvename>CVE-2015-7185</cvename>
 <cvename>CVE-2015-7186</cvename>
 <cvename>CVE-2015-7187</cvename>
 <cvename>CVE-2015-7188</cvename>
 <cvename>CVE-2015-7189</cvename>
 <cvename>CVE-2015-7190</cvename>
 <cvename>CVE-2015-7191</cvename>
 <cvename>CVE-2015-7192</cvename>
 <cvename>CVE-2015-7193</cvename>
 <cvename>CVE-2015-7194</cvename>
 <cvename>CVE-2015-7195</cvename>
 <cvename>CVE-2015-7196</cvename>
 <cvename>CVE-2015-7197</cvename>
 <cvename>CVE-2015-7198</cvename>
 <cvename>CVE-2015-7199</cvename>
 <cvename>CVE-2015-7200</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-116/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-117/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-118/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-119/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-120/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-121/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-122/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-123/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-124/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-125/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-126/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-127/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-128/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-129/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-130/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-131/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-132/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-133/</url>
 </references>
 <dates>
 <discovery>2015-11-03</discovery>
 <entry>2015-11-19</entry>
 <modified>2016-04-13</modified>
 </dates>
 </vuln>

<vuln vid="68847b20-8ddc-11e5-b69c-c86000169601">
 <topic>gdm -- lock screen bypass when holding escape key</topic>
 <affects>
 <package>
	<name>gdm</name>
	<range><lt>3.16.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ray Strode reports:
	<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2015-November/msg00074.html">
	 CVE-2015-7496 - lock screen bypass when holding escape key.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7496</cvename>
 <url>https://mail.gnome.org/archives/ftp-release-list/2015-November/msg00074.html</url>
 <url>https://bugzilla.gnome.org/show_bug.cgi?id=758032</url>
 </references>
 <dates>
 <discovery>2015-11-12</discovery>
 <entry>2015-11-18</entry>
 </dates>
 </vuln>

<vuln vid="3eb0ccc2-8c6a-11e5-8519-005056ac623e">
 <topic>strongswan -- authentication bypass vulnerability in the eap-mschapv2 plugin</topic>
 <affects>
 <package>
	<name>strongswan</name>
	<range><lt>5.3.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Strongswan Release Notes reports:
	<blockquote cite="https://github.com/strongswan/strongswan/blob/master/NEWS">
	 Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin that
	 was caused by insufficient verification of the internal state when handling
	 MSCHAPv2 Success messages received by the client.
	 This vulnerability has been registered as CVE-2015-8023.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8023</cvename>
 <url>https://github.com/strongswan/strongswan/commit/453e204ac40dfff2e0978e8f84a5f8ff0cbc45e2</url>
 </references>
 <dates>
 <discovery>2015-11-16</discovery>
 <entry>2015-11-16</entry>
 </dates>
 </vuln>

<vuln vid="82b3ca2a-8c07-11e5-bd18-002590263bf5">
 <topic>moodle -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moodle27</name>
	<range><lt>2.7.11</lt></range>
 </package>
 <package>
	<name>moodle28</name>
	<range><lt>2.8.9</lt></range>
 </package>
 <package>
	<name>moodle29</name>
	<range><lt>2.9.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Moodle Release Notes report:
	<blockquote cite="https://docs.moodle.org/dev/Moodle_2.9.3_release_notes">
	 MSA-15-0037 Possible to send a message to a user who blocked
	 messages from non contacts
	 MSA-15-0038 DDoS possibility in Atto
	 MSA-15-0039 CSRF in site registration form
	 MSA-15-0040 Student XSS in survey
	 MSA-15-0041 XSS in flash video player
	 MSA-15-0042 CSRF in lesson login form
	 MSA-15-0043 Web service core_enrol_get_enrolled_users does not
	 respect course group mode
	 MSA-15-0044 Capability to view available badges is not
	 respected
	 MSA-15-0045 SCORM module allows to bypass access restrictions based
	 on date
	 MSA-15-0046 Choice module closing date can be bypassed
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.moodle.org/dev/Moodle_2.7.11_release_notes</url>
 <url>https://docs.moodle.org/dev/Moodle_2.8.9_release_notes</url>
 <url>https://docs.moodle.org/dev/Moodle_2.9.3_release_notes</url>
 </references>
 <dates>
 <discovery>2015-11-09</discovery>
 <entry>2015-11-16</entry>
 <modified>2015-12-21</modified>
 </dates>
 </vuln>

<vuln vid="2cabfbab-8bfb-11e5-bd18-002590263bf5">
 <topic>xen-kernel -- CPU lockup during exception delivery</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-156.html">
	 A malicious HVM guest administrator can cause a denial of service.
	 Specifically, prevent use of a physical CPU for a significant,
	 perhaps indefinite period. If a host watchdog (Xen or dom0) is in
	 use, this can lead to a watchdog timeout and consequently a reboot
	 of the host. If another, innocent, guest, is configured with a
	 watchdog, this issue can lead to a reboot of such a guest.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5307</cvename>
 <cvename>CVE-2015-8104</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-156.html</url>
 </references>
 <dates>
 <discovery>2015-11-10</discovery>
 <entry>2015-11-16</entry>
 </dates>
 </vuln>

<vuln vid="1886e195-8b87-11e5-90e7-b499baebfeaf">
 <topic>libpng buffer overflow in png_set_PLTE</topic>
 <affects>
 <package>
 <name>png</name>
 <range><lt>1.6.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 libpng reports:
 <blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/12/2">
 CVE for a vulnerability in libpng, all versions, in the
 png_set_PLTE/png_get_PLTE functions. These functions failed to check for
 an out-of-range palette when reading or writing PNG files with a bit_depth
 less than 8. Some applications might read the bit depth from the IHDR
 chunk and allocate memory for a 2^N entry palette, while libpng can return
 a palette with up to 256 entries even when the bit depth is less than 8.
 </blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2015/11/12/2</url>
 <url>http://www.openwall.com/lists/oss-security/2015/12/03/6</url>
 <cvename>CVE-2015-8126</cvename>
 <cvename>CVE-2015-8472</cvename>
 </references>
 <dates>
 <discovery>2015-11-15</discovery>
 <entry>2015-11-15</entry>
 <modified>2015-12-08</modified>
 </dates>
 </vuln>

<vuln vid="547fbd98-8b1f-11e5-b48b-bcaec565249c">
 <topic>flash -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.548</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-28.html">
	 These updates resolve a type confusion vulnerability that
	 could lead to code execution (CVE-2015-7659).

These updates resolve a security bypass vulnerability that
	 could be exploited to write arbitrary data to the file
	 system under user permissions (CVE-2015-7662).

These updates resolve use-after-free vulnerabilities that
	 could lead to code execution (CVE-2015-7651, CVE-2015-7652,
	 CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656,
	 CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661,
	 CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044,
	 CVE-2015-8046).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb15-28.html</url>
 <cvename>CVE-2015-7651</cvename>
 <cvename>CVE-2015-7652</cvename>
 <cvename>CVE-2015-7653</cvename>
 <cvename>CVE-2015-7654</cvename>
 <cvename>CVE-2015-7655</cvename>
 <cvename>CVE-2015-7656</cvename>
 <cvename>CVE-2015-7657</cvename>
 <cvename>CVE-2015-7658</cvename>
 <cvename>CVE-2015-7659</cvename>
 <cvename>CVE-2015-7660</cvename>
 <cvename>CVE-2015-7661</cvename>
 <cvename>CVE-2015-7662</cvename>
 <cvename>CVE-2015-7663</cvename>
 <cvename>CVE-2015-8043</cvename>
 <cvename>CVE-2015-8044</cvename>
 <cvename>CVE-2015-8046</cvename>
 </references>
 <dates>
 <discovery>2015-11-10</discovery>
 <entry>2015-11-14</entry>
 </dates>
 </vuln>

<vuln vid="f0b9049f-88c4-11e5-aed7-00262d5ed8ee">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>46.0.2490.86</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/11/stable-channel-update.html">
	 [520422] High CVE-2015-1302: Information leak in PDF viewer.
	 Credit to Rob Wu.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1302</cvename>
 <url>http://googlechromereleases.blogspot.nl/2015/11/stable-channel-update.html</url>
 </references>
 <dates>
 <discovery>2015-11-10</discovery>
 <entry>2015-11-11</entry>
 </dates>
 </vuln>

<vuln vid="851a0eea-88aa-11e5-90e7-b499baebfeaf">
 <topic>MySQL - Multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>mariadb-client</name>
 <range><lt>5.3.13</lt></range>
 </package>
 <package>
 <name>mariadb-server</name>
 <range><lt>5.3.13</lt></range>
 </package>
 <package>
 <name>mariadb55-client</name>
 <range><lt>5.5.46</lt></range>
 </package>
 <package>
 <name>mariadb55-server</name>
 <range><lt>5.5.46</lt></range>
 </package>
 <package>
 <name>mariadb100-client</name>
 <range><lt>10.0.22</lt></range>
 </package>
 <package>
 <name>mariadb100-server</name>
 <range><lt>10.0.22</lt></range>
 </package>
 <package>
 <name>mysql55-client</name>
 <range><lt>5.5.46</lt></range>
 </package>
 <package>
 <name>mysql55-server</name>
 <range><lt>5.5.46</lt></range>
 </package>
 <package>
 <name>mysql56-client</name>
 <range><lt>5.6.27</lt></range>
 </package>
 <package>
 <name>mysql56-server</name>
 <range><lt>5.6.27</lt></range>
 </package>
 <package>
 <name>percona55-client</name>
 <range><lt>5.5.46</lt></range>
 </package>
 <package>
 <name>percona55-server</name>
 <range><lt>5.5.46</lt></range>
 </package>
 <package>
 <name>percona56-client</name>
 <range><lt>5.6.27</lt></range>
 </package>
 <package>
 <name>percona56-server</name>
 <range><lt>5.6.27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Oracle reports:
 <blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html">
 Critical Patch Update: MySQL Server, version(s) 5.5.45 and prior, 5.6.26 and prior
 </blockquote>
 </body>
 </description>
 <references>
 <url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html</url>
 <cvename>CVE-2015-4802</cvename>
 <cvename>CVE-2015-4807</cvename>
 <cvename>CVE-2015-4815</cvename>
 <cvename>CVE-2015-4826</cvename>
 <cvename>CVE-2015-4830</cvename>
 <cvename>CVE-2015-4836</cvename>
 <cvename>CVE-2015-4858</cvename>
 <cvename>CVE-2015-4861</cvename>
 <cvename>CVE-2015-4870</cvename>
 <cvename>CVE-2015-4913</cvename>
 <cvename>CVE-2015-4792</cvename>
 <url>https://mariadb.com/kb/en/mariadb/mariadb-5546-release-notes/</url>
 <url>https://mariadb.com/kb/en/mariadb/mariadb-10022-release-notes/</url>
 <url>https://www.percona.com/doc/percona-server/5.5/release-notes/Percona-Server-5.5.46-37.5.html</url>
 <url>https://www.percona.com/doc/percona-server/5.6/release-notes/Percona-Server-5.6.27-75.0.html</url>
 </references>
 <dates>
 <discovery>2015-11-10</discovery>
 <entry>2015-11-11</entry>
 </dates>
 </vuln>

<vuln vid="b665668a-91db-4f13-8113-9e4b5b0e47f7">
 <topic>jenkins -- remote code execution via unsafe deserialization</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>1.638</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>1.625.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Developers report:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11">
	 Unsafe deserialization allows unauthenticated remote attackers to
	 run arbitrary code on the Jenkins master.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11</url>
 <url>https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli</url>
 <url>http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#thefix</url>
 </references>
 <dates>
 <discovery>2015-11-06</discovery>
 <entry>2015-11-11</entry>
 </dates>
 </vuln>

<vuln vid="71af4ded-8864-11e5-af1b-001999f8d30b">
 <topic>owncloudclient -- Improper validation of certificates when using self-signed certificates</topic>
 <affects>
 <package>
	<name>owncloudclient</name>
	<range><lt>2.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	owncloud.org reports:
	<blockquote cite="https://owncloud.org/security/advisory/?id=oc-sa-2015-016">
	 The ownCloud Desktop Client was vulnerable against MITM attacks until version 2.0.0 in combination with self-signed certificates.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://owncloud.org/security/advisory/?id=oc-sa-2015-016</url>
 <cvename>CVE-2015-7298</cvename>
 </references>
 <dates>
 <discovery>2015-09-21</discovery>
 <entry>2015-11-11</entry>
 </dates>
 </vuln>

<vuln vid="c0e76d33-8821-11e5-ab94-002590263bf5">
 <topic>xen-tools -- populate-on-demand balloon size inaccuracy can crash guests</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><ge>3.4</ge><lt>4.5.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-153.html">
	 Guests configured with PoD might be unstable, especially under
	 load. In an affected guest, an unprivileged guest user might be
	 able to cause a guest crash, perhaps simply by applying load so
	 as to cause heavy memory pressure within the guest.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7972</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-153.html</url>
 </references>
 <dates>
 <discovery>2015-10-29</discovery>
 <entry>2015-11-11</entry>
 </dates>
 </vuln>

<vuln vid="e4848ca4-8820-11e5-ab94-002590263bf5">
 <topic>xen-kernel -- some pmu and profiling hypercalls log without rate limiting</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><ge>3.2</ge><lt>4.5.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-152.html">
	 HYPERCALL_xenoprof_op and HYPERVISOR_xenpmu_op log some errors and
	 attempts at invalid operations. These log messages are not
	 rate-limited, even though they can be triggered by guests.
	 A malicious guest could cause repeated logging to the hypervisor
	 console, leading to a Denial of Service attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7971</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-152.html</url>
 </references>
 <dates>
 <discovery>2015-10-29</discovery>
 <entry>2015-11-11</entry>
 </dates>
 </vuln>

<vuln vid="e3792855-881f-11e5-ab94-002590263bf5">
 <topic>xen-kernel -- leak of per-domain profiling-related vcpu pointer array</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><ge>4.0</ge><lt>4.5.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-151.html">
	 A domain's xenoprofile state contains an array of per-vcpu
	 information... This array is leaked on domain teardown. This memory
	 leak could -- over time -- exhaust the host's memory.
	 The following parties can mount a denial of service attack
	 affecting the whole system:
	 <ul>
	 <li>A malicious guest administrator via XENOPROF_get_buffer.</li>
	 <li>A domain given suitable privilege over another domain via
	 XENOPROF_set_passive (this would usually be a domain being
	 used to profile another domain, eg with the xenoprof tool).</li>
	 </ul>
	 The ability to also restart or create suitable domains is also
	 required to fully exploit the issue. Without this the leak is
	 limited to a small multiple of the maximum number of vcpus for the
	 domain.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7969</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-151.html</url>
 </references>
 <dates>
 <discovery>2015-10-29</discovery>
 <entry>2015-11-11</entry>
 </dates>
 </vuln>

<vuln vid="83350009-881e-11e5-ab94-002590263bf5">
 <topic>xen-kernel -- Long latency populate-on-demand operation is not preemptible</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><ge>3.4</ge><lt>4.5.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-150.html">
	 When running an HVM domain in Populate-on-Demand mode, Xen would
	 sometimes search the domain for memory to reclaim, in response to
	 demands for population of other pages in the same domain. This
	 search runs without preemption. The guest can, by suitable
	 arrangement of its memory contents, create a situation where this
	 search is a time-consuming linear scan of the guest's address
	 space.
	 A malicious HVM guest administrator can cause a denial of service.
	 Specifically, prevent use of a physical CPU for a significant
	 period.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7970</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-150.html</url>
 </references>
 <dates>
 <discovery>2015-10-29</discovery>
 <entry>2015-11-11</entry>
 </dates>
 </vuln>

<vuln vid="fc1f8795-881d-11e5-ab94-002590263bf5">
 <topic>xen-kernel -- leak of main per-domain vcpu pointer array</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.5.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-149.html">
	 A domain's primary array of vcpu pointers can be allocated by a
	 toolstack exactly once in the lifetime of a domain via the
	 XEN_DOMCTL_max_vcpus hypercall. This array is leaked on domain
	 teardown. This memory leak could -- over time -- exhaust the host's
	 memory.
	 A domain given partial management control via XEN_DOMCTL_max_vcpus
	 can mount a denial of service attack affecting the whole system. The
	 ability to also restart or create suitable domains is also required
	 to fully exploit the issue. Without this the leak is limited to a
	 small multiple of the maximum number of vcpus for the domain. The
	 maximum leak is 64kbytes per domain (re)boot (less on ARM).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7969</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-149.html</url>
 </references>
 <dates>
 <discovery>2015-10-29</discovery>
 <entry>2015-11-11</entry>
 </dates>
 </vuln>

<vuln vid="3d9f6260-881d-11e5-ab94-002590263bf5">
 <topic>xen-kernel -- Uncontrolled creation of large page mappings by PV guests</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><ge>3.4</ge><lt>4.5.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-148.html">
	 The code to validate level 2 page table entries is bypassed when
	 certain conditions are satisfied. This means that a PV guest can
	 create writable mappings using super page mappings. Such writable
	 mappings can violate Xen intended invariants for pages which Xen is
	 supposed to keep read-only. This is possible even if the
	 "allowsuperpage" command line option is not used.
	 Malicious PV guest administrators can escalate privilege so as to
	 control the whole system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7835</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-148.html</url>
 </references>
 <dates>
 <discovery>2015-10-29</discovery>
 <entry>2015-11-11</entry>
 </dates>
 </vuln>

<vuln vid="301b04d7-881c-11e5-ab94-002590263bf5">
 <topic>xen-tools -- libxl fails to honour readonly flag on disks with qemu-xen</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><ge>4.1</ge><lt>4.5.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-142.html">
	 Callers of libxl can specify that a disk should be read-only to the
	 guest. However, there is no code in libxl to pass this information
	 to qemu-xen (the upstream-based qemu); and indeed there is no way in
	 qemu to make a disk read-only.
	 The vulnerability is exploitable only via devices emulated by the
	 device model, not the parallel PV devices for supporting PVHVM.
	 Normally the PVHVM device unplug protocol renders the emulated
	 devices inaccessible early in boot.
	 Malicious guest administrators or (in some situations) users may be
	 able to write to supposedly read-only disk images.
	 CDROM devices (that is, devices specified to be presented to the
	 guest as CDROMs, regardless of the nature of the backing storage on
	 the host) are not affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7311</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-142.html</url>
 </references>
 <dates>
 <discovery>2015-09-22</discovery>
 <entry>2015-11-11</entry>
 </dates>
 </vuln>

<vuln vid="2f7f4db2-8819-11e5-ab94-002590263bf5">
 <topic>p5-HTML-Scrubber -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>p5-HTML-Scrubber</name>
	<range><lt>0.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5667">
	 Cross-site scripting (XSS) vulnerability in the HTML-Scrubber
	 module before 0.15 for Perl, when the comment feature is enabled,
	 allows remote attackers to inject arbitrary web script or HTML via
	 a crafted comment.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5667</cvename>
 <url>https://metacpan.org/release/HTML-Scrubber</url>
 <url>http://jvndb.jvn.jp/jvndb/JVNDB-2015-000171</url>
 <url>http://jvn.jp/en/jp/JVN53973084/index.html</url>
 </references>
 <dates>
 <discovery>2015-10-10</discovery>
 <entry>2015-11-11</entry>
 </dates>
 </vuln>

<vuln vid="6ca7eddd-d436-486a-b169-b948436bcf14">
 <topic>libvpx -- buffer overflow in vp9_init_context_buffers</topic>
 <affects>
 <package>
	<name>libvpx</name>
	<range><lt>1.4.0.488_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/security/advisories/mfsa2015-101/">
	 Security researcher Khalil Zhani reported that a
	 maliciously crafted vp9 format video could be used to
	 trigger a buffer overflow while parsing the file. This leads
	 to a potentially exploitable crash due to a flaw in the
	 libvpx library.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4506</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-101/</url>
 </references>
 <dates>
 <discovery>2015-09-22</discovery>
 <entry>2015-11-10</entry>
 </dates>
 </vuln>

<vuln vid="56665ccb-8723-11e5-9b13-14dae9d210b8">
 <topic>powerdns -- Denial of Service</topic>
 <affects>
 <package>
	<name>powerdns</name>
	<range><ge>3.4.4</ge><lt>3.4.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS reports:
	<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/">
	 A bug was found using afl-fuzz in our packet parsing code.
	 This bug, when exploited, causes an assertion error and consequent
	 termination of the the pdns_server process, causing a Denial of Service.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/</url>
 <cvename>CVE-2015-5311</cvename>
 </references>
 <dates>
 <discovery>2015-11-03</discovery>
 <entry>2015-11-09</entry>
 </dates>
 </vuln>

<vuln vid="0cb0afd9-86b8-11e5-bf60-080027ef73ec">
 <topic>PuTTY -- memory corruption in terminal emulator's erase character handling</topic>
 <affects>
 <package>
	<name>putty</name>
	<range><ge>0.54</ge><lt>0.66</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ben Harris reports:
	<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html">
	 Versions of PuTTY and pterm between 0.54 and 0.65 inclusive have a
	 potentially memory-corrupting integer overflow in the handling of
	 the ECH (erase characters) control sequence in the terminal
	 emulator.
	 To exploit a vulnerability in the terminal emulator, an attacker
	 must be able to insert a carefully crafted escape sequence into the
	 terminal stream. For a PuTTY SSH session, this must be before
	 encryption, so the attacker likely needs access to the server you're
	 connecting to. For instance, an attacker on a multi-user machine
	 that you connect to could trick you into running cat on a file they
	 control containing a malicious escape sequence. (Unix write(1) is
	 not a vector for this, if implemented correctly.)
	 Only PuTTY, PuTTYtel, and pterm are affected; other PuTTY tools do
	 not include the terminal emulator, so cannot be exploited this
	 way.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html</url>
 <cvename>CVE-2015-5309</cvename>
 </references>
 <dates>
 <discovery>2015-11-06</discovery>
 <entry>2015-11-09</entry>
 </dates>
 </vuln>

<vuln vid="18b3c61b-83de-11e5-905b-ac9e174be3af">
 <topic>OpenOffice 4.1.1 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache-openoffice</name>
	<range><lt>4.1.2</lt></range>
 </package>
 <package>
	<name>apache-openoffice-devel</name>
	<range><lt>4.2.1705368,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache OpenOffice Project reports:
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-4551.html">
	 A vulnerability in OpenOffice settings of OpenDocument Format
	 files and templates allows silent access to files that are
	 readable from an user account, over-riding the user's default
	 configuration settings. Once these files are imported into a
	 maliciously-crafted document, the data can be silently hidden
	 in the document and possibly exported to an external party
	 without being observed. 
	</blockquote>
	The Apache OpenOffice Project reports:
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5212.html">
	 A crafted ODF document can be used to create a buffer that is
	 too small for the amount of data loaded into it, allowing an
	 attacker to cause denial of service (memory corruption and
	 application crash) and possible execution of arbitrary code.
	</blockquote>
	The Apache OpenOffice Project reports:
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5213.html">
	 A crafted Microsoft Word DOC file can be used to specify a
	 document buffer that is too small for the amount of data
	 provided for it. Failure to detect the discrepancy allows an
	 attacker to cause denial of service (memory corruption and
	 application crash) and possible execution of arbitrary code.
	</blockquote>
	The Apache OpenOffice Project reports:
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5214.html">
	 A crafted Microsoft Word DOC can contain invalid bookmark
	 positions leading to memory corruption when the document is
	 loaded or bookmarks are manipulated. The defect allows an
	 attacker to cause denial of service (memory corruption and
	 application crash) and possible execution of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4551</cvename>
 <url>http://www.openoffice.org/security/cves/CVE-2015-4551.html</url>
 <cvename>CVE-2015-5212</cvename>
 <url>http://www.openoffice.org/security/cves/CVE-2015-5212.html</url>
 <cvename>CVE-2015-5213</cvename>
 <url>http://www.openoffice.org/security/cves/CVE-2015-5213.html</url>
 <cvename>CVE-2015-5214</cvename>
 <url>http://www.openoffice.org/security/cves/CVE-2015-5214.html</url>
 </references>
 <dates>
 <discovery>2015-11-04</discovery>
 <entry>2015-11-05</entry>
 <modified>2015-11-05</modified>
 </dates>
 </vuln>

<vuln vid="698403a7-803d-11e5-ab94-002590263bf5">
 <topic>codeigniter -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>codeigniter</name>
	<range><lt>2.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The CodeIgniter changelog reports:
	<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
	 Fixed an XSS attack vector in Security Library method
	 xss_clean().
	 Changed Config Library method base_url() to fallback to
	 ``$_SERVER['SERVER_ADDR']`` in order to avoid Host header
	 injections.
	 Changed CAPTCHA Helper to try to use the operating system's PRNG
	 first.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/203403</freebsdpr>
 <url>https://codeigniter.com/userguide2/changelog.html</url>
 </references>
 <dates>
 <discovery>2015-10-31</discovery>
 <entry>2015-11-01</entry>
 </dates>
 </vuln>

<vuln vid="017a493f-7db6-11e5-a762-14dae9d210b8">
 <topic>openafs -- information disclosure</topic>
 <affects>
 <package>
	<name>openafs</name>
	<range><lt>1.6.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenAFS development team reports:
	<blockquote cite="http://openafs.org/pages/security/OPENAFS-SA-2015-007.txt">
	 When constructing an Rx acknowledgment (ACK) packet, Andrew-derived Rx
	 implementations do not initialize three octets of data that are padding
	 in the C language structure and were inadvertently included in the wire
	 protocol (CVE-2015-7762). Additionally, OpenAFS Rx in versions 1.5.75
	 through 1.5.78, 1.6.0 through 1.6.14, and 1.7.0 through 1.7.32 include
	 a variable-length padding at the end of the ACK packet, in an attempt to
	 detect the path MTU, but only four octets of the additional padding are
	 initialized (CVE-2015-7763).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://openafs.org/pages/security/OPENAFS-SA-2015-007.txt</url>
 <cvename>CVE-2015-7762</cvename>
 <cvename>CVE-2015-7763</cvename>
 </references>
 <dates>
 <discovery>2015-10-28</discovery>
 <entry>2015-10-28</entry>
 </dates>
 </vuln>

<vuln vid="4b9393b8-7c0c-11e5-a010-080027ddead3">
 <topic>xscreensaver - lock bypass</topic>
 <affects>
 <package>
	<name>xscreensaver</name>
	<name>xscreensaver-gnome</name>
	<name>xscreensaver-gnome-hacks</name>
	<range><lt>5.34</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RedHat bugzilla reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1274452">
	 In dual screen configurations, unplugging one screen will cause
	 xscreensaver to crash, leaving the screen unlocked.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.jwz.org/xscreensaver/changelog.html</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1274452</url>
 <cvename>CVE-2015-8025</cvename>
 </references>
 <dates>
 <discovery>2015-10-24</discovery>
 <entry>2015-10-27</entry>
 <modified>2015-11-04</modified>
 </dates>
 </vuln>

<vuln vid="2a4a112a-7c1b-11e5-bd77-0800275369e2">
 <topic>lldpd -- Buffer overflow/Denial of service</topic>
 <affects>
 <package>
	<name>lldpd</name>
	<range><ge>0.5.6</ge><lt>0.7.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The lldpd developer Vincent Bernat reports:
	<blockquote cite="https://github.com/vincentbernat/lldpd/raw/0.7.19/NEWS">
	 A buffer overflow may allow arbitrary code execution
	 only if hardening was disabled.
	</blockquote>
	<blockquote cite="https://github.com/vincentbernat/lldpd/commit/793526f8884455f43daecd0a2c46772388417a00">
	 Malformed packets should not make lldpd crash. Ensure we can
	 handle them by not using assert() in this part.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8011</cvename>
 <cvename>CVE-2015-8012</cvename>
 <url>https://github.com/vincentbernat/lldpd/raw/0.7.19/NEWS</url>
 <url>http://www.openwall.com/lists/oss-security/2015/10/30/2</url>
 </references>
 <dates>
 <discovery>2015-10-04</discovery>
 <entry>2015-10-26</entry>
 <modified>2015-11-10</modified>
 </dates>
 </vuln>

<vuln vid="24e4d383-7b3e-11e5-a250-68b599b52a02">
 <topic>wireshark -- Pcapng file parser crash</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>wireshark-qt5</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>1.12.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wireshark development team reports:
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.8.html">
	 The following vulnerability has been fixed.
	 <ul>
	 <li>wnpa-sec-2015-30
	 Pcapng file parser crash. (Bug 11455)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.8.html</url>
 <cvename>CVE-2015-7830</cvename>
 </references>
 <dates>
 <discovery>2015-10-14</discovery>
 <entry>2015-10-25</entry>
 </dates>
 </vuln>

<vuln vid="0ebc6e78-7ac6-11e5-b35a-002590263bf5">
 <topic>Joomla! -- Core - SQL Injection/ACL Violation vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><ge>3.2.0</ge><lt>3.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html">
	 <h2>[20151001] - Core - SQL Injection</h2>
	 Inadequate filtering of request data leads to a SQL Injection
	 vulnerability.
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security-centre/629-20151002-core-acl-violations.html">
	 <h2>[20151002] - Core - ACL Violations</h2>
	 Inadequate ACL checks in com_contenthistory provide potential read
	 access to data which should be access restricted.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7297</cvename>
 <cvename>CVE-2015-7857</cvename>
 <cvename>CVE-2015-7858</cvename>
 <cvename>CVE-2015-7859</cvename>
 <url>http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html</url>
 <url>http://developer.joomla.org/security-centre/629-20151002-core-acl-violations.html</url>
 <url>https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html</url>
 </references>
 <dates>
 <discovery>2015-10-22</discovery>
 <entry>2015-10-25</entry>
 </dates>
 </vuln>

<vuln vid="03e54e42-7ac6-11e5-b35a-002590263bf5">
 <topic>Joomla! -- Core - ACL Violation vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><ge>3.0.0</ge><lt>3.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="http://developer.joomla.org/security-centre/630-20151003-core-acl-violations.html">
	 <h2>[20151003] - Core - ACL Violations</h2>
	 Inadequate ACL checks in com_content provide potential read access
	 to data which should be access restricted.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7899</cvename>
 <url>http://developer.joomla.org/security-centre/630-20151003-core-acl-violations.html</url>
 <url>https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html</url>
 </references>
 <dates>
 <discovery>2015-10-22</discovery>
 <entry>2015-10-25</entry>
 </dates>
 </vuln>

<vuln vid="f8c37915-7ac5-11e5-b35a-002590263bf5">
 <topic>Joomla! -- Core - XSS Vulnerability</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><ge>3.4.0</ge><lt>3.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerability.html">
	 <h2>[20150908] - Core - XSS Vulnerability</h2>
	 Inadequate escaping leads to XSS vulnerability in login module.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-6939</cvename>
 <url>http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerability.html</url>
 <url>https://www.joomla.org/announcements/release-news/5628-joomla-3-4-4-released.html</url>
 </references>
 <dates>
 <discovery>2015-09-08</discovery>
 <entry>2015-10-25</entry>
 </dates>
 </vuln>

<vuln vid="ec2d1cfd-7ac5-11e5-b35a-002590263bf5">
 <topic>Joomla! -- Core - CSRF Protection vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><ge>3.2.0</ge><lt>3.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="http://developer.joomla.org/security-centre/618-20150602-core-remote-code-execution.html">
	 <h2>[20150602] - Core - CSRF Protection</h2>
	 Lack of CSRF checks potentially enabled uploading malicious code.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5397</cvename>
 <url>http://developer.joomla.org/security-centre/618-20150602-core-remote-code-execution.html</url>
 <url>https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html</url>
 </references>
 <dates>
 <discovery>2015-06-30</discovery>
 <entry>2015-10-25</entry>
 </dates>
 </vuln>

<vuln vid="deaba148-7ac5-11e5-b35a-002590263bf5">
 <topic>Joomla! -- Core - Open Redirect vulnerability</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><ge>3.0.0</ge><lt>3.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="http://developer.joomla.org/security-centre/617-20150601-core-open-redirect.html">
	 <h2>[20150601] - Core - Open Redirect</h2>
	 Inadequate checking of the return value allowed to redirect to an
	 external page.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5608</cvename>
 <url>http://developer.joomla.org/security-centre/617-20150601-core-open-redirect.html</url>
 <url>https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html</url>
 </references>
 <dates>
 <discovery>2015-06-30</discovery>
 <entry>2015-10-25</entry>
 </dates>
 </vuln>

<vuln vid="cec4d01a-7ac5-11e5-b35a-002590263bf5">
 <topic>Joomla! -- Core - Remote File Execution/Denial of Service vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><lt>3.2.6</lt></range>
	<range><ge>3.3.0</ge><lt>3.3.5</lt></range>
 </package>
 <package>
	<name>joomla2</name>
	<range><ge>2.5.4</ge><lt>2.5.26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="http://developer.joomla.org/security-centre/595-20140903-core-remote-file-inclusion.html">
	 <h2>[20140903] - Core - Remote File Inclusion</h2>
	 Inadequate checking allowed the potential for remote files to be
	 executed.
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security-centre/596-20140904-core-denial-of-service.html">
	 <h2>[20140904] - Core - Denial of Service</h2>
	 Inadequate checking allowed the potential for a denial of service
	 attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-7228</cvename>
 <cvename>CVE-2014-7229</cvename>
 <url>http://developer.joomla.org/security-centre/595-20140903-core-remote-file-inclusion.html</url>
 <url>http://developer.joomla.org/security-centre/596-20140904-core-denial-of-service.html</url>
 <url>https://www.joomla.org/announcements/release-news/5567-joomla-3-3-5-released.html</url>
 <url>https://www.joomla.org/announcements/release-news/5566-joomla-2-5-26-released.html</url>
 </references>
 <dates>
 <discovery>2014-09-30</discovery>
 <entry>2015-10-25</entry>
 </dates>
 </vuln>

<vuln vid="beb3d5fc-7ac5-11e5-b35a-002590263bf5">
 <topic>Joomla! -- Core - Unauthorized Login vulnerability</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><lt>3.2.5</lt></range>
	<range><ge>3.3.0</ge><lt>3.3.4</lt></range>
 </package>
 <package>
	<name>joomla2</name>
	<range><lt>2.5.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="http://developer.joomla.org/security-centre/594-20140902-core-unauthorised-logins.html">
	 <h2>[20140902] - Core - Unauthorized Logins</h2>
	 Inadequate checking allowed unauthorized logins via LDAP
	 authentication.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-6632</cvename>
 <url>http://developer.joomla.org/security-centre/594-20140902-core-unauthorised-logins.html</url>
 <url>https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html</url>
 <url>https://www.joomla.org/announcements/release-news/5563-joomla-2-5-25-released.html</url>
 </references>
 <dates>
 <discovery>2014-09-23</discovery>
 <entry>2015-10-25</entry>
 </dates>
 </vuln>

<vuln vid="adbb32d9-7ac5-11e5-b35a-002590263bf5">
 <topic>Joomla! -- Core - XSS Vulnerability</topic>
 <affects>
 <package>
	<name>joomla3</name>
	<range><ge>3.2.0</ge><lt>3.2.5</lt></range>
	<range><ge>3.3.0</ge><lt>3.3.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="http://developer.joomla.org/security-centre/593-20140901-core-xss-vulnerability.html">
	 <h2>[20140901] - Core - XSS Vulnerability</h2>
	 Inadequate escaping leads to XSS vulnerability in com_media.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-6631</cvename>
 <url>http://developer.joomla.org/security-centre/593-20140901-core-xss-vulnerability.html</url>
 <url>https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html</url>
 </references>
 <dates>
 <discovery>2014-09-23</discovery>
 <entry>2015-10-25</entry>
 </dates>
 </vuln>

<vuln vid="75f39413-7a00-11e5-a2a1-002590263bf5">
 <topic>drupal -- open redirect vulnerability</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.41</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal development team reports:
	<blockquote cite="https://www.drupal.org/SA-CORE-2015-004">
	 The Overlay module in Drupal core displays administrative pages
	 as a layer over the current page (using JavaScript), rather than
	 replacing the page in the browser window. The Overlay module does
	 not sufficiently validate URLs prior to displaying their contents,
	 leading to an open redirect vulnerability.
	 This vulnerability is mitigated by the fact that it can only be
	 used against site users who have the "Access the administrative
	 overlay" permission, and that the Overlay module must be enabled.
	 
	 An incomplete fix for this issue was released as part of
	 SA-CORE-2015-002.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7943</cvename>
 <url>https://www.drupal.org/SA-CORE-2015-004</url>
 <url>http://www.openwall.com/lists/oss-security/2015/10/23/6</url>
 </references>
 <dates>
 <discovery>2015-10-21</discovery>
 <entry>2015-10-24</entry>
 </dates>
 </vuln>

<vuln vid="08d11134-79c5-11e5-8987-6805ca0b3d42">
 <topic>phpMyAdmin -- Content spoofing vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.4.0</ge><lt>4.4.15.1</lt></range>
	<range><ge>4.5.0</ge><lt>4.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-5/">
	 This vulnerability allows an attacker to perform a
	 content spoofing attack using the phpMyAdmin's redirection
	 mechanism to external sites.
	 We consider this vulnerability to be non critical since
	 the spoofed content is escaped and no HTML injection is
	 possible.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2015-5/</url>
 <cvename>CVE-2015-7873</cvename>
 </references>
 <dates>
 <discovery>2015-10-23</discovery>
 <entry>2015-10-23</entry>
 </dates>
 </vuln>

<vuln vid="b973a763-7936-11e5-a2a1-002590263bf5">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki123</name>
	<range><lt>1.23.11</lt></range>
 </package>
 <package>
	<name>mediawiki124</name>
	<range><lt>1.24.4</lt></range>
 </package>
 <package>
	<name>mediawiki125</name>
	<range><lt>1.25.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MediaWiki reports:
	<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html">
	 Wikipedia user RobinHood70 reported two issues in the chunked
	 upload API. The API failed to correctly stop adding new chunks to
	 the upload when the reported size was exceeded (T91203), allowing
	 a malicious users to upload add an infinite number of chunks for a
	 single file upload. Additionally, a malicious user could upload
	 chunks of 1 byte for very large files, potentially creating a very
	 large number of files on the server's filesystem (T91205).
	 Internal review discovered that it is not possible to throttle file
	 uploads.
	 Internal review discovered a missing authorization check when
	 removing suppression from a revision. This allowed users with the
	 'viewsuppressed' user right but not the appropriate
	 'suppressrevision' user right to unsuppress revisions.
	 Richard Stanway from teamliquid.net reported that thumbnails of PNG
	 files generated with ImageMagick contained the local file path in
	 the image metadata.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8001</cvename>
 <cvename>CVE-2015-8002</cvename>
 <cvename>CVE-2015-8003</cvename>
 <cvename>CVE-2015-8004</cvename>
 <cvename>CVE-2015-8005</cvename>
 <cvename>CVE-2015-8006</cvename>
 <cvename>CVE-2015-8007</cvename>
 <cvename>CVE-2015-8008</cvename>
 <cvename>CVE-2015-8009</cvename>
 <url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html</url>
 <url>https://phabricator.wikimedia.org/T91203</url>
 <url>https://phabricator.wikimedia.org/T91205</url>
 <url>https://phabricator.wikimedia.org/T91850</url>
 <url>https://phabricator.wikimedia.org/T95589</url>
 <url>https://phabricator.wikimedia.org/T108616</url>
 <url>http://www.openwall.com/lists/oss-security/2015/10/29/14</url>
 </references>
 <dates>
 <discovery>2015-10-16</discovery>
 <entry>2015-10-23</entry>
 <modified>2015-12-24</modified>
 </dates>
 </vuln>

<vuln vid="c4a18a12-77fc-11e5-a687-206a8a720317">
 <topic>ntp -- 13 low- and medium-severity vulnerabilities</topic>
 <affects>
 <package>
	<name>ntp</name>
	<range><lt>4.2.8p4</lt></range>
 </package>
 <package>
	<name>ntp-devel</name>
	<range><lt>4.3.76</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_7</lt></range>
	<range><ge>10.1</ge><lt>10.1_24</lt></range>
	<range><ge>9.3</ge><lt>9.3_30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ntp.org reports:
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities">
	 NTF's NTP Project has been notified of the following 13 low-
	 and medium-severity vulnerabilities that are fixed in
	 ntp-4.2.8p4, released on Wednesday, 21 October 2015:
	 <ul>
	 <li>Bug 2941 CVE-2015-7871 NAK to the Future: Symmetric
		association authentication bypass via crypto-NAK
		(Cisco ASIG)</li>
	 <li>Bug 2922 CVE-2015-7855 decodenetnum() will ASSERT botch
		instead of returning FAIL on some bogus values (IDA)</li>
	 <li>Bug 2921 CVE-2015-7854 Password Length Memory Corruption
		Vulnerability. (Cisco TALOS)</li>
	 <li>Bug 2920 CVE-2015-7853 Invalid length data provided by a
		custom refclock driver could cause a buffer overflow.
		(Cisco TALOS)</li>
	 <li>Bug 2919 CVE-2015-7852 ntpq atoascii() Memory Corruption
		Vulnerability. (Cisco TALOS)</li>
	 <li>Bug 2918 CVE-2015-7851 saveconfig Directory Traversal
		Vulnerability. (OpenVMS) (Cisco TALOS)</li>
	 <li>Bug 2917 CVE-2015-7850 remote config logfile-keyfile.
		(Cisco TALOS)</li>
	 <li>Bug 2916 CVE-2015-7849 trusted key use-after-free.
		(Cisco TALOS)</li>
	 <li>Bug 2913 CVE-2015-7848 mode 7 loop counter underrun.
		(Cisco TALOS)</li>
	 <li>Bug 2909 CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC.
		(Tenable)</li>
	 <li>Bug 2902 : CVE-2015-7703 configuration directives "pidfile"
		and "driftfile" should only be allowed locally. (RedHat)</li>
	 <li>Bug 2901 : CVE-2015-7704, CVE-2015-7705 Clients that
		receive a KoD should validate the origin timestamp field.
		(Boston University)</li>
	 <li>Bug 2899 : CVE-2015-7691, CVE-2015-7692, CVE-2015-7702
		Incomplete autokey data packet length checks. (Tenable)</li>
	 </ul>
	 The only generally-exploitable bug in the above list is the
	 crypto-NAK bug, which has a CVSS2 score of 6.4.
	 Additionally, three bugs that have already been fixed in
	 ntp-4.2.8 but were not fixed in ntp-4.2.6 as it was EOL'd
	 have a security component, but are all below 1.8 CVSS score,
	 so we're reporting them here:
	 <ul>
	 <li>Bug 2382 : Peer precision &lt; -31 gives division by zero</li>
	 <li>Bug 1774 : Segfaults if cryptostats enabled when built
		without OpenSSL</li>
	 <li>Bug 1593 : ntpd abort in free() with logconfig syntax error</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-15:25.ntp</freebsdsa>
 <cvename>CVE-2015-7691</cvename>
 <cvename>CVE-2015-7692</cvename>
 <cvename>CVE-2015-7701</cvename>
 <cvename>CVE-2015-7702</cvename>
 <cvename>CVE-2015-7703</cvename>
 <cvename>CVE-2015-7704</cvename>
 <cvename>CVE-2015-7705</cvename>
 <cvename>CVE-2015-7848</cvename>
 <cvename>CVE-2015-7849</cvename>
 <cvename>CVE-2015-7850</cvename>
 <cvename>CVE-2015-7851</cvename>
 <cvename>CVE-2015-7852</cvename>
 <cvename>CVE-2015-7853</cvename>
 <cvename>CVE-2015-7854</cvename>
 <cvename>CVE-2015-7855</cvename>
 <cvename>CVE-2015-7871</cvename>
 <url>http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities</url>
 </references>
 <dates>
 <discovery>2015-10-21</discovery>
 <entry>2015-10-21</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="95602550-76cf-11e5-a2a1-002590263bf5">
 <topic>codeigniter -- multiple XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>codeigniter</name>
	<range><lt>2.2.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The CodeIgniter changelog reports:
	<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
	 Fixed a number of XSS attack vectors in Security Library method
	 xss_clean (thanks to Frans Rosén from Detectify.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/203403</freebsdpr>
 <url>https://codeigniter.com/userguide2/changelog.html</url>
 </references>
 <dates>
 <discovery>2015-10-08</discovery>
 <entry>2015-10-20</entry>
 </dates>
 </vuln>

<vuln vid="7f645ee5-7681-11e5-8519-005056ac623e">
 <topic>Git -- Execute arbitrary code</topic>
 <affects>
 <package>
	<name>git</name>
	<range><lt>2.6.1</lt></range>
 </package>
 <package>
	<name>git-gui</name>
	<range><lt>2.6.1</lt></range>
 </package>
 <package>
	<name>git-lite</name>
	<range><lt>2.6.1</lt></range>
 </package>
 <package>
	<name>git-subversion</name>
	<range><lt>2.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Git release notes:
	<blockquote cite="https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.6.1.txt">
	 Some protocols (like git-remote-ext) can execute arbitrary code
	 found in the URL. The URLs that submodules use may come from
	 arbitrary sources (e.g., .gitmodules files in a remote
	 repository), and can hurt those who blindly enable recursive
	 fetch. Restrict the allowed protocols to well known and safe
	 ones.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7545</cvename>
 <url>https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.6.1.txt</url>
 <url>http://www.openwall.com/lists/oss-security/2015/12/11/7</url>
 </references>
 <dates>
 <discovery>2015-09-23</discovery>
 <entry>2015-10-19</entry>
 <modified>2015-12-12</modified>
 </dates>
 </vuln>

<vuln vid="3934cc60-f0fa-4eca-be09-c8bd7ae42871">
 <topic>Salt -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-salt</name>
	<range><lt>2015.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Salt release notes:
	<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html">
	 CVE-2015-6918 - Git modules leaking HTTPS auth credentials to debug log
	 Updated the Git state and execution modules to no longer display HTTPS basic
	 authentication credentials in loglevel debug output on the Salt master. These
	 credentials are now replaced with REDACTED in the debug output. Thanks to
	 Andreas Stieger for bringing this to our attention.
	 CVE-2015-6941 - win_useradd module and salt-cloud display passwords in debug
	 log
	 Updated the win_useradd module return data to no longer include the password
	 of the newly created user. The password is now replaced with the string
	 XXX-REDACTED-XXX. Updated the Salt Cloud debug output to no longer display
	 win_password and sudo_password authentication credentials. Also updated the
	 Linode driver to no longer display authentication credentials in debug logs.
	 These credentials are now replaced with REDACTED in the debug output.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html</url>
 <cvename>CVE-2015-6918</cvename>
 <cvename>CVE-2015-6941</cvename>
 </references>
 <dates>
 <discovery>2015-10-16</discovery>
 <entry>2015-10-17</entry>
 </dates>
 </vuln>

<vuln vid="79c68ef7-c8ae-4ade-91b4-4b8221b7c72a">
 <topic>firefox -- Cross-origin restriction bypass using Fetch</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>41.0.2,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>41.0.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Firefox Developers report:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/">
	 Security researcher Abdulrahman Alqabandi reported that the fetch()
	 API did not correctly implement the Cross-Origin Resource Sharing
	 (CORS) specification, allowing a malicious page to access private
	 data from other origins. Mozilla developer Ben Kelly independently reported the
	 same issue.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/</url>
 <cvename>CVE-2015-7184</cvename>
 </references>
 <dates>
 <discovery>2015-10-15</discovery>
 <entry>2015-10-16</entry>
 </dates>
 </vuln>

<vuln vid="84147b46-e876-486d-b746-339ee45a8bb9">
 <topic>flash -- remote code execution</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.540</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-27.html">
	 These updates resolve type confusion vulnerabilities that
	 could lead to code execution (CVE-2015-7645, CVE-2015-7647,
	 CVE-2015-7648).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7645</cvename>
 <cvename>CVE-2015-7647</cvename>
 <cvename>CVE-2015-7648</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb15-27.html</url>
 </references>
 <dates>
 <discovery>2015-10-16</discovery>
 <entry>2015-10-16</entry>
 </dates>
 </vuln>

<vuln vid="e75a96df-73ca-11e5-9b45-b499baebfeaf">
 <topic>LibreSSL -- Memory leak and buffer overflow</topic>
 <affects>
 <package>
	<name>libressl</name>
	<range><lt>2.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Qualys reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/16/1">
	 During the code review of OpenSMTPD a memory leak and buffer overflow
	 (an off-by-one, usually stack-based) were discovered in LibreSSL's
	 OBJ_obj2txt() function. This function is called automatically during
	 a TLS handshake (both client-side, unless an anonymous mode is used,
	 and server-side, if client authentication is requested).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://marc.info/?l=openbsd-announce&amp;m=144495690528446</url>
 <cvename>CVE-2015-5333</cvename>
 <cvename>CVE-2015-5334</cvename>
 </references>
 <dates>
 <discovery>2015-10-15</discovery>
 <entry>2015-10-16</entry>
 <modified>2015-10-26</modified>
 </dates>
 </vuln>

<vuln vid="07a1a76c-734b-11e5-ae81-14dae9d210b8">
 <topic>mbedTLS/PolarSSL -- DoS and possible remote code execution</topic>
 <affects>
 <package>
	<name>polarssl</name>
	<range><ge>1.2.0</ge><lt>1.2.17</lt></range>
 </package>
 <package>
	<name>polarssl13</name>
	<range><ge>1.3.0</ge><lt>1.3.14</lt></range>
 </package>
 <package>
	<name>mbedtls</name>
	<range><lt>2.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ARM Limited reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01">
	 When the client creates its ClientHello message, due to
	 insufficient bounds checking it can overflow the heap-based buffer
	 containing the message while writing some extensions. Two extensions in
	 particular could be used by a remote attacker to trigger the overflow:
	 the session ticket extension and the server name indication (SNI)
	 extension.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01</url>
 <cvename>CVE-2015-5291</cvename>
 </references>
 <dates>
 <discovery>2015-10-05</discovery>
 <entry>2015-10-15</entry>
 </dates>
 </vuln>

<vuln vid="ea1d2530-72ce-11e5-a2a1-002590263bf5">
 <topic>magento -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>magento</name>
	<range><lt>1.9.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Magento, Inc. reports:
	<blockquote cite="https://www.magentocommerce.com/download">
	 SUPEE-6482 - This patch addresses two issues related to APIs and
	 two cross-site scripting risks.
	 SUPEE-6285 - This patch provides protection against several types
	 of security-related issues, including information leaks, request
	 forgeries, and cross-site scripting.
	 SUPEE-5994 - This patch addresses multiple security
	 vulnerabilities in Magento Community Edition software, including
	 issues that can put customer information at risk.
	 SUPEE-5344 - Addresses a potential remote code execution
	 exploit.
	 SUPEE-1533 - Addresses two potential remote code execution
	 exploits.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/201709</freebsdpr>
 <url>https://www.magentocommerce.com/download</url>
 <url>http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.html</url>
 <url>http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.1.html</url>
 </references>
 <dates>
 <discovery>2014-10-03</discovery>
 <entry>2015-10-14</entry>
 </dates>
 </vuln>

<vuln vid="705b759c-7293-11e5-a371-14dae9d210b8">
 <topic>pear-twig -- remote code execution</topic>
 <affects>
 <package>
	<name>pear-twig-twig</name>
	<range><lt>1.20.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Fabien Potencier reports:
	<blockquote cite="http://symfony.com/blog/security-release-twig-1-20-0">
	 End users can craft valid Twig code that allows them to
	 execute arbitrary code (RCEs) via the _self variable, which is always
	 available, even in sandboxed templates.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://symfony.com/blog/security-release-twig-1-20-0</url>
 <cvename>CVE-2015-7809</cvename>
 </references>
 <dates>
 <discovery>2015-08-12</discovery>
 <entry>2015-10-14</entry>
 </dates>
 </vuln>

<vuln vid="06fefd2f-728f-11e5-a371-14dae9d210b8">
 <topic>miniupnpc -- buffer overflow</topic>
 <affects>
 <package>
	<name>miniupnpc</name>
	<range><ge>1.9.1</ge><lt>1.9.20150917</lt></range>
	<range><lt>1.9_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Talos reports:
	<blockquote cite="http://talosintel.com/reports/TALOS-2015-0035/">
	 An exploitable buffer overflow vulnerability exists in the
	 XML parser functionality of the MiniUPnP library. A specially crafted
	 XML response can lead to a buffer overflow on the stack resulting in
	 remote code execution. An attacker can set up a server on the local
	 network to trigger this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-6031</cvename>
 <url>http://talosintel.com/reports/TALOS-2015-0035/</url>
 <url>https://github.com/miniupnp/miniupnp/commit/79cca974a4c2ab1199786732a67ff6d898051b78</url>
 </references>
 <dates>
 <discovery>2015-09-15</discovery>
 <entry>2015-10-14</entry>
 <modified>2015-10-14</modified>
 </dates>
 </vuln>

<vuln vid="a63f2c06-726b-11e5-a12b-bcaec565249c">
 <topic>flash -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.535</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-25.html">
	 These updates resolve a vulnerability that could be exploited
	 to bypass the same-origin-policy and lead to information
	 disclosure (CVE-2015-7628).

These updates include a defense-in-depth feature in the Flash
	 broker API (CVE-2015-5569).

These updates resolve use-after-free vulnerabilities that
	 could lead to code execution (CVE-2015-7629, CVE-2015-7631,
	 CVE-2015-7643, CVE-2015-7644).

These updates resolve a buffer overflow vulnerability that
	 could lead to code execution (CVE-2015-7632).

These updates resolve memory corruption vulnerabilities that
	 could lead to code execution (CVE-2015-7625, CVE-2015-7626,
	 CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5569</cvename>
 <cvename>CVE-2015-7625</cvename>
 <cvename>CVE-2015-7626</cvename>
 <cvename>CVE-2015-7627</cvename>
 <cvename>CVE-2015-7628</cvename>
 <cvename>CVE-2015-7629</cvename>
 <cvename>CVE-2015-7630</cvename>
 <cvename>CVE-2015-7631</cvename>
 <cvename>CVE-2015-7632</cvename>
 <cvename>CVE-2015-7633</cvename>
 <cvename>CVE-2015-7634</cvename>
 <cvename>CVE-2015-7643</cvename>
 <cvename>CVE-2015-7644</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb15-25.html</url>
 </references>
 <dates>
 <discovery>2015-10-13</discovery>
 <entry>2015-10-14</entry>
 </dates>
 </vuln>

<vuln vid="8301c04d-71df-11e5-9fcb-00262d5ed8ee">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	
	<name>chromium-npapi</name>
	<name>chromium-pulse</name>
	<range><lt>46.0.2490.71</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/10/stable-channel-update.html">
	 24 security fixes in this release, including:
	 <ul>
	 <li>[519558] High CVE-2015-6755: Cross-origin bypass in Blink.
	 Credit to Mariusz Mlynski.</li>
	 <li>[507316] High CVE-2015-6756: Use-after-free in PDFium. Credit
	 to anonymous.</li>
	 <li>[529520] High CVE-2015-6757: Use-after-free in ServiceWorker.
	 Credit to Collin Payne.</li>
	 <li>[522131] High CVE-2015-6758: Bad-cast in PDFium. Credit to Atte
	 Kettunen of OUSPG.</li>
	 <li>[514076] Medium CVE-2015-6759: Information leakage in
	 LocalStorage. Credit to Muneaki Nishimura (nishimunea).</li>
	 <li>[519642] Medium CVE-2015-6760: Improper error handling in
	 libANGLE. Credit to lastland.net.</li>
	 <li>[447860,532967] Medium CVE-2015-6761: Memory corruption in
	 FFMpeg. Credit to Aki Helin of OUSPG and anonymous.</li>
	 <li>[512678] Low CVE-2015-6762: CORS bypass via CSS fonts. Credit
	 to Muneaki Nishimura (nishimunea).</li>
	 <li> [542517] CVE-2015-6763: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 <li>Multiple vulnerabilities in V8 fixed at the tip of the 4.6
	 branch (currently 4.6.85.23).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-6755</cvename>
 <cvename>CVE-2015-6756</cvename>
 <cvename>CVE-2015-6757</cvename>
 <cvename>CVE-2015-6758</cvename>
 <cvename>CVE-2015-6759</cvename>
 <cvename>CVE-2015-6760</cvename>
 <cvename>CVE-2015-6761</cvename>
 <cvename>CVE-2015-6762</cvename>
 <cvename>CVE-2015-6763</cvename>
 <url>http://googlechromereleases.blogspot.nl/2015/10/stable-channel-update.html</url>
 </references>
 <dates>
 <discovery>2015-10-13</discovery>
 <entry>2015-10-13</entry>
 </dates>
 </vuln>

<vuln vid="00dadbf0-6f61-11e5-a2a1-002590263bf5">
 <topic>p5-UI-Dialog -- shell command execution vulnerability</topic>
 <affects>
 <package>
	<name>p5-UI-Dialog</name>
	<range><lt>1.09_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthijs Kooijman reports:
	<blockquote cite="https://rt.cpan.org/Public/Bug/Display.html?id=107364">
	 It seems that the whiptail, cdialog and kdialog backends apply
	 some improper escaping in their shell commands, causing special
	 characters present in menu item titles to be interpreted by the
	 shell. This includes the backtick evaluation operator, so this
	 constitutes a security issue, allowing execution of arbitrary
	 commands if an attacker has control over the text displayed in
	 a menu.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-7315</cvename>
 <freebsdpr>ports/203667</freebsdpr>
 <url>https://rt.cpan.org/Public/Bug/Display.html?id=107364</url>
 <url>https://bugs.debian.org/496448</url>
 <url>https://github.com/kckrinke/UI-Dialog/commit/6adc44cc636c615d76297d86835e1a997681eb61</url>
 </references>
 <dates>
 <discovery>2008-08-24</discovery>
 <entry>2015-10-10</entry>
 </dates>
 </vuln>

<vuln vid="290351c9-6f5c-11e5-a2a1-002590263bf5">
 <topic>devel/ipython -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ipython</name>
	<range><lt>3.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Bussonnier reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/02/3">
	 Summary: Local folder name was used in HTML templates without
	 escaping, allowing XSS in said pages by carefully crafting folder
	 name and URL to access it.
	 URI with issues:
	 <ul>
	 <li>GET /tree/**</li>
	 </ul>
	</blockquote>
	Benjamin RK reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/16/3">
	 Vulnerability: A maliciously forged file opened for editing can
	 execute javascript, specifically by being redirected to /files/ due
	 to a failure to treat the file as plain text.
	 URI with issues:
	 <ul>
	 <li>GET /edit/**</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/203668</freebsdpr>
 <cvename>CVE-2015-6938</cvename>
 <cvename>CVE-2015-7337</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/09/02/3</url>
 <url>https://github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892</url>
 <url>http://www.openwall.com/lists/oss-security/2015/09/16/3</url>
 <url>https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967</url>
 </references>
 <dates>
 <discovery>2015-09-01</discovery>
 <entry>2015-10-10</entry>
 </dates>
 </vuln>

<vuln vid="a0182578-6e00-11e5-a90c-0026551a22dc">
 <topic>PostgreSQL -- minor security problems.</topic>
 <affects>
 <package>
	<name>postgresql90-server</name>
	<range><ge>9.0.0</ge><lt>9.0.22</lt></range>
 </package>
 <package>
	<name>postgresql91-server</name>
	<range><ge>9.1.0</ge><lt>9.1.18</lt></range>
 </package>
 <package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.13</lt></range>
 </package>
 <package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.9</lt></range>
 </package>
 <package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL project reports:
	<blockquote cite="http://www.postgresql.org/about/news/1615/">
	 
		Two security issues have been fixed in this release which affect
		users of specific PostgreSQL features.
	 
	 <ul>
	 <li>CVE-2015-5289 json or jsonb input values constructed from
		arbitrary user input can crash the PostgreSQL server and cause a denial of
		service.
	 </li>
	 <li>CVE-2015-5288: The crypt() function included with the optional pgCrypto
		extension could be exploited to read a few additional bytes of memory.
		No working exploit for this issue has been developed.
	 </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5289</cvename>
 <cvename>CVE-2015-5288</cvename>
 </references>
 <dates>
 <discovery>2015-10-08</discovery>
 <entry>2015-10-08</entry>
 </dates>
 </vuln>

<vuln vid="d3324fdb-6bf0-11e5-bc5e-00505699053e">
 <topic>ZendFramework1 -- SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>ZendFramework1</name>
	<range><lt>1.12.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Zend Framework developers report:
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2015-08">
	 The PDO adapters of Zend Framework 1 do not filter null bytes values
	 in SQL statements. A PDO adapter can treat null bytes in a query as a
	 string terminator, allowing an attacker to add arbitrary SQL
	 following a null byte, and thus create a SQL injection.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7695</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/09/30/6</url>
 <url>http://framework.zend.com/security/advisory/ZF2015-08</url>
 </references>
 <dates>
 <discovery>2015-09-15</discovery>
 <entry>2015-10-06</entry>
 <modified>2015-10-12</modified>
 </dates>
 </vuln>

<vuln vid="42852f72-6bd3-11e5-9909-002590263bf5">
 <topic>OpenSMTPD -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opensmtpd</name>
	<range><lt>5.7.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSMTPD developers report:
	<blockquote cite="https://www.opensmtpd.org/announces/release-5.7.3.txt">
	 fix an mda buffer truncation bug which allows a user to create
	 forward files that pass session checks but fail delivery later down
	 the chain, within the user mda
	 fix remote buffer overflow in unprivileged pony process
	 reworked offline enqueue to better protect against hardlink
	 attacks
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2015/10/04/2</url>
 <url>https://www.opensmtpd.org/announces/release-5.7.3.txt</url>
 </references>
 <dates>
 <discovery>2015-10-04</discovery>
 <entry>2015-10-06</entry>
 </dates>
 </vuln>

<vuln vid="5d280761-6bcf-11e5-9909-002590263bf5">
 <topic>mbedTLS/PolarSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>polarssl</name>
	<range><ge>1.2.0</ge><lt>1.2.16</lt></range>
 </package>
 <package>
	<name>polarssl13</name>
	<range><ge>1.3.0</ge><lt>1.3.13</lt></range>
 </package>
 <package>
	<name>mbedtls</name>
	<range><lt>2.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ARM Limited reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released">
	 Florian Weimar from Red Hat published on Lenstra's RSA-CRT attach
	 for PKCS#1 v1.5 signatures. These releases include countermeasures
	 against that attack.
	 Fabian Foerg of Gotham Digital Science found a possible client-side
	 NULL pointer dereference, using the AFL Fuzzer. This dereference can
	 only occur when misusing the API, although a fix has still been
	 implemented.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released</url>
 </references>
 <dates>
 <discovery>2015-09-18</discovery>
 <entry>2015-10-06</entry>
 </dates>
 </vuln>

<vuln vid="953aaa57-6bce-11e5-9909-002590263bf5">
 <topic>mbedTLS/PolarSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>polarssl</name>
	<range><ge>1.2.0</ge><lt>1.2.15</lt></range>
 </package>
 <package>
	<name>polarssl13</name>
	<range><ge>1.3.0</ge><lt>1.3.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ARM Limited reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released">
	 In order to strengthen the minimum requirements for connections and
	 to protect against the Logjam attack, the minimum size of
	 Diffie-Hellman parameters accepted by the client has been increased
	 to 1024 bits.
	 In addition the default size for the Diffie-Hellman parameters on
	 the server are increased to 2048 bits. This can be changed with
	 ssl_set_dh_params() in case this is necessary.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released</url>
 </references>
 <dates>
 <discovery>2015-08-11</discovery>
 <entry>2015-10-06</entry>
 </dates>
 </vuln>

<vuln vid="9272a5b0-6b40-11e5-bd7f-bcaec565249c">
 <topic>gdk-pixbuf2 -- head overflow and DoS</topic>
 <affects>
 <package>
	<name>gdk-pixbuf2</name>
	<range><lt>2.32.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/02/9">
	 We found a heap overflow and a DoS in the gdk-pixbuf
	 implementation triggered by the scaling of tga file.
	</blockquote>
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/02/10">
	 We found a heap overflow in the gdk-pixbuf implementation
	 triggered by the scaling of gif file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-7673</cvename>
 <cvename>CVE-2015-7674</cvename>
 <url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00201.html</url>
 <url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00287.html</url>
 <url>http://www.openwall.com/lists/oss-security/2015/10/02/9</url>
 <url>http://www.openwall.com/lists/oss-security/2015/10/02/10</url>
 </references>
 <dates>
 <discovery>2015-10-02</discovery>
 <entry>2015-10-05</entry>
 </dates>
 </vuln>

<vuln vid="6b3374d4-6b0b-11e5-9909-002590263bf5">
 <topic>plone -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>plone</name>
	<range><lt>4.3.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Plone.org reports:
	<blockquote cite="https://plone.org/products/plone/security/advisories/20150910-announcement">
	 Versions Affected: All current Plone versions.
	 Versions Not Affected: None.
	 Nature of vulnerability: Allows creation of members by anonymous
	 users on sites that have self-registration enabled, allowing bypass
	 of CAPTCHA and similar protections against scripted attacks.
	 The patch can be added to buildouts as Products.PloneHotfix20150910
	 (available from PyPI) or downloaded from Plone.org.
	 Immediate Measures You Should Take: Disable self-registration until
	 you have applied the patch.
	</blockquote>
	<blockquote cite="https://plone.org/security/20150910/non-persistent-xss-in-plone">
	 Plone's URL checking infrastructure includes a method for checking
	 if URLs valid and located in the Plone site. By passing HTML into
	 this specially crafted url, XSS can be achieved.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/203255</freebsdpr>
 <url>https://plone.org/products/plone-hotfix/releases/20150910</url>
 <url>https://plone.org/products/plone/security/advisories/20150910-announcement</url>
 <url>https://plone.org/security/20150910/non-persistent-xss-in-plone</url>
 <url>https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087</url>
 </references>
 <dates>
 <discovery>2015-09-10</discovery>
 <entry>2015-10-05</entry>
 </dates>
 </vuln>

<vuln vid="c1da8b75-6aef-11e5-9909-002590263bf5">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5-phar</name>
	<range><le>5.4.45</le></range>
 </package>
 <package>
	<name>php55-phar</name>
	<range><lt>5.5.30</lt></range>
 </package>
 <package>
	<name>php56-phar</name>
	<range><lt>5.6.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP reports:
	<blockquote cite="http://php.net/ChangeLog-5.php#5.5.30">
	 Phar:
	 <ul>
	 <li>Fixed bug #69720 (Null pointer dereference in
	 phar_get_fp_offset()).</li>
	 <li>Fixed bug #70433 (Uninitialized pointer in phar_make_dirstream
	 when zip entry filename is "/").</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/203541</freebsdpr>
 <cvename>CVE-2015-7803</cvename>
 <cvename>CVE-2015-7804</cvename>
 <url>http://php.net/ChangeLog-5.php#5.5.30</url>
 <url>http://php.net/ChangeLog-5.php#5.6.14</url>
 </references>
 <dates>
 <discovery>2015-10-01</discovery>
 <entry>2015-10-04</entry>
 <modified>2015-10-12</modified>
 </dates>
 </vuln>

<vuln vid="ee7bdf7f-11bb-4eea-b054-c692ab848c20">
 <topic>OpenSMTPD -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opensmtpd</name>
	<range><lt>5.7.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSMTPD developers report:
	<blockquote cite="https://www.opensmtpd.org/announces/release-5.7.2.txt">
	 an oversight in the portable version of fgetln() that allows
	 attackers to read and write out-of-bounds memory
	 multiple denial-of-service vulnerabilities that allow local users
	 to kill or hang OpenSMTPD
	 a stack-based buffer overflow that allows local users to crash
	 OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd
	 user
	 a hardlink attack (or race-conditioned symlink attack) that allows
	 local users to unset the chflags() of arbitrary files
	 a hardlink attack that allows local users to read the first line of
	 arbitrary files (for example, root's hash from /etc/master.passwd)
	 
	 a denial-of-service vulnerability that allows remote attackers to
	 fill OpenSMTPD's queue or mailbox hard-disk partition
	 an out-of-bounds memory read that allows remote attackers to crash
	 OpenSMTPD, or leak information and defeat the ASLR protection
	 a use-after-free vulnerability that allows remote attackers to
	 crash OpenSMTPD, or execute arbitrary code as the non-chrooted
	 _smtpd user
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.opensmtpd.org/announces/release-5.7.2.txt</url>
 <cvename>CVE-2015-7687</cvename>
 </references>
 <dates>
 <discovery>2015-10-02</discovery>
 <entry>2015-10-04</entry>
 <modified>2015-10-06</modified>
 </dates>
 </vuln>

<vuln vid="be3069c9-67e7-11e5-9909-002590263bf5">
 <topic>james -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>james</name>
	<range><lt>2.3.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache James Project reports:
	<blockquote cite="http://james.apache.org/download.cgi#Apache_James_Server">
	 This release has many enhancements and bug fixes over the previous
	 release. See the Release Notes for a detailed list of changes. Some
	 of the earlier defects could turn a James mail server into an Open
	 Relay and allow files to be written on disk. All users of James
	 Server are urged to upgrade to version v2.3.2.1 as soon as
	 possible.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/203461</freebsdpr>
 <certvu>988628</certvu>
 <cvename>CVE-2015-7611</cvename>
 <url>http://james.apache.org/download.cgi#Apache_James_Server</url>
 <url>https://blogs.apache.org/james/entry/apache_james_server_2_3</url>
 </references>
 <dates>
 <discovery>2015-09-30</discovery>
 <entry>2015-10-01</entry>
 <modified>2015-10-04</modified>
 </dates>
 </vuln>

<vuln vid="1e7f0c11-673a-11e5-98c8-60a44c524f57">
 <topic>otrs -- Scheduler Process ID File Access</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><gt>3.2.*</gt><lt>3.2.18</lt></range>
	<range><gt>3.3.*</gt><lt>3.3.15</lt></range>
	<range><gt>4.0.*</gt><lt>4.0.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OTRS project reports:
	<blockquote cite="https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-access/">
	 An attacker with valid LOCAL credentials could access and
	 manipulate the process ID file for bin/otrs.schduler.pl from the
	 CLI.
	 The Proc::Daemon module 0.14 for Perl uses world-writable
	 permissions for a file that stores a process ID, which allows local
	 users to have an unspecified impact by modifying this file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-access/</url>
 <cvename>CVE-2015-6842</cvename>
 <cvename>CVE-2013-7135</cvename>
 </references>
 <dates>
 <discovery>2015-09-17</discovery>
 <entry>2015-09-30</entry>
 </dates>
 </vuln>

<vuln vid="4e3e8a50-65c1-11e5-948e-bcaec565249c">
 <topic>flash -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.521</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-23.html">
	 These updates resolve a type confusion vulnerability that could
	 lead to code execution (CVE-2015-5573).

These updates resolve use-after-free vulnerabilities that could
	 lead to code execution (CVE-2015-5570, CVE-2015-5574, CVE-2015-5581, CVE-2015-5584, CVE-2015-6682).

These updates resolve buffer overflow vulnerabilities that could
	 lead to code execution (CVE-2015-6676, CVE-2015-6678).

These updates resolve memory corruption vulnerabilities that
	 could lead to code execution (CVE-2015-5575, CVE-2015-5577,
	 CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588,
	 CVE-2015-6677).

These updates include additional validation checks to ensure
	 that Flash Player rejects malicious content from vulnerable
	 JSONP callback APIs (CVE-2015-5571).

These updates resolve a memory leak vulnerability
	 (CVE-2015-5576).

These updates include further hardening to a mitigation to
	 defend against vector length corruptions (CVE-2015-5568).

These updates resolve stack corruption vulnerabilities that
	 could lead to code execution (CVE-2015-5567, CVE-2015-5579).

These updates resolve a stack overflow vulnerability that could
	 lead to code execution (CVE-2015-5587).

These updates resolve a security bypass vulnerability that could
	 lead to information disclosure (CVE-2015-5572).

These updates resolve a vulnerability that could be exploited to
	 bypass the same-origin-policy and lead to information disclosure
	 (CVE-2015-6679).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5567</cvename>
 <cvename>CVE-2015-5568</cvename>
 <cvename>CVE-2015-5570</cvename>
 <cvename>CVE-2015-5571</cvename>
 <cvename>CVE-2015-5572</cvename>
 <cvename>CVE-2015-5573</cvename>
 <cvename>CVE-2015-5574</cvename>
 <cvename>CVE-2015-5575</cvename>
 <cvename>CVE-2015-5576</cvename>
 <cvename>CVE-2015-5577</cvename>
 <cvename>CVE-2015-5578</cvename>
 <cvename>CVE-2015-5588</cvename>
 <cvename>CVE-2015-6676</cvename>
 <cvename>CVE-2015-6677</cvename>
 <cvename>CVE-2015-6678</cvename>
 <cvename>CVE-2015-6679</cvename>
 <cvename>CVE-2015-6682</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb15-23.html</url>
 </references>
 <dates>
 <discovery>2015-09-21</discovery>
 <entry>2015-09-28</entry>
 </dates>
 </vuln>

<vuln vid="5114cd11-6571-11e5-9909-002590263bf5">
 <topic>codeigniter -- SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>codeigniter</name>
	<range><lt>2.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The CodeIgniter changelog reports:
	<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
	 Security: Fixed an SQL injection vulnerability in Active Record
	 method offset().
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/203401</freebsdpr>
 <url>https://codeigniter.com/userguide2/changelog.html</url>
 </references>
 <dates>
 <discovery>2015-08-20</discovery>
 <entry>2015-09-28</entry>
 </dates>
 </vuln>

<vuln vid="01bce4c6-6571-11e5-9909-002590263bf5">
 <topic>codeigniter -- mysql database driver vulnerability</topic>
 <affects>
 <package>
	<name>codeigniter</name>
	<range><lt>2.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The CodeIgniter changelog reports:
	<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
	 Security: Removed a fallback to mysql_escape_string() in the mysql
	 database driver (escape_str() method) when there's no active database
	 connection.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/203401</freebsdpr>
 <url>https://codeigniter.com/userguide2/changelog.html</url>
 </references>
 <dates>
 <discovery>2015-07-15</discovery>
 <entry>2015-09-28</entry>
 </dates>
 </vuln>

<vuln vid="c21f4e61-6570-11e5-9909-002590263bf5">
 <topic>codeigniter -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>codeigniter</name>
	<range><lt>2.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The CodeIgniter changelog reports:
	<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
	 Security: Added HTTP "Host" header character validation to prevent
	 cache poisoning attacks when base_url auto-detection is used.
	 Security: Added FSCommand and seekSegmentTime to the "evil
	 attributes" list in CI_Security::xss_clean().
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/203401</freebsdpr>
 <url>https://codeigniter.com/userguide2/changelog.html</url>
 </references>
 <dates>
 <discovery>2015-04-15</discovery>
 <entry>2015-09-28</entry>
 </dates>
 </vuln>

<vuln vid="f838dcb4-656f-11e5-9909-002590263bf5">
 <topic>codeigniter -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>codeigniter</name>
	<range><lt>2.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The CodeIgniter changelog reports:
	<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
	 Security: The xor_encode() method in the Encrypt Class has been
	 removed. The Encrypt Class now requires the Mcrypt extension to be
	 installed.
	 Security: The Session Library now uses HMAC authentication instead
	 of a simple MD5 checksum.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/203401</freebsdpr>
 <url>https://codeigniter.com/userguide2/changelog.html</url>
 </references>
 <dates>
 <discovery>2014-06-05</discovery>
 <entry>2015-09-28</entry>
 </dates>
 </vuln>

<vuln vid="b7d785ea-656d-11e5-9909-002590263bf5">
 <topic>codeigniter -- SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>codeigniter</name>
	<range><lt>2.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The CodeIgniter changelog reports:
	<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
	 An improvement was made to the MySQL and MySQLi drivers to prevent
	 exposing a potential vector for SQL injection on sites using
	 multi-byte character sets in the database client connection.
	 An incompatibility in PHP versions &lt; 5.2.3 and MySQL &gt; 5.0.7
	 with mysql_set_charset() creates a situation where using multi-byte
	 character sets on these environments may potentially expose a SQL
	 injection attack vector. Latin-1, UTF-8, and other "low ASCII"
	 character sets are unaffected on all environments.
	 If you are running or considering running a multi-byte character
	 set for your database connection, please pay close attention to the
	 server environment you are deploying on to ensure you are not
	 vulnerable.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/156486</freebsdpr>
 <url>https://codeigniter.com/userguide2/changelog.html</url>
 </references>
 <dates>
 <discovery>2011-08-20</discovery>
 <entry>2015-09-28</entry>
 </dates>
 </vuln>

<vuln vid="0e425bb7-64f2-11e5-b2fd-00262d5ed8ee">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>45.0.2454.101</lt></range>
 </package>
 <package>
	
	<name>chromium-npapi</name>
	<range><lt>45.0.2454.101</lt></range>
 </package>
 <package>
	
	<name>chromium-pulse</name>
	<range><lt>45.0.2454.101</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/09/stable-channel-update_24.html">
	 Two vulnerabilities were fixed in this release:
	 <ul>
	 <li>[530301] High CVE-2015-1303: Cross-origin bypass in DOM. Credit
	 to Mariusz Mlynski.</li>
	 <li>[531891] High CVE-2015-1304: Cross-origin bypass in V8. Credit
	 to Mariusz Mlynski.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1303</cvename>
 <cvename>CVE-2015-1304</cvename>
 <url>http://googlechromereleases.blogspot.nl/2015/09/stable-channel-update_24.html</url>
 </references>
 <dates>
 <discovery>2015-09-24</discovery>
 <entry>2015-09-27</entry>
 </dates>
 </vuln>

<vuln vid="9770d6ac-614d-11e5-b379-14dae9d210b8">
 <topic>libssh2 -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>libssh2</name>
	<range><lt>1.5.0,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mariusz Ziulek reports:
	<blockquote cite="http://www.libssh2.org/adv_20150311.html">
	 A malicious attacker could man in the middle a real server
	 and cause libssh2 using clients to crash (denial of service) or
	 otherwise read and use completely unintended memory areas in this
	 process.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.libssh2.org/adv_20150311.html</url>
 <url>https://trac.libssh2.org/ticket/294</url>
 <cvename>CVE-2015-1782</cvename>
 </references>
 <dates>
 <discovery>2015-01-25</discovery>
 <entry>2015-09-22</entry>
 <modified>2015-09-22</modified>
 </dates>
 </vuln>

<vuln vid="2d56c7f4-b354-428f-8f48-38150c607a05">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>41.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>41.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.38</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.38</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>38.3.0,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>38.3.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>38.3.0</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>38.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	 MFSA 2015-96 Miscellaneous memory safety hazards (rv:41.0
	 / rv:38.3)
	 MFSA 2015-97 Memory leak in mozTCPSocket to servers
	 MFSA 2015-98 Out of bounds read in QCMS library with ICC
	 V4 profile attributes
	 MFSA 2015-99 Site attribute spoofing on Android by
	 pasting URL with unknown scheme
	 MFSA 2015-100 Arbitrary file manipulation by local user
	 through Mozilla updater
	 MFSA 2015-101 Buffer overflow in libvpx while parsing vp9
	 format video
	 MFSA 2015-102 Crash when using debugger with SavedStacks
	 in JavaScript
	 MFSA 2015-103 URL spoofing in reader mode
	 MFSA 2015-104 Use-after-free with shared workers and
	 IndexedDB
	 MFSA 2015-105 Buffer overflow while decoding WebM
	 video
	 MFSA 2015-106 Use-after-free while manipulating HTML
	 media content
	 MFSA 2015-107 Out-of-bounds read during 2D canvas display
	 on Linux 16-bit color depth systems
	 MFSA 2015-108 Scripted proxies can access inner
	 window
	 MFSA 2015-109 JavaScript immutable property enforcement
	 can be bypassed
	 MFSA 2015-110 Dragging and dropping images exposes final
	 URL after redirects
	 MFSA 2015-111 Errors in the handling of CORS preflight
	 request headers
	 MFSA 2015-112 Vulnerabilities found through code
	 inspection
	 MFSA 2015-113 Memory safety errors in libGLES in the
	 ANGLE graphics library
	 MFSA 2015-114 Information disclosure via the High
	 Resolution Time API
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4476</cvename>
 <cvename>CVE-2015-4500</cvename>
 <cvename>CVE-2015-4501</cvename>
 <cvename>CVE-2015-4502</cvename>
 <cvename>CVE-2015-4503</cvename>
 <cvename>CVE-2015-4504</cvename>
 <cvename>CVE-2015-4505</cvename>
 <cvename>CVE-2015-4506</cvename>
 <cvename>CVE-2015-4507</cvename>
 <cvename>CVE-2015-4508</cvename>
 <cvename>CVE-2015-4509</cvename>
 <cvename>CVE-2015-4510</cvename>
 <cvename>CVE-2015-4512</cvename>
 <cvename>CVE-2015-4516</cvename>
 <cvename>CVE-2015-4517</cvename>
 <cvename>CVE-2015-4519</cvename>
 <cvename>CVE-2015-4520</cvename>
 <cvename>CVE-2015-4521</cvename>
 <cvename>CVE-2015-4522</cvename>
 <cvename>CVE-2015-7174</cvename>
 <cvename>CVE-2015-7175</cvename>
 <cvename>CVE-2015-7176</cvename>
 <cvename>CVE-2015-7177</cvename>
 <cvename>CVE-2015-7178</cvename>
 <cvename>CVE-2015-7179</cvename>
 <cvename>CVE-2015-7180</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-96/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-97/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-98/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-99/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-100/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-101/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-102/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-103/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-104/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-105/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-106/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-107/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-108/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-109/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-110/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-111/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-112/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-113/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-114/</url>
 </references>
 <dates>
 <discovery>2015-09-22</discovery>
 <entry>2015-09-22</entry>
 </dates>
 </vuln>

<vuln vid="3d950687-b4c9-4a86-8478-c56743547af8">
 <topic>ffmpeg -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libav</name>
	
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>gstreamer1-libav</name>
	
	<range><lt>1.5.90</lt></range>
 </package>
 <package>
	<name>gstreamer-ffmpeg</name>
	
	
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>handbrake</name>
	
	
	<range><lt>1.2.0</lt></range>
 </package>
 <package>
	<name>ffmpeg</name>
	<range><lt>2.7.2,1</lt></range>
 </package>
 <package>
	<name>ffmpeg26</name>
	<range><lt>2.6.4</lt></range>
 </package>
 <package>
	<name>ffmpeg25</name>
	<range><lt>2.5.8</lt></range>
 </package>
 <package>
	<name>ffmpeg24</name>
	<range><lt>2.4.11</lt></range>
 </package>
 <package>
	<name>ffmpeg-devel</name>
	<name>ffmpeg23</name>
	<name>ffmpeg2</name>
	<name>ffmpeg1</name>
	<name>ffmpeg-011</name>
	<name>ffmpeg0</name>
	
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>avidemux</name>
	<name>avidemux2</name>
	<name>avidemux26</name>
	
	<range><lt>2.6.11</lt></range>
 </package>
 <package>
	<name>kodi</name>
	
	<range><lt>15.1</lt></range>
 </package>
 <package>
	<name>mplayer</name>
	<name>mencoder</name>
	
	<range><lt>1.1.r20150822</lt></range>
 </package>
 <package>
	<name>mythtv</name>
	<name>mythtv-frontend</name>
	
	<range><le>0.27.5,1</le></range>
 </package>
 <package>
	<name>plexhometheater</name>
	
	
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6818">
	 The decode_ihdr_chunk function in libavcodec/pngdec.c in
	 FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR
	 (aka image header) chunk in a PNG image, which allows remote
	 attackers to cause a denial of service (out-of-bounds array
	 access) or possibly have unspecified other impact via a
	 crafted image with two or more of these chunks.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6819">
	 Multiple integer underflows in the ff_mjpeg_decode_frame
	 function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2
	 allow remote attackers to cause a denial of service
	 (out-of-bounds array access) or possibly have unspecified
	 other impact via crafted MJPEG data.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6820">
	 The ff_sbr_apply function in libavcodec/aacsbr.c in
	 FFmpeg before 2.7.2 does not check for a matching AAC frame
	 syntax element before proceeding with Spectral Band
	 Replication calculations, which allows remote attackers to
	 cause a denial of service (out-of-bounds array access) or
	 possibly have unspecified other impact via crafted AAC
	 data.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6821">
	 The ff_mpv_common_init function in libavcodec/mpegvideo.c
	 in FFmpeg before 2.7.2 does not properly maintain the
	 encoding context, which allows remote attackers to cause a
	 denial of service (invalid pointer access) or possibly have
	 unspecified other impact via crafted MPEG data.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6822">
	 The destroy_buffers function in libavcodec/sanm.c in
	 FFmpeg before 2.7.2 does not properly maintain height and
	 width values in the video context, which allows remote
	 attackers to cause a denial of service (segmentation
	 violation and application crash) or possibly have
	 unspecified other impact via crafted LucasArts Smush video
	 data.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6823">
	 The allocate_buffers function in libavcodec/alac.c in
	 FFmpeg before 2.7.2 does not initialize certain context
	 data, which allows remote attackers to cause a denial of
	 service (segmentation violation) or possibly have
	 unspecified other impact via crafted Apple Lossless Audio
	 Codec (ALAC) data.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6824">
	 The sws_init_context function in libswscale/utils.c in
	 FFmpeg before 2.7.2 does not initialize certain pixbuf data
	 structures, which allows remote attackers to cause a denial
	 of service (segmentation violation) or possibly have
	 unspecified other impact via crafted video data.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6825">
	 The ff_frame_thread_init function in
	 libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles
	 certain memory-allocation failures, which allows remote
	 attackers to cause a denial of service (invalid pointer
	 access) or possibly have unspecified other impact via a
	 crafted file, as demonstrated by an AVI file.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6826">
	 The ff_rv34_decode_init_thread_copy function in
	 libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize
	 certain structure members, which allows remote attackers to
	 cause a denial of service (invalid pointer access) or
	 possibly have unspecified other impact via crafted (1) RV30
	 or (2) RV40 RealVideo data.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-6818</cvename>
 <cvename>CVE-2015-6819</cvename>
 <cvename>CVE-2015-6820</cvename>
 <cvename>CVE-2015-6821</cvename>
 <cvename>CVE-2015-6822</cvename>
 <cvename>CVE-2015-6823</cvename>
 <cvename>CVE-2015-6824</cvename>
 <cvename>CVE-2015-6825</cvename>
 <cvename>CVE-2015-6826</cvename>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=47f4e2d8960ca756ca153ab8e3e93d80449b8c91</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=84afc6b70d24fc0bf686e43138c96cf60a9445fe</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=79a98294da6cd85f8c86b34764c5e0c43b09eea3</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b160fc290cf49b516c5b6ee0730fd9da7fc623b1</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=39bbdebb1ed8eb9c9b0cd6db85afde6ba89d86e4</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7068bf277a37479aecde2832208d820682b35e6</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a5d44d5c220e12ca0cb7a4eceb0f74759cb13111</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f1a38264f20382731cf2cc75fdd98f4c9a84a626</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3197c0aa87a3b7190e17d49e6fbc7b554e4b3f0a</url>
 <url>https://ffmpeg.org/security.html</url>
 </references>
 <dates>
 <discovery>2015-09-05</discovery>
 <entry>2015-09-20</entry>
 <modified>2018-03-25</modified>
 </dates>
 </vuln>

<vuln vid="c2fcbec2-5daa-11e5-9909-002590263bf5">
 <topic>moodle -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moodle27</name>
	<range><lt>2.7.10</lt></range>
 </package>
 <package>
	<name>moodle28</name>
	<range><lt>2.8.8</lt></range>
 </package>
 <package>
	<name>moodle29</name>
	<range><lt>2.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Moodle Release Notes report:
	<blockquote cite="https://docs.moodle.org/dev/Moodle_2.7.10_release_notes">
	 MSA-15-0030: Students can re-attempt answering questions in the
	 lesson (CVE-2015-5264)
	 MSA-15-0031: Teacher in forum can still post to "all participants"
	 and groups they are not members of (CVE-2015-5272 - 2.7.10 only)
	 MSA-15-0032: Users can delete files uploaded by other users in wiki
	 (CVE-2015-5265)
	 MSA-15-0033: Meta course synchronization enrolls suspended students
	 as managers for a short period of time (CVE-2015-5266)
	 MSA-15-0034: Vulnerability in password recovery mechanism
	 (CVE-2015-5267)
	 MSA-15-0035: Rating component does not check separate groups
	 (CVE-2015-5268)
	 MSA-15-0036: XSS in grouping description (CVE-2015-5269)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5264</cvename>
 <cvename>CVE-2015-5272</cvename>
 <cvename>CVE-2015-5265</cvename>
 <cvename>CVE-2015-5266</cvename>
 <cvename>CVE-2015-5267</cvename>
 <cvename>CVE-2015-5268</cvename>
 <cvename>CVE-2015-5269</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/09/21/1</url>
 <url>https://docs.moodle.org/dev/Moodle_2.7.10_release_notes</url>
 <url>https://docs.moodle.org/dev/Moodle_2.8.8_release_notes</url>
 <url>https://docs.moodle.org/dev/Moodle_2.9.2_release_notes</url>
 </references>
 <dates>
 <discovery>2015-09-14</discovery>
 <entry>2015-09-18</entry>
 <modified>2015-09-24</modified>
 </dates>
 </vuln>

<vuln vid="d3a98c2d-5da1-11e5-9909-002590263bf5">
 <topic>squid -- TLS/SSL parser denial of service vulnerability</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><ge>3.5.0.1</ge><lt>3.5.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Amos Jeffries, release manager of the Squid-3 series, reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/18/1">
	 Vulnerable versions are 3.5.0.1 to 3.5.8 (inclusive), which are
	 built with OpenSSL and configured for "SSL-Bump" decryption.
	 Integer overflows can lead to invalid pointer math reading from
	 random memory on some CPU architectures. In the best case this leads
	 to wrong TLS extensions being used for the client, worst-case a
	 crash of the proxy terminating all active transactions.
	 Incorrect message size checks and assumptions about the existence
	 of TLS extensions in the SSL/TLS handshake message can lead to very
	 high CPU consumption (up to and including 'infinite loop'
	 behaviour).
	 The above can be triggered remotely. Though there is one layer of
	 authorization applied before this processing to check that the
	 client is allowed to use the proxy, that check is generally weak. MS
	 Skype on Windows XP is known to trigger some of these.
	</blockquote>
	The FreeBSD port does not use SSL by default and is not vulnerable
	 in the default configuration.
 </body>
 </description>
 <references>
 <freebsdpr>ports/203186</freebsdpr>
 <url>http://www.squid-cache.org/Advisories/SQUID-2015_3.txt</url>
 <url>http://www.openwall.com/lists/oss-security/2015/09/18/1</url>
 </references>
 <dates>
 <discovery>2015-09-18</discovery>
 <entry>2015-09-18</entry>
 <modified>2016-02-18</modified>
 </dates>
 </vuln>

<vuln vid="b55ecf12-5d98-11e5-9909-002590263bf5">
 <topic>remind -- buffer overflow with malicious reminder file input</topic>
 <affects>
 <package>
	<name>remind</name>
	<range><lt>3.1.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dianne Skoll reports:
	<blockquote cite="http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html">
	 BUG FIX: Fix a buffer overflow found by Alexander Keller.
	</blockquote>
	The bug can be manifested by an extended DUMP command using a system
	 variable (that is a special variable whose name begins with '$')
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5957</cvename>
 <freebsdpr>ports/202942</freebsdpr>
 <url>http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html</url>
 <url>http://www.openwall.com/lists/oss-security/2015/08/07/1</url>
 </references>
 <dates>
 <discovery>2015-07-27</discovery>
 <entry>2015-09-18</entry>
 </dates>
 </vuln>

<vuln vid="d45ad7ae-5d56-11e5-9ad8-14dae9d210b8">
 <topic>shutter -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>shutter</name>
	<range><ge>0.80</ge><lt>0.93.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Luke Farone reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/541">
	 In the "Shutter" screenshot application, I discovered that using the
	 "Show in folder" menu option while viewing a file with a
	 specially-crafted path allows for arbitrary code execution with the
	 permissions of the user running Shutter.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2015/q3/541</url>
 <url>https://bugs.launchpad.net/shutter/+bug/1495163</url>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798862</url>
 <cvename>CVE-2015-0854</cvename>
 </references>
 <dates>
 <discovery>2015-09-13</discovery>
 <entry>2015-09-17</entry>
 </dates>
 </vuln>

<vuln vid="a233d51f-5d4c-11e5-9ad8-14dae9d210b8">
 <topic>openjpeg -- use-after-free vulnerability</topic>
 <affects>
 <package>
	<name>openjpeg</name>
	<range><lt>2.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Feist Josselin reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/550">
	 Use-after-free was found in openjpeg. The vuln is fixed in
	 version 2.1.1 and was located in opj_j2k_write_mco function.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2015/q3/550</url>
 <url>https://github.com/uclouvain/openjpeg/issues/563</url>
 </references>
 <dates>
 <discovery>2015-08-14</discovery>
 <entry>2015-09-17</entry>
 </dates>
 </vuln>

<vuln vid="bab05188-5d4b-11e5-9ad8-14dae9d210b8">
 <topic>optipng -- use-after-free vulnerability</topic>
 <affects>
 <package>
	<name>optipng</name>
	<range><le>0.6.5</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gustavo Grieco reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/556">
	 We found a use-after-free causing an invalid/double free in
	 optipng 0.6.4.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2015/q3/556</url>
 <cvename>CVE-2015-7801</cvename>
 </references>
 <dates>
 <discovery>2015-09-16</discovery>
 <entry>2015-09-17</entry>
 <modified>2015-10-14</modified>
 </dates>
 </vuln>

<vuln vid="3c259621-5d4a-11e5-9ad8-14dae9d210b8">
 <topic>openslp -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>openslp</name>
	<range><lt>2.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Qinghao Tang reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/559">
	 The function ParseExtension() in openslp 1.2.1 contains
	 vulnerability: an attacker can cause a denial of service
	 (infinite loop) via a packet with crafted "nextoffset"
	 value and "extid" value.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2015/q3/559</url>
 <cvename>CVE-2015-5155</cvename>
 </references>
 <dates>
 <discovery>2015-09-16</discovery>
 <entry>2015-09-17</entry>
 </dates>
 </vuln>

<vuln vid="8f5c9dd6-5cac-11e5-9ad8-14dae9d210b8">
 <topic>p7zip -- directory traversal vulnerability</topic>
 <affects>
 <package>
	<name>p7zip</name>
	<range><lt>9.38.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Alexander Cherepanov reports:
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660">
	 7z (and 7zr) is susceptible to a directory traversal vulnerability.
	 While extracting an archive, it will extract symlinks and then follow
	 them if they are referenced in further entries. This can be exploited by
	 a rogue archive to write files outside the current directory.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660</url>
 <url>http://www.openwall.com/lists/oss-security/2015/01/11/2</url>
 <url>http://sourceforge.net/p/p7zip/bugs/147/</url>
 <cvename>CVE-2015-1038</cvename>
 </references>
 <dates>
 <discovery>2015-01-05</discovery>
 <entry>2015-09-16</entry>
 </dates>
 </vuln>

<vuln vid="31ea7f73-5c55-11e5-8607-74d02b9a84d5">
 <topic>h2o -- directory traversal vulnerability</topic>
 <affects>
 <package>
	<name>h2o</name>
	<range><lt>1.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Yakuzo reports:
	<blockquote cite="https://h2o.examp1e.net/vulnerabilities.html">
	 H2O (up to version 1.4.4 / 1.5.0-beta1) contains a flaw in its URL
	 normalization logic.
	 When file.dir directive is used, this flaw
	 allows a remote attacker to retrieve arbitrary files that exist
	 outside the directory specified by the directive.
	 H2O version 1.4.5 and version 1.5.0-beta2 have been released
	 to address this vulnerability.
	 Users are advised to upgrade their servers immediately.
	 The vulnerability was reported by: Yusuke OSUMI.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5638</cvename>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5638</url>
 </references>
 <dates>
 <discovery>2015-09-14</discovery>
 <entry>2015-09-16</entry>
 </dates>
 </vuln>

<vuln vid="f4ce64c2-5bd4-11e5-9040-3c970e169bc2">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.3.1,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samuel Sidler reports:
	<blockquote cite="https://wordpress.org/news/2015/09/wordpress-4-3-1/">
	 WordPress 4.3.1 is now available. This is a security
	 release for all previous versions and we strongly
	 encourage you to update your sites immediately.
	 <ul>
	 <li>WordPress versions 4.3 and earlier are vulnerable
	 to a cross-site scripting vulnerability when processing
	 shortcode tags (CVE-2015-5714). Reported by Shahar Tal
	 and Netanel Rubin of <a href="http://checkpoint.com/">Check Point</a>.</li>
	 <li>A separate cross-site scripting vulnerability was found
	 in the user list table. Reported by Ben Bidner of the
	 WordPress security team.</li>
	 <li>Finally, in certain cases, users without proper
	 permissions could publish private posts and make
	 them sticky (CVE-2015-5715). Reported by Shahar Tal
	 and Netanel Rubin of <a href="http://checkpoint.com/">Check Point</a>.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5714</cvename>
 <cvename>CVE-2015-5715</cvename>
 <cvename>CVE-2015-7989</cvename>
 <url>http://www.openwall.com/lists/oss-security/2015/10/28/1</url>
 <url>https://wordpress.org/news/2015/09/wordpress-4-3-1/</url>
 </references>
 <dates>
 <discovery>2015-09-15</discovery>
 <entry>2015-09-15</entry>
 <modified>2015-10-29</modified>
 </dates>
 </vuln>

<vuln vid="ea893f06-5a92-11e5-98c0-20cf30e32f6d">
 <topic>Bugzilla security issues</topic>
 <affects>
 <package>
	<name>bugzilla44</name>
	<range><lt>4.4.10</lt></range>
 </package>
 <package>
	<name>bugzilla50</name>
	<range><lt>5.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bugzilla Security Advisory
	<blockquote cite="https://www.bugzilla.org/security/4.2.14/">
	 Login names (usually an email address) longer than 127
	 characters are silently truncated in MySQL which could
	 cause the domain name of the email address to be
	 corrupted. An attacker could use this vulnerability to
	 create an account with an email address different from the
	 one originally requested. The login name could then be
	 automatically added to groups based on the group's regular
	 expression setting.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4499</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1202447</url>
 </references>
 <dates>
 <discovery>2015-09-10</discovery>
 <entry>2015-09-14</entry>
 </dates>
 </vuln>

<vuln vid="4910d161-58a4-11e5-9ad8-14dae9d210b8">
 <topic>openldap -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>openldap-server</name>
	<range><lt>2.4.42_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Denis Andzakovic reports:
	<blockquote cite="http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240">
	 By sending a crafted packet, an attacker may cause the
	 OpenLDAP server to reach an assert(9 9 statement, crashing the daemon.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240</url>
 <url>http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629</url>
 <cvename>CVE-2015-6908</cvename>
 </references>
 <dates>
 <discovery>2015-09-09</discovery>
 <entry>2015-09-12</entry>
 <modified>2015-09-13</modified>
 </dates>
 </vuln>

<vuln vid="a35f415d-572a-11e5-b0a4-f8b156b6dcc8">
 <topic>vorbis-tools, opus-tools -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>vorbis-tools</name>
	<range><lt>1.4.0_10,3</lt></range>
 </package>
 <package>
	<name>opus-tools</name>
	<range><lt>0.1.9_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Paris Zoumpouloglou reports:
	<blockquote cite="https://trac.xiph.org/ticket/2136">
	 I discovered an integer overflow issue in oggenc,
	 related to the number of channels in the input WAV file.
	 The issue triggers an out-of-bounds memory access which
	 causes oggenc to crash.
	</blockquote>
	Paris Zoumpouloglou reports:
	<blockquote cite="https://trac.xiph.org/ticket/2136">
	 A crafted WAV file with number of channels set to 0
	 will cause oggenc to crash due to a division by zero
	 issue.
	</blockquote>
	pengsu reports:
	<blockquote cite="https://trac.xiph.org/ticket/2212">
	 I discovered an buffer overflow issue in oggenc/audio.c
	 when it tries to open invalid aiff file.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/202941</freebsdpr>
 <url>https://trac.xiph.org/ticket/2136</url>
 <cvename>CVE-2014-9639</cvename>
 <url>https://trac.xiph.org/ticket/2137</url>
 <cvename>CVE-2014-9638</cvename>
 <url>https://trac.xiph.org/ticket/2212</url>
 <cvename>CVE-2015-6749</cvename>
 </references>
 <dates>
 <discovery>2015-08-08</discovery>
 <entry>2015-09-09</entry>
 <modified>2015-09-09</modified>
 </dates>
 </vuln>

<vuln vid="d76961da-56f6-11e5-934b-002590263bf5">
 <topic>pgbouncer -- failed auth_query lookup leads to connection as auth_user</topic>
 <affects>
 <package>
	<name>pgbouncer</name>
	<range><eq>1.6.0</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PgBouncer reports:
	<blockquote cite="http://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/">
	 New auth_user functionality introduced in 1.6 allows login as
	 auth_user when client presents unknown username. It's quite likely
	 auth_user is superuser. Affects only setups that have enabled
	 auth_user in their config.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-6817</cvename>
 <url>https://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/</url>
 <url>https://github.com/pgbouncer/pgbouncer/issues/69</url>
 <url>http://www.openwall.com/lists/oss-security/2015/09/04/3</url>
 </references>
 <dates>
 <discovery>2015-09-03</discovery>
 <entry>2015-09-09</entry>
 </dates>
 </vuln>

<vuln vid="3904f759-5659-11e5-a207-6805ca0b3d42">
 <topic>phpMyAdmin -- reCaptcha bypass</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.4.0</ge><lt>4.4.14.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-4/">
	 This vulnerability allows to complete the reCaptcha test
	 and subsequently perform a brute force attack to guess user
	 credentials without having to complete further reCaptcha
	 tests.

We consider this vulnerability to be non critical since
	 reCaptcha is an additional opt-in security measure.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.phpmyadmin.net/security/PMASA-2015-4/</url>
 <cvename>CVE-2015-6830</cvename>
 </references>
 <dates>
 <discovery>2015-09-08</discovery>
 <entry>2015-09-08</entry>
 </dates>
 </vuln>

<vuln vid="3d675519-5654-11e5-9ad8-14dae9d210b8">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5</name>
	<name>php5-soap</name>
	<name>php5-xsl</name>
	<range><lt>5.4.45</lt></range>
 </package>
 <package>
	<name>php55</name>
	<name>php55-soap</name>
	<name>php55-xsl</name>
	<range><lt>5.5.29</lt></range>
 </package>
 <package>
	<name>php56</name>
	<name>php56-soap</name>
	<name>php56-xsl</name>
	<range><lt>5.6.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP reports:
	<blockquote cite="http://php.net/ChangeLog-5.php#5.4.45">
	 <ul><li>Core:
	 <ul>
	 <li>Fixed bug #70172 (Use After Free Vulnerability in unserialize()).</li>
	 <li>Fixed bug #70219 (Use after free vulnerability in session deserializer).</li>
	 </ul></li>
	 <li>EXIF:
	 <ul>
	 <li>Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).</li>
	 </ul></li>
	 <li>hash:
	 <ul>
	 <li>Fixed bug #70312 (HAVAL gives wrong hashes in specific cases).</li>
	 </ul></li>
	 <li>PCRE:
	 <ul>
	 <li>Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).</li>
	 </ul></li>
	 <li>SOAP:
	 <ul>
	 <li>Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE).</li>
	 </ul></li>
	 <li>SPL:
	 <ul>
	 <li>Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage).</li>
	 <li>Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList).</li>
	 </ul></li>
	 <li>XSLT:
	 <ul>
	 <li>Fixed bug #69782 (NULL pointer dereference).</li>
	 </ul></li>
	 <li>ZIP:
	 <ul>
	 <li>Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories).</li>
	 </ul></li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://php.net/ChangeLog-5.php#5.4.45</url>
 <url>http://php.net/ChangeLog-5.php#5.5.29</url>
 <url>http://php.net/ChangeLog-5.php#5.6.13</url>
 <cvename>CVE-2015-6834</cvename>
 <cvename>CVE-2015-6835</cvename>
 <cvename>CVE-2015-6836</cvename>
 <cvename>CVE-2015-6837</cvename>
 <cvename>CVE-2015-6838</cvename>
 </references>
 <dates>
 <discovery>2015-09-03</discovery>
 <entry>2015-09-08</entry>
 <modified>2015-09-08</modified>
 </dates>
 </vuln>

<vuln vid="d68df01b-564e-11e5-9ad8-14dae9d210b8">
 <topic>ganglia-webfrontend -- auth bypass</topic>
 <affects>
 <package>
	<name>ganglia-webfrontend</name>
	<range><lt>3.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ivan Novikov reports:
	<blockquote cite="https://github.com/ganglia/ganglia-web/issues/267">
	 It's easy to bypass auth by using boolean serialization...
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/ganglia/ganglia-web/issues/267</url>
 <cvename>CVE-2015-6816</cvename>
 </references>
 <dates>
 <discovery>2015-09-04</discovery>
 <entry>2015-09-08</entry>
 <modified>2015-09-08</modified>
 </dates>
 </vuln>

<vuln vid="9bdd8eb5-564a-11e5-9ad8-14dae9d210b8">
 <topic>wireshark -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>wireshark-qt5</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>1.12.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wireshark development team reports:
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html">
	 The following vulnerabilities have been fixed.
	 <ul>
	 <li>wnpa-sec-2015-21
	 Protocol tree crash. (Bug 11309)</li>
	 <li>wnpa-sec-2015-22
	 Memory manager crash. (Bug 11373)</li>
	 <li>wnpa-sec-2015-23
	 Dissector table crash. (Bug 11381)</li>
	 <li>wnpa-sec-2015-24
	 ZigBee crash. (Bug 11389)</li>
	 <li>wnpa-sec-2015-25
	 GSM RLC/MAC infinite loop. (Bug 11358)</li>
	 <li>wnpa-sec-2015-26
	 WaveAgent crash. (Bug 11358)</li>
	 <li>wnpa-sec-2015-27
	 OpenFlow infinite loop. (Bug 11358)</li>
	 <li>wnpa-sec-2015-28
	 Ptvcursor crash. (Bug 11358)</li>
	 <li>wnpa-sec-2015-29
	 WCCP crash. (Bug 11358)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html</url>
 <cvename>CVE-2015-6241</cvename>
 <cvename>CVE-2015-6242</cvename>
 <cvename>CVE-2015-6243</cvename>
 <cvename>CVE-2015-6244</cvename>
 <cvename>CVE-2015-6245</cvename>
 <cvename>CVE-2015-6246</cvename>
 <cvename>CVE-2015-6247</cvename>
 <cvename>CVE-2015-6248</cvename>
 <cvename>CVE-2015-6249</cvename>
 </references>
 <dates>
 <discovery>2015-08-12</discovery>
 <entry>2015-09-08</entry>
 <modified>2015-09-08</modified>
 </dates>
 </vuln>

<vuln vid="98092444-5645-11e5-9ad8-14dae9d210b8">
 <topic>screen -- stack overflow</topic>
 <affects>
 <package>
	<name>screen</name>
	<range><lt>4.3.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kuang-che Wu reports:
	<blockquote cite="https://savannah.gnu.org/bugs/?45713">
	 screen will recursively call MScrollV to depth n/256. This
	 is time consuming and will overflow stack if n is huge.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://savannah.gnu.org/bugs/?45713</url>
 <cvename>CVE-2015-6806</cvename>
 </references>
 <dates>
 <discovery>2015-08-07</discovery>
 <entry>2015-09-08</entry>
 </dates>
 </vuln>

<vuln vid="b5e654c3-5644-11e5-9ad8-14dae9d210b8">
 <topic>libvncserver -- memory corruption</topic>
 <affects>
 <package>
	<name>libvncserver</name>
	<range><lt>0.9.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Petr Pisar reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=706087">
	 libvncserver/tight.c:rfbTightCleanup() frees a buffer without zeroing freed pointer.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=706087</url>
 <url>https://github.com/LibVNC/libvncserver/commit/804335f9d296440bb708ca844f5d89b58b50b0c6</url>
 </references>
 <dates>
 <discovery>2011-05-19</discovery>
 <entry>2015-09-08</entry>
 </dates>
 </vuln>

<vuln vid="ed0ecad5-531d-11e5-9850-bcaec565249c">
 <topic>gdk-pixbuf2 -- integer overflows</topic>
 <affects>
 <package>
	<name>gdk-pixbuf2</name>
	<range><lt>2.31.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Clasen reports:
	<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00013.html">
	 Fix several integer overflows.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00013.html</url>
 </references>
 <dates>
 <discovery>2015-09-01</discovery>
 <entry>2015-09-04</entry>
 </dates>
 </vuln>

<vuln vid="2c5e7e23-5248-11e5-9ad8-14dae9d210b8">
 <topic>bind -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><ge>9.9.7</ge><lt>9.9.7P3</lt></range>
 </package>
 <package>
	<name>bind910</name>
	<range><lt>9.10.2P4</lt></range>
 </package>
 <package>
	<name>bind910-base</name>
	<name>bind99-base</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/">
	 An incorrect boundary check in openpgpkey_61.c can cause
	 named to terminate due to a REQUIRE assertion failure. This defect can
	 be deliberately exploited by an attacker who can provide a maliciously
	 constructed response in answer to a query.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/</url>
 <cvename>CVE-2015-5986</cvename>
 </references>
 <dates>
 <discovery>2015-08-19</discovery>
 <entry>2015-09-03</entry>
 </dates>
 </vuln>

<vuln vid="eaf3b255-5245-11e5-9ad8-14dae9d210b8">
 <topic>bind -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><lt>9.9.7P3</lt></range>
 </package>
 <package>
	<name>bind910</name>
	<range><ge>9.10.2</ge><lt>9.10.2P4</lt></range>
 </package>
 <package>
	<name>bind910-base</name>
	<name>bind99-base</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/">
	 Parsing a malformed DNSSEC key can cause a validating
	 resolver to exit due to a failed assertion in buffer.c. It is possible
	 for a remote attacker to deliberately trigger this condition, for
	 example by using a query which requires a response from a zone
	 containing a deliberately malformed key.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/</url>
 <cvename>CVE-2015-5722</cvename>
 <freebsdsa>SA-15:23.bind</freebsdsa>
 </references>
 <dates>
 <discovery>2015-08-19</discovery>
 <entry>2015-09-03</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="a9350df8-5157-11e5-b5c1-e8e0b747a45a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>45.0.2454.85</lt></range>
 </package>
 <package>
	
	<name>chromium-npapi</name>
	<range><lt>45.0.2454.85</lt></range>
 </package>
 <package>
	
	<name>chromium-pulse</name>
	<range><lt>45.0.2454.85</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl">
	 29 security fixes in this release, including:
	 <ul>
	 <li>[516377] High CVE-2015-1291: Cross-origin bypass in DOM. Credit
	 to anonymous.</li>
	 <li>[522791] High CVE-2015-1292: Cross-origin bypass in
	 ServiceWorker. Credit to Mariusz Mlynski.</li>
	 <li>[524074] High CVE-2015-1293: Cross-origin bypass in DOM. Credit
	 to Mariusz Mlynski.</li>
	 <li>[492263] High CVE-2015-1294: Use-after-free in Skia. Credit
	 to cloudfuzzer.</li>
	 <li>[502562] High CVE-2015-1295: Use-after-free in Printing. Credit
	 to anonymous.</li>
	 <li>[421332] High CVE-2015-1296: Character spoofing in omnibox.
	 Credit to zcorpan.</li>
	 <li>[510802] Medium CVE-2015-1297: Permission scoping error in
	 Webrequest. Credit to Alexander Kashev.</li>
	 <li>[518827] Medium CVE-2015-1298: URL validation error in
	 extensions. Credit to Rob Wu.</li>
	 <li>[416362] Medium CVE-2015-1299: Use-after-free in Blink. Credit
	 to taro.suzuki.dev.</li>
	 <li>[511616] Medium CVE-2015-1300: Information leak in Blink. Credit
	 to cgvwzq.</li>
	 <li>[526825] CVE-2015-1301: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1291</cvename>
 <cvename>CVE-2015-1292</cvename>
 <cvename>CVE-2015-1293</cvename>
 <cvename>CVE-2015-1294</cvename>
 <cvename>CVE-2015-1295</cvename>
 <cvename>CVE-2015-1296</cvename>
 <cvename>CVE-2015-1297</cvename>
 <cvename>CVE-2015-1298</cvename>
 <cvename>CVE-2015-1299</cvename>
 <cvename>CVE-2015-1300</cvename>
 <cvename>CVE-2015-1301</cvename>
 <url>http://googlechromereleases.blogspot.nl</url>
 </references>
 <dates>
 <discovery>2015-09-01</discovery>
 <entry>2015-09-02</entry>
 </dates>
 </vuln>

<vuln vid="55c43f5b-5190-11e5-9ad8-14dae9d210b8">
 <topic>powerdns -- denial of service</topic>
 <affects>
 <package>
	<name>powerdns</name>
	<range><ge>3.4.0</ge><lt>3.4.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS reports:
	<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/">
	 A bug was found in our DNS packet parsing/generation code,
	 which, when exploited, can cause individual threads (disabling service)
	 or whole processes (allowing a supervisor to restart them) to crash with
	 just one or a few query packets.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/</url>
 <cvename>CVE-2015-5230</cvename>
 </references>
 <dates>
 <discovery>2015-09-02</discovery>
 <entry>2015-09-02</entry>
 </dates>
 </vuln>

<vuln vid="fc1f6658-4f53-11e5-934b-002590263bf5">
 <topic>ghostscript -- denial of service (crash) via crafted Postscript files</topic>
 <affects>
 <package>
	<name>ghostscript7</name>
	<name>ghostscript7-nox11</name>
	<name>ghostscript7-base</name>
	<name>ghostscript7-x11</name>
	<range><lt>7.07_32</lt></range>
 </package>
 <package>
	<name>ghostscript8</name>
	<name>ghostscript8-nox11</name>
	<name>ghostscript8-base</name>
	<name>ghostscript8-x11</name>
	<range><lt>8.71_19</lt></range>
 </package>
 <package>
	<name>ghostscript9</name>
	<name>ghostscript9-nox11</name>
	<name>ghostscript9-base</name>
	<name>ghostscript9-x11</name>
	<range><lt>9.06_11</lt></range>
 </package>
 <package>
	<name>ghostscript9-agpl</name>
	<name>ghostscript9-agpl-nox11</name>
	<range><lt>9.15_2</lt></range>
 </package>
 <package>
	<name>ghostscript9-agpl-base</name>
	<name>ghostscript9-agpl-x11</name>
	<range><lt>9.16_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3228">
	 Integer overflow in the gs_heap_alloc_bytes function in
	 base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote
	 attackers to cause a denial of service (crash) via a crafted
	 Postscript (ps) file, as demonstrated by using the ps2pdf command,
	 which triggers an out-of-bounds read or write.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3228</cvename>
 <url>http://bugs.ghostscript.com/show_bug.cgi?id=696041</url>
 <url>http://bugs.ghostscript.com/show_bug.cgi?id=696070</url>
 <url>http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0c0b0859</url>
 </references>
 <dates>
 <discovery>2015-06-17</discovery>
 <entry>2015-09-01</entry>
 <modified>2015-09-02</modified>
 </dates>
 </vuln>

<vuln vid="80c66af0-d1c5-449e-bd31-63b12525ff88">
 <topic>ffmpeg -- out-of-bounds array access</topic>
 <affects>
 <package>
	<name>libav</name>
	<range><ge>11.0</ge><lt>11.4</lt></range>
	<range><lt>10.7</lt></range>
 </package>
 <package>
	<name>gstreamer1-libav</name>
	
	<range><lt>1.5.1</lt></range>
 </package>
 <package>
	<name>handbrake</name>
	
	
	<range><lt>1.2.0</lt></range>
 </package>
 <package>
	<name>ffmpeg</name>
	<range><ge>2.2.0,1</ge><lt>2.2.15,1</lt></range>
	<range><lt>2.0.7,1</lt></range>
 </package>
 <package>
	<name>ffmpeg26</name>
	<range><lt>2.6.2</lt></range>
 </package>
 <package>
	<name>ffmpeg25</name>
	<range><lt>2.5.6</lt></range>
 </package>
 <package>
	<name>ffmpeg24</name>
	<range><lt>2.4.8</lt></range>
 </package>
 <package>
	<name>ffmpeg23</name>
	
	
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>ffmpeg1</name>
	
	
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>avidemux</name>
	<name>avidemux26</name>
	
	<range><lt>2.6.11</lt></range>
 </package>
 <package>
	<name>kodi</name>
	
	<range><lt>15.1</lt></range>
 </package>
 <package>
	<name>mplayer</name>
	<name>mencoder</name>
	
	<range><lt>1.1.r20150403</lt></range>
 </package>
 <package>
	<name>mythtv</name>
	<name>mythtv-frontend</name>
	
	<range><le>0.27.5,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3395">
	 The msrle_decode_pal4 function in msrledec.c in Libav
	 before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7,
	 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6,
	 and 2.6.x before 2.6.2 allows remote attackers to have
	 unspecified impact via a crafted image, related to a pixel
	 pointer, which triggers an out-of-bounds array access.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3395</cvename>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7e1367f58263593e6cee3c282f7277d7ee9d553</url>
 <url>https://git.libav.org/?p=libav.git;a=commit;h=5ecabd3c54b7c802522dc338838c9a4c2dc42948</url>
 <url>https://ffmpeg.org/security.html</url>
 <url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4</url>
 </references>
 <dates>
 <discovery>2015-04-12</discovery>
 <entry>2015-09-01</entry>
 <modified>2018-03-25</modified>
 </dates>
 </vuln>

<vuln vid="da434a78-e342-4d9a-87e2-7497e5f117ba">
 <topic>ffmpeg -- use-after-free</topic>
 <affects>
 <package>
	<name>libav</name>
	<range><ge>11.0</ge><lt>11.4</lt></range>
	<range><lt>10.7</lt></range>
 </package>
 <package>
	<name>gstreamer1-libav</name>
	
	<range><lt>1.5.0</lt></range>
 </package>
 <package>
	<name>handbrake</name>
	
	
	<range><lt>1.2.0</lt></range>
 </package>
 <package>
	<name>ffmpeg</name>
	<range><ge>2.2.0,1</ge><lt>2.2.12,1</lt></range>
	<range><ge>2.1.0,1</ge><lt>2.1.7,1</lt></range>
	<range><lt>2.0.7,1</lt></range>
 </package>
 <package>
	<name>ffmpeg25</name>
	<range><lt>2.5.2</lt></range>
 </package>
 <package>
	<name>ffmpeg24</name>
	<range><lt>2.4.5</lt></range>
 </package>
 <package>
	<name>ffmpeg23</name>
	<range><lt>2.3.6</lt></range>
 </package>
 <package>
	<name>ffmpeg1</name>
	<range><lt>1.2.11</lt></range>
 </package>
 <package>
	<name>mythtv</name>
	<name>mythtv-frontend</name>
	
	<range><le>0.27.5,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3417">
	 Use-after-free vulnerability in the ff_h264_free_tables
	 function in libavcodec/h264.c in FFmpeg before 2.3.6 allows
	 remote attackers to cause a denial of service or possibly
	 have unspecified other impact via crafted H.264 data in an
	 MP4 file, as demonstrated by an HTML VIDEO element that
	 references H.264 data.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3417</cvename>
 
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=e8714f6f93d1a32f4e4655209960afcf4c185214</url>
 <url>https://git.libav.org/?p=libav.git;a=commitdiff;h=3b69f245dbe6e2016659a45c4bfe284f6c5ac57e</url>
 <url>https://ffmpeg.org/security.html</url>
 <url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4</url>
 </references>
 <dates>
 <discovery>2014-12-19</discovery>
 <entry>2015-09-01</entry>
 <modified>2018-03-25</modified>
 </dates>
 </vuln>

<vuln vid="5300711b-4e61-11e5-9ad8-14dae9d210b8">
 <topic>graphviz -- format string vulnerability</topic>
 <affects>
 <package>
	<name>graphviz</name>
	<range><lt>2.38.0_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Joshua Rogers reports:
	<blockquote cite="http://seclists.org/oss-sec/2014/q4/784">
	 A format string vulnerability has been found in `graphviz'.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2014/q4/784</url>
 <url>https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081</url>
 </references>
 <dates>
 <discovery>2014-11-24</discovery>
 <entry>2015-08-29</entry>
 </dates>
 </vuln>

<vuln vid="237a201c-888b-487f-84d3-7d92266381d6">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>40.0.3,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>40.0.3,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>38.2.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	 MFSA 2015-95 Add-on notification bypass through data URLs
	 MFSA 2015-94 Use-after-free when resizing canvas element
	 during restyling
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4497</cvename>
 <cvename>CVE-2015-4498</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-94/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-95/</url>
 </references>
 <dates>
 <discovery>2015-08-27</discovery>
 <entry>2015-08-28</entry>
 </dates>
 </vuln>

<vuln vid="4464212e-4acd-11e5-934b-002590263bf5">
 <topic>go -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>go</name>
	<range><lt>1.4.3,1</lt></range>
 </package>
 <package>
	<name>go14</name>
	<range><lt>1.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jason Buberel, Go Product Manager, reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/237">
	 CVE-2015-5739 - "Content Length" treated as valid header
	 CVE-2015-5740 - Double content-length headers does not return 400
	 error
	 CVE-2015-5741 - Additional hardening, not sending Content-Length
	 w/Transfer-Encoding, Closing connections
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5739</cvename>
 <cvename>CVE-2015-5740</cvename>
 <cvename>CVE-2015-5741</cvename>
 <url>https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9</url>
 <url>https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e</url>
 <url>https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f</url>
 <url>http://seclists.org/oss-sec/2015/q3/237</url>
 </references>
 <dates>
 <discovery>2015-07-29</discovery>
 <entry>2015-08-25</entry>
 </dates>
 </vuln>

<vuln vid="40497e81-fee3-4e54-9d5f-175a5c633b73">
 <topic>libtremor -- memory corruption</topic>
 <affects>
 <package>
	<name>libtremor</name>
	<range><lt>1.2.0.s20120120</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2012-07/">
	 Security researcher regenrecht reported via
	 TippingPoint's Zero Day Initiative the possibility of memory
	 corruption during the decoding of Ogg Vorbis files. This can
	 cause a crash during decoding and has the potential for
	 remote code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0444</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=719612</url>
 <url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=3daa274</url>
 </references>
 <dates>
 <discovery>2012-01-31</discovery>
 <entry>2015-08-25</entry>
 <modified>2015-08-25</modified>
 </dates>
 </vuln>

<vuln vid="3dac84c9-bce1-4199-9784-d68af1eb7b2e">
 <topic>libtremor -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libtremor</name>
	<range><lt>1.2.0.s20101013</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The RedHat Project reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=438125">
	 Will Drewry of the Google Security Team reported multiple
	 issues in OGG Vorbis and Tremor libraries, that could cause
	 application using those libraries to crash (NULL pointer
	 dereference or divide by zero), enter an infinite loop or
	 cause heap overflow caused by integer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1418</cvename>
 <cvename>CVE-2008-1419</cvename>
 <cvename>CVE-2008-1420</cvename>
 <cvename>CVE-2008-1423</cvename>
 <cvename>CVE-2008-2009</cvename>
 <url>http://redpig.dataspill.org/2008/05/multiple-vulnerabilities-in-ogg-tremor.html</url>
 <url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=7e94eea</url>
 <url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=1d1f93e</url>
 <url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=159efc4</url>
 </references>
 <dates>
 <discovery>2008-03-19</discovery>
 <entry>2015-08-25</entry>
 <modified>2015-08-25</modified>
 </dates>
 </vuln>

<vuln vid="6900e6f1-4a79-11e5-9ad8-14dae9d210b8">
 <topic>pcre -- heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>pcre</name>
	<range><lt>8.37_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Guanxing Wen reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/295">
	 PCRE library is prone to a vulnerability which leads to
	 Heap Overflow.
	 During the compilation of a malformed regular expression, more data is
	 written on the malloced block than the expected size output by
	 compile_regex().
	 The Heap Overflow vulnerability is caused by the following regular
	 expression.
	 /(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/
	 A dry run of this particular regular expression with pcretest will
	 reports "double free or corruption (!prev)".
	 But it is actually a heap overflow problem.
	 The overflow only affects pcre 8.x branch, pcre2 branch is not affected.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2015/q3/295</url>
 <url>https://bugs.exim.org/show_bug.cgi?id=1672</url>
 </references>
 <dates>
 <discovery>2015-08-21</discovery>
 <entry>2015-08-24</entry>
 </dates>
 </vuln>

<vuln vid="9393213d-489b-11e5-b8c7-d050996490d0">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal6</name>
	<range><lt>6.37</lt></range>
 </package>
 <package>
	<name>drupal7</name>
	<range><lt>7.39</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal development team reports:
	<blockquote cite="https://www.drupal.org/SA-CORE-2015-003">
	 This security advisory fixes multiple vulnerabilities.
	 See below for a list.
	 <h3>Cross-site Scripting - Ajax system - Drupal 7</h3>
	 A vulnerability was found that allows a malicious
	 user to perform a cross-site scripting attack by
	 invoking Drupal.ajax() on a whitelisted HTML element.
	 This vulnerability is mitigated on sites that do not
	 allow untrusted users to enter HTML.
	 <h3>Cross-site Scripting - Autocomplete system - Drupal 6 and 7</h3>
	 A cross-site scripting vulnerability was found in
	 the autocomplete functionality of forms. The
	 requested URL is not sufficiently sanitized.
	 This vulnerability is mitigated by the fact that
	 the malicious user must be allowed to upload files.
	 <h3>SQL Injection - Database API - Drupal 7</h3>
	 A vulnerability was found in the SQL comment
	 filtering system which could allow a user with
	 elevated permissions to inject malicious code in
	 SQL comments.
	 This vulnerability is mitigated by the fact that
	 only one contributed module that the security team
	 found uses the comment filtering system in a way
	 that would trigger the vulnerability. That module
	 requires you to have a very high level of access
	 in order to perform the attack.
	 <h3>Cross-site Request Forgery - Form API - Drupal 6 and 7</h3>
	 A vulnerability was discovered in Drupal's form API
	 that could allow file upload value callbacks to run
	 with untrusted input, due to form token validation
	 not being performed early enough. This vulnerability
	 could allow a malicious user to upload files to the
	 site under another user's account.
	 This vulnerability is mitigated by the fact that
	 the uploaded files would be temporary, and Drupal
	 normally deletes temporary files automatically
	 after 6 hours.
	 <h3>Information Disclosure in Menu Links - Access system - Drupal 6 and 7</h3>
	 Users without the "access content" permission
	 can see the titles of nodes that they do not have
	 access to, if the nodes are added to a menu on the
	 site that the users have access to.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.drupal.org/SA-CORE-2015-003</url>
 </references>
 <dates>
 <discovery>2015-08-19</discovery>
 <entry>2015-08-22</entry>
 </dates>
 </vuln>

<vuln vid="2920c449-4850-11e5-825f-c80aa9043978">
 <topic>OpenSSH -- PAM vulnerabilities</topic>
 <affects>
 <package>
	<name>openssh-portable</name>
	<range><lt>7.0.p1,1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.2</ge><lt>10.2_2</lt></range>
	<range><ge>10.1</ge><lt>10.1_19</lt></range>
	<range><ge>9.3</ge><lt>9.3_24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.openssh.com/txt/release-7.0">
	 OpenSSH 6.8 and 6.9 incorrectly set TTYs to be world-writable.
	 Local attackers may be able to write arbitrary messages to
	 logged-in users, including terminal escape sequences. Reported
	 by Nikolay Edigaryev.
	 Fixed a privilege separation
	 weakness related to PAM support. Attackers who could successfully
	 compromise the pre-authentication process for remote code
	 execution and who had valid credentials on the host could
	 impersonate other users.
	 Fixed a use-after-free bug
	 related to PAM support that was reachable by attackers who could
	 compromise the pre-authentication process for remote code
	 execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openssh.com/txt/release-7.0</url>
 <cvename>CVE-2015-6563</cvename>
 <cvename>CVE-2015-6564</cvename>
 <cvename>CVE-2015-6565</cvename>
 <freebsdsa>SA-15:22.openssh</freebsdsa>
 </references>
 <dates>
 <discovery>2015-08-11</discovery>
 <entry>2015-08-21</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="27fed73e-484f-11e5-825f-c80aa9043978">
 <topic>OpenSSH -- PermitRootLogin may allow password connections with 'without-password'</topic>
 <affects>
 <package>
	<name>openssh-portable</name>
	<range><eq>7.0.p1,1</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.openssh.com/txt/release-7.1">
	 OpenSSH 7.0 contained a logic error in PermitRootLogin=
	 prohibit-password/without-password that could, depending on
	 compile-time configuration, permit password authentication to
	 root while preventing other forms of authentication. This problem
	 was reported by Mantas Mikulenas.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openssh.com/txt/release-7.1</url>
 </references>
 <dates>
 <discovery>2015-08-20</discovery>
 <entry>2015-08-21</entry>
 </dates>
 </vuln>

<vuln vid="2fe40238-480f-11e5-adde-14dae9d210b8">
 <topic>tarsnap -- buffer overflow and local DoS</topic>
 <affects>
 <package>
	<name>tarsnap</name>
	<range><lt>1.0.36</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Colin Percival reports:
	<blockquote cite="http://mail.tarsnap.com/tarsnap-announce/msg00032.html">
	 1. SECURITY FIX: When constructing paths of objects being archived, a buffer
	 could overflow by one byte upon encountering 1024, 2048, 4096, etc. byte
	 paths. Theoretically this could be exploited by an unprivileged user whose
	 files are being archived; I do not believe it is exploitable in practice,
	 but I am offering a $1000 bounty for the first person who can prove me wrong:
	 http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html
	 2. SECURITY FIX: An attacker with a machine's write keys, or with read keys
	 and control of the tarsnap service, could make tarsnap allocate a large
	 amount of memory upon listing archives or reading an archive the attacker
	 created; on 32-bit machines, tarsnap can be caused to crash under the
	 aforementioned conditions.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://mail.tarsnap.com/tarsnap-announce/msg00032.html</url>
 <url>http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html</url>
 </references>
 <dates>
 <discovery>2015-08-21</discovery>
 <entry>2015-08-21</entry>
 </dates>
 </vuln>

<vuln vid="a0a4e24c-4760-11e5-9391-3c970e169bc2">
 <topic>vlc -- arbitrary pointer dereference vulnerability</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><lt>2.2.1_5,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	oCERT reports:
	<blockquote cite="https://www.ocert.org/advisories/ocert-2015-009.html">
	 The stable VLC version suffers from an arbitrary pointer
	 dereference vulnerability.
	 The vulnerability affects the 3GP file format parser,
	 insufficient restrictions on a writable buffer can be
	 exploited to execute arbitrary code via the heap memory.
	 A specific 3GP file can be crafted to trigger the
	 vulnerability.
	 Credit: vulnerability reported by Loren Maggiore of
	 Trail of Bits.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5949</cvename>
 <url>https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=ce91452460a75d7424b165c4dc8db98114c3cbd9;hp=9e12195d3e4316278af1fa4bcb6a705ff27456fd</url>
 <url>https://www.ocert.org/advisories/ocert-2015-009.html</url>
 </references>
 <dates>
 <discovery>2015-08-20</discovery>
 <entry>2015-08-20</entry>
 </dates>
 </vuln>

<vuln vid="9a71953a-474a-11e5-adde-14dae9d210b8">
 <topic>libpgf -- use-after-free</topic>
 <affects>
 <package>
	<name>libpgf</name>
	<range><le>6.14.12</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pengsu Cheng reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/404">
	 An use-after-free issue in Decoder.cpp was reported to
	 upstream. The problem is due to lack of validation of ColorTableSize.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2015/q3/404</url>
 <url>https://sourceforge.net/p/libpgf/code/147/</url>
 <url>https://sourceforge.net/p/libpgf/code/148/</url>
 <cvename>CVE-2015-6673</cvename>
 </references>
 <dates>
 <discovery>2015-08-08</discovery>
 <entry>2015-08-20</entry>
 <modified>2015-08-26</modified>
 </dates>
 </vuln>

<vuln vid="f5b8b670-465c-11e5-a49d-bcaec565249c">
 <topic>gdk-pixbuf2 -- heap overflow and DoS</topic>
 <affects>
 <package>
	<name>gdk-pixbuf2</name>
	<range><lt>2.31.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gustavo Grieco reports:
	<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=752297">
	 We found a heap overflow and a DoS in the gdk-pixbuf
	 implementation triggered by the scaling of a malformed bmp.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4491</cvename>
 <url>https://bugzilla.gnome.org/show_bug.cgi?id=752297</url>
 </references>
 <dates>
 <discovery>2015-07-12</discovery>
 <entry>2015-08-19</entry>
 </dates>
 </vuln>

<vuln vid="b0e54dc1-45d2-11e5-adde-14dae9d210b8">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-django</name>
	<name>py32-django</name>
	<name>py33-django</name>
	<name>py34-django</name>
	<range><lt>1.8.4</lt></range>
 </package>
 <package>
	<name>py27-django17</name>
	<name>py32-django17</name>
	<name>py33-django17</name>
	<name>py34-django17</name>
	<range><lt>1.7.10</lt></range>
 </package>
 <package>
	<name>py27-django14</name>
	<name>py32-django14</name>
	<name>py33-django14</name>
	<name>py34-django14</name>
	<range><lt>1.4.22</lt></range>
 </package>
 <package>
	<name>py27-django-devel</name>
	<name>py32-django-devel</name>
	<name>py33-django-devel</name>
	<name>py34-django-devel</name>
	<range><le>20150709,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Graham reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2015/aug/18/security-releases/">
	 Denial-of-service possibility in logout() view by filling
	 session store
	 Previously, a session could be created when anonymously
	 accessing the django.contrib.auth.views.logout view
	 (provided it wasn't decorated with django.contrib.auth.decorators.login_required
	 as done in the admin). This could allow an attacker to
	 easily create many new session records by sending repeated
	 requests, potentially filling up the session store or
	 causing other users' session records to be evicted.
	 The django.contrib.sessions.middleware.SessionMiddleware
	 has been modified to no longer create empty session records.
	 This portion of the fix has been assigned CVE-2015-5963.
	 Additionally, on the 1.4 and 1.7 series only, the
	 contrib.sessions.backends.base.SessionBase.flush() and
	 cache_db.SessionStore.flush() methods have been modified
	 to avoid creating a new empty session. Maintainers of
	 third-party session backends should check if the same
	 vulnerability is present in their backend and correct
	 it if so.
	 This portion of the fix has been assigned CVE-2015-5964.
	 Anyone reporting a similar vulnerability in a third-party
	 session backend should not use this CVE ID.
	 Thanks Lin Hua Cheng for reporting the issue.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2015/aug/18/security-releases/</url>
 <cvename>CVE-2015-5963</cvename>
 <cvename>CVE-2015-5964</cvename>
 </references>
 <dates>
 <discovery>2015-08-18</discovery>
 <entry>2015-08-18</entry>
 </dates>
 </vuln>

<vuln vid="0ecc1f55-45d0-11e5-adde-14dae9d210b8">
 <topic>unreal -- denial of service</topic>
 <affects>
 <package>
	<name>Unreal</name>
	<range><ge>3.2.10</ge><lt>3.2.10.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Unreal reports:
	<blockquote cite="https://www.unrealircd.org/txt/unrealsecadvisory.20150816.txt">
	 Summary: If SASL support is enabled in UnrealIRCd (this is
	 not the default) and is also enabled in your services
	 package then a malicious user with a services account can cause
	 UnrealIRCd to crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.unrealircd.org/txt/unrealsecadvisory.20150816.txt</url>
 <url>http://seclists.org/oss-sec/2015/q3/367</url>
 </references>
 <dates>
 <discovery>2015-08-13</discovery>
 <entry>2015-08-18</entry>
 </dates>
 </vuln>

<vuln vid="f1692469-45ce-11e5-adde-14dae9d210b8">
 <topic>jasper -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jasper</name>
	<range><lt>1.900.1_16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Martin Prpic reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c0">
	 A double free flaw was found in the way JasPer's
	 jasper_image_stop_load() function parsed certain JPEG 2000 image files.
	 A specially crafted file could cause an application using JasPer to
	 crash.
	</blockquote>
	Feist Josselin reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/408">
	 A new use-after-free was found in Jasper JPEG-200. The
	 use-after-free appears in the function mif_process_cmpt of the
	 src/libjasper/mif/mif_cod.c file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c0</url>
 <url>http://seclists.org/oss-sec/2015/q3/366</url>
 <url>http://seclists.org/oss-sec/2015/q3/408</url>
 <cvename>CVE-2015-5203</cvename>
 <cvename>CVE-2015-5221</cvename>
 </references>
 <dates>
 <discovery>2015-08-17</discovery>
 <entry>2015-08-18</entry>
 <modified>2016-02-24</modified>
 </dates>
 </vuln>

<vuln vid="a59e263a-45cd-11e5-adde-14dae9d210b8">
 <topic>freexl -- integer overflow</topic>
 <affects>
 <package>
	<name>freexl</name>
	<range><lt>1.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Cornelius reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/07/06/7">
	 There's an integer overflow in the allocate_cells() function
	 when trying to allocate the memory for worksheet with specially
	 crafted row/column dimensions. This can be exploited to cause a
	 heap memory corruption. The most likely outcome of this is a crash
	 when trying to initialize the cells later in the function.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2015/07/06/7</url>
 </references>
 <dates>
 <discovery>2015-07-06</discovery>
 <entry>2015-08-18</entry>
 </dates>
 </vuln>

<vuln vid="ac98d090-45cc-11e5-adde-14dae9d210b8">
 <topic>freexl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>freexl</name>
	<range><lt>1.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jodie Cunningham reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/03/25/1">
	 #1: A flaw was found in the way FreeXL reads sectors from
	 the input file. A specially crafted file could possibly
	 result in stack corruption near freexl.c:3752.
	 #2: A flaw was found in the function allocate_cells(). A
	 specially crafted file with invalid workbook dimensions
	 could possibly result in stack corruption near freexl.c:1074
	 #3: A flaw was found in the way FreeXL handles a premature EOF. A
	 specially crafted input file could possibly result in stack corruption
	 near freexl.c:1131
	 #4: FreeXL 1.0.0g did not properly check requests for workbook memory
	 allocation. A specially crafted input file could cause a Denial of
	 Service, or possibly write onto the stack.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2015/03/25/1</url>
 <cvename>CVE-2015-2776</cvename>
 </references>
 <dates>
 <discovery>2015-03-24</discovery>
 <entry>2015-08-18</entry>
 </dates>
 </vuln>

<vuln vid="47aa4343-44fa-11e5-9daa-14dae9d210b8">
 <topic>mod_jk -- information disclosure</topic>
 <affects>
 <package>
	<name>ap22-mod_jk</name>
	<name>ap24-mod_jk</name>
	<range><lt>1.2.41,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NIST reports:
	<blockquote cite="http://www.cvedetails.com/cve/CVE-2014-8111/">
	 Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores
	 JkUnmount rules for subtrees of previous JkMount rules, which allows
	 remote attackers to access otherwise restricted artifacts via
	 unspecified vectors. 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.mail-archive.com/users@tomcat.apache.org/msg118949.html</url>
 <url>http://readlist.com/lists/tomcat.apache.org/users/27/135512.html</url>
 <url>http://www.cvedetails.com/cve/CVE-2014-8111/</url>
 <cvename>CVE-2014-8111</cvename>
 </references>
 <dates>
 <discovery>2015-01-15</discovery>
 <entry>2015-08-17</entry>
 </dates>
 </vuln>

<vuln vid="f06f20dc-4347-11e5-93ad-002590263bf5">
 <topic>qemu, xen-tools -- QEMU leak of uninitialized heap memory in rtl8139 device model</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><le>0.11.1_20</le></range>
	<range><ge>0.12</ge><le>2.3.0_2</le></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.4.50.g20150814</lt></range>
 </package>
 <package>
	<name>xen-tools</name>
	<range><lt>4.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-140.html">
	 The QEMU model of the RTL8139 network card did not sufficiently
	 validate inputs in the C+ mode offload emulation. This results in
	 uninitialized memory from the QEMU process's heap being leaked to
	 the domain as well as to the network.
	 A guest may be able to read sensitive host-level data relating to
	 itself which resides in the QEMU process.
	 Such information may include things such as information relating to
	 real devices backing emulated devices or passwords which the host
	 administrator does not intend to share with the guest admin.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5165</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-140.html</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=2a3612ccc1fa9cea77bd193afbfe21c77e7e91ef</url>
 </references>
 <dates>
 <discovery>2015-08-03</discovery>
 <entry>2015-08-17</entry>
 <modified>2015-08-19</modified>
 </dates>
 </vuln>

<vuln vid="ee99899d-4347-11e5-93ad-002590263bf5">
 <topic>qemu, xen-tools -- use-after-free in QEMU/Xen block unplug protocol</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><le>0.11.1_20</le></range>
	<range><ge>0.12</ge><le>2.3.0_2</le></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.4.50.g20150814</lt></range>
 </package>
 <package>
	<name>xen-tools</name>
	<range><lt>4.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-139.html">
	 When unplugging an emulated block device the device was not fully
	 unplugged, meaning a second unplug attempt would attempt to unplug
	 the device a second time using a previously freed pointer.
	 An HVM guest which has access to an emulated IDE disk device may be
	 able to exploit this vulnerability in order to take over the qemu
	 process elevating its privilege to that of the qemu process.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5166</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-139.html</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=260425ab405ea76c44dd59744d05176d4f579a52</url>
 </references>
 <dates>
 <discovery>2015-08-03</discovery>
 <entry>2015-08-17</entry>
 <modified>2015-08-19</modified>
 </dates>
 </vuln>

<vuln vid="787ef75e-44da-11e5-93ad-002590263bf5">
 <topic>php5 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5</name>
	<name>php5-openssl</name>
	<name>php5-phar</name>
	<name>php5-soap</name>
	<range><lt>5.4.44</lt></range>
 </package>
 <package>
	<name>php55</name>
	<name>php55-openssl</name>
	<name>php55-phar</name>
	<name>php55-soap</name>
	<range><lt>5.5.28</lt></range>
 </package>
 <package>
	<name>php56</name>
	<name>php56-openssl</name>
	<name>php56-phar</name>
	<name>php56-soap</name>
	<range><lt>5.6.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP project reports:
	<blockquote cite="http://php.net/ChangeLog-5.php">
	 Core:
	 <ul>
	 <li>Fixed bug #69793 (Remotely triggerable stack exhaustion via
	 recursive method calls).</li>
	 <li>Fixed bug #70121 (unserialize() could lead to unexpected methods
	 execution / NULL pointer deref).</li>
	 </ul>
	 OpenSSL:
	 <ul>
	 <li>Fixed bug #70014 (openssl_random_pseudo_bytes() is not
	 cryptographically secure).</li>
	 </ul>
	 Phar:
	 <ul>
	 <li>Improved fix for bug #69441.</li>
	 <li>Fixed bug #70019 (Files extracted from archive may be placed
	 outside of destination directory).</li>
	 </ul>
	 SOAP:
	 <ul>
	 <li>Fixed bug #70081 (SoapClient info leak / null pointer
	 dereference via multiple type confusions).</li>
	 </ul>
	 SPL:
	 <ul>
	 <li>Fixed bug #70068 (Dangling pointer in the unserialization of
	 ArrayObject items).</li>
	 <li>Fixed bug #70166 (Use After Free Vulnerability in unserialize()
	 with SPLArrayObject).</li>
	 <li>Fixed bug #70168 (Use After Free Vulnerability in unserialize()
	 with SplObjectStorage).</li>
	 <li>Fixed bug #70169 (Use After Free Vulnerability in unserialize()
	 with SplDoublyLinkedList).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://php.net/ChangeLog-5.php#5.4.44</url>
 <url>http://php.net/ChangeLog-5.php#5.5.28</url>
 <url>http://php.net/ChangeLog-5.php#5.6.12</url>
 <cvename>CVE-2015-6831</cvename>
 <cvename>CVE-2015-6832</cvename>
 <cvename>CVE-2015-6833</cvename>
 </references>
 <dates>
 <discovery>2015-08-06</discovery>
 <entry>2015-08-17</entry>
 <modified>2015-09-08</modified>
 </dates>
 </vuln>

<vuln vid="6241b5df-42a1-11e5-93ad-002590263bf5">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki123</name>
	<range><lt>1.23.10</lt></range>
 </package>
 <package>
	<name>mediawiki124</name>
	<range><lt>1.24.3</lt></range>
 </package>
 <package>
	<name>mediawiki125</name>
	<range><lt>1.25.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MediaWiki reports:
	<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html">
	 Internal review discovered that Special:DeletedContributions did
	 not properly protect the IP of autoblocked users. This fix makes
	 the functionality of Special:DeletedContributions consistent with
	 Special:Contributions and Special:BlockList.
	 Internal review discovered that watchlist anti-csrf tokens were not
	 being compared in constant time, which could allow various timing
	 attacks. This could allow an attacker to modify a user's watchlist
	 via csrf
	 John Menerick reported that MediaWiki's thumb.php failed to sanitize
	 various error messages, resulting in xss.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-6727</cvename>
 <cvename>CVE-2013-7444</cvename>
 <cvename>CVE-2015-6728</cvename>
 <cvename>CVE-2015-6729</cvename>
 <cvename>CVE-2015-6730</cvename>
 <cvename>CVE-2015-6731</cvename>
 <cvename>CVE-2015-6733</cvename>
 <cvename>CVE-2015-6734</cvename>
 <cvename>CVE-2015-6735</cvename>
 <cvename>CVE-2015-6736</cvename>
 <cvename>CVE-2015-6737</cvename>
 <url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html</url>
 <url>https://phabricator.wikimedia.org/T106893</url>
 <url>https://phabricator.wikimedia.org/T94116</url>
 <url>https://phabricator.wikimedia.org/T97391</url>
 <url>http://www.openwall.com/lists/oss-security/2015/08/27/6</url>
 </references>
 <dates>
 <discovery>2015-08-10</discovery>
 <entry>2015-08-14</entry>
 <modified>2015-12-24</modified>
 </dates>
 </vuln>

<vuln vid="0c2c4d84-42a2-11e5-9daa-14dae9d210b8">
 <topic>freeradius3 -- insufficient validation on packets</topic>
 <affects>
 <package>
	<name>freeradius3</name>
	<range><lt>3.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jouni Malinen reports:
	<blockquote cite="http://freeradius.org/security.html#eap-pwd-2015">
	 The EAP-PWD module performed insufficient validation on
	 packets received from an EAP peer. This module is not enabled in the
	 default configuration. Administrators must manually enable it for their
	 server to be vulnerable. Only versions 3.0 up to 3.0.8 are affected.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://freeradius.org/security.html#eap-pwd-2015</url>
 </references>
 <dates>
 <discovery>2015-04-04</discovery>
 <entry>2015-08-14</entry>
 </dates>
 </vuln>

<vuln vid="ec6a2a1e-429d-11e5-9daa-14dae9d210b8">
 <topic>gnutls -- double free in certificate DN decoding</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>3.3.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	gnutls.org reports:
	<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2015-3">
	 Kurt Roeckx reported that decoding a specific certificate with very
	 long DistinguishedName (DN) entries leads to double free, which may
	 result to a denial of service. Since the DN decoding occurs in almost
	 all applications using certificates it is recommended to upgrade the
	 latest GnuTLS version fixing the issue. Recommendation: Upgrade to
	 GnuTLS 3.4.4, or 3.3.17.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.gnutls.org/security.html#GNUTLS-SA-2015-3</url>
 <mlist>http://seclists.org/oss-sec/2015/q3/308</mlist>
 <url>https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12</url>
 <cvename>CVE-2015-6251</cvename>
 </references>
 <dates>
 <discovery>2015-07-20</discovery>
 <entry>2015-08-14</entry>
 <modified>2015-08-18</modified>
 </dates>
 </vuln>

<vuln vid="3de36a19-429d-11e5-9daa-14dae9d210b8">
 <topic>gnutls -- MD5 downgrade in TLS signatures</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>3.3.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Karthikeyan Bhargavan reports:
	<blockquote cite="http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8132">
	 GnuTLS does not by default support MD5 signatures. Indeed the RSA-MD5
	 signature-hash algorithm needs to be explicitly enabled using the
	 priority option VERIFY_ALLOW_SIGN_RSA_MD5. In the NORMAL and SECURE
	 profiles, GnuTLS clients do not offer RSA-MD5 in the signature
	 algorithms extension. However, we find that all GnuTLS clients still
	 accept RSA-MD5 in the ServerKeyExchange and GnuTLS servers still
	 accept RSA-MD5 in the ClientCertificateVerify.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist>http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8132</mlist>
 <url>http://www.gnutls.org/security.html#GNUTLS-SA-2015-2</url>
 <mlist>http://seclists.org/oss-sec/2015/q2/367</mlist>
 </references>
 <dates>
 <discovery>2015-04-25</discovery>
 <entry>2015-08-14</entry>
 </dates>
 </vuln>

<vuln vid="9ee72858-4159-11e5-93ad-002590263bf5">
 <topic>froxlor -- database password information leak</topic>
 <affects>
 <package>
	<name>froxlor</name>
	<range><lt>0.9.33.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	oss-security-list@demlak.de reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/238">
	 An unauthenticated remote attacker is able to get the database
	 password via webaccess due to wrong file permissions of the /logs/
	 folder in froxlor version 0.9.33.1 and earlier. The plain SQL
	 password and username may be stored in the /logs/sql-error.log file.
	 This directory is publicly reachable under the default
	 configuration/setup.
	</blockquote>
	Note that froxlor 0.9.33.2 prevents future logging of passwords but
	 does not retroactively remove passwords already logged. Michael
	 Kaufmann, the Froxlor lead developer reports:
	<blockquote cite="http://forum.froxlor.org/index.php/topic/13054-important-bugfix-release-09332/#entry30025">
	 Removing all .log files from the directory should do the job,
	 alternatively just use the class.ConfigIO.php from Github
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5959</cvename>
 <freebsdpr>ports/202262</freebsdpr>
 <url>http://seclists.org/oss-sec/2015/q3/238</url>
 <url>https://forum.froxlor.org/index.php/topic/13054-important-bugfix-release-09332/</url>
 </references>
 <dates>
 <discovery>2015-07-29</discovery>
 <entry>2015-08-13</entry>
 </dates>
 </vuln>

<vuln vid="83b38a2c-413e-11e5-bfcf-6805ca0b3d42">
 <topic>RT -- two XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>rt42</name>
	<range><ge>4.2.0</ge><lt>4.2.12</lt></range>
 </package>
 <package>
	<name>rt40</name>
	<range><ge>4.0.0</ge><lt>4.0.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Best Practical reports:
	<blockquote cite="http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html">
	 RT 4.0.0 and above are vulnerable to a cross-site
	 scripting (XSS) attack via the user and group rights
	 management pages. This vulnerability is assigned
	 CVE-2015-5475. It was discovered and reported by Marcin
	 Kopec at Data Reliance Shared Service Center.
	 RT 4.2.0 and above are vulnerable to a cross-site
	 scripting (XSS) attack via the cryptography interface.
	 This vulnerability could allow an attacker with a
	 carefully-crafted key to inject JavaScript into RT's user
	 interface. Installations which use neither GnuPG nor
	 S/MIME are unaffected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5475</cvename>
 <cvename>CVE-2015-6506</cvename>
 <url>http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html</url>
 </references>
 <dates>
 <discovery>2015-08-12</discovery>
 <entry>2015-08-12</entry>
 <modified>2015-08-18</modified>
 </dates>
 </vuln>

<vuln vid="09fff0d9-4126-11e5-9f01-14dae9d210b8">
 <topic>py-foolscap -- local file inclusion</topic>
 <affects>
 <package>
	<name>py27-foolscap</name>
	<name>py32-foolscap</name>
	<name>py33-foolscap</name>
	<name>py34-foolscap</name>
	<range><lt>0.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Brian Warner reports:
	<blockquote cite="https://github.com/warner/foolscap/blob/a17218e18e01c05a9655863cd507b80561692c14/NEWS">
	 The "flappserver" feature was found to have a vulnerability in the
	 service-lookup code which, when combined with an attacker who has the ability
	 to write files to a location where the flappserver process could read them,
	 would allow that attacker to obtain control of the flappserver process.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/warner/foolscap/blob/a17218e18e01c05a9655863cd507b80561692c14/NEWS</url>
 <url>http://foolscap.lothar.com/trac/ticket/226</url>
 </references>
 <dates>
 <discovery>2014-09-23</discovery>
 <entry>2015-08-12</entry>
 </dates>
 </vuln>

<vuln vid="42c98cef-62b1-4b8b-9065-f4621e08d526">
 <topic>libvpx -- out-of-bounds write</topic>
 <affects>
 <package>
	<name>libvpx</name>
	<range><lt>1.4.0</lt></range>
 </package>
 <package>
	<name>firefox</name>
	<range><lt>33.0,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>31.1.2,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>33.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.30</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>31.1.2</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.30</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>31.1.2</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>31.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2014-77/">
	 Using the Address Sanitizer tool, security researcher
	 Abhishek Arya (Inferno) of the Google Chrome Security Team
	 found an out-of-bounds write when buffering WebM format
	 video containing frames with invalid tile sizes. This can
	 lead to a potentially exploitable crash during WebM video
	 playback.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1578</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2014-77/</url>
 <url>https://hg.mozilla.org/releases/mozilla-esr31/rev/6023f0b4f8ba</url>
 </references>
 <dates>
 <discovery>2014-10-14</discovery>
 <entry>2015-08-12</entry>
 </dates>
 </vuln>

<vuln vid="f3778328-d288-4b39-86a4-65877331eaf7">
 <topic>Adobe Flash Player -- critical vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<name>linux-c6_64-flashplugin</name>
	<range><lt>11.2r202.508</lt></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.508</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-19.html">
	 Adobe has released security updates for Adobe Flash Player.
	 These updates address critical vulnerabilities that could
	 potentially allow an attacker to take control of the affected
	 system.
	 These updates resolve type confusion vulnerabilities that could
	 lead to code execution (CVE-2015-5128, CVE-2015-5554,
	 CVE-2015-5555, CVE-2015-5558, CVE-2015-5562).
	 These updates include further hardening to a mitigation
	 introduced in version 18.0.0.209 to defend against vector
	 length corruptions (CVE-2015-5125).
	 These updates resolve use-after-free vulnerabilities that could
	 lead to code execution (CVE-2015-5550, CVE-2015-5551,
	 CVE-2015-3107, CVE-2015-5556, CVE-2015-5130, CVE-2015-5134,
	 CVE-2015-5539, CVE-2015-5540, CVE-2015-5557, CVE-2015-5559,
	 CVE-2015-5127, CVE-2015-5563, CVE-2015-5561, CVE-2015-5124,
	 CVE-2015-5564).
	 These updates resolve heap buffer overflow vulnerabilities
	 that could lead to code execution (CVE-2015-5129,
	 CVE-2015-5541).
	 These updates resolve buffer overflow vulnerabilities that
	 could lead to code execution (CVE-2015-5131, CVE-2015-5132,
	 CVE-2015-5133).
	 These updates resolve memory corruption vulnerabilities that
	 could lead to code execution (CVE-2015-5544, CVE-2015-5545,
	 CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549,
	 CVE-2015-5552, CVE-2015-5553).
	 These updates resolve an integer overflow vulnerability that
	 could lead to code execution (CVE-2015-5560).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3107</cvename>
 <cvename>CVE-2015-5124</cvename>
 <cvename>CVE-2015-5125</cvename>
 <cvename>CVE-2015-5127</cvename>
 <cvename>CVE-2015-5128</cvename>
 <cvename>CVE-2015-5129</cvename>
 <cvename>CVE-2015-5130</cvename>
 <cvename>CVE-2015-5131</cvename>
 <cvename>CVE-2015-5132</cvename>
 <cvename>CVE-2015-5133</cvename>
 <cvename>CVE-2015-5134</cvename>
 <cvename>CVE-2015-5539</cvename>
 <cvename>CVE-2015-5540</cvename>
 <cvename>CVE-2015-5541</cvename>
 <cvename>CVE-2015-5544</cvename>
 <cvename>CVE-2015-5545</cvename>
 <cvename>CVE-2015-5546</cvename>
 <cvename>CVE-2015-5547</cvename>
 <cvename>CVE-2015-5548</cvename>
 <cvename>CVE-2015-5549</cvename>
 <cvename>CVE-2015-5550</cvename>
 <cvename>CVE-2015-5551</cvename>
 <cvename>CVE-2015-5552</cvename>
 <cvename>CVE-2015-5553</cvename>
 <cvename>CVE-2015-5554</cvename>
 <cvename>CVE-2015-5555</cvename>
 <cvename>CVE-2015-5556</cvename>
 <cvename>CVE-2015-5557</cvename>
 <cvename>CVE-2015-5558</cvename>
 <cvename>CVE-2015-5559</cvename>
 <cvename>CVE-2015-5560</cvename>
 <cvename>CVE-2015-5561</cvename>
 <cvename>CVE-2015-5562</cvename>
 <cvename>CVE-2015-5563</cvename>
 <cvename>CVE-2015-5564</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb15-19.html</url>
 </references>
 <dates>
 <discovery>2015-08-11</discovery>
 <entry>2015-08-12</entry>
 </dates>
 </vuln>

<vuln vid="34e60332-2448-4ed6-93f0-12713749f250">
 <topic>libvpx -- multiple buffer overflows</topic>
 <affects>
 <package>
	<name>libvpx</name>
	<range><lt>1.4.0.488</lt></range>
 </package>
 <package>
	<name>firefox</name>
	<range><lt>40.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>40.0,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/security/advisories/mfsa2015-89/">
	 Security researcher Abhishek Arya (Inferno) of the Google
	 Chrome Security Team used the Address Sanitizer tool to
	 discover two buffer overflow issues in the Libvpx library
	 used for WebM video when decoding a malformed WebM video
	 file. These buffer overflows result in potentially
	 exploitable crashes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4485</cvename>
 <cvename>CVE-2015-4486</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-89/</url>
 </references>
 <dates>
 <discovery>2015-08-11</discovery>
 <entry>2015-08-11</entry>
 <modified>2015-08-14</modified>
 </dates>
 </vuln>

<vuln vid="c66a5632-708a-4727-8236-d65b2d5b2739">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>40.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>40.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><ge>2.36</ge><lt>2.37</lt></range>
	
	<range><lt>2.35</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><ge>2.36</ge><lt>2.37</lt></range>
	
	<range><lt>2.35</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>38.2.0,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>38.2.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>38.2.0</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>38.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	 MFSA 2015-79 Miscellaneous memory safety hazards (rv:40.0
	 / rv:38.2)
	 MFSA 2015-80 Out-of-bounds read with malformed MP3
	 file
	 MFSA 2015-81 Use-after-free in MediaStream playback
	 MFSA 2015-82 Redefinition of non-configurable JavaScript object properties
	 MFSA 2015-83 Overflow issues in libstagefright
	 MFSA 2015-84 Arbitrary file overwriting through Mozilla
	 Maintenance Service with hard links
	 MFSA 2015-85 Out-of-bounds write with Updater and
	 malicious MAR file
	 MFSA 2015-86 Feed protocol with POST bypasses mixed
	 content protections
	 MFSA 2015-87 Crash when using shared memory in
	 JavaScript
	 MFSA 2015-88 Heap overflow in gdk-pixbuf when scaling
	 bitmap images
	 MFSA 2015-90 Vulnerabilities found through code
	 inspection
	 MFSA 2015-91 Mozilla Content Security Policy allows for
	 asterisk wildcards in violation of CSP specification
	 MFSA 2015-92 Use-after-free in XMLHttpRequest with shared
	 workers
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4473</cvename>
 <cvename>CVE-2015-4474</cvename>
 <cvename>CVE-2015-4475</cvename>
 <cvename>CVE-2015-4477</cvename>
 <cvename>CVE-2015-4478</cvename>
 <cvename>CVE-2015-4479</cvename>
 <cvename>CVE-2015-4480</cvename>
 <cvename>CVE-2015-4481</cvename>
 <cvename>CVE-2015-4482</cvename>
 <cvename>CVE-2015-4483</cvename>
 <cvename>CVE-2015-4484</cvename>
 <cvename>CVE-2015-4487</cvename>
 <cvename>CVE-2015-4488</cvename>
 <cvename>CVE-2015-4489</cvename>
 <cvename>CVE-2015-4490</cvename>
 <cvename>CVE-2015-4491</cvename>
 <cvename>CVE-2015-4492</cvename>
 <cvename>CVE-2015-4493</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-79/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-80/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-81/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-82/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-83/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-84/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-85/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-86/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-87/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-88/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-90/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-91/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-92/</url>
 </references>
 <dates>
 <discovery>2015-08-11</discovery>
 <entry>2015-08-11</entry>
 <modified>2015-08-22</modified>
 </dates>
 </vuln>

<vuln vid="dd7f29cc-3ee9-11e5-93ad-002590263bf5">
 <topic>lighttpd -- Log injection vulnerability in mod_auth</topic>
 <affects>
 <package>
	<name>lighttpd</name>
	<range><lt>1.4.36</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3200">
	 mod_auth in lighttpd before 1.4.36 allows remote attackers to
	 inject arbitrary log entries via a basic HTTP authentication string
	 without a colon character, as demonstrated by a string containing a
	 NULL and new line character.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3200</cvename>
 <url>http://redmine.lighttpd.net/issues/2646</url>
 </references>
 <dates>
 <discovery>2015-05-25</discovery>
 <entry>2015-08-10</entry>
 </dates>
 </vuln>

<vuln vid="ff0acfb4-3efa-11e5-93ad-002590263bf5">
 <topic>pcre -- heap overflow vulnerability in '(?|' situations</topic>
 <affects>
 <package>
	<name>pcre</name>
	<range><le>8.37_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Venustech ADLAB reports:
	<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1667">
	 PCRE library is prone to a vulnerability which leads to Heap
	 Overflow. During the compilation of a malformed regular expression,
	 more data is written on the malloced block than the expected size
	 output by compile_regex. Exploits with advanced Heap Fengshui
	 techniques may allow an attacker to execute arbitrary code in the
	 context of the user running the affected application.
	 Latest version of PCRE is prone to a Heap Overflow vulnerability
	 which could caused by the following regular expression.
	 /(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/202209</freebsdpr>
 <url>https://bugs.exim.org/show_bug.cgi?id=1667</url>
 </references>
 <dates>
 <discovery>2015-08-05</discovery>
 <entry>2015-08-10</entry>
 </dates>
 </vuln>

<vuln vid="8eee06d4-c21d-4f07-a669-455151ff426f">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>39.0.3,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>39.0.3,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>38.1.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	 MFSA 2015-78 Same origin violation and local file
	 stealing via PDF reader
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4495</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-78/</url>
 </references>
 <dates>
 <discovery>2015-08-06</discovery>
 <entry>2015-08-07</entry>
 </dates>
 </vuln>

<vuln vid="ac5ec8e3-3c6c-11e5-b921-00a0986f28c4">
 <topic>wordpress -- Multiple vulnerability</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.2.4,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gary Pendergast reports:
	<blockquote cite="https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/">
	 WordPress 4.2.4 fixes three cross-site scripting vulnerabilities
	 and a potential SQL injection that could be used to compromise a
	 site.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/</url>
 <cvename>CVE-2015-2213</cvename>
 <cvename>CVE-2015-5730</cvename>
 <cvename>CVE-2015-5731</cvename>
 <cvename>CVE-2015-5732</cvename>
 <cvename>CVE-2015-5733</cvename>
 <cvename>CVE-2015-5734</cvename>
 </references>
 <dates>
 <discovery>2015-08-04</discovery>
 <entry>2015-08-06</entry>
 <modified>2015-09-15</modified>
 </dates>
 </vuln>

<vuln vid="57bb5e3d-3c4f-11e5-a4d4-001e8c75030d">
 <topic>subversion -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><ge>1.8.0</ge><lt>1.8.14</lt></range>
	<range><ge>1.7.0</ge><lt>1.7.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion reports:
	<blockquote cite="http://svn.haxx.se/dev/archive-2015-08/0024.shtml">
	 CVE-2015-3184: 
	 Subversion's mod_authz_svn does not properly restrict anonymous access
	 in some mixed anonymous/authenticated environments when
	 using Apache httpd 2.4.
	 CVE-2015-3187: 
	 Subversion servers, both httpd and svnserve, will reveal some
	 paths that should be hidden by path-based authz.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3184</cvename>
 <url>http://subversion.apache.org/security/CVE-2015-3184-advisory.txt</url>
 <cvename>CVE-2015-3187</cvename>
 <url>http://subversion.apache.org/security/CVE-2015-3187-advisory.txt</url>
 </references>
 <dates>
 <discovery>2015-07-27</discovery>
 <entry>2015-08-06</entry>
 </dates>
 </vuln>

<vuln vid="ae8c09cb-32da-11e5-a4a5-002590263bf5">
 <topic>elasticsearch -- directory traversal attack via snapshot API</topic>
 <affects>
 <package>
	<name>elasticsearch</name>
	<range><ge>1.0.0</ge><lt>1.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Elastic reports:
	<blockquote cite="https://www.elastic.co/community/security">
	 Vulnerability Summary: Elasticsearch versions from 1.0.0 to 1.6.0
	 are vulnerable to a directory traversal attack.
	 Remediation Summary: Users should upgrade to 1.6.1 or later, or
	 constrain access to the snapshot API to trusted sources.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5531</cvename>
 <freebsdpr>ports/201834</freebsdpr>
 <url>https://www.elastic.co/community/security</url>
 </references>
 <dates>
 <discovery>2015-07-16</discovery>
 <entry>2015-08-05</entry>
 </dates>
 </vuln>

<vuln vid="fb3668df-32d7-11e5-a4a5-002590263bf5">
 <topic>elasticsearch -- remote code execution via transport protocol</topic>
 <affects>
 <package>
	<name>elasticsearch</name>
	<range><lt>1.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Elastic reports:
	<blockquote cite="https://www.elastic.co/community/security">
	 Vulnerability Summary: Elasticsearch versions prior to 1.6.1 are
	 vulnerable to an attack that can result in remote code execution.
	 Remediation Summary: Users should upgrade to 1.6.1 or 1.7.0.
	 Alternately, ensure that only trusted applications have access to
	 the transport protocol port.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5377</cvename>
 <freebsdpr>ports/201834</freebsdpr>
 <url>https://www.elastic.co/community/security</url>
 </references>
 <dates>
 <discovery>2015-07-16</discovery>
 <entry>2015-08-05</entry>
 </dates>
 </vuln>

<vuln vid="da451130-365d-11e5-a4a5-002590263bf5">
 <topic>qemu, xen-tools -- QEMU heap overflow flaw with certain ATAPI commands</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><le>0.11.1_20</le></range>
	<range><ge>0.12</ge><le>2.3.0_2</le></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<name>qemu-user-static</name>
	<range><lt>2.4.50.g20150814</lt></range>
 </package>
 <package>
	<name>xen-tools</name>
	<range><lt>4.5.0_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-138.html">
	 A heap overflow flaw was found in the way QEMU's IDE subsystem
	 handled I/O buffer access while processing certain ATAPI
	 commands.
	 A privileged guest user in a guest with CDROM drive enabled could
	 potentially use this flaw to execute arbitrary code on the host
	 with the privileges of the host's QEMU process corresponding to
	 the guest.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5154</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-138.html</url>
 <url>http://git.qemu.org/?p=qemu.git;a=commit;h=e40db4c6d391419c0039fe274c74df32a6ca1a28</url>
 </references>
 <dates>
 <discovery>2015-07-27</discovery>
 <entry>2015-08-04</entry>
 <modified>2015-08-19</modified>
 </dates>
 </vuln>

<vuln vid="4622635f-37a1-11e5-9970-14dae9d210b8">
 <topic>net-snmp -- snmptrapd crash</topic>
 <affects>
 <package>
	<name>net-snmp</name>
	<range><ge>5.7.0</ge><le>5.7.2.1</le></range>
	<range><ge>5.6.0</ge><le>5.6.2.1</le></range>
	<range><ge>5.5.0</ge><le>5.5.2.1</le></range>
	<range><ge>5.4.0</ge><le>5.4.4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Murray McAllister reports:
	<blockquote cite="http://seclists.org/oss-sec/2014/q3/473">
	 A remote denial-of-service flaw was found in the way
	 snmptrapd handled certain SNMP traps when started with the
	 "-OQ" option. If an attacker sent an SNMP trap containing a
	 variable with a NULL type where an integer variable type was
	 expected, it would cause snmptrapd to crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2014/q3/473</url>
 <url>http://sourceforge.net/p/net-snmp/code/ci/7f4a7b891332899cea26e95be0337aae01648742/</url>
 <url>https://sourceforge.net/p/net-snmp/official-patches/48/</url>
 <cvename>CVE-2014-3565</cvename>
 </references>
 <dates>
 <discovery>2014-07-31</discovery>
 <entry>2015-07-31</entry>
 </dates>
 </vuln>

<vuln vid="381183e8-3798-11e5-9970-14dae9d210b8">
 <topic>net-snmp -- snmp_pdu_parse() function incomplete initialization</topic>
 <affects>
 <package>
	<name>net-snmp</name>
	<range><le>5.7.3_7</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Qinghao Tang reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q2/116">
	 Incompletely initialized vulnerability exists in the function
	 ‘snmp_pdu_parse()’ of ‘snmp_api.c', and remote attackers can cause memory
	 leak, DOS and possible command executions by sending malicious packets.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2015/q2/116</url>
 <url>http://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1212408</url>
 <cvename>CVE-2015-5621</cvename>
 </references>
 <dates>
 <discovery>2015-04-11</discovery>
 <entry>2015-07-31</entry>
 </dates>
 </vuln>

<vuln vid="731cdeaa-3564-11e5-9970-14dae9d210b8">
 <topic>bind -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>bind910</name>
	<range><lt>9.10.2P3</lt></range>
 </package>
 <package>
	<name>bind99</name>
	<range><lt>9.9.7P2</lt></range>
 </package>
 <package>
	<name>bind910-base</name>
	<name>bind99-base</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_21</lt></range>
	<range><ge>8.4</ge><lt>8.4_35</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01272/">
	 An error in the handling of TKEY queries can be exploited
	 by an attacker for use as a denial-of-service vector, as a constructed
	 packet can use the defect to trigger a REQUIRE assertion failure,
	 causing BIND to exit.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-15:17.bind</freebsdsa>
 <cvename>CVE-2015-5477</cvename>
 <url>https://kb.isc.org/article/AA-01272/</url>
 </references>
 <dates>
 <discovery>2015-07-21</discovery>
 <entry>2015-07-28</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="5b74a5bc-348f-11e5-ba05-c80aa9043978">
 <topic>OpenSSH -- MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices</topic>
 <affects>
 <package>
	<name>openssh-portable</name>
	<range><lt>6.9.p1_2,1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_16</lt></range>
	<range><ge>9.3</ge><lt>9.3_21</lt></range>
	<range><ge>8.4</ge><lt>8.4_36</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://access.redhat.com/security/cve/CVE-2015-5600">
	 It was discovered that the OpenSSH sshd daemon did not check the
	 list of keyboard-interactive authentication methods for duplicates.
	 A remote attacker could use this flaw to bypass the MaxAuthTries
	 limit, making it easier to perform password guessing attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://access.redhat.com/security/cve/CVE-2015-5600</url>
 <cvename>CVE-2015-5600</cvename>
 <freebsdsa>SA-15:16.openssh</freebsdsa>
 </references>
 <dates>
 <discovery>2015-07-21</discovery>
 <entry>2015-07-27</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="c470bcc7-33fe-11e5-a4a5-002590263bf5">
 <topic>logstash -- SSL/TLS vulnerability with Lumberjack input</topic>
 <affects>
 <package>
	<name>logstash</name>
	<range><lt>1.4.4</lt></range>
	<range><ge>1.5.0</ge><lt>1.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Elastic reports:
	<blockquote cite="https://www.elastic.co/community/security">
	 Vulnerability Summary: All Logstash versions prior to 1.5.2 that
	 use Lumberjack input (in combination with Logstash Forwarder agent)
	 are vulnerable to a SSL/TLS security issue called the FREAK attack.
	 This allows an attacker to intercept communication and access secure
	 data. Users should upgrade to 1.5.3 or 1.4.4.
	 Remediation Summary: Users that do not want to upgrade can address
	 the vulnerability by disabling the Lumberjack input.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5378</cvename>
 <url>https://www.elastic.co/community/security</url>
 </references>
 <dates>
 <discovery>2015-07-22</discovery>
 <entry>2015-07-27</entry>
 </dates>
 </vuln>

<vuln vid="9d732078-32c7-11e5-b263-00262d5ed8ee">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>44.0.2403.89</lt></range>
 </package>
 <package>
	
	<name>chromium-npapi</name>
	<range><lt>44.0.2403.89</lt></range>
 </package>
 <package>
	
	<name>chromium-pulse</name>
	<range><lt>44.0.2403.89</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/">
	 43 security fixes in this release, including:
	 <ul>
	 <li>[446032] High CVE-2015-1271: Heap-buffer-overflow in pdfium.
	 Credit to cloudfuzzer.</li>
	 <li>[459215] High CVE-2015-1273: Heap-buffer-overflow in pdfium.
	 Credit to makosoft.</li>
	 <li>[461858] High CVE-2015-1274: Settings allowed executable files
	 to run immediately after download. Credit to andrewm.bpi.</li>
	 <li>[462843] High CVE-2015-1275: UXSS in Chrome for Android. Credit
	 to WangTao(neobyte) of Baidu X-Team.</li>
	 <li>[472614] High CVE-2015-1276: Use-after-free in IndexedDB.
	 Credit to Collin Payne.</li>
	 <li>[483981] High CVE-2015-1279: Heap-buffer-overflow in pdfium.
	 Credit to mlafon.</li>
	 <li>[486947] High CVE-2015-1280: Memory corruption in skia. Credit
	 to cloudfuzzer.</li>
	 <li>[487155] High CVE-2015-1281: CSP bypass. Credit to Masato
	 Kinugawa.</li>
	 <li>[487928] High CVE-2015-1282: Use-after-free in pdfium. Credit
	 to Chamal de Silva.</li>
	 <li>[492052] High CVE-2015-1283: Heap-buffer-overflow in expat.
	 Credit to sidhpurwala.huzaifa.</li>
	 <li>[493243] High CVE-2015-1284: Use-after-free in blink. Credit to
	 Atte Kettunen of OUSPG.</li>
	 <li>[504011] High CVE-2015-1286: UXSS in blink. Credit to
	 anonymous.</li>
	 <li>[505374] High CVE-2015-1290: Memory corruption in V8. Credit to
	 Yongjun Liu of NSFOCUS Security Team.</li>
	 <li>[419383] Medium CVE-2015-1287: SOP bypass with CSS. Credit to
	 filedescriptor.</li>
	 <li>[444573] Medium CVE-2015-1270: Uninitialized memory read in
	 ICU. Credit to Atte Kettunen of OUSPG.</li>
	 <li>[451456] Medium CVE-2015-1272: Use-after-free related to
	 unexpected GPU process termination. Credit to Chamal de
	 Silva.</li>
	 <li>[479743] Medium CVE-2015-1277: Use-after-free in accessibility.
	 Credit to SkyLined.</li>
	 <li>[482380] Medium CVE-2015-1278: URL spoofing using pdf files.
	 Credit to Chamal de Silva.</li>
	 <li>[498982] Medium CVE-2015-1285: Information leak in XSS auditor.
	 Credit to gazheyes.</li>
	 <li>[479162] Low CVE-2015-1288: Spell checking dictionaries fetched
	 over HTTP. Credit to mike@michaelruddy.com.</li>
	 <li>[512110] CVE-2015-1289: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1270</cvename>
 <cvename>CVE-2015-1271</cvename>
 <cvename>CVE-2015-1272</cvename>
 <cvename>CVE-2015-1273</cvename>
 <cvename>CVE-2015-1274</cvename>
 <cvename>CVE-2015-1275</cvename>
 <cvename>CVE-2015-1276</cvename>
 <cvename>CVE-2015-1277</cvename>
 <cvename>CVE-2015-1278</cvename>
 <cvename>CVE-2015-1279</cvename>
 <cvename>CVE-2015-1280</cvename>
 <cvename>CVE-2015-1281</cvename>
 <cvename>CVE-2015-1282</cvename>
 <cvename>CVE-2015-1283</cvename>
 <cvename>CVE-2015-1284</cvename>
 <cvename>CVE-2015-1285</cvename>
 <cvename>CVE-2015-1286</cvename>
 <cvename>CVE-2015-1287</cvename>
 <cvename>CVE-2015-1288</cvename>
 <cvename>CVE-2015-1289</cvename>
 <cvename>CVE-2015-1290</cvename>
 <url>http://googlechromereleases.blogspot.nl/</url>
 </references>
 <dates>
 <discovery>2015-07-21</discovery>
 <entry>2015-07-25</entry>
 </dates>
 </vuln>

<vuln vid="b202e4ce-3114-11e5-aa32-0026551a22dc">
 <topic>shibboleth-sp -- DoS vulnerability</topic>
 <affects>
 <package>
	<name>xmltooling</name>
	<range><lt>1.5.5</lt></range>
 </package>
 <package>
	<name>opensaml2</name>
	<range><lt>2.5.5</lt></range>
 </package>
 <package>
	<name>shibboleth-sp</name>
	<range><lt>2.5.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Shibboleth consortium reports:
	<blockquote cite="http://shibboleth.net/community/advisories/secadv_20150721.txt">
	 
	 Shibboleth SP software crashes on well-formed but invalid XML.
	 
	 
	 The Service Provider software contains a code path with an uncaught
	 exception that can be triggered by an unauthenticated attacker by
	 supplying well-formed but schema-invalid XML in the form of SAML
	 metadata or SAML protocol messages. The result is a crash and so
	 causes a denial of service.
	 
	 
	 You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or
	 later. The easiest way to do so is to update the whole chain including
	 shibboleth-2.5.5 an opensaml2.5.5.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://shibboleth.net/community/advisories/secadv_20150721.txt</url>
 <cvename>CVE-2015-2684</cvename>
 </references>
 <dates>
 <discovery>2015-07-21</discovery>
 <entry>2015-07-23</entry>
 </dates>
 </vuln>

<vuln vid="c80b27a2-3165-11e5-8a1d-14dae9d210b8">
 <topic>wordpress -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.2.3,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>ja-wordpress</name>
	<name>ru-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gary Pendergast reports:
	<blockquote cite="https://wordpress.org/news/2015/07/wordpress-4-2-3/">
	 WordPress versions 4.2.2 and earlier are affected by a
	 cross-site scripting vulnerability, which could allow users with the
	 Contributor or Author role to compromise a site. This was reported by
	 Jon Cave and fixed by Robert Chapin, both of the WordPress security
	 team.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2015/07/wordpress-4-2-3/</url>
 <cvename>CVE-2015-5622</cvename>
 <cvename>CVE-2015-5623</cvename>
 </references>
 <dates>
 <discovery>2015-07-23</discovery>
 <entry>2015-07-23</entry>
 <modified>2015-09-15</modified>
 </dates>
 </vuln>

<vuln vid="4caf01e2-30e6-11e5-a4a5-002590263bf5">
 <topic>libidn -- out-of-bounds read issue with invalid UTF-8 input</topic>
 <affects>
 <package>
	<name>libidn</name>
	<range><lt>1.31</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Josefsson reports:
	<blockquote cite="http://git.savannah.gnu.org/cgit/libidn.git/plain/NEWS?id=libidn-1-31">
	 stringprep_utf8_to_ucs4 now rejects invalid UTF-8. This function
	 has always been documented to not validate that the input UTF-8
	 string is actually valid UTF-8...
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2059</cvename>
 <url>http://git.savannah.gnu.org/cgit/libidn.git/plain/NEWS?id=libidn-1-31</url>
 </references>
 <dates>
 <discovery>2015-02-09</discovery>
 <entry>2015-07-23</entry>
 <modified>2015-08-03</modified>
 </dates>
 </vuln>

<vuln vid="9dd761ff-30cb-11e5-a4a5-002590263bf5">
 <topic>sox -- memory corruption vulnerabilities</topic>
 <affects>
 <package>
	<name>sox</name>
	<range><le>14.4.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michele Spagnuolo, Google Security Team, reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/167">
	 The write heap buffer overflows are related to ADPCM handling in
	 WAV files, while the read heap buffer overflow is while opening a
	 .VOC.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://seclists.org/oss-sec/2015/q3/167</url>
 </references>
 <dates>
 <discovery>2015-07-22</discovery>
 <entry>2015-07-23</entry>
 </dates>
 </vuln>

<vuln vid="92cda470-30cb-11e5-a4a5-002590263bf5">
 <topic>sox -- input sanitization errors</topic>
 <affects>
 <package>
	<name>sox</name>
	<range><lt>14.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	oCERT reports:
	<blockquote cite="http://www.ocert.org/advisories/ocert-2014-010.html">
	 The sox command line tool is affected by two heap-based buffer
	 overflows, respectively located in functions start_read() and
	 AdpcmReadBlock().
	 A specially crafted wav file can be used to trigger the
	 vulnerabilities.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>71774</bid>
 <cvename>CVE-2014-8145</cvename>
 <url>http://www.ocert.org/advisories/ocert-2014-010.html</url>
 </references>
 <dates>
 <discovery>2014-11-20</discovery>
 <entry>2015-07-23</entry>
 </dates>
 </vuln>

<vuln vid="95eee71d-3068-11e5-a9b5-bcaec565249c">
 <topic>gdk-pixbuf2 -- heap overflow and DoS affecting Firefox and other programs</topic>
 <affects>
 <package>
	<name>gdk-pixbuf2</name>
	<range><lt>2.31.2_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	gustavo.grieco@imag.fr reports:
	<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=752297">
	 We found a heap overflow and a DoS in the gdk-pixbuf
	 implementation triggered by the scaling of a malformed bmp.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.gnome.org/show_bug.cgi?id=752297</url>
 </references>
 <dates>
 <discovery>2015-07-12</discovery>
 <entry>2015-07-22</entry>
 </dates>
 </vuln>

<vuln vid="8a1d0e63-1e07-11e5-b43d-002590263bf5">
 <topic>pcre -- Heap Overflow Vulnerability in find_fixedlength()</topic>
 <affects>
 <package>
	<name>pcre</name>
	<range><le>8.37_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Venustech ADLAB reports:
	<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1651">
	 PCRE library is prone to a vulnerability which leads to Heap
	 Overflow. During subpattern calculation of a malformed regular
	 expression, an offset that is used as an array index is fully
	 controlled and can be large enough so that unexpected heap
	 memory regions are accessed.
	 One could at least exploit this issue to read objects nearby of
	 the affected application's memory.
	 Such information disclosure may also be used to bypass memory
	 protection method such as ASLR.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5073</cvename>
 <url>https://bugs.exim.org/show_bug.cgi?id=1651</url>
 <url>http://vcs.pcre.org/pcre?view=revision&amp;revision=1571</url>
 <mlist>http://www.openwall.com/lists/oss-security/2015/06/26/1</mlist>
 </references>
 <dates>
 <discovery>2015-06-23</discovery>
 <entry>2015-06-29</entry>
 </dates>
 </vuln>

<vuln vid="0bfda05f-2e6f-11e5-a4a5-002590263bf5">
 <topic>cacti -- Multiple XSS and SQL injection vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>0.8.8e</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Cacti Group, Inc. reports:
	<blockquote cite="http://www.cacti.net/release_notes_0_8_8e.php">
	 Important Security Fixes
	 <ul>
	 <li>Multiple XSS and SQL injection vulnerabilities</li>
	 <li>CVE-2015-4634 - SQL injection in graphs.php</li>
	 </ul>
	 Changelog
	 <ul>
	 <li>bug: Fixed various SQL Injection vectors</li>
	 <li>bug#0002574: SQL Injection Vulnerabilities in graph items and
	 graph template items</li>
	 <li>bug#0002577: CVE-2015-4634 - SQL injection in graphs.php</li>
	 <li>bug#0002579: SQL Injection Vulnerabilities in data sources</li>
	 <li>bug#0002580: SQL Injection in cdef.php</li>
	 <li>bug#0002582: SQL Injection in data_templates.php</li>
	 <li>bug#0002583: SQL Injection in graph_templates.php</li>
	 <li>bug#0002584: SQL Injection in host_templates.php</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4634</cvename>
 <freebsdpr>ports/201702</freebsdpr>
 <url>http://www.cacti.net/release_notes_0_8_8e.php</url>
 <mlist>http://seclists.org/oss-sec/2015/q3/150</mlist>
 </references>
 <dates>
 <discovery>2015-07-12</discovery>
 <entry>2015-07-20</entry>
 </dates>
 </vuln>

<vuln vid="8b1f53f3-2da5-11e5-86ff-14dae9d210b8">
 <topic>php-phar -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php56-phar</name>
	<range><lt>5.6.11</lt></range>
 </package>
 <package>
	<name>php55-phar</name>
	<range><lt>5.5.27</lt></range>
 </package>
 <package>
	<name>php5-phar</name>
	<range><lt>5.4.43</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/141">
	 Segfault in Phar::convertToData on invalid file.
	 Buffer overflow and stack smashing error in phar_fix_filepath.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist>http://seclists.org/oss-sec/2015/q3/141</mlist>
 <url>https://bugs.php.net/bug.php?id=69958</url>
 <url>http://git.php.net/?p=php-src.git;a=commit;h=bf58162ddf970f63502837f366930e44d6a992cf</url>
 <url>https://bugs.php.net/bug.php?id=69923</url>
 <url>http://git.php.net/?p=php-src.git;a=commit;h=6dedeb40db13971af45276f80b5375030aa7e76f</url>
 <cvename>CVE-2015-5589</cvename>
 <cvename>CVE-2015-5590</cvename>
 </references>
 <dates>
 <discovery>2015-06-24</discovery>
 <entry>2015-07-18</entry>
 <modified>2015-12-18</modified>
 </dates>
 </vuln>

<vuln vid="43891162-2d5e-11e5-a4a5-002590263bf5">
 <topic>moodle -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moodle27</name>
	<range><lt>2.7.9</lt></range>
 </package>
 <package>
	<name>moodle28</name>
	<range><lt>2.8.7</lt></range>
 </package>
 <package>
	<name>moodle29</name>
	<range><lt>2.9.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marina Glancy reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/94">
	 MSA-15-0026: Possible phishing when redirecting to external site
	 using referer header. (CVE-2015-3272)
	 MSA-15-0027: Capability 'mod/forum:canposttomygroups' is not
	 respected when using 'Post a copy to all groups' in forum
	 (CVE-2015-3273)
	 MSA-15-0028: Possible XSS through custom text profile fields in Web
	 Services (CVE-2015-3274)
	 MSA-15-0029: Javascript injection in SCORM module (CVE-2015-3275)
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3272</cvename>
 <cvename>CVE-2015-3273</cvename>
 <cvename>CVE-2015-3274</cvename>
 <cvename>CVE-2015-3275</cvename>
 <mlist>http://seclists.org/oss-sec/2015/q3/94</mlist>
 <url>https://docs.moodle.org/dev/Moodle_2.7.9_release_notes</url>
 <url>https://docs.moodle.org/dev/Moodle_2.8.7_release_notes</url>
 <url>https://docs.moodle.org/dev/Moodle_2.9.1_release_notes</url>
 </references>
 <dates>
 <discovery>2015-07-06</discovery>
 <entry>2015-07-18</entry>
 <modified>2015-07-19</modified>
 </dates>
 </vuln>

<vuln vid="29083f8e-2ca8-11e5-86ff-14dae9d210b8">
 <topic>apache22 -- chunk header parsing defect</topic>
 <affects>
 <package>
	<name>apache22</name>
	<name>apache22-event-mpm</name>
	<name>apache22-itk-mpm</name>
	<name>apache22-peruser-mpm</name>
	<name>apache22-worker-mpm</name>
	<range><le>2.2.29_5</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache Foundation reports:
	<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.2.html">
	 CVE-2015-3183 core: Fix chunk header parsing defect. Remove
	 apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN
	 filter, parse chunks in a single pass with zero copy. Limit accepted
	 chunk-size to 2^63-1 and be strict about chunk-ext authorized
	 characters.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.apache.org/dist/httpd/Announcement2.2.html</url>
 <url>https://github.com/apache/httpd/commit/29779fd08c18b18efc5e640d74cbe297c7ec007e</url>
 <cvename>CVE-2015-3183</cvename>
 </references>
 <dates>
 <discovery>2015-06-24</discovery>
 <entry>2015-07-17</entry>
 </dates>
 </vuln>

<vuln vid="5c399624-2bef-11e5-86ff-14dae9d210b8">
 <topic>zenphoto -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>zenphoto</name>
	<range><lt>1.4.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	zenphoto reports:
	<blockquote cite="http://www.zenphoto.org/news/zenphoto-1.4.9">
	 Fixes several SQL Injection, XSS and path traversal
	 security issues
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.zenphoto.org/news/zenphoto-1.4.9</url>
 <mlist>http://seclists.org/oss-sec/2015/q3/123</mlist>
 <url>https://github.com/zenphoto/zenphoto/pull/935</url>
 <cvename>CVE-2015-5591</cvename>
 <cvename>CVE-2015-5592</cvename>
 <cvename>CVE-2015-5593</cvename>
 <cvename>CVE-2015-5594</cvename>
 <cvename>CVE-2015-5595</cvename>
 </references>
 <dates>
 <discovery>2015-05-24</discovery>
 <entry>2015-07-16</entry>
 <modified>2015-07-18</modified>
 </dates>
 </vuln>

<vuln vid="67b3fef2-2bea-11e5-86ff-14dae9d210b8">
 <topic>groovy -- remote execution of untrusted code</topic>
 <affects>
 <package>
	<name>groovy</name>
	<range><ge>1.7.0</ge><lt>2.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cédric Champeau reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/121">
	 Description
	 When an application has Groovy on the classpath and that
	 it uses standard Java serialization mechanism to communicate
	 between servers, or to store local data, it is possible for
	 an attacker to bake a special serialized object that will
	 execute code directly when deserialized. All applications
	 which rely on serialization and do not isolate the code which
	 deserializes objects are subject to this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist>http://seclists.org/oss-sec/2015/q3/121</mlist>
 <url>http://groovy-lang.org/security.html</url>
 <url>https://issues.apache.org/jira/browse/GROOVY-7504</url>
 <cvename>CVE-2015-3253</cvename>
 </references>
 <dates>
 <discovery>2015-07-09</discovery>
 <entry>2015-07-16</entry>
 </dates>
 </vuln>

<vuln vid="a928960a-2bdc-11e5-86ff-14dae9d210b8">
 <topic>libav -- divide by zero</topic>
 <affects>
 <package>
	<name>libav</name>
	<range><le>11.3_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Agostino Sarubbo reports:
	<blockquote cite="https://blogs.gentoo.org/ago/2015/07/16/libav-divide-by-zero-in-ff_h263_decode_mba/">
	 libav: divide-by-zero in ff_h263_decode_mba()
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://blogs.gentoo.org/ago/2015/07/16/libav-divide-by-zero-in-ff_h263_decode_mba/</url>
 <url>https://git.libav.org/?p=libav.git;a=commitdiff;h=0a49a62f998747cfa564d98d36a459fe70d3299b;hp=6f4cd33efb5a9ec75db1677d5f7846c60337129f</url>
 <cvename>CVE-2015-5479</cvename>
 </references>
 <dates>
 <discovery>2015-06-21</discovery>
 <entry>2015-07-16</entry>
 </dates>
 </vuln>

<vuln vid="44d9daee-940c-4179-86bb-6e3ffd617869">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>39.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>39.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	
	<range><lt>2.35</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	
	<range><lt>2.35</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>31.8.0,1</lt></range>
	<range><ge>38.0,1</ge><lt>38.1.0,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>31.8.0</lt></range>
	<range><ge>38.0</ge><lt>38.1.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>31.8.0</lt></range>
	<range><ge>38.0</ge><lt>38.1.0</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>31.8.0</lt></range>
	<range><ge>38.0</ge><lt>38.1.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	 MFSA 2015-59 Miscellaneous memory safety hazards (rv:39.0
	 / rv:31.8 / rv:38.1)
	 MFSA 2015-60 Local files or privileged URLs in pages can
	 be opened into new tabs
	 MFSA 2015-61 Type confusion in Indexed Database
	 Manager
	 MFSA 2015-62 Out-of-bound read while computing an
	 oscillator rendering range in Web Audio
	 MFSA 2015-63 Use-after-free in Content Policy due to
	 microtask execution error
	 MFSA 2015-64 ECDSA signature validation fails to handle
	 some signatures correctly
	 MFSA 2015-65 Use-after-free in workers while using
	 XMLHttpRequest
	 MFSA 2015-66 Vulnerabilities found through code
	 inspection
	 MFSA 2015-67 Key pinning is ignored when overridable
	 errors are encountered
	 MFSA 2015-68 OS X crash reports may contain entered key
	 press information
	 MFSA 2015-69 Privilege escalation through internal
	 workers
	 MFSA 2015-70 NSS accepts export-length DHE keys with
	 regular DHE cipher suites
	 MFSA 2015-71 NSS incorrectly permits skipping of
	 ServerKeyExchange
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2721</cvename>
 <cvename>CVE-2015-2722</cvename>
 <cvename>CVE-2015-2724</cvename>
 <cvename>CVE-2015-2725</cvename>
 <cvename>CVE-2015-2726</cvename>
 <cvename>CVE-2015-2727</cvename>
 <cvename>CVE-2015-2728</cvename>
 <cvename>CVE-2015-2729</cvename>
 <cvename>CVE-2015-2730</cvename>
 <cvename>CVE-2015-2731</cvename>
 <cvename>CVE-2015-2733</cvename>
 <cvename>CVE-2015-2734</cvename>
 <cvename>CVE-2015-2735</cvename>
 <cvename>CVE-2015-2736</cvename>
 <cvename>CVE-2015-2737</cvename>
 <cvename>CVE-2015-2738</cvename>
 <cvename>CVE-2015-2739</cvename>
 <cvename>CVE-2015-2740</cvename>
 <cvename>CVE-2015-2741</cvename>
 <cvename>CVE-2015-2742</cvename>
 <cvename>CVE-2015-2743</cvename>
 <cvename>CVE-2015-4000</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-59/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-60/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-61/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-62/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-63/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-64/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-65/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-66/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-67/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-68/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-69/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-70/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-71/</url>
 </references>
 <dates>
 <discovery>2015-07-02</discovery>
 <entry>2015-07-16</entry>
 <modified>2015-09-22</modified>
 </dates>
 </vuln>

<vuln vid="d3216606-2b47-11e5-a668-080027ef73ec">
 <topic>PolarSSL -- Security Fix Backports</topic>
 <affects>
 <package>
	<name>polarssl</name>
	<range><lt>1.2.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Paul Bakker reports:
	<blockquote cite="https://tls.mbed.org/tech-updates/releases/polarssl-1.2.14-released">
	 PolarSSL 1.2.14 fixes one remotely-triggerable issues that was
	 found by the Codenomicon Defensics tool, one potential remote crash
	 and countermeasures against the "Lucky 13 strikes back" cache-based
	 attack.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://tls.mbed.org/tech-updates/releases/polarssl-1.2.14-released</url>
 </references>
 <dates>
 <discovery>2015-06-26</discovery>
 <entry>2015-07-15</entry>
 </dates>
 </vuln>

<vuln vid="ca139c7f-2a8c-11e5-a4a5-002590263bf5">
 <topic>libwmf -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libwmf</name>
	<range><lt>0.2.8.4_14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0941">
	 Multiple buffer overflows in the gd graphics library (libgd) 2.0.21
	 and earlier may allow remote attackers to execute arbitrary code via
	 malformed image files that trigger the overflows due to improper
	 calls to the gdMalloc function, a different set of vulnerabilities
	 than CVE-2004-0990.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0455">
	 Buffer overflow in the gdImageStringFTEx function in gdft.c in GD
	 Graphics Library 2.0.33 and earlier allows remote attackers to cause
	 a denial of service (application crash) and possibly execute
	 arbitrary code via a crafted string with a JIS encoded font.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756">
	 The gdPngReadData function in libgd 2.0.34 allows user-assisted
	 attackers to cause a denial of service (CPU consumption) via a
	 crafted PNG image with truncated data, which causes an infinite loop
	 in the png_read_info function in libpng.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3472">
	 Integer overflow in gdImageCreateTrueColor function in the GD
	 Graphics Library (libgd) before 2.0.35 allows user-assisted remote
	 attackers to have unspecified attack vectors and impact.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3473">
	 The gdImageCreateXbm function in the GD Graphics Library (libgd)
	 before 2.0.35 allows user-assisted remote attackers to cause a
	 denial of service (crash) via unspecified vectors involving a
	 gdImageCreate failure.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3477">
	 The (a) imagearc and (b) imagefilledarc functions in GD Graphics
	 Library (libgd) before 2.0.35 allow attackers to cause a denial of
	 service (CPU consumption) via a large (1) start or (2) end angle
	 degree value.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546">
	 The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before
	 5.3.1, and the GD Graphics Library 2.x, does not properly verify a
	 certain colorsTotal structure member, which might allow remote
	 attackers to conduct buffer overflow or buffer over-read attacks via
	 a crafted GD file, a different vulnerability than CVE-2009-3293.
	 NOTE: some of these details are obtained from third party
	 information.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0848">
	 Heap-based buffer overflow in libwmf 0.2.8.4 allows remote
	 attackers to cause a denial of service (crash) or possibly execute
	 arbitrary code via a crafted BMP image.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4695">
	 meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial
	 of service (out-of-bounds read) via a crafted WMF file.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4696">
	 Use-after-free vulnerability in libwmf 0.2.8.4 allows remote
	 attackers to cause a denial of service (crash) via a crafted WMF
	 file to the (1) wmf2gd or (2) wmf2eps command.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4588">
	 Heap-based buffer overflow in the DecodeImage function in libwmf
	 0.2.8.4 allows remote attackers to cause a denial of service (crash)
	 or possibly execute arbitrary code via a crafted "run-length count"
	 in an image in a WMF file.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>11663</bid>
 <bid>22289</bid>
 <bid>24089</bid>
 <bid>24651</bid>
 <bid>36712</bid>
 <freebsdpr>ports/201513</freebsdpr>
 <cvename>CVE-2004-0941</cvename>
 <cvename>CVE-2007-0455</cvename>
 <cvename>CVE-2007-2756</cvename>
 <cvename>CVE-2007-3472</cvename>
 <cvename>CVE-2007-3473</cvename>
 <cvename>CVE-2007-3477</cvename>
 <cvename>CVE-2009-3546</cvename>
 <cvename>CVE-2015-0848</cvename>
 <cvename>CVE-2015-4695</cvename>
 <cvename>CVE-2015-4696</cvename>
 <cvename>CVE-2015-4588</cvename>
 </references>
 <dates>
 <discovery>2004-10-12</discovery>
 <entry>2015-07-15</entry>
 </dates>
 </vuln>

<vuln vid="a12494c1-2af4-11e5-86ff-14dae9d210b8">
 <topic>apache24 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jim Jagielski reports:
	<blockquote cite="https://mail-archives.apache.org/mod_mbox/www-announce/201507.mbox/%3CAA5C882C-A9C3-46B9-9320-5040A2152E83@apache.org%3E">
	 CVE-2015-3183 (cve.mitre.org)
	 core: Fix chunk header parsing defect.
	 Remove apr_brigade_flatten(), buffering and duplicated code from
	 the HTTP_IN filter, parse chunks in a single pass with zero copy.
	 Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext
	 authorized characters.
	 CVE-2015-3185 (cve.mitre.org)
	 Replacement of ap_some_auth_required (unusable in Apache httpd 2.4)
	 with new ap_some_authn_required and ap_force_authn hook.
	 CVE-2015-0253 (cve.mitre.org)
	 core: Fix a crash with ErrorDocument 400 pointing to a local URL-path
	 with the INCLUDES filter active, introduced in 2.4.11. PR 57531.
	 CVE-2015-0228 (cve.mitre.org)
	 mod_lua: A maliciously crafted websockets PING after a script
	 calls r:wsupgrade() can cause a child process crash.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist>https://mail-archives.apache.org/mod_mbox/www-announce/201507.mbox/%3CAA5C882C-A9C3-46B9-9320-5040A2152E83@apache.org%3E</mlist>
 <cvename>CVE-2015-3183</cvename>
 <cvename>CVE-2015-3185</cvename>
 <cvename>CVE-2015-0253</cvename>
 <cvename>CVE-2015-0228</cvename>
 </references>
 <dates>
 <discovery>2015-02-04</discovery>
 <entry>2015-07-15</entry>
 </dates>
 </vuln>

<vuln vid="8d2d6bbd-2a02-11e5-a0af-bcaec565249c">
 <topic>Adobe Flash Player -- critical vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<range><lt>11.2r202.491</lt></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.491</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-18.html">
	 Critical vulnerabilities (CVE-2015-5122, CVE-2015-5123) have
	 been identified. Successful exploitation could cause a crash
	 and potentially allow an attacker to take control of the
	 affected system. Adobe is aware of reports that exploits
	 targeting these vulnerabilities have been published publicly.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5122</cvename>
 <cvename>CVE-2015-5123</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb15-18.html</url>
 </references>
 <dates>
 <discovery>2015-07-10</discovery>
 <entry>2015-07-14</entry>
 <modified>2015-07-16</modified>
 </dates>
 </vuln>

<vuln vid="3d39e927-29a2-11e5-86ff-14dae9d210b8">
 <topic>php -- use-after-free vulnerability</topic>
 <affects>
 <package>
	<name>php56-sqlite3</name>
	<range><lt>5.6.11</lt></range>
 </package>
 <package>
	<name>php55-sqlite3</name>
	<range><lt>5.5.27</lt></range>
 </package>
 <package>
	<name>php5-sqlite3</name>
	<range><lt>5.4.43</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Symeon Paraschoudis reports:
	<blockquote cite="https://bugs.php.net/bug.php?id=69972">
	 Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk()
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.php.net/bug.php?id=69972</url>
 </references>
 <dates>
 <discovery>2015-06-30</discovery>
 <entry>2015-07-13</entry>
 </dates>
 </vuln>

<vuln vid="af7fbd91-29a1-11e5-86ff-14dae9d210b8">
 <topic>php -- use-after-free vulnerability</topic>
 <affects>
 <package>
	<name>php56</name>
	<range><lt>5.6.11</lt></range>
 </package>
 <package>
	<name>php55</name>
	<range><lt>5.5.27</lt></range>
 </package>
 <package>
	<name>php5</name>
	<range><lt>5.4.43</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Symeon Paraschoudis reports:
	<blockquote cite="https://bugs.php.net/bug.php?id=69970">
	 Use-after-free vulnerability in spl_recursive_it_move_forward_ex()
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.php.net/bug.php?id=69970</url>
 </references>
 <dates>
 <discovery>2015-06-30</discovery>
 <entry>2015-07-13</entry>
 </dates>
 </vuln>

<vuln vid="5a1d5d74-29a0-11e5-86ff-14dae9d210b8">
 <topic>php -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>php56</name>
	<range><lt>5.6.11</lt></range>
 </package>
 <package>
	<name>php55</name>
	<range><lt>5.5.27</lt></range>
 </package>
 <package>
	<name>php5</name>
	<range><lt>5.4.43</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cmb reports:
	<blockquote cite="https://bugs.php.net/bug.php?id=69768">
	 When delayed variable substitution is enabled (can be set in the
	 Registry, for instance), !ENV! works similar to %ENV%, and the
	 value of the environment variable ENV will be subsituted.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.php.net/bug.php?id=69768</url>
 </references>
 <dates>
 <discovery>2015-06-07</discovery>
 <entry>2015-07-13</entry>
 </dates>
 </vuln>

<vuln vid="36bd352d-299b-11e5-86ff-14dae9d210b8">
 <topic>mysql -- SSL Downgrade</topic>
 <affects>
 <package>
	<name>php56-mysql</name>
	<name>php56-mysqli</name>
	<range><lt>5.6.11</lt></range>
 </package>
 <package>
	<name>php55-mysql</name>
	<name>php55-mysqli</name>
	<range><lt>5.5.27</lt></range>
 </package>
 <package>
	<name>php5-mysql</name>
	<name>php5-mysqli</name>
	<range><lt>5.4.43</lt></range>
 </package>
 <package>
	<name>mariadb55-client</name>
	<range><lt>5.5.44</lt></range>
 </package>
 <package>
	<name>mariadb100-client</name>
	<range><lt>10.0.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Duo Security reports:
	<blockquote cite="https://www.duosecurity.com/blog/backronym-mysql-vulnerability">
	 Researchers have identified a serious vulnerability in some
	 versions of Oracle’s MySQL database product that allows an attacker to
	 strip SSL/TLS connections of their security wrapping transparently.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.php.net/bug.php?id=69669</url>
 <url>https://www.duosecurity.com/blog/backronym-mysql-vulnerability</url>
 <url>http://www.ocert.org/advisories/ocert-2015-003.html</url>
 <url>https://mariadb.atlassian.net/browse/MDEV-7937</url>
 <url>https://mariadb.com/kb/en/mariadb/mariadb-10020-changelog/</url>
 <url>https://mariadb.com/kb/en/mariadb/mariadb-5544-changelog/</url>
 <cvename>CVE-2015-3152</cvename>
 </references>
 <dates>
 <discovery>2015-03-20</discovery>
 <entry>2015-07-13</entry>
 <modified>2015-07-18</modified>
 </dates>
 </vuln>

<vuln vid="81326883-2905-11e5-a4a5-002590263bf5">
 <topic>devel/ipython -- CSRF possible remote execution vulnerability</topic>
 <affects>
 <package>
	<name>ipython</name>
	<range><ge>0.12</ge><lt>3.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kyle Kelley reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q3/92">
	 Summary: POST requests exposed via the IPython REST API are
	 vulnerable to cross-site request forgery (CSRF). Web pages on
	 different domains can make non-AJAX POST requests to known IPython
	 URLs, and IPython will honor them. The user's browser will
	 automatically send IPython cookies along with the requests. The
	 response is blocked by the Same-Origin Policy, but the request
	 isn't.
	 API paths with issues:
	 <ul>
	 <li>POST /api/contents/&lt;path&gt;/&lt;file&gt;</li>
	 <li>POST /api/contents/&lt;path&gt;/&lt;file&gt;/checkpoints</li>
	 <li>POST /api/contents/&lt;path&gt;/&lt;file&gt;/checkpoints/&lt;checkpoint_id&gt;</li>
	 <li>POST /api/kernels</li>
	 <li>POST /api/kernels/&lt;kernel_id&gt;/&lt;action&gt;</li>
	 <li>POST /api/sessions</li>
	 <li>POST /api/clusters/&lt;cluster_id&gt;/&lt;action&gt;</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5607</cvename>
 <url>http://seclists.org/oss-sec/2015/q3/92</url>
 <url>http://ipython.org/ipython-doc/3/whatsnew/version3.html#ipython-3-2-1</url>
 </references>
 <dates>
 <discovery>2015-07-12</discovery>
 <entry>2015-07-13</entry>
 <modified>2015-07-22</modified>
 </dates>
 </vuln>

<vuln vid="379788f3-2900-11e5-a4a5-002590263bf5">
 <topic>freeradius -- insufficient CRL application vulnerability</topic>
 <affects>
 <package>
	<name>freeradius2</name>
	<range><lt>2.2.8</lt></range>
 </package>
 <package>
	<name>freeradius3</name>
	<range><lt>3.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	oCERT reports:
	<blockquote cite="http://www.ocert.org/advisories/ocert-2015-008.html">
	 The FreeRADIUS server relies on OpenSSL to perform certificate
	 validation, including Certificate Revocation List (CRL) checks. The
	 FreeRADIUS usage of OpenSSL, in CRL application, limits the checks
	 to leaf certificates, therefore not detecting revocation of
	 intermediate CA certificates.
	 An unexpired client certificate, issued by an intermediate CA with
	 a revoked certificate, is therefore accepted by FreeRADIUS.
	 Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf
	 certificate CRL checks, but does not use X509_V_FLAG_CRL_CHECK_ALL
	 for CRL checks on the complete trust chain.
	 The FreeRADIUS project advises that the recommended configuration
	 is to use self-signed CAs for all EAP-TLS methods.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4680</cvename>
 <freebsdpr>ports/201058</freebsdpr>
 <freebsdpr>ports/201059</freebsdpr>
 <url>http://www.ocert.org/advisories/ocert-2015-008.html</url>
 <url>http://freeradius.org/security.html</url>
 </references>
 <dates>
 <discovery>2015-06-22</discovery>
 <entry>2015-07-13</entry>
 </dates>
 </vuln>

<vuln vid="f1deed23-27ec-11e5-a4a5-002590263bf5">
 <topic>xen-tools -- xl command line config handling stack overflow</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><ge>4.1</ge><lt>4.5.0_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-137.html">
	 The xl command line utility mishandles long configuration values
	 when passed as command line arguments, with a buffer overrun.
	 A semi-trusted guest administrator or controller, who is intended
	 to be able to partially control the configuration settings for a
	 domain, can escalate their privileges to that of the whole host.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3259</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-137.html</url>
 </references>
 <dates>
 <discovery>2015-07-07</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="8c31b288-27ec-11e5-a4a5-002590263bf5">
 <topic>xen-kernel -- vulnerability in the iret hypercall handler</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><ge>3.1</ge><lt>4.5.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-136.html">
	 A buggy loop in Xen's compat_iret() function iterates the wrong way
	 around a 32-bit index. Any 32-bit PV guest kernel can trigger this
	 vulnerability by attempting a hypercall_iret with EFLAGS.VM set.
	 Given the use of __get/put_user(), and that the virtual addresses
	 in question are contained within the lower canonical half, the guest
	 cannot clobber any hypervisor data. Instead, Xen will take up to
	 2^33 pagefaults, in sequence, effectively hanging the host.
	 Malicious guest administrators can cause a denial of service
	 affecting the whole system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4164</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-136.html</url>
 </references>
 <dates>
 <discovery>2015-06-11</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="80e846ff-27eb-11e5-a4a5-002590263bf5">
 <topic>xen-kernel -- GNTTABOP_swap_grant_ref operation misbehavior</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><ge>4.2</ge><lt>4.5.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-134.html">
	 With the introduction of version 2 grant table operations, a
	 version check became necessary for most grant table related
	 hypercalls. The GNTTABOP_swap_grant_ref call was lacking such a
	 check. As a result, the subsequent code behaved as if version 2 was
	 in use, when a guest issued this hypercall without a prior
	 GNTTABOP_setup_table or GNTTABOP_set_version.
	 The effect is a possible NULL pointer dereferences. However, this
	 cannot be exploited to elevate privileges of the attacking domain,
	 as the maximum memory address that can be wrongly accessed this way
	 is bounded to far below the start of hypervisor memory.
	 Malicious or buggy guest domain kernels can mount a denial of
	 service attack which, if successful, can affect the whole system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4163</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-134.html</url>
 </references>
 <dates>
 <discovery>2015-06-11</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="ce658051-27ea-11e5-a4a5-002590263bf5">
 <topic>xen-kernel -- Information leak through XEN_DOMCTL_gettscinfo</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><ge>4.0</ge><lt>4.5.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-132.html">
	 The handler for XEN_DOMCTL_gettscinfo failed to initialize a
	 padding field subsequently copied to guest memory.
	 A similar leak existed in XEN_SYSCTL_getdomaininfolist, which is
	 being addressed here regardless of that operation being declared
	 unsafe for disaggregation by XSA-77.
	 Malicious or buggy stub domain kernels or tool stacks otherwise
	 living outside of Domain0 may be able to read sensitive data
	 relating to the hypervisor or other guests not under the control of
	 that domain.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3340</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-132.html</url>
 </references>
 <dates>
 <discovery>2015-04-20</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="3d657340-27ea-11e5-a4a5-002590263bf5">
 <topic>xen-tools -- Unmediated PCI register access in qemu</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-131.html">
	 Qemu allows guests to not only read, but also write all parts of
	 the PCI config space (but not extended config space) of passed
	 through PCI devices not explicitly dealt with for (partial)
	 emulation purposes.
	 Since the effect depends on the specific purpose of the the config
	 space field, it's not possible to give a general statement about the
	 exact impact on the host or other guests. Privilege escalation,
	 host crash (Denial of Service), and leaked information all cannot be
	 excluded.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4106</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-131.html</url>
 </references>
 <dates>
 <discovery>2015-06-02</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="cbe1a0f9-27e9-11e5-a4a5-002590263bf5">
 <topic>xen-tools -- Guest triggerable qemu MSI-X pass-through error messages</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-130.html">
	 Device model code dealing with guest PCI MSI-X interrupt management
	 activities logs messages on certain (supposedly) invalid guest
	 operations.
	 A buggy or malicious guest repeatedly invoking such operations may
	 result in the host disk to fill up, possibly leading to a Denial of
	 Service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4105</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-130.html</url>
 </references>
 <dates>
 <discovery>2015-06-02</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="4db8a0f4-27e9-11e5-a4a5-002590263bf5">
 <topic>xen-tools -- PCI MSI mask bits inadvertently exposed to guests</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-129.html">
	 The mask bits optionally available in the PCI MSI capability
	 structure are used by the hypervisor to occasionally suppress
	 interrupt delivery. Unprivileged guests were, however, nevertheless
	 allowed direct control of these bits.
	 Interrupts may be observed by Xen at unexpected times, which may
	 lead to a host crash and therefore a Denial of Service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4104</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-129.html</url>
 </references>
 <dates>
 <discovery>2015-06-02</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="af38cfec-27e7-11e5-a4a5-002590263bf5">
 <topic>xen-tools -- Potential unintended writes to host MSI message data field via qemu</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-128.html">
	 Logic is in place to avoid writes to certain host config space
	 fields when the guest must nevertheless be able to access their
	 virtual counterparts. A bug in how this logic deals with accesses
	 spanning multiple fields allows the guest to write to the host MSI
	 message data field.
	 While generally the writes write back the values previously read,
	 their value in config space may have got changed by the host between
	 the qemu read and write. In such a case host side interrupt handling
	 could become confused, possibly losing interrupts or allowing
	 spurious interrupt injection into other guests.
	 Certain untrusted guest administrators may be able to confuse host
	 side interrupt handling, leading to a Denial of Service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4103</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-128.html</url>
 </references>
 <dates>
 <discovery>2015-06-02</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="103a47d5-27e7-11e5-a4a5-002590263bf5">
 <topic>xen-kernel -- Certain domctl operations may be abused to lock up the host</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><ge>4.3</ge><lt>4.5.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-127.html">
	 XSA-77 put the majority of the domctl operations on a list
	 excepting them from having security advisories issued for them if
	 any effects their use might have could hamper security. Subsequently
	 some of them got declared disaggregation safe, but for a small
	 subset this was not really correct: Their (mis-)use may result in
	 host lockups.
	 As a result, the potential security benefits of toolstack
	 disaggregation are not always fully realised.
	 Domains deliberately given partial management control may be able
	 to deny service to the entire host.
	 As a result, in a system designed to enhance security by radically
	 disaggregating the management, the security may be reduced. But,
	 the security will be no worse than a non-disaggregated design.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2751</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-127.html</url>
 </references>
 <dates>
 <discovery>2015-03-31</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="79f401cd-27e6-11e5-a4a5-002590263bf5">
 <topic>xen-tools -- Unmediated PCI command register access in qemu</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-126.html">
	 HVM guests are currently permitted to modify the memory and I/O
	 decode bits in the PCI command register of devices passed through to
	 them. Unless the device is an SR-IOV virtual function, after
	 disabling one or both of these bits subsequent accesses to the MMIO
	 or I/O port ranges would - on PCI Express devices - lead to
	 Unsupported Request responses. The treatment of such errors is
	 platform specific.
	 Furthermore (at least) devices under control of the Linux pciback
	 driver in the host are handed to guests with the aforementioned bits
	 turned off. This means that such accesses can similarly lead to
	 Unsupported Request responses until these flags are set as needed by
	 the guest.
	 In the event that the platform surfaces aforementioned UR responses
	 as Non-Maskable Interrupts, and either the OS is configured to treat
	 NMIs as fatal or (e.g. via ACPI's APEI) the platform tells the OS to
	 treat these errors as fatal, the host would crash, leading to a
	 Denial of Service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2756</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-126.html</url>
 </references>
 <dates>
 <discovery>2015-03-31</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="d40c66cb-27e4-11e5-a4a5-002590263bf5">
 <topic>xen-kernel and xen-tools -- Long latency MMIO mapping operations are not preemptible</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.5.0_3</lt></range>
 </package>
 <package>
	<name>xen-tools</name>
	<range><lt>4.5.0_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-125.html">
	 The XEN_DOMCTL_memory_mapping hypercall allows long running
	 operations without implementing preemption.
	 This hypercall is used by the device model as part of the emulation
	 associated with configuration of PCI devices passed through to HVM
	 guests and is therefore indirectly exposed to those guests.
	 This can cause a physical CPU to become busy for a significant
	 period, leading to a host denial of service in some cases.
	 If a host denial of service is not triggered then it may instead be
	 possible to deny service to the domain running the device model,
	 e.g. domain 0.
	 This hypercall is also exposed more generally to all toolstacks.
	 However the uses of it in libxl based toolstacks are not believed
	 to open up any avenue of attack from an untrusted guest. Other
	 toolstacks may be vulnerable however.
	 The vulnerability is exposed via HVM guests which have a PCI device
	 assigned to them. A malicious HVM guest in such a configuration can
	 mount a denial of service attack affecting the whole system via its
	 associated device model (qemu-dm).
	 A guest is able to trigger this hypercall via operations which it
	 is legitimately expected to perform, therefore running the device
	 model as a stub domain does not offer protection against the host
	 denial of service issue. However it does offer some protection
	 against secondary issues such as denial of service against dom0.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2752</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-125.html</url>
 </references>
 <dates>
 <discovery>2015-03-31</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="83a28417-27e3-11e5-a4a5-002590263bf5">
 <topic>xen-kernel -- Hypervisor memory corruption due to x86 emulator flaw</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.5.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-123.html">
	 Instructions with register operands ignore eventual segment
	 overrides encoded for them. Due to an insufficiently conditional
	 assignment such a bogus segment override can, however, corrupt a
	 pointer used subsequently to store the result of the instruction.
	 A malicious guest might be able to read sensitive data relating to
	 other guests, or to cause denial of service on the host. Arbitrary
	 code execution, and therefore privilege escalation, cannot be
	 excluded.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2151</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-123.html</url>
 </references>
 <dates>
 <discovery>2015-03-10</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="ef9d041e-27e2-11e5-a4a5-002590263bf5">
 <topic>xen-kernel -- Information leak through version information hypercall</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.5.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-122.html">
	 The code handling certain sub-operations of the
	 HYPERVISOR_xen_version hypercall fails to fully initialize all
	 fields of structures subsequently copied back to guest memory. Due
	 to this hypervisor stack contents are copied into the destination of
	 the operation, thus becoming visible to the guest.
	 A malicious guest might be able to read sensitive data relating to
	 other guests.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2045</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-122.html</url>
 </references>
 <dates>
 <discovery>2015-03-05</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="5023f559-27e2-11e5-a4a5-002590263bf5">
 <topic>xen-kernel -- Information leak via internal x86 system device emulation</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><lt>4.5.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-121.html">
	 Emulation routines in the hypervisor dealing with certain system
	 devices check whether the access size by the guest is a supported
	 one. When the access size is unsupported these routines failed to
	 set the data to be returned to the guest for read accesses, so that
	 hypervisor stack contents are copied into the destination of the
	 operation, thus becoming visible to the guest.
	 A malicious HVM guest might be able to read sensitive data relating
	 to other guests.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2044</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-121.html</url>
 </references>
 <dates>
 <discovery>2015-03-05</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="0d732fd1-27e0-11e5-a4a5-002590263bf5">
 <topic>xen-tools -- HVM qemu unexpectedly enabling emulated VGA graphics backends</topic>
 <affects>
 <package>
	<name>xen-tools</name>
	<range><lt>4.5.0_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-119.html">
	 When instantiating an emulated VGA device for an x86 HVM guest qemu
	 will by default enable a backend to expose that device, either SDL
	 or VNC depending on the version of qemu and the build time
	 configuration.
	 The libxl toolstack library does not explicitly disable these
	 default backends when they are not enabled, leading to an unexpected
	 backend running.
	 If either SDL or VNC is explicitly enabled in the guest
	 configuration then only the expected backends will be enabled.
	 This affects qemu-xen and qemu-xen-traditional differently.
	 If qemu-xen was compiled with SDL support then this would result in
	 an SDL window being opened if $DISPLAY is valid, or a failure to
	 start the guest if not.
	 If qemu-xen was compiled without SDL support then qemu would
	 instead start a VNC server listening on ::1 (IPv6 localhost) or
	 127.0.0.1 (IPv4 localhost) with IPv6 preferred if available. A VNC
	 password will not be configured even if one is present in the guest
	 configuration.
	 qemu-xen-traditional will never start a vnc backend unless
	 explicitly configured. However by default it will start an SDL
	 backend if it was built with SDL support and $DISPLAY is valid.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2152</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-119.html</url>
 </references>
 <dates>
 <discovery>2015-03-13</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="912cb7f7-27df-11e5-a4a5-002590263bf5">
 <topic>xen-kernel -- arm: vgic: incorrect rate limiting of guest triggered logging</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><ge>4.4</ge><lt>4.5.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-118.html">
	 On ARM systems the code which deals with virtualizing the GIC
	 distributor would, under various circumstances, log messages on a
	 guest accessible code path without appropriate rate limiting.
	 A malicious guest could cause repeated logging to the hypervisor
	 console, leading to a Denial of Service attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1563</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-118.html</url>
 </references>
 <dates>
 <discovery>2015-01-29</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="785c86b1-27d6-11e5-a4a5-002590263bf5">
 <topic>xen-kernel -- arm: vgic-v2: GICD_SGIR is not properly emulated</topic>
 <affects>
 <package>
	<name>xen-kernel</name>
	<range><ge>4.5</ge><lt>4.5.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Xen Project reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-117.html">
	 When decoding a guest write to a specific register in the virtual
	 interrupt controller Xen would treat an invalid value as a critical
	 error and crash the host.
	 By writing an invalid value to the GICD.SGIR register a guest can
	 crash the host, resulting in a Denial of Service attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0268</cvename>
 <url>http://xenbits.xen.org/xsa/advisory-117.html</url>
 </references>
 <dates>
 <discovery>2015-02-12</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="7313b0e3-27b4-11e5-a15a-50af736ef1c0">
 <topic>pivotx -- Multiple unrestricted file upload vulnerabilities</topic>
 <affects>
 <package>
	<name>pivotx</name>
	<range><lt>2.3.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pivotx reports:
	<blockquote cite="http://pivotx.net/page/security">
	 Multiple unrestricted file upload vulnerabilities in fileupload.php
	 in PivotX before 2.3.9 allow remote authenticated users to execute
	 arbitrary PHP code by uploading a file with a (1) .php or (2) .php#
	 extension, and then accessing it via unspecified vectors.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0341</cvename>
 </references>
 <dates>
 <discovery>2014-04-15</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="14d846d6-27b3-11e5-a15a-50af736ef1c0">
 <topic>pivotx -- cross-site scripting (XSS) vulnerability</topic>
 <affects>
 <package>
	<name>pivotx</name>
	<range><lt>2.3.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	pivotx reports:
	<blockquote cite="http://pivotx.net/page/security">
	 cross-site scripting (XSS) vulnerability in the nickname (and
	 possibly the email) field. Mitigated by the fact that an attacker
	 must have a PivotX account.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0341</cvename>
 </references>
 <dates>
 <discovery>2014-04-15</discovery>
 <entry>2015-07-11</entry>
 </dates>
 </vuln>

<vuln vid="c93c9395-25e1-11e5-a4a5-002590263bf5">
 <topic>wpa_supplicant -- WPS_NFC option payload length validation vulnerability</topic>
 <affects>
 <package>
	<name>wpa_supplicant</name>
	<range><lt>2.4_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jouni Malinen reports:
	<blockquote cite="http://w1.fi/security/2015-5/incomplete-wps-and-p2p-nfc-ndef-record-payload-length-validation.txt">
	 Incomplete WPS and P2P NFC NDEF record payload length
	 validation. (2015-5)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-8041</cvename>
 <url>http://w1.fi/security/2015-5/incomplete-wps-and-p2p-nfc-ndef-record-payload-length-validation.txt</url>
 </references>
 <dates>
 <discovery>2015-07-08</discovery>
 <entry>2015-07-09</entry>
 <modified>2015-11-10</modified>
 </dates>
 </vuln>

<vuln vid="075952fe-267e-11e5-9d03-3c970e169bc2">
 <topic>openssl -- alternate chains certificate forgery vulnerability</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><ge>1.0.2_2</ge><lt>1.0.2_4</lt></range>
 </package>
 <package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.2b</ge><lt>1.0.2d</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL reports:
	<blockquote cite="https://www.openssl.org/news/secadv_20150709.txt">
	 During certificate verification, OpenSSL (starting from version
	 1.0.1n and 1.0.2b) will attempt to find an alternative certificate
	 chain if the first attempt to build such a chain fails. An error
	 in the implementation of this logic can mean that an attacker could
	 cause certain checks on untrusted certificates to be bypassed,
	 such as the CA flag, enabling them to use a valid leaf certificate
	 to act as a CA and "issue" an invalid certificate.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1793</cvename>
 <url>https://www.openssl.org/news/secadv_20150709.txt</url>
 </references>
 <dates>
 <discovery>2015-07-09</discovery>
 <entry>2015-07-09</entry>
 </dates>
 </vuln>

<vuln vid="37ed8e9c-2651-11e5-86ff-14dae9d210b8">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-django</name>
	<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
 </package>
 <package>
	<name>py32-django</name>
	<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
 </package>
 <package>
	<name>py33-django</name>
	<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
 </package>
 <package>
	<name>py34-django</name>
	<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
 </package>
 <package>
	<name>py27-django</name>
	<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
 </package>
 <package>
	<name>py32-django</name>
	<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
 </package>
 <package>
	<name>py33-django</name>
	<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
 </package>
 <package>
	<name>py34-django</name>
	<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
 </package>
 <package>
	<name>py27-django</name>
	<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
 </package>
 <package>
	<name>py32-django</name>
	<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
 </package>
 <package>
	<name>py33-django</name>
	<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
 </package>
 <package>
	<name>py34-django</name>
	<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
 </package>
 <package>
	<name>py27-django-devel</name>
	<range><le>20150531,1</le></range>
 </package>
 <package>
	<name>py32-django-devel</name>
	<range><le>20150531,1</le></range>
 </package>
 <package>
	<name>py33-django-devel</name>
	<range><le>20150531,1</le></range>
 </package>
 <package>
	<name>py34-django-devel</name>
	<range><le>20150531,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Graham reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2015/jul/08/security-releases/">
	 In accordance with our security release policy, the Django
	 team is issuing multiple releases -- Django 1.4.21, 1.7.9, and 1.8.3.
	 These releases are now available on PyPI and our download page. These
	 releases address several security issues detailed below. We encourage
	 all users of Django to upgrade as soon as possible. The Django master
	 branch has also been updated.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2015/jul/08/security-releases/</url>
 <url>https://github.com/django/django/commit/df049ed77a4db67e45db5679bfc76a85d2a26680</url>
 <url>https://github.com/django/django/commit/014247ad1922931a2f17beaf6249247298e9dc44</url>
 <url>https://github.com/django/django/commit/17d3a6d8044752f482453f5906026eaf12c39e8e</url>
 <cvename>CVE-2015-5143</cvename>
 <cvename>CVE-2015-5144</cvename>
 <cvename>CVE-2015-5145</cvename>
 </references>
 <dates>
 <discovery>2015-06-10</discovery>
 <entry>2015-07-09</entry>
 </dates>
 </vuln>

<vuln vid="348bfa69-25a2-11e5-ade1-0011d823eebd">
 <topic>Adobe Flash Player -- critical vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<range><lt>11.2r202.481</lt></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.481</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-16.html">
	 
	 Adobe has released security updates for Adobe Flash Player. These
	 updates address critical vulnerabilities that could potentially
	 allow an attacker to take control of the affected system. Adobe is
	 aware of a report that an exploit targeting CVE-2015-5119 has been
	 publicly published.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb15-16.html</url>
 <cvename>CVE-2015-5119</cvename>
 </references>
 <dates>
 <discovery>2015-07-07</discovery>
 <entry>2015-07-08</entry>
 </dates>
 </vuln>

<vuln vid="c93533a3-24f1-11e5-8b74-3c970e169bc2">
 <topic>bind -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>bind910</name>
	<range><lt>9.10.2P2</lt></range>
 </package>
 <package>
	<name>bind99</name>
	<range><lt>9.9.7P1</lt></range>
 </package>
 <package>
	<name>bind910-base</name>
	<name>bind99-base</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_19</lt></range>
	<range><ge>8.4</ge><lt>8.4_33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01267/">
	 A very uncommon combination of zone data has been found
	 that triggers a bug in BIND, with the result that named
	 will exit with a "REQUIRE" failure in name.c when validating
	 the data returned in answer to a recursive query.
	 A recursive resolver that is performing DNSSEC validation
	 can be deliberately terminated by any attacker who can
	 cause a query to be performed against a maliciously
	 constructed zone. This will result in a denial of
	 service to clients who rely on that resolver.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-15:11.bind</freebsdsa>
 <cvename>CVE-2015-4620</cvename>
 <url>https://kb.isc.org/article/AA-01267/</url>
 </references>
 <dates>
 <discovery>2015-07-07</discovery>
 <entry>2015-07-07</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="cbfa8bd7-24b6-11e5-86ff-14dae9d210b8">
 <topic>haproxy -- information leak vulnerability</topic>
 <affects>
 <package>
 <name>haproxy</name>
 <range><ge>1.5.0</ge><lt>1.5.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 HAProxy reports:
 <blockquote cite="http://www.haproxy.org/news.html">
	 A vulnerability was found when HTTP pipelining is used. In
	 some cases, a client might be able to cause a buffer alignment issue and
	 retrieve uninitialized memory contents that exhibit data from a past
	 request or session. I want to address sincere congratulations to Charlie
	 Smurthwaite of aTech Media for the really detailed traces he provided
	 which made it possible to find the cause of this bug. Every user of
	 1.5-dev, 1.5.x or 1.6-dev must upgrade to 1.5.14 or latest 1.6-dev
	 snapshot to fix this issue, or use the backport of the fix provided by
	 their operating system vendors. CVE-2015-3281 was assigned to this bug.
 </blockquote>
 </body>
 </description>
 <references>
 <url>http://www.haproxy.org/news.html</url>
 <url>http://git.haproxy.org/?p=haproxy-1.5.git;a=commit;h=7ec765568883b2d4e5a2796adbeb492a22ec9bd4</url>
 <mlist>http://seclists.org/oss-sec/2015/q3/61</mlist>
 <cvename>CVE-2015-3281</cvename>
 </references>
 <dates>
 <discovery>2015-07-02</discovery>
 <entry>2015-07-07</entry>
 </dates>
 </vuln>

<vuln vid="038a5808-24b3-11e5-b0c8-bf4d8935d4fa">
 <topic>roundcube -- multiple vulnerabilities</topic>
 <affects>
 <package>
 <name>roundcube</name>
 <range><ge>1.1.0,1</ge><lt>1.1.2,1</lt></range>
 <range><lt>1.0.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Roundcube reports:
 <blockquote cite="https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/">
	 We just published updates to both stable versions 1.0 and
	 1.1 after fixing many minor bugs and adding some security improvements
	 to the 1.1 release branch. Version 1.0.6 comes with cherry-picked fixes
	 from the more recent version to ensure proper long term support
	 especially in regards of security and compatibility. 
	 
	 The security-related fixes in particular are: 
	 
	 * XSS vulnerability in _mbox argument 
	 * security improvement in contact photo handling 
	 * potential info disclosure from temp directory
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5381</cvename>
 <cvename>CVE-2015-5383</cvename>
 <mlist>http://openwall.com/lists/oss-security/2015/07/06/10</mlist>
 <url>https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/</url>
 </references>
 <dates>
 <discovery>2015-05-30</discovery>
 <entry>2015-07-07</entry>
 </dates>
 </vuln>

<vuln vid="543b5939-2067-11e5-a4a5-002590263bf5">
 <topic>turnserver -- SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>turnserver</name>
	<range><lt>4.4.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oleg Moskalenko reports:
	<blockquote cite="http://turnserver.open-sys.org/downloads/v4.4.5.3/ChangeLog">
	 SQL injection security hole fixed.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://turnserver.open-sys.org/downloads/v4.4.5.3/ChangeLog</url>
 <mlist>https://groups.google.com/d/msg/turn-server-project-rfc5766-turn-server/Dj3MmgyZX1o/ZaFo3zvxIw0J</mlist>
 </references>
 <dates>
 <discovery>2015-06-20</discovery>
 <entry>2015-07-02</entry>
 </dates>
 </vuln>

<vuln vid="150d1538-23fa-11e5-a4a5-002590263bf5">
 <topic>squid -- Improper Protection of Alternate Path with CONNECT requests</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>3.5.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid security advisory 2015:2 reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2015_2.txt">
	 Squid configured with cache_peer and operating on explicit proxy
	 traffic does not correctly handle CONNECT method peer responses.
	 The bug is important because it allows remote clients to bypass
	 security in an explicit gateway proxy.
	 However, the bug is exploitable only if you have configured
	 cache_peer to receive CONNECT requests.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.squid-cache.org/Advisories/SQUID-2015_2.txt</url>
 <cvename>CVE-2015-5400</cvename>
 </references>
 <dates>
 <discovery>2015-07-06</discovery>
 <entry>2015-07-06</entry>
 <modified>2015-07-17</modified>
 </dates>
 </vuln>

<vuln vid="b6da24da-23f7-11e5-a4a5-002590263bf5">
 <topic>squid -- client-first SSL-bump does not correctly validate X509 server certificate</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><ge>3.5</ge><lt>3.5.4</lt></range>
	<range><ge>3.4</ge><lt>3.4.13</lt></range>
 </package>
 <package>
	<name>squid33</name>
	<range><ge>3.3</ge><lt>3.3.14</lt></range>
 </package>
 <package>
	<name>squid32</name>
	<range><ge>3.2</ge><lt>3.2.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid security advisory 2015:1 reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2015_1.txt">
	 Squid configured with client-first SSL-bump does not correctly
	 validate X509 server certificate domain / hostname fields.
	 The bug is important because it allows remote servers to bypass
	 client certificate validation. Some attackers may also be able
	 to use valid certificates for one domain signed by a global
	 Certificate Authority to abuse an unrelated domain.
	 However, the bug is exploitable only if you have configured
	 Squid to perform SSL Bumping with the "client-first" or "bump"
	 mode of operation.
	 Sites that do not use SSL-Bump are not vulnerable.
	 All Squid built without SSL support are not vulnerable to the
	 problem.
	</blockquote>
	The FreeBSD port does not use SSL by default and is not vulnerable
	 in the default configuration.
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3455</cvename>
 <url>http://www.squid-cache.org/Advisories/SQUID-2015_1.txt</url>
 </references>
 <dates>
 <discovery>2015-05-01</discovery>
 <entry>2015-07-06</entry>
 </dates>
 </vuln>

<vuln vid="72fccfdf-2061-11e5-a4a5-002590263bf5">
 <topic>ansible -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ansible</name>
	<range><lt>1.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ansible, Inc. reports:
	<blockquote cite="http://www.ansible.com/security">
	 Ensure that hostnames match certificate names when using HTTPS -
	 resolved in Ansible 1.9.2
	 Improper symlink handling in zone, jail, and chroot connection
	 plugins could lead to escape from confined environment - resolved
	 in Ansible 1.9.2
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3908</cvename>
 <cvename>CVE-2015-6240</cvename>
 <url>http://www.ansible.com/security</url>
 <url>https://raw.githubusercontent.com/ansible/ansible/v1.9.2-1/CHANGELOG.md</url>
 </references>
 <dates>
 <discovery>2015-06-25</discovery>
 <entry>2015-07-02</entry>
 <modified>2015-08-18</modified>
 </dates>
 </vuln>

<vuln vid="e308c61a-2060-11e5-a4a5-002590263bf5">
 <topic>ansible -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ansible</name>
	<range><lt>1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ansible, Inc. reports:
	<blockquote cite="http://www.ansible.com/security">
	 Arbitrary execution from data from compromised remote hosts or
	 local data when using a legacy Ansible syntax - resolved in
	 Ansible 1.7
	 ansible-galaxy command when used on local tarballs (and not
	 galaxy.ansible.com) can install a malformed tarball if so provided
	 - resolved in Ansible 1.7
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.ansible.com/security</url>
 <url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
 </references>
 <dates>
 <discovery>2014-08-06</discovery>
 <entry>2015-07-02</entry>
 </dates>
 </vuln>

<vuln vid="9dae9d62-205f-11e5-a4a5-002590263bf5">
 <topic>ansible -- code execution from compromised remote host data or untrusted local data</topic>
 <affects>
 <package>
	<name>ansible</name>
	<range><lt>1.6.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ansible, Inc. reports:
	<blockquote cite="http://www.ansible.com/security">
	 Arbitrary execution from data from compromised remote hosts or
	 untrusted local data - resolved in Ansible 1.6.7
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-4966</cvename>
 <bid>68794</bid>
 <url>http://www.ansible.com/security</url>
 <url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
 </references>
 <dates>
 <discovery>2014-07-21</discovery>
 <entry>2015-07-02</entry>
 </dates>
 </vuln>

<vuln vid="2c493ac8-205e-11e5-a4a5-002590263bf5">
 <topic>ansible -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>ansible</name>
	<range><lt>1.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ansible, Inc. reports:
	<blockquote cite="http://www.ansible.com/security">
	 Incomplete Fix Remote Code Execution Vulnerability - Fixed in
	 Ansible 1.6.4
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-4678</cvename>
 <bid>68335</bid>
 <url>http://www.ansible.com/security</url>
 <url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
 </references>
 <dates>
 <discovery>2014-06-25</discovery>
 <entry>2015-07-02</entry>
 </dates>
 </vuln>

<vuln vid="a6a9f9d5-205c-11e5-a4a5-002590263bf5">
 <topic>ansible -- local symlink exploits</topic>
 <affects>
 <package>
	<name>ansible</name>
	<range><lt>1.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4259">
	 runner/connection_plugins/ssh.py in Ansible before 1.2.3, when
	 using ControlPersist, allows local users to redirect a ssh session
	 via a symlink attack on a socket file with a predictable name in
	 /tmp/.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4260">
	 lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3,
	 when playbook does not run due to an error, allows local users to
	 overwrite arbitrary files via a symlink attack on a retry file with
	 a predictable name in /var/tmp/ansible/.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4259</cvename>
 <cvename>CVE-2013-4260</cvename>
 <url>http://www.ansible.com/security</url>
 <url>https://groups.google.com/forum/#!topic/ansible-project/UVDYW0HGcNg</url>
 </references>
 <dates>
 <discovery>2013-08-21</discovery>
 <entry>2015-07-02</entry>
 </dates>
 </vuln>

<vuln vid="a478421e-2059-11e5-a4a5-002590263bf5">
 <topic>ansible -- enable host key checking in paramiko connection type</topic>
 <affects>
 <package>
	<name>ansible</name>
	<range><lt>1.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ansible changelog reports:
	<blockquote cite="https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md">
	 Host key checking is on by default. Disable it if you like by
	 adding host_key_checking=False in the [default] section of
	 /etc/ansible/ansible.cfg or ~/ansible.cfg or by exporting
	 ANSIBLE_HOST_KEY_CHECKING=False.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2233</cvename>
 <url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
 <url>http://www.ansible.com/security</url>
 <url>https://github.com/ansible/ansible/issues/857</url>
 </references>
 <dates>
 <discovery>2012-08-13</discovery>
 <entry>2015-07-02</entry>
 </dates>
 </vuln>

<vuln vid="d7b9a28d-238c-11e5-86ff-14dae9d210b8">
 <topic>bitcoin -- denial of service</topic>
 <affects>
 <package>
	<name>bitcoin</name>
	<range><lt>0.10.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gregory Maxwell reports:
	<blockquote cite="http://bitcoin-development.narkive.com/tO8M0R0j/upcoming-dos-vulnerability-announcements-for-bitcoin-core">
	 On July 7th I will be making public details of several
	 serious denial of service vulnerabilities which have fixed in recent
	 versions of Bitcoin Core, including including CVE-2015-3641.

I strongly recommend anyone running production nodes exposed to inbound
	 connections from the internet upgrade to 0.10.2 as soon as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3641</cvename>
 <url>http://bitcoin-development.narkive.com/tO8M0R0j/upcoming-dos-vulnerability-announcements-for-bitcoin-core</url>
 <url>https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures</url>
 </references>
 <dates>
 <discovery>2015-06-27</discovery>
 <entry>2015-07-06</entry>
 </dates>
 </vuln>

<vuln vid="864e6f75-2372-11e5-86ff-14dae9d210b8">
 <topic>node, iojs, and v8 -- denial of service</topic>
 <affects>
 <package>
	<name>node</name>
	<range><lt>0.12.6</lt></range>
 </package>
 <package>
	<name>node-devel</name>
	<range><lt>0.12.6</lt></range>
 </package>
 <package>
	<name>iojs</name>
	<range><lt>2.3.3</lt></range>
 </package>
 <package>
	<name>v8</name>
	<range><le>3.18.5</le></range>
 </package>
 <package>
	<name>v8-devel</name>
	<range><le>3.27.7_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	node reports:
	<blockquote cite="http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/">
	 This release of Node.js fixes a bug that triggers an
	 out-of-band write in V8's utf-8 decoder. This bug impacts all Buffer to
	 String conversions. This is an important security update as this bug can
	 be used to cause a denial of service attack.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/</url>
 <url>https://github.com/joyent/node/commit/78b0e30954111cfaba0edbeee85450d8cbc6fdf6</url>
 <url>https://github.com/nodejs/io.js/commit/030f8045c706a8c3925ec7cb3184fdfae4ba8676</url>
 <url>https://codereview.chromium.org/1226493003</url>
 <cvename>CVE-2015-5380</cvename>
 </references>
 <dates>
 <discovery>2015-07-03</discovery>
 <entry>2015-07-06</entry>
 <modified>2015-07-10</modified>
 </dates>
 </vuln>

<vuln vid="bf1d9331-21b6-11e5-86ff-14dae9d210b8">
 <topic>cups-filters -- texttopdf integer overflow</topic>
 <affects>
 <package>
	<name>cups-filters</name>
	<range><lt>1.0.71</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Cornelius from Red Hat reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/07/03/2">
	 An integer overflow flaw leading to a heap-based buffer overflow was
	 discovered in the way the texttopdf utility of cups-filter processed
	 print jobs with a specially crafted line size. An attacker being able
	 to submit print jobs could exploit this flaw to crash texttopdf or,
	 possibly, execute arbitrary code with the privileges of the 'lp' user.
	</blockquote>
	Tim Waugh reports:
	<blockquote cite="http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7365">
	 The Page allocation is moved into textcommon.c, where it does all the
	 necessary checking: lower-bounds for CVE-2015-3258 and upper-bounds
	 for CVE-2015-3259 due to integer overflows for the calloc() call
	 initializing Page[0] and the memset() call in texttopdf.c's
	 WritePage() function zeroing the entire array.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3279</cvename>
 <url>https://access.redhat.com/security/cve/CVE-2015-3279</url>
 <url>http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7365</url>
 <mlist>http://osdir.com/ml/opensource-software-security/2015-07/msg00021.html</mlist>
 </references>
 <dates>
 <discovery>2015-07-03</discovery>
 <entry>2015-07-03</entry>
 <modified>2015-07-07</modified>
 </dates>
 </vuln>

<vuln vid="9c7177ff-1fe1-11e5-9a01-bcaec565249c">
 <topic>libxml2 -- Enforce the reader to run in constant memory</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.9.2_3</lt></range>
 </package>
 <package>
	<name>linux-c6-libxml2</name>
	<range><lt>2.7.6_5</lt></range>
 </package>
 <package>
	<name>linux-f10-libxml2</name>
	<range><ge>*</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Daniel Veilland reports:
	<blockquote cite="https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9">
	 Enforce the reader to run in constant memory. One of the
	 operation on the reader could resolve entities leading to
	 the classic expansion issue. Make sure the buffer used for
	 xmlreader operation is bounded. Introduce a new allocation
	 type for the buffers for this effect.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1819</cvename>
 <url>https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9</url>
 </references>
 <dates>
 <discovery>2015-04-14</discovery>
 <entry>2015-07-01</entry>
 <modified>2016-01-31</modified>
 </dates>
 </vuln>

<vuln vid="2a8b7d21-1ecc-11e5-a4a5-002590263bf5">
 <topic>wesnoth -- disclosure of .pbl files with lowercase, uppercase, and mixed-case extension</topic>
 <affects>
 <package>
	<name>wesnoth</name>
	<range><lt>1.12.4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ignacio R. Morelle reports:
	<blockquote cite="http://forums.wesnoth.org/viewtopic.php?t=42776">
	 As mentioned in the Wesnoth 1.12.4 and Wesnoth 1.13.1 release
	 announcements, a security vulnerability targeting add-on authors
	 was found (bug #23504) which allowed a malicious user to obtain
	 add-on server passphrases from the client's .pbl files and transmit
	 them over the network, or store them in saved game files intended
	 to be shared by the victim. This vulnerability affects all existing
	 releases up to and including versions 1.12.2 and 1.13.0.
	 Additionally, version 1.12.3 included only a partial fix that failed
	 to guard users against attempts to read from .pbl files with an
	 uppercase or mixed-case extension. CVE-2015-5069 and CVE-2015-5070
	 have been assigned to the vulnerability affecting .pbl files with a
	 lowercase extension, and .pbl files with an uppercase or mixed-case
	 extension, respectively.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-5069</cvename>
 <cvename>CVE-2015-5070</cvename>
 <url>http://forums.wesnoth.org/viewtopic.php?t=42776</url>
 <url>http://forums.wesnoth.org/viewtopic.php?t=42775</url>
 </references>
 <dates>
 <discovery>2015-06-28</discovery>
 <entry>2015-07-01</entry>
 </dates>
 </vuln>

<vuln vid="b19da422-1e02-11e5-b43d-002590263bf5">
 <topic>cups-filters -- buffer overflow in texttopdf size allocation</topic>
 <affects>
 <package>
	<name>cups-filters</name>
	<range><lt>1.0.70</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Cornelius from Red Hat reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/06/26/4">
	 A heap-based buffer overflow was discovered in the way the
	 texttopdf utility of cups-filters processed print jobs with a
	 specially crafted line size. An attacker being able to submit
	 print jobs could exploit this flaw to crash texttopdf or,
	 possibly, execute arbitrary code.
	</blockquote>
	Till Kamppeter reports:
	<blockquote cite="http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7363">
	 texttopdf: Fixed buffer overflow on size allocation of texttopdf
	 when working with extremely small line sizes, which causes the size
	 calculation to result in 0 (CVE-2015-3258, thanks to Stefan
	 Cornelius from Red Hat for the patch).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3258</cvename>
 <mlist>http://www.openwall.com/lists/oss-security/2015/06/26/4</mlist>
 <url>http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7363</url>
 </references>
 <dates>
 <discovery>2015-06-26</discovery>
 <entry>2015-06-29</entry>
 </dates>
 </vuln>

<vuln vid="0d0f3050-1f69-11e5-9ba9-d050996490d0">
 <topic>ntp -- control message remote Denial of Service vulnerability</topic>
 <affects>
 <package>
	<name>ntp</name>
	<range><lt>4.2.8p3</lt></range>
 </package>
 <package>
	<name>ntp-devel</name>
	<range><lt>4.3.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ntp.org reports:
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi">
	 Under limited and specific circumstances an attacker can send a
	 crafted packet to cause a vulnerable ntpd instance to crash.
	 This requires each of the following to be true:
	 <ul>
	 <li>ntpd set up to allow for remote configuration (not
	 allowed by default), and</li>
	 <li>knowledge of the configuration password, and</li>
	 <li>access to a computer entrusted to perform remote
	 configuration.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://bugs.ntp.org/show_bug.cgi?id=2853</url>
 <url>https://www.kb.cert.org/vuls/id/668167</url>
 <url>http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi</url>
 </references>
 <dates>
 <discovery>2015-06-29</discovery>
 <entry>2015-06-30</entry>
 </dates>
 </vuln>

<vuln vid="acd5d037-1c33-11e5-be9c-6805ca1d3bb1">
 <topic>qemu -- Heap overflow in QEMU PCNET controller, allowing guest to host escape (CVE-2015-3209)</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>0.11.1_20</lt></range>
	<range><ge>0.12</ge><lt>2.3.0_2</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<range><lt>2.3.50.g20150618_1</lt></range>
 </package>
 <package>
	<name>xen-tools</name>
	<range><lt>4.5.0_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The QEMU security team reports:
	<blockquote cite="http://xenbits.xen.org/xsa/advisory-135.html">
	 A guest which has access to an emulated PCNET network
	 device (e.g. with "model=pcnet" in their VIF configuration)
	 can exploit this vulnerability to take over the qemu
	 process elevating its privilege to that of the qemu
	 process.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://xenbits.xen.org/xsa/advisory-135.html</url>
 <cvename>CVE-2015-3209</cvename>
 </references>
 <dates>
 <discovery>2015-04-10</discovery>
 <entry>2015-06-26</entry>
 <modified>2015-07-11</modified>
 </dates>
 </vuln>

<vuln vid="23232028-1ba4-11e5-b43d-002590263bf5">
 <topic>elasticsearch -- security fix for shared file-system repositories</topic>
 <affects>
 <package>
	<name>elasticsearch</name>
	<range><ge>1.0.0</ge><lt>1.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Elastic reports:
	<blockquote cite="https://www.elastic.co/community/security">
	 Vulnerability Summary: All Elasticsearch versions from 1.0.0 to
	 1.5.2 are vulnerable to an attack that uses Elasticsearch to modify
	 files read and executed by certain other applications.
	 Remediation Summary: Users should upgrade to 1.6.0. Alternately,
	 ensure that other applications are not present on the system, or
	 that Elasticsearch cannot write into areas where these applications
	 would read.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4165</cvename>
 <freebsdpr>ports/201008</freebsdpr>
 <url>https://www.elastic.co/community/security</url>
 <url>https://www.elastic.co/blog/elasticsearch-1-6-0-released</url>
 </references>
 <dates>
 <discovery>2015-06-09</discovery>
 <entry>2015-06-26</entry>
 </dates>
 </vuln>

<vuln vid="a71e7440-1ba3-11e5-b43d-002590263bf5">
 <topic>elasticsearch -- directory traversal attack with site plugins</topic>
 <affects>
 <package>
	<name>elasticsearch</name>
	<range><lt>1.4.5</lt></range>
	<range><ge>1.5.0</ge><lt>1.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Elastic reports:
	<blockquote cite="https://www.elastic.co/community/security">
	 Vulnerability Summary: All Elasticsearch versions prior to 1.5.2
	 and 1.4.5 are vulnerable to a directory traversal attack that allows
	 an attacker to retrieve files from the server running Elasticsearch
	 when one or more site plugins are installed, or when Windows is the
	 server OS.
	 Remediation Summary: Users should upgrade to 1.4.5 or 1.5.2. Users
	 that do not want to upgrade can address the vulnerability by
	 disabling site plugins. See the CVE description for additional
	 options.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3337</cvename>
 <bid>74353</bid>
 <url>https://www.elastic.co/community/security</url>
 <url>https://www.elastic.co/blog/elasticsearch-1-5-2-and-1-4-5-released</url>
 <url>https://www.exploit-db.com/exploits/37054/</url>
 <url>https://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html</url>
 <url>http://www.securityfocus.com/archive/1/535385</url>
 </references>
 <dates>
 <discovery>2015-04-27</discovery>
 <entry>2015-06-26</entry>
 </dates>
 </vuln>

<vuln vid="026759e0-1ba3-11e5-b43d-002590263bf5">
 <topic>elasticsearch -- remote OS command execution via Groovy scripting engine</topic>
 <affects>
 <package>
	<name>elasticsearch</name>
	<range><ge>1.3.0</ge><lt>1.3.8</lt></range>
	<range><ge>1.4.0</ge><lt>1.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Elastic reports:
	<blockquote cite="https://www.elastic.co/community/security">
	 Vulnerability Summary: Elasticsearch versions 1.3.0-1.3.7 and
	 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine that
	 were introduced in 1.3.0. The vulnerability allows an attacker to
	 construct Groovy scripts that escape the sandbox and execute shell
	 commands as the user running the Elasticsearch Java VM.
	 Remediation Summary: Users should upgrade to 1.3.8 or 1.4.3. Users
	 that do not want to upgrade can address the vulnerability by setting
	 script.groovy.sandbox.enabled to false in elasticsearch.yml and
	 restarting the node.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1427</cvename>
 <bid>72585</bid>
 <url>https://www.elastic.co/community/security</url>
 <url>https://www.elastic.co/blog/elasticsearch-1-4-3-and-1-3-8-released</url>
 <url>http://www.securityfocus.com/archive/1/archive/1/534689/100/0/threaded</url>
 <url>https://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html</url>
 <url>https://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html</url>
 </references>
 <dates>
 <discovery>2015-02-11</discovery>
 <entry>2015-06-26</entry>
 </dates>
 </vuln>

<vuln vid="5951fb49-1ba2-11e5-b43d-002590263bf5">
 <topic>elasticsearch -- cross site scripting vulnerability in the CORS functionality</topic>
 <affects>
 <package>
	<name>elasticsearch</name>
	<range><lt>1.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Elastic reports:
	<blockquote cite="https://www.elastic.co/community/security">
	 Vulnerability Summary: Elasticsearch versions 1.3.x and prior have
	 a default configuration for CORS that allows an attacker to craft
	 links that could cause a user's browser to send requests to
	 Elasticsearch instances on their local network. These requests could
	 cause data loss or compromise.
	 Remediation Summary: Users should either set "http.cors.enabled" to
	 false, or set "http.cors.allow-origin" to the value of the server
	 that should be allowed access, such as localhost or a server hosting
	 Kibana. Disabling CORS entirely with the former setting is more
	 secure, but may not be suitable for all use cases.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-6439</cvename>
 <bid>70233</bid>
 <url>https://www.elastic.co/community/security</url>
 <url>https://www.elastic.co/blog/elasticsearch-1-4-0-beta-released</url>
 <url>https://packetstormsecurity.com/files/128556/Elasticsearch-1.3.x-CORS-Issue.html</url>
 <url>http://www.securityfocus.com/archive/1/archive/1/533602/100/0/threaded</url>
 </references>
 <dates>
 <discovery>2014-10-01</discovery>
 <entry>2015-06-26</entry>
 </dates>
 </vuln>

<vuln vid="43ac9d42-1b9a-11e5-b43d-002590263bf5">
 <topic>elasticsearch and logstash -- remote OS command execution via dynamic scripting</topic>
 <affects>
 <package>
	<name>elasticsearch</name>
	<range><lt>1.2.0</lt></range>
 </package>
 <package>
	<name>logstash</name>
	<range><lt>1.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Elastic reports:
	<blockquote cite="https://www.elastic.co/community/security">
	 Vulnerability Summary: In Elasticsearch versions 1.1.x and prior,
	 dynamic scripting is enabled by default. This could allow an
	 attacker to execute OS commands.
	 Remediation Summary: Disable dynamic scripting.
	</blockquote>
	<blockquote cite="https://www.elastic.co/blog/logstash-1-4-3-released">
	 Logstash 1.4.2 was bundled with Elasticsearch 1.1.1, which is
	 vulnerable to CVE-2014-3120. These binaries are used in
	 Elasticsearch output specifically when using the node protocol.
	 Since a node client joins the Elasticsearch cluster, the attackers
	 could use scripts to execute commands on the host OS using the node
	 client's URL endpoint. With 1.4.3 release, we are packaging Logstash
	 with Elasticsearch 1.5.2 binaries which by default disables the
	 ability to run scripts. This also affects users who are using the
	 configuration option embedded=&gt;true in the Elasticsearch output
	 which starts a local embedded Elasticsearch cluster. This is
	 typically used in development environment and proof of concept
	 deployments. Regardless of this vulnerability, we strongly recommend
	 not using embedded in production.
	 Note that users of transport and http protocol are not vulnerable
	 to this attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3120</cvename>
 <bid>67731</bid>
 <url>https://www.elastic.co/community/security</url>
 <url>https://www.elastic.co/blog/elasticsearch-1-2-0-released</url>
 <url>https://www.elastic.co/blog/logstash-1-4-3-released</url>
 <url>https://www.exploit-db.com/exploits/33370/</url>
 <url>http://bouk.co/blog/elasticsearch-rce/</url>
 <url>http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce</url>
 <url>https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch</url>
 </references>
 <dates>
 <discovery>2014-05-22</discovery>
 <entry>2015-06-26</entry>
 </dates>
 </vuln>

<vuln vid="24bde04f-1a10-11e5-b43d-002590263bf5">
 <topic>logstash -- Directory traversal vulnerability in the file output plugin</topic>
 <affects>
 <package>
	<name>logstash</name>
	<range><lt>1.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Elastic reports:
	<blockquote cite="https://www.elastic.co/blog/logstash-1-4-3-released">
	 An attacker could use the File output plugin with dynamic field
	 references in the path option to traverse paths outside of Logstash
	 directory. This technique could also be used to overwrite any files
	 which can be accessed with permissions associated with Logstash
	 user. This release sandboxes the paths which can be traversed using
	 the configuration. We have also disallowed use of dynamic field
	 references if the path options is pointing to an absolute path.
	 We have added this vulnerability to our CVE page and are working
	 on filling out the CVE. We would like to thank Colin Coghill for
	 reporting the issue and working with us on the resolution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4152</cvename>
 <url>https://www.elastic.co/blog/logstash-1-4-3-released</url>
 <url>https://www.elastic.co/community/security</url>
 </references>
 <dates>
 <discovery>2015-06-09</discovery>
 <entry>2015-06-24</entry>
 </dates>
 </vuln>

<vuln vid="2184ccad-1a10-11e5-b43d-002590263bf5">
 <topic>logstash -- Remote command execution in Logstash zabbix and nagios_nsca outputs</topic>
 <affects>
 <package>
	<name>logstash</name>
	<range><lt>1.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Elastic reports:
	<blockquote cite="https://www.elastic.co/blog/logstash-1-4-2">
	 The vulnerability impacts deployments that use the either the
	 zabbix or the nagios_nsca outputs. In these cases, an attacker
	 with an ability to send crafted events to any source of data for
	 Logstash could execute operating system commands with the
	 permissions of the Logstash process.
	 Deployments that do not use the zabbix or the nagios_nsca outputs
	 are not vulnerable and do not need to upgrade for this reason.
	 We have added this vulnerability to our CVE page and are working
	 on filling out the CVE.
	 We would like to thank Jan Karwowski and Danila Borisiuk for
	 reporting the issue and working with us on the resolution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-4326</cvename>
 <url>https://www.elastic.co/blog/logstash-1-4-2</url>
 <url>https://www.elastic.co/community/security</url>
 </references>
 <dates>
 <discovery>2014-06-24</discovery>
 <entry>2015-06-24</entry>
 </dates>
 </vuln>

<vuln vid="ad4d3871-1a0d-11e5-b43d-002590263bf5">
 <topic>logstash-forwarder and logstash -- susceptibility to POODLE vulnerability</topic>
 <affects>
 <package>
	<name>logstash-forwarder</name>
	<range><lt>0.4.0.20150507</lt></range>
 </package>
 <package>
	<name>logstash</name>
	<range><lt>1.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Elastic reports:
	<blockquote cite="https://www.elastic.co/blog/logstash-1-4-3-released">
	 The combination of Logstash Forwarder and Lumberjack input (and
	 output) was vulnerable to the POODLE attack in SSLv3 protocol. We
	 have disabled SSLv3 for this combination and set the minimum version
	 to be TLSv1.0. We have added this vulnerability to our CVE page and
	 are working on filling out the CVE.
	 Thanks to Tray Torrance, Marc Chadwick, and David Arena for
	 reporting this.
	</blockquote>
	<blockquote cite="https://www.elastic.co/blog/logstash-forwarder-0-4-0-released">
	 SSLv3 is no longer supported; TLS 1.0+ is required (compatible
	 with Logstash 1.4.2+).
	</blockquote>
 </body>
 </description>
 <references>
 
 <freebsdpr>ports/201065</freebsdpr>
 <freebsdpr>ports/201065</freebsdpr>
 <url>https://www.elastic.co/blog/logstash-1-4-3-released</url>
 <url>https://www.elastic.co/blog/logstash-forwarder-0-4-0-released</url>
 </references>
 <dates>
 <discovery>2015-06-09</discovery>
 <entry>2015-06-24</entry>
 <modified>2015-06-24</modified>
 </dates>
 </vuln>

<vuln vid="d02f6b01-1a3f-11e5-8bd6-c485083ca99c">
 <topic>Adobe Flash Player -- critical vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<range><lt>11.2r202.466</lt></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.466</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-14.html">
	 
	 Adobe has released security updates for Adobe Flash Player for
	 Windows, Macintosh and Linux. These updates address a critical
	 vulnerability (CVE-2015-3113) that could potentially allow an
	 attacker to take control of the affected system.
	 
	 
	 Adobe is aware of reports that CVE-2015-3113 is being actively
	 exploited in the wild via limited, targeted attacks. Systems running
	 Internet Explorer for Windows 7 and below, as well as Firefox on
	 Windows XP, are known targets.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb15-14.html</url>
 <cvename>CVE-2015-3113</cvename>
 </references>
 <dates>
 <discovery>2015-06-23</discovery>
 <entry>2015-06-24</entry>
 </dates>
 </vuln>

<vuln vid="f5225b23-192d-11e5-a1cf-002590263bf5">
 <topic>rubygem-bson -- DoS and possible injection</topic>
 <affects>
 <package>
	<name>rubygem-bson</name>
	<range><lt>3.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Phill MV reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2015/06/06/1">
	 By submitting a specially crafted string to a service relying on
	 the bson rubygem, an attacker may trigger denials of service or even
	 inject data into victim's MongoDB instances.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4412</cvename>
 <mlist>http://www.openwall.com/lists/oss-security/2015/06/06/1</mlist>
 <url>http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html</url>
 <url>https://github.com/mongodb/bson-ruby/commit/976da329ff03ecdfca3030eb6efe3c85e6db9999</url>
 </references>
 <dates>
 <discovery>2015-06-04</discovery>
 <entry>2015-06-23</entry>
 </dates>
 </vuln>

<vuln vid="cdff0af2-1492-11e5-a1cf-002590263bf5">
 <topic>php5 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5-dom</name>
	<name>php5-ftp</name>
	<name>php5-gd</name>
	<name>php5-pgsql</name>
	<range><lt>5.4.42</lt></range>
 </package>
 <package>
	<name>php55-dom</name>
	<name>php55-ftp</name>
	<name>php55-gd</name>
	<name>php55-pgsql</name>
	<range><lt>5.5.26</lt></range>
 </package>
 <package>
	<name>php56-dom</name>
	<name>php56-ftp</name>
	<name>php56-gd</name>
	<name>php56-psql</name>
	<range><lt>5.6.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP project reports:
	<blockquote cite="http://www.php.net/ChangeLog-5.php">
	 DOM and GD:
	 <ul>
	 <li>Fixed bug #69719 (Incorrect handling of paths with NULs).</li>
	 </ul>
	 FTP:
	 <ul>
	 <li>Improved fix for bug #69545 (Integer overflow in ftp_genlist()
	 resulting in heap overflow). (CVE-2015-4643)</li>
	 </ul>
	 Postgres:
	 <ul>
	 <li>Fixed bug #69667 (segfault in php_pgsql_meta_data).
	 (CVE-2015-4644)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4643</cvename>
 <cvename>CVE-2015-4644</cvename>
 <url>http://www.php.net/ChangeLog-5.php#5.4.42</url>
 <url>http://www.php.net/ChangeLog-5.php#5.5.26</url>
 <url>http://www.php.net/ChangeLog-5.php#5.6.10</url>
 <mlist>http://openwall.com/lists/oss-security/2015/06/18/3</mlist>
 </references>
 <dates>
 <discovery>2015-06-11</discovery>
 <entry>2015-06-23</entry>
 </dates>
 </vuln>

<vuln vid="a4460ac7-192c-11e5-9c01-bcaec55be5e5">
 <topic>devel/ipython -- remote execution</topic>
 <affects>
 <package>
	<name>ipython</name>
	<range><lt>3.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kyle Kelley reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q2/779">
	 Summary: JSON error responses from the IPython notebook REST API
	 contained URL parameters and were incorrectly reported as text/html
	 instead of application/json. The error messages included some of these
	 URL params, resulting in a cross site scripting attack. This affects
	 users on Mozilla Firefox but not Chromium/Google Chrome.
	 API paths with issues:
	 <ul>
	 <li>/api/contents (3.0-3.1)</li>
	 <li>/api/notebooks (2.0-2.4, 3.0-3.1)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4706</cvename>
 <cvename>CVE-2015-4707</cvename>
 <url>http://seclists.org/oss-sec/2015/q2/779</url>
 </references>
 <dates>
 <discovery>2015-06-22</discovery>
 <entry>2015-06-22</entry>
 </dates>
 </vuln>

<vuln vid="d46ed7b8-1912-11e5-9fdf-00262d5ed8ee">
 <topic>www/chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>43.0.2357.130</lt></range>
 </package>
 <package>
	
	<name>chromium-npapi</name>
	<range><lt>43.0.2357.130</lt></range>
 </package>
 <package>
	
	<name>chromium-pulse</name>
	<range><lt>43.0.2357.130</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html">
	 4 security fixes in this release:
	 <ul>
	 <li>[464922] High CVE-2015-1266: Scheme validation error in WebUI.
	 Credit to anonymous.</li>
	 <li>[494640] High CVE-2015-1268: Cross-origin bypass in Blink.
	 Credit to Mariusz Mlynski.</li>
	 <li>[497507] Medium CVE-2015-1267: Cross-origin bypass in Blink.
	 Credit to anonymous.</li>
	 <li>[461481] Medium CVE-2015-1269: Normalization error in HSTS/HPKP
	 preload list. Credit to Mike Ruddy.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1266</cvename>
 <cvename>CVE-2015-1267</cvename>
 <cvename>CVE-2015-1268</cvename>
 <cvename>CVE-2015-1269</cvename>
 <url>http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html</url>
 </references>
 <dates>
 <discovery>2015-06-22</discovery>
 <entry>2015-06-22</entry>
 </dates>
 </vuln>

<vuln vid="0f154810-16e4-11e5-a1cf-002590263bf5">
 <topic>rubygem-paperclip -- validation bypass vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-paperclip</name>
	<range><lt>4.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jon Yurek reports:
	<blockquote cite="https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57">
	 Thanks to MORI Shingo of DeNA Co., Ltd. for reporting this.
	 There is an issue where if an HTML file is uploaded with a .html
	 extension, but the content type is listed as being `image/jpeg`,
	 this will bypass a validation checking for images. But it will also
	 pass the spoof check, because a file named .html and containing
	 actual HTML passes the spoof check.
	 This change makes it so that we also check the supplied content
	 type. So even if the file contains HTML and ends with .html, it
	 doesn't match the content type of `image/jpeg` and so it fails.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2963</cvename>
 <url>https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57</url>
 <url>https://robots.thoughtbot.com/paperclip-security-release</url>
 <url>http://jvn.jp/en/jp/JVN83881261/index.html</url>
 </references>
 <dates>
 <discovery>2015-06-05</discovery>
 <entry>2015-06-22</entry>
 </dates>
 </vuln>

<vuln vid="0da404ad-1891-11e5-a1cf-002590263bf5">
 <topic>chicken -- Potential buffer overrun in string-translate*</topic>
 <affects>
 <package>
	<name>chicken</name>
	<range><lt>4.10.0.r2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	chicken developer Peter Bex reports:
	<blockquote cite="http://lists.nongnu.org/archive/html/chicken-announce/2015-06/msg00010.html">
	 Using gcc's Address Sanitizer, it was discovered that the string-translate*
	 procedure from the data-structures unit can scan beyond the input string's
	 length up to the length of the source strings in the map that's passed to
	 string-translate*.	This issue was fixed in master 8a46020, and it will
	 make its way into CHICKEN 4.10.
	 This bug is present in all released versions of CHICKEN.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4556</cvename>
 <freebsdpr>ports/200980</freebsdpr>
 <mlist>http://lists.nongnu.org/archive/html/chicken-announce/2015-06/msg00010.html</mlist>
 <mlist>http://lists.nongnu.org/archive/html/chicken-hackers/2015-06/msg00037.html</mlist>
 <mlist>http://lists.nongnu.org/archive/html/chicken-announce/2015-07/msg00001.html</mlist>
 </references>
 <dates>
 <discovery>2015-06-15</discovery>
 <entry>2015-06-22</entry>
 <modified>2015-07-31</modified>
 </dates>
 </vuln>

<vuln vid="e7b7f2b5-177a-11e5-ad33-f8d111029e6a">
 <topic>chicken -- buffer overrun in substring-index[-ci]</topic>
 <affects>
 <package>
	<name>chicken</name>
	<range><lt>4.10.0.r1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	chicken developer Moritz Heidkamp reports:
	<blockquote cite="http://lists.gnu.org/archive/html/chicken-users/2015-01/msg00048.html">
	 The substring-index[-ci] procedures of the data-structures unit are
	 vulnerable to a buffer overrun attack when passed an integer greater
	 than zero as the optional START argument.
	 As a work-around you can switch to SRFI 13's
	 string-contains procedure which also returns the substring's index in
	 case it is found.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-9651</cvename>
 <mlist>http://lists.gnu.org/archive/html/chicken-users/2015-01/msg00048.html</mlist>
 <mlist>http://lists.nongnu.org/archive/html/chicken-hackers/2014-12/txt2UqAS9CtvH.txt</mlist>
 </references>
 <dates>
 <discovery>2015-01-12</discovery>
 <entry>2015-06-22</entry>
 <modified>2015-06-23</modified>
 </dates>
 </vuln>

<vuln vid="a3929112-181b-11e5-a1cf-002590263bf5">
 <topic>cacti -- Multiple XSS and SQL injection vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>0.8.8d</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Cacti Group, Inc. reports:
	<blockquote cite="http://www.cacti.net/release_notes_0_8_8d.php">
	 Important Security Fixes
	 <ul>
	 <li>Multiple XSS and SQL injection vulnerabilities</li>
	 </ul>
	 Changelog
	 <ul>
	 <li>bug: Fixed SQL injection VN: JVN#78187936 /
	 TN:JPCERT#98968540</li>
	 <li>bug#0002542: [FG-VD-15-017] Cacti Cross-Site Scripting
	 Vulnerability Notification</li>
	 <li>bug#0002571: SQL Injection and Location header injection from
	 cdef id CVE-2015-4342</li>
	 <li>bug#0002572: SQL injection in graph template</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4342</cvename>
 <freebsdpr>ports/200963</freebsdpr>
 <url>http://www.cacti.net/release_notes_0_8_8d.php</url>
 <mlist>http://seclists.org/fulldisclosure/2015/Jun/19</mlist>
 </references>
 <dates>
 <discovery>2015-06-09</discovery>
 <entry>2015-06-21</entry>
 </dates>
 </vuln>

<vuln vid="a0e74731-181b-11e5-a1cf-002590263bf5">
 <topic>cacti -- multiple security vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>0.8.8c</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Cacti Group, Inc. reports:
	<blockquote cite="http://www.cacti.net/release_notes_0_8_8c.php">
	 Important Security Fixes
	 <ul>
	 <li>CVE-2013-5588 - XSS issue via installer or device editing</li>
	 <li>CVE-2013-5589 - SQL injection vulnerability in device editing</li>
	 <li>CVE-2014-2326 - XSS issue via CDEF editing</li>
	 <li>CVE-2014-2327 - Cross-site request forgery (CSRF) vulnerability</li>
	 <li>CVE-2014-2328 - Remote Command Execution Vulnerability in graph export</li>
	 <li>CVE-2014-4002 - XSS issues in multiple files</li>
	 <li>CVE-2014-5025 - XSS issue via data source editing</li>
	 <li>CVE-2014-5026 - XSS issues in multiple files</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-5588</cvename>
 <cvename>CVE-2013-5589</cvename>
 <cvename>CVE-2014-2326</cvename>
 <cvename>CVE-2014-2327</cvename>
 <cvename>CVE-2014-2328</cvename>
 <cvename>CVE-2014-4002</cvename>
 <cvename>CVE-2014-5025</cvename>
 <cvename>CVE-2014-5026</cvename>
 <freebsdpr>ports/198586</freebsdpr>
 <mlist>http://sourceforge.net/p/cacti/mailman/message/33072838/</mlist>
 <url>http://www.cacti.net/release_notes_0_8_8c.php</url>
 </references>
 <dates>
 <discovery>2014-11-23</discovery>
 <entry>2015-06-21</entry>
 </dates>
 </vuln>

<vuln vid="968d1e74-1740-11e5-a643-40a8f0757fb4">
 <topic>p5-Dancer -- possible to abuse session cookie values</topic>
 <affects>
 <package>
	<name>p5-Dancer</name>
	<range><lt>1.3138</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Russell Jenkins reports:
	<blockquote cite="INSERT URL HERE">
	 It was possible to abuse session cookie values so that
	 file-based session stores such as Dancer::Session::YAML or
	 Dancer2::Session::YAML would attempt to read/write from
	 any file on the filesystem with the same extension the
	 file-based store uses, such as '*.yml' for the YAML
	 stores.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.preshweb.co.uk/pipermail/dancer-users/2015-June/004621.html</url>
 </references>
 <dates>
 <discovery>2015-06-12</discovery>
 <entry>2015-06-20</entry>
 </dates>
 </vuln>

<vuln vid="d605edb1-1616-11e5-a000-d050996490d0">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal6</name>
	<range><lt>6.36</lt></range>
 </package>
 <package>
	<name>drupal7</name>
	<range><lt>7.38</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal development team reports:
	<blockquote cite="https://www.drupal.org/SA-CORE-2015-002">
	 <h3>Impersonation (OpenID module - Drupal 6 and 7 - Critical)</h3>
	 A vulnerability was found in the OpenID module that allows
	 a malicious user to log in as other users on the site,
	 including administrators, and hijack their accounts.
	 This vulnerability is mitigated by the fact that the victim
	 must have an account with an associated OpenID identity from
	 a particular set of OpenID providers (including, but not
	 limited to, Verisign, LiveJournal, or StackExchange).
	 <h3>Open redirect (Field UI module - Drupal 7 - Less critical)</h3>
	 The Field UI module uses a "destinations" query string parameter
	 in URLs to redirect users to new destinations after completing
	 an action on a few administration pages. Under certain
	 circumstances, malicious users can use this parameter to
	 construct a URL that will trick users into being redirected
	 to a 3rd party website, thereby exposing the users to potential
	 social engineering attacks.
	 This vulnerability is mitigated by the fact that only sites
	 with the Field UI module enabled are affected.
	 Drupal 6 core is not affected, but see the similar advisory
	 for the Drupal 6 contributed CCK module:
	 <a href="https://www.drupal.org/node/2507753">SA-CONTRIB-2015-126</a>
	 <h3>Open redirect (Overlay module - Drupal 7 - Less critical)</h3>
	 The Overlay module displays administrative pages as a layer
	 over the current page (using JavaScript), rather than replacing
	 the page in the browser window. The Overlay module does not
	 sufficiently validate URLs prior to displaying their contents,
	 leading to an open redirect vulnerability.
	 This vulnerability is mitigated by the fact that it can only
	 be used against site users who have the "Access the administrative
	 overlay" permission, and that the Overlay module must be enabled.
	 <h3>Information disclosure (Render cache system - Drupal 7
	 - Less critical)</h3>
	 On sites utilizing Drupal 7's render cache system to cache
	 content on the site by user role, private content viewed by
	 user 1 may be included in the cache and exposed to non-privileged
	 users.
	 This vulnerability is mitigated by the fact that render caching
	 is not used in Drupal 7 core itself (it requires custom code or
	 the contributed <a href="https://www.drupal.org/project/render_cache">Render
	 Cache</a> module to enable) and that it only affects sites that
	 have user 1 browsing the live site. Exposure is also limited if an
	 administrative role has been assigned to the user 1 account (which
	 is done, for example, by the Standard install profile that ships
	 with Drupal core).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3231</cvename>
 <cvename>CVE-2015-3232</cvename>
 <cvename>CVE-2015-3233</cvename>
 <cvename>CVE-2015-3234</cvename>
 <url>https://www.drupal.org/SA-CORE-2015-002</url>
 </references>
 <dates>
 <discovery>2015-06-17</discovery>
 <entry>2015-06-19</entry>
 </dates>
 </vuln>

<vuln vid="2438d4af-1538-11e5-a106-3c970e169bc2">
 <topic>cURL -- Multiple Vulnerability</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.40</ge><lt>7.43</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cURL reports:
	<blockquote cite="http://curl.haxx.se/docs/adv_20150617A.html">
	 libcurl can wrongly send HTTP credentials when re-using
	 connections.
	 libcurl allows applications to set credentials for the
	 upcoming transfer with HTTP Basic authentication, like
	 with CURLOPT_USERPWD for example. Name and password.
	 Just like all other libcurl options the credentials
	 are sticky and are kept associated with the "handle"
	 until something is made to change the situation.
	 Further, libcurl offers a curl_easy_reset() function
	 that resets a handle back to its pristine state in
	 terms of all settable options. A reset is of course
	 also supposed to clear the credentials. A reset is
	 typically used to clear up the handle and prepare
	 it for a new, possibly unrelated, transfer.
	 Within such a handle, libcurl can also store a
	 set of previous connections in case a second transfer
	 is requested to a host name for which an existing
	 connection is already kept alive.
	 With this flaw present, using the handle even
	 after a reset would make libcurl accidentally use
	 those credentials in a subsequent request if done
	 to the same host name and connection as was
	 previously accessed.
	 An example case would be first requesting a password
	 protected resource from one section of a web site, and
	 then do a second request of a public resource from a
	 completely different part of the site without
	 authentication. This flaw would then inadvertently
	 leak the credentials in the second request.
	</blockquote>
	<blockquote cite="http://curl.haxx.se/docs/adv_20150617B.html">
	 libcurl can get tricked by a malicious SMB server to
	 send off data it did not intend to.
	 In libcurl's state machine function handling the SMB
	 protocol (smb_request_state()), two length and offset
	 values are extracted from data that has arrived over
	 the network, and those values are subsequently used
	 to figure out what data range to send back.
	 The values are used and trusted without boundary
	 checks and are just assumed to be valid. This allows
	 carefully handcrafted packages to trick libcurl
	 into responding and sending off data that was not
	 intended. Or just crash if the values cause libcurl
	 to access invalid memory.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3236</cvename>
 <cvename>CVE-2015-3237</cvename>
 <url>http://curl.haxx.se/docs/adv_20150617A.html</url>
 <url>http://curl.haxx.se/docs/adv_20150617B.html</url>
 </references>
 <dates>
 <discovery>2015-06-17</discovery>
 <entry>2015-06-17</entry>
 </dates>
 </vuln>

<vuln vid="eb8a8978-8dd5-49ce-87f4-49667b2166dd">
 <topic>rubygem-rails -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-activesupport</name>
	<range><lt>3.2.22</lt></range>
 </package>
 <package>
	<name>rubygem-activesupport4</name>
	<range><lt>4.2.2</lt></range>
 </package>
 <package>
	<name>rubygem-jquery-rails</name>
	<range><lt>3.1.3</lt></range>
 </package>
 <package>
	<name>rubygem-jquery-rails4</name>
	<range><lt>4.0.4</lt></range>
 </package>
 <package>
	<name>rubygem-rack</name>
	<range><lt>1.4.6</lt></range>
 </package>
 <package>
	<name>rubygem-rack15</name>
	<range><lt>1.5.4</lt></range>
 </package>
 <package>
	<name>rubygem-rack16</name>
	<range><lt>1.6.2</lt></range>
 </package>
 <package>
	<name>rubygem-rails</name>
	<range><lt>3.2.22</lt></range>
 </package>
 <package>
	<name>rubygem-rails4</name>
	<range><lt>4.2.2</lt></range>
 </package>
 <package>
	<name>rubygem-web-console</name>
	<range><lt>2.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails blog:
	<blockquote cite="http://weblog.rubyonrails.org/2015/6/16/Rails-3-2-22-4-1-11-and-4-2-2-have-been-released-and-more/">
	 Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web
	 console and jquery-rails plugins and Rack 1.5.4 and 1.6.2.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1840</cvename>
 <cvename>CVE-2015-3224</cvename>
 <cvename>CVE-2015-3225</cvename>
 <cvename>CVE-2015-3226</cvename>
 <cvename>CVE-2015-3227</cvename>
 <url>http://weblog.rubyonrails.org/2015/6/16/Rails-3-2-22-4-1-11-and-4-2-2-have-been-released-and-more/</url>
 </references>
 <dates>
 <discovery>2015-06-16</discovery>
 <entry>2015-06-17</entry>
 </dates>
 </vuln>

<vuln vid="c67069dc-0986-11e5-bb90-002590263bf5">
 <topic>testdisk -- buffer overflow with malicious disk image</topic>
 <affects>
 <package>
	<name>testdisk</name>
	<range><lt>7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CGSecurity TestDisk Changelog reports:
	<blockquote cite="http://www.cgsecurity.org/wiki/TestDisk_7.0_Release">
	 Various fix including security fix, thanks to:
	 <ul>
	 <li>Coverity scan (Static Analysis of source code)</li>
	 <li>afl-fuzz (security-oriented fuzzer).</li>
	 <li>Denis Andzakovic from Security Assessment for reporting an
	 exploitable Stack Buffer Overflow.</li>
	 </ul>
	</blockquote>
	Denis Andzakovic reports:
	<blockquote cite="http://www.security-assessment.com/files/documents/advisory/Testdisk%20Check_OS2MB%20Stack%20Buffer%20Overflow%20-%20Release.pdf">
	 A buffer overflow is triggered within the software when a malicious
	 disk image is attempted to be recovered. This may be leveraged by an
	 attacker to crash TestDisk and gain control of program execution. An
	 attacker would have to coerce the victim to run TestDisk against
	 their malicious image.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.cgsecurity.org/wiki/TestDisk_7.0_Release</url>
 <url>http://www.security-assessment.com/files/documents/advisory/Testdisk%20Check_OS2MB%20Stack%20Buffer%20Overflow%20-%20Release.pdf</url>
 </references>
 <dates>
 <discovery>2015-04-30</discovery>
 <entry>2015-06-16</entry>
 </dates>
 </vuln>

<vuln vid="25e0593d-13c0-11e5-9afb-3c970e169bc2">
 <topic>tomcat -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><lt>6.0.44</lt></range>
 </package>
 <package>
	<name>tomcat7</name>
	<range><lt>7.0.55</lt></range>
 </package>
 <package>
	<name>tomcat8</name>
	<range><lt>8.0.9</lt></range>
 </package>
 <package>
	<name>hadoop2</name>
	<range><le>2.6.0</le></range>
 </package>
 <package>
	<name>oozie</name>
	<range><le>4.1.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache Software Foundation reports:
	<blockquote cite="https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44">
	 Low: Denial of Service CVE-2014-0230
	 When a response for a request with a request body is
	 returned to the user agent before the request body is
	 fully read, by default Tomcat swallows the remaining
	 request body so that the next request on the connection
	 may be processed. There was no limit to the size of
	 request body that Tomcat would swallow. This permitted
	 a limited Denial of Service as Tomcat would never close
	 the connection and a processing thread would remain
	 allocated to the connection.
	 Moderate: Security Manager bypass CVE-2014-7810
	 Malicious web applications could use expression
	 language to bypass the protections of a Security
	 Manager as expressions were evaluated within a
	 privileged code section.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0230</cvename>
 <cvename>CVE-2014-7810</cvename>
 <url>https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44</url>
 </references>
 <dates>
 <discovery>2015-05-12</discovery>
 <entry>2015-06-16</entry>
 <modified>2017-03-18</modified>
 </dates>
 </vuln>

<vuln vid="c470db07-1098-11e5-b6a8-002590263bf5">
 <topic>security/ossec-hids-* -- root escalation via syscheck feature</topic>
 <affects>
 <package>
	<name>ossec-hids-server</name>
	<name>ossec-hids-client</name>
	<name>ossec-hids-local</name>
	<range><ge>2.7</ge><lt>2.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OSSEC reports:
	<blockquote cite="http://www.ossec.net/?p=1198">
	 The CVE-2015-3222 vulnerability, which allows for root escalation
	 via sys check has been fixed in OSSEC 2.8.2. This issue does not
	 affect agents.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3222</cvename>
 <freebsdpr>ports/200801</freebsdpr>
 <url>http://www.ossec.net/?p=1198</url>
 <url>https://github.com/ossec/ossec-hids/releases/tag/2.8.2</url>
 </references>
 <dates>
 <discovery>2015-06-11</discovery>
 <entry>2015-06-12</entry>
 </dates>
 </vuln>

<vuln vid="8305e215-1080-11e5-8ba2-000c2980a9f3">
 <topic>openssl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.2_2</lt></range>
 </package>
 <package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.2b</lt></range>
 </package>
 <package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_6</lt></range>
 </package>
 <package>
	<name>libressl</name>
	<range><lt>2.1.7</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_12</lt></range>
	<range><ge>9.3</ge><lt>9.3_16</lt></range>
	<range><ge>8.4</ge><lt>8.4_30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL team reports:
	<blockquote cite="https://www.openssl.org/news/secadv_20150611.txt">
	 <ul>
	 <li>Missing DHE man-in-the-middle protection (Logjam)
	 (CVE-2015-4000)</li>
	 <li>Malformed ECParameters causes infinite loop (CVE-2015-1788)</li>
	 <li>Exploitable out-of-bounds read in X509_cmp_time
	 (CVE-2015-1789)</li>
	 <li>PKCS#7 crash with missing EnvelopedContent (CVE-2015-1790)</li>
	 <li>CMS verify infinite loop with unknown hash function
	 (CVE-2015-1792)</li>
	 <li>Race condition handling NewSessionTicket (CVE-2015-1791)</li>
	 <li>Invalid free in DTLS (CVE-2014-8176)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8176</cvename>
 <cvename>CVE-2015-1788</cvename>
 <cvename>CVE-2015-1789</cvename>
 <cvename>CVE-2015-1790</cvename>
 <cvename>CVE-2015-1791</cvename>
 <cvename>CVE-2015-1792</cvename>
 <cvename>CVE-2015-4000</cvename>
 <freebsdsa>SA-15:10.openssl</freebsdsa>
 <url>https://www.openssl.org/news/secadv_20150611.txt</url>
 </references>
 <dates>
 <discovery>2015-06-11</discovery>
 <entry>2015-06-11</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="1e63db88-1050-11e5-a4df-c485083ca99c">
 <topic>Adobe Flash Player -- critical vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<range><lt>11.2r202.466</lt></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.466</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-11.html">
	 
	 Adobe has released security updates for Adobe Flash Player for
	 Windows, Macintosh and Linux. These updates address vulnerabilities
	 that could potentially allow an attacker to take control of the
	 affected system.
	 
	 
	 These updates resolve a vulnerability (CVE-2015-3096) that could be
	 exploited to bypass the fix for CVE-2014-5333.
	 
	 
	 These updates improve memory address randomization of the Flash heap
	 for the Window 7 64-bit platform (CVE-2015-3097).
	 
	 
	 These updates resolve vulnerabilities that could be exploited to
	 bypass the same-origin-policy and lead to information disclosure
	 (CVE-2015-3098, CVE-2015-3099, CVE-2015-3102).
	 
	 
	 These updates resolve a stack overflow vulnerability that could lead
	 to code execution (CVE-2015-3100).
	 
	 
	 These updates resolve a permission issue in the Flash broker for
	 Internet Explorer that could be exploited to perform privilege
	 escalation from low to medium integrity level (CVE-2015-3101).
	 
	 
	 These updates resolve an integer overflow vulnerability that could
	 lead to code execution (CVE-2015-3104).
	 
	 
	 These updates resolve a memory corruption vulnerability that could
	 lead to code execution (CVE-2015-3105).
	 
	 
	 These updates resolve use-after-free vulnerabilities that could lead
	 to code execution (CVE-2015-3103, CVE-2015-3106, CVE-2015-3107).
	 
	 
	 These updates resolve a memory leak vulnerability that could be used
	 to bypass ASLR (CVE-2015-3108).
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb15-11.html</url>
 <cvename>CVE-2015-3096</cvename>
 <cvename>CVE-2015-3097</cvename>
 <cvename>CVE-2015-3098</cvename>
 <cvename>CVE-2015-3099</cvename>
 <cvename>CVE-2015-3100</cvename>
 <cvename>CVE-2015-3101</cvename>
 <cvename>CVE-2015-3102</cvename>
 <cvename>CVE-2015-3103</cvename>
 <cvename>CVE-2015-3104</cvename>
 <cvename>CVE-2015-3105</cvename>
 <cvename>CVE-2015-3106</cvename>
 <cvename>CVE-2015-3107</cvename>
 <cvename>CVE-2015-3108</cvename>
 </references>
 <dates>
 <discovery>2015-06-09</discovery>
 <entry>2015-06-11</entry>
 </dates>
 </vuln>

<vuln vid="10a6d0aa-0b1c-11e5-bb90-002590263bf5">
 <topic>libzmq4 -- V3 protocol handler vulnerable to downgrade attacks</topic>
 <affects>
 <package>
	<name>libzmq4</name>
	<range><ge>4.0.0</ge><lt>4.0.6</lt></range>
	<range><ge>4.1.0</ge><lt>4.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pieter Hintjens reports:
	<blockquote cite="https://github.com/zeromq/libzmq/issues/1273">
	 It is easy to bypass the security mechanism in 4.1.0 and 4.0.5 by
	 sending a ZMTP v2 or earlier header. The library accepts such
	 connections without applying its security mechanism.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-9721</cvename>
 <url>https://github.com/zeromq/libzmq/issues/1273</url>
 <mlist>http://www.openwall.com/lists/oss-security/2015/05/07/8</mlist>
 <freebsdpr>ports/200502</freebsdpr>
 </references>
 <dates>
 <discovery>2014-12-04</discovery>
 <entry>2015-06-10</entry>
 <modified>2015-09-28</modified>
 </dates>
 </vuln>

<vuln vid="8fbd4187-0f18-11e5-b6a8-002590263bf5">
 <topic>pgbouncer -- remote denial of service</topic>
 <affects>
 <package>
	<name>pgbouncer</name>
	<range><lt>1.5.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PgBouncer reports:
	<blockquote cite="https://pgbouncer.github.io/2015/04/pgbouncer-1-5-5/">
	 Fix remote crash - invalid packet order causes lookup of NULL pointer. Not
	 exploitable, just DoS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4054</cvename>
 <url>https://pgbouncer.github.io/2015/04/pgbouncer-1-5-5/</url>
 <mlist>http://www.openwall.com/lists/oss-security/2015/05/21/2</mlist>
 <freebsdpr>ports/200507</freebsdpr>
 </references>
 <dates>
 <discovery>2015-04-08</discovery>
 <entry>2015-06-10</entry>
 <modified>2015-09-28</modified>
 </dates>
 </vuln>

<vuln vid="a40ec970-0efa-11e5-90e4-d050996490d0">
 <topic>cups -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cups-base</name>
	<range><lt>2.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CUPS development team reports:
	<blockquote cite="https://cups.org/blog.php?L1082">
	 The new release addresses two security vulnerabilities,
	 add localizations for German and Russian, and includes
	 several general bug fixes. Changes include:
	 Security: Fixed CERT VU #810572/CVE-2015-1158/CVE-2015-1159
	 exploiting the dynamic linker (STR #4609)
	 Security: The scheduler could hang with malformed
	 gzip data (STR #4602)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1158</cvename>
 <cvename>CVE-2015-1159</cvename>
 <url>https://cups.org/blog.php?L1082</url>
 <url>https://www.kb.cert.org/vuls/id/810572</url>
 </references>
 <dates>
 <discovery>2015-06-09</discovery>
 <entry>2015-06-09</entry>
 </dates>
 </vuln>

<vuln vid="55363e65-0e71-11e5-8027-00167671dd1d">
 <topic>strongswan -- Denial-of-service and potential remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>strongswan</name>
	<range><ge>5.2.2</ge><lt>5.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	StrongSwan Project reports
	<blockquote cite="https://www.strongswan.org/blog/2015/06/01/strongswan-vulnerability-(cve-2015-3991).html">
	 A denial-of-service and potential remote code execution vulnerability
	 triggered by crafted IKE messages was discovered in strongSwan. Versions
	 5.2.2 and 5.3.0 are affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3991</cvename>
 <url>https://www.strongswan.org/blog/2015/06/01/strongswan-vulnerability-(cve-2015-3991).html</url>
 </references>
 <dates>
 <discovery>2015-05-15</discovery>
 <entry>2015-06-09</entry>
 <modified>2015-09-28</modified>
 </dates>
 </vuln>

<vuln vid="10d14955-0e45-11e5-b6a8-002590263bf5">
 <topic>strongswan -- Information Leak Vulnerability</topic>
 <affects>
 <package>
	<name>strongswan</name>
	<range><ge>4.3.0</ge><lt>5.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	strongSwan Project reports:
	<blockquote cite="http://www.strongswan.org/blog/2015/06/08/strongswan-5.3.2-released.html">
	 An information leak vulnerability was fixed that, in certain IKEv2
	 setups, allowed rogue servers with a valid certificate accepted by
	 the client to trick it into disclosing user credentials (even plain
	 passwords if the client accepts EAP-GTC). This was caused because
	 constraints against the server's authentication were enforced too
	 late. All versions since 4.3.0 are affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4171</cvename>
 <url>http://www.strongswan.org/blog/2015/06/08/strongswan-5.3.2-released.html</url>
 </references>
 <dates>
 <discovery>2015-06-08</discovery>
 <entry>2015-06-09</entry>
 </dates>
 </vuln>

<vuln vid="838fa84a-0e25-11e5-90e4-d050996490d0">
 <topic>redis -- EVAL Lua Sandbox Escape</topic>
 <affects>
 <package>
	<name>redis</name>
	<name>redis-devel</name>
	<range><ge>2.6.0</ge><lt>2.8.21</lt></range>
	<range><ge>3.0</ge><lt>3.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ben Murphy reports:
	<blockquote cite="http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/">
	 It is possible to break out of the Lua sandbox in
	 Redis and execute arbitrary code.
	 This shouldn’t pose a threat to users under the
	 trusted Redis security model where only trusted
	 users can connect to the database. However, in real
	 deployments there could be databases that can be
	 accessed by untrusted users. The main deployments
	 that are vulnerable are developers machines, places
	 where redis servers can be reached via SSRF attacks
	 and cloud hosting.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4335</cvename>
 <url>http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/</url>
 </references>
 <dates>
 <discovery>2015-06-04</discovery>
 <entry>2015-06-08</entry>
 </dates>
 </vuln>

<vuln vid="bd1ab7a5-0e01-11e5-9976-a0f3c100ae18">
 <topic>tidy -- heap-buffer-overflow</topic>
 <affects>
 <package>
	<name>tidy4</name>
	<range><le>20000804_3</le></range>
 </package>
 <package>
	<name>tidy-devel</name>
	<range><le>090315.c_2</le></range>
 </package>
 <package>
	<name>tidy-lib</name>
	<range><le>090315.c_2</le></range>
 </package>
 <package>
	<name>tidy-html5</name>
	<range><lt>4.9.31</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Geoff McLane reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q2/633">
	 tidy is affected by a write out of bounds when processing malformed html files.
	 This issue could be abused on server side applications that use php-tidy extension with user input.
	 The issue was confirmed, analyzed, and fixed by the tidy5 maintainer.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/htacg/tidy-html5/issues/217</url>
 <url>http://seclists.org/oss-sec/2015/q2/633</url>
 <url>http://seclists.org/oss-sec/2015/q3/116</url>
 <cvename>CVE-2015-5522</cvename>
 <cvename>CVE-2015-5523</cvename>
 </references>
 <dates>
 <discovery>2015-06-03</discovery>
 <entry>2015-06-08</entry>
 <modified>2015-07-15</modified>
 </dates>
 </vuln>

<vuln vid="e69af246-0ae2-11e5-90e4-d050996490d0">
 <topic>pcre -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>pcre</name>
	<range><lt>8.37_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Venustech ADLAB reports:
	<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1636">
	 PCRE library is prone to a vulnerability which leads
	 to Heap Overflow. During the compilation of a malformed
	 regular expression, more data is written on the malloced
	 block than the expected size output by compile_regex.
	</blockquote>
	<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1638">
	 PCRE library is prone to a vulnerability which leads to
	 Stack Overflow. Without enough bound checking inside
	 match(), the stack memory could be overflowed via a
	 crafted regular expression.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3210</cvename>
 <cvename>CVE-2015-3217</cvename>
 <url>https://bugs.exim.org/show_bug.cgi?id=1636</url>
 <url>https://bugs.exim.org/show_bug.cgi?id=1638</url>
 </references>
 <dates>
 <discovery>2015-05-29</discovery>
 <entry>2015-06-04</entry>
 <modified>2015-06-07</modified>
 </dates>
 </vuln>

<vuln vid="bbc0db92-084c-11e5-bb90-002590263bf5">
 <topic>hostapd and wpa_supplicant -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>hostapd</name>
	<range><lt>2.4_1</lt></range>
 </package>
 <package>
	<name>wpa_supplicant</name>
	<range><lt>2.4_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jouni Malinen reports:
	<blockquote cite="http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt">
	 WPS UPnP vulnerability with HTTP chunked transfer encoding. (2015-2
	 - CVE-2015-4141)
	</blockquote>
	<blockquote cite="http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt">
	 Integer underflow in AP mode WMM Action frame processing. (2015-3 -
	 CVE-2015-4142)
	</blockquote>
	<blockquote cite="http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt">
	 EAP-pwd missing payload length validation. (2015-4 - CVE-2015-4143,
	 CVE-2015-4144, CVE-2015-4145, CVE-2015-4146)
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt</url>
 <url>http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt</url>
 <url>http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt</url>
 <cvename>CVE-2015-4141</cvename>
 <cvename>CVE-2015-4142</cvename>
 <cvename>CVE-2015-4143</cvename>
 <cvename>CVE-2015-4144</cvename>
 <cvename>CVE-2015-4145</cvename>
 <cvename>CVE-2015-4146</cvename>
 <mlist>http://openwall.com/lists/oss-security/2015/05/31/6</mlist>
 </references>
 <dates>
 <discovery>2015-05-04</discovery>
 <entry>2015-06-01</entry>
 </dates>
 </vuln>

<vuln vid="65b14d39-d01f-419c-b0b8-5df60b929973">
 <topic>ffmpeg -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ffmpeg</name>
	<name>ffmpeg0</name>
	<range><lt>0.7.17,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Please reference CVE/URL list for details
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5150</cvename>
 <cvename>CVE-2014-4609</cvename>
 <cvename>CVE-2014-8541</cvename>
 <cvename>CVE-2014-8542</cvename>
 <cvename>CVE-2014-8543</cvename>
 <cvename>CVE-2014-8545</cvename>
 <cvename>CVE-2014-8547</cvename>
 <cvename>CVE-2014-8548</cvename>
 <cvename>CVE-2014-9316</cvename>
 <cvename>CVE-2014-9317</cvename>
 <cvename>CVE-2014-9603</cvename>
 <cvename>CVE-2015-1872</cvename>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c3ece52decafc4923aebe7fd74b274e9ebb1962e</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=1b291e0466308b341bc2e8c2a49d44862400f014</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b5e661bcd2bb4fe771cb2c1e21215c68e6a17665</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cd3c4d8c55222337b0b59af4ea1fecfb46606e5e</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=73962e677d871fa0dde5385ee04ea07c048d8864</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=7a5590ef4282e19d48d70cba0bc4628c13ec6fd8</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ef32bc8dde52439afd13988f56012a9f4dd55a83</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5b2097626d0e4ccb432d7d8ab040aa8dbde9eb3a</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=30e8a375901f8802853fd6d478b77a127d208bd6</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cb1db92cca98f963e91f421ee0c84f8866325a73</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=fac6f744d8170585f05e098ce9c9f27eeffa818e</url>
 <url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75b0cfcf105c8720a47a2ee80a70ba16799d71b7</url>
 <url>https://ffmpeg.org/security.html</url>
 </references>
 <dates>
 <discovery>2015-03-12</discovery>
 <entry>2015-06-02</entry>
 </dates>
 </vuln>

<vuln vid="022255be-0895-11e5-a242-5404a68ad561">
 <topic>avidemux26 -- multiple vulnerabilities in bundled FFmpeg</topic>
 <affects>
 <package>
	<name>avidemux2</name>
	<range><lt>2.6.8</lt></range>
 </package>
 <package>
	<name>avidemux26</name>
	<range><lt>2.6.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mageia project reports:
	<blockquote cite="http://advisories.mageia.org/MGASA-2015-0233.html">
	 Avidemux is built with a bundled set of FFmpeg libraries.
	 The bundled FFmpeg version has been updated from 1.2.10
	 to 1.2.12 to fix these security issues and other bugs
	 fixed upstream in FFmpeg.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-9316</cvename>
 <cvename>CVE-2014-9317</cvename>
 <cvename>CVE-2014-9603</cvename>
 <cvename>CVE-2014-9604</cvename>
 <cvename>CVE-2015-1872</cvename>
 <cvename>CVE-2015-3417</cvename>
 <freebsdpr>ports/200507</freebsdpr>
 <url>http://advisories.mageia.org/MGASA-2015-0233.html</url>
 </references>
 <dates>
 <discovery>2015-05-18</discovery>
 <entry>2015-06-01</entry>
 <modified>2015-09-28</modified>
 </dates>
 </vuln>

<vuln vid="ffe2d86c-07d9-11e5-9a28-001e67150279">
 <topic>rest-client -- plaintext password disclosure</topic>
 <affects>
 <package>
	<name>rubygem-rest-client</name>
	<range><lt>1.6.7_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The open sourced vulnerability database reports:
	<blockquote cite="http://osvdb.org/show/osvdb/117461">
	 REST Client for Ruby contains a flaw that is due to the application
	 logging password information in plaintext. This may allow a local
	 attacker to gain access to password information.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3448</cvename>
 <freebsdpr>ports/200504</freebsdpr>
 <url>https://github.com/rest-client/rest-client/issues/349</url>
 <url>http://osvdb.org/show/osvdb/117461</url>
 </references>
 <dates>
 <discovery>2015-01-12</discovery>
 <entry>2015-05-31</entry>
 <modified>2015-09-28</modified>
 </dates>
 </vuln>

<vuln vid="83a7a720-07d8-11e5-9a28-001e67150279">
 <topic>rest-client -- session fixation vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-rest-client</name>
	<range><lt>1.6.7_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Andy Brody reports:
	<blockquote cite="https://github.com/rest-client/rest-client/issues/369">
	 When Ruby rest-client processes an HTTP redirection response,
	 it blindly passes along the values from any Set-Cookie headers to the
	 redirection target, regardless of domain, path, or expiration.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1820</cvename>
 <freebsdpr>ports/200504</freebsdpr>
 <url>https://github.com/rest-client/rest-client/issues/369</url>
 </references>
 <dates>
 <discovery>2015-03-24</discovery>
 <entry>2015-05-31</entry>
 <modified>2015-09-28</modified>
 </dates>
 </vuln>

<vuln vid="cfb12f02-06e1-11e5-8fda-002590263bf5">
 <topic>cabextract -- directory traversal with UTF-8 symbols in filenames</topic>
 <affects>
 <package>
	<name>cabextract</name>
	<range><lt>1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cabextract ChangeLog reports:
	<blockquote cite="http://www.cabextract.org.uk/#changes">
	 It was possible for cabinet files to extract to absolute file
	 locations, and it was possible on Cygwin to get around cabextract's
	 absolute and relative path protections by using backslashes.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.cabextract.org.uk/#changes</url>
 <mlist>http://www.openwall.com/lists/oss-security/2015/02/18/3</mlist>
 <cvename>CVE-2015-2060</cvename>
 </references>
 <dates>
 <discovery>2015-02-18</discovery>
 <entry>2015-05-31</entry>
 </dates>
 </vuln>

<vuln vid="cc7548ef-06e1-11e5-8fda-002590263bf5">
 <topic>libmspack -- frame_end overflow which could cause infinite loop</topic>
 <affects>
 <package>
	<name>libmspack</name>
	<range><lt>0.5</lt></range>
 </package>
 <package>
	<name>cabextract</name>
	<range><lt>1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	There is a denial of service vulnerability in libmspack. The
	 libmspack code is built into cabextract, so it is also
	 vulnerable.
	MITRE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9556">
	 Integer overflow in the qtmd_decompress function in libmspack 0.4
	 allows remote attackers to cause a denial of service (hang) via a
	 crafted CAB file, which triggers an infinite loop.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-9556</cvename>
 <url>https://bugs.debian.org/773041</url>
 <mlist>http://www.openwall.com/lists/oss-security/2015/01/07/2</mlist>
 </references>
 <dates>
 <discovery>2014-12-11</discovery>
 <entry>2015-05-31</entry>
 </dates>
 </vuln>

<vuln vid="48504af7-07ad-11e5-879c-00e0814cab4e">
 <topic>django -- Fixed session flushing in the cached_db backend</topic>
 <affects>
 <package>
	<name>py27-django</name>
	<range><ge>1.8</ge><lt>1.8.2</lt></range>
 </package>
 <package>
	<name>py32-django</name>
	<range><ge>1.8</ge><lt>1.8.2</lt></range>
 </package>
 <package>
	<name>py33-django</name>
	<range><ge>1.8</ge><lt>1.8.2</lt></range>
 </package>
 <package>
	<name>py34-django</name>
	<range><ge>1.8</ge><lt>1.8.2</lt></range>
 </package>
 <package>
	<name>py27-django-devel</name>
	<range><lt>20150531,1</lt></range>
 </package>
 <package>
	<name>py32-django-devel</name>
	<range><lt>20150531,1</lt></range>
 </package>
 <package>
	<name>py33-django-devel</name>
	<range><lt>20150531,1</lt></range>
 </package>
 <package>
	<name>py34-django-devel</name>
	<range><lt>20150531,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Django project reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2015/may/20/security-release/">
	 A change to session.flush() in the cached_db session backend in
	 Django 1.8 mistakenly sets the session key to an empty string
	 rather than None. An empty string is treated as a valid session key
	 and the session cookie is set accordingly. Any users with an empty
	 string in their session cookie will use the same session store.
	 session.flush() is called by django.contrib.auth.logout() and, more
	 seriously, by django.contrib.auth.login() when a user switches accounts.
	 If a user is logged in and logs in again to a different account
	 (without logging out) the session is flushed to avoid reuse.
	 After the session is flushed (and its session key becomes '') the
	 account details are set on the session and the session is saved.
	 Any users with an empty string in their session cookie will now be
	 logged into that account.
	 Thanks to Sam Cooke for reporting the issue.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2015/may/20/security-release/</url>
 <cvename>CVE-2015-3982</cvename>
 </references>
 <dates>
 <discovery>2015-05-20</discovery>
 <entry>2015-05-31</entry>
 </dates>
 </vuln>

<vuln vid="9471ec47-05a2-11e5-8fda-002590263bf5">
 <topic>proxychains-ng -- current path as the first directory for the library search path</topic>
 <affects>
 <package>
	<name>proxychains-ng</name>
	<range><lt>4.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mamoru TASAKA reports:
	<blockquote cite="http://seclists.org/oss-sec/2015/q2/430">
	 proxychains4 sets LD_PRELOAD to dlopen libproxychains4.so
	 and execvp() the arbitrary command user has specified.
	 proxychains4 sets the current directory as the first path
	 to search libproxychains4.so
	</blockquote>
 </body>
 </description>
 <references>
 <mlist>http://openwall.com/lists/oss-security/2015/05/12/6</mlist>
 <mlist>http://seclists.org/oss-sec/2015/q2/430</mlist>
 <cvename>CVE-2015-3887</cvename>
 </references>
 <dates>
 <discovery>2015-05-11</discovery>
 <entry>2015-05-29</entry>
 </dates>
 </vuln>

<vuln vid="a13500d0-0570-11e5-aab1-d050996490d0">
 <topic>wireshark -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>tshark</name>
	<name>tshark-lite</name>
	<range><lt>1.12.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wireshark development team reports:
	<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.5.html">
	 The following vulnerabilities have been fixed.
	 <ul>
	 <li>wnpa-sec-2015-12
	 The LBMR dissector could go into an infinite loop.
		(Bug 11036) CVE-2015-3808, CVE-2015-3809</li>
	 <li>wnpa-sec-2015-13
	 The WebSocket dissector could recurse excessively.
		(Bug 10989) CVE-2015-3810</li>
	 <li>wnpa-sec-2015-14
	 The WCP dissector could crash while decompressing data.
		(Bug 10978) CVE-2015-3811</li>
	 <li>wnpa-sec-2015-15
	 The X11 dissector could leak memory. (Bug 11088)
		CVE-2015-3812</li>
	 <li>wnpa-sec-2015-16
	 The packet reassembly code could leak memory.
		(Bug 11129) CVE-2015-3813</li>
	 <li>wnpa-sec-2015-17
	 The IEEE 802.11 dissector could go into an infinite loop.
		(Bug 11110) CVE-2015-3814</li>
	 <li>wnpa-sec-2015-18
	 The Android Logcat file parser could crash. Discovered by
		Hanno Böck. (Bug 11188) CVE-2015-3815</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3808</cvename>
 <cvename>CVE-2015-3809</cvename>
 <cvename>CVE-2015-3810</cvename>
 <cvename>CVE-2015-3811</cvename>
 <cvename>CVE-2015-3812</cvename>
 <cvename>CVE-2015-3813</cvename>
 <cvename>CVE-2015-3814</cvename>
 <cvename>CVE-2015-3815</cvename>
 <url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.5.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2015-12.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2015-13.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2015-14.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2015-15.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2015-16.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2015-17.html</url>
 <url>https://www.wireshark.org/security/wnpa-sec-2015-18.html</url>
 </references>
 <dates>
 <discovery>2015-05-12</discovery>
 <entry>2015-05-28</entry>
 </dates>
 </vuln>

<vuln vid="406636fe-055d-11e5-aab1-d050996490d0">
 <topic>krb5 -- requires_preauth bypass in PKINIT-enabled KDC</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><lt>1.13.2</lt></range>
 </package>
 <package>
	<name>krb5-112</name>
	<range><lt>1.12.3_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MIT reports:
	<blockquote cite="http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160">
	 In MIT krb5 1.12 and later, when the KDC is configured
	 with PKINIT support, an unauthenticated remote attacker
	 can bypass the requires_preauth flag on a client principal
	 and obtain a ciphertext encrypted in the principal's
	 long-term key. This ciphertext could be used to conduct
	 an off-line dictionary attack against the user's password.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2694</cvename>
 <url>http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160</url>
 </references>
 <dates>
 <discovery>2015-05-25</discovery>
 <entry>2015-05-28</entry>
 </dates>
 </vuln>

<vuln vid="27f742f6-03f4-11e5-aab1-d050996490d0">
 <topic>cURL -- sensitive HTTP server headers also sent to proxies</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>7.42.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cURL reports:
	<blockquote cite="http://curl.haxx.se/docs/adv_20150429.html">
	 libcurl provides applications a way to set custom HTTP
	 headers to be sent to the server by using CURLOPT_HTTPHEADER.
	 A similar option is available for the curl command-line
	 tool with the '--header' option.
	 When the connection passes through an HTTP proxy the
	 same set of headers is sent to the proxy as well by default.
	 While this is by design, it has not necessarily been clear
	 nor understood by application programmers.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3153</cvename>
 <url>http://curl.haxx.se/docs/adv_20150429.html</url>
 </references>
 <dates>
 <discovery>2015-04-29</discovery>
 <entry>2015-05-26</entry>
 </dates>
 </vuln>

<vuln vid="6294f75f-03f2-11e5-aab1-d050996490d0">
 <topic>cURL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>7.42.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cURL reports:
	<blockquote cite="http://curl.haxx.se/docs/adv_20150422A.html">
	 libcurl keeps a pool of its last few connections around
	 after use to facilitate easy, convenient, and completely
	 transparent connection re-use for applications.
	 When doing HTTP requests NTLM authenticated, the entire
	 connection becomes authenticated and not just the
	 specific HTTP request which is otherwise how HTTP works.
	 This makes NTLM special and a subject for special
	 treatment in the code. With NTLM, once the connection is
	 authenticated, no further authentication is necessary until
	 the connection gets closed.
	</blockquote>
	<blockquote cite="http://curl.haxx.se/docs/adv_20150422B.html">
	 When doing HTTP requests Negotiate authenticated, the
	 entire connection may become authenticated and not just
	 the specific HTTP request which is otherwise how HTTP
	 works, as Negotiate can basically use NTLM under the hood.
	 curl was not adhering to this fact but would assume that
	 such requests would also be authenticated per request.
	</blockquote>
	<blockquote cite="http://curl.haxx.se/docs/adv_20150422C.html">
	 libcurl supports HTTP "cookies" as documented in RFC 6265.
	 Together with each individual cookie there are several
	 different properties, but for this vulnerability we
	 focus on the associated "path" element. It tells
	 information about for which path on a given host the
	 cookies is valid.
	 The internal libcurl function called sanitize_cookie_path()
	 that cleans up the path element as given to it from a
	 remote site or when read from a file, did not properly
	 validate the input. If given a path that consisted of a
	 single double-quote, libcurl would index a newly
	 allocated memory area with index -1 and assign a zero
	 to it, thus destroying heap memory it wasn't supposed to.
	</blockquote>
	<blockquote cite="http://curl.haxx.se/docs/adv_20150422D.html">
	 There is a private function in libcurl called fix_hostname()
	 that removes a trailing dot from the host name if there is
	 one. The function is called after the host name has been
	 extracted from the URL libcurl has been told to act on.
	 If a URL is given with a zero-length host name, like in
	 "http://:80" or just ":80", fix_hostname() will index the
	 host name pointer with a -1 offset (as it blindly assumes
	 a non-zero length) and both read and assign that address.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://curl.haxx.se/docs/adv_20150422A.html</url>
 <url>http://curl.haxx.se/docs/adv_20150422B.html</url>
 <url>http://curl.haxx.se/docs/adv_20150422C.html</url>
 <url>http://curl.haxx.se/docs/adv_20150422D.html</url>
 <cvename>CVE-2014-3143</cvename>
 <cvename>CVE-2014-3144</cvename>
 <cvename>CVE-2014-3145</cvename>
 <cvename>CVE-2014-3148</cvename>
 </references>
 <dates>
 <discovery>2015-04-22</discovery>
 <entry>2015-05-26</entry>
 </dates>
 </vuln>

<vuln vid="607f4d44-0158-11e5-8fda-002590263bf5">
 <topic>cassandra -- remote execution of arbitrary code</topic>
 <affects>
 <package>
	<name>cassandra</name>
	<range><ge>1.2.0</ge><le>1.2.19</le></range>
 </package>
 <package>
	<name>cassandra2</name>
	<range><ge>2.0.0</ge><lt>2.0.14</lt></range>
	<range><ge>2.1.0</ge><lt>2.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jake Luciani reports:
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/cassandra-dev/201504.mbox/raw/%3CCALamADJu4yo=cO8HgA6NpgFc1wQN_VNqpkMn-3SZwhPq9foLBw@mail.gmail.com%3E/">
	 Under its default configuration, Cassandra binds an unauthenticated
	 JMX/RMI interface to all network interfaces. As RMI is an API for the
	 transport and remote execution of serialized Java, anyone with access
	 to this interface can execute arbitrary code as the running user.
	 Mitigation:
	 1.2.x has reached EOL, so users of &lt;= 1.2.x are recommended to upgrade
	 to a supported version of Cassandra, or manually configure encryption
	 and authentication of JMX,
	 (see https://wiki.apache.org/cassandra/JmxSecurity).
	 2.0.x users should upgrade to 2.0.14
	 2.1.x users should upgrade to 2.1.4
	 Alternately, users of any version not wishing to upgrade can
	 reconfigure JMX/RMI to enable encryption and authentication according
	 to https://wiki.apache.org/cassandra/JmxSecurityor
	 http://docs.oracle.com/javase/7/docs/technotes/guides/management/agent.html
	 Credit:
	 This issue was discovered by Georgi Geshev of MWR InfoSecurity
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://mail-archives.apache.org/mod_mbox/cassandra-dev/201504.mbox/raw/%3CCALamADJu4yo=cO8HgA6NpgFc1wQN_VNqpkMn-3SZwhPq9foLBw@mail.gmail.com%3E/</url>
 <cvename>CVE-2015-0225</cvename>
 </references>
 <dates>
 <discovery>2015-04-01</discovery>
 <entry>2015-05-24</entry>
 </dates>
 </vuln>

<vuln vid="865863af-fb5e-11e4-8fda-002590263bf5">
 <topic>py-salt -- potential shell injection vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-salt</name>
	<range><lt>2015.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Colton Myers reports:
	<blockquote cite="http://docs.saltstack.com/en/latest/topics/releases/2015.5.0.html">
	 In order to fix potential shell injection vulnerabilities in salt
	 modules, a change has been made to the various cmd module functions.
	 These functions now default to python_shell=False, which means that
	 the commands will not be sent to an actual shell.
	 The largest side effect of this change is that "shellisms", such as
	 pipes, will not work by default. The modules shipped with salt have
	 been audited to fix any issues that might have arisen from this
	 change. Additionally, the cmd state module has been unaffected, and
	 use of cmd.run in jinja is also unaffected. cmd.run calls on the
	 CLI will also allow shellisms.
	 However, custom execution modules which use shellisms in cmd calls
	 will break, unless you pass python_shell=True to these calls.
	 As a temporary workaround, you can set cmd_safe: False in your
	 minion and master configs. This will revert the default, but is
	 also less secure, as it will allow shell injection vulnerabilities
	 to be written in custom code. We recommend you only set this
	 setting for as long as it takes to resolve these issues in your
	 custom code, then remove the override.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://docs.saltstack.com/en/latest/topics/releases/2015.5.0.html</url>
 </references>
 <dates>
 <discovery>2015-05-11</discovery>
 <entry>2015-05-24</entry>
 </dates>
 </vuln>

<vuln vid="384fc0b2-0144-11e5-8fda-002590263bf5">
 <topic>davmail -- fix potential CVE-2014-3566 vulnerability (POODLE)</topic>
 <affects>
 <package>
	<name>davmail</name>
	<range><lt>4.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mickaël Guessant reports:
	<blockquote cite="http://sourceforge.net/p/davmail/mailman/message/33279118/">
	 DavMail 4.6.0 released
	 Enhancements: Fix potential CVE-2014-3566 vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://sourceforge.net/p/davmail/mailman/message/33279118/</url>
 <url>http://sourceforge.net/p/davmail/code/2322/</url>
 <cvename>CVE-2014-3566</cvename>
 </references>
 <dates>
 <discovery>2014-10-27</discovery>
 <entry>2015-05-23</entry>
 </dates>
 </vuln>

<vuln vid="7927165a-0126-11e5-9d98-080027ef73ec">
 <topic>dnsmasq -- remotely exploitable buffer overflow in release candidate</topic>
 <affects>
 <package>
	<name>dnsmasq-devel</name>
	<range><ge>2.73rc6</ge><lt>2.73rc8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Kelley reports:
	<blockquote cite="http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009529.html">
	 Anyone running 2.[73]rc6 or 2.[73]rc7 should be aware that there's a
	 remotely exploitable buffer overflow in those trees. I just tagged
	 2.[73]rc8, which includes the fix.
	 
	</blockquote>
	(Corrections from second URL.)
 </body>
 </description>
 <references>
 <url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009529.html</url>
 <url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009535.html</url>
 </references>
 <dates>
 <discovery>2015-05-15</discovery>
 <entry>2015-05-23</entry>
 </dates>
 </vuln>

<vuln vid="37569eb7-0125-11e5-9d98-080027ef73ec">
 <topic>dnsmasq -- data exposure and denial of service</topic>
 <affects>
 <package>
	<name>dnsmasq</name>
	<range><lt>2.72_1</lt></range>
 </package>
 <package>
	<name>dnsmasq-devel</name>
	<range><lt>2.73rc4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nick Sampanis reported a potential memory exposure and denial of service vulnerability against dnsmasq 2.72. The CVE entry summarizes this as:
	
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3294">The tcp_request function in Dnsmasq before 2.73rc4
	 does not properly handle the return value of the setup_reply function,
	 which allows remote attackers to read process memory and cause a
	 denial of service (out-of-bounds read and crash) via a malformed DNS
	 request."
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009382.html</url>
 <cvename>CVE-2015-3294</cvename>
 <url>http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=ad4a8ff7d9097008d7623df8543df435bfddeac8</url>
 </references>
 <dates>
 <discovery>2015-04-07</discovery>
 <entry>2015-05-23</entry>
 </dates>
 </vuln>

<vuln vid="4a88e3ed-00d3-11e5-a072-d050996490d0">
 <topic>pcre -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>pcre</name>
	<range><lt>8.37</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PCRE development team reports:
	<blockquote cite="http://www.pcre.org/original/changelog.txt">
	 A pattern such as "((?2){0,1999}())?", which has a group
	 containing a forward reference repeated a large (but limited)
	 number of times within a repeated outer group that has a zero
	 minimum quantifier, caused incorrect code to be compiled,
	 leading to the error "internal error: previously-checked
	 referenced subpattern not found" when an incorrect memory
	 address was read. This bug was reported as "heap overflow",
	 discovered by Kai Lu of Fortinet's FortiGuard Labs and given
	 the CVE number CVE-2015-2325.
	 A pattern such as "((?+1)(\1))/" containing a forward
	 reference subroutine call within a group that also contained
	 a recursive back reference caused incorrect code to be
	 compiled. This bug was reported as "heap overflow",
	 discovered by Kai Lu of Fortinet's FortiGuard Labs,
	 and given the CVE number CVE-2015-2326.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2325</cvename>
 <cvename>CVE-2015-2326</cvename>
 <url>http://www.pcre.org/original/changelog.txt</url>
 </references>
 <dates>
 <discovery>2015-04-28</discovery>
 <entry>2015-05-22</entry>
 <modified>2015-06-07</modified>
 </dates>
 </vuln>

<vuln vid="31de2e13-00d2-11e5-a072-d050996490d0">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.4.41</lt></range>
 </package>
 <package>
	<name>php55</name>
	<range><lt>5.5.25</lt></range>
 </package>
 <package>
	<name>php56</name>
	<range><lt>5.6.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP development team reports:
	<blockquote cite="https://php.net/ChangeLog-5.php#5.6.9">
	 Fixed bug #69364 (PHP Multipart/form-data remote DoS
	 Vulnerability). (CVE-2015-4024)
	 Fixed bug #69418 (CVE-2006-7243 fix regressions in
	 5.4+). (CVE-2015-4025)
	 Fixed bug #69545 (Integer overflow in ftp_genlist()
	 resulting in heap overflow). (CVE-2015-4022)
	 Fixed bug #68598 (pcntl_exec() should not allow null
	 char). (CVE-2015-4026)
	 Fixed bug #69453 (Memory Corruption in phar_parse_tarfile
	 when entry filename starts with null). (CVE-2015-4021)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-4021</cvename>
 <cvename>CVE-2015-4022</cvename>
 <cvename>CVE-2015-4024</cvename>
 <cvename>CVE-2015-4025</cvename>
 <cvename>CVE-2015-4026</cvename>
 <url>https://php.net/ChangeLog-5.php#5.6.9</url>
 </references>
 <dates>
 <discovery>2015-05-14</discovery>
 <entry>2015-05-22</entry>
 </dates>
 </vuln>

<vuln vid="fc38cd83-00b3-11e5-8ebd-0026551a22dc">
 <topic>PostgreSQL -- minor security problems.</topic>
 <affects>
 <package>
	<name>postgresql90-server</name>
	<range><ge>9.0.0</ge><lt>9.0.20</lt></range>
 </package>
 <package>
	<name>postgresql91-server</name>
	<range><ge>9.1.0</ge><lt>9.1.16</lt></range>
 </package>
 <package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.11</lt></range>
 </package>
 <package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.7</lt></range>
 </package>
 <package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL project reports:
	<blockquote cite="http://www.postgresql.org/about/news/1587/">
	 
		This update fixes three security vulnerabilities reported in
		PostgreSQL over the past few months. Nether of these issues is seen as
		particularly urgent. However, users should examine them in case their
		installations are vulnerable:.
	 
	 <ul>
	 <li>CVE-2015-3165 Double "free" after authentication timeout.</li>
	 <li>CVE-2015-3166 Unanticipated errors from the standard library.</li>
	 <li>CVE-2015-3167 pgcrypto has multiple error messages for decryption with an incorrect key.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3165</cvename>
 <cvename>CVE-2015-3166</cvename>
 <cvename>CVE-2015-3167</cvename>
 </references>
 <dates>
 <discovery>2015-04-10</discovery>
 <entry>2015-05-22</entry>
 </dates>
 </vuln>

<vuln vid="d0034536-ff24-11e4-a072-d050996490d0">
 <topic>proftpd -- arbitrary code execution vulnerability with chroot</topic>
 <affects>
 <package>
	<name>proftpd</name>
	<range><lt>1.3.5_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ProFTPd development team reports:
	<blockquote cite="http://bugs.proftpd.org/show_bug.cgi?id=4169">
	 Vadim Melihow reported a critical issue with proftpd
	 installations that use the mod_copy module's SITE CPFR/SITE
	 CPTO commands; mod_copy allows these commands to be used by
	 *unauthenticated clients*.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3306</cvename>
 <url>http://bugs.proftpd.org/show_bug.cgi?id=4169</url>
 </references>
 <dates>
 <discovery>2015-04-15</discovery>
 <entry>2015-05-20</entry>
 </dates>
 </vuln>

<vuln vid="35431f79-fe3e-11e4-ba63-000c292ee6b8">
 <topic>ipsec-tools -- Memory leak leading to denial of service</topic>
 <affects>
 <package>
	<name>ipsec-tools</name>
	<range><lt>0.8.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Javantea reports:
	<blockquote cite="https://www.altsci.com/ipsec/">
	 It is a null dereference crash, leading to denial of
	 service against the IKE daemon.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.altsci.com/ipsec/</url>
 </references>
 <dates>
 <discovery>2015-05-18</discovery>
 <entry>2015-05-19</entry>
 </dates>
 </vuln>

<vuln vid="a9d456b4-fe4c-11e4-ad15-00262d5ed8ee">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>43.0.2357.65</lt></range>
 </package>
 <package>
	
	<name>chromium-npapi</name>
	<range><lt>43.0.2357.65</lt></range>
 </package>
 <package>
	
	<name>chromium-pulse</name>
	<range><lt>43.0.2357.65</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/05/stable-channel-update_19.html">
	 37 security fixes in this release, including:
	 <ul>
	 <li>[474029] High CVE-2015-1252: Sandbox escape in Chrome. Credit
	 to anonymous.</li>
	 <li>[464552] High CVE-2015-1253: Cross-origin bypass in DOM. Credit
	 to anonymous.</li>
	 <li>[444927] High CVE-2015-1254: Cross-origin bypass in Editing.
	 Credit to armin@rawsec.net.</li>
	 <li>[473253] High CVE-2015-1255: Use-after-free in WebAudio. Credit
	 to Khalil Zhani.</li>
	 <li>[478549] High CVE-2015-1256: Use-after-free in SVG. Credit to
	 Atte Kettunen of OUSPG.</li>
	 <li>[481015] High CVE-2015-1251: Use-after-free in Speech. Credit
	 to SkyLined working with HP's Zero Day Initiative.</li>
	 <li>[468519] Medium CVE-2015-1257: Container-overflow in SVG.
	 Credit to miaubiz.</li>
	 <li>[450939] Medium CVE-2015-1258: Negative-size parameter in
	 libvpx. Credit to cloudfuzzer</li>
	 <li>[468167] Medium CVE-2015-1259: Uninitialized value in PDFium.
	 Credit to Atte Kettunen of OUSPG</li>
	 <li>[474370] Medium CVE-2015-1260: Use-after-free in WebRTC. Credit
	 to Khalil Zhani.</li>
	 <li>[466351] Medium CVE-2015-1261: URL bar spoofing. Credit to Juho
	 Nurminen.</li>
	 <li>[476647] Medium CVE-2015-1262: Uninitialized value in Blink.
	 Credit to miaubiz.</li>
	 <li>[479162] Low CVE-2015-1263: Insecure download of spellcheck
	 dictionary. Credit to Mike Ruddy.</li>
	 <li>[481015] Low CVE-2015-1264: Cross-site scripting in bookmarks.
	 Credit to K0r3Ph1L.</li>
	 <li>[489518] CVE-2015-1265: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 <li>Multiple vulnerabilities in V8 fixed at the tip of the 4.3
	 branch (currently 4.3.61.21).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://googlechromereleases.blogspot.nl/2015/05/stable-channel-update_19.html</url>
 <cvename>CVE-2015-1251</cvename>
 <cvename>CVE-2015-1252</cvename>
 <cvename>CVE-2015-1253</cvename>
 <cvename>CVE-2015-1254</cvename>
 <cvename>CVE-2015-1255</cvename>
 <cvename>CVE-2015-1256</cvename>
 <cvename>CVE-2015-1257</cvename>
 <cvename>CVE-2015-1258</cvename>
 <cvename>CVE-2015-1259</cvename>
 <cvename>CVE-2015-1260</cvename>
 <cvename>CVE-2015-1261</cvename>
 <cvename>CVE-2015-1262</cvename>
 <cvename>CVE-2015-1263</cvename>
 <cvename>CVE-2015-1264</cvename>
 <cvename>CVE-2015-1265</cvename>
 </references>
 <dates>
 <discovery>2015-05-19</discovery>
 <entry>2015-05-19</entry>
 </dates>
 </vuln>

<vuln vid="3d0428b2-fdfb-11e4-894f-d050996490d0">
 <topic>clamav -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.98.7</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ClamAV project reports:
	<blockquote cite="http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html">
	 ClamAV 0.98.7 is here! This release contains new
	 scanning features and bug fixes.
	 Fix infinite loop condition on crafted y0da cryptor file.
	 Identified and patch suggested by Sebastian Andrzej Siewior.
	 CVE-2015-2221.
	 Fix crash on crafted petite packed file. Reported and patch
	 supplied by Sebastian Andrzej Siewior. CVE-2015-2222.
	 Fix an infinite loop condition on a crafted "xz" archive
	 file. This was reported by Dimitri Kirchner and Goulven
	 Guiheux. CVE-2015-2668.
	 Apply upstream patch for possible heap overflow in Henry
	 Spencer's regex library. CVE-2015-2305.
	 Fix crash in upx decoder with crafted file. Discovered and
	 patch supplied by Sebastian Andrzej Siewior. CVE-2015-2170.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2170</cvename>
 <cvename>CVE-2015-2221</cvename>
 <cvename>CVE-2015-2222</cvename>
 <cvename>CVE-2015-2305</cvename>
 <cvename>CVE-2015-2668</cvename>
 <url>http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html</url>
 </references>
 <dates>
 <discovery>2015-04-29</discovery>
 <entry>2015-05-19</entry>
 </dates>
 </vuln>

<vuln vid="a0089e18-fc9e-11e4-bc58-001e67150279">
 <topic>rubygems -- request hijacking vulnerability</topic>
 <affects>
 <package>
	<name>ruby20-gems</name>
	<range><lt>2.4.7</lt></range>
 </package>
 <package>
	<name>ruby21-gems</name>
	<range><lt>2.4.7</lt></range>
 </package>
 <package>
	<name>ruby22-gems</name>
	<range><lt>2.4.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jonathan Claudius reports:
	<blockquote cite="http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html">
	 RubyGems provides the ability of a domain to direct clients to a
	 separate host that is used to fetch gems and make API calls against.
	 This mechanism is implemented via DNS, specifically a SRV record
	 _rubygems._tcp under the original requested domain.
	 RubyGems did not validate the hostname returned in the SRV record
	 before sending requests to it. This left clients open to a DNS
	 hijack attack, whereby an attacker could return a SRV of their
	 choosing and get the client to use it.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/200264</freebsdpr>
 <cvename>CVE-2015-3900</cvename>
 <url>http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html</url>
 </references>
 <dates>
 <discovery>2015-05-14</discovery>
 <entry>2015-05-17</entry>
 </dates>
 </vuln>

<vuln vid="2780e442-fc59-11e4-b18b-6805ca1d3bb1">
 <topic>qemu, xen and VirtualBox OSE -- possible VM escape and code execution ("VENOM")</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>0.11.1_19</lt></range>
	<range><ge>0.12</ge><lt>2.3.0_1</lt></range>
 </package>
 <package>
	<name>qemu-sbruno</name>
	<range><lt>2.3.50.g20150501_1</lt></range>
 </package>
 <package>
	<name>virtualbox-ose</name>
	<range><lt>4.3.28</lt></range>
 </package>
 <package>
	<name>xen-tools</name>
	<range><ge>4.5.0</ge><lt>4.5.0_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jason Geffner, CrowdStrike Senior Security Researcher reports:
	<blockquote cite="http://venom.crowdstrike.com/">
	 VENOM, CVE-2015-3456, is a security vulnerability in
	 the virtual floppy drive code used by many computer
	 virtualization platforms. This vulnerability may allow
	 an attacker to escape from the confines of an affected
	 virtual machine (VM) guest and potentially obtain
	 code-execution access to the host. Absent mitigation,
	 this VM escape could open access to the host system and
	 all other VMs running on that host, potentially giving
	 adversaries significant elevated access to the host's
	 local network and adjacent systems.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3456</cvename>
 <freebsdpr>ports/200255</freebsdpr>
 <freebsdpr>ports/200256</freebsdpr>
 <freebsdpr>ports/200257</freebsdpr>
 <url>http://venom.crowdstrike.com/</url>
 <url>http://www.oracle.com/technetwork/topics/security/alert-cve-2015-3456-2542656.html</url>
 <url>http://xenbits.xen.org/xsa/advisory-133.html</url>
 </references>
 <dates>
 <discovery>2015-04-29</discovery>
 <entry>2015-05-17</entry>
 <modified>2015-09-28</modified>
 </dates>
 </vuln>

<vuln vid="49d9c28c-fbad-11e4-b0fb-00269ee29e57">
 <topic>Quassel IRC -- SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>quassel</name>
	<range><lt>0.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Quassel IRC developers report:
	<blockquote cite="http://www.quassel-irc.org/node/127">
	 Restarting a PostgreSQL database while Quassel Core is running
	 would not properly re-initialize the database session inside Quassel,
	 bringing back an old security issue (CVE-2013-4422).
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/quassel/quassel/commit/6605882f41331c80f7ac3a6992650a702ec71283</url>
 <cvename>CVE-2015-3427</cvename>
 </references>
 <dates>
 <discovery>2015-04-23</discovery>
 <entry>2015-05-16</entry>
 </dates>
 </vuln>

<vuln vid="c368155a-fa83-11e4-bc58-001e67150279">
 <topic>rubygem-redcarpet -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-redcarpet</name>
	<range><lt>3.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Daniel LeCheminant reports:
	<blockquote cite="https://hackerone.com/reports/46916">
	 When markdown is being presented as HTML, there seems to be a
	 strange interaction between _ and @ that lets an attacker insert
	 malicious tags.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist>http://openwall.com/lists/oss-security/2015/04/07/11</mlist>
 <url>https://hackerone.com/reports/46916</url>
 <url>http://danlec.com/blog/bug-in-sundown-and-redcarpet</url>
 </references>
 <dates>
 <discovery>2015-04-07</discovery>
 <entry>2015-05-14</entry>
 </dates>
 </vuln>

<vuln vid="57325ecf-facc-11e4-968f-b888e347c638">
 <topic>dcraw -- integer overflow condition</topic>
 <affects>
 <package>
	<name>cinepaint</name>
	
	<range><ge>0.22.0</ge></range>
 </package>
 <package>
	<name>darktable</name>
	<range><lt>1.6.7</lt></range>
 </package>
 <package>
	<name>dcraw</name>
	<range><ge>7.00</ge><lt>9.26</lt></range>
 </package>
 <package>
	<name>dcraw-m</name>
	
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>exact-image</name>
	<range><lt>0.9.1</lt></range>
 </package>
 <package>
	<name>flphoto</name>
	
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>freeimage</name>
	<range><ge>3.13.0</ge><lt>3.16.0_1</lt></range>
 </package>
 <package>
	<name>kodi</name>
	<range><lt>14.2_1</lt></range>
 </package>
 <package>
	<name>libraw</name>
	<range><lt>0.16.1</lt></range>
 </package>
 <package>
	<name>lightzone</name>
	<range><lt>4.1.2</lt></range>
 </package>
 <package>
	<name>netpbm</name>
	<range><lt>10.35.96</lt></range>
 </package>
 <package>
	<name>opengtl</name>
	
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>rawstudio</name>
	<range><lt>2.0_11</lt></range>
 </package>
 <package>
	<name>ufraw</name>
	<range><lt>0.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ocert reports:
	<blockquote cite="http://www.ocert.org/advisories/ocert-2015-006.html">
	 The dcraw tool, as well as several other projects re-using its
	 code, suffers from an integer overflow condition which lead to a
	 buffer overflow.
	 The vulnerability concerns the 'len' variable, parsed without
	 validation from opened images, used in the ljpeg_start()
	 function.
	 A maliciously crafted raw image file can be used to trigger the
	 vulnerability, causing a Denial of Service condition.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3885</cvename>
 <url>http://www.ocert.org/advisories/ocert-2015-006.html</url>
 <url>https://github.com/rawstudio/rawstudio/commit/983bda1f0fa5fa86884381208274198a620f006e</url>
 <url>https://github.com/LibRaw/LibRaw/commit/4606c28f494a750892c5c1ac7903e62dd1c6fdb5</url>
 <url>https://sourceforge.net/p/netpbm/code/2512/</url>
 </references>
 <dates>
 <discovery>2015-04-24</discovery>
 <entry>2015-05-15</entry>
 <modified>2016-01-08</modified>
 </dates>
 </vuln>

<vuln vid="c6e31869-f99f-11e4-9f91-6805ca0b3d42">
 <topic>phpMyAdmin -- XSRF and man-in-the-middle vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.4.0</ge><lt>4.4.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php">
	 XSRF/CSRF vulnerability in phpMyAdmin setup.
	 By deceiving a user to click on a crafted URL, it is
	 possible to alter the configuration file being generated
	 with phpMyAdmin setup.
	 This vulnerability only affects the configuration file
	 generation process and does not affect the effective
	 configuration file. Moreover, the configuration file being
	 generated is at risk only during the period when it's
	 writable.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php">
	 Vulnerability allowing man-in-the-middle attack on API
	 call to GitHub.
	 A vulnerability in the API call to GitHub can be
	 exploited to perform a man-in-the-middle attack.
	 We consider this vulnerability to be serious.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php</url>
 <cvename>CVE-2015-3902</cvename>
 <cvename>CVE-2015-3903</cvename>
 </references>
 <dates>
 <discovery>2015-05-13</discovery>
 <entry>2015-05-13</entry>
 </dates>
 </vuln>

<vuln vid="e206df57-f97b-11e4-b799-c485083ca99c">
 <topic>Adobe Flash Player -- critical vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<range><le>11.2r202.457</le></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><le>11.2r202.457</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-09.html">
	 
	 Adobe has released security updates for Adobe Flash Player for
	 Windows, Macintosh and Linux. These updates address vulnerabilities
	 that could potentially allow an attacker to take control of the
	 affected system. Adobe recommends users update their product
	 installations to the latest versions.
	 
	 
	 These updates resolve memory corruption vulnerabilities that could
	 lead to code execution (CVE-2015-3078, CVE-2015-3089, CVE-2015-3090,
	 CVE-2015-3093).
	 
	 
	 These updates resolve a heap overflow vulnerability that could lead
	 to code execution (CVE-2015-3088).
	 
	 
	 These updates resolve a time-of-check time-of-use (TOCTOU) race
	 condition that could be exploited to bypass Protected Mode in
	 Internet Explorer (CVE-2015-3081).
	 
	 
	 These updates resolve validation bypass issues that could be
	 exploited to write arbitrary data to the file system under user
	 permissions (CVE-2015-3082, CVE-2015-3083, CVE-2015-3085).
	 
	 
	 These updates resolve an integer overflow vulnerability that could
	 lead to code execution (CVE-2015-3087).
	 
	 
	 These updates resolve a type confusion vulnerability that could lead
	 to code execution (CVE-2015-3077, CVE-2015-3084, CVE-2015-3086).
	 
	 
	 These updates resolve a use-after-free vulnerability that could lead
	 to code execution (CVE-2015-3080).
	 
	 
	 These updates resolve memory leak vulnerabilities that could be used
	 to bypass ASLR (CVE-2015-3091, CVE-2015-3092).
	 
	 
	 These updates resolve a security bypass vulnerability that could lead
	 to information disclosure (CVE-2015-3079), and provide additional
	 hardening to protect against CVE-2015-3044.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3044</cvename>
 <cvename>CVE-2015-3077</cvename>
 <cvename>CVE-2015-3078</cvename>
 <cvename>CVE-2015-3079</cvename>
 <cvename>CVE-2015-3080</cvename>
 <cvename>CVE-2015-3081</cvename>
 <cvename>CVE-2015-3082</cvename>
 <cvename>CVE-2015-3083</cvename>
 <cvename>CVE-2015-3084</cvename>
 <cvename>CVE-2015-3085</cvename>
 <cvename>CVE-2015-3086</cvename>
 <cvename>CVE-2015-3087</cvename>
 <cvename>CVE-2015-3088</cvename>
 <cvename>CVE-2015-3089</cvename>
 <cvename>CVE-2015-3090</cvename>
 <cvename>CVE-2015-3091</cvename>
 <cvename>CVE-2015-3092</cvename>
 <cvename>CVE-2015-3093</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb15-09.html</url>
 </references>
 <dates>
 <discovery>2015-05-12</discovery>
 <entry>2015-05-13</entry>
 </dates>
 </vuln>

<vuln vid="d9b43004-f5fd-4807-b1d7-dbf66455b244">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>38.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>38.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.35</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.35</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>31.7.0,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>31.7.0</lt></range>
	<range><ge>32.0</ge><lt>38.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>31.7.0</lt></range>
	<range><ge>32.0</ge><lt>38.0</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>31.7.0</lt></range>
	<range><ge>32.0</ge><lt>38.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
	 MFSA-2015-46 Miscellaneous memory safety hazards (rv:38.0
	 / rv:31.7)
	 MFSA-2015-47 Buffer overflow parsing H.264 video with
	 Linux Gstreamer
	 MFSA-2015-48 Buffer overflow with SVG content and CSS
	 MFSA-2015-49 Referrer policy ignored when links opened by
	 middle-click and context menu
	 MFSA-2015-50 Out-of-bounds read and write in asm.js validation
	 MFSA-2015-51 Use-after-free during text processing with
	 vertical text enabled
	 MFSA-2015-52 Sensitive URL encoded information written to
	 Android logcat
	 MFSA-2015-53 Use-after-free due to Media Decoder Thread creation
	 during shutdown
	 MFSA-2015-54 Buffer overflow when parsing compressed XML
	 MFSA-2015-55 Buffer overflow and out-of-bounds read while
	 parsing MP4 video metadata
	 MFSA-2015-56 Untrusted site hosting trusted page can
	 intercept webchannel responses
	 MFSA-2015-57 Privilege escalation through IPC channel messages
	 MFSA-2015-58 Mozilla Windows updater can be run outside
	 of application directory
	 MFSA 2015-93 Integer overflows in libstagefright while processing
	 MP4 video metadata
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3079</cvename>
 <cvename>CVE-2015-0797</cvename>
 <cvename>CVE-2015-0833</cvename>
 <cvename>CVE-2015-2708</cvename>
 <cvename>CVE-2015-2709</cvename>
 <cvename>CVE-2015-2710</cvename>
 <cvename>CVE-2015-2711</cvename>
 <cvename>CVE-2015-2712</cvename>
 <cvename>CVE-2015-2713</cvename>
 <cvename>CVE-2015-2714</cvename>
 <cvename>CVE-2015-2715</cvename>
 <cvename>CVE-2015-2716</cvename>
 <cvename>CVE-2015-2717</cvename>
 <cvename>CVE-2015-2718</cvename>
 <cvename>CVE-2015-2720</cvename>
 <cvename>CVE-2015-4496</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-46/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-47/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-48/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-49/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-50/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-51/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-52/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-53/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-54/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-55/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-56/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-57/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-58/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-93/</url>
 </references>
 <dates>
 <discovery>2015-05-12</discovery>
 <entry>2015-05-12</entry>
 <modified>2015-08-28</modified>
 </dates>
 </vuln>

<vuln vid="fe910ed6-f88d-11e4-9ae3-0050562a4d7b">
 <topic>suricata -- TLS/DER Parser Bug (DoS)</topic>
 <affects>
 <package>
	<name>suricata</name>
	<range><lt>2.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OISF Development Team reports:
	<blockquote cite="https://lists.openinfosecfoundation.org/pipermail/oisf-devel/2015-May/003406.html">
	 The OISF development team is pleased to announce Suricata 2.0.8.
	 This release fixes a number of issues in the 2.0 series.

The most important issue is a bug in the DER parser which is used to
	 decode SSL/TLS certificates could crash Suricata. This issue was
	 reported by Kostya Kortchinsky of the Google Security Team and was fixed
	 by Pierre Chifflier of ANSSI.

Those processing large numbers of (untrusted) pcap files need to update
	 as a malformed pcap could crash Suricata. Again, credits go to Kostya
	 Kortchinsky.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0971</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0971</url>
 <url>https://github.com/inliniac/suricata/commit/fa73a0bb8f312fd0a95cc70f6b3ee4e4997bdba7</url>
 </references>
 <dates>
 <discovery>2015-05-06</discovery>
 <entry>2015-05-12</entry>
 </dates>
 </vuln>

<vuln vid="0b040e24-f751-11e4-b24d-5453ed2e2b49">
 <topic>libssh -- null pointer dereference</topic>
 <affects>
 <package>
	<name>libssh</name>
	<range><lt>0.6.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Andreas Schneider reports:
	<blockquote cite="https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release/">
	 libssh versions 0.5.1 and above have a logical error in the
	 handling of a SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY package. A
	 detected error did not set the session into the error state
	 correctly and further processed the packet which leads to a null
	 pointer dereference. This is the packet after the initial key
	 exchange and doesn’t require authentication.
	 This could be used for a Denial of Service (DoS) attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3146</cvename>
 <url>https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release</url>
 </references>
 <dates>
 <discovery>2015-04-30</discovery>
 <entry>2015-05-10</entry>
 </dates>
 </vuln>

<vuln vid="b13af778-f4fc-11e4-a95d-ac9e174be3af">
 <topic>Vulnerability in HWP document filter</topic>
 <affects>
 <package>
	<name>libreoffice</name>
	<range><lt>4.3.7</lt></range>
 </package>
 <package>
	<name>apache-openoffice</name>
	<range><lt>4.1.1_9</lt></range>
 </package>
 <package>
	<name>apache-openoffice-devel</name>
	<range><lt>4.2.1677190,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US-CERT/NIST reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1774">
	 The HWP filter in LibreOffice before 4.3.7 and 4.4.x before
	 4.4.2 and Apache OpenOffice before 4.1.2 allows remote
	 attackers to cause a denial of service (crash) or possibly
	 execute arbitrary code via a crafted HWP document, which
	 triggers an out-of-bounds write.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1774</cvename>
 <url>http://www.openoffice.org/security/cves/CVE-2015-1774.html</url>
 <url>https://www.libreoffice.org/about-us/security/advisories/cve-2015-1774/</url>
 </references>
 <dates>
 <discovery>2015-04-27</discovery>
 <entry>2015-05-07</entry>
 </dates>
 </vuln>

<vuln vid="d86890da-f498-11e4-99aa-bcaec565249c">
 <topic>wordpress -- 2 cross-site scripting vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.2.2,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<range><lt>4.2.2</lt></range>
 </package>
 <package>
	<name>ja-wordpress</name>
	<range><lt>4.2.2</lt></range>
 </package>
 <package>
	<name>ru-wordpress</name>
	<range><lt>4.2.2</lt></range>
 </package>
 <package>
	<name>zh-wordpress-zh_CN</name>
	<range><lt>4.2.2</lt></range>
 </package>
 <package>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samuel Sidler reports:
	<blockquote cite="https://wordpress.org/news/2015/05/wordpress-4-2-2/">
	 The Genericons icon font package, which is used in a number of
	 popular themes and plugins, contained an HTML file vulnerable to
	 a cross-site scripting attack. All affected themes and plugins
	 hosted on WordPress.org (including the Twenty Fifteen default
	 theme) have been updated today by the WordPress security team
	 to address this issue by removing this nonessential file. To
	 help protect other Genericons usage, WordPress 4.2.2
	 proactively scans the wp-content directory for this HTML
	 file and removes it. Reported by Robert Abela of Netsparker.

WordPress versions 4.2 and earlier are affected by a critical
	 cross-site scripting vulnerability, which could enable anonymous
	 users to compromise a site. WordPress 4.2.2 includes a
	 comprehensive fix for this issue.

The release also includes hardening for a potential cross-site
	 scripting vulnerability when using the visual editor. This issue
	 was reported by Mahadev Subedi.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2015/05/wordpress-4-2-2/</url>
 </references>
 <dates>
 <discovery>2015-05-07</discovery>
 <entry>2015-05-07</entry>
 <modified>2015-09-15</modified>
 </dates>
 </vuln>

<vuln vid="ba4f9b19-ed9d-11e4-9118-bcaec565249c">
 <topic>wordpress -- cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.2.1,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<range><lt>4.2.1</lt></range>
 </package>
 <package>
	<name>ja-wordpress</name>
	<range><lt>4.2.1</lt></range>
 </package>
 <package>
	<name>ru-wordpress</name>
	<range><lt>4.2.1</lt></range>
 </package>
 <package>
	<name>zh-wordpress-zh_CN</name>
	<range><lt>4.2.1</lt></range>
 </package>
 <package>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gary Pendergast reports:
	<blockquote cite="https://wordpress.org/news/2015/04/wordpress-4-2-1/">
	 WordPress 4.2.1 is now available. This is a critical security
	 release for all previous versions and we strongly encourage you
	 to update your sites immediately.
	 A few hours ago, the WordPress team was made aware of a
	 cross-site scripting vulnerability, which could enable commenters
	 to compromise a site. The vulnerability was discovered by Jouko
	 Pynnöne.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2015/04/wordpress-4-2-1/</url>
 </references>
 <dates>
 <discovery>2015-04-27</discovery>
 <entry>2015-05-07</entry>
 <modified>2015-09-15</modified>
 </dates>
 </vuln>

<vuln vid="64e6006e-f009-11e4-98c6-000c292ee6b8">
 <topic>powerdns -- Label decompression bug can cause crashes or CPU spikes</topic>
 <affects>
 <package>
	<name>powerdns</name>
	<range><lt>3.4.5</lt></range>
 </package>
 <package>
	<name>powerdns-recursor</name>
	<range><lt>3.7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PowerDNS project reports:
	<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/">
	 A bug was discovered in our label decompression code, making it
	 possible for names to refer to themselves, thus causing a loop during
	 decompression. On some platforms, this bug can be abused to cause
	 crashes. On all platforms, this bug can be abused to cause
	 service-affecting CPU spikes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1868</cvename>
 <cvename>CVE-2015-5470</cvename>
 <url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/</url>
 <mlist>http://www.openwall.com/lists/oss-security/2015/07/10/8</mlist>
 </references>
 <dates>
 <discovery>2015-04-23</discovery>
 <entry>2015-05-01</entry>
 <modified>2015-07-12</modified>
 </dates>
 </vuln>

<vuln vid="210f80b9-ede4-11e4-81c4-00262d5ed8ee">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>42.0.2311.135</lt></range>
 </package>
 <package>
	
	<name>chromium-npapi</name>
	<range><lt>42.0.2311.135</lt></range>
 </package>
 <package>
	
	<name>chromium-pulse</name>
	<range><lt>42.0.2311.135</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_28.html">
	 5 security fixes in this release, including:
	 <ul>
	 <li>[453279] High CVE-2015-1243: Use-after-free in DOM. Credit to
	 Saif El-Sherei.</li>
	 <li>[481777] CVE-2015-1250: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1243</cvename>
 <cvename>CVE-2015-1250</cvename>
 <url>http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_28.html</url>
 </references>
 <dates>
 <discovery>2015-04-28</discovery>
 <entry>2015-04-28</entry>
 </dates>
 </vuln>

<vuln vid="b57f690e-ecc9-11e4-876c-00262d5ed8ee">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>42.0.2311.90</lt></range>
 </package>
 <package>
	
	<name>chromium-npapi</name>
	<range><lt>42.0.2311.90</lt></range>
 </package>
 <package>
	
	<name>chromium-pulse</name>
	<range><lt>42.0.2311.90</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_14.html">
	 45 new security fixes, including:
	 <ul>
	 <li>[456518] High CVE-2015-1235: Cross-origin-bypass in HTML
	 parser. Credit to anonymous.</li>
	 <li>[313939] Medium CVE-2015-1236: Cross-origin-bypass in Blink.
	 Credit to Amitay Dobo.</li>
	 <li>[461191] High CVE-2015-1237: Use-after-free in IPC. Credit to
	 Khalil Zhani.</li>
	 <li>[445808] High CVE-2015-1238: Out-of-bounds write in Skia.
	 Credit to cloudfuzzer.</li>
	 <li>[463599] Medium CVE-2015-1240: Out-of-bounds read in WebGL.
	 Credit to w3bd3vil.</li>
	 <li>[418402] Medium CVE-2015-1241: Tap-Jacking. Credit to Phillip
	 Moon and Matt Weston of Sandfield Information Systems.</li>
	 <li>[460917] High CVE-2015-1242: Type confusion in V8. Credit to
	 fcole@onshape.com.</li>
	 <li>[455215] Medium CVE-2015-1244: HSTS bypass in WebSockets.
	 Credit to Mike Ruddy.</li>
	 <li>[444957] Medium CVE-2015-1245: Use-after-free in PDFium. Credit
	 to Khalil Zhani.</li>
	 <li>[437399] Medium CVE-2015-1246: Out-of-bounds read in Blink.
	 Credit to Atte Kettunen of OUSPG.</li>
	 <li>[429838] Medium CVE-2015-1247: Scheme issues in OpenSearch.
	 Credit to Jann Horn.</li>
	 <li>[380663] Medium CVE-2015-1248: SafeBrowsing bypass. Credit to
	 Vittorio Gambaletta (VittGam).</li>
	 <li>[476786] CVE-2015-1249: Various fixes from internal audits,
	 fuzzing and other initiatives. Multiple vulnerabilities in V8
	 fixed at the tip of the 4.2 branch (currently 4.2.77.14).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_14.html</url>
 <cvename>CVE-2015-1235</cvename>
 <cvename>CVE-2015-1236</cvename>
 <cvename>CVE-2015-1237</cvename>
 <cvename>CVE-2015-1238</cvename>
 <cvename>CVE-2015-1240</cvename>
 <cvename>CVE-2015-1241</cvename>
 <cvename>CVE-2015-1242</cvename>
 <cvename>CVE-2015-1244</cvename>
 <cvename>CVE-2015-1245</cvename>
 <cvename>CVE-2015-1246</cvename>
 <cvename>CVE-2015-1247</cvename>
 <cvename>CVE-2015-1248</cvename>
 <cvename>CVE-2015-1249</cvename>
 </references>
 <dates>
 <discovery>2015-04-14</discovery>
 <entry>2015-04-27</entry>
 </dates>
 </vuln>

<vuln vid="cb9d2fcd-eb47-11e4-b03e-002590263bf5">
 <topic>wpa_supplicant -- P2P SSID processing vulnerability</topic>
 <affects>
 <package>
	<name>wpa_supplicant</name>
	<range><lt>2.4_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jouni Malinen reports:
	<blockquote cite="http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt">
	 A vulnerability was found in how wpa_supplicant uses SSID information
	 parsed from management frames that create or update P2P peer entries
	 (e.g., Probe Response frame or number of P2P Public Action frames). SSID
	 field has valid length range of 0-32 octets. However, it is transmitted
	 in an element that has a 8-bit length field and potential maximum
	 payload length of 255 octets. wpa_supplicant was not sufficiently
	 verifying the payload length on one of the code paths using the SSID
	 received from a peer device.
	 This can result in copying arbitrary data from an attacker to a fixed
	 length buffer of 32 bytes (i.e., a possible overflow of up to 223
	 bytes). The SSID buffer is within struct p2p_device that is allocated
	 from heap. The overflow can override couple of variables in the struct,
	 including a pointer that gets freed. In addition about 150 bytes (the
	 exact length depending on architecture) can be written beyond the end of
	 the heap allocation.
	 This could result in corrupted state in heap, unexpected program
	 behavior due to corrupted P2P peer device information, denial of service
	 due to wpa_supplicant process crash, exposure of memory contents during
	 GO Negotiation, and potentially arbitrary code execution.
	 Vulnerable versions/configurations
	 wpa_supplicant v1.0-v2.4 with CONFIG_P2P build option enabled
	 (which is not compiled by default).
	 Attacker (or a system controlled by the attacker) needs to be within
	 radio range of the vulnerable system to send a suitably constructed
	 management frame that triggers a P2P peer device information to be
	 created or updated.
	 The vulnerability is easiest to exploit while the device has started an
	 active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control
	 interface command in progress). However, it may be possible, though
	 significantly more difficult, to trigger this even without any active
	 P2P operation in progress.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1863</cvename>
 <url>http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt</url>
 </references>
 <dates>
 <discovery>2015-04-22</discovery>
 <entry>2015-04-25</entry>
 </dates>
 </vuln>

<vuln vid="1e232a0c-eb57-11e4-b595-4061861086c1">
 <topic>Several vulnerabilities found in PHP</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.4.40</lt></range>
 </package>
 <package>
	<name>php55</name>
	<range><lt>5.5.24</lt></range>
 </package>
 <package>
	<name>php56</name>
	<range><lt>5.6.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP project reports:
	<blockquote cite="http://php.net/archive/2015.php#id2015-04-16-2">
	 The PHP development team announces the immediate
	 availability of PHP 5.4.40. 14 security-related
	 bugs were fixed in this release, including
	 CVE-2014-9709, CVE-2015-2301, CVE-2015-2783,
	 CVE-2015-1352. All PHP 5.4 users are encouraged to
	 upgrade to this version.
	 The PHP development team announces the immediate
	 availability of PHP 5.5.24. Several bugs have been
	 fixed, some of them being security related, like
	 CVE-2015-1351 and CVE-2015-1352. All PHP 5.5 users
	 are encouraged to upgrade to this version.
	 The PHP development team announces the immediate
	 availability of PHP 5.6.8. Several bugs have been
	 fixed, some of them being security related, like
	 CVE-2015-1351 and CVE-2015-1352. All PHP 5.6 users
	 are encouraged to upgrade to this version.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://php.net/archive/2015.php#id2015-04-16-2</url>
 <cvename>CVE-2014-9709</cvename>
 <cvename>CVE-2015-2301</cvename>
 <cvename>CVE-2015-2783</cvename>
 <cvename>CVE-2015-1351</cvename>
 <cvename>CVE-2015-1352</cvename>
 <freebsdpr>ports/199585</freebsdpr>
 </references>
 <dates>
 <discovery>2015-04-16</discovery>
 <entry>2015-04-25</entry>
 <modified>2015-05-22</modified>
 </dates>
 </vuln>

<vuln vid="505904d3-ea95-11e4-beaf-bcaec565249c">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>4.1.2</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<range><lt>4.1.2</lt></range>
 </package>
 <package>
	<name>ja-wordpress</name>
	<range><lt>4.1.2</lt></range>
 </package>
 <package>
	<name>ru-wordpress</name>
	<range><lt>4.1.2</lt></range>
 </package>
 <package>
	<name>zh-wordpress-zh_CN</name>
	<range><lt>4.1.2</lt></range>
 </package>
 <package>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>4.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gary Pendergast reports:
	<blockquote cite="https://wordpress.org/news/2015/04/wordpress-4-1-2/">
	 WordPress 4.1.2 is now available. This is a critical security
	 release for all previous versions and we strongly encourage you
	 to update your sites immediately.
	 WordPress versions 4.1.1 and earlier are affected by a critical
	 cross-site scripting vulnerability, which could enable anonymous
	 users to compromise a site. This was reported by Cedric Van
	 Bockhaven and fixed by Gary Pendergast, Mike Adams, and Andrew
	 Nacin of the WordPress security team.
	 We also fixed three other security issues:
	 <ul>
	 <li>In WordPress 4.1 and higher, files with invalid or unsafe
	 names could be uploaded. Discovered by Michael Kapfer and
	 Sebastian Kraemer of HSASec.</li>
	 <li>In WordPress 3.9 and higher, a very limited cross-site
	 scripting vulnerability could be used as part of a social
	 engineering attack. Discovered by Jakub Zoczek.</li>
	 <li>Some plugins were vulnerable to an SQL injection
	 vulnerability. Discovered by Ben Bidner of the WordPress
	 security team.</li>
	 </ul>
	 We also made four hardening changes, discovered by J.D. Grimes,
	 Divyesh Prajapati, Allan Collins, Marc-Alexandre Montpas and
	 Jeff Bowen.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wordpress.org/news/2015/04/wordpress-4-1-2/</url>
 </references>
 <dates>
 <discovery>2015-04-21</discovery>
 <entry>2015-04-24</entry>
 <modified>2015-04-24</modified>
 </dates>
 </vuln>

<vuln vid="82595123-e8b8-11e4-a008-047d7b492d07">
 <topic>libtasn1 -- stack-based buffer overflow in asn1_der_decoding</topic>
 <affects>
 <package>
	<name>libtasn1</name>
	<range><lt>4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian reports:
	<blockquote cite="https://www.debian.org/security/2015/dsa-3220.en.html">
	 Hanno Boeck discovered a stack-based buffer overflow in
	 the asn1_der_decoding function in Libtasn1, a library to
	 manage ASN.1 structures. A remote attacker could take advantage
	 of this flaw to cause an application using the Libtasn1 library
	 to crash, or potentially to execute arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2806</cvename>
 <url>https://www.debian.org/security/2015/dsa-3220.en.html</url>
 </references>
 <dates>
 <discovery>2015-04-11</discovery>
 <entry>2015-04-22</entry>
 </dates>
 </vuln>

<vuln vid="738fc80d-5f13-4ccb-aa9a-7965699e5a10">
 <topic>mozilla -- use-after-free</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>37.0.2,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>37.0.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
	 MFSA 2015-45 Memory corruption during failed plugin
	 initialization
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-2706</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-45/</url>
 </references>
 <dates>
 <discovery>2015-04-20</discovery>
 <entry>2015-04-21</entry>
 </dates>
 </vuln>

<vuln vid="dec3164f-3121-45ef-af18-bb113ac5082f">
 <topic>sqlite -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>sqlite3</name>
	<range><lt>3.8.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3414">
	 SQLite before 3.8.9 does not properly implement the
	 dequoting of collation-sequence names, which allows
	 context-dependent attackers to cause a denial of service
	 (uninitialized memory access and application crash) or
	 possibly have unspecified other impact via a crafted
	 COLLATE clause, as demonstrated by COLLATE"""""""" at the
	 end of a SELECT statement.
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3415">
	 The sqlite3VdbeExec function in vdbe.c in SQLite before
	 3.8.9 does not properly implement comparison operators,
	 which allows context-dependent attackers to cause a denial
	 of service (invalid free operation) or possibly have
	 unspecified other impact via a crafted CHECK clause, as
	 demonstrated by CHECK(0&amp;O&gt;O) in a CREATE TABLE statement.
	 
	</blockquote>
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3416">
	 The sqlite3VXPrintf function in printf.c in SQLite before
	 3.8.9 does not properly handle precision and width values
	 during floating-point conversions, which allows
	 context-dependent attackers to cause a denial of service
	 (integer overflow and stack-based buffer overflow) or
	 possibly have unspecified other impact via large integers
	 in a crafted printf function call in a SELECT statement.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-3414</cvename>
 <cvename>CVE-2015-3415</cvename>
 <cvename>CVE-2015-3416</cvename>
 <url>https://www.sqlite.org/src/info/eddc05e7bb31fae7</url>
 <url>https://www.sqlite.org/src/info/02e3c88fbf6abdcf</url>
 <url>https://www.sqlite.org/src/info/c494171f77dc2e5e</url>
 <mlist>http://seclists.org/fulldisclosure/2015/Apr/31</mlist>
 </references>
 <dates>
 <discovery>2015-04-14</discovery>
 <entry>2015-04-18</entry>
 <modified>2015-05-08</modified>
 </dates>
 </vuln>

<vuln vid="c4571ca8-053d-44c9-ab3c-89b1372ad0a5">
 <topic>chrony -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chrony</name>
	<range><lt>1.31.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrony News reports:
	<blockquote cite="http://chrony.tuxfamily.org/News.html">
	 CVE-2015-1853: DoS attack on authenticated symmetric NTP
	 associations
	 CVE-2015-1821: Heap-based buffer overflow in access
	 configuration
	 CVE-2015-1822: Use of uninitialized pointer in command
	 processing
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://chrony.tuxfamily.org/News.html</url>
 <cvename>CVE-2015-1821</cvename>
 <cvename>CVE-2015-1822</cvename>
 <cvename>CVE-2015-1853</cvename>
 </references>
 <dates>
 <discovery>2015-02-17</discovery>
 <entry>2015-04-18</entry>
 </dates>
 </vuln>

<vuln vid="e426eda9-dae1-11e4-8107-94de806b0af9">
 <topic>Dulwich -- Remote code execution</topic>
 <affects>
 <package>
	<name>py27-dulwich</name>
	<range><lt>0.9.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0838">
	 Buffer overflow in the C implementation of the apply_delta
	 function in _pack.c in Dulwich before 0.9.9 allows remote
	 attackers to execute arbitrary code via a crafted pack file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0838</cvename>
 </references>
 <dates>
 <discovery>2015-01-07</discovery>
 <entry>2015-04-17</entry>
 </dates>
 </vuln>

<vuln vid="3364d497-e4e6-11e4-a265-c485083ca99c">
 <topic>Adobe Flash Player -- critical vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<range><le>11.2r202.451</le></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><le>11.2r202.451</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-06.html">
	 
	 Adobe has released security updates for Adobe Flash Player for
	 Windows, Macintosh and Linux. These updates address vulnerabilities
	 that could potentially allow an attacker to take control of the
	 affected system. Adobe is aware of a report that an exploit for
	 CVE-2015-3043 exists in the wild, and recommends users update their
	 product installations to the latest versions.
	 
	 <ul>
	 <li>
	 These updates resolve memory corruption vulnerabilities that could
	 lead to code execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352,
	 CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360,
	 CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043).
	 </li>
	 <li>
	 These updates resolve a type confusion vulnerability that could lead
	 to code execution (CVE-2015-0356).
	 </li>
	 <li>
	 These updates resolve a buffer overflow vulnerability that could
	 lead to code execution (CVE-2015-0348).
	 </li>
	 <li>
	 These updates resolve use-after-free vulnerabilities that could lead
	 to code execution (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358,
	 CVE-2015-3039).
	 </li>
	 <li>
	 These updates resolve double-free vulnerabilities that could lead to
	 code execution (CVE-2015-0346, CVE-2015-0359).
	 </li>
	 <li>
	 These updates resolve memory leak vulnerabilities that could be used
	 to bypass ASLR (CVE-2015-0357, CVE-2015-3040).
	 </li>
	 <li>
	 These updates resolve a security bypass vulnerability that could
	 lead to information disclosure (CVE-2015-3044).
	 </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb15-06.html</url>
 <cvename>CVE-2015-3038</cvename>
 <cvename>CVE-2015-3039</cvename>
 <cvename>CVE-2015-3040</cvename>
 <cvename>CVE-2015-3041</cvename>
 <cvename>CVE-2015-3042</cvename>
 <cvename>CVE-2015-3043</cvename>
 <cvename>CVE-2015-3044</cvename>
 <cvename>CVE-2015-0346</cvename>
 <cvename>CVE-2015-0347</cvename>
 <cvename>CVE-2015-0348</cvename>
 <cvename>CVE-2015-0349</cvename>
 <cvename>CVE-2015-0350</cvename>
 <cvename>CVE-2015-0351</cvename>
 <cvename>CVE-2015-0352</cvename>
 <cvename>CVE-2015-0353</cvename>
 <cvename>CVE-2015-0354</cvename>
 <cvename>CVE-2015-0355</cvename>
 <cvename>CVE-2015-0356</cvename>
 <cvename>CVE-2015-0357</cvename>
 <cvename>CVE-2015-0358</cvename>
 <cvename>CVE-2015-0359</cvename>
 <cvename>CVE-2015-0360</cvename>
 </references>
 <dates>
 <discovery>2015-04-14</discovery>
 <entry>2015-04-17</entry>
 </dates>
 </vuln>

<vuln vid="ba326a36-5f02-452d-a215-31e7b06d5edf">
 <topic>Wesnoth -- Remote information disclosure</topic>
 <affects>
 <package>
	<name>wesnoth</name>
	<name>wesnoth-devel</name>
	<range><ge>1.7.0</ge><lt>1.12.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US-CERT/NIST reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0844">
	 The WML/Lua API in Battle for Wesnoth 1.7.x through
	 1.11.x and 1.12.x before 1.12.2 allows remote attackers to
	 read arbitrary files via a crafted (1) campaign or (2) map
	 file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0844</cvename>
 </references>
 <dates>
 <discovery>2015-04-11</discovery>
 <entry>2015-04-17</entry>
 </dates>
 </vuln>

<vuln vid="5713bfda-e27d-11e4-b2ce-5453ed2e2b49">
 <topic>qt4-imageformats, qt4-gui, qt5-gui -- Multiple Vulnerabilities in Qt Image Format Handling</topic>
 <affects>
 <package>
	<name>qt4-imageformats</name>
	<range><lt>4.8.6_3</lt></range>
 </package>
 <package>
	<name>qt4-gui</name>
	<range><lt>4.8.6_5</lt></range>
 </package>
 <package>
	<name>qt5-gui</name>
	<range><lt>5.4.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Richard J. Moore reports:
	<blockquote cite="http://lists.qt-project.org/pipermail/announce/2015-April/000067.html">
	 Due to two recent vulnerabilities identified in the built-in image
	 format handling code, it was decided that this area required further
	 testing to determine if further issues remained. Fuzzing using
	 afl-fuzz located a number of issues in the handling of BMP, ICO and
	 GIF files. The issues exposed included denial of service and buffer
	 overflows leading to heap corruption. It is possible the latter could
	 be used to perform remote code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist>http://lists.qt-project.org/pipermail/announce/2015-April/000067.html</mlist>
 <cvename>CVE-2015-1858</cvename>
 <cvename>CVE-2015-1859</cvename>
 <cvename>CVE-2015-1860</cvename>
 </references>
 <dates>
 <discovery>2015-04-12</discovery>
 <entry>2015-04-14</entry>
 </dates>
 </vuln>

<vuln vid="d4379f59-3e9b-49eb-933b-61de4d0b0fdb">
 <topic>Ruby -- OpenSSL Hostname Verification Vulnerability</topic>
 <affects>
 <package>
	<name>ruby</name>
	<name>ruby20</name>
	<range><ge>2.0,1</ge><lt>2.0.0.645,1</lt></range>
 </package>
 <package>
	<name>ruby</name>
	<name>ruby21</name>
	<range><ge>2.1,1</ge><lt>2.1.6,1</lt></range>
 </package>
 <package>
	<name>ruby</name>
	<name>ruby22</name>
	<range><ge>2.2,1</ge><lt>2.2.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby Developers report:
	<blockquote cite="https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/">
	 After reviewing RFC 6125 and RFC 5280, we found multiple violations
	 of matching hostnames and particularly wildcard certificates.
	 Ruby’s OpenSSL extension will now provide a string-based matching
	 algorithm which follows more strict behavior, as recommended by
	 these RFCs. In particular, matching of more than one wildcard per
	 subject/SAN is no-longer allowed. As well, comparison of these
	 values are now case-insensitive.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/</url>
 <cvename>CVE-2015-1855</cvename>
 </references>
 <dates>
 <discovery>2015-04-13</discovery>
 <entry>2015-04-14</entry>
 <modified>2015-09-23</modified>
 </dates>
 </vuln>

<vuln vid="a5f160fa-deee-11e4-99f8-080027ef73ec">
 <topic>mailman -- path traversal vulnerability</topic>
 <affects>
 <package>
	<name>mailman</name>
	<range><lt>2.1.20</lt></range>
 </package>
 <package>
	<name>mailman-with-htdig</name>
	<range><lt>2.1.20</lt></range>
 </package>
 <package>
	<name>ja-mailman</name>
	<range><lt>2.1.14.j7_2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mark Sapiro reports:
	<blockquote cite="https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html">
	 A path traversal vulnerability has been discovered and fixed. This
	 vulnerability is only exploitable by a local user on a Mailman
	 server where the suggested Exim transport, the Postfix
	 postfix_to_mailman.py transport or some other programmatic MTA
	 delivery not using aliases is employed.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html</url>
 <url>https://bugs.launchpad.net/mailman/+bug/1437145</url>
 <cvename>CVE-2015-2775</cvename>
 </references>
 <dates>
 <discovery>2015-03-27</discovery>
 <entry>2015-04-09</entry>
 <modified>2015-06-17</modified>
 </dates>
 </vuln>

<vuln vid="5fee3f02-de37-11e4-b7c3-001999f8d30b">
 <topic>asterisk -- TLS Certificate Common name NULL byte exploit</topic>
 <affects>
 <package>
	<name>asterisk</name>
	<range><lt>1.8.32.3</lt></range>
 </package>
 <package>
	<name>asterisk11</name>
	<range><lt>11.17.1</lt></range>
 </package>
 <package>
	<name>asterisk13</name>
	<range><lt>13.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 When Asterisk registers to a SIP TLS device and and
	 verifies the server, Asterisk will accept signed certificates
	 that match a common name other than the one Asterisk is
	 expecting if the signed certificate has a common name
	 containing a null byte after the portion of the common
	 name that Asterisk expected. For example, if Asterisk is
	 trying to register to www.domain.com, Asterisk will accept
	 certificates of the form
	 www.domain.com\x00www.someotherdomain.com
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2015-003.html</url>
 <cvename>CVE-2015-3008</cvename>
 </references>
 <dates>
 <discovery>2015-04-04</discovery>
 <entry>2015-04-08</entry>
 </dates>
 </vuln>

<vuln vid="ebd84c96-dd7e-11e4-854e-3c970e169bc2">
 <topic>ntp -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ntp</name>
	<range><lt>4.2.8p2</lt></range>
 </package>
 <package>
	<name>ntp-devel</name>
	<range><lt>4.3.14</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_9</lt></range>
	<range><ge>9.3</ge><lt>9.3_13</lt></range>
	<range><ge>8.4</ge><lt>8.4_27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ntp.org reports:
	<blockquote cite="http://archive.ntp.org/ntp4/ChangeLog-stable">
	 <ul>
	 <li>[Sec 2779] ntpd accepts unauthenticated packets
	 with symmetric key crypto.</li>
	 <li>[Sec 2781] Authentication doesn't protect symmetric
	 associations against DoS attacks.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-15:07.ntp</freebsdsa>
 <cvename>CVE-2015-1798</cvename>
 <cvename>CVE-2015-1799</cvename>
 <url>http://archive.ntp.org/ntp4/ChangeLog-stable</url>
 </references>
 <dates>
 <discovery>2015-04-07</discovery>
 <entry>2015-04-07</entry>
 </dates>
 </vuln>

<vuln vid="b8321d76-24e7-4b72-a01d-d12c4445d826">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>37.0.1,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>37.0.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
	 MFSA 2015-44 Certificate verification bypass through the
	 HTTP/2 Alt-Svc header
	 MFSA 2015-43 Loading privileged content through Reader
	 mode
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0798</cvename>
 <cvename>CVE-2015-0799</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-43/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-44/</url>
 <url>https://www.mozilla.org/security/advisories/</url>
 </references>
 <dates>
 <discovery>2015-04-03</discovery>
 <entry>2015-04-04</entry>
 </dates>
 </vuln>

<vuln vid="2f75141c-da1d-11e4-8d32-5404a68ad561">
 <topic>Several vulnerabilities in libav</topic>
 <affects>
 <package>
	<name>libav</name>
	<range><lt>11.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The libav project reports:
	<blockquote cite="https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.3">
	 utvideodec: Handle slice_height being zero (CVE-2014-9604)
	 tiff: Check that there is no aliasing in pixel format selection (CVE-2014-8544)
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.3</url>
 <cvename>CVE-2014-8544</cvename>
 <cvename>CVE-2014-9604</cvename>
 </references>
 <dates>
 <discovery>2015-03-24</discovery>
 <entry>2015-04-03</entry>
 </dates>
 </vuln>

<vuln vid="742563d4-d776-11e4-b595-4061861086c1">
 <topic>Several vulnerabilities found in PHP</topic>
 <affects>
 <package>
	<name>php53</name>
	<range><le>5.3.29_5</le></range>
 </package>
 <package>
	<name>php5</name>
	<range><lt>5.4.39</lt></range>
 </package>
 <package>
	<name>php55</name>
	<range><lt>5.5.23</lt></range>
 </package>
 <package>
	<name>php56</name>
	<range><lt>5.6.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP project reports:
	<blockquote cite="http://php.net/archive/2015.php#id2015-03-20-2">
	 The PHP development team announces the immediate
	 availability of PHP 5.6.7. Several bugs have been
	 fixed as well as CVE-2015-0231, CVE-2015-2305 and
	 CVE-2015-2331. All PHP 5.6 users are encouraged to
	 upgrade to this version.
	 The PHP development team announces the immediate
	 availability of PHP 5.5.23. Several bugs have been
	 fixed as well as CVE-2015-0231, CVE-2015-2305 and
	 CVE-2015-2331. All PHP 5.5 users are encouraged
	 to upgrade to this version.
	 The PHP development team announces the immediate
	 availability of PHP 5.4.39. Six security-related
	 bugs were fixed in this release, including
	 CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331.
	 All PHP 5.4 users are encouraged to upgrade to
	 this version.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://php.net/archive/2015.php#id2015-03-20-2</url>
 <cvename>CVE-2015-0231</cvename>
 <cvename>CVE-2015-2305</cvename>
 <cvename>CVE-2015-2311</cvename>
 <freebsdpr>ports/198739</freebsdpr>
 </references>
 <dates>
 <discovery>2015-03-19</discovery>
 <entry>2015-04-01</entry>
 </dates>
 </vuln>

<vuln vid="8e887b71-d769-11e4-b1c2-20cf30e32f6d">
 <topic>subversion -- DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>mod_dav_svn</name>
	<range><ge>1.5.0</ge><lt>1.7.20</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.13</lt></range>
 </package>
 <package>
	<name>subversion16</name>
	<range><ge>1.0.0</ge><lt>1.7.20</lt></range>
 </package>
 <package>
	<name>subversion17</name>
	<range><ge>1.0.0</ge><lt>1.7.20</lt></range>
 </package>
 <package>
	<name>subversion</name>
	<range><ge>1.0.0</ge><lt>1.7.20</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion Project reports:
	<blockquote cite="http://subversion.apache.org/security/">
	 Subversion HTTP servers with FSFS repositories are vulnerable to a remotely
	 triggerable excessive memory use with certain REPORT requests.
	 Subversion mod_dav_svn and svnserve are vulnerable to a remotely triggerable
	 assertion DoS vulnerability for certain requests with dynamically evaluated
	 revision numbers.
	 Subversion HTTP servers allow spoofing svn:author property values for new
	 revisions.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://subversion.apache.org/security/</url>
 <cvename>CVE-2015-0202</cvename>
 <cvename>CVE-2015-0248</cvename>
 <cvename>CVE-2015-0251</cvename>
 <url>http://subversion.apache.org/security/CVE-2015-0202-advisory.txt</url>
 <url>http://subversion.apache.org/security/CVE-2015-0248-advisory.txt</url>
 <url>http://subversion.apache.org/security/CVE-2015-0251-advisory.txt</url>
 </references>
 <dates>
 <discovery>2015-03-31</discovery>
 <entry>2015-03-31</entry>
 </dates>
 </vuln>

<vuln vid="d0c97697-df2c-4b8b-bff2-cec24dc35af8">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>37.0,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>31.6.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>37.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.34</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>31.6.0</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.34</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>31.6.0</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>31.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
	 MFSA-2015-30 Miscellaneous memory safety hazards (rv:37.0
	 / rv:31.6)
	 MFSA-2015-31 Use-after-free when using the Fluendo MP3
	 GStreamer plugin
	 MFSA-2015-32 Add-on lightweight theme installation
	 approval bypassed through MITM attack
	 MFSA-2015-33 resource:// documents can load privileged
	 pages
	 MFSA-2015-34 Out of bounds read in QCMS library
	 MFSA-2015-35 Cursor clickjacking with flash and images
	 MFSA-2015-36 Incorrect memory management for simple-type
	 arrays in WebRTC
	 MFSA-2015-37 CORS requests should not follow 30x
	 redirections after preflight
	 MFSA-2015-38 Memory corruption crashes in Off Main Thread
	 Compositing
	 MFSA-2015-39 Use-after-free due to type confusion flaws
	 MFSA-2015-40 Same-origin bypass through anchor navigation
	 MFSA-2015-41 PRNG weakness allows for DNS poisoning on
	 Android
	 MFSA-2015-42 Windows can retain access to privileged
	 content on navigation to unprivileged pages
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2808</cvename>
 <cvename>CVE-2015-0800</cvename>
 <cvename>CVE-2015-0801</cvename>
 <cvename>CVE-2015-0802</cvename>
 <cvename>CVE-2015-0803</cvename>
 <cvename>CVE-2015-0804</cvename>
 <cvename>CVE-2015-0805</cvename>
 <cvename>CVE-2015-0806</cvename>
 <cvename>CVE-2015-0807</cvename>
 <cvename>CVE-2015-0808</cvename>
 <cvename>CVE-2015-0810</cvename>
 <cvename>CVE-2015-0811</cvename>
 <cvename>CVE-2015-0812</cvename>
 <cvename>CVE-2015-0813</cvename>
 <cvename>CVE-2015-0814</cvename>
 <cvename>CVE-2015-0815</cvename>
 <cvename>CVE-2015-0816</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-30/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-31/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-32/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-33/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-34/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-35/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-36/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-37/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-38/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-39/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-40/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-41/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-42/</url>
 <url>https://www.mozilla.org/security/advisories/</url>
 </references>
 <dates>
 <discovery>2015-03-31</discovery>
 <entry>2015-03-31</entry>
 </dates>
 </vuln>

<vuln vid="f450587b-d7bd-11e4-b5a4-14dae9d5a9d2">
 <topic>osc -- shell command injection via crafted _service files</topic>
 <affects>
 <package>
	<name>osc</name>
	<range><lt>0.151.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SUSE Security Update reports:
	<blockquote cite="https://www.suse.com/security/cve/CVE-2015-0778.html">
	 osc before 0.151.0 allows remote attackers to execute
	 arbitrary commands via shell metacharacters in a _service
	 file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0778</cvename>
 <url>https://www.suse.com/security/cve/CVE-2015-0778.html</url>
 <url>https://bugzilla.suse.com/show_bug.cgi?id=901643</url>
 <url>http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00012.html</url>
 </references>
 <dates>
 <discovery>2015-03-16</discovery>
 <entry>2015-03-31</entry>
 </dates>
 </vuln>

<vuln vid="72ee9707-d7b2-11e4-8d8e-f8b156b6dcc8">
 <topic>cpio -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gcpio</name>
	<range><lt>2.11_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	From the Debian Security Team:
	<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2014-9112">
	 Heap-based buffer overflow in the process_copy_in
	 function in GNU Cpio 2.11 allows remote attackers to cause
	 a denial of service via a large block value in a cpio
	 archive.
	</blockquote>
	<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2015-1197">
	 cpio 2.11, when using the --no-absolute-filenames
	 option, allows local users to write to arbitrary files
	 via a symlink attack on a file in an archive.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-9112</cvename>
 <url>https://security-tracker.debian.org/tracker/CVE-2014-9112</url>
 <cvename>CVE-2015-1197</cvename>
 <url>https://bugzilla.suse.com/show_bug.cgi?id=658010</url>
 </references>
 <dates>
 <discovery>2015-03-27</discovery>
 <entry>2015-03-31</entry>
 </dates>
 </vuln>

<vuln vid="264749ae-d565-11e4-b545-00269ee29e57">
 <topic>libzip -- integer overflow</topic>
 <affects>
 <package>
	<name>libzip</name>
	<range><lt>0.11.2_2</lt></range>
 </package>
 <package>
	<name>ppsspp</name>
	<range><lt>1.0.1_5</lt></range>
 </package>
 <package>
	<name>ppsspp-devel</name>
	<range><lt>1.0.1.2668_1</lt></range>
 </package>
 <package>
	<name>radare2</name>
	<range><lt>0.9.8_1</lt></range>
 </package>
 <package>
	<name>openlierox</name>
	<range><lt>0.58.r3_5,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libzip developers report:
	<blockquote cite="http://hg.nih.at/libzip/rev/9f11d54f692e">
	 Avoid integer overflow. Fixed similarly to patch used in PHP copy of libzip.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.php.net/bug.php?id=69253</url>
 <url>https://github.com/php/php-src/commit/ef8fc4b53d92fbfcd8ef1abbd6f2f5fe2c4a11e5</url>
 <url>http://hg.nih.at/libzip/rev/9f11d54f692e</url>
 <cvename>CVE-2015-2331</cvename>
 </references>
 <dates>
 <discovery>2015-03-18</discovery>
 <entry>2015-03-28</entry>
 <modified>2015-09-20</modified>
 </dates>
 </vuln>

<vuln vid="62287f51-d43d-11e4-879c-00e0814cab4e">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-django</name>
	<range><ge>1.4</ge><lt>1.4.20</lt></range>
	<range><ge>1.6</ge><lt>1.6.11</lt></range>
	<range><ge>1.7</ge><lt>1.7.7</lt></range>
 </package>
 <package>
	<name>py32-django</name>
	<range><ge>1.4</ge><lt>1.4.20</lt></range>
	<range><ge>1.6</ge><lt>1.6.11</lt></range>
	<range><ge>1.7</ge><lt>1.7.7</lt></range>
 </package>
 <package>
	<name>py33-django</name>
	<range><ge>1.4</ge><lt>1.4.20</lt></range>
	<range><ge>1.6</ge><lt>1.6.11</lt></range>
	<range><ge>1.7</ge><lt>1.7.7</lt></range>
 </package>
 <package>
	<name>py34-django</name>
	<range><ge>1.4</ge><lt>1.4.20</lt></range>
	<range><ge>1.6</ge><lt>1.6.11</lt></range>
	<range><ge>1.7</ge><lt>1.7.7</lt></range>
 </package>
 <package>
	<name>py27-django-devel</name>
	<range><lt>20150326,1</lt></range>
 </package>
 <package>
	<name>py32-django-devel</name>
	<range><lt>20150326,1</lt></range>
 </package>
 <package>
	<name>py33-django-devel</name>
	<range><lt>20150326,1</lt></range>
 </package>
 <package>
	<name>py34-django-devel</name>
	<range><lt>20150326,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Django project reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2015/mar/18/security-releases/">
	 In accordance with our security release policy, the Django team
	 is issuing multiple releases -- Django 1.4.20, 1.6.11, 1.7.7 and
	 1.8c1. These releases are now available on PyPI and our download
	 page. These releases address several security issues detailed
	 below. We encourage all users of Django to upgrade as soon as
	 possible. The Django master branch has also been updated.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2015/mar/18/security-releases/</url>
 <cvename>CVE-2015-2316</cvename>
 <cvename>CVE-2015-2317</cvename>
 </references>
 <dates>
 <discovery>2015-03-18</discovery>
 <entry>2015-03-27</entry>
 </dates>
 </vuln>

<vuln vid="f6a014cd-d268-11e4-8339-001e679db764">
 <topic>GNU binutils -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cross-binutils</name>
	<range><lt>2.25</lt></range>
 </package>
 <package>
	<name>x86_64-pc-mingw32-binutils</name>
	<range><lt>2.25</lt></range>
 </package>
 <package>
	<name>m6811-binutils</name>
	<range><lt>2.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US-CERT/NIST reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8501">
	 The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU
	 binutils 2.24 and earlier allows remote attackers to cause a
	 denial of service (out-of-bounds write) and possibly have other
	 unspecified impact via a crafted NumberOfRvaAndSizes field in the
	 AOUT header in a PE executable.
	</blockquote>
	US-CERT/NIST reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8502">
	 Heap-based buffer overflow in the pe_print_edata function in
	 bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote
	 attackers to cause a denial of service (crash) and possibly have
	 other unspecified impact via a truncated export table in a PE
	 file.
	</blockquote>
	US-CERT/NIST reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8503">
	 Stack-based buffer overflow in the ihex_scan function in
	 bfd/ihex.c in GNU binutils 2.24 and earlier allows remote
	 attackers to cause a denial of service (crash) and possibly have
	 other unspecified impact via a crafted ihex file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8501</cvename>
 <cvename>CVE-2014-8502</cvename>
 <cvename>CVE-2014-8503</cvename>
 <url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8501</url>
 <url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8502</url>
 <url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8503</url>
 </references>
 <dates>
 <discovery>2014-12-09</discovery>
 <entry>2015-03-24</entry>
 <modified>2016-01-08</modified>
 </dates>
 </vuln>

<vuln vid="996bce94-d23d-11e4-9463-9cb654ea3e1c">
 <topic>libuv -- incorrect revocation order while relinquishing privileges</topic>
 <affects>
 <package>
	<name>node010</name>
	<range><lt>0.10.36</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nodejs releases reports:
	<blockquote cite="http://blog.nodejs.org/2015/03/14/node-v0-10-37-stable">
	 <h5>CVE-2015-0278</h5>
	 This may potentially allow an attacker to gain elevated privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.nodejs.org/2015/03/14/node-v0-10-37-stable</url>
 <freebsdpr>ports/198861</freebsdpr>
 <cvename>CVE-2015-0278</cvename>
 </references>
 <dates>
 <discovery>2015-03-14</discovery>
 <entry>2015-03-24</entry>
 </dates>
 </vuln>

<vuln vid="22dc4a22-d1e5-11e4-879c-00e0814cab4e">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><le>1.605</le></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><le>1.596.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23">
	 <h1>Description</h1>
	 <h5>SECURITY-171, SECURITY-177 (Reflective XSS vulnerability)</h5>
	 An attacker without any access to Jenkins can navigate the user
	 to a carefully crafted URL and have the user execute unintended
	 actions. This vulnerability can be used to attack Jenkins inside
	 firewalls from outside so long as the location of Jenkins is known
	 to the attacker.
	 <h5>SECURITY-180 (forced API token change)</h5>
	 The part of Jenkins that issues a new API token was not
	 adequately protected against anonymous attackers. This allows an
	 attacker to escalate privileges on Jenkins.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23</url>
 </references>
 <dates>
 <discovery>2015-03-23</discovery>
 <entry>2015-03-24</entry>
 </dates>
 </vuln>

<vuln vid="76ff65f4-17ca-4d3f-864a-a3d6026194fb">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>36.0.4,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>31.5.3,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>36.0.4,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.33.1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.33.1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>31.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
	 MFSA-2015-28 Privilege escalation through SVG navigation
	 MFSA-2015-29 Code execution through incorrect JavaScript
	 bounds checking elimination
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0817</cvename>
 <cvename>CVE-2015-0818</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-28/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-29/</url>
 <url>https://www.mozilla.org/security/advisories/</url>
 </references>
 <dates>
 <discovery>2015-03-20</discovery>
 <entry>2015-03-22</entry>
 </dates>
 </vuln>

<vuln vid="9d15355b-ce7c-11e4-9db0-d050992ecde8">
 <topic>OpenSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_19</lt></range>
 </package>
 <package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1m</lt></range>
 </package>
 <package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_4</lt></range>
 </package>
 <package>
	<name>libressl</name>
	<range><le>2.1.5_1</le></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_8</lt></range>
	<range><ge>9.3</ge><lt>9.3_12</lt></range>
	<range><ge>8.4</ge><lt>8.4_26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv_20150319.txt">
	 <ul>
	 <li>Reclassified: RSA silently downgrades to EXPORT_RSA
	 [Client] (CVE-2015-0204). OpenSSL only.</li>
	 <li>Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)</li>
	 <li>ASN.1 structure reuse memory corruption (CVE-2015-0287)</li>
	 <li>PKCS#7 NULL pointer dereferences (CVE-2015-0289)</li>
	 <li>Base64 decode (CVE-2015-0292). OpenSSL only.</li>
	 <li>DoS via reachable assert in SSLv2 servers
	 (CVE-2015-0293). OpenSSL only.</li>
	 <li>Use After Free following d2i_ECPrivatekey error
	 (CVE-2015-0209)</li>
	 <li>X509_to_X509_REQ NULL pointer deref (CVE-2015-0288)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-15:06.openssl</freebsdsa>
 <freebsdpr>ports/198681</freebsdpr>
 <cvename>CVE-2015-0204</cvename>
 <cvename>CVE-2015-0286</cvename>
 <cvename>CVE-2015-0287</cvename>
 <cvename>CVE-2015-0289</cvename>
 <cvename>CVE-2015-0292</cvename>
 <cvename>CVE-2015-0293</cvename>
 <cvename>CVE-2015-0209</cvename>
 <cvename>CVE-2015-0288</cvename>
 <url>https://www.openssl.org/news/secadv_20150319.txt</url>
 </references>
 <dates>
 <discovery>2015-03-19</discovery>
 <entry>2015-03-19</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="f7d79fac-cd49-11e4-898f-bcaec565249c">
 <topic>libXfont -- BDF parsing issues</topic>
 <affects>
 <package>
	<name>libXfont</name>
	<range><lt>1.5.1</lt></range>
 </package>
 <package>
	<name>linux-c6-xorg-libs</name>
	<range><lt>7.4_4</lt></range>
 </package>
 <package>
	<name>linux-f10-xorg-libs</name>
	<range><lt>7.4_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Alan Coopersmith reports:
	<blockquote cite="http://lists.x.org/archives/xorg-announce/2015-March/002550.html">
	 Ilja van Sprundel, a security researcher with IOActive, has
	 discovered an issue in the parsing of BDF font files by libXfont.
	 Additional testing by Alan Coopersmith and William Robinet with
	 the American Fuzzy Lop (afl) tool uncovered two more issues in
	 the parsing of BDF font files.

As libXfont is used by the X server to read font files, and an
	 unprivileged user with access to the X server can tell the X
	 server to read a given font file from a path of their choosing,
	 these vulnerabilities have the potential to allow unprivileged
	 users to run code with the privileges of the X server
	 (often root access).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.x.org/archives/xorg-announce/2015-March/002550.html</url>
 <cvename>CVE-2015-1802</cvename>
 <cvename>CVE-2015-1803</cvename>
 <cvename>CVE-2015-1804</cvename>
 </references>
 <dates>
 <discovery>2015-03-17</discovery>
 <entry>2015-03-18</entry>
 <modified>2016-01-31</modified>
 </dates>
 </vuln>

<vuln vid="8b3ecff5-c9b2-11e4-b71f-00bd5af88c00">
 <topic>Adobe Flash Player -- critical vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<range><le>11.2r202.442</le></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><le>11.2r202.442</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-05.html">
	 
	 Adobe has released security updates for Adobe Flash Player for
	 Windows, Macintosh and Linux. These updates address vulnerabilities
	 that could potentially allow an attacker to take control of the
	 affected system.
	 These updates resolve memory corruption vulnerabilities that could
	 lead to code execution (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335,
	 CVE-2015-0339).
	 These updates resolve type confusion vulnerabilities that could lead
	 to code execution (CVE-2015-0334, CVE-2015-0336).
	 These updates resolve a vulnerability that could lead to a
	 cross-domain policy bypass (CVE-2015-0337).
	 These updates resolve a vulnerability that could lead to a file
	 upload restriction bypass (CVE-2015-0340).
	 These updates resolve an integer overflow vulnerability that could
	 lead to code execution (CVE-2015-0338).
	 These updates resolve use-after-free vulnerabilities that could lead
	 to code execution (CVE-2015-0341, CVE-2015-0342).
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb15-05.html</url>
 <cvename>CVE-2015-0332</cvename>
 <cvename>CVE-2015-0333</cvename>
 <cvename>CVE-2015-0334</cvename>
 <cvename>CVE-2015-0335</cvename>
 <cvename>CVE-2015-0336</cvename>
 <cvename>CVE-2015-0337</cvename>
 <cvename>CVE-2015-0338</cvename>
 <cvename>CVE-2015-0339</cvename>
 <cvename>CVE-2015-0340</cvename>
 <cvename>CVE-2015-0341</cvename>
 <cvename>CVE-2015-0342</cvename>
 </references>
 <dates>
 <discovery>2015-03-12</discovery>
 <entry>2015-03-13</entry>
 </dates>
 </vuln>

<vuln vid="451a6c79-c92b-11e4-a835-000c292ee6b8">
 <topic>sympa -- Remote attackers can read arbitrary files</topic>
 <affects>
 <package>
	<name>sympa</name>
	<range><lt>6.1.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Sympa Project reports:
	<blockquote cite="https://www.sympa.org/security_advisories">
	 The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.sympa.org/security_advisories</url>
 <cvename>CVE-2015-1306</cvename>
 </references>
 <dates>
 <discovery>2015-01-13</discovery>
 <entry>2015-03-13</entry>
 </dates>
 </vuln>

<vuln vid="d08f6002-c588-11e4-8495-6805ca0b3d42">
 <topic>rt -- Remote DoS, Information disclosure and Session Hijackingvulnerabilities</topic>
 <affects>
 <package>
	<name>rt42</name>
	<range><ge>4.2.0</ge><lt>4.2.10</lt></range>
 </package>
 <package>
	<name>rt40</name>
	<range><ge>4.0.0</ge><lt>4.0.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Best Practical reports:
	<blockquote cite="http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html">
	 RT 3.0.0 and above, if running on Perl 5.14.0 or higher,
	 are vulnerable to a remote denial-of-service via the email
	 gateway; any installation which accepts mail from untrusted
	 sources is vulnerable, regardless of the permissions
	 configuration inside RT. This denial-of-service may
	 encompass both CPU and disk usage, depending on RT's logging
	 configuration. This vulnerability is assigned
	 CVE-2014-9472.
	 RT 3.8.8 and above are vulnerable to an information
	 disclosure attack which may reveal RSS feeds URLs, and thus
	 ticket data; this vulnerability is assigned
	 CVE-2015-1165. RSS feed URLs can also be leveraged to
	 perform session hijacking, allowing a user with the URL to
	 log in as the user that created the feed; this vulnerability
	 is assigned CVE-2015-1464.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html</url>
 <cvename>CVE-2014-9472</cvename>
 <cvename>CVE-2015-1165</cvename>
 <cvename>CVE-2015-1464</cvename>
 </references>
 <dates>
 <discovery>2015-02-26</discovery>
 <entry>2015-03-08</entry>
 </dates>
 </vuln>

<vuln vid="81b4c118-c586-11e4-8495-6805ca0b3d42">
 <topic>phpMyAdmin -- Risk of BREACH attack due to reflected parameter</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.3.0</ge><lt>4.3.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php">
	 Risk of BREACH attack due to reflected parameter.
	 With a large number of crafted requests it was possible to infer
	 the CSRF token by a BREACH attack.
	 Mitigation factor: this vulnerability can only be exploited in
	 the presence of another vulnerability that allows the attacker to
	 inject JavaScript into victim's browser.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php</url>
 <cvename>CVE-2015-2206</cvename>
 </references>
 <dates>
 <discovery>2015-03-04</discovery>
 <entry>2015-03-08</entry>
 </dates>
 </vuln>

<vuln vid="c0cae920-c4e9-11e4-898e-90e6ba741e35">
 <topic>mono -- TLS bugs</topic>
 <affects>
 <package>
	<name>mono</name>
	<range><lt>3.10.1</lt></range>
	<range><ge>3.12</ge><lt>3.12.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mono project reports:
	<blockquote cite="http://www.mono-project.com/docs/about-mono/vulnerabilities/#tls-bugs">
	 Mono’s implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various attacks on the protocol to succeed. Details of this vulnerability are discussed in <a href="https://www.smacktls.com/#skip">SKIP-TLS post</a>.
	 Mono’s implementation of SSL/TLS also contained support for the weak EXPORT cyphers and was susceptible to the <a href="https://www.smacktls.com/#freak">FREAK</a> attack.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.mono-project.com/docs/about-mono/vulnerabilities/#tls-bugs</url>
 </references>
 <dates>
 <discovery>2015-03-06</discovery>
 <entry>2015-03-07</entry>
 </dates>
 </vuln>

<vuln vid="92fc2e2b-c383-11e4-8ef7-080027ef73ec">
 <topic>PuTTY -- fails to scrub private keys from memory after use</topic>
 <affects>
 <package>
	<name>putty</name>
	<range><lt>0.64</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Tatham reports:
	<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html">
	 When PuTTY has sensitive data in memory and has no further need for
	 it, it should wipe the data out of its memory, in case malware later
	 gains access to the PuTTY process or the memory is swapped out to
	 disk or written into a crash dump file. An obvious example of this
	 is the password typed during SSH login; other examples include
	 obsolete session keys, public-key passphrases, and the private
	 halves of public keys.
	 PuTTY 0.63 and earlier versions, after loading a private key
	 from a disk file, mistakenly leak a memory buffer containing a
	 copy of the private key, in the function ssh2_load_userkey. The
	 companion function ssh2_save_userkey (only called by PuTTYgen) can
	 also leak a copy, but only in the case where the file it tried to
	 save to could not be created.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html</url>
 <cvename>CVE-2015-2157</cvename>
 </references>
 <dates>
 <discovery>2015-02-28</discovery>
 <entry>2015-03-05</entry>
 </dates>
 </vuln>

<vuln vid="8505e013-c2b3-11e4-875d-000c6e25e3e9">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>41.0.2272.76</lt></range>
 </package>
 <package>
	<name>chromium-npapi</name>
	<range><lt>41.0.2272.76</lt></range>
 </package>
 <package>
	<name>chromium-pulse</name>
	<range><lt>41.0.2272.76</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl">
	 51 security fixes in this release, including:
	 <ul>
	 <li>[456516] High CVE-2015-1212: Out-of-bounds write in media.
	 Credit to anonymous.</li>
	 <li>[448423] High CVE-2015-1213: Out-of-bounds write in skia
	 filters. Credit to cloudfuzzer.</li>
	 <li>[445810] High CVE-2015-1214: Out-of-bounds write in skia
	 filters. Credit to cloudfuzzer.</li>
	 <li>[445809] High CVE-2015-1215: Out-of-bounds write in skia
	 filters. Credit to cloudfuzzer.</li>
	 <li>[454954] High CVE-2015-1216: Use-after-free in v8 bindings.
	 Credit to anonymous.</li>
	 <li>[456192] High CVE-2015-1217: Type confusion in v8 bindings.
	 Credit to anonymous.</li>
	 <li>[456059] High CVE-2015-1218: Use-after-free in dom.
	 Credit to cloudfuzzer.</li>
	 <li>[446164] High CVE-2015-1219: Integer overflow in webgl.
	 Credit to Chen Zhang (demi6od) of NSFOCUS Security Team.</li>
	 <li>[437651] High CVE-2015-1220: Use-after-free in gif decoder.
	 Credit to Aki Helin of OUSPG.</li>
	 <li>[455368] High CVE-2015-1221: Use-after-free in web databases.
	 Credit to Collin Payne.</li>
	 <li>[448082] High CVE-2015-1222: Use-after-free in service workers.
	 Credit to Collin Payne.</li>
	 <li>[454231] High CVE-2015-1223: Use-after-free in dom.
	 Credit to Maksymillian Motyl.</li>
	 <li>High CVE-2015-1230: Type confusion in v8.
	 Credit to Skylined working with HP's Zero Day Initiative.</li>
	 <li>[449958] Medium CVE-2015-1224: Out-of-bounds read in vpxdecoder.
	 Credit to Aki Helin of OUSPG.</li>
	 <li>[446033] Medium CVE-2015-1225: Out-of-bounds read in pdfium.
	 Credit to cloudfuzzer.</li>
	 <li>[456841] Medium CVE-2015-1226: Validation issue in debugger.
	 Credit to Rob Wu.</li>
	 <li>[450389] Medium CVE-2015-1227: Uninitialized value in blink.
	 Credit to Christoph Diehl.</li>
	 <li>[444707] Medium CVE-2015-1228: Uninitialized value in rendering.
	 Credit to miaubiz.</li>
	 <li>[431504] Medium CVE-2015-1229: Cookie injection via proxies.
	 Credit to iliwoy.</li>
	 <li>[463349] CVE-2015-1231: Various fixes from internal audits,
	 fuzzing, and other initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1212</cvename>
 <cvename>CVE-2015-1213</cvename>
 <cvename>CVE-2015-1214</cvename>
 <cvename>CVE-2015-1215</cvename>
 <cvename>CVE-2015-1216</cvename>
 <cvename>CVE-2015-1217</cvename>
 <cvename>CVE-2015-1218</cvename>
 <cvename>CVE-2015-1219</cvename>
 <cvename>CVE-2015-1220</cvename>
 <cvename>CVE-2015-1221</cvename>
 <cvename>CVE-2015-1222</cvename>
 <cvename>CVE-2015-1223</cvename>
 <cvename>CVE-2015-1224</cvename>
 <cvename>CVE-2015-1225</cvename>
 <cvename>CVE-2015-1226</cvename>
 <cvename>CVE-2015-1227</cvename>
 <cvename>CVE-2015-1228</cvename>
 <cvename>CVE-2015-1229</cvename>
 <cvename>CVE-2015-1230</cvename>
 <cvename>CVE-2015-1231</cvename>
 <url>http://googlechromereleases.blogspot.nl</url>
 </references>
 <dates>
 <discovery>2015-03-03</discovery>
 <entry>2015-03-04</entry>
 </dates>
 </vuln>

<vuln vid="c9c3374d-c2c1-11e4-b236-5453ed2e2b49">
 <topic>qt4-gui, qt5-gui -- DoS vulnerability in the BMP image handler</topic>
 <affects>
 <package>
	<name>qt4-gui</name>
	<range><lt>4.8.6_4</lt></range>
 </package>
 <package>
	<name>qt5-gui</name>
	<range><lt>5.3.2_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Richard J. Moore reports:
	<blockquote cite="http://lists.qt-project.org/pipermail/announce/2015-February/000059.html">
	 The builtin BMP decoder in QtGui prior to Qt 5.5 contained a bug
	 that would lead to a division by zero when loading certain corrupt
	 BMP files. This in turn would cause the application loading these
	 hand crafted BMPs to crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0295</cvename>
 <mlist>http://lists.qt-project.org/pipermail/announce/2015-February/000059.html</mlist>
 </references>
 <dates>
 <discovery>2015-02-22</discovery>
 <entry>2015-03-05</entry>
 </dates>
 </vuln>

<vuln vid="7480b6ac-adf1-443e-a33c-3a3c0becba1e">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><le>1.600</le></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><le>1.580.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kohsuke Kawaguchi from Jenkins team reports:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27">
	 <h1>Description</h1>
	 <h5>SECURITY-125 (Combination filter Groovy script unsecured)</h5>
	 This vulnerability allows users with the job configuration
	 privilege to escalate his privileges, resulting in arbitrary code
	 execution to the master.
	 <h5>SECURITY-162 (directory traversal from artifacts via symlink)</h5>
	 This vulnerability allows users with the job configuration
	 privilege or users with commit access to the build script to
	 access arbitrary files/directories on the master, resulting in
	 the exposure of sensitive information, such as encryption keys.
	 <h5>SECURITY-163 (update center metadata retrieval DoS attack)</h5>
	 This vulnerability allows authenticated users to disrupt the
	 operation of Jenkins by feeding malicious update center data into
	 Jenkins, affecting plugin installation and tool installation.
	 <h5>SECURITY-165 (external entity injection via XPath)</h5>
	 This vulnerability allows users with the read access to Jenkins
	 to retrieve arbitrary XML document on the server, resulting in
	 the exposure of sensitive information inside/outside Jenkins.
	 <h5>SECURITY-166 (HudsonPrivateSecurityRealm allows creation of
	 reserved names)</h5>
	 For users using "Jenkins' own user database" setting, Jenkins
	 doesn't refuse reserved names, thus allowing privilege escalation.
	 <h5>SECURITY-167 (External entity processing in XML can reveal
	 sensitive local files)</h5>
	 This vulnerability allows attackers to create malicious XML
	 documents and feed that into Jenkins, which causes Jenkins to
	 retrieve arbitrary XML document on the server, resulting in the
	 exposure of sensitive information inside/outside Jenkins.
	 <h1>Severity</h1>
	 SECURITY-125 is rated critical. This attack can be
	 only mounted by users with some trust, but it results in arbitrary
	 code execution on the master.
	 SECURITY-162 is rated critical. This attack can be
	 only mounted by users with some trust, but it results in the
	 exposure of sensitive information.
	 SECURITY-163 is rated medium, as it results in the
	 loss of functionality.
	 SECURITY-165 is rated critical. This attack is
	 easy to mount, and it results in the exposure of sensitive
	 information.
	 SECURITY-166 is rated critical. For users who use
	 the affected feature, this attack results in arbitrary code
	 execution on the master.
	 SECURITY-167 is rated critical. This attack is
	 easy to mount, and it results in the exposure of sensitive information.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27</url>
 </references>
 <dates>
 <discovery>2015-03-01</discovery>
 <entry>2015-03-01</entry>
 </dates>
 </vuln>

<vuln vid="99029172-8253-407d-9d8b-2cfeab9abf81">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>36.0,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>31.5.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>36.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.33</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>31.5.0</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.33</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>31.5.0</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>31.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
	 MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0
	 / rv:31.5)
	 MFSA-2015-12 Invoking Mozilla updater will load locally
	 stored DLL files
	 MFSA-2015-13 Appended period to hostnames can bypass HPKP
	 and HSTS protections
	 MFSA-2015-14 Malicious WebGL content crash when writing
	 strings
	 MFSA-2015-15 TLS TURN and STUN connections silently fail
	 to simple TCP connections
	 MFSA-2015-16 Use-after-free in IndexedDB
	 MFSA-2015-17 Buffer overflow in libstagefright during MP4
	 video playback
	 MFSA-2015-18 Double-free when using non-default memory
	 allocators with a zero-length XHR
	 MFSA-2015-19 Out-of-bounds read and write while rendering
	 SVG content
	 MFSA-2015-20 Buffer overflow during CSS restyling
	 MFSA-2015-21 Buffer underflow during MP3 playback
	 MFSA-2015-22 Crash using DrawTarget in Cairo graphics
	 library
	 MFSA-2015-23 Use-after-free in Developer Console date
	 with OpenType Sanitiser
	 MFSA-2015-24 Reading of local files through manipulation
	 of form autocomplete
	 MFSA-2015-25 Local files or privileged URLs in pages can
	 be opened into new tabs
	 MFSA-2015-26 UI Tour whitelisted sites in background tab
	 can spoof foreground tabs
	 MFSA-2015-27 Caja Compiler JavaScript sandbox bypass
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0819</cvename>
 <cvename>CVE-2015-0820</cvename>
 <cvename>CVE-2015-0821</cvename>
 <cvename>CVE-2015-0822</cvename>
 <cvename>CVE-2015-0823</cvename>
 <cvename>CVE-2015-0824</cvename>
 <cvename>CVE-2015-0825</cvename>
 <cvename>CVE-2015-0826</cvename>
 <cvename>CVE-2015-0827</cvename>
 <cvename>CVE-2015-0828</cvename>
 <cvename>CVE-2015-0829</cvename>
 <cvename>CVE-2015-0830</cvename>
 <cvename>CVE-2015-0831</cvename>
 <cvename>CVE-2015-0832</cvename>
 <cvename>CVE-2015-0833</cvename>
 <cvename>CVE-2015-0834</cvename>
 <cvename>CVE-2015-0835</cvename>
 <cvename>CVE-2015-0836</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-11/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-12/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-13/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-14/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-15/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-16/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-17/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-18/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-19/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-20/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-21/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-22/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-23/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-24/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-25/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-26/</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2015-27/</url>
 <url>https://www.mozilla.org/security/advisories/</url>
 </references>
 <dates>
 <discovery>2015-02-24</discovery>
 <entry>2015-02-27</entry>
 </dates>
 </vuln>

<vuln vid="f7a9e415-bdca-11e4-970c-000c292ee6b8">
 <topic>php5 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.4.38</lt></range>
 </package>
 <package>
	<name>php55</name>
	<range><lt>5.5.22</lt></range>
 </package>
 <package>
	<name>php56</name>
	<range><lt>5.6.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP Project reports:
	<blockquote cite="http://www.php.net/ChangeLog-5.php">
	 Use after free vulnerability in unserialize() with DateTimeZone.
	 Mitigation for CVE-2015-0235 -- GHOST: glibc gethostbyname buffer
	 overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0235</cvename>
 <cvename>CVE-2015-0273</cvename>
 <url>http://php.net/ChangeLog-5.php#5.4.38</url>
 <url>http://php.net/ChangeLog-5.php#5.5.22</url>
 <url>http://php.net/ChangeLog-5.php#5.6.6</url>
 </references>
 <dates>
 <discovery>2015-02-18</discovery>
 <entry>2015-02-26</entry>
 </dates>
 </vuln>

<vuln vid="dbf9e66c-bd50-11e4-a7ba-206a8a720317">
 <topic>krb5 1.11 -- New release/fix multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>krb5-111</name>
	<range><lt>1.11.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.11.6:
	<blockquote cite="http://web.mit.edu/kerberos/krb5-1.11/README-1.11.6.txt">
	 Handle certain invalid RFC 1964 GSS tokens correctly to avoid
	 invalid memory reference vulnerabilities. [CVE-2014-4341
	 Fix memory management vulnerabilities in GSSAPI SPNEGO.
	 [CVE-2014-4343 CVE-2014-4344]
	 Fix buffer overflow vulnerability in LDAP KDB back end.
	 [CVE-2014-4345]
	 Fix multiple vulnerabilities in the LDAP KDC back end.
	 [CVE-2014-5354 CVE-2014-5353]
	 Fix multiple kadmind vulnerabilities, some of which are based
	 in the gssrpc library. [CVE-2014-5352 CVE-2014-9421
	 CVE-2014-9422 CVE-2014-9423]
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://web.mit.edu/kerberos/krb5-1.11/README-1.11.6.txt</url>
 </references>
 <dates>
 <discovery>2015-02-25</discovery>
 <entry>2015-02-25</entry>
 </dates>
 </vuln>

<vuln vid="996c219c-bbb1-11e4-88ae-d050992ecde8">
 <topic>samba -- Unexpected code execution in smbd</topic>
 <affects>
 <package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><lt>4.0.25</lt></range>
 </package>
 <package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><lt>4.1.17</lt></range>
 </package>
 <package>
	<name>samba36</name>
	<range><ge>3.6.0</ge><lt>3.6.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samba development team reports:
	<blockquote cite="https://www.samba.org/samba/security/CVE-2015-0240">
	 All versions of Samba from 3.5.0 to 4.2.0rc4 are
	 vulnerable to an unexpected code execution vulnerability
	 in the smbd file server daemon.
	 A malicious client could send packets that may set up the
	 stack in such a way that the freeing of memory in a
	 subsequent anonymous netlogon packet could allow execution
	 of arbitrary code. This code would execute with root
	 privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0240</cvename>
 <url>https://www.samba.org/samba/security/CVE-2015-0240</url>
 </references>
 <dates>
 <discovery>2015-02-23</discovery>
 <entry>2015-02-23</entry>
 </dates>
 </vuln>

<vuln vid="0f488b7b-bbb9-11e4-903c-080027ef73ec">
 <topic>e2fsprogs -- buffer overflow if s_first_meta_bg too big</topic>
 <affects>
 <package>
	<name>e2fsprogs</name>
	<range><lt>1.42.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Theodore Ts'o reports:
	<blockquote cite="http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4">
	 If s_first_meta_bg is greater than the of number block group descriptor blocks, then reading or writing the block group descriptors will end up overruning the memory buffer allocated for the descriptors.
	 The finding is credited to a vulnerability report from Jose Duart of Google Security Team &lt;jduart AT google.com&gt; and was reported through oCERT-2015-002.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4</url>
 <url>http://www.ocert.org/advisories/ocert-2015-002.html</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1187032</url>
 <cvename>CVE-2015-0247</cvename>
 </references>
 <dates>
 <discovery>2014-08-09</discovery>
 <entry>2015-02-24</entry>
 </dates>
 </vuln>

<vuln vid="2a4bcd7d-bbb8-11e4-903c-080027ef73ec">
 <topic>e2fsprogs -- potential buffer overflow in closefs()</topic>
 <affects>
 <package>
	<name>e2fsprogs</name>
	<range><lt>1.42.12_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Theodore Ts'o reports:
	<blockquote cite="http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&amp;id=49d0fe2a14f2a23da2fe299643379b8c1d37df73">
	 On a carefully crafted filesystem that gets modified through
	 tune2fs or debugfs, it is possible to trigger a buffer overrun when
	 the file system is closed via closefs().
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&amp;id=49d0fe2a14f2a23da2fe299643379b8c1d37df73</url>
 <cvename>CVE-2015-1572</cvename>
 </references>
 <dates>
 <discovery>2015-02-06</discovery>
 <entry>2015-02-24</entry>
 </dates>
 </vuln>

<vuln vid="58033a95-bba8-11e4-88ae-d050992ecde8">
 <topic>bind -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>bind910</name>
	<name>bind910-base</name>
	<range><lt>9.10.1P2</lt></range>
 </package>
 <package>
	<name>bind99</name>
	<name>bind99-base</name>
	<range><lt>9.9.6P2</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_10</lt></range>
	<range><ge>8.4</ge><lt>8.4_24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01235">
	 When configured to perform DNSSEC validation, named can
	 crash when encountering a rare set of conditions in the
	 managed trust anchors.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-15:05.bind</freebsdsa>
 <cvename>CVE-2015-1349</cvename>
 <url>https://kb.isc.org/article/AA-01235</url>
 </references>
 <dates>
 <discovery>2015-02-18</discovery>
 <entry>2015-02-23</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="63527d0d-b9de-11e4-8a48-206a8a720317">
 <topic>krb5 1.12 -- New release/fix multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>krb5-112</name>
	<range><lt>1.12.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.12.3:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt">
	 Fix multiple vulnerabilities in the LDAP KDC back end.
	 [CVE-2014-5354] [CVE-2014-5353]
	 Fix multiple kadmind vulnerabilities, some of which are based
	 in the gssrpc library. [CVE-2014-5352 CVE-2014-5352
	 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423]
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://web.mit.edu/kerberos/krb5-1.12/README-1.12.3.txt</url>
 </references>
 <dates>
 <discovery>2015-02-20</discovery>
 <entry>2015-02-21</entry>
 </dates>
 </vuln>

<vuln vid="3680b234-b6f0-11e4-b7cc-d050992ecde8">
 <topic>unzip -- heap based buffer overflow in iconv patch</topic>
 <affects>
 <package>
	<name>unzip</name>
	<range><lt>6.0_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ubuntu Security Notice USN-2502-1 reports:
	<blockquote cite="http://www.ubuntu.com/usn/usn-2502-1/">
	 unzip could be made to run programs if it opened a specially crafted file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1315</cvename>
 <url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1315.html</url>
 <url>https://security-tracker.debian.org/tracker/CVE-2015-1315</url>
 <url>http://www.ubuntu.com/usn/usn-2502-1/</url>
 </references>
 <dates>
 <discovery>2015-02-17</discovery>
 <entry>2015-02-17</entry>
 </dates>
 </vuln>

<vuln vid="3a888a1e-b321-11e4-83b2-206a8a720317">
 <topic>krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><lt>1.13.1</lt></range>
 </package>
 <package>
	<name>krb5-112</name>
	<range><lt>1.12.2_2</lt></range>
 </package>
 <package>
	<name>krb5-111</name>
	<range><lt>1.11.5_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MIT Kerberos team reports:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt">
	 CVE-2014-5353: The krb5_ldap_get_password_policy_from_dn
	 function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in
	 MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP,
	 allows remote authenticated users to cause a denial of service
	 (daemon crash) via a successful LDAP query with no results, as
	 demonstrated by using an incorrect object type for a password
	 policy.
	 CVE-2014-5354: plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in
	 MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when
	 the KDC uses LDAP, allows remote authenticated users to cause a
	 denial of service (NULL pointer dereference and daemon crash) by
	 creating a database entry for a keyless principal, as
	 demonstrated by a kadmin "add_principal -nokey" or "purgekeys
	 -all" command.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-5353</cvename>
 <cvename>CVE-2014-5354</cvename>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt</url>
 </references>
 <dates>
 <discovery>2015-02-12</discovery>
 <entry>2015-02-12</entry>
 <modified>2015-02-13</modified>
 </dates>
 </vuln>

<vuln vid="54a69cf7-b2ef-11e4-b1f1-bcaec565249c">
 <topic>xorg-server -- Information leak in the XkbSetGeometry request of X servers.</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<range><lt>1.14.7_2,1</lt></range>
 </package>
 <package>
	<name>xorg-server</name>
	<range><ge>1.15.0,1</ge><lt>1.16.4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Peter Hutterer reports:
	<blockquote cite="http://lists.freedesktop.org/archives/xorg/2015-February/057158.html">
	 Olivier Fourdan from Red Hat has discovered a protocol handling
	 issue in the way the X server code base handles the XkbSetGeometry
	 request.
	 The issue stems from the server trusting the client to send valid
	 string lengths in the request data. A malicious client with string
	 lengths exceeding the request length can cause the server to copy
	 adjacent memory data into the XKB structs. This data is then
	 available to the client via the XkbGetGeometry request. The
	 data length is at least up to 64k, it is possible to obtain
	 more data by chaining strings, each string length is then
	 determined by whatever happens to be in that 16-bit region of
	 memory.
	 A similarly crafted request can likely cause the X server
	 to crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0255</cvename>
 <url>http://lists.freedesktop.org/archives/xorg/2015-February/057158.html</url>
 </references>
 <dates>
 <discovery>2015-02-10</discovery>
 <entry>2015-02-12</entry>
 </dates>
 </vuln>

<vuln vid="a0c45e53-ae51-11e4-8ac7-d050992ecde8">
 <topic>openldap -- two remote denial of service vulnerabilities</topic>
 <affects>
 <package>
	<name>openldap-server</name>
	<range><lt>2.4.40_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ryan Tandy reports:
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988">
	 With the deref overlay enabled, ldapsearch with '-E deref=member:'
	 causes slapd to crash.
	</blockquote>
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991">
	 Bill MacAllister discovered that certain queries cause slapd
	 to crash while freeing operation controls. This is a 2.4.40 regression.
	 Earlier releases are not affected.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988</url>
 <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991</url>
 </references>
 <dates>
 <discovery>2015-02-02</discovery>
 <entry>2015-02-06</entry>
 </dates>
 </vuln>

<vuln vid="a6eb239f-adbe-11e4-9fce-080027593b9a">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>40.0.2214.111</lt></range>
 </package>
 <package>
	<name>chromium-pulse</name>
	<range><lt>40.0.2214.111</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl">
	 11 security fixes in this release, including:
	 <ul>
	 <li>[447906] High CVE-2015-1209: Use-after-free in DOM. Credit to
	 Maksymillian.</li>
	 <li>[453979] High CVE-2015-1210: Cross-origin-bypass in V8
	 bindings. Credit to anonymous.</li>
	 <li>[453982] High CVE-2015-1211: Privilege escalation using service
	 workers. Credit to anonymous.</li>
	 <li>[455225] CVE-2015-1212: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1209</cvename>
 <cvename>CVE-2015-1210</cvename>
 <cvename>CVE-2015-1211</cvename>
 <cvename>CVE-2015-1212</cvename>
 <url>http://googlechromereleases.blogspot.nl</url>
 </references>
 <dates>
 <discovery>2015-02-05</discovery>
 <entry>2015-02-06</entry>
 </dates>
 </vuln>

<vuln vid="3b40bf2c-ad83-11e4-a2b2-0026551a22dc">
 <topic>PostgreSQL -- multiple buffer overflows and memory issues</topic>
 <affects>
 <package>
	<name>postgresql90-server</name>
	<range><ge>9.0.0</ge><lt>9.0.19</lt></range>
 </package>
 <package>
	<name>postgresql91-server</name>
	<range><ge>9.1.0</ge><lt>9.1.15</lt></range>
 </package>
 <package>
	<name>postgresql92-server</name>
	<range><ge>9.2.0</ge><lt>9.2.10</lt></range>
 </package>
 <package>
	<name>postgresql93-server</name>
	<range><ge>9.3.0</ge><lt>9.3.6</lt></range>
 </package>
 <package>
	<name>postgresql94-server</name>
	<range><ge>9.4.0</ge><lt>9.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL Project reports:
	<blockquote cite="http://www.postgresql.org/about/news/1569/">
	 This update fixes multiple security issues reported in PostgreSQL
	 over the past few months. All of these issues require prior
	 authentication, and some require additional conditions, and as such
	 are not considered generally urgent. However, users should examine
	 the list of security holes patched below in case they are particularly
	 vulnerable.
	 <ol>
	 <li>CVE-2015-0241 Buffer overruns in "to_char" functions.</li>
	 <li>CVE-2015-0242 Buffer overrun in replacement printf family of
		functions.</li>
	 <li>CVE-2015-0243 Memory errors in functions in the pgcrypto extension.</li>
	 <li>CVE-2015-0244 An error in extended protocol message reading.</li>
	 <li>CVE-2014-8161 Constraint violation errors can cause display of values in columns
		which the user would not normally have rights to see.</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0241</cvename>
 <cvename>CVE-2015-0242</cvename>
 <cvename>CVE-2015-0243</cvename>
 <cvename>CVE-2015-0244</cvename>
 <cvename>CVE-2014-8161</cvename>
 </references>
 <dates>
 <discovery>2015-02-05</discovery>
 <entry>2015-02-05</entry>
 </dates>
 </vuln>

<vuln vid="24ce5597-acab-11e4-a847-206a8a720317">
 <topic>krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><lt>1.13_1</lt></range>
 </package>
 <package>
	<name>krb5-112</name>
	<range><lt>1.12.2_1</lt></range>
 </package>
 <package>
	<name>krb5-111</name>
	<range><lt>1.11.5_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MIT krb5 Security Advisory 2015-001 reports:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt">
	 CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after
	 gss_process_context_token() is used to process a valid context
	 deletion token, the caller is left with a security context handle
	 containing a dangling pointer. Further uses of this handle will
	 result in use-after-free and double-free memory access violations.
	 libgssrpc server applications such as kadmind are vulnerable as
	 they can be instructed to call gss_process_context_token().
	 CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR
	 data from an authenticated user, it may perform use-after-free and
	 double-free memory access violations while cleaning up the partial
	 deserialization results. Other libgssrpc server applications may
	 also be vulnerable if they contain insufficiently defensive XDR
	 functions.
	 CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepts
	 authentications to two-component server principals whose first
	 component is a left substring of "kadmin" or whose realm is a left
	 prefix of the default realm.
	 CVE-2014-9423: libgssrpc applications including kadmind output
	 four or eight bytes of uninitialized memory to the network as
	 part of an unused "handle" field in replies to clients.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-5352</cvename>
 <cvename>CVE-2014-9421</cvename>
 <cvename>CVE-2014-9422</cvename>
 <cvename>CVE-2014-9423</cvename>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt</url>
 </references>
 <dates>
 <discovery>2015-02-03</discovery>
 <entry>2015-02-04</entry>
 </dates>
 </vuln>

<vuln vid="e543c6f8-abf2-11e4-8ac7-d050992ecde8">
 <topic>unzip -- out of boundary access issues in test_compr_eb</topic>
 <affects>
 <package>
	<name>unzip</name>
	<range><lt>6.0_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ubuntu Security Notice USN-2489-1 reports:
	<blockquote cite="http://www.ubuntu.com/usn/usn-2489-1/">
	 Michal Zalewski discovered that unzip incorrectly handled
	 certain malformed zip archives. If a user or automated system
	 were tricked into processing a specially crafted zip archive,
	 an attacker could possibly execute arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-9636</cvename>
 <url>http://www.ubuntu.com/usn/usn-2489-1/</url>
 <url>http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9636.html</url>
 <url>http://seclists.org/oss-sec/2014/q4/489</url>
 <url>http://www.info-zip.org/phpBB3/viewtopic.php?f=7&amp;t=450</url>
 </references>
 <dates>
 <discovery>2014-11-02</discovery>
 <entry>2015-02-03</entry>
 </dates>
 </vuln>

<vuln vid="1c7cfd05-aaee-11e4-83b4-14dae9d210b8">
 <topic>Xymon -- buffer overrun</topic>
 <affects>
 <package>
	<name>xymon-server</name>
	<range><ge>4.3.4</ge><lt>4.3.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian reports:
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776007">
	 web/acknowledge.c uses a string twice in a format string, but only
	 allocates memory for one copy.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2015/01/31/4</url>
 <url>https://security-tracker.debian.org/tracker/CVE-2015-1430</url>
 <cvename>CVE-2015-1430</cvename>
 </references>
 <dates>
 <discovery>2014-09-28</discovery>
 <entry>2015-02-02</entry>
 </dates>
 </vuln>

<vuln vid="8469d41c-a960-11e4-b18e-bcaec55be5e5">
 <topic>rabbitmq -- Security issues in management plugin</topic>
 <affects>
 <package>
	<name>rabbitmq</name>
	<range><lt>3.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The RabbitMQ project reports:
	<blockquote cite="http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100">
	 Some user-controllable content was not properly HTML-escaped
	 before being presented to a user in the management web UI:
	 <ul>
	 <li>When a user unqueued a message from the management UI,
	 message details (header names, arguments, etc.) were displayed
	 unescaped. An attacker could publish a specially crafted
	 message to add content or execute arbitrary Javascript code on
	 behalf of a user, if this user unqueued the message from the
	 management UI.</li>
	 <li>When viewing policies, their name was displayed unescaped.
	 An attacker could create a policy with a specially crafted name
	 to add content or execute arbitrary Javascript code on behalf
	 of a user who is viewing policies.</li>
	 <li>When listing connected AMQP network clients, client details
	 such as its version were displayed unescaped. An attacker could
	 use a client with a specially crafted version field to add
	 content or execute arbitrary Javascript code on behalf of a
	 user who is viewing connected clients.</li>
	 </ul>
	 In all cases, the attacker needs a valid user account on the
	 targeted RabbitMQ cluster.
	 Furthermore, some admin-controllable content was not properly
	 escaped:
	 <ul>
	 <li>user names;</li>
	 <li>the cluster name.</li>
	 </ul>
	 Likewise, an attacker could add content or execute arbitrary
	 Javascript code on behalf of a user using the management web UI.
	 However, the attacker must be an administrator on the RabbitMQ
	 cluster, thus a trusted user.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100</url>
 <url>http://www.rabbitmq.com/release-notes/README-3.4.3.txt</url>
 <cvename>CVE-2015-0862</cvename>
 </references>
 <dates>
 <discovery>2015-01-08</discovery>
 <entry>2015-01-31</entry>
 </dates>
 </vuln>

<vuln vid="5804b9d4-a959-11e4-9363-20cf30e32f6d">
 <topic>apache24 -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Apache HTTP SERVER PROJECT reports:</h1>
	<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.4.html">
	 mod_proxy_fcgi: Fix a potential crash due to buffer over-read,
	 with response headers' size above 8K.
	 mod_cache: Avoid a crash when Content-Type has an empty value. PR 56924.
	 mod_lua: Fix handling of the Require line when a LuaAuthzProvider is used
	 in multiple Require directives with different arguments. PR57204.
	 core: HTTP trailers could be used to replace HTTP headers late during
	 request processing, potentially undoing or otherwise confusing modules
	 that examined or modified request headers earlier. Adds "MergeTrailers"
	 directive to restore legacy behavior.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3583</cvename>
 <cvename>CVE-2014-3581</cvename>
 <cvename>CVE-2014-8109</cvename>
 <cvename>CVE-2013-5704</cvename>
 </references>
 <dates>
 <discovery>2015-01-29</discovery>
 <entry>2015-01-31</entry>
 </dates>
 </vuln>

<vuln vid="7656fc62-a7a7-11e4-96ba-001999f8d30b">
 <topic>asterisk -- Mitigation for libcURL HTTP request injection vulnerability</topic>
 <affects>
 <package>
	<name>asterisk</name>
	<range><lt>1.8.32.2</lt></range>
 </package>
 <package>
	<name>asterisk11</name>
	<range><lt>11.15.1</lt></range>
 </package>
 <package>
	<name>asterisk13</name>
	<range><lt>13.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 CVE-2014-8150 reported an HTTP request injection
	 vulnerability in libcURL. Asterisk uses libcURL in its
	 func_curl.so module (the CURL() dialplan function), as
	 well as its res_config_curl.so (cURL realtime backend)
	 modules.
	 Since Asterisk may be configured to allow for user-supplied
	 URLs to be passed to libcURL, it is possible that an
	 attacker could use Asterisk as an attack vector to inject
	 unauthorized HTTP requests if the version of libcURL
	 installed on the Asterisk server is affected by
	 CVE-2014-8150.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2015-002.html</url>
 </references>
 <dates>
 <discovery>2015-01-12</discovery>
 <entry>2015-01-29</entry>
 </dates>
 </vuln>

<vuln vid="2eeb6652-a7a6-11e4-96ba-001999f8d30b">
 <topic>asterisk -- File descriptor leak when incompatible codecs are offered</topic>
 <affects>
 <package>
	<name>asterisk13</name>
	<range><lt>13.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 Asterisk may be configured to only allow specific audio
	 or video codecs to be used when communicating with a
	 particular endpoint. When an endpoint sends an SDP offer
	 that only lists codecs not allowed by Asterisk, the offer
	 is rejected. However, in this case, RTP ports that are
	 allocated in the process are not reclaimed.
	 This issue only affects the PJSIP channel driver in
	 Asterisk. Users of the chan_sip channel driver are not
	 affected.
	 As the resources are allocated after authentication,
	 this issue only affects communications with authenticated
	 endpoints.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2015-001.html</url>
 <cvename>CVE-2015-1558</cvename>
 </references>
 <dates>
 <discovery>2015-01-06</discovery>
 <entry>2015-01-29</entry>
 <modified>2015-02-17</modified>
 </dates>
 </vuln>

<vuln vid="0765de84-a6c1-11e4-a0c1-c485083ca99c">
 <topic>glibc -- gethostbyname buffer overflow</topic>
 <affects>
 <package>
	<name>linux_base-c6</name>
	<range><lt>6.6_2</lt></range>
 </package>
 <package>
	<name>linux_base-f10</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>linux-c6-devtools</name>
	<range><lt>6.6_3</lt></range>
 </package>
 <package>
	<name>linux-f10-devtools</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Robert Krátký reports:
	<blockquote cite="https://access.redhat.com/discussions/1332403">
	 
	 GHOST is a 'buffer overflow' bug affecting the gethostbyname() and
	 gethostbyname2() function calls in the glibc library. This
	 vulnerability allows a remote attacker that is able to make an
	 application call to either of these functions to execute arbitrary
	 code with the permissions of the user running the application.
	 The gethostbyname() function calls are used for DNS resolving, which
	 is a very common event. To exploit this vulnerability, an attacker
	 must trigger a buffer overflow by supplying an invalid hostname
	 argument to an application that performs a DNS resolution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0235</cvename>
 <url>https://access.redhat.com/articles/1332213</url>
 <url>http://www.openwall.com/lists/oss-security/2015/01/27/9</url>
 </references>
 <dates>
 <discovery>2015-01-27</discovery>
 <entry>2015-01-28</entry>
 <modified>2015-02-02</modified>
 </dates>
 </vuln>

<vuln vid="37a87ade-a59f-11e4-958e-0011d823eebd">
 <topic>Adobe Flash Player -- critical vulnerability</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<range><le>11.2r202.438</le></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><le>11.2r202.438</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsa15-01.html">
	 Successful exploitation could cause a crash and potentially allow
	 an attacker to take control of the affected system. We are aware
	 of reports that this vulnerability is being actively exploited in
	 the wild via drive-by-download attacks against systems running
	 Internet Explorer and Firefox on Windows 8.1 and below.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0311</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsa15-01.html</url>
 </references>
 <dates>
 <discovery>2015-01-22</discovery>
 <entry>2015-01-26</entry>
 </dates>
 </vuln>

<vuln vid="dc2d76df-a595-11e4-9363-20cf30e32f6d">
 <topic>Bugzilla multiple security issues</topic>
 <affects>
 <package>
	<name>bugzilla44</name>
	<range><lt>4.4.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bugzilla Security Advisory
	<blockquote cite="http://www.bugzilla.org/security/4.0.15/">
	 <h5>Command Injection</h5>
	 Some code in Bugzilla does not properly utilize 3 arguments form
	 for open() and it is possible for an account with editcomponents
	 permissions to inject commands into product names and other
	 attributes.
	 <h5>Information Leak</h5>
	 Using the WebServices API, a user can possibly execute imported
	 functions from other non-WebService modules. A whitelist has now
	 been added that lists explicit methods that can be executed via the
	 API.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8630</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1079065</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1090275</url>
 </references>
 <dates>
 <discovery>2015-01-21</discovery>
 <entry>2015-01-26</entry>
 </dates>
 </vuln>

<vuln vid="9c7b6c20-a324-11e4-879c-00e0814cab4e">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-django</name>
	<range><ge>1.4</ge><lt>1.4.18</lt></range>
	<range><ge>1.5</ge><le>1.5.12</le></range>
	<range><ge>1.6</ge><lt>1.6.10</lt></range>
	<range><ge>1.7</ge><lt>1.7.3</lt></range>
 </package>
 <package>
	<name>py32-django</name>
	<range><ge>1.4</ge><lt>1.4.18</lt></range>
	<range><ge>1.5</ge><le>1.5.12</le></range>
	<range><ge>1.6</ge><lt>1.6.10</lt></range>
	<range><ge>1.7</ge><lt>1.7.3</lt></range>
 </package>
 <package>
	<name>py33-django</name>
	<range><ge>1.4</ge><lt>1.4.18</lt></range>
	<range><ge>1.5</ge><le>1.5.12</le></range>
	<range><ge>1.6</ge><lt>1.6.10</lt></range>
	<range><ge>1.7</ge><lt>1.7.3</lt></range>
 </package>
 <package>
	<name>py34-django</name>
	<range><ge>1.4</ge><lt>1.4.18</lt></range>
	<range><ge>1.5</ge><le>1.5.12</le></range>
	<range><ge>1.6</ge><lt>1.6.10</lt></range>
	<range><ge>1.7</ge><lt>1.7.3</lt></range>
 </package>
 <package>
	<name>py27-django-devel</name>
	<range><lt>20150124,1</lt></range>
 </package>
 <package>
	<name>py32-django-devel</name>
	<range><lt>20150124,1</lt></range>
 </package>
 <package>
	<name>py33-django-devel</name>
	<range><lt>20150124,1</lt></range>
 </package>
 <package>
	<name>py34-django-devel</name>
	<range><lt>20150124,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Django project reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2015/jan/13/security/">
	 Today the Django team is issuing multiple releases --
	 Django 1.4.18, Django 1.6.10, and Django 1.7.3 -- as part of our
	 security process. These releases are now available on PyPI and our
	 download page.
	 These releases address several security issues. We encourage all
	 users of Django to upgrade as soon as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2015/jan/13/security/</url>
 <cvename>CVE-2015-0219</cvename>
 <cvename>CVE-2015-0220</cvename>
 <cvename>CVE-2015-0221</cvename>
 <cvename>CVE-2015-0222</cvename>
 </references>
 <dates>
 <discovery>2015-01-13</discovery>
 <entry>2015-01-23</entry>
 <modified>2015-01-24</modified>
 </dates>
 </vuln>

<vuln vid="0523fb7e-8444-4e86-812d-8de05f6f0dce">
 <topic>libutp -- remote denial of service or arbitrary code execution</topic>
 <affects>
 <package>
	<name>bittorrent-libutp</name>
	<range><lt>0.20130514_1</lt></range>
 </package>
 <package>
	<name>transmission-cli</name>
	<name>transmission-deamon</name>
	<name>transmission-gtk</name>
	<name>transmission-qt4</name>
	<range><lt>2.74</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6129">
	 Stack-based buffer overflow in utp.cpp in libutp, as used
	 in Transmission before 2.74 and possibly other products,
	 allows remote attackers to cause a denial of service (crash)
	 and possibly execute arbitrary code via crafted "micro
	 transport protocol packets."
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-6129</cvename>
 <url>https://github.com/bittorrent/libutp/issues/38</url>
 <url>https://trac.transmissionbt.com/ticket/5002</url>
 </references>
 <dates>
 <discovery>2012-08-01</discovery>
 <entry>2014-12-29</entry>
 </dates>
 </vuln>

<vuln vid="f9c388c5-a256-11e4-992a-7b2a515a1247">
 <topic>LibreSSL -- DTLS vulnerability</topic>
 <affects>
 <package>
	<name>libressl</name>
	<range><lt>2.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL Security Advisory:
	<blockquote cite="https://www.openssl.org/news/secadv_20150108.txt">
	
	A memory leak can occur in the dtls1_buffer_record function under certain
	conditions. In particular this could occur if an attacker sent repeated DTLS
	records with the same sequence number but for the next epoch. The memory leak
	could be exploited by an attacker in a Denial of Service attack through memory
	exhaustion.
	
	</blockquote>
 </body>
 </description>
 <references>
		<cvename>CVE-2015-0206</cvename>
		<url>https://www.openssl.org/news/secadv_20150108.txt</url>
 </references>
 <dates>
 <discovery>2015-01-08</discovery>
 <entry>2015-01-22</entry>
 </dates>
 </vuln>

<vuln vid="cc294a2c-a232-11e4-8e9f-0011d823eebd">
 <topic>Adobe Flash Player -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-c6-flashplugin</name>
	<range><lt>11.2r202.429</lt></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.429</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="http://helpx.adobe.com/security/products/flash-player/apsb15-01.html">
	 These updates address vulnerabilities that could potentially allow
	 an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-0301</cvename>
 <cvename>CVE-2015-0302</cvename>
 <cvename>CVE-2015-0303</cvename>
 <cvename>CVE-2015-0304</cvename>
 <cvename>CVE-2015-0305</cvename>
 <cvename>CVE-2015-0306</cvename>
 <cvename>CVE-2015-0307</cvename>
 <cvename>CVE-2015-0308</cvename>
 <cvename>CVE-2015-0309</cvename>
 <url>http://helpx.adobe.com/security/products/flash-player/apsb15-01.html</url>
 </references>
 <dates>
 <discovery>2015-01-13</discovery>
 <entry>2015-01-22</entry>
 </dates>
 </vuln>

<vuln vid="e30e0c99-a1b7-11e4-b85c-00262d5ed8ee">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>40.0.2214.91</lt></range>
 </package>
 <package>
	<name>chromium-pulse</name>
	<range><lt>40.0.2214.91</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/">
	 62 security fixes in this release, including:
	 <ul>
	 <li>[430353] High CVE-2014-7923: Memory corruption in ICU. Credit
	 to yangdingning.</li>
	 <li>[435880] High CVE-2014-7924: Use-after-free in IndexedDB.
	 Credit to Collin Payne.</li>
	 <li>[434136] High CVE-2014-7925: Use-after-free in WebAudio. Credit
	 to mark.buer.</li>
	 <li>[422824] High CVE-2014-7926: Memory corruption in ICU. Credit
	 to yangdingning.</li>
	 <li>[444695] High CVE-2014-7927: Memory corruption in V8. Credit to
	 Christian Holler.</li>
	 <li>[435073] High CVE-2014-7928: Memory corruption in V8. Credit to
	 Christian Holler.</li>
	 <li>[442806] High CVE-2014-7930: Use-after-free in DOM. Credit to
	 cloudfuzzer.</li>
	 <li>[442710] High CVE-2014-7931: Memory corruption in V8. Credit to
	 cloudfuzzer.</li>
	 <li>[443115] High CVE-2014-7929: Use-after-free in DOM. Credit to
	 cloudfuzzer.</li>
	 <li>[429666] High CVE-2014-7932: Use-after-free in DOM. Credit to
	 Atte Kettunen of OUSPG.</li>
	 <li>[427266] High CVE-2014-7933: Use-after-free in FFmpeg. Credit
	 to aohelin.</li>
	 <li>[427249] High CVE-2014-7934: Use-after-free in DOM. Credit to
	 cloudfuzzer.</li>
	 <li>[402957] High CVE-2014-7935: Use-after-free in Speech. Credit
	 to Khalil Zhani.</li>
	 <li>[428561] High CVE-2014-7936: Use-after-free in Views. Credit
	 to Christoph Diehl.</li>
	 <li>[419060] High CVE-2014-7937: Use-after-free in FFmpeg. Credit
	 to Atte Kettunen of OUSPG.</li>
	 <li>[416323] High CVE-2014-7938: Memory corruption in Fonts. Credit
	 to Atte Kettunen of OUSPG.</li>
	 <li>[399951] High CVE-2014-7939: Same-origin-bypass in V8. Credit
	 to Takeshi Terada.</li>
	 <li>[433866] Medium CVE-2014-7940: Uninitialized-value in ICU.
	 Credit to miaubiz.</li>
	 <li>[428557] Medium CVE-2014-7941: Out-of-bounds read in UI. Credit
	 to Atte Kettunen of OUSPG and Christoph Diehl.</li>
	 <li>[426762] Medium CVE-2014-7942: Uninitialized-value in Fonts.
	 Credit to miaubiz.</li>
	 <li>[422492] Medium CVE-2014-7943: Out-of-bounds read in Skia.
	 Credit to Atte Kettunen of OUSPG.</li>
	 <li>[418881] Medium CVE-2014-7944: Out-of-bounds read in PDFium.
	 Credit to cloudfuzzer.</li>
	 <li>[414310] Medium CVE-2014-7945: Out-of-bounds read in PDFium.
	 Credit to cloudfuzzer.</li>
	 <li>[414109] Medium CVE-2014-7946: Out-of-bounds read in Fonts.
	 Credit to miaubiz.</li>
	 <li>[430566] Medium CVE-2014-7947: Out-of-bounds read in PDFium.
	 Credit to fuzztercluck.</li>
	 <li>[414026] Medium CVE-2014-7948: Caching error in AppCache.
	 Credit to jiayaoqijia.</li>
	 <li>[449894] CVE-2015-1205: Various fixes from internal audits,
	 fuzzing and other initiatives.</li>
	 <li>Multiple vulnerabilities in V8 fixed at the tip of the 3.30
	 branch (currently 3.30.33.15).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-7923</cvename>
 <cvename>CVE-2014-7924</cvename>
 <cvename>CVE-2014-7925</cvename>
 <cvename>CVE-2014-7926</cvename>
 <cvename>CVE-2014-7927</cvename>
 <cvename>CVE-2014-7928</cvename>
 <cvename>CVE-2014-7929</cvename>
 <cvename>CVE-2014-7930</cvename>
 <cvename>CVE-2014-7931</cvename>
 <cvename>CVE-2014-7932</cvename>
 <cvename>CVE-2014-7933</cvename>
 <cvename>CVE-2014-7934</cvename>
 <cvename>CVE-2014-7935</cvename>
 <cvename>CVE-2014-7936</cvename>
 <cvename>CVE-2014-7937</cvename>
 <cvename>CVE-2014-7938</cvename>
 <cvename>CVE-2014-7939</cvename>
 <cvename>CVE-2014-7940</cvename>
 <cvename>CVE-2014-7941</cvename>
 <cvename>CVE-2014-7942</cvename>
 <cvename>CVE-2014-7943</cvename>
 <cvename>CVE-2014-7944</cvename>
 <cvename>CVE-2014-7945</cvename>
 <cvename>CVE-2014-7946</cvename>
 <cvename>CVE-2014-7947</cvename>
 <cvename>CVE-2014-7948</cvename>
 <cvename>CVE-2015-1205</cvename>
 <url>http://googlechromereleases.blogspot.nl</url>
 </references>
 <dates>
 <discovery>2015-01-21</discovery>
 <entry>2015-01-21</entry>
 </dates>
 </vuln>

<vuln vid="a5856eba-a015-11e4-a680-1c6f65c3c4ff">
 <topic>polarssl -- Remote attack using crafted certificates</topic>
 <affects>
 <package>
	<name>polarssl</name>
	<range><ge>1.2.0</ge><lt>1.2.12_1</lt></range>
 </package>
 <package>
	<name>polarssl13</name>
	<range><ge>1.3.0</ge><lt>1.3.9_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PolarSSL team reports:
	<blockquote cite="https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04">
	 During the parsing of a ASN.1 sequence, a pointer in the linked list of asn1_sequence is not
	 initialized by asn1_get_sequence_of(). In case an error occurs during parsing of the list, a
	 situation is created where the uninitialized pointer is passed to polarssl_free().
	 This sequence can be triggered when a PolarSSL entity is parsing a certificate. So practically this
	 means clients when receiving a certificate from the server or servers in case they are actively
	 asking for a client certificate.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2015-1182</cvename>
 <url>https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04</url>
 <url>https://www.certifiedsecure.com/polarssl-advisory/</url>
 </references>
 <dates>
 <discovery>2015-01-14</discovery>
 <entry>2015-01-19</entry>
 </dates>
 </vuln>

<vuln vid="d9360908-9d52-11e4-87fd-10bf48e1088e">
 <topic>unzip -- input sanitization errors</topic>
 <affects>
 <package>
	<name>unzip</name>
	<range><le>6.0_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	oCERT reports:
	<blockquote cite="http://www.ocert.org/advisories/ocert-2014-011.html">
	 The UnZip tool is an open source extraction utility for archives
	 compressed in the zip format.
	 The unzip command line tool is affected by heap-based buffer
	 overflows within the CRC32 verification, the test_compr_eb() and
	 the getZip64Data() functions. The input errors may result in
	 arbitrary code execution.
	 A specially crafted zip file, passed to unzip -t, can be used to
	 trigger the vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8139</cvename>
 <cvename>CVE-2014-8140</cvename>
 <cvename>CVE-2014-8141</cvename>
 <url>http://www.info-zip.org/UnZip.html</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1174844</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8140</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1174856</url>
 </references>
 <dates>
 <discovery>2014-12-03</discovery>
 <entry>2015-01-16</entry>
 </dates>
 </vuln>

<vuln vid="d4f45676-9d33-11e4-8275-000c292e4fd8">
 <topic>samba -- Elevation of privilege to Active Directory Domain Controller</topic>
 <affects>
 <package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><lt>4.0.23</lt></range>
 </package>
 <package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><lt>4.1.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samba team reports:
	<blockquote cite="https://www.samba.org/samba/security/CVE-2014-8143">
	 In Samba's AD DC we neglected to ensure that
	 attempted modifications of the userAccountControl attribute
	 did not allow the UF_SERVER_TRUST_ACCOUNT bit to be set.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8143</cvename>
 <url>https://www.samba.org/samba/security/CVE-2014-8143</url>
 </references>
 <dates>
 <discovery>2015-01-15</discovery>
 <entry>2015-01-16</entry>
 </dates>
 </vuln>

<vuln vid="7a8a74d1-9c34-11e4-a40b-5453ed2e2b49">
 <topic>kde-runtime -- incorrect CBC encryption handling</topic>
 <affects>
 <package>
	<name>kde-runtime</name>
	<range><lt>4.12_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Valentin Rusu reports:
	<blockquote cite="https://www.kde.org/info/security/advisory-20150109-1.txt">
	 Until KDE Applications 14.12.0, kwalletd incorrectly handled CBC
	 encryption blocks when encrypting secrets in kwl files. The secrets
	 were still encrypted, but the result binary data corresponded to an
	 ECB encrypted block instead of CBC.
	 The ECB encryption algorithm, even if it'll scramble user data,
	 will produce same encrypted byte sequence for the same input text.
	 As a result, attackers may eventually find-out the encrypted
	 text.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-7252</cvename>
 <url>https://www.kde.org/info/security/advisory-20150109-1.txt</url>
 </references>
 <dates>
 <discovery>2015-01-09</discovery>
 <entry>2015-01-14</entry>
 </dates>
 </vuln>

<vuln vid="bd62c640-9bb9-11e4-a5ad-000c297fb80f">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>35.0,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>31.4.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>35.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.32</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>31.4.0</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.32</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>31.4.0</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>31.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
	 MFSA-2015-01 Miscellaneous memory safety hazards (rv:35.0
	 / rv:31.4)
	 MFSA-2015-02 Uninitialized memory use during bitmap
	 rendering
	 MFSA-2015-03 sendBeacon requests lack an Origin header
	 MFSA-2015-04 Cookie injection through Proxy Authenticate
	 responses
	 MFSA-2015-05 Read of uninitialized memory in Web Audio
	 MFSA-2015-06 Read-after-free in WebRTC
	 MFSA-2015-07 Gecko Media Plugin sandbox escape
	 MFSA-2015-08 Delegated OCSP responder certificates failure
	 with id-pkix-ocsp-nocheck extension
	 MFSA-2015-09 XrayWrapper bypass through DOM objects
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8634</cvename>
 <cvename>CVE-2014-8635</cvename>
 <cvename>CVE-2014-8637</cvename>
 <cvename>CVE-2014-8638</cvename>
 <cvename>CVE-2014-8639</cvename>
 <cvename>CVE-2014-8640</cvename>
 <cvename>CVE-2014-8641</cvename>
 <cvename>CVE-2014-8642</cvename>
 <cvename>CVE-2014-8643</cvename>
 <cvename>CVE-2014-8636</cvename>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-01/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-02/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-03/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-04/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-05/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-06/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-07/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-08/</url>
 <url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-09/</url>
 <url>https://www.mozilla.org/security/advisories/</url>
 </references>
 <dates>
 <discovery>2015-01-13</discovery>
 <entry>2015-01-14</entry>
 </dates>
 </vuln>

<vuln vid="daa8a49b-99b9-11e4-8f66-3085a9a4510d">
 <topic>libevent -- integer overflow in evbuffers</topic>
 <affects>
 <package>
	<name>libevent</name>
	<range><lt>1.4.15</lt></range>
	<range><ge>2.0</ge><lt>2.0.22</lt></range>
 </package>
 <package>
	<name>libevent2</name>
	<range><lt>2.0.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian Security Team reports:
	<blockquote cite="https://www.debian.org/security/2015/dsa-3119">
	 Andrew Bartlett of Catalyst reported a defect affecting certain
	 applications using the Libevent evbuffer API. This defect leaves
	 applications which pass insanely large inputs to evbuffers open
	 to a possible heap overflow or infinite loop. In order to exploit
	 this flaw, an attacker needs to be able to find a way to provoke
	 the program into trying to make a buffer chunk larger than what
	 will fit into a single size_t or off_t.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-6272</cvename>
 <url>https://www.debian.org/security/2015/dsa-3119</url>
 </references>
 <dates>
 <discovery>2015-01-05</discovery>
 <entry>2015-01-11</entry>
 <modified>2017-02-20</modified>
 </dates>
 </vuln>

<vuln vid="caa98ffd-0a92-40d0-b234-fd79b429157e">
 <topic>cURL -- URL request injection vulnerability</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>7.40.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cURL reports:
	<blockquote cite="http://curl.haxx.se/docs/adv_20150108B.html">
	 When libcurl sends a request to a server via a HTTP proxy, it
	 copies the entire URL into the request and sends if off.
	 If the given URL contains line feeds and carriage returns those will
	 be sent along to the proxy too, which allows the program to for
	 example send a separate HTTP request injected embedded in the URL.
	 Many programs allow some kind of external sources to set the URL or
	 provide partial pieces for the URL to ask for, and if the URL as
	 received from the user is not stripped good enough this flaw allows
	 malicious users to do additional requests in a way that was not
	 intended, or just to insert request headers into the request that
	 the program didn't intend.
	 We are not aware of any exploit of this flaw.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8150</cvename>
 <url>http://curl.haxx.se/docs/adv_20150108B.html</url>
 </references>
 <dates>
 <discovery>2014-12-25</discovery>
 <entry>2015-01-09</entry>
 </dates>
 </vuln>

<vuln vid="e9ccdb28-9802-11e4-9d9c-bcaec565249c">
 <topic>WebKit-gtk -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>webkit-gtk2</name>
	<range><lt>1.4.8</lt></range>
 </package>
 <package>
	<name>webkit-gtk3</name>
	<range><lt>1.4.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Webkit release team reports:
	<blockquote cite="http://webkitgtk.org/2015/01/07/webkitgtk2.4.8-released.html">
	 This release fixes the following security issues:
	 CVE-2014-1344, CVE-2014-1384, CVE-2014-1385, CVE-2014-1386,
	 CVE-2014-1387, CVE-2014-1388, CVE-2014-1389, CVE-2014-1390.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://webkitgtk.org/2015/01/07/webkitgtk2.4.8-released.html</url>
 <cvename>CVE-2014-1344</cvename>
 <cvename>CVE-2014-1384</cvename>
 <cvename>CVE-2014-1385</cvename>
 <cvename>CVE-2014-1386</cvename>
 <cvename>CVE-2014-1387</cvename>
 <cvename>CVE-2014-1388</cvename>
 <cvename>CVE-2014-1389</cvename>
 <cvename>CVE-2014-1390</cvename>
 </references>
 <dates>
 <discovery>2015-01-07</discovery>
 <entry>2015-01-09</entry>
 </dates>
 </vuln>

<vuln vid="4e536c14-9791-11e4-977d-d050992ecde8">
 <topic>OpenSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_17</lt></range>
 </package>
 <package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1k</lt></range>
 </package>
 <package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_3</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.1</ge><lt>10.1_4</lt></range>
	<range><ge>10.0</ge><lt>10.0_16</lt></range>
	<range><ge>9.3</ge><lt>9.3_8</lt></range>
	<range><ge>8.4</ge><lt>8.4_22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL project reports:
	<blockquote cite="https://www.openssl.org/news/secadv_20150108.txt">
	 DTLS segmentation fault in dtls1_get_record (CVE-2014-3571)
	 DTLS memory leak in dtls1_buffer_record (CVE-2015-0206)
	 no-ssl3 configuration sets method to NULL (CVE-2014-3569)
	 ECDHE silently downgrades to ECDH [Client] (CVE-2014-3572)
	 RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)
	 DH client certificates accepted without verification [Server] (CVE-2015-0205)
	 Certificate fingerprints can be modified (CVE-2014-8275)
	 Bignum squaring may produce incorrect results (CVE-2014-3570)
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-15:01.openssl</freebsdsa>
 <cvename>CVE-2014-3569</cvename>
 <cvename>CVE-2014-3570</cvename>
 <cvename>CVE-2014-3571</cvename>
 <cvename>CVE-2014-3572</cvename>
 <cvename>CVE-2014-8275</cvename>
 <cvename>CVE-2015-0204</cvename>
 <cvename>CVE-2015-0205</cvename>
 <cvename>CVE-2015-0206</cvename>
 <url>https://www.openssl.org/news/secadv_20150108.txt</url>
 </references>
 <dates>
 <discovery>2015-01-08</discovery>
 <entry>2015-01-08</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="5e135178-8aeb-11e4-801f-0022156e8794">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>3.7.5,1</lt></range>
	<range><ge>3.8,1</ge><lt>3.8.5,1</lt></range>
	<range><ge>3.9,1</ge><lt>3.9.3,1</lt></range>
	<range><ge>4.0,1</ge><lt>4.0.1,1</lt></range>
 </package>
 <package>
	<name>zh-wordpress</name>
	<range><lt>3.7.5</lt></range>
	<range><ge>3.8</ge><lt>3.8.5</lt></range>
	<range><ge>3.9</ge><lt>3.9.3</lt></range>
	<range><ge>4.0</ge><lt>4.0.1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<range><lt>3.7.5</lt></range>
	<range><ge>3.8</ge><lt>3.8.5</lt></range>
	<range><ge>3.9</ge><lt>3.9.3</lt></range>
	<range><ge>4.0</ge><lt>4.0.1</lt></range>
 </package>
 <package>
	<name>ja-wordpress</name>
	<range><lt>3.7.5</lt></range>
	<range><ge>3.8</ge><lt>3.8.5</lt></range>
	<range><ge>3.9</ge><lt>3.9.3</lt></range>
	<range><ge>4.0</ge><lt>4.0.1</lt></range>
 </package>
 <package>
	<name>ru-wordpress</name>
	<range><lt>3.7.5</lt></range>
	<range><ge>3.8</ge><lt>3.8.5</lt></range>
	<range><ge>3.9</ge><lt>3.9.3</lt></range>
	<range><ge>4.0</ge><lt>4.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9039">
	 wp-login.php in WordPress before 3.7.5, 3.8.x before
	 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow
	 remote attackers to reset passwords by leveraging access to
	 an e-mail account that received a password-reset message.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9038">
	 wp-includes/http.php in WordPress before 3.7.5, 3.8.x
	 before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1
	 allows remote attackers to conduct server-side request
	 forgery (SSRF) attacks by referring to a 127.0.0.0/8
	 resource.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9037">
	 WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before
	 3.9.3, and 4.x before 4.0.1 might allow remote attackers to
	 obtain access to an account idle since 2008 by leveraging an
	 improper PHP dynamic type comparison for an MD5 hash.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9036">
	 Cross-site scripting (XSS) vulnerability in WordPress
	 before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and
	 4.x before 4.0.1 allows remote attackers to inject arbitrary
	 web script or HTML via a crafted Cascading Style Sheets
	 (CSS) token sequence in a post.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9035">
	 Cross-site scripting (XSS) vulnerability in Press This in
	 WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before
	 3.9.3, and 4.x before 4.0.1 allows remote attackers to
	 inject arbitrary web script or HTML via unspecified
	 vectors
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9034">
	 wp-includes/class-phpass.php in WordPress before 3.7.5,
	 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1
	 allows remote attackers to cause a denial of service (CPU
	 consumption) via a long password that is improperly handled
	 during hashing, a similar issue to CVE-2014-9016.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9033">
	 Cross-site request forgery (CSRF) vulnerability in
	 wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0
	 allows remote attackers to hijack the authentication of
	 arbitrary users for requests that reset passwords.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-9033</cvename>
 <cvename>CVE-2014-9034</cvename>
 <cvename>CVE-2014-9035</cvename>
 <cvename>CVE-2014-9036</cvename>
 <cvename>CVE-2014-9037</cvename>
 <cvename>CVE-2014-9038</cvename>
 <cvename>CVE-2014-9039</cvename>
 </references>
 <dates>
 <discovery>2014-11-25</discovery>
 <entry>2015-01-05</entry>
 </dates>
 </vuln>

<vuln vid="c564f9bd-8ba7-11e4-801f-0022156e8794">
 <topic>png -- heap overflow for 32-bit builds</topic>
 <affects>
 <package>
	<name>png</name>
	<range><ge>1.2.6</ge><lt>1.5.21</lt></range>
	<range><ge>1.6</ge><lt>1.6.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	32-bit builds of PNG library are vulnerable to an unsigned
	 integer overflow that is triggered by a crafted wide
	 interlaced images.
	 Overflow results in a heap corruption that will crash the
	 application and may lead to the controlled overwrite of a
	 selected portions of process address space.
 </body>
 </description>
 <references>
 <url>http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt</url>
 <url>http://codelabs.ru/security/vulns/analysis/libpng/2014-dec-libpng-1.6.15/</url>
 </references>
 <dates>
 <discovery>2014-12-23</discovery>
 <entry>2015-01-05</entry>
 </dates>
 </vuln>

<vuln vid="9575259a-92d5-11e4-bce6-d050992ecde8">
 <topic>file -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>file</name>
	<range><lt>5.21</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>8.4</ge><lt>8.4_20</lt></range>
	<range><ge>9.1</ge><lt>9.1_23</lt></range>
	<range><ge>9.2</ge><lt>9.2_16</lt></range>
	<range><ge>9.3</ge><lt>9.3_6</lt></range>
	<range><ge>10.0</ge><lt>10.0_13</lt></range>
	<range><ge>10.1</ge><lt>10.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RedHat reports:
	<blockquote cite="http://seclists.org/oss-sec/2014/q4/1056">
	 Thomas Jarosch of Intra2net AG reported a number of
	 denial of service issues (resource consumption) in
	 the ELF parser used by file(1). These issues were
	 fixed in the 5.21 release of file(1), but by mistake
	 are missing from the changelog.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3710</cvename>
 <cvename>CVE-2014-8116</cvename>
 <cvename>CVE-2014-8117</cvename>
 <freebsdsa>SA-14:28.file</freebsdsa>
 <url>http://seclists.org/oss-sec/2014/q4/1056</url>
 </references>
 <dates>
 <discovery>2014-12-16</discovery>
 <entry>2015-01-02</entry>
 </dates>
 </vuln>

<vuln vid="c3d43001-8064-11e4-801f-0022156e8794">
 <topic>mutt -- denial of service via crafted mail message</topic>
 <affects>
 <package>
	<name>mutt</name>
	<range><ge>1.5.22</ge><lt>1.5.23_7</lt></range>
 </package>
 <package>
	<name>ja-mutt</name>
	<range><ge>1.5.22</ge><lt>1.5.23_7</lt></range>
 </package>
 <package>
	<name>zh-mutt</name>
	<range><ge>1.5.22</ge><lt>1.5.23_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVD reports:
	<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9116">
	 The write_one_header function in mutt 1.5.23 does not
	 properly handle newline characters at the beginning of a
	 header, which allows remote attackers to cause a denial of
	 service (crash) via a header with an empty body, which
	 triggers a heap-based buffer overflow in the mutt_substrdup
	 function.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>71334</bid>
 <cvename>CVE-2014-9116</cvename>
 <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=771125</url>
 <url>http://dev.mutt.org/trac/ticket/3716</url>
 </references>
 <dates>
 <discovery>2014-11-26</discovery>
 <entry>2014-12-23</entry>
 </dates>
 </vuln>

<vuln vid="4033d826-87dd-11e4-9079-3c970e169bc2">
 <topic>ntp -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ntp</name>
	<name>ntp-devel</name>
	<range><lt>4.2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CERT reports:
	<blockquote cite="http://www.kb.cert.org/vuls/id/852879">
	 The Network Time Protocol (NTP) provides networked
	 systems with a way to synchronize time for various
	 services and applications. ntpd version 4.2.7 and
	 previous versions allow attackers to overflow several
	 buffers in a way that may allow malicious code to
	 be executed. ntp-keygen prior to version 4.2.7p230
	 also uses a non-cryptographic random number generator
	 when generating symmetric keys.
	 The buffer overflow vulnerabilities in ntpd may
	 allow a remote unauthenticated attacker to execute
	 arbitrary malicious code with the privilege level
	 of the ntpd process. The weak default key and
	 non-cryptographic random number generator in
	 ntp-keygen may allow an attacker to gain
	 information regarding the integrity checking
	 and authentication encryption schemes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-9293</cvename>
 <cvename>CVE-2014-9294</cvename>
 <cvename>CVE-2014-9295</cvename>
 <cvename>CVE-2014-9296</cvename>
 <url>http://www.kb.cert.org/vuls/id/852879</url>
 </references>
 <dates>
 <discovery>2014-12-19</discovery>
 <entry>2014-12-20</entry>
 </dates>
 </vuln>

<vuln vid="1d567278-87a5-11e4-879c-000c292ee6b8">
 <topic>git -- Arbitrary command execution on case-insensitive filesystems</topic>
 <affects>
 <package>
	<name>git</name>
	<range><lt>2.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Git Project reports:
	<blockquote cite="http://article.gmane.org/gmane.linux.kernel/1853266">
	 When using a case-insensitive filesystem an attacker can
	 craft a malicious Git tree that will cause Git to overwrite
	 its own .git/config file when cloning or checking out a
	 repository, leading to arbitrary command execution in the
	 client machine. If you are a hosting service whose users
	 may fetch from your service to Windows or Mac OS X machines,
	 you are strongly encouraged to update to protect such users
	 who use existing versions of Git.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-9390</cvename>
 <url>https://github.com/blog/1938-git-client-vulnerability-announced</url>
 <url>http://article.gmane.org/gmane.linux.kernel/1853266</url>
 </references>
 <dates>
 <discovery>2014-12-19</discovery>
 <entry>2014-12-19</entry>
 </dates>
 </vuln>

<vuln vid="0c5cf7c4-856e-11e4-a089-60a44c524f57">
 <topic>otrs -- Incomplete Access Control</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><gt>3.2.*</gt><lt>3.2.17</lt></range>
	<range><gt>3.3.*</gt><lt>3.3.11</lt></range>
	<range><gt>4.0.*</gt><lt>4.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OTRS project reports:
	<blockquote cite="http://www.otrs.com/security-advisory-2014-06-incomplete-access-control/">
	 An attacker with valid OTRS credentials could access and manipulate ticket data
	 of other users via the GenericInterface, if a ticket webservice is configured
	 and not additionally secured.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.otrs.com/security-advisory-2014-06-incomplete-access-control/</url>
 <cvename>CVE-2014-9324</cvename>
 </references>
 <dates>
 <discovery>2014-12-16</discovery>
 <entry>2014-12-16</entry>
 </dates>
 </vuln>

<vuln vid="f5561ade-846c-11e4-b7a7-20cf30e32f6d">
 <topic>subversion -- DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>mod_dav_svn</name>
	<range><ge>1.8.0</ge><lt>1.8.11</lt></range>
 </package>
 <package>
	<name>subversion16</name>
	<range><ge>1.0.0</ge><lt>1.7.19</lt></range>
 </package>
 <package>
	<name>subversion17</name>
	<range><ge>1.0.0</ge><lt>1.7.19</lt></range>
 </package>
 <package>
	<name>subversion</name>
	<range><ge>1.0.0</ge><lt>1.7.19</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion Project reports:
	<blockquote cite="http://subversion.apache.org/security/">
	 Subversion's mod_dav_svn Apache HTTPD server module will crash when it
	 receives a REPORT request for some invalid formatted special URIs.
	 Subversion's mod_dav_svn Apache HTTPD server module will crash when it
	 receives a request for some invalid formatted special URIs.
	 We consider this to be a medium risk vulnerability. Repositories which
	 allow for anonymous reads will be vulnerable without authentication.
	 Unfortunately, no special configuration is required and all mod_dav_svn
	 servers are vulnerable.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3580</cvename>
 <cvename>CVE-2014-8108</cvename>
 <url>http://subversion.apache.org/security/CVE-2014-3580-advisory.txt</url>
 <url>http://subversion.apache.org/security/CVE-2014-8108-advisory.txt</url>
 </references>
 <dates>
 <discovery>2014-12-13</discovery>
 <entry>2014-12-15</entry>
 </dates>
 </vuln>

<vuln vid="fdf72a0e-8371-11e4-bc20-001636d274f3">
 <topic>NVIDIA UNIX driver -- remote denial of service or arbitrary code execution</topic>
 <affects>
 <package>
	<name>nvidia-driver</name>
	<range><lt>340.65</lt></range>
 </package>
 <package>
	<name>nvidia-driver-304</name>
	<range><lt>304.125</lt></range>
 </package>
 <package>
	<name>nvidia-driver-173</name>
	<range><le>173.14.35_3</le></range>
 </package>
 <package>
	<name>nvidia-driver-96</name>
	<range><le>96.43.23_2</le></range>
 </package>
 <package>
	<name>nvidia-driver-71</name>
	<range><le>71.86.15_4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVIDIA Unix security team reports:
	<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3610">
	 The GLX indirect rendering support supplied on NVIDIA products
	 is subject to the recently disclosed X.Org vulnerabilities
	 (CVE-2014-8093, CVE-2014-8098) as well as internally identified
	 vulnerabilities (CVE-2014-8298).
	 Depending on how it is configured, the X server typically runs
	 with raised privileges, and listens for GLX indirect rendering
	 protocol requests from a local socket and potentially a TCP/IP
	 port. The vulnerabilities could be exploited in a way that
	 causes the X server to access uninitialized memory or overwrite
	 arbitrary memory in the X server process. This can cause a
	 denial of service (e.g., an X server segmentation fault), or
	 could be exploited to achieve arbitrary code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8298</cvename>
 <cvename>CVE-2014-8093</cvename>
 <cvename>CVE-2014-8098</cvename>
 </references>
 <dates>
 <discovery>2014-12-03</discovery>
 <entry>2014-12-14</entry>
 </dates>
 </vuln>

<vuln vid="ab3e98d9-8175-11e4-907d-d050992ecde8">
 <topic>bind -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>bind99</name>
	<name>bind99-base</name>
	<range><lt>9.9.6</lt></range>
 </package>
 <package>
	<name>bind98</name>
	<name>bind98-base</name>
	<name>bind96</name>
	<name>bind96-base</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.3</ge><lt>9.3_6</lt></range>
	<range><ge>9.2</ge><lt>9.2_16</lt></range>
	<range><ge>9.1</ge><lt>9.1_23</lt></range>
	<range><ge>8.4</ge><lt>8.4_20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://www.isc.org/blogs/important-security-advisory-posted/">
	 We have today posted updated versions of 9.9.6 and 9.10.1
	 to address a significant security vulnerability in DNS
	 resolution. The flaw was discovered by Florian Maury of
	 ANSSI, and applies to any recursive resolver that does not
	 support a limit on the number of recursions. [<a href="http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.html">CERTFR-2014-AVI-512</a>],
	 [USCERT <a href="www.kb.cert.org/vuls/id/264212">VU#264212</a>]
	 A flaw in delegation handling could be exploited to put named
	 into an infinite loop, in which each lookup of a name server
	 triggered additional lookups of more name servers. This has
	 been addressed by placing limits on the number of levels of
	 recursion named will allow (default 7), and on the number of
	 queries that it will send before terminating a recursive query
	 (default 50). The recursion depth limit is configured via the
	 max-recursion-depth option, and the query limit via the
	 max-recursion-queries option. For more information, see the
	 security advisory at <a href="https://kb.isc.org/article/AA-01216/">https://kb.isc.org/article/AA-01216/</a>.
	 <a href="https://kb.isc.org/article/AA-01216/">[CVE-2014-8500]</a>
	 [RT #37580]
	 In addition, we have also corrected a potential security
	 vulnerability in the GeoIP feature in the 9.10.1 release only.
	 For more information on this issue, see the security advisory
	 at <a href="https://kb.isc.org/article/AA-01217">https://kb.isc.org/article/AA-01217</a>.
	 <a href="https://kb.isc.org/article/AA-01217">[CVE-2014-8680]</a>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-14:29.bind</freebsdsa>
 <cvename>CVE-2014-8500</cvename>
 <cvename>CVE-2014-8680</cvename>
 <url>https://www.isc.org/blogs/important-security-advisory-posted/</url>
 </references>
 <dates>
 <discovery>2014-12-08</discovery>
 <entry>2014-12-11</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="94268da0-8118-11e4-a180-001999f8d30b">
 <topic>asterisk -- Remote Crash Vulnerability in WebSocket Server</topic>
 <affects>
 <package>
	<name>asterisk11</name>
	<range><lt>11.14.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 When handling a WebSocket frame the res_http_websocket
	 module dynamically changes the size of the memory used
	 to allow the provided payload to fit. If a payload length
	 of zero was received the code would incorrectly attempt
	 to resize to zero. This operation would succeed and end
	 up freeing the memory but be treated as a failure. When
	 the session was subsequently torn down this memory would
	 get freed yet again causing a crash.
	 Users of the WebSocket functionality also did not take
	 into account that provided text frames are not guaranteed
	 to be NULL terminated. This has been fixed in chan_sip
	 and chan_pjsip in the applicable versions.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2014-019.html</url>
 <cvename>CVE-2014-9374</cvename>
 </references>
 <dates>
 <discovery>2014-10-30</discovery>
 <entry>2014-12-11</entry>
 <modified>2015-01-29</modified>
 </dates>
 </vuln>

<vuln vid="27b9b2f0-8081-11e4-b4ca-bcaec565249c">
 <topic>xserver -- multiple issue with X client request handling</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<range><lt>1.12.4_10,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Alan Coopersmith reports:
	<blockquote cite="http://lists.x.org/archives/xorg-announce/2014-December/002500.html">
	 Ilja van Sprundel, a security researcher with IOActive, has
	 discovered a large number of issues in the way the X server
	 code base handles requests from X clients, and has worked
	 with X.Org's security team to analyze, confirm, and fix
	 these issues.

The vulnerabilities could be exploited to cause the X server
	 to access uninitialized memory or overwrite arbitrary memory
	 in the X server process. This can cause a denial of service
	 (e.g., an X server segmentation fault), or could be exploited
	 to achieve arbitrary code execution.

The GLX extension to the X Window System allows an X client
	 to send X protocol to the X server, to request that the X
	 server perform OpenGL rendering on behalf of the X client.
	 This is known as "GLX indirect rendering", as opposed to
	 "GLX direct rendering" where the X client submits OpenGL
	 rendering commands directly to the GPU, bypassing the X
	 server and avoiding the X server code for GLX protocol
	 handling.

Most GLX indirect rendering implementations share some
	 common ancestry, dating back to "Sample Implementation"
	 code from Silicon Graphics, Inc (SGI), which SGI
	 originally commercially licensed to other Unix workstation
	 and graphics vendors, and later released as open source, so
	 those vulnerabilities may affect other licensees of SGI's
	 code base beyond those running code from the X.Org Foundation
	 or the XFree86 Project.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.x.org/archives/xorg-announce/2014-December/002500.html</url>
 <cvename>CVE-2014-8091</cvename>
 <cvename>CVE-2014-8092</cvename>
 <cvename>CVE-2014-8093</cvename>
 <cvename>CVE-2014-8094</cvename>
 <cvename>CVE-2014-8095</cvename>
 <cvename>CVE-2014-8096</cvename>
 <cvename>CVE-2014-8097</cvename>
 <cvename>CVE-2014-8098</cvename>
 <cvename>CVE-2014-8099</cvename>
 <cvename>CVE-2014-8100</cvename>
 <cvename>CVE-2014-8101</cvename>
 <cvename>CVE-2014-8102</cvename>
 </references>
 <dates>
 <discovery>2014-12-09</discovery>
 <entry>2014-12-10</entry>
 </dates>
 </vuln>

<vuln vid="10d73529-7f4b-11e4-af66-00215af774f0">
 <topic>unbound -- can be tricked into following an endless series of delegations, this consumes a lot of resources</topic>
 <affects>
 <package>
	<name>unbound</name>
	<range><lt>1.5.1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_14</lt></range>
	<range><ge>10.1</ge><lt>10.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Unbound developer reports:
	<blockquote cite="http://unbound.net/downloads/CVE-2014-8602.txt">
	 The resolver can be tricked into following an endless series of
	 delegations, this consumes a lot of resources.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://unbound.net/downloads/CVE-2014-8602.txt</url>
 <freebsdsa>SA-14:30.unbound</freebsdsa>
 <cvename>CVE-2014-8602</cvename>
 </references>
 <dates>
 <discovery>2014-12-08</discovery>
 <entry>2014-12-09</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="567beb1e-7e0a-11e4-b9cc-bcaec565249c">
 <topic>freetype -- Out of bounds stack-based read/write</topic>
 <affects>
 <package>
	<name>freetype2</name>
	<range><lt>2.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Werner LEMBERG reports:
	<blockquote cite="http://lists.nongnu.org/archive/html/freetype-announce/2014-12/msg00000.html">
	 The fix for CVE-2014-2240 was not 100% complete to fix the issue
	 from the CVE completly.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.nongnu.org/archive/html/freetype-announce/2014-12/msg00000.html</url>
 <cvename>CVE-2014-2240</cvename>
 </references>
 <dates>
 <discovery>2014-12-07</discovery>
 <entry>2014-12-07</entry>
 </dates>
 </vuln>

<vuln vid="c9c46fbf-7b83-11e4-a96e-6805ca0b3d42">
 <topic>phpMyAdmin -- XSS and DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.2.0</ge><lt>4.2.13.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php">
	 DoS vulnerability with long passwords.
	 With very long passwords it was possible to initiate a
	 denial of service attack on phpMyAdmin.
	 We consider this vulnerability to be serious.
	 This vulnerability can be mitigated by configuring
	 throttling in the webserver.
	</blockquote>

<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php">
	 XSS vulnerability in redirection mechanism.
	 With a crafted URL it was possible to trigger an XSS in
	 the redirection mechanism in phpMyAdmin.
	 We consider this vulnerability to be non critical.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php</url>
 <cvename>CVE-2014-9218</cvename>
 <cvename>CVE-2014-9219</cvename>
 </references>
 <dates>
 <discovery>2014-12-03</discovery>
 <entry>2014-12-04</entry>
 </dates>
 </vuln>

<vuln vid="7ae61870-9dd2-4884-a2f2-f19bb5784d09">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>34.0,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>31.3.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>34.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.31</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>31.3.0</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.31</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>31.3.0</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>31.3.0</lt></range>
 </package>
 <package>
	<name>nss</name>
	<range><lt>3.17.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 ASN.1 DER decoding of lengths is too permissive, allowing
	 undetected smuggling of arbitrary data
	 MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10
	 logging input data to /tmp directory
	 MFSA-2014-89 Bad casting from the BasicThebesLayer to
	 BasicContainerLayer
	 MFSA-2014-88 Buffer overflow while parsing media content
	 MFSA-2014-87 Use-after-free during HTML5 parsing
	 MFSA-2014-86 CSP leaks redirect data via violation reports
	 MFSA-2014-85 XMLHttpRequest crashes with some input streams
	 MFSA-2014-84 XBL bindings accessible via improper CSS
	 declarations
	 MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0
	 / rv:31.3)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1587</cvename>
 <cvename>CVE-2014-1588</cvename>
 <cvename>CVE-2014-1589</cvename>
 <cvename>CVE-2014-1590</cvename>
 <cvename>CVE-2014-1591</cvename>
 <cvename>CVE-2014-1592</cvename>
 <cvename>CVE-2014-1593</cvename>
 <cvename>CVE-2014-1594</cvename>
 <cvename>CVE-2014-1595</cvename>
 <cvename>CVE-2014-1569</cvename>
 <url>https://www.mozilla.org/security/advisories/mfsa2014-83</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2014-84</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2014-85</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2014-86</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2014-87</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2014-88</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2014-89</url>
 <url>https://www.mozilla.org/security/advisories/mfsa2014-90</url>
 <url>https://www.mozilla.org/security/advisories/</url>
 </references>
 <dates>
 <discovery>2014-12-01</discovery>
 <entry>2014-12-02</entry>
 </dates>
 </vuln>

<vuln vid="23ab5c3e-79c3-11e4-8b1e-d050992ecde8">
 <topic>OpenVPN -- denial of service security vulnerability</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><lt>2.0.11</lt></range>
	<range><ge>2.1.0</ge><lt>2.2.3</lt></range>
	<range><ge>2.3.0</ge><lt>2.3.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenVPN project reports:
	<blockquote cite="https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b">
	 In late November 2014 Dragana Damjanovic notified OpenVPN
	 developers of a critical denial of service security vulnerability
	 (CVE-2014-8104). The vulnerability allows an tls-authenticated
	 client to crash the server by sending a too-short control channel
	 packet to the server. In other words this vulnerability is denial
	 of service only.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8104</cvename>
 <url>https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b</url>
 </references>
 <dates>
 <discovery>2014-12-01</discovery>
 <entry>2014-12-02</entry>
 </dates>
 </vuln>

<vuln vid="a33addf6-74e6-11e4-a615-f8b156b6dcc8">
 <topic>flac -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>flac</name>
	<range><lt>1.3.0_3</lt></range>
 </package>
 <package>
	<name>linux-c6-flac</name>
	<range><lt>1.2.1_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Erik de Castro Lopo reports:
	<blockquote cite="http://lists.xiph.org/pipermail/flac-dev/2014-November/005226.html">
	 Google Security Team member, Michele Spagnuolo, recently
	 found two potential problems in the FLAC code base. They are:
	 <ul>
	 <li>CVE-2014-9028: Heap buffer write overflow.</li>
	 <li>CVE-2014-8962: Heap buffer read overflow.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://git.xiph.org/?p=flac.git;a=commit;h=5b3033a2b355068c11fe637e14ac742d273f076e</url>
 <cvename>CVE-2014-8962</cvename>
 <url>https://git.xiph.org/?p=flac.git;a=commit;h=fcf0ba06ae12ccd7c67cee3c8d948df15f946b85</url>
 <cvename>CVE-2014-9028</cvename>
 </references>
 <dates>
 <discovery>2014-11-25</discovery>
 <entry>2014-11-25</entry>
 <modified>2015-07-15</modified>
 </dates>
 </vuln>

<vuln vid="7bfd797c-716d-11e4-b008-001999f8d30b">
 <topic>asterisk -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk11</name>
	<range><lt>11.14.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 AST-2014-014 - High call load may result in hung
	 channels in ConfBridge.
	 AST-2014-017 - Permission escalation through ConfBridge
	 actions/dialplan functions.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2014-014.html</url>
 <cvename>CVE-2014-8414</cvename>
 <url>http://downloads.asterisk.org/pub/security/AST-2014-017.html</url>
 <cvename>CVE-2014-8417</cvename>
 </references>
 <dates>
 <discovery>2014-11-21</discovery>
 <entry>2014-11-21</entry>
 </dates>
 </vuln>

<vuln vid="a92ed304-716c-11e4-b008-001999f8d30b">
 <topic>asterisk -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk</name>
	<range><lt>1.8.32.1</lt></range>
 </package>
 <package>
	<name>asterisk11</name>
	<range><lt>11.14.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/security">
	 AST-2014-012 - Mixed IP address families in access
	 control lists may permit unwanted traffic.
	 AST-2014-018 - AMI permission escalation through DB
	 dialplan function.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2014-012.html</url>
 <cvename>CVE-2014-8412</cvename>
 <url>http://downloads.asterisk.org/pub/security/AST-2014-018.html</url>
 <cvename>CVE-2014-8418</cvename>
 </references>
 <dates>
 <discovery>2014-11-21</discovery>
 <entry>2014-11-21</entry>
 </dates>
 </vuln>

<vuln vid="a5d4a82a-7153-11e4-88c7-6805ca0b3d42">
 <topic>phpMyAdmin -- XSS and information disclosure vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.2.0</ge><lt>4.2.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php">
	 <ul>
	 <li>With a crafted database, table or column name it is
	 possible to trigger an XSS attack in the table browse
	 page.</li>
	 <li>With a crafted ENUM value it is possible to trigger
	 XSS attacks in the table print view and zoom search
	 pages.</li>
	 <li>With a crafted value for font size it is possible to
	 trigger an XSS attack in the home page.</li>
	 </ul>
	 These vulnerabilities can be triggered only by someone
	 who is logged in to phpMyAdmin, as the usual token
	 protection prevents non-logged-in users from accessing the
	 required pages. Moreover, exploitation of the XSS
	 vulnerability related to the font size requires forgery of
	 the pma_fontsize cookie.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php">
	 In the GIS editor feature, a parameter specifying the
	 geometry type was not correcly validated, opening the door
	 to a local file inclusion attack.
	 This vulnerability can be triggered only by someone who
	 is logged in to phpMyAdmin, as the usual token protection
	 prevents non-logged-in users from accessing the required
	 page.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php">
	 With a crafted file name it is possible to trigger an
	 XSS in the error reporting page.
	 This vulnerability can be triggered only by someone who
	 is logged in to phpMyAdmin, as the usual token protection
	 prevents non-logged-in users from accessing the required
	 page.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php">
	 In the error reporting feature, a parameter specifying
	 the file was not correctly validated, allowing the
	 attacker to derive the line count of an arbitrary file
	 This vulnerability can be triggered only by someone who
	 is logged in to phpMyAdmin, as the usual token protection
	 prevents non-logged-in users from accessing the required
	 page.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php</url>
 <cvename>CVE-2014-8958</cvename>
 <cvename>CVE-2014-8959</cvename>
 <cvename>CVE-2014-8960</cvename>
 <cvename>CVE-2014-8961</cvename>
 </references>
 <dates>
 <discovery>2014-11-20</discovery>
 <entry>2014-11-21</entry>
 </dates>
 </vuln>

<vuln vid="890b6b22-70fa-11e4-91ae-5453ed2e2b49">
 <topic>kwebkitpart, kde-runtime -- insufficient input validation</topic>
 <affects>
 <package>
	<name>kde-runtime</name>
	<range><lt>4.14.2_2</lt></range>
 </package>
 <package>
	<name>kwebkitpart</name>
	<range><lt>1.3.2_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Albert Aastals Cid reports:
	<blockquote cite="https://www.kde.org/info/security/advisory-20141113-1.txt">
	 kwebkitpart and the bookmarks:// io slave were not sanitizing
	 input correctly allowing to some javascript being executed on the
	 context of the referenced hostname.
	 Whilst in most cases, the JavaScript will be executed in an
	 untrusted context, with the bookmarks IO slave, it will be executed
	 in the context of the referenced hostname. It should however be
	 noted that KDE mitigates this risk by attempting to ensure that
	 such URLs cannot be embedded directly into Internet hosted
	 content.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.kde.org/info/security/advisory-20141113-1.txt</url>
 <cvename>CVE-2014-8600</cvename>
 </references>
 <dates>
 <discovery>2014-11-13</discovery>
 <entry>2014-11-20</entry>
 </dates>
 </vuln>

<vuln vid="5a35bc56-7027-11e4-a4a3-001999f8d30b">
 <topic>yii -- Remote arbitrary PHP code execution</topic>
 <affects>
 <package>
	<name>yii</name>
	<range><lt>1.1.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Yii PHP Framework developers report:
	<blockquote cite="http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/">
	 We are releasing Yii 1.1.15 to fix a security issue
	 found in 1.1.14. We urge all 1.1.14 users to upgrade their
	 Yii to this latest release. Note that the issue only
	 affects 1.1.14. All previous releases are not affected.
	 Upgrading to this release from 1.1.14 is very safe and
	 will not break your existing code.
	 The vulnerability is in the CDetailView widget. When
	 a Yii application uses this widget and configures the
	 "value" property of a CDetailView attribute using end
	 user inputs, it may allow attackers to potentially execute
	 arbitrary PHP scripts on the server. We are not showing
	 how to exploit it here to allow users to upgrade before
	 details about the exploit become publicly known. To our
	 knowledge the details of this issue are only known to
	 core team members.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-4672</cvename>
 <url>http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix</url>
 </references>
 <dates>
 <discovery>2014-07-03</discovery>
 <entry>2014-11-19</entry>
 </dates>
 </vuln>

<vuln vid="d395e44f-6f4f-11e4-a444-00262d5ed8ee">
 <topic>chromium -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>chromium</name>
	<range><lt>39.0.2171.65</lt></range>
 </package>
 <package>
	<name>chromium-pulse</name>
	<range><lt>39.0.2171.65</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Chrome Releases reports:
	<blockquote cite="http://googlechromereleases.blogspot.nl/2014/11/stable-channel-update_18.html">
	 42 security fixes in this release, including:
	 <ul>
	 <li>[389734] High CVE-2014-7899: Address bar spoofing. Credit to
	 Eli Grey.</li>
	 <li>[406868] High CVE-2014-7900: Use-after-free in pdfium. Credit
	 to Atte Kettunen from OUSPG.</li>
	 <li>[413375] High CVE-2014-7901: Integer overflow in pdfium. Credit
	 to cloudfuzzer.</li>
	 <li>[414504] High CVE-2014-7902: Use-after-free in pdfium. Credit
	 to cloudfuzzer.</li>
	 <li>[414525] High CVE-2014-7903: Buffer overflow in pdfium. Credit
	 to cloudfuzzer.</li>
	 <li>[418161] High CVE-2014-7904: Buffer overflow in Skia. Credit to
	 Atte Kettunen from OUSPG.</li>
	 <li>[421817] High CVE-2014-7905: Flaw allowing navigation to
	 intents that do not have the BROWSABLE category. Credit to
	 WangTao(neobyte) of Baidu X-Team.</li>
	 <li>[423030] High CVE-2014-7906: Use-after-free in pepper plugins.
	 Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.</li>
	 <li>[423703] High CVE-2014-0574: Double-free in Flash. Credit to
	 biloulehibou.</li>
	 <li>[424453] High CVE-2014-7907: Use-after-free in blink. Credit to
	 Chen Zhang (demi6od) of the NSFOCUS Security Team.</li>
	 <li>[425980] High CVE-2014-7908: Integer overflow in media. Credit
	 to Christoph Diehl.</li>
	 <li>[391001] Medium CVE-2014-7909: Uninitialized memory read in
	 Skia. Credit to miaubiz.</li>
	 <li>CVE-2014-7910: Various fixes from internal audits, fuzzing and
	 other initiatives.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0574</cvename>
 <cvename>CVE-2014-7899</cvename>
 <cvename>CVE-2014-7900</cvename>
 <cvename>CVE-2014-7901</cvename>
 <cvename>CVE-2014-7902</cvename>
 <cvename>CVE-2014-7903</cvename>
 <cvename>CVE-2014-7904</cvename>
 <cvename>CVE-2014-7905</cvename>
 <cvename>CVE-2014-7906</cvename>
 <cvename>CVE-2014-7907</cvename>
 <cvename>CVE-2014-7908</cvename>
 <cvename>CVE-2014-7909</cvename>
 <cvename>CVE-2014-7910</cvename>
 <url>http://googlechromereleases.blogspot.nl/2014/11/stable-channel-update_18.html</url>
 </references>
 <dates>
 <discovery>2014-11-18</discovery>
 <entry>2014-11-18</entry>
 </dates>
 </vuln>

<vuln vid="dafa13a8-6e9b-11e4-8ef7-5453ed2e2b49">
 <topic>kde-workspace -- privilege escalation</topic>
 <affects>
 <package>
	<name>kde-workspace</name>
	<range><lt>4.11.13_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	David Edmundson reports:
	<blockquote cite="https://www.kde.org/info/security/advisory-20141106-1.txt">
	 KDE workspace configuration module for setting the date and time
	 has a helper program which runs as root for performing actions.
	 This is secured with polkit.
	 This helper takes the name of the ntp utility to run as an
	 argument. This allows a hacker to run any arbitrary command as root
	 under the guise of updating the time.
	 An application can gain root priveledges from an admin user with
	 either misleading information or no interaction.
	 On some systems the user will be shown a prompt to change the
	 time. However, if the system has policykit-desktop-privileges
	 installed, the datetime helper will be invoked by an admin user
	 without any prompts.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8651</cvename>
 <mlist>http://seclists.org/oss-sec/2014/q4/520</mlist>
 </references>
 <dates>
 <discovery>2014-11-06</discovery>
 <entry>2014-11-17</entry>
 </dates>
 </vuln>

<vuln vid="c1930f45-6982-11e4-80e1-bcaec565249c">
 <topic>dbus -- incomplete fix for CVE-2014-3636 part A</topic>
 <affects>
 <package>
	<name>dbus</name>
	<range><lt>1.8.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon McVittie reports:
	<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-November/016395.html">
	 The patch issued by the D-Bus maintainers for CVE-2014-3636
	 was based on incorrect reasoning, and does not fully prevent
	 the attack described as "CVE-2014-3636 part A", which is
	 repeated below. Preventing that attack requires raising the
	 system dbus-daemon's RLIMIT_NOFILE (ulimit -n) to a higher
	 value. CVE-2014-7824 has been allocated for this
	 vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-7824</cvename>
 <url>http://lists.freedesktop.org/archives/dbus/2014-November/016395.html</url>
 </references>
 <dates>
 <discovery>2014-11-10</discovery>
 <entry>2014-11-11</entry>
 </dates>
 </vuln>

<vuln vid="ee7b4f9d-66c8-11e4-9ae1-e8e0b722a85e">
 <topic>wget -- path traversal vulnerability in recursive FTP mode</topic>
 <affects>
 <package>
	<name>wget</name>
	<range><lt>1.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4877">
	 Absolute path traversal vulnerability in GNU Wget before
	 1.16, when recursion is enabled, allows remote FTP servers
	 to write to arbitrary files, and consequently execute
	 arbitrary code, via a LIST response that references the same
	 filename within two entries, one of which indicates that the
	 filename is for a symlink. 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-4877</cvename>
 <certvu>685996</certvu>
 </references>
 <dates>
 <discovery>2014-10-27</discovery>
 <entry>2014-11-08</entry>
 </dates>
 </vuln>

<vuln vid="0167f5ad-64ea-11e4-98c1-00269ee29e57">
 <topic>Konversation -- out-of-bounds read on a heap-allocated array</topic>
 <affects>
 <package>
	<name>konversation</name>
	<range><lt>1.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Konversation developers report:
	<blockquote cite="https://www.kde.org/info/security/advisory-20141104-1.txt">
	 Konversation's Blowfish ECB encryption support assumes incoming blocks
	 to be the expected 12 bytes. The lack of a sanity-check for the actual
	 size can cause a denial of service and an information leak to the local
	 user.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-8483</cvename>
 <url>https://www.kde.org/info/security/advisory-20141104-1.txt</url>
 </references>
 <dates>
 <discovery>2014-11-04</discovery>
 <entry>2014-11-05</entry>
 </dates>
 </vuln>

<vuln vid="21ce1840-6107-11e4-9e84-0022156e8794">
 <topic>twiki -- remote Perl code execution</topic>
 <affects>
 <package>
	<name>twiki</name>
	<range><lt>5.1.4_1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	TWiki developers report:
	<blockquote cite="http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236">
	 The debugenableplugins request parameter allows arbitrary
	 Perl code execution.
	 Using an HTTP GET request towards a TWiki server,
	 add a specially crafted debugenableplugins request parameter
	 to TWiki's view script (typically port 80/TCP).
	 Prior authentication may or may not be necessary.
	 A remote attacker can execute arbitrary Perl code
	 to view and modify any file the webserver user has access to.
	 Example: http://www.example.com/do/view/Main/WebHome?debugenableplugins=BackupRestorePlugin%3bprint("Content-Type:text/html\r\n\r\nVulnerable!")%3bexit
	 The TWiki site is vulnerable if you see a page with text
	 "Vulnerable!".
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-7236</cvename>
 <url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236</url>
 </references>
 <dates>
 <discovery>2014-10-09</discovery>
 <entry>2014-10-31</entry>
 </dates>
 </vuln>

<vuln vid="0dad9114-60cc-11e4-9e84-0022156e8794">
 <topic>jenkins -- slave-originated arbitrary code execution on master servers</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>1.587</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>1.580.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kohsuke Kawaguchi from Jenkins team reports:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30">
	 Historically, Jenkins master and slaves behaved as if
	 they altogether form a single distributed process. This
	 means a slave can ask a master to do just about anything
	 within the confinement of the operating system, such as
	 accessing files on the master or trigger other jobs on
	 Jenkins.
	 This has increasingly become problematic, as larger
	 enterprise deployments have developed more sophisticated
	 trust separation model, where the administators of a master
	 might take slaves owned by other teams. In such an
	 environment, slaves are less trusted than the master.
	 Yet the "single distributed process" assumption was not
	 communicated well to the users, resulting in vulnerabilities
	 in some deployments.
	 SECURITY-144 (CVE-2014-3665) introduces a new subsystem
	 to address this problem. This feature is off by default for
	 compatibility reasons. See Wiki for more details, who should
	 turn this on, and implications.
	 CVE-2014-3566 is rated high. It only affects
	 installations that accept slaves from less trusted
	 computers, but this will allow an owner of of such slave to
	 mount a remote code execution attack on Jenkins.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3665</cvename>
 <url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30</url>
 <url>https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control</url>
 <url>http://www.cloudbees.com/jenkins-security-advisory-2014-10-30</url>
 </references>
 <dates>
 <discovery>2014-10-30</discovery>
 <entry>2014-10-31</entry>
 </dates>
 </vuln>

<vuln vid="f8c88d50-5fb3-11e4-81bd-5453ed2e2b49">
 <topic>libssh -- PRNG state reuse on forking servers</topic>
 <affects>
 <package>
	<name>libssh</name>
	<range><lt>0.6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aris Adamantiadis reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2014/03/05/1">
	 When accepting a new connection, the server forks and the
	 child process handles the request. The RAND_bytes() function
	 of openssl doesn't reset its state after the fork, but
	 simply adds the current process id (getpid) to the PRNG
	 state, which is not guaranteed to be unique.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0017</cvename>
 <mlist>http://www.openwall.com/lists/oss-security/2014/03/05/1</mlist>
 <url>http://secunia.com/advisories/57407</url>
 </references>
 <dates>
 <discovery>2014-03-05</discovery>
 <entry>2014-10-29</entry>
 </dates>
 </vuln>

<vuln vid="d057c5e6-5b20-11e4-bebd-000c2980a9f3">
 <topic>libpurple/pidgin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libpurple</name>
	<range><lt>2.10.10</lt></range>
 </package>
 <package>
	<name>pidgin</name>
	<range><lt>2.10.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The pidgin development team reports:
	<blockquote cite="https://developer.pidgin.im/wiki/ChangeLog">
	 .
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3694</cvename>
 <cvename>CVE-2014-3697</cvename>
 <cvename>CVE-2014-3696</cvename>
 <cvename>CVE-2014-3695</cvename>
 <cvename>CVE-2014-3698</cvename>
 <url>https://developer.pidgin.im/wiki/ChangeLog</url>
 </references>
 <dates>
 <discovery>2014-10-22</discovery>
 <entry>2014-10-24</entry>
 </dates>
 </vuln>

<vuln vid="25b78f04-59c8-11e4-b711-6805ca0b3d42">
 <topic>phpMyAdmin -- XSS vulnerabilities in SQL debug output and server monitor page.</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.2.0</ge><lt>4.2.10.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php">
	 With a crafted database or table name it is possible to
	 trigger an XSS in SQL debug output when enabled and in
	 server monitor page when viewing and analysing executed
	 queries.
	 This vulnerability can be triggered only by someone who
	 is logged in to phpMyAdmin, as the usual token protection
	 prevents non-logged-in users from accessing the required
	 pages. Moreover, debugging SQL is a developer option which
	 is disabled by default and expected to be disabled in
	 production environments.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php</url>
 <cvename>CVE-2014-8326</cvename>
 </references>
 <dates>
 <discovery>2014-10-21</discovery>
 <entry>2014-10-22</entry>
 </dates>
 </vuln>

<vuln vid="76c7a0f5-5928-11e4-adc7-001999f8d30b">
 <topic>asterisk -- Asterisk Susceptibility to POODLE Vulnerability</topic>
 <affects>
 <package>
	<name>asterisk</name>
	<range><lt>1.8.31.1</lt></range>
 </package>
 <package>
	<name>asterisk11</name>
	<range><lt>11.13.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
	 The POODLE vulnerability is described under CVE-2014-3566.
	 This advisory describes the Asterisk's project susceptibility
	 to this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2014-011.html</url>
 <cvename>CVE-2014-3566</cvename>
 </references>
 <dates>
 <discovery>2014-10-20</discovery>
 <entry>2014-10-21</entry>
 </dates>
 </vuln>

<vuln vid="0642b064-56c4-11e4-8b87-bcaec565249c">
 <topic>libxml2 -- Denial of service</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.9.2</lt></range>
 </package>
 <package>
	<name>linux-c6-libxml2</name>
	<range><lt>2.7.6_2</lt></range>
 </package>
 <package>
	<name>linux-f10-libxml2</name>
	<range><ge>*</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RedHat reports:
	<blockquote cite="https://rhn.redhat.com/errata/RHSA-2014-1655.html">
	 A denial of service flaw was found in libxml2, a library
	 providing support to read, modify and write XML and HTML
	 files. A remote attacker could provide a specially crafted
	 XML file that, when processed by an application using
	 libxml2, would lead to excessive CPU consumption (denial of
	 service) based on excessive entity substitutions, even if
	 entity substitution was disabled, which is the parser default
	 behavior.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3660</cvename>
 <url>https://rhn.redhat.com/errata/RHSA-2014-1655.html</url>
 </references>
 <dates>
 <discovery>2014-10-16</discovery>
 <entry>2014-10-18</entry>
 <modified>2015-07-15</modified>
 </dates>
 </vuln>

<vuln vid="6f825fa4-5560-11e4-a4c3-00a0986f28c4">
 <topic>drupal7 -- SQL injection</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.32</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://drupal.org/SA-CORE-2013-003">
	 Drupal 7 includes a database abstraction API to ensure that
	 queries executed against the database are sanitized to prevent
	 SQL injection attacks.
	 A vulnerability in this API allows an attacker to send
	 specially crafted requests resulting in arbitrary SQL execution.
	 Depending on the content of the requests this can lead to
	 privilege escalation, arbitrary PHP execution, or other attacks.
	 This vulnerability can be exploited by anonymous users.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3704</cvename>
 <url>https://www.drupal.org/SA-CORE-2014-005</url>
 <url>https://www.sektioneins.de/en/blog/14-10-15-drupal-sql-injection-vulnerability.html</url>
 </references>
 <dates>
 <discovery>2014-10-15</discovery>
 <entry>2014-10-16</entry>
 </dates>
 </vuln>

<vuln vid="03175e62-5494-11e4-9cc1-bc5ff4fb5e7b">
 <topic>OpenSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_16</lt></range>
 </package>
 <package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1j</lt></range>
 </package>
 <package>
	<name>linux-c6-openssl</name>
	<range><lt>1.0.1e_1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>8.4</ge><lt>8.4_17</lt></range>
	<range><ge>9.1</ge><lt>9.1_20</lt></range>
	<range><ge>9.2</ge><lt>9.2_13</lt></range>
	<range><ge>9.3</ge><lt>9.3_3</lt></range>
	<range><ge>10.0</ge><lt>10.0_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL Project reports:
	<blockquote cite="https://www.openssl.org/news/secadv_20141015.txt">
	 A flaw in the DTLS SRTP extension parsing code allows an
	 attacker, who sends a carefully crafted handshake message,
	 to cause OpenSSL to fail to free up to 64k of memory causing
	 a memory leak. This could be exploited in a Denial Of Service
	 attack. This issue affects OpenSSL 1.0.1 server implementations
	 for both SSL/TLS and DTLS regardless of whether SRTP is used
	 or configured. Implementations of OpenSSL that have been
	 compiled with OPENSSL_NO_SRTP defined are not affected.
	 [CVE-2014-3513].
	 When an OpenSSL SSL/TLS/DTLS server receives a session
	 ticket the integrity of that ticket is first verified.
	 In the event of a session ticket integrity check failing,
	 OpenSSL will fail to free memory causing a memory leak.
	 By sending a large number of invalid session tickets an
	 attacker could exploit this issue in a Denial Of Service
	 attack. [CVE-2014-3567].
	 OpenSSL has added support for TLS_FALLBACK_SCSV to allow
	 applications to block the ability for a MITM attacker to
	 force a protocol downgrade.
	 Some client applications (such as browsers) will reconnect
	 using a downgraded protocol to work around interoperability
	 bugs in older servers. This could be exploited by an active
	 man-in-the-middle to downgrade connections to SSL 3.0 even
	 if both sides of the connection support higher protocols.
	 SSL 3.0 contains a number of weaknesses including POODLE
	 [CVE-2014-3566].
	 When OpenSSL is configured with "no-ssl3" as a build option,
	 servers could accept and complete a SSL 3.0 handshake, and
	 clients could be configured to send them. [CVE-2014-3568].
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-14:23.openssl</freebsdsa>
 <cvename>CVE-2014-3513</cvename>
 <cvename>CVE-2014-3566</cvename>
 <cvename>CVE-2014-3567</cvename>
 <cvename>CVE-2014-3568</cvename>
 <url>https://www.openssl.org/news/secadv_20141015.txt</url>
 </references>
 <dates>
 <discovery>2014-10-15</discovery>
 <entry>2014-10-15</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="9c1495ac-8d8c-4789-a0f3-8ca6b476619c">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>33.0,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>31.2.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>33.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.30</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>31.2.0</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.30</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>31.2.0</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><lt>31.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2014-74 Miscellaneous memory safety hazards
	 (rv:33.0 / rv:31.2)
	 MFSA 2014-75 Buffer overflow during CSS manipulation
	 MFSA 2014-76 Web Audio memory corruption issues with
	 custom waveforms
	 MFSA 2014-78 Further uninitialized memory use during GIF
	 MFSA 2014-79 Use-after-free interacting with text
	 directionality
	 MFSA 2014-80 Key pinning bypasses
	 MFSA 2014-81 Inconsistent video sharing within iframe
	 MFSA 2014-82 Accessing cross-origin objects via the
	 Alarms API
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1574</cvename>
 <cvename>CVE-2014-1575</cvename>
 <cvename>CVE-2014-1576</cvename>
 <cvename>CVE-2014-1577</cvename>
 <cvename>CVE-2014-1580</cvename>
 <cvename>CVE-2014-1581</cvename>
 <cvename>CVE-2014-1582</cvename>
 <cvename>CVE-2014-1583</cvename>
 <cvename>CVE-2014-1584</cvename>
 <cvename>CVE-2014-1585</cvename>
 <cvename>CVE-2014-1586</cvename>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-74.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-75.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-76.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-78.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-79.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-80.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-81.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-82.html</url>
 <url>https://www.mozilla.org/security/announce/</url>
 </references>
 <dates>
 <discovery>2014-10-14</discovery>
 <entry>2014-10-14</entry>
 <modified>2015-08-12</modified>
 </dates>
 </vuln>

<vuln vid="c30c3a2e-4fb1-11e4-b275-14dae9d210b8">
 <topic>foreman-proxy SSL verification issue</topic>
 <affects>
 <package>
	<name>foreman-proxy</name>
	<range><lt>1.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Foreman Security reports:
	<blockquote cite="http://projects.theforeman.org/issues/7822">
	 The smart proxy when running in an SSL-secured mode permits incoming
	 API calls to any endpoint without requiring, or performing any
	 verification of an SSL client certificate. This permits any client
	 with access to the API to make requests and perform actions
	 permitting control of Puppet CA, DHCP, DNS etc.)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3691</cvename>
 <url>https://groups.google.com/forum/#!topic/foreman-announce/LcjZx25Bl7U</url>
 </references>
 <dates>
 <discovery>2014-05-09</discovery>
 <entry>2014-10-09</entry>
 </dates>
 </vuln>

<vuln vid="b6587341-4d88-11e4-aef9-20cf30e32f6d">
 <topic>Bugzilla multiple security issues</topic>
 <affects>
 <package>
	<name>bugzilla44</name>
	<range><lt>4.4.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bugzilla Security Advisory
	<blockquote cite="http://www.bugzilla.org/security/4.0.14/">
	 <h5>Unauthorized Account Creation</h5>
	 An attacker creating a new Bugzilla account can override certain
	 parameters when finalizing the account creation that can lead to the
	 user being created with a different email address than originally
	 requested. The overridden login name could be automatically added
	 to groups based on the group's regular expression setting.
	 <h5>Cross-Site Scripting</h5>
	 During an audit of the Bugzilla code base, several places
	 were found where cross-site scripting exploits could occur which
	 could allow an attacker to access sensitive information.
	 <h5>Information Leak</h5>
	 If a new comment was marked private to the insider group, and a flag
	 was set in the same transaction, the comment would be visible to
	 flag recipients even if they were not in the insider group.
	 <h5>Social Engineering</h5>
	 Search results can be exported as a CSV file which can then be
	 imported into external spreadsheet programs. Specially formatted
	 field values can be interpreted as formulas which can be executed
	 and used to attack a user's computer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1572</cvename>
 <cvename>CVE-2014-1573</cvename>
 <cvename>CVE-2014-1571</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1074812</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1075578</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1064140</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1054702</url>
 </references>
 <dates>
 <discovery>2014-10-06</discovery>
 <entry>2014-10-06</entry>
 </dates>
 </vuln>

<vuln vid="81e2b308-4a6c-11e4-b711-6805ca0b3d42">
 <topic>rt42 -- vulnerabilities related to shellshock</topic>
 <affects>
 <package>
	<name>rt42</name>
	<range><ge>4.2.0</ge><lt>4.2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Best Practical reports:
	<blockquote cite="http://blog.bestpractical.com/2014/10/security-vulnerability-in-rt-42x-cve-2014-7227.html">
	 RT 4.2.0 and above may be vulnerable to arbitrary
	 execution of code by way of CVE-2014-7169, CVE-2014-7186,
	 CVE-2014-7187, CVE-2014-6277, or CVE-2014-6271 --
	 collectively known as "Shellshock." This vulnerability
	 requires a privileged user with access to an RT instance
	 running with SMIME integration enabled; it applies to both
	 mod_perl and fastcgi deployments. If you have already
	 taken upgrades to bash to resolve "Shellshock," you are
	 protected from this vulnerability in RT, and there is no
	 need to apply this patch. This vulnerability has been
	 assigned CVE-2014-7227.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.bestpractical.com/2014/10/security-vulnerability-in-rt-42x-cve-2014-7227.html</url>
 <cvename>CVE-2014-7227</cvename>
 </references>
 <dates>
 <discovery>2014-10-02</discovery>
 <entry>2014-10-02</entry>
 </dates>
 </vuln>

<vuln vid="549a2771-49cc-11e4-ae2c-c80aa9043978">
 <topic>jenkins -- remote execution, privilege escalation, XSS, password exposure, ACL hole, DoS</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>1.583</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>1.565.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01</url>
 <cvename>CVE-2014-3661</cvename>
 <cvename>CVE-2014-3662</cvename>
 <cvename>CVE-2014-3663</cvename>
 <cvename>CVE-2014-3664</cvename>
 <cvename>CVE-2014-3680</cvename>
 <cvename>CVE-2014-3681</cvename>
 <cvename>CVE-2014-3666</cvename>
 <cvename>CVE-2014-3667</cvename>
 <cvename>CVE-2013-2186</cvename>
 <cvename>CVE-2014-1869</cvename>
 <cvename>CVE-2014-3678</cvename>
 <cvename>CVE-2014-3679</cvename>
 </references>
 <dates>
 <discovery>2014-10-01</discovery>
 <entry>2014-10-01</entry>
 </dates>
 </vuln>

<vuln vid="512d1301-49b9-11e4-ae2c-c80aa9043978">
 <topic>bash -- remote code execution</topic>
 <affects>
 <package>
	<name>bash</name>
	<name>bash-static</name>
	<range><lt>4.3.25_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Note that this is different than the public "Shellshock"
	 issue.
	Specially crafted environment variables could lead to remote
	 arbitrary code execution. This was fixed in bash 4.3.27, however
	 the port was patched with a mitigation in 4.3.25_2.
 </body>
 </description>
 <references>
 <url>http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html</url>
 <cvename>CVE-2014-6277</cvename>
 <cvename>CVE-2014-6278</cvename>
 </references>
 <dates>
 <discovery>2014-09-27</discovery>
 <entry>2014-10-01</entry>
 </dates>
 </vuln>

<vuln vid="3e8b7f8a-49b0-11e4-b711-6805ca0b3d42">
 <topic>phpMyAdmin -- XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.2.0</ge><lt>4.2.9.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php">
	 With a crafted ENUM value it is possible to trigger an
	 XSS in table search and table structure pages. This
	 vulnerability can be triggered only by someone who is
	 logged in to phpMyAdmin, as the usual token protection
	 prevents non-logged-in users from accessing the required
	 pages.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php</url>
 <cvename>CVE-2014-7217</cvename>
 </references>
 <dates>
 <discovery>2014-10-01</discovery>
 <entry>2014-10-01</entry>
 </dates>
 </vuln>

<vuln vid="4a4e9f88-491c-11e4-ae2c-c80aa9043978">
 <topic>bash -- out-of-bounds memory access in parser</topic>
 <affects>
 <package>
	<name>bash</name>
	<name>bash-static</name>
	<range><lt>4.3.27_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RedHat security team reports:
	<blockquote cite="https://access.redhat.com/security/cve/CVE-2014-7186">
	 It was discovered that the fixed-sized redir_stack could be forced
	 to overflow in the Bash parser, resulting in memory corruption, and
	 possibly leading to arbitrary code execution when evaluating
	 untrusted input that would not otherwise be run as code.
	</blockquote>
	<blockquote cite="https://access.redhat.com/security/cve/CVE-2014-7187">
	 An off-by-one error was discovered in the way Bash was handling
	 deeply nested flow control constructs. Depending on the layout of
	 the .bss segment, this could allow arbitrary execution of code that
	 would not otherwise be executed by Bash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://access.redhat.com/security/cve/CVE-2014-7186</url>
 <cvename>CVE-2014-7186</cvename>
 <cvename>CVE-2014-7187</cvename>
 </references>
 <dates>
 <discovery>2014-09-25</discovery>
 <entry>2014-10-01</entry>
 </dates>
 </vuln>

<vuln vid="8e0e86ff-48b5-11e4-ab80-000c29f6ae42">
 <topic>rsyslog -- remote syslog PRI vulnerability</topic>
 <affects>
 <package>
	<name>rsyslog</name>
	<range><lt>7.6.7</lt></range>
 </package>
 <package>
	<name>rsyslog8</name>
	<range><lt>8.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The rsyslog project reports:
	<blockquote cite="http://www.rsyslog.com/remote-syslog-pri-vulnerability/">
	 potential abort when a message with PRI &gt; 191 was processed
	 if the "pri-text" property was used in active templates,
	 this could be abused to a remote denial of service from
	 permitted senders
	 The original fix for CVE-2014-3634 was not adequate.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.rsyslog.com/remote-syslog-pri-vulnerability/</url>
 <cvename>CVE-2014-3634</cvename>
 </references>
 <dates>
 <discovery>2014-09-30</discovery>
 <entry>2014-09-30</entry>
 <modified>2014-10-02</modified>
 </dates>
 </vuln>

<vuln vid="6c083cf8-4830-11e4-ae2c-c80aa9043978">
 <topic>fish -- local privilege escalation and remote code execution</topic>
 <affects>
 <package>
	<name>fish</name>
	<range><ge>1.6.0</ge><lt>2.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Fish developer David Adam reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2014/09/28/8">
	 This release fixes a number of local privilege escalation
	 vulnerability and one remote code execution vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2014/09/28/8</url>
 <cvename>CVE-2014-2905</cvename>
 <url>https://github.com/fish-shell/fish-shell/issues/1436</url>
 <cvename>CVE-2014-2906</cvename>
 <cvename>CVE-2014-3856</cvename>
 <url>https://github.com/fish-shell/fish-shell/issues/1437</url>
 <cvename>CVE-2014-2914</cvename>
 <url>https://github.com/fish-shell/fish-shell/issues/1438</url>
 <cvename>CVE-2014-3219</cvename>
 <url>https://github.com/fish-shell/fish-shell/issues/1440</url>
 </references>
 <dates>
 <discovery>2014-09-28</discovery>
 <entry>2014-09-29</entry>
 </dates>
 </vuln>

<vuln vid="ca44b64c-4453-11e4-9ea1-c485083ca99c">
 <topic>Flash player -- Multiple security vulnerabilities in www/linux-*-flashplugin11</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.400</lt></range>
 </package>
 <package>
	<name>linux-c6-flashplugin</name>
	<range><lt>11.2r202.400</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb14-21.html">
	 These updates address vulnerabilities that could cause a crash
	 and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0547</cvename>
 <cvename>CVE-2014-0548</cvename>
 <cvename>CVE-2014-0549</cvename>
 <cvename>CVE-2014-0550</cvename>
 <cvename>CVE-2014-0551</cvename>
 <cvename>CVE-2014-0552</cvename>
 <cvename>CVE-2014-0553</cvename>
 <cvename>CVE-2014-0554</cvename>
 <cvename>CVE-2014-0555</cvename>
 <cvename>CVE-2014-0556</cvename>
 <cvename>CVE-2014-0557</cvename>
 <cvename>CVE-2014-0559</cvename>
 <url>http://helpx.adobe.com/security/products/flash-player/apsb14-21.html</url>
 </references>
 <dates>
 <discovery>2014-09-09</discovery>
 <entry>2014-09-25</entry>
 </dates>
 </vuln>

<vuln vid="48108fb0-751c-4cbb-8f33-09239ead4b55">
 <topic>NSS -- RSA Signature Forgery</topic>
 <affects>
 <package>
	<name>linux-firefox</name>
	<range><lt>32.0.3,1</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>31.1.2</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.29.1</lt></range>
 </package>
 <package>
	<name>nss</name>
	<range><lt>3.17.1</lt></range>
 </package>
 <package>
	<name>linux-c6-nss</name>
	<range><lt>3.16.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="https://www.mozilla.org/security/announce/2014/mfsa2014-73.html">
	 Antoine Delignat-Lavaud discovered that NSS is vulnerable
	 to a variant of a signature forgery attack previously
	 published by Daniel Bleichenbacher. This is due to lenient
	 parsing of ASN.1 values involved in a signature and could
	 lead to the forging of RSA certificates.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1568</cvename>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-73.html</url>
 </references>
 <dates>
 <discovery>2014-09-23</discovery>
 <entry>2014-09-25</entry>
 </dates>
 </vuln>

<vuln vid="fb25333d-442f-11e4-98f3-5453ed2e2b49">
 <topic>krfb -- Multiple security issues in bundled libvncserver</topic>
 <affects>
 <package>
	<name>krfb</name>
	<range><lt>4.12.5_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Martin Sandsmark reports:
	<blockquote cite="http://lists.kde.org/?l=kde-announce&amp;m=141153917319769&amp;w=2">
	 krfb 4.14 [and earlier] embeds libvncserver which has had
	 several security issues.
	 Several remotely exploitable security issues have been
	 uncovered in libvncserver, some of which might allow a
	 remote authenticated user code execution or application
	 crashes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-6055</cvename>
 <mlist>http://lists.kde.org/?l=kde-announce&amp;m=141153917319769&amp;w=2</mlist>
 </references>
 <dates>
 <discovery>2014-09-23</discovery>
 <entry>2014-09-25</entry>
 </dates>
 </vuln>

<vuln vid="71ad81da-4414-11e4-a33e-3c970e169bc2">
 <topic>bash -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>bash</name>
	<name>bash-static</name>
	<range><gt>3.0</gt><le>3.0.17</le></range>
	<range><gt>3.1</gt><le>3.1.18</le></range>
	<range><gt>3.2</gt><le>3.2.52</le></range>
	<range><gt>4.0</gt><le>4.0.39</le></range>
	<range><gt>4.1</gt><le>4.1.12</le></range>
	<range><gt>4.2</gt><le>4.2.48</le></range>
	<range><gt>4.3</gt><lt>4.3.25_1</lt></range>
 </package>
 <package>
	<name>linux_base-c6</name>
	<range><lt>6.5_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chet Ramey reports:
	<blockquote cite="https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00081.html">
	 Under certain circumstances, bash will execute user code
	 while processing the environment for exported function
	 definitions.
	</blockquote>
	The original fix released for CVE-2014-6271 was not adequate. A
	 similar vulnerability was discovered and tagged as CVE-2014-7169.
 </body>
 </description>
 <references>
 <cvename>CVE-2014-6271</cvename>
 <cvename>CVE-2014-7169</cvename>
 <url>https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/</url>
 <url>https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00081.html</url>
 <url>http://seclists.org/oss-sec/2014/q3/690</url>
 </references>
 <dates>
 <discovery>2014-09-24</discovery>
 <entry>2014-09-24</entry>
 <modified>2014-09-25</modified>
 </dates>
 </vuln>

<vuln vid="e60d9e65-3f6b-11e4-ad16-001999f8d30b">
 <topic>asterisk -- Remotely triggered crash</topic>
 <affects>
 <package>
	<name>asterisk11</name>
	<range><lt>11.12.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/security">
	 When an out of call message - delivered by either the
	 SIP or PJSIP channel driver or the XMPP stack - is handled
	 in Asterisk, a crash can occur if the channel servicing
	 the message is sent into the ReceiveFax dialplan application
	 while using the res_fax_spandsp module.
	 Note that this crash does not occur when using the
	 res_fax_digium module. While this crash technically
	 occurs due to a configuration issue, as attempting to
	 receive a fax from a channel driver that only contains
	 textual information will never succeed, the likelihood
	 of having it occur is sufficiently high as to warrant
	 this advisory.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2014-010.pdf</url>
 <url>https://issues.asterisk.org/jira/browse/ASTERISK-24301</url>
 <url>https://www.asterisk.org/security</url>
 </references>
 <dates>
 <discovery>2014-09-05</discovery>
 <entry>2014-09-18</entry>
 </dates>
 </vuln>

<vuln vid="d3324c55-3f11-11e4-ad16-001999f8d30b">
 <topic>squid -- Buffer overflow in SNMP processing</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>3.4.8</lt></range>
 </package>
 <package>
	<name>squid32</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>squid33</name>
	<range><lt>3.3.13_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The squid-cache project reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2014_3.txt">
	 Due to incorrect buffer management Squid can be caused
	 by an attacker to write outside its allocated SNMP buffer.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.squid-cache.org/Advisories/SQUID-2014_3.txt</url>
 <cvename>CVE-2014-6270</cvename>
 </references>
 <dates>
 <discovery>2014-09-15</discovery>
 <entry>2014-09-18</entry>
 </dates>
 </vuln>

<vuln vid="38242d51-3e58-11e4-ac2f-bcaec565249c">
 <topic>dbus -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dbus</name>
	<range><lt>1.8.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon McVittie reports:
	<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-September/016343.html">
	 Do not accept an extra fd in the padding of a cmsg message,
	 which could lead to a 4-byte heap buffer overrun
	 (CVE-2014-3635).
	 Reduce default for maximum Unix file descriptors passed per
	 message from 1024 to 16, preventing a uid with the default
	 maximum number of connections from exhausting the system
	 bus' file descriptors under Linux's default rlimit
	 (CVE-2014-3636).
	 Disconnect connections that still have a fd pending
	 unmarshalling after a new configurable limit,
	 pending_fd_timeout (defaulting to 150 seconds), removing
	 the possibility of creating an abusive connection that
	 cannot be disconnected by setting up a circular reference
	 to a connection's file descriptor (CVE-2014-3637).
	 Reduce default for maximum pending replies per connection
	 from 8192 to 128, mitigating an algorithmic complexity
	 denial-of-service attack (CVE-2014-3638).
	 Reduce default for authentication timeout on the system
	 bus from 30 seconds to 5 seconds, avoiding denial of service
	 by using up all unauthenticated connection slots; and when
	 all unauthenticated connection slots are used up, make new
	 connection attempts block instead of disconnecting them
	 (CVE-2014-3639).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3635</cvename>
 <cvename>CVE-2014-3636</cvename>
 <cvename>CVE-2014-3637</cvename>
 <cvename>CVE-2014-3638</cvename>
 <cvename>CVE-2014-3639</cvename>
 <url>http://lists.freedesktop.org/archives/dbus/2014-September/016343.html</url>
 </references>
 <dates>
 <discovery>2014-09-16</discovery>
 <entry>2014-09-17</entry>
 </dates>
 </vuln>

<vuln vid="77b784bb-3dc6-11e4-b191-f0def16c5c1b">
 <topic>nginx -- inject commands into SSL session vulnerability</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><ge>0.6.0</ge><lt>1.6.2,2</lt></range>
 </package>
 <package>
	<name>nginx-devel</name>
	<range><ge>0.5.6</ge><lt>1.7.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The nginx project reports:
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html">
	 Security: it was possible to reuse SSL sessions in unrelated contexts
	 if a shared SSL session cache or the same TLS session ticket key was
	 used for multiple "server" blocks (CVE-2014-3616).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3616</cvename>
 <url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html</url>
 </references>
 <dates>
 <discovery>2014-09-16</discovery>
 <entry>2014-09-16</entry>
 </dates>
 </vuln>

<vuln vid="cc627e6c-3b89-11e4-b629-6805ca0b3d42">
 <topic>phpMyAdmin -- XSRF/CSRF due to DOM based XSS in the micro history feature</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.2.0</ge><lt>4.2.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php">
	 XSRF/CSRF due to DOM based XSS in the micro history feature.
	 By deceiving a logged-in user to click on a crafted URL,
	 it is possible to perform remote code execution and in some
	 cases, create a root account due to a DOM based XSS
	 vulnerability in the micro history feature.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php</url>
 <cvename>CVE-2014-6300</cvename>
 </references>
 <dates>
 <discovery>2014-09-13</discovery>
 <entry>2014-09-13</entry>
 </dates>
 </vuln>

<vuln vid="36858e78-3963-11e4-ad84-000c29f6ae42">
 <topic>security/ossec-hids-* -- root escalation via temp files</topic>
 <affects>
 <package>
	<name>ossec-hids-server</name>
	<name>ossec-hids-client</name>
	<name>ossec-hids-local</name>
	<range><lt>2.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OSSEC reports:
	<blockquote cite="http://www.ossec.net/?p=1135">
	 This correction will create the temp file for the hosts deny file
	 in /var/ossec and will use mktemp where available to create
	 NON-predictable temp file name. In cases where mktemp is not
	 available we have written a BAD version of mktemp, but should be a
	 little better then just process id.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-5284</cvename>
 <url>http://www.ossec.net/?p=1135</url>
 </references>
 <dates>
 <discovery>2014-09-09</discovery>
 <entry>2014-09-11</entry>
 </dates>
 </vuln>

<vuln vid="6318b303-3507-11e4-b76c-0011d823eebd">
 <topic>trafficserver -- unspecified vulnerability</topic>
 <affects>
 <package>
	<name>trafficserver</name>
	<range><lt>5.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bryan Call reports:
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/trafficserver-users/201407.mbox/%3CBFCEC9C8-1BE9-4DCA-AF9C-B8FE798EEC07@yahoo-inc.com%3E">
	 Below is our announcement for the security issue reported to us
	 from Yahoo! Japan. All versions of Apache Traffic Server are
	 vulnerable. We urge users to upgrade to either 4.2.1.1 or 5.0.1
	 immediately.
	 This fixes CVE-2014-3525 and limits access to how the health
	 checks are performed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3525</cvename>
 <url>http://mail-archives.apache.org/mod_mbox/trafficserver-users/201407.mbox/%3CBFCEC9C8-1BE9-4DCA-AF9C-B8FE798EEC07@yahoo-inc.com%3E</url>
 </references>
 <dates>
 <discovery>2014-07-23</discovery>
 <entry>2014-09-05</entry>
 </dates>
 </vuln>

<vuln vid="84203724-296b-11e4-bebd-000c2980a9f3">
 <topic>file -- buffer overruns and missing buffer size tests</topic>
 <affects>
 <package>
	<name>file</name>
	<range><lt>5.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Christos Zoulas reports:
	<blockquote cite="http://mx.gw.com/pipermail/file/2014/001553.html">
	 A specially crafted file can cause a segmentation fault.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://mx.gw.com/pipermail/file/2014/001553.html</url>
 </references>
 <dates>
 <discovery>2014-06-09</discovery>
 <entry>2014-08-21</entry>
 </dates>
 </vuln>

<vuln vid="3c5579f7-294a-11e4-99f6-00e0814cab4e">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py27-django</name>
	<range><ge>1.6</ge><lt>1.6.6</lt></range>
 </package>
 <package>
	<name>py27-django15</name>
	<range><ge>1.5</ge><lt>1.5.9</lt></range>
 </package>
 <package>
	<name>py27-django14</name>
	<range><ge>1.4</ge><lt>1.4.14</lt></range>
 </package>
 <package>
	<name>py32-django</name>
	<range><ge>1.6</ge><lt>1.6.6</lt></range>
 </package>
 <package>
	<name>py32-django15</name>
	<range><ge>1.5</ge><lt>1.5.9</lt></range>
 </package>
 <package>
	<name>py33-django</name>
	<range><ge>1.6</ge><lt>1.6.6</lt></range>
 </package>
 <package>
	<name>py33-django15</name>
	<range><ge>1.5</ge><lt>1.5.9</lt></range>
 </package>
 <package>
	<name>py34-django</name>
	<range><ge>1.6</ge><lt>1.6.6</lt></range>
 </package>
 <package>
	<name>py34-django15</name>
	<range><ge>1.5</ge><lt>1.5.9</lt></range>
 </package>
 <package>
	<name>py27-django-devel</name>
	<range><lt>20140821,1</lt></range>
 </package>
 <package>
	<name>py32-django-devel</name>
	<range><lt>20140821,1</lt></range>
 </package>
 <package>
	<name>py33-django-devel</name>
	<range><lt>20140821,1</lt></range>
 </package>
 <package>
	<name>py34-django-devel</name>
	<range><lt>20140821,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Django project reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2014/aug/20/security/">
	 These releases address an issue with reverse() generating external
	 URLs; a denial of service involving file uploads; a potential
	 session hijacking issue in the remote-user middleware; and a data
	 leak in the administrative interface. We encourage all users of
	 Django to upgrade as soon as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2014/aug/20/security/</url>
 <cvename>CVE-2014-0480</cvename>
 <cvename>CVE-2014-0481</cvename>
 <cvename>CVE-2014-0482</cvename>
 <cvename>CVE-2014-0483</cvename>
 </references>
 <dates>
 <discovery>2014-08-20</discovery>
 <entry>2014-08-21</entry>
 </dates>
 </vuln>

<vuln vid="d2a892b9-2605-11e4-9da0-00a0986f28c4">
 <topic>PHP multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php53</name>
	<range><lt>5.3.29</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP Team reports:
	<blockquote cite="http://php.net/ChangeLog-5.php#5.3.29">
	 insecure temporary file use in the configure script
	 unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion
	 
	 Heap buffer over-read in DateInterval
	 fileinfo: cdf_read_short_sector insufficient boundary check
	 fileinfo: CDF infinite loop in nelements DoS
	 fileinfo: fileinfo: numerous file_printf calls resulting in
	 performance degradation)
	 Fix potential segfault in dns_check_record()
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-6712</cvename>
 <cvename>CVE-2014-0207</cvename>
 <cvename>CVE-2014-0237</cvename>
 <cvename>CVE-2014-0238</cvename>
 <cvename>CVE-2014-3515</cvename>
 <cvename>CVE-2014-3981</cvename>
 <cvename>CVE-2014-4049</cvename>
 <url>http://php.net/ChangeLog-5.php#5.3.29</url>
 <url>https://www.sektioneins.de/en/blog/14-07-04-phpinfo-infoleak.html</url>
 </references>
 <dates>
 <discovery>2014-08-14</discovery>
 <entry>2014-08-18</entry>
 </dates>
 </vuln>

<vuln vid="fbb01289-2645-11e4-bc44-6805ca0b3d42">
 <topic>phpMyAdmin -- XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.2.0</ge><lt>4.2.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php">
	 Multiple XSS vulnerabilities in browse table, ENUM
	 editor, monitor, query charts and table relations pages.
	 With a crafted database, table or a primary/unique key
	 column name it is possible to trigger an XSS when dropping
	 a row from the table. With a crafted column name it is
	 possible to trigger an XSS in the ENUM editor dialog. With
	 a crafted variable name or a crafted value for unit field
	 it is possible to trigger a self-XSS when adding a new
	 chart in the monitor page. With a crafted value for x-axis
	 label it is possible to trigger a self-XSS in the query
	 chart page. With a crafted relation name it is possible to
	 trigger an XSS in table relations page.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php">
	 XSS in view operations page.
	 With a crafted view name it is possible to trigger an
	 XSS when dropping the view in view operation page.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php</url>
 <cvename>CVE-2014-5273</cvename>
 <cvename>CVE-2014-5274</cvename>
 </references>
 <dates>
 <discovery>2014-08-17</discovery>
 <entry>2014-08-17</entry>
 </dates>
 </vuln>

<vuln vid="69048656-2187-11e4-802c-20cf30e32f6d">
 <topic>serf -- SSL Certificate Null Byte Poisoning</topic>
 <affects>
 <package>
	<name>serf</name>
	<range><lt>1.3.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	serf Development list reports:
	<blockquote cite="https://groups.google.com/forum/#!topic/serf-dev/NvgPoK6sFsc">
	 Serf provides APIs to retrieve information about a certificate. These
	 APIs return the information as NUL terminated strings (commonly called C
	 strings). X.509 uses counted length strings which may include a NUL byte.
	 This means that a library user will interpret any information as ending
	 upon seeing this NUL byte and will only see a partial value for that field.
	 
	 Attackers could exploit this vulnerability to create a certificate that a
	 client will accept for a different hostname than the full certificate is
	 actually for by embedding a NUL byte in the certificate.
	 This can lead to a man-in-the-middle attack. There are no known instances
	 of this problem being exploited in the wild and in practice it should be
	 difficult to actually exploit this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3504</cvename>
 </references>
 <dates>
 <discovery>2014-08-06</discovery>
 <entry>2014-08-11</entry>
 </dates>
 </vuln>

<vuln vid="83a418cc-2182-11e4-802c-20cf30e32f6d">
 <topic>subversion -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>subversion16</name>
	<range><ge>1.0.0</ge><lt>1.7.18</lt></range>
 </package>
 <package>
	<name>subversion17</name>
	<range><ge>1.0.0</ge><lt>1.7.18</lt></range>
 </package>
 <package>
	<name>subversion</name>
	<range><ge>1.0.0</ge><lt>1.7.18</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion Project reports:
	<blockquote cite="http://subversion.apache.org/security/CVE-2014-3522-advisory.txt">
	 Using the Serf RA layer of Subversion for HTTPS uses the apr_fnmatch API
	 to handle matching wildcards in certificate Common Names and Subject
	 Alternate Names. However, apr_fnmatch is not designed for this purpose.
	 Instead it is designed to behave like common shell globbing. In particular
	 this means that '*' is not limited to a single label within a hostname
	 (i.e. it will match '.'). But even further apr_fnmatch supports '?' and
	 character classes (neither of which are part of the RFCs defining how
	 certificate validation works).
	 Subversion stores cached credentials by an MD5 hash based on the URL and
	 the authentication realm of the server the credentials are cached for.
	 MD5 has been shown to be subject to chosen plaintext hash collisions.
	 This means it may be possible to generate an authentication realm which
	 results in the same MD5 hash for a different URL.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3522</cvename>
 <cvename>CVE-2014-3528</cvename>
 <url>http://subversion.apache.org/security/CVE-2014-3522-advisory.txt</url>
 <url>http://subversion.apache.org/security/CVE-2014-3528-advisory.txt</url>
 </references>
 <dates>
 <discovery>2014-08-06</discovery>
 <entry>2014-08-11</entry>
 </dates>
 </vuln>

<vuln vid="ad747a01-1fee-11e4-8ff1-f0def16c5c1b">
 <topic>nginx -- inject commands into SSL session vulnerability</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><ge>1.6.0,2</ge><lt>1.6.1,2</lt></range>
 </package>
 <package>
	<name>nginx-devel</name>
	<range><ge>1.5.6</ge><lt>1.7.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The nginx project reports:
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000144.html">
	 Security: pipelined commands were not discarded after STARTTLS
	 command in SMTP proxy (CVE-2014-3556); the bug had appeared in 1.5.6.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3556</cvename>
 <url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000144.html</url>
 </references>
 <dates>
 <discovery>2014-08-05</discovery>
 <entry>2014-08-09</entry>
 </dates>
 </vuln>

<vuln vid="8aff07eb-1dbd-11e4-b6ba-3c970e169bc2">
 <topic>OpenSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_14</lt></range>
 </package>
 <package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1i</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>8.4</ge><lt>8.4_15</lt></range>
	<range><ge>9.1</ge><lt>9.1_18</lt></range>
	<range><ge>9.2</ge><lt>9.2_11</lt></range>
	<range><ge>9.3</ge><lt>9.3_1</lt></range>
	<range><ge>10.0</ge><lt>10.0_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL Project reports:
	<blockquote cite="https://www.openssl.org/news/secadv_20140806.txt">
	 A flaw in OBJ_obj2txt may cause pretty printing functions
	 such as X509_name_oneline, X509_name_print_ex et al. to leak
	 some information from the stack. [CVE-2014-3508]
	 The issue affects OpenSSL clients and allows a malicious
	 server to crash the client with a null pointer dereference
	 (read) by specifying an SRP ciphersuite even though it was
	 not properly negotiated with the client. [CVE-2014-5139]
	 If a multithreaded client connects to a malicious server
	 using a resumed session and the server sends an ec point
	 format extension it could write up to 255 bytes to freed
	 memory. [CVE-2014-3509]
	 An attacker can force an error condition which causes
	 openssl to crash whilst processing DTLS packets due to
	 memory being freed twice. This can be exploited through
	 a Denial of Service attack. [CVE-2014-3505]
	 An attacker can force openssl to consume large amounts
	 of memory whilst processing DTLS handshake messages.
	 This can be exploited through a Denial of Service
	 attack. [CVE-2014-3506]
	 By sending carefully crafted DTLS packets an attacker
	 could cause openssl to leak memory. This can be exploited
	 through a Denial of Service attack. [CVE-2014-3507]
	 OpenSSL DTLS clients enabling anonymous (EC)DH
	 ciphersuites are subject to a denial of service attack.
	 A malicious server can crash the client with a null pointer
	 dereference (read) by specifying an anonymous (EC)DH
	 ciphersuite and sending carefully crafted handshake
	 messages. [CVE-2014-3510]
	 A flaw in the OpenSSL SSL/TLS server code causes the
	 server to negotiate TLS 1.0 instead of higher protocol
	 versions when the ClientHello message is badly
	 fragmented. This allows a man-in-the-middle attacker
	 to force a downgrade to TLS 1.0 even if both the server
	 and the client support a higher protocol version, by
	 modifying the client's TLS records. [CVE-2014-3511]
	 A malicious client or server can send invalid SRP
	 parameters and overrun an internal buffer. Only
	 applications which are explicitly set up for SRP
	 use are affected. [CVE-2014-3512]
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.openssl.org/news/secadv_20140806.txt</url>
 <freebsdsa>SA-14:18.openssl</freebsdsa>
 <cvename>CVE-2014-3505</cvename>
 <cvename>CVE-2014-3506</cvename>
 <cvename>CVE-2014-3507</cvename>
 <cvename>CVE-2014-3508</cvename>
 <cvename>CVE-2014-3509</cvename>
 <cvename>CVE-2014-3510</cvename>
 <cvename>CVE-2014-3511</cvename>
 <cvename>CVE-2014-3512</cvename>
 <cvename>CVE-2014-5139</cvename>
 </references>
 <dates>
 <discovery>2014-08-06</discovery>
 <entry>2014-08-06</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="be5421ab-1b56-11e4-a767-5453ed2e2b49">
 <topic>krfb -- Possible Denial of Service or code execution via integer overflow</topic>
 <affects>
 <package>
	<name>krfb</name>
	<range><lt>4.12.5_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Albert Aastals Cid reports:
	<blockquote cite="http://lists.kde.org/?l=kde-announce&amp;m=140709940701878&amp;w=2">
	 krfb embeds libvncserver which embeds liblzo2, it contains various
	 flaws that result in integer overflow problems.
	 This potentially allows a malicious application to create a
	 possible denial of service or code execution. Due to the need to
	 exploit precise details of the target architecture and threading it
	 is unlikely that remote code execution can be achieved in
	 practice.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-4607</cvename>
 <mlist>http://lists.kde.org/?l=kde-announce&amp;m=140709940701878&amp;w=2</mlist>
 </references>
 <dates>
 <discovery>2014-08-03</discovery>
 <entry>2014-08-03</entry>
 </dates>
 </vuln>

<vuln vid="89ff45e3-1a57-11e4-bebd-000c2980a9f3">
 <topic>samba -- remote code execution</topic>
 <affects>
 <package>
	<name>samba4</name>
	<range><ge>4.0.0</ge><lt>4.0.21</lt></range>
 </package>
 <package>
	<name>samba41</name>
	<range><ge>4.1.0</ge><lt>4.1.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samba developers report:
	<blockquote cite="http://www.samba.org/samba/security/CVE-2014-3560">
	 A malicious browser can send packets that may overwrite the heap of
	 the target nmbd NetBIOS name services daemon. It may be possible to
	 use this to generate a remote code execution vulnerability as the
	 superuser (root).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3560</cvename>
 <url>http://www.samba.org/samba/security/CVE-2014-3560</url>
 </references>
 <dates>
 <discovery>2014-07-31</discovery>
 <entry>2014-08-02</entry>
 </dates>
 </vuln>

<vuln vid="90ca3ba5-19e6-11e4-8616-001b3856973b">
 <topic>gpgme -- heap-based buffer overflow in gpgsm status handler</topic>
 <affects>
 <package>
	<name>gpgme</name>
	<range><lt>1.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tomas Trnka reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1113267">
	 Gpgme contains a buffer overflow in the gpgsm status handler
	 that could possibly be exploited using a specially crafted certificate.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3564</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1113267</url>
 </references>
 <dates>
 <discovery>2014-06-25</discovery>
 <entry>2014-08-02</entry>
 </dates>
 </vuln>

<vuln vid="2f90556f-18c6-11e4-9cc4-5453ed2e2b49">
 <topic>kdelibs -- KAuth PID Reuse Flaw</topic>
 <affects>
 <package>
	<name>kdelibs</name>
	<range><lt>4.12.5_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Martin Sandsmark reports:
	<blockquote cite="http://lists.kde.org/?l=kde-announce&amp;m=140674898412923&amp;w=2">
	 The KAuth framework uses polkit-1 API which tries to authenticate
	 using the requestors PID. This is prone to PID reuse race
	 conditions.
	 This potentially allows a malicious application to pose as another
	 for authentication purposes when executing privileged actions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-5033</cvename>
 <mlist>http://lists.kde.org/?l=kde-announce&amp;m=140674898412923&amp;w=2</mlist>
 </references>
 <dates>
 <discovery>2014-07-30</discovery>
 <entry>2014-07-31</entry>
 </dates>
 </vuln>

<vuln vid="31c09848-1829-11e4-bf04-60a44c524f57">
 <topic>tor -- traffic confirmation attack</topic>
 <affects>
 <package>
	<name>tor</name>
	<range><lt>0.2.4.23</lt></range>
 </package>
 <package>
	<name>tor-devel</name>
	<range><lt>0.2.5.6.a</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Tor Project reports:
	<blockquote cite="https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html">
	 Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a
	 circuit after an inbound RELAY_EARLY cell is received by a client,
	 which makes it easier for remote attackers to conduct
	 traffic-confirmation attacks by using the pattern of RELAY and
	 RELAY_EARLY cells as a means of communicating information about
	 hidden service names.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html</url>
 <url>https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack</url>
 <cvename>CVE-2014-5117</cvename>
 </references>
 <dates>
 <discovery>2014-07-30</discovery>
 <entry>2014-07-30</entry>
 </dates>
 </vuln>

<vuln vid="13419364-1685-11e4-bf04-60a44c524f57">
 <topic>i2p -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>i2p</name>
	<range><lt>0.9.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The i2p project reports:
	<blockquote cite="http://geti2p.net/en/blog/post/2014/07/26/0.9.14-Release">
	 XSS and remote execution vulnerabilities reported by Exodus Intelligence.
	</blockquote>
	Exodus Intelligence reports:
	<blockquote cite="http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/">
	 The vulnerability we have found is able to perform remote code
	 execution with a specially crafted payload. This payload can be
	 customized to unmask a user and show the public IP address in
	 which the user connected from within 'a couple of seconds.'
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/</url>
 <url>http://geti2p.net/en/blog/post/2014/07/26/0.9.14-Release</url>
 </references>
 <dates>
 <discovery>2014-07-24</discovery>
 <entry>2014-07-28</entry>
 </dates>
 </vuln>

<vuln vid="9defb2d6-1404-11e4-8cae-20cf30e32f6d">
 <topic>bugzilla -- Cross Site Request Forgery</topic>
 <affects>
 <package>
	<name>bugzilla44</name>
	<range><lt>4.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/4.0.13/">
	 Adobe does not properly restrict the SWF file format,
	 which allows remote attackers to conduct cross-site
	 request forgery (CSRF) attacks against Bugzilla's JSONP
	 endpoint, possibly obtaining sensitive bug information,
	 via a crafted OBJECT element with SWF content satisfying
	 the character-set requirements of a callback API.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1546</cvename>
 </references>
 <dates>
 <discovery>2014-07-24</discovery>
 <entry>2014-07-25</entry>
 </dates>
 </vuln>

<vuln vid="f927e06c-1109-11e4-b090-20cf30e32f6d">
 <topic>apache22 -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>apache22</name>
	<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
 </package>
 <package>
	<name>apache22-event-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
 </package>
 <package>
	<name>apache22-itk-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
 </package>
 <package>
	<name>apache22-peruser-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
 </package>
 <package>
	<name>apache22-worker-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache HTTP SERVER PROJECT reports:
	 <blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.29">
	 mod_deflate: The DEFLATE input filter (inflates request bodies) now
	 limits the length and compression ratio of inflated request bodies to
	 avoid denial of service via highly compressed bodies. See directives
	 DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and
	 DeflateInflateRatioBurst.
	 mod_cgid: Fix a denial of service against CGI scripts that do not consume
	 stdin that could lead to lingering HTTPD child processes filling up the
	 scoreboard and eventually hanging the server. By default, the client I/O
	 timeout (Timeout directive) now applies to communication with scripts. The
	 CGIDScriptTimeout directive can be used to set a different timeout for
	 communication with scripts.
	 Fix a race condition in scoreboard handling, which could lead to a heap
	 buffer overflow.
	 core: HTTP trailers could be used to replace HTTP headers late during
	 request processing, potentially undoing or otherwise confusing modules
	 that examined or modified request headers earlier. Adds "MergeTrailers"
	 directive to restore legacy behavior.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0118</cvename>
 <cvename>CVE-2014-0231</cvename>
 <cvename>CVE-2014-0226</cvename>
 <cvename>CVE-2013-5704</cvename>
 </references>
 <dates>
 <discovery>2014-07-19</discovery>
 <entry>2014-07-24</entry>
 <modified>2014-09-03</modified>
 </dates>
 </vuln>

<vuln vid="81fc1076-1286-11e4-bebd-000c2980a9f3">
 <topic>tomcat -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><lt>6.0.40</lt></range>
 </package>
 <package>
	<name>tomcat7</name>
	<range><lt>7.0.53</lt></range>
 </package>
 <package>
	<name>tomcat8</name>
	<range><lt>8.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tomcat Security Team reports:
	<blockquote cite="https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.54">
	 Tomcat does not properly restrict XSLT stylesheets, which allows
	 remote attackers to bypass security-manager restrictions and read
	 arbitrary files via a crafted web application that provides an XML
	 external entity declaration in conjunction with an entity
	 reference, related to an XML External Entity (XXE) issue.
	 An integer overflow, when operated behind a reverse proxy, allows
	 remote attackers to conduct HTTP request smuggling attacks via a
	 crafted Content-Length HTTP header.
	 An integer overflow in parseChunkHeader allows remote attackers
	 to cause a denial of service (resource consumption) via a malformed
	 chunk size in chunked transfer coding of a request during the
	 streaming of data.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0096</cvename>
 <cvename>CVE-2014-0099</cvename>
 <cvename>CVE-2014-0075</cvename>
 <url>https://tomcat.apache.org/security-6.html</url>
 <url>https://tomcat.apache.org/security-7.html</url>
 <url>https://tomcat.apache.org/security-8.html</url>
 </references>
 <dates>
 <discovery>2014-05-23</discovery>
 <entry>2014-07-23</entry>
 <modified>2017-03-18</modified>
 </dates>
 </vuln>

<vuln vid="978b0f76-122d-11e4-afe3-bc5ff4fb5e7b">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>31.0,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>24.7.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>31.0,1</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>24.7.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>24.7.0</lt></range>
 </package>
 <package>
	<name>nss</name>
	<range><lt>3.16.1_2</lt></range>
	
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2014-66 IFRAME sandbox same-origin access through
	 redirect
	 MFSA 2014-65 Certificate parsing broken by non-standard
	 character encoding
	 MFSA 2014-64 Crash in Skia library when scaling high
	 quality images
	 MFSA 2014-63 Use-after-free while when manipulating
	 certificates in the trusted cache
	 MFSA 2014-62 Exploitable WebGL crash with Cesium
	 JavaScript library
	 MFSA 2014-61 Use-after-free with FireOnStateChange
	 event
	 MFSA 2014-60 Toolbar dialog customization event
	 spoofing
	 MFSA 2014-59 Use-after-free in DirectWrite font
	 handling
	 MFSA 2014-58 Use-after-free in Web Audio due to
	 incorrect control message ordering
	 MFSA 2014-57 Buffer overflow during Web Audio
	 buffering for playback
	 MFSA 2014-56 Miscellaneous memory safety hazards
	 (rv:31.0 / rv:24.7)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1544</cvename>
 <cvename>CVE-2014-1547</cvename>
 <cvename>CVE-2014-1548</cvename>
 <cvename>CVE-2014-1549</cvename>
 <cvename>CVE-2014-1550</cvename>
 <cvename>CVE-2014-1551</cvename>
 <cvename>CVE-2014-1552</cvename>
 <cvename>CVE-2014-1555</cvename>
 <cvename>CVE-2014-1556</cvename>
 <cvename>CVE-2014-1557</cvename>
 <cvename>CVE-2014-1558</cvename>
 <cvename>CVE-2014-1559</cvename>
 <cvename>CVE-2014-1560</cvename>
 <cvename>CVE-2014-1561</cvename>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-56.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-57.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-58.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-59.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-60.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-61.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-62.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-63.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-64.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-65.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-66.html</url>
 <url>https://www.mozilla.org/security/announce/</url>
 </references>
 <dates>
 <discovery>2014-07-22</discovery>
 <entry>2014-07-23</entry>
 </dates>
 </vuln>

<vuln vid="ecea9e92-0be5-4931-88da-8772d044972a">
 <topic>mcollective -- cert valication issue</topic>
 <affects>
 <package>
	<name>mcollective</name>
	<range><lt>2.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Melissa Stone reports:
	<blockquote cite="https://groups.google.com/forum/#!topic/puppet-announce/cPykqUXMmK4">
	 The MCollective aes_security public key plugin does not correctly
	 validate certs against the CA. By exploiting this vulnerability
	 within a race/initialization window, an attacker with local access
	 could initiate an unauthorized MCollective client connection with a
	 server, and thus control the mcollective plugins running on that
	 server. This vulnerability requires a collective be configured to
	 use the aes_security plugin. Puppet Enterprise and open source
	 MCollective are not configured to use the plugin and are not
	 vulnerable by default.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3251</cvename>
 <url>https://groups.google.com/forum/#!topic/puppet-announce/cPykqUXMmK4</url>
 </references>
 <dates>
 <discovery>2014-07-09</discovery>
 <entry>2014-07-21</entry>
 </dates>
 </vuln>

<vuln vid="904d78b8-0f7e-11e4-8b71-5453ed2e2b49">
 <topic>qt4-imageformats, qt5-gui -- DoS vulnerability in the GIF image handler</topic>
 <affects>
 <package>
	<name>qt4-imageformats</name>
	<range><lt>4.8.6_1</lt></range>
 </package>
 <package>
	<name>qt5-gui</name>
	<range><lt>5.2.1_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Richard J. Moore reports:
	<blockquote cite="http://lists.qt-project.org/pipermail/announce/2014-April/000045.html">
	 The builtin GIF decoder in QtGui prior to Qt 5.3 contained a bug
	 that would lead to a null pointer dereference when loading certain
	 hand crafted corrupt GIF files. This in turn would cause the
	 application loading these hand crafted GIFs to crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0190</cvename>
 <bid>67087</bid>
 <mlist>http://lists.qt-project.org/pipermail/announce/2014-April/000045.html</mlist>
 </references>
 <dates>
 <discovery>2014-04-24</discovery>
 <entry>2014-07-19</entry>
 <modified>2014-07-21</modified>
 </dates>
 </vuln>

<vuln vid="4364e1f1-0f44-11e4-b090-20cf30e32f6d">
 <topic>apache24 -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Apache HTTP SERVER PROJECT reports:</h1>
	<blockquote cite="http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/CHANGES?view=markup&amp;pathrev=1610737">
	 mod_proxy: Fix crash in Connection header handling which allowed a
	 denial of service attack against a reverse proxy with a threaded MPM.
	 Fix a race condition in scoreboard handling, which could lead to a
	 heap buffer overflow.
	 mod_deflate: The DEFLATE input filter (inflates request bodies) now
	 limits the length and compression ratio of inflated request bodies to avoid
	 denial of sevice via highly compressed bodies. See directives
	 DeflateInflateLimitRequestBody, DeflateInflateRatioLimit,
	 and DeflateInflateRatioBurst.
	 mod_cgid: Fix a denial of service against CGI scripts that do
	 not consume stdin that could lead to lingering HTTPD child processes
	 filling up the scoreboard and eventually hanging the server. By
	 default, the client I/O timeout (Timeout directive) now applies to
	 communication with scripts. The CGIDScriptTimeout directive can be
	 used to set a different timeout for communication with scripts.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0117</cvename>
 <cvename>CVE-2014-3523</cvename>
 <cvename>CVE-2014-0226</cvename>
 <cvename>CVE-2014-0118</cvename>
 <cvename>CVE-2014-0231</cvename>
 </references>
 <dates>
 <discovery>2014-07-15</discovery>
 <entry>2014-07-19</entry>
 </dates>
 </vuln>

<vuln vid="3f09ca29-0e48-11e4-b17a-6805ca0b3d42">
 <topic>phpMyAdmin -- multiple XSS vulnerabilities, missing validation</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.2.0</ge><lt>4.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php">
	 Self-XSS due to unescaped HTML output in database
	 structure page.
	 With a crafted table comment, it is possible to trigger
	 an XSS in database structure page.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php">
	 Self-XSS due to unescaped HTML output in database
	 triggers page.
	 When navigating into the database triggers page, it is
	 possible to trigger an XSS with a crafted trigger
	 name.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php">
	 Multiple XSS in AJAX confirmation messages.
	 With a crafted column name it is possible to trigger an
	 XSS when dropping the column in table structure page. With
	 a crafted table name it is possible to trigger an XSS when
	 dropping or truncating the table in table operations
	 page.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php">
	 Access for an unprivileged user to MySQL user list.
	 An unpriviledged user could view the MySQL user list and
	 manipulate the tabs displayed in phpMyAdmin for them.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-4954</cvename>
 <cvename>CVE-2014-4955</cvename>
 <cvename>CVE-2014-4986</cvename>
 <cvename>CVE-2014-4987</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php</url>
 </references>
 <dates>
 <discovery>2014-07-18</discovery>
 <entry>2014-07-18</entry>
 <modified>2014-07-20</modified>
 </dates>
 </vuln>

<vuln vid="4a114331-0d24-11e4-8dd2-5453ed2e2b49">
 <topic>kdelibs4 -- KMail/KIO POP3 SSL Man-in-the-middle Flaw</topic>
 <affects>
 <package>
	<name>kdelibs</name>
	<range><ge>4.10.95</ge><lt>4.12.5_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Richard J. Moore reports:
	<blockquote cite="http://www.kde.org/info/security/advisory-20140618-1.txt">
	 The POP3 kioslave used by KMail will accept invalid
	 certificates without presenting a dialog to the user due a
	 bug that leads to an inability to display the dialog
	 combined with an error in the way the result is checked.
	 This flaw allows an active attacker to perform MITM
	 attacks against the ioslave which could result in the leakage of
	 sensitive data such as the authentication details and the contents of
	 emails.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3494</cvename>
 <bid>68113</bid>
 <mlist>http://lists.kde.org/?l=kde-announce&amp;m=140312275318160&amp;w=2</mlist>
 </references>
 <dates>
 <discovery>2014-06-17</discovery>
 <entry>2014-07-16</entry>
 </dates>
 </vuln>

<vuln vid="ff98087f-0a8f-11e4-b00b-5453ed2e2b49">
 <topic>postfixadmin -- SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>postfixadmin</name>
	<range><lt>2.3.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Thijs Kinkhorst reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2014/03/26/6">
	 Postfixadmin has an SQL injection vulnerability. This
	 vulnerability is only exploitable by authenticated users able to
	 create new aliases.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-2655</cvename>
 <bid>66455</bid>
 <freebsdpr>ports/189248</freebsdpr>
 <mlist>http://www.openwall.com/lists/oss-security/2014/03/26/6</mlist>
 <url>https://www.debian.org/security/2014/dsa-2889</url>
 </references>
 <dates>
 <discovery>2014-03-28</discovery>
 <entry>2014-07-13</entry>
 <modified>2015-09-28</modified>
 </dates>
 </vuln>

<vuln vid="e6a7636a-02d0-11e4-88b6-080027671656">
 <topic>dbus -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dbus</name>
	<range><lt>1.8.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon McVittie reports:
	<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-July/016235.html">
	 Alban Crequy at Collabora Ltd. discovered a bug in dbus-daemon's
	 support for file descriptor passing. A malicious process could
	 force system services or user applications to be disconnected
	 from the D-Bus system bus by sending them a message containing
	 a file descriptor, then causing that file descriptor to exceed
	 the kernel's maximum recursion depth (itself introduced to fix
	 a DoS) before dbus-daemon forwards the message to the victim
	 process. Most services and applications exit when disconnected
	 from the system bus, leading to a denial of service.
	 Additionally, Alban discovered that bug fd.o#79694, a bug
	 previously reported by Alejandro Martínez Suárez which was n
	 believed to be security flaw, could be used for a similar denial
	 of service, by causing dbus-daemon to attempt to forward invalid
	 file descriptors to a victim process when file descriptors become
	 associated with the wrong message.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3532</cvename>
 <cvename>CVE-2014-3533</cvename>
 <url>http://lists.freedesktop.org/archives/dbus/2014-July/016235.html</url>
 </references>
 <dates>
 <discovery>2014-07-02</discovery>
 <entry>2014-07-03</entry>
 </dates>
 </vuln>

<vuln vid="17dfd984-feba-11e3-b938-5404a68ad561">
 <topic>mencoder -- potential buffer overrun when processing malicious lzo compressed input</topic>
 <affects>
 <package>
	<name>mencoder</name>
	<range><lt>1.1.r20140418_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michael Niedermayer and Luca Barbato report in upstream ffmpeg:
	<blockquote>
	 avutil/lzo: Fix integer overflow
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ccda51b14c0fcae2fad73a24872dce75a7964996</url>
 <url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d6af26c55c1ea30f85a7d9edbc373f53be1743ee</url>
 <cvename>CVE-2014-4610</cvename>
 </references>
 <dates>
 <discovery>2014-06-24</discovery>
 <entry>2014-06-28</entry>
 </dates>
 </vuln>

<vuln vid="9ab3a22c-feb8-11e3-b938-5404a68ad561">
 <topic>mplayer -- potential buffer overrun when processing malicious lzo compressed input</topic>
 <affects>
 <package>
	<name>mplayer</name>
	<range><lt>1.1.r20140418_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michael Niedermayer and Luca Barbato report in upstream ffmpeg:
	<blockquote>
	 avutil/lzo: Fix integer overflow
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ccda51b14c0fcae2fad73a24872dce75a7964996</url>
 <url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d6af26c55c1ea30f85a7d9edbc373f53be1743ee</url>
 <cvename>CVE-2014-4610</cvename>
 </references>
 <dates>
 <discovery>2014-06-24</discovery>
 <entry>2014-06-28</entry>
 </dates>
 </vuln>

<vuln vid="d1f5e12a-fd5a-11e3-a108-080027ef73ec">
 <topic>LZO -- potential buffer overrun when processing malicious input data</topic>
 <affects>
 <package>
	<name>lzo2</name>
	<range><lt>2.07</lt></range>
 </package>
 <package>
	<name>busybox</name>
	<range><lt>1.22.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Markus Franz Xaver Johannes Oberhumer reports, in the package's NEWS file:
	<blockquote>
	 Fixed a potential integer overflow condition in the "safe"
	 decompressor variants which could result in a possible buffer
	 overrun when processing maliciously crafted compressed input
	 data.

As this issue only affects 32-bit systems and also can only happen
	 if you use uncommonly huge buffer sizes where you have to decompress
	 more than 16 MiB (2^24 bytes) compressed bytes within a single
	 function call, the practical implications are limited.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.oberhumer.com/opensource/lzo/download/lzo-2.07.tar.gz</url>
 <cvename>CVE-2014-4608</cvename>
 </references>
 <dates>
 <discovery>2014-06-25</discovery>
 <entry>2014-06-26</entry>
 <modified>2015-01-06</modified>
 </dates>
 </vuln>

<vuln vid="1c840eb9-fb32-11e3-866e-b499baab0cbe">
 <topic>gnupg -- possible DoS using garbled compressed data packets</topic>
 <affects>
 <package>
	<name>gnupg1</name>
	<range><lt>1.4.17</lt></range>
 </package>
 <package>
	<name>gnupg</name>
	<range><lt>2.0.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Werner Koch reports:
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html">
	 This release includes a *security fix* to stop
	 a possible DoS using garbled compressed data packets which can be used
	 to put gpg into an infinite loop.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html</url>
 <url>http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000345.html</url>
 </references>
 <dates>
 <discovery>2014-06-23</discovery>
 <entry>2014-06-23</entry>
 </dates>
 </vuln>

<vuln vid="6ad309d9-fb03-11e3-bebd-000c2980a9f3">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba36</name>
	<range><lt>3.6.24</lt></range>
 </package>
 <package>
	<name>samba4</name>
	<range><lt>4.0.19</lt></range>
 </package>
 <package>
	<name>samba41</name>
	<range><lt>4.1.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The samba project reports:
	<blockquote cite="https://www.samba.org/samba/history/">
	 A malformed packet can cause the nmbd server to loop the CPU and
	 prevent any further NetBIOS name service.
	 Valid unicode path names stored on disk can cause smbd to
	 crash if an authenticated client attempts to read them
	 using a non-unicode request.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0244</cvename>
 <cvename>CVE-2014-3493</cvename>
 <url>https://www.samba.org/samba/security/CVE-2014-0244</url>
 <url>https://www.samba.org/samba/security/CVE-2014-3493</url>
 </references>
 <dates>
 <discovery>2014-06-23</discovery>
 <entry>2014-06-23</entry>
 </dates>
 </vuln>

<vuln vid="c4892644-f8c6-11e3-9f45-6805ca0b3d42">
 <topic>phpMyAdmin -- two XSS vulnerabilities due to unescaped db/table names</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.1.0</ge><lt>4.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-2.php">
	 Self-XSS due to unescaped HTML output in recent/favorite
	 tables navigation.

When marking a crafted database or table name as
	 favorite or having it in recent tables, it is possible to
	 trigger an XSS.

This vulnerability can be triggered only by someone who
	 logged in to phpMyAdmin, as the usual token protection
	 prevents non-logged-in users from accessing the required
	 form.

</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-3.php">
	 Self-XSS due to unescaped HTML output in navigation items
	 hiding feature.

When hiding or unhiding a crafted table name in the
	 navigation, it is possible to trigger an XSS.

This vulnerability can be triggered only by someone who
	 logged in to phpMyAdmin, as the usual token protection
	 prevents non-logged-in users from accessing the required
	 form.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-4348</cvename>
 <cvename>CVE-2014-4349</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-2.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-3.php</url>
 </references>
 <dates>
 <discovery>2014-06-20</discovery>
 <entry>2014-06-20</entry>
 <modified>2014-06-24</modified>
 </dates>
 </vuln>

<vuln vid="0981958a-f733-11e3-8276-071f1604ef8a">
 <topic>iodined -- authentication bypass</topic>
 <affects>
 <package>
	<name>iodine</name>
	<range><lt>0.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Erik Ekman of the iodine project reports:
 <blockquote cite="https://github.com/yarrick/iodine/commit/b715be5cf3978fbe589b03b09c9398d0d791f850">
	The client could bypass the password check by continuing after
	 getting error from the server and guessing the network parameters.
	 The server would still accept the rest of the setup and also network
	 traffic.
	</blockquote>
 </body>
 </description>
 <references>
	<url>https://github.com/yarrick/iodine/commit/b715be5cf3978fbe589b03b09c9398d0d791f850</url>
 </references>
 <dates>
 <discovery>2014-06-16</discovery>
 <entry>2014-06-18</entry>
 </dates>
 </vuln>

<vuln vid="f109b02f-f5a4-11e3-82e9-00a098b18457">
 <topic>asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk11</name>
	<range><lt>11.10.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><lt>1.8.28.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/security">
	 Asterisk Manager User Unauthorized Shell Access. Manager users can
	 execute arbitrary shell commands with the MixMonitor manager action.
	 Asterisk does not require system class authorization for a manager
	 user to use the MixMonitor action, so any manager user who is
	 permitted to use manager commands can potentially execute shell
	 commands as the user executing the Asterisk process.
	 Exhaustion of Allowed Concurrent HTTP Connections. Establishing a
	 TCP or TLS connection to the configured HTTP or HTTPS port
	 respectively in http.conf and then not sending or completing a HTTP
	 request will tie up a HTTP session. By doing this repeatedly until the
	 maximum number of open HTTP sessions is reached, legitimate requests
	 are blocked.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-4046</cvename>
 <cvename>CVE-2014-4047</cvename>
 <url>http://downloads.asterisk.org/pub/security/AST-2014-006.pdf</url>
 <url>http://downloads.asterisk.org/pub/security/AST-2014-007.pdf</url>
 <url>https://www.asterisk.org/security</url>
 </references>
 <dates>
 <discovery>2014-06-12</discovery>
 <entry>2014-06-17</entry>
 </dates>
 </vuln>

<vuln vid="52bbc7e8-f13c-11e3-bc09-bcaec565249c">
 <topic>dbus -- local DoS</topic>
 <affects>
 <package>
	<name>dbus</name>
	<range><ge>1.8.0</ge><lt>1.8.4</lt></range>
	<range><lt>1.6.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon MvVittie reports:
	<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-June/016220.html">
	 Alban Crequy at Collabora Ltd. discovered and fixed a
	 denial-of-service flaw in dbus-daemon, part of the reference
	 implementation of D-Bus. Additionally, in highly unusual
	 environments the same flaw could lead to a side channel between
	 processes that should not be able to communicate.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3477</cvename>
 <url>http://lists.freedesktop.org/archives/dbus/2014-June/016220.html</url>
 </references>
 <dates>
 <discovery>2014-06-10</discovery>
 <entry>2014-06-14</entry>
 </dates>
 </vuln>

<vuln vid="888a0262-f0d9-11e3-ba0c-b4b52fce4ce8">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>30.0,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>24.6.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.26.1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>30.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.26.1</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>24.6.0</lt></range>
 </package>
 <package>
	<name>nspr</name>
	<range><lt>4.10.6</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>24.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2014-48 Miscellaneous memory safety hazards
	 (rv:30.0 / rv:24.6)
	 MFSA 2014-49 Use-after-free and out of bounds
	 issues found using Address Sanitizer
	 MFSA 2014-51 Use-after-free in Event Listener
	 Manager
	 MFSA 2014-52 Use-after-free with SMIL Animation
	 Controller
	 MFSA 2014-53 Buffer overflow in Web Audio Speex
	 resampler
	 MFSA 2014-54 Buffer overflow in Gamepad API
	 MFSA 2014-55 Out of bounds write in NSPR
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1533</cvename>
 <cvename>CVE-2014-1534</cvename>
 <cvename>CVE-2014-1536</cvename>
 <cvename>CVE-2014-1537</cvename>
 <cvename>CVE-2014-1540</cvename>
 <cvename>CVE-2014-1541</cvename>
 <cvename>CVE-2014-1542</cvename>
 <cvename>CVE-2014-1543</cvename>
 <cvename>CVE-2014-1545</cvename>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-48.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-49.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-51.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-52.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-53.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-54.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-55.html</url>
 </references>
 <dates>
 <discovery>2014-06-10</discovery>
 <entry>2014-06-10</entry>
 </dates>
 </vuln>

<vuln vid="5ac53801-ec2e-11e3-9cf3-3c970e169bc2">
 <topic>OpenSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_13</lt></range>
 </package>
 <package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1h</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>8.0</ge><lt>8.4_12</lt></range>
	<range><ge>9.1</ge><lt>9.1_15</lt></range>
	<range><ge>9.2</ge><lt>9.2_8</lt></range>
	<range><ge>10.0</ge><lt>10.0_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL Project reports:
	<blockquote cite="http://www.openssl.org/news/secadv_20140605.txt">
	 An attacker using a carefully crafted handshake can force
	 the use of weak keying material in OpenSSL SSL/TLS clients
	 and servers. This can be exploited by a Man-in-the-middle
	 (MITM) attack where the attacker can decrypt and modify
	 traffic from the attacked client and server. [CVE-2014-0224]
	 By sending an invalid DTLS handshake to an OpenSSL DTLS
	 client the code can be made to recurse eventually crashing
	 in a DoS attack. [CVE-2014-0221]
	 A buffer overrun attack can be triggered by sending invalid
	 DTLS fragments to an OpenSSL DTLS client or server. This is
	 potentially exploitable to run arbitrary code on a vulnerable
	 client or server. [CVE-2014-0195]
	 OpenSSL TLS clients enabling anonymous ECDH ciphersuites are
	 subject to a denial of service attack. [CVE-2014-3470]
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0195</cvename>
 <cvename>CVE-2014-0221</cvename>
 <cvename>CVE-2014-0224</cvename>
 <cvename>CVE-2014-3470</cvename>
 <freebsdsa>SA-14:14.openssl</freebsdsa>
 <url>http://www.openssl.org/news/secadv_20140605.txt</url>
 </references>
 <dates>
 <discovery>2014-06-05</discovery>
 <entry>2014-06-05</entry>
 </dates>
 </vuln>

<vuln vid="9733c480-ebff-11e3-970b-206a8a720317">
 <topic>gnutls -- client-side memory corruption</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>2.12.23_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GnuTLS project reports:
	<blockquote cite="www.gnutls.org/security.html#GNUTLS-SA-2014-3">
	 This vulnerability affects the client side of the gnutls library.
	 A server that sends a specially crafted ServerHello could corrupt
	 the memory of a requesting client.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3466</cvename>
 <url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-3</url>
 </references>
 <dates>
 <discovery>2014-05-14</discovery>
 <entry>2014-06-04</entry>
 </dates>
 </vuln>

<vuln vid="027af74d-eb56-11e3-9032-000c2980a9f3">
 <topic>gnutls -- client-side memory corruption</topic>
 <affects>
 <package>
	<name>gnutls3</name>
	<range><ge>3.1</ge><lt>3.1.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GnuTLS project reports:
	<blockquote cite="www.gnutls.org/security.html#GNUTLS-SA-2014-3">
	 This vulnerability affects the client side of the gnutls library.
	 A server that sends a specially crafted ServerHello could corrupt
	 the memory of a requesting client.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-3466</cvename>
 <url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-3</url>
 </references>
 <dates>
 <discovery>2014-05-14</discovery>
 <entry>2014-06-03</entry>
 </dates>
 </vuln>

<vuln vid="77e2e631-e742-11e3-9a25-5404a6a6412c">
 <topic>mumble -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mumble</name>
	<range><ge>1.2.0</ge><lt>1.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mumble reports:
	<blockquote cite="http://blog.mumble.info/mumble-1-2-6/">
	 SVG images with local file references could trigger client DoS
	 The Mumble client did not properly HTML-escape some external strings
	 before using them in a rich-text (HTML) context.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://mumble.info/security/Mumble-SA-2014-005.txt</url>
 <url>http://mumble.info/security/Mumble-SA-2014-006.txt</url>
 </references>
 <dates>
 <discovery>2014-04-16</discovery>
 <entry>2014-05-29</entry>
 </dates>
 </vuln>

<vuln vid="c2c8c84b-e734-11e3-9a25-5404a6a6412c">
 <topic>mumble -- NULL pointer dereference and heap-based buffer overflow</topic>
 <affects>
 <package>
	<name>mumble</name>
	<range><ge>1.2.4</ge><le>1.2.4_6</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mumble reports:
	<blockquote cite="http://blog.mumble.info/mumble-1-2-5/">
	 A malformed Opus voice packet sent to a Mumble client could trigger
	 a NULL pointer dereference or an out-of-bounds array access.
	 A malformed Opus voice packet sent to a Mumble client could trigger a
	 heap-based buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0044</cvename>
 <cvename>CVE-2014-0045</cvename>
 <url>http://mumble.info/security/Mumble-SA-2014-001.txt</url>
 <url>http://mumble.info/security/Mumble-SA-2014-002.txt</url>
 </references>
 <dates>
 <discovery>2014-01-25</discovery>
 <entry>2014-05-29</entry>
 </dates>
 </vuln>

<vuln vid="688e73a2-e514-11e3-a52a-98fc11cdc4f5">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.359</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb14-14.html">
	 These updates address vulnerabilities that could cause a crash
	 and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0510</cvename>
 <cvename>CVE-2014-0516</cvename>
 <cvename>CVE-2014-0517</cvename>
 <cvename>CVE-2014-0518</cvename>
 <cvename>CVE-2014-0519</cvename>
 <cvename>CVE-2014-0520</cvename>
 <url>https://helpx.adobe.com/security/products/flash-player/apsb14-14.html</url>
 </references>
 <dates>
 <discovery>2014-03-13</discovery>
 <entry>2014-05-26</entry>
 </dates>
 </vuln>

<vuln vid="02db20d7-e34a-11e3-bd92-bcaec565249c">
 <topic>openjpeg -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openjpeg</name>
	<range><lt>1.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Openjpeg release notes report:
	<blockquote cite="http://openjpeg.googlecode.com/svn/tags/version.1.5.1/NEWS">
	 That CVE-2012-3535 and CVE-2012-3358 are fixed in the 1.5.1
	 release.
	</blockquote>
	<blockquote cite="http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS">
	 That CVE-2013-4289, CVE-2013-4290, CVE-2013-1447, CVE-2013-6045,
	 CVE-2013-6052, CVE-2013-6054, CVE-2013-6053, CVE-2013-6887,
	 where fixed in the 1.5.2 release.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3358</cvename>
 <cvename>CVE-2012-3535</cvename>
 <cvename>CVE-2013-1447</cvename>
 <cvename>CVE-2013-4289</cvename>
 <cvename>CVE-2013-4290</cvename>
 <cvename>CVE-2013-6045</cvename>
 <cvename>CVE-2013-6052</cvename>
 <cvename>CVE-2013-6053</cvename>
 <cvename>CVE-2013-6054</cvename>
 <cvename>CVE-2013-6887</cvename>
 <url>http://openjpeg.googlecode.com/svn/tags/version.1.5.1/NEWS</url>
 <url>http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS</url>
 </references>
 <dates>
 <discovery>2012-05-13</discovery>
 <entry>2014-05-24</entry>
 </dates>
 </vuln>

<vuln vid="b060ee50-daba-11e3-99f2-bcaec565249c">
 <topic>libXfont -- X Font Service Protocol and Font metadata file handling issues</topic>
 <affects>
 <package>
	<name>libXfont</name>
	<range><lt>1.4.7_3</lt></range>
 </package>
 <package>
	<name>linux-c6-xorg-libs</name>
	<range><lt>7.4_2</lt></range>
 </package>
 <package>
	<name>linux-f10-xorg-libs</name>
	<range><ge>*</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Alan Coopersmith reports:
	<blockquote cite="http://lists.x.org/archives/xorg-announce/2014-May/002431.html">
	 Ilja van Sprundel, a security researcher with IOActive, has
	 discovered several issues in the way the libXfont library
	 handles the responses it receives from xfs servers, and has
	 worked with X.Org's security team to analyze, confirm, and fix
	 these issues.
	 Most of these issues stem from libXfont trusting the font server
	 to send valid protocol data, and not verifying that the values
	 will not overflow or cause other damage. This code is commonly
	 called from the X server when an X Font Server is active in the
	 font path, so may be running in a setuid-root process depending
	 on the X server in use. Exploits of this path could be used by
	 a local, authenticated user to attempt to raise privileges; or
	 by a remote attacker who can control the font server to attempt
	 to execute code with the privileges of the X server.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0209</cvename>
 <cvename>CVE-2014-0210</cvename>
 <cvename>CVE-2014-0211</cvename>
 <url>http://lists.x.org/archives/xorg-announce/2014-May/002431.html</url>
 </references>
 <dates>
 <discovery>2014-05-13</discovery>
 <entry>2014-05-13</entry>
 <modified>2015-07-15</modified>
 </dates>
 </vuln>

<vuln vid="e7bb3885-da40-11e3-9ecb-2c4138874f7d">
 <topic>libxml2 -- lack of end-of-document check DoS</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.9.1</lt></range>
 </package>
 <package>
	<name>linux-c6-libxml2</name>
	<range><lt>2.7.6_2</lt></range>
 </package>
 <package>
	<name>linux-f10-libxml2</name>
	<range><ge>*</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE MITRE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877">
	 parser.c in libxml2 before 2.9.0, as used in Google
	 Chrome before 28.0.1500.71 and other products, allows remote
	 attackers to cause a denial of service (out-of-bounds read)
	 via a document that ends abruptly, related to the lack of
	 certain checks for the XML_PARSER_EOF state.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2877</cvename>
 <url>https://git.gnome.org/browse/libxml2/tag/?id=CVE-2013-2877</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877</url>
 <url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2877</url>
 </references>
 <dates>
 <discovery>2013-04-11</discovery>
 <entry>2013-07-10</entry>
 <modified>2015-07-15</modified>
 </dates>
 </vuln>

<vuln vid="efdd0edc-da3d-11e3-9ecb-2c4138874f7d">
 <topic>libxml2 -- entity substitution DoS</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.9.1</lt></range>
 </package>
 <package>
	<name>linux-c6-libxml2</name>
	<range><lt>2.7.6_2</lt></range>
 </package>
 <package>
	<name>linux-f10-libxml2</name>
	<range><ge>*</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Cornelius reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2014/05/06/4">
	 It was discovered that libxml2, a library providing
	 support to read, modify and write XML files, incorrectly
	 performs entity substitution in the doctype prolog, even if
	 the application using libxml2 disabled any entity
	 substitution. A remote attacker could provide a
	 specially-crafted XML file that, when processed, would lead
	 to the exhaustion of CPU and memory resources or file
	 descriptors.
	 This issue was discovered by Daniel Berrange of Red Hat.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0191</cvename>
 <url>http://www.openwall.com/lists/oss-security/2014/05/06/4</url>
 <url>https://git.gnome.org/browse/libxml2/tag/?id=CVE-2014-0191</url>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0191</url>
 </references>
 <dates>
 <discovery>2013-12-03</discovery>
 <entry>2014-05-06</entry>
 <modified>2015-07-15</modified>
 </dates>
 </vuln>

<vuln vid="1959e847-d4f0-11e3-84b0-0018fe623f2b">
 <topic>OpenSSL -- NULL pointer dereference / DoS</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_12</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenBSD and David Ramos reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2014/05/02/5">
	 Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx/apache,
	 are prone to a race condition which may allow a remote attacker to
	 crash the current service.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2014/05/02/5</url>
 <url>https://rt.openssl.org/Ticket/Display.html?user=guest&amp;pass=guest&amp;id=3321</url>
 <freebsdsa>SA-14:10.openssl</freebsdsa>
 <cvename>CVE-2014-0198</cvename>
 </references>
 <dates>
 <discovery>2014-05-02</discovery>
 <entry>2014-05-03</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="89709e58-d497-11e3-a3d5-5453ed2e2b49">
 <topic>qt4-xml -- XML Entity Expansion Denial of Service</topic>
 <affects>
 <package>
	<name>qt4-xml</name>
	<range><lt>4.8.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Richard J. Moore reports:
	<blockquote cite="http://lists.qt-project.org/pipermail/announce/2013-December/000036.html">
	 QXmlSimpleReader in Qt versions prior to 5.2 supports
	 expansion of internal entities in XML documents without
	 placing restrictions to ensure the document does not cause
	 excessive memory usage. If an application using this API
	 processes untrusted data then the application may use
	 unexpected amounts of memory if a malicious document is
	 processed.
	 It is possible to construct XML documents using internal
	 entities that consume large amounts of memory and other
	 resources to process, this is known as the 'Billion Laughs'
	 attack. Qt versions prior to 5.2 did not offer protection
	 against this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4549</cvename>
 <url>http://lists.qt-project.org/pipermail/announce/2013-December/000036.html</url>
 </references>
 <dates>
 <discovery>2013-12-05</discovery>
 <entry>2014-05-05</entry>
 </dates>
 </vuln>

<vuln vid="6fb521b0-d388-11e3-a790-000c2980a9f3">
 <topic>strongswan -- Remote Authentication Bypass</topic>
 <affects>
 <package>
	<name>strongswan</name>
	<range><lt>5.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	strongSwan developers report:
	<blockquote cite="www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-(cve-2014-2338).html">
	 Remote attackers are able to bypass authentication by rekeying an
	 IKE_SA during (1) initiation or (2) re-authentication, which
	 triggers the IKE_SA state to be set to established.
	 Only installations that actively initiate or re-authenticate IKEv2
	 IKE_SAs are affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-2338</cvename>
 <url>http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html</url>
 </references>
 <dates>
 <discovery>2014-03-12</discovery>
 <entry>2014-05-04</entry>
 </dates>
 </vuln>

<vuln vid="670d732a-cdd4-11e3-aac2-0022fb6fcf92">
 <topic>mohawk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mohawk</name>
	<range><lt>2.0.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The mohawk project reports:
	<blockquote cite="http://fossil.bsdsx.fr/mohawk/tktview?name=1707f0e351">
	 Segfault when parsing malformed / unescaped url, coredump when setting syslog facility.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://fossil.bsdsx.fr/mohawk/tktview?name=1707f0e351</url>
 <url>http://fossil.bsdsx.fr/mohawk/tktview?name=1c7565019e</url>
 </references>
 <dates>
 <discovery>2014-04-10</discovery>
 <entry>2014-04-30</entry>
 </dates>
 </vuln>

<vuln vid="985d4d6c-cfbd-11e3-a003-b4b52fce4ce8">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>29.0,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>24.5.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>29.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.26</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>24.5.0</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.26</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>24.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2014-34 Miscellaneous memory safety hazards
	 (rv:29.0 / rv:24.5)
	 MFSA 2014-35 Privilege escalation through Mozilla Maintenance
	 Service Installer
	 MFSA 2014-36 Web Audio memory corruption issues
	 MFSA 2014-37 Out of bounds read while decoding JPG images
	 MFSA 2014-38 Buffer overflow when using non-XBL object as
	 XBL
	 MFSA 2014-39 Use-after-free in the Text Track Manager
	 for HTML video
	 MFSA 2014-41 Out-of-bounds write in Cairo
	 MFSA 2014-42 Privilege escalation through Web Notification
	 API
	 MFSA 2014-43 Cross-site scripting (XSS) using history
	 navigations
	 MFSA 2014-44 Use-after-free in imgLoader while resizing
	 images
	 MFSA 2014-45 Incorrect IDNA domain name matching for
	 wildcard certificates
	 MFSA 2014-46 Use-after-free in nsHostResolve
	 MFSA 2014-47 Debugger can bypass XrayWrappers
	 with JavaScript
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1492</cvename>
 <cvename>CVE-2014-1518</cvename>
 <cvename>CVE-2014-1519</cvename>
 <cvename>CVE-2014-1520</cvename>
 <cvename>CVE-2014-1522</cvename>
 <cvename>CVE-2014-1523</cvename>
 <cvename>CVE-2014-1524</cvename>
 <cvename>CVE-2014-1525</cvename>
 <cvename>CVE-2014-1526</cvename>
 <cvename>CVE-2014-1527</cvename>
 <cvename>CVE-2014-1528</cvename>
 <cvename>CVE-2014-1529</cvename>
 <cvename>CVE-2014-1530</cvename>
 <cvename>CVE-2014-1531</cvename>
 <cvename>CVE-2014-1532</cvename>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-34.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-35.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-36.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-37.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-38.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-39.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-41.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-42.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-43.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-44.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-45.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-46.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-47.html</url>
 <url>http://www.mozilla.org/security/known-vulnerabilities/</url>
 </references>
 <dates>
 <discovery>2014-04-29</discovery>
 <entry>2014-04-29</entry>
 </dates>
 </vuln>

<vuln vid="59e72db2-cae6-11e3-8420-00e0814cab4e">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py26-django</name>
	<range><ge>1.6</ge><lt>1.6.3</lt></range>
 </package>
 <package>
	<name>py27-django</name>
	<range><ge>1.6</ge><lt>1.6.3</lt></range>
 </package>
 <package>
	<name>py31-django</name>
	<range><ge>1.6</ge><lt>1.6.3</lt></range>
 </package>
 <package>
	<name>py32-django</name>
	<range><ge>1.6</ge><lt>1.6.3</lt></range>
 </package>
 <package>
	<name>py33-django</name>
	<range><ge>1.6</ge><lt>1.6.3</lt></range>
 </package>
 <package>
	<name>py34-django</name>
	<range><ge>1.6</ge><lt>1.6.3</lt></range>
 </package>
 <package>
	<name>py26-django15</name>
	<range><ge>1.5</ge><lt>1.5.6</lt></range>
 </package>
 <package>
	<name>py27-django15</name>
	<range><ge>1.5</ge><lt>1.5.6</lt></range>
 </package>
 <package>
	<name>py31-django15</name>
	<range><ge>1.5</ge><lt>1.5.6</lt></range>
 </package>
 <package>
	<name>py32-django15</name>
	<range><ge>1.5</ge><lt>1.5.6</lt></range>
 </package>
 <package>
	<name>py33-django15</name>
	<range><ge>1.5</ge><lt>1.5.6</lt></range>
 </package>
 <package>
	<name>py34-django15</name>
	<range><ge>1.5</ge><lt>1.5.6</lt></range>
 </package>
 <package>
	<name>py26-django14</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
 </package>
 <package>
	<name>py27-django14</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
 </package>
 <package>
	<name>py31-django14</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
 </package>
 <package>
	<name>py32-django14</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
 </package>
 <package>
	<name>py33-django14</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
 </package>
 <package>
	<name>py34-django14</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
 </package>
 <package>
	<name>py26-django-devel</name>
	<range><lt>20140423,1</lt></range>
 </package>
 <package>
	<name>py27-django-devel</name>
	<range><lt>20140423,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Django project reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2014/apr/21/security/">
	 These releases address an unexpected code-execution issue, a
	 caching issue which can expose CSRF tokens and a MySQL typecasting
	 issue. While these issues present limited risk and may not affect
	 all Django users, we encourage all users to evaluate their own
	 risk and upgrade as soon as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2014/apr/21/security/</url>
 <cvename>CVE-2014-0472</cvename>
 <cvename>CVE-2014-0473</cvename>
 <cvename>CVE-2014-0474</cvename>
 </references>
 <dates>
 <discovery>2014-04-21</discovery>
 <entry>2014-04-23</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="0b8d7194-ca88-11e3-9d8d-c80aa9043978">
 <topic>OpenSSL -- Remote Data Injection / DoS</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_11</lt></range>
 </package>
 <package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><le>1.0.1g</le></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx, are
	 prone to a race condition which may allow a remote attacker to
	 inject random data into other connections.
 </body>
 </description>
 <references>
 <url>https://rt.openssl.org/Ticket/Display.html?id=2167</url>
 <url>http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse</url>
 <freebsdsa>SA-14:09.openssl</freebsdsa>
 <cvename>CVE-2010-5298</cvename>
 </references>
 <dates>
 <discovery>2010-02-09</discovery>
 <entry>2014-04-23</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="608ed765-c700-11e3-848c-20cf30e32f6d">
 <topic>bugzilla -- Cross-Site Request Forgery</topic>
 <affects>
 <package>
	<name>bugzilla40</name>
	<range><ge>2.0.0</ge><lt>4.4.3</lt></range>
 </package>
 <package>
	<name>bugzilla42</name>
	<range><ge>2.0.0</ge><lt>4.4.3</lt></range>
 </package>
 <package>
	<name>bugzilla44</name>
	<range><ge>2.0.0</ge><lt>4.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/4.0.11/">
	 The login form had no CSRF protection, meaning that
	 an attacker could force the victim to log in using the
	 attacker's credentials. If the victim then reports a new
	 security sensitive bug, the attacker would get immediate
	 access to this bug.
	 
	 Due to changes involved in the Bugzilla API, this fix is
	 not backported to the 4.0 and 4.2 branches, meaning that
	 Bugzilla 4.0.12 and older, and 4.2.8 and older, will
	 remain vulnerable to this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1517</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=713926</url>
 </references>
 <dates>
 <discovery>2014-04-17</discovery>
 <entry>2014-04-18</entry>
 <modified>2014-04-18</modified>
 </dates>
 </vuln>

<vuln vid="60bfa396-c702-11e3-848c-20cf30e32f6d">
 <topic>bugzilla -- Social Engineering</topic>
 <affects>
 <package>
	<name>bugzilla40</name>
	<range><ge>2.0.0</ge><lt>4.0.12</lt></range>
 </package>
 <package>
	<name>bugzilla42</name>
	<range><ge>4.1.1</ge><lt>4.2.8</lt></range>
 </package>
 <package>
	<name>bugzilla44</name>
	<range><ge>4.4.0</ge><lt>4.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/4.0.11/">
	 Dangerous control characters can be inserted into
	 Bugzilla, notably into bug comments. If the text, which
	 may look safe, is copied into a terminal such as xterm or
	 gnome-terminal, then unexpected commands could be executed
	 on the local machine.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=968576</url>
 </references>
 <dates>
 <discovery>2014-04-17</discovery>
 <entry>2014-04-18</entry>
 <modified>2014-04-18</modified>
 </dates>
 </vuln>

<vuln vid="abad20bf-c1b4-11e3-a5ac-001b21614864">
 <topic>OpenLDAP -- incorrect handling of NULL in certificate Common Name</topic>
 <affects>
 <package>
	<name>openldap24-client</name>
	<range><lt>2.4.18</lt></range>
 </package>
 <package>
	<name>linux-f10-openldap</name>
	<range><lt>2.4.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jan Lieskovsky reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3767">
	 OpenLDAP does not properly handle a '\0' character in a domain name
	 in the subject's Common Name (CN) field of an X.509 certificate,
	 which allows man-in-the-middle attackers to spoof arbitrary SSL
	 servers via a crafted certificate issued by a legitimate
	 Certification Authority
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3767</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3767</url>
 </references>
 <dates>
 <discovery>2009-08-07</discovery>
 <entry>2014-04-11</entry>
 </dates>
 </vuln>

<vuln vid="9aecb94c-c1ad-11e3-a5ac-001b21614864">
 <topic>cURL -- inappropriate GSSAPI delegation</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.10.6</ge><le>7.21.6</le></range>
 </package>
 <package>
	<name>linux-f10-curl</name>
	<range><ge>7.10.6</ge><le>7.21.6</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cURL reports:
	<blockquote cite="http://curl.haxx.se/docs/adv_20110623.html">
	 When doing GSSAPI authentication, libcurl unconditionally performs
	 credential delegation. This hands the server a copy of the client's
	 security credentials, allowing the server to impersonate the client
	 to any other using the same GSSAPI mechanism.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2192</cvename>
 <url>http://curl.haxx.se/docs/adv_20110623.html</url>
 </references>
 <dates>
 <discovery>2011-06-23</discovery>
 <entry>2014-04-11</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="77bb0541-c1aa-11e3-a5ac-001b21614864">
 <topic>dbus-glib -- privledge escalation</topic>
 <affects>
 <package>
	<name>dbus-glib</name>
	<range><lt>0.100.1</lt></range>
 </package>
 <package>
	<name>linux-f10-dbus-glib</name>
	<range><lt>0.100.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sebastian Krahmer reports:
	<blockquote cite="https://bugs.freedesktop.org/show_bug.cgi?id=60916">
	 A privilege escalation flaw was found in the way dbus-glib, the
	 D-Bus add-on library to integrate the standard D-Bus library with
	 the GLib thread abstraction and main loop, performed filtering of
	 the message sender (message source subject), when the
	 NameOwnerChanged signal was received. A local attacker could use
	 this flaw to escalate their privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0292</cvename>
 <url>https://bugs.freedesktop.org/show_bug.cgi?id=60916</url>
 </references>
 <dates>
 <discovery>2013-02-15</discovery>
 <entry>2014-04-11</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="bf7912f5-c1a8-11e3-a5ac-001b21614864">
 <topic>nas -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>nas</name>
	<range><lt>1.9.4</lt></range>
 </package>
 <package>
	<name>linux-f10-nas-libs</name>
	<range><lt>1.9.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hamid Zamani reports:
	<blockquote cite="http://radscan.com/pipermail/nas/2013-August/001270.html">
	 multiple security problems (buffer overflows, format string
	 vulnerabilities and missing input sanitising), which could lead to
	 the execution of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4256</cvename>
 <cvename>CVE-2013-4257</cvename>
 <cvename>CVE-2013-4258</cvename>
 <url>http://radscan.com/pipermail/nas/2013-August/001270.html</url>
 </references>
 <dates>
 <discovery>2013-08-07</discovery>
 <entry>2014-04-11</entry>
 </dates>
 </vuln>

<vuln vid="09f47c51-c1a6-11e3-a5ac-001b21614864">
 <topic>libaudiofile -- heap-based overflow in Microsoft ADPCM compression module</topic>
 <affects>
 <package>
	<name>libaudiofile</name>
	<range><lt>0.2.7</lt></range>
 </package>
 <package>
	<name>linux-f10-libaudiofile</name>
	<range><lt>0.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian reports:
	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510205">
	 Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile
	 0.2.6 allows context-dependent attackers to cause a denial of service
	 (application crash) or possibly execute arbitrary code via a crafted
	 WAV file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0159</cvename>
 <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510205</url>
 </references>
 <dates>
 <discovery>2008-12-30</discovery>
 <entry>2014-04-11</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="972837fc-c304-11e3-8758-00262d5ed8ee">
 <topic>ChaSen -- buffer overflow</topic>
 <affects>
 <package>
	<name>chasen-base</name>
	<range><lt>2.4.5</lt></range>
 </package>
 <package>
	<name>chasen</name>
	<range><lt>2.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	JVN iPedia reports:
	<blockquote cite="http://jvn.jp/en/jp/JVN16901583/index.html">
	 ChaSen provided by Nara Institute of Science and Technology is a
	 software for morphologically analyzing Japanese. ChaSen contains an
	 issue when reading in strings, which may lead to a buffer
	 overflow.
	 An arbitrary script may be executed by an attacker with access to
	 a system that is running a product listed in "Products
	 Affected."
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4000</cvename>
 <url>http://jvn.jp/en/jp/JVN16901583/index.html</url>
 </references>
 <dates>
 <discovery>2011-11-08</discovery>
 <entry>2014-04-13</entry>
 </dates>
 </vuln>

<vuln vid="7ccd4def-c1be-11e3-9d09-000c2980a9f3">
 <topic>OpenSSL -- Local Information Disclosure</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_10</lt></range>
 </package>
 <package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1g</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>8.3</ge><lt>8.3_15</lt></range>
	<range><ge>8.4</ge><lt>8.4_8</lt></range>
	<range><ge>9.1</ge><lt>9.1_11</lt></range>
	<range><ge>9.2</ge><lt>9.2_4</lt></range>
	<range><ge>10.0</ge><lt>10.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL reports:
	<blockquote cite="https://www.openssl.org/news/vulnerabilities.html#2014-0076">
	 A flaw in the implementation of Montgomery Ladder Approach would
	 create a side-channel that leaks sensitive timing information.
	 A local attacker might be able to snoop a signing process and
	 might recover the signing key from it.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0076</cvename>
 <freebsdsa>SA-14:06.openssl</freebsdsa>
 <url>https://www.openssl.org/news/vulnerabilities.html#2014-0076</url>
 </references>
 <dates>
 <discovery>2014-04-07</discovery>
 <entry>2014-04-11</entry>
 </dates>
 </vuln>

<vuln vid="c0c31b27-bff3-11e3-9d09-000c2980a9f3">
 <topic>openafs -- Denial of Service</topic>
 <affects>
 <package>
	<name>openafs</name>
	<range><ge>1.4.8</ge><lt>1.6.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenAFS development team reports:
	<blockquote cite="http://openafs.org/security/OPENAFS-SA-2014-001.txt">
	 An attacker with the ability to connect to an OpenAFS fileserver can
	 trigger a buffer overflow, crashing the server.
	 The buffer overflow can be triggered by sending an unauthenticated
	 request for file server statistical information.
	 Clients are not affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0159</cvename>
 <url>http://openafs.org/security/OPENAFS-SA-2014-001.txt</url>
 </references>
 <dates>
 <discovery>2014-04-09</discovery>
 <entry>2014-04-09</entry>
 </dates>
 </vuln>

<vuln vid="5631ae98-be9e-11e3-b5e3-c80aa9043978">
 <topic>OpenSSL -- Remote Information Disclosure</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1_10</lt></range>
 </package>
 <package>
	<name>mingw32-openssl</name>
	<range><ge>1.0.1</ge><lt>1.0.1g</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>10.0</ge><lt>10.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL Reports:
	<blockquote cite="https://www.openssl.org/news/secadv_20140407.txt">
	 A missing bounds check in the handling of the TLS heartbeat extension can be
	 used to reveal up to 64k of memory to a connected client or server.
	 Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately
	 upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.
	</blockquote>
	<blockquote cite="http://www.heartbleed.com">
	 The bug allows anyone on the Internet to read the memory of the
	 systems protected by the vulnerable versions of the OpenSSL software.
	 This compromises the secret keys used to identify the service
	 providers and to encrypt the traffic, the names and passwords of the
	 users and the actual content. This allows attackers to eavesdrop
	 communications, steal data directly from the services and users and
	 to impersonate services and users.
	</blockquote>
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-14:06.openssl.asc">
	 The code used to handle the Heartbeat Extension does not do
	 sufficient boundary checks on record length, which allows reading
	 beyond the actual payload.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0160</cvename>
 <freebsdsa>SA-14:06.openssl</freebsdsa>
 <url>https://www.openssl.org/news/secadv_20140407.txt</url>
 <url>https://www.openssl.org/news/vulnerabilities.html#2014-0076</url>
 <url>http://www.heartbleed.com</url>
 </references>
 <dates>
 <discovery>2014-04-07</discovery>
 <entry>2014-04-07</entry>
 <modified>2014-04-11</modified>
 </dates>
 </vuln>

<vuln vid="ffa7c6e4-bb29-11e3-8136-60a44c524f57">
 <topic>otrs -- Clickjacking issue</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><lt>3.1.21</lt></range>
	<range><gt>3.2.*</gt><lt>3.2.16</lt></range>
	<range><gt>3.3.*</gt><lt>3.3.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OTRS Project reports:
	<blockquote cite="http://www.otrs.com/security-advisory-2014-05-clickjacking-issue/">
	 An attacker could embed OTRS in a hidden iframe tag of another
	 page, tricking the user into clicking links in OTRS.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.w3.org/1999/xhtml</url>
 <cvename>CVE-2014-2554</cvename>
 </references>
 <dates>
 <discovery>2014-04-01</discovery>
 <entry>2014-04-03</entry>
 </dates>
 </vuln>

<vuln vid="580cc46b-bb1e-11e3-b144-2c4138874f7d">
 <topic>LibYAML input sanitization errors</topic>
 <affects>
 <package>
	<name>libyaml</name>
	<range><lt>0.1.6</lt></range>
 </package>
 <package>
	<name>mingw32-libyaml</name>
	<range><lt>0.1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	oCERT reports:
	<blockquote cite="http://www.ocert.org/advisories/ocert-2014-003.html">
	 The LibYAML project is an open source YAML 1.1 parser and
	 emitter written in C.
	 The library is affected by a heap-based buffer overflow
	 which can lead to arbitrary code execution. The
	 vulnerability is caused by lack of proper expansion for the
	 string passed to the yaml_parser_scan_uri_escapes()
	 function.
	 A specially crafted YAML file, with a long sequence of
	 percent-encoded characters in a URL, can be used to trigger
	 the overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-2525</cvename>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2525</url>
 </references>
 <dates>
 <discovery>2014-03-11</discovery>
 <entry>2014-03-26</entry>
 </dates>
 </vuln>

<vuln vid="4e95eb4e-b737-11e3-87cd-f0def10dca57">
 <topic>Icinga -- buffer overflow in classic web interface</topic>
 <affects>
 <package>
	<name>icinga</name>
	<range><lt>1.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Icinga Team reports:
	<blockquote cite="https://git.icinga.org/?p=icinga-core.git;a=commitdiff;h=73285093b71a5551abdaab0a042d3d6bae093b0d">
	 Wrong strlen check against MAX_INPUT_BUFFER without taking '\0' into account [...]
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-2386</cvename>
 <url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2386</url>
 </references>
 <dates>
 <discovery>2014-02-18</discovery>
 <entry>2014-03-29</entry>
 </dates>
 </vuln>

<vuln vid="7e61a839-b714-11e3-8195-001966155bea">
 <topic>file -- out-of-bounds access in search rules with offsets from input file</topic>
 <affects>
 <package>
	<name>file</name>
	<range><lt>5.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aaron Reffett reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2270">
	 softmagic.c in file ... and libmagic allows context-dependent
	 attackers to cause a denial of service (out-of-bounds memory access and
	 crash) via crafted offsets in the softmagic of a PE executable.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-2270</cvename>
 <url>http://bugs.gw.com/view.php?id=31</url>
 </references>
 <dates>
 <discovery>2013-12-20</discovery>
 <entry>2014-03-29</entry>
 </dates>
 </vuln>

<vuln vid="9fa1a0ac-b2e0-11e3-bb07-6cf0490a8c18">
 <topic>Joomla! -- Core - Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla2</name>
	<range><ge>2.5.*</ge><le>2.5.18</le></range>
 </package>
 <package>
	<name>joomla3</name>
	<range><ge>3.0.*</ge><le>3.2.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="http://developer.joomla.org/security/578-20140301-core-sql-injection.html">
	 <h2>[20140301] - Core - SQL Injection</h2>
	 Inadequate escaping leads to SQL injection vulnerability.
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/579-20140302-core-xss-vulnerability.html">
	 <h2>[20140302] - Core - XSS Vulnerability</h2>
	 Inadequate escaping leads to XSS vulnerability in com_contact.
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/580-20140303-core-xss-vulnerability.html">
	 <h2>[20140303] - Core - XSS Vulnerability</h2>
	 Inadequate escaping leads to XSS vulnerability.
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/581-20140304-core-unauthorised-logins.html">
	 <h2>[20140304] - Core - Unauthorised Logins</h2>
	 Inadequate checking allowed unauthorised logins via GMail authentication.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://developer.joomla.org/security/578-20140301-core-sql-injection.html</url>
 <url>http://developer.joomla.org/security/579-20140302-core-xss-vulnerability.html</url>
 <url>http://developer.joomla.org/security/580-20140303-core-xss-vulnerability.html</url>
 <url>http://developer.joomla.org/security/581-20140304-core-unauthorised-logins.html</url>
 </references>
 <dates>
 <discovery>2014-03-01</discovery>
 <entry>2014-03-23</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="36f9ac43-b2ac-11e3-8752-080027ef73ec">
 <topic>mail/trojita -- may leak mail contents (not user credentials) over unencrypted connection</topic>
 <affects>
 <package>
	<name>trojita</name>
	<range><lt>0.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jan Kundrát reports:
	<blockquote cite="http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html">
	 An SSL stripping vulnerability was discovered in Trojitá, a fast Qt
	 IMAP e-mail client. User's credentials are never leaked, but if a
	 user tries to send an e-mail, the automatic saving into the "sent"
	 or "draft" folders could happen over a plaintext connection even if
	 the user's preferences specify STARTTLS as a requirement.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-2567</cvename>
 <url>http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html</url>
 </references>
 <dates>
 <discovery>2014-03-20</discovery>
 <entry>2014-03-23</entry>
 </dates>
 </vuln>

<vuln vid="da4b89ad-b28f-11e3-99ca-f0def16c5c1b">
 <topic>nginx-devel -- SPDY heap buffer overflow</topic>
 <affects>
 <package>
	<name>nginx-devel</name>
	<range><ge>1.3.15</ge><lt>1.5.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The nginx project reports:
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html">
	 A bug in the experimental SPDY implementation in nginx was found, which
	 might allow an attacker to cause a heap memory buffer overflow in a
	 worker process by using a specially crafted request, potentially
	 resulting in arbitrary code execution (CVE-2014-0133).

The problem affects nginx 1.3.15 - 1.5.11, compiled with the
	 ngx_http_spdy_module module (which is not compiled by default) and
	 without --with-debug configure option, if the "spdy" option of the
	 "listen" directive is used in a configuration file.

The problem is fixed in nginx 1.5.12, 1.4.7.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0133</cvename>
 <url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html</url>
 </references>
 <dates>
 <discovery>2014-03-18</discovery>
 <entry>2014-03-23</entry>
 </dates>
 </vuln>

<vuln vid="fc28df92-b233-11e3-99ca-f0def16c5c1b">
 <topic>nginx -- SPDY heap buffer overflow</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><lt>1.4.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The nginx project reports:
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html">
	 A bug in the experimental SPDY implementation in nginx was found, which
	 might allow an attacker to cause a heap memory buffer overflow in a
	 worker process by using a specially crafted request, potentially
	 resulting in arbitrary code execution (CVE-2014-0133).

<vuln vid="91ecb546-b1e6-11e3-980f-20cf30e32f6d">
 <topic>apache -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><gt>2.4.0</gt><lt>2.4.9</lt></range>
 </package>
 <package>
	<name>apache22</name>
	<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
 </package>
 <package>
	<name>apache22-event-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
 </package>
 <package>
	<name>apache22-itk-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
 </package>
 <package>
	<name>apache22-peruser-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
 </package>
 <package>
	<name>apache22-worker-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Apache HTTP SERVER PROJECT reports:</h1>
	<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.27">
	 Clean up cookie logging with fewer redundant string parsing passes.
	 Log only cookies with a value assignment. Prevents segfaults when
	 logging truncated cookies.
	 mod_dav: Keep track of length of cdata properly when removing leading
	 spaces. Eliminates a potential denial of service from specifically
	 crafted DAV WRITE requests.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0098</cvename>
 <cvename>CVE-2013-6438</cvename>
 </references>
 <dates>
 <discovery>2014-02-25</discovery>
 <entry>2014-03-22</entry>
 </dates>
 </vuln>

<vuln vid="610de647-af8d-11e3-a25b-b4b52fce4ce8">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>28.0,1</lt></range>
 </package>
 <package>
	<name>firefox-esr</name>
	<range><lt>24.4.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>28.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.25</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>24.4.0</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.25</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>24.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2014-15 Miscellaneous memory safety hazards
	 (rv:28.0 / rv:24.4)
	 MFSA 2014-16 Files extracted during updates are not always
	 read only
	 MFSA 2014-17 Out of bounds read during WAV file decoding
	 MFSA 2014-18 crypto.generateCRMFRequest does not validate
	 type of key
	 MFSA 2014-19 Spoofing attack on WebRTC permission prompt
	 MFSA 2014-20 onbeforeunload and Javascript navigation DOS
	 MFSA 2014-21 Local file access via Open Link in new tab
	 MFSA 2014-22 WebGL content injection from one domain to
	 rendering in another
	 MFSA 2014-23 Content Security Policy for data: documents
	 not preserved by session restore
	 MFSA 2014-24 Android Crash Reporter open to manipulation
	 MFSA 2014-25 Firefox OS DeviceStorageFile object vulnerable
	 to relative path escape
	 MFSA 2014-26 Information disclosure through polygon
	 rendering in MathML
	 MFSA 2014-27 Memory corruption in Cairo during PDF font
	 rendering
	 MFSA 2014-28 SVG filters information disclosure through
	 feDisplacementMap
	 MFSA 2014-29 Privilege escalation using WebIDL-implemented
	 APIs
	 MFSA 2014-30 Use-after-free in TypeObject
	 MFSA 2014-31 Out-of-bounds read/write through neutering
	 ArrayBuffer objects
	 MFSA 2014-32 Out-of-bounds write through TypedArrayObject
	 after neutering
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1493</cvename>
 <cvename>CVE-2014-1494</cvename>
 <cvename>CVE-2014-1496</cvename>
 <cvename>CVE-2014-1497</cvename>
 <cvename>CVE-2014-1498</cvename>
 <cvename>CVE-2014-1499</cvename>
 <cvename>CVE-2014-1500</cvename>
 <cvename>CVE-2014-1501</cvename>
 <cvename>CVE-2014-1502</cvename>
 <cvename>CVE-2014-1504</cvename>
 <cvename>CVE-2014-1505</cvename>
 <cvename>CVE-2014-1506</cvename>
 <cvename>CVE-2014-1507</cvename>
 <cvename>CVE-2014-1508</cvename>
 <cvename>CVE-2014-1509</cvename>
 <cvename>CVE-2014-1510</cvename>
 <cvename>CVE-2014-1511</cvename>
 <cvename>CVE-2014-1512</cvename>
 <cvename>CVE-2014-1513</cvename>
 <cvename>CVE-2014-1514</cvename>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-15.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-16.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-17.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-18.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-19.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-20.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-21.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-22.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-23.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-24.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-25.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-26.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-27.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-28.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-29.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-30.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-31.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-32.html</url>
 <url>http://www.mozilla.org/security/known-vulnerabilities/</url>
 </references>
 <dates>
 <discovery>2014-03-19</discovery>
 <entry>2014-03-19</entry>
 <modified>2014-03-20</modified>
 </dates>
 </vuln>

<vuln vid="eb426e82-ab68-11e3-9d09-000c2980a9f3">
 <topic>mutt -- denial of service, potential remote code execution</topic>
 <affects>
 <package>
	<name>mutt</name>
	<range><lt>1.5.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Beatrice Torracca and Evgeni Golov report:
	<blockquote cite="http://www.securityfocus.com/archive/1/531431">
	 A buffer overflow has been discovered that could result in
	 denial of service or potential execution of arbitrary code.
	 This condition can be triggered by malformed RFC2047 header
	 lines
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0467</cvename>
 <url>http://packetstormsecurity.com/files/cve/CVE-2014-0467</url>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467</url>
 </references>
 <dates>
 <discovery>2014-03-12</discovery>
 <entry>2014-03-14</entry>
 </dates>
 </vuln>

<vuln vid="777d7b9e-ab02-11e3-841e-60a44c524f57">
 <topic>wemux -- read-only can be bypassed</topic>
 <affects>
 <package>
	<name>wemux</name>
	<range><lt>3.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	JonApps reports:
	<blockquote cite="https://github.com/zolrath/wemux/issues/36">
	 The read-only mode can be bypassed and any command sent to bash session
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/zolrath/wemux/issues/36</url>
 </references>
 <dates>
 <discovery>2013-12-24</discovery>
 <entry>2014-03-13</entry>
 </dates>
 </vuln>

<vuln vid="03e48bf5-a96d-11e3-a556-3c970e169bc2">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba34</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>samba35</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>samba36</name>
	<range><gt>3.6.*</gt><lt>3.6.23</lt></range>
 </package>
 <package>
	<name>samba4</name>
	<range><gt>4.0.*</gt><lt>4.0.16</lt></range>
 </package>
 <package>
	<name>samba41</name>
	<range><gt>4.1.*</gt><lt>4.1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samba project reports:
	<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4496">
	 In Samba's SAMR server we neglect to ensure that attempted
	 password changes will update the bad password count, nor set
	 the lockout flags. This would allow a user unlimited attempts
	 against the password by simply calling ChangePasswordUser2
	 repeatedly.
	 This is available without any other authentication.
	</blockquote>
	<blockquote cite="http://www.samba.org/samba/security/CVE-2013-6442">
	 smbcacls can remove a file or directory ACL by mistake.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4496</cvename>
 <cvename>CVE-2013-6442</cvename>
 <url>http://www.samba.org/samba/security/CVE-2013-4496</url>
 <url>http://www.samba.org/samba/security/CVE-2013-6442</url>
 </references>
 <dates>
 <discovery>2014-03-11</discovery>
 <entry>2014-03-11</entry>
 </dates>
 </vuln>

<vuln vid="03159886-a8a3-11e3-8f36-0025905a4771">
 <topic>asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk11</name>
	<range><lt>11.8.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><lt>1.8.26.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/security">
	 Stack Overflow in HTTP Processing of Cookie Headers. Sending a HTTP
	 request that is handled by Asterisk with a large number of Cookie
	 headers could overflow the stack. You could even exhaust memory if you
	 sent an unlimited number of headers in the request.
	 Denial of Service Through File Descriptor Exhaustion with chan_sip
	 Session-Timers. An attacker can use all available file descriptors
	 using SIP INVITE requests. Asterisk will respond with code 400, 420,
	 or 422 for INVITEs meeting this criteria.
	 Each INVITE meeting these conditions will leak a channel and several
	 file descriptors. The file descriptors cannot be released without
	 restarting Asterisk which may allow intrusion detection systems to be
	 bypassed by sending the requests slowly.
	 Remote Crash Vulnerability in PJSIP channel driver. A remotely
	 exploitable crash vulnerability exists in the PJSIP channel driver if
	 the "qualify_frequency" configuration option is enabled on an AOR and
	 the remote SIP server challenges for authentication of the resulting
	 OPTIONS request. The response handling code wrongly assumes that a
	 PJSIP endpoint will always be associated with an outgoing request which
	 is incorrect.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-2286</cvename>
 <cvename>CVE-2014-2287</cvename>
 <cvename>CVE-2014-2288</cvename>
 <url>http://downloads.asterisk.org/pub/security/AST-2014-001.pdf</url>
 <url>http://downloads.asterisk.org/pub/security/AST-2014-002.pdf</url>
 <url>http://downloads.asterisk.org/pub/security/AST-2014-003.pdf</url>
 <url>https://www.asterisk.org/security</url>
 </references>
 <dates>
 <discovery>2014-03-10</discovery>
 <entry>2014-03-10</entry>
 </dates>
 </vuln>

<vuln vid="1a0de610-a761-11e3-95fe-bcaec565249c">
 <topic>freetype2 -- Out of bounds read/write</topic>
 <affects>
 <package>
	<name>freetype2</name>
	<range><lt>2.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mateusz Jurczyk reports:
	<blockquote cite="http://savannah.nongnu.org/bugs/?41697">
	 Out of bounds stack-based read/write in
	 cf2_hintmap_build.
	 This is a critical vulnerability in the CFF Rasterizer
	 code recently contributed by Adobe, leading to potential
	 arbitrary code execution in the context of the FreeType2
	 library client.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://savannah.nongnu.org/bugs/?41697</url>
 </references>
 <dates>
 <discovery>2014-02-25</discovery>
 <entry>2014-03-09</entry>
 </dates>
 </vuln>

<vuln vid="20e23b65-a52e-11e3-ae3a-00224d7c32a2">
 <topic>xmms -- Integer Overflow And Underflow Vulnerabilities</topic>
 <affects>
 <package>
	<name>xmms</name>
	<range><le>1.2.11_20</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/secunia_research/2007-47/advisory/">
	 Secunia Research has discovered two vulnerabilities in XMMS, which can
	 be exploited by malicious people to compromise a user's system.

1) An integer underflow error exists in the processing of skin bitmap
	 images. This can be exploited to cause a stack-based buffer overflow
	 via specially crafted skin images containing manipulated header
	 information.

Successful exploitation allows execution of arbitrary code.

2) An integer overflow error exists in the processing of skin bitmap
	 images. This can be exploited to cause memory corruption via specially
	 crafted skin images containing manipulated header information.

Successful exploitation may allow the execution of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-0653</cvename>
 <cvename>CVE-2007-0654</cvename>
 </references>
 <dates>
 <discovery>2007-02-06</discovery>
 <entry>2014-03-06</entry>
 </dates>
 </vuln>

<vuln vid="89db3b31-a4c3-11e3-978f-f0def16c5c1b">
 <topic>nginx -- SPDY memory corruption</topic>
 <affects>
 <package>
	<name>nginx-devel</name>
	<range><eq>1.5.10</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The nginx project reports:
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html">
	 A bug in the experimental SPDY implementation in nginx 1.5.10 was found,
	 which might allow an attacker to corrupt worker process memory by using
	 a specially crafted request, potentially resulting in arbitrary code
	 execution (CVE-2014-0088).

The problem only affects nginx 1.5.10 on 32-bit platforms, compiled with
	 the ngx_http_spdy_module module (which is not compiled by default), if
	 the "spdy" option of the "listen" directive is used in a configuration
	 file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0088</cvename>
 <url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html</url>
 </references>
 <dates>
 <discovery>2014-03-04</discovery>
 <entry>2014-03-06</entry>
 </dates>
 </vuln>

<vuln vid="f645aa90-a3e8-11e3-a422-3c970e169bc2">
 <topic>gnutls -- multiple certificate verification issues</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>2.12.23_4</lt></range>
 </package>
 <package>
	<name>linux-f10-gnutls</name>
	<range><lt>2.12.23_4</lt></range>
 </package>
 <package>
	<name>gnutls-devel</name>
	<range><lt>3.1.22</lt></range>
	<range><gt>3.2.0</gt><lt>3.2.12</lt></range>
 </package>
 <package>
	<name>gnutls3</name>
	<range><lt>3.1.22</lt></range>
	<range><gt>3.2.0</gt><lt>3.2.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GnuTLS project reports:
	<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2014-2">
	 A vulnerability was discovered that affects the
	 certificate verification functions of all gnutls
	 versions. A specially crafted certificate could
	 bypass certificate validation checks. The
	 vulnerability was discovered during an audit of
	 GnuTLS for Red Hat.
	</blockquote>
	<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2014-1">
	 Suman Jana reported a vulnerability that affects
	 the certificate verification functions of
	 gnutls 2.11.5 and later versions. A version 1
	 intermediate certificate will be considered as
	 a CA certificate by default (something that
	 deviates from the documented behavior).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0092</cvename>
 <cvename>CVE-2014-1959</cvename>
 <url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-1</url>
 <url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-2</url>
 </references>
 <dates>
 <discovery>2014-03-03</discovery>
 <entry>2014-03-04</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="815dbcf9-a2d6-11e3-8088-002590860428">
 <topic>file -- denial of service</topic>
 <affects>
 <package>
	<name>file</name>
	<range><lt>5.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Fine Free file project reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1943">
	 file before 5.17 allows context-dependent attackers to
	 cause a denial of service (infinite recursion, CPU consumption, and
	 crash) via a crafted indirect offset value in the magic of a file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1943</cvename>
 <mlist>http://mx.gw.com/pipermail/file/2014/001327.html</mlist>
 </references>
 <dates>
 <discovery>2014-02-16</discovery>
 <entry>2014-03-03</entry>
 </dates>
 </vuln>

<vuln vid="8e5e6d42-a0fa-11e3-b09a-080027f2d077">
 <topic>Python -- buffer overflow in socket.recvfrom_into()</topic>
 <affects>
 <package>
	<name>python27</name>
	<range><le>2.7.6_3</le></range>
 </package>
 <package>
	<name>python31</name>
	<range><le>3.1.5_10</le></range>
 </package>
 <package>
	<name>python32</name>
	<range><le>3.2.5_7</le></range>
 </package>
 <package>
	<name>python33</name>
	<range><le>3.3.3_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Vincent Danen via Red Hat Issue Tracker reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1062370">
	 A vulnerability was reported in Python's socket module, due to a
	 boundary error within the sock_recvfrom_into() function, which could be
	 exploited to cause a buffer overflow. This could be used to crash a
	 Python application that uses the socket.recvfrom_info() function or,
	 possibly, execute arbitrary code with the permissions of the user
	 running vulnerable Python code.

This vulnerable function, socket.recvfrom_into(), was introduced in
	 Python 2.5. Earlier versions are not affected by this flaw.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>65379</bid>
 <cvename>CVE-2014-1912</cvename>
 <mlist>https://mail.python.org/pipermail/python-dev/2014-February/132758.html</mlist>
 <url>http://bugs.python.org/issue20246</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1062370</url>
 </references>
 <dates>
 <discovery>2014-01-14</discovery>
 <entry>2014-03-01</entry>
 </dates>
 </vuln>

<vuln vid="1839f78c-9f2b-11e3-980f-20cf30e32f6d">
 <topic>subversion -- mod_dav_svn vulnerability</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><ge>1.3.0</ge><lt>1.7.16</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.8</lt></range>
 </package>
 <package>
	<name>subversion16</name>
	<range><ge>1.3.0</ge><lt>1.7.16</lt></range>
 </package>
 <package>
	<name>subversion17</name>
	<range><ge>1.3.0</ge><lt>1.7.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion Project reports:
	<blockquote cite="http://subversion.apache.org/security/">
	 Subversion's mod_dav_svn Apache HTTPD server module will crash when it
	 receives an OPTIONS request against the server root and Subversion is
	 configured to handle the server root and SVNListParentPath is on.
	 This can lead to a DoS. There are no known instances of this
	 problem being exploited in the wild, but the details of how to exploit
	 it have been disclosed on the Subversion development mailing list.
	</blockquote>
 </body>
 </description>
 <references>
 <url>CVE-2014-0032</url>
 <url>https://subversion.apache.org/security/CVE-2014-0032-advisory.txt</url>
 </references>
 <dates>
 <discovery>2014-01-10</discovery>
 <entry>2014-02-26</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="70b72a52-9e54-11e3-babe-60a44c524f57">
 <topic>otrs -- XSS Issue</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><lt>3.1.20</lt></range>
	<range><gt>3.2.*</gt><lt>3.2.15</lt></range>
	<range><gt>3.3.*</gt><lt>3.3.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OTRS Project reports:
	<blockquote cite="https://www.otrs.com/security-advisory-2014-03-xss-issue/">
	 An attacker could send a specially prepared HTML email to OTRS. If
he can then trick an agent into following a special link to display this email,
JavaScript code would be executed.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.otrs.com/security-advisory-2014-03-xss-issue/</url>
 <cvename>CVE-2014-1695</cvename>
 </references>
 <dates>
 <discovery>2014-02-25</discovery>
 <entry>2014-02-25</entry>
 </dates>
 </vuln>

<vuln vid="42d42090-9a4d-11e3-b029-08002798f6ff">
 <topic>PostgreSQL -- multiple privilege issues</topic>
 <affects>
 <package>
	<name>postgresql-server</name>
	<range><lt>8.4.20</lt></range>
	<range><ge>9.0.0</ge><lt>9.0.16</lt></range>
	<range><ge>9.1.0</ge><lt>9.1.12</lt></range>
	<range><ge>9.2.0</ge><lt>9.2.7</lt></range>
	<range><ge>9.3.0</ge><lt>9.3.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL Project reports:
	<blockquote cite="http://www.postgresql.org/about/news/1506/">
	 This update fixes CVE-2014-0060, in which PostgreSQL did not
	 properly enforce the WITH ADMIN OPTION permission for ROLE management.
	 Before this fix, any member of a ROLE was able to grant others access
	 to the same ROLE regardless if the member was given the WITH ADMIN
	 OPTION permission. It also fixes multiple privilege escalation issues,
	 including: CVE-2014-0061, CVE-2014-0062, CVE-2014-0063, CVE-2014-0064,
	 CVE-2014-0065, and CVE-2014-0066. More information on these issues can
	 be found on our security page and the security issue detail wiki page.
	 
	 
	 With this release, we are also alerting users to a known security hole
	 that allows other users on the same machine to gain access to an
	 operating system account while it is doing "make check":
	 CVE-2014-0067. "Make check" is normally part of building PostgreSQL
	 from source code. As it is not possible to fix this issue without
	 causing significant issues to our testing infrastructure, a patch will
	 be released separately and publicly. Until then, users are strongly
	 advised not to run "make check" on machines where untrusted users have
	 accounts.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0060</cvename>
 <cvename>CVE-2014-0061</cvename>
 <cvename>CVE-2014-0062</cvename>
 <cvename>CVE-2014-0063</cvename>
 <cvename>CVE-2014-0064</cvename>
 <cvename>CVE-2014-0065</cvename>
 <cvename>CVE-2014-0066</cvename>
 <cvename>CVE-2014-0067</cvename>
 </references>
 <dates>
 <discovery>2014-02-20</discovery>
 <entry>2014-02-20</entry>
 </dates>
 </vuln>

<vuln vid="0871d18b-9638-11e3-a371-6805ca0b3d42">
 <topic>phpMyAdmin -- Self-XSS due to unescaped HTML output in import.</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>3.3.1</ge><lt>4.1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php">
	 When importing a file with crafted filename, it is
	 possible to trigger an XSS. We consider this vulnerability
	 to be non critical.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php</url>
 <cvename>CVE-2014-1879</cvename>
 </references>
 <dates>
 <discovery>2014-02-15</discovery>
 <entry>2014-02-15</entry>
 </dates>
 </vuln>

<vuln vid="3e0507c6-9614-11e3-b3a5-00e0814cab4e">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>1.551</lt></range>
 </package>
 <package>
	<name>jenkins-lts</name>
	<range><lt>1.532.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory reports:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14">
	 This advisory announces multiple security vulnerabilities that
	 were found in Jenkins core.
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14</url>
 <cvename>CVE-2013-5573</cvename>
 <cvename>CVE-2013-7285</cvename>
 </references>
 <dates>
 <discovery>2014-02-14</discovery>
 <entry>2014-02-15</entry>
 </dates>
 </vuln>

<vuln vid="90b27045-9530-11e3-9d09-000c2980a9f3">
 <topic>lighttpd -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>lighttpd</name>
	<range><lt>1.4.34</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	lighttpd security advisories report:
	<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt">
	 It is possible to inadvertantly enable vulnerable ciphers when using
	 ssl.cipher-list.
	</blockquote>
	<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt">
	 In certain cases setuid() and similar can fail, potentially triggering
	 lighttpd to restart running as root.
	</blockquote>
	<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt">
	 If FAMMonitorDirectory fails, the memory intended to store the context is
	 released; some lines below the "version" compoment of that context is read.
	 Reading invalid data doesn't matter, but the memory access could trigger a
	 segfault.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt</url>
 <url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt</url>
 <url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt</url>
 <cvename>CVE-2013-4508</cvename>
 <cvename>CVE-2013-4559</cvename>
 <cvename>CVE-2013-4560</cvename>
 </references>
 <dates>
 <discovery>2013-11-28</discovery>
 <entry>2014-02-14</entry>
 </dates>
 </vuln>

<vuln vid="4dd575b8-8f82-11e3-bb11-0025905a4771">
 <topic>phpmyfaq -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><lt>2.8.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyFAQ team reports:
	<blockquote cite="http://www.phpmyfaq.de/advisory_2014-02-04.php">
	 An arbitrary script may be executed on the user's Internet
	 Explorer when using an older version of the browser. If a user views
	 a malicious page while logged in, settings may be changed
	 unintentionally.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0813</cvename>
 <cvename>CVE-2014-0814</cvename>
 <url>http://www.phpmyfaq.de/advisory_2014-02-04.php</url>
 </references>
 <dates>
 <discovery>2014-02-04</discovery>
 <entry>2014-02-06</entry>
 </dates>
 </vuln>

<vuln vid="b7a7576d-8e0a-11e3-9976-9c4e36909cc0">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.336</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb14-04.html">
	 These updates address vulnerabilities that could cause a crash
	 and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0497</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb14-04.html</url>
 </references>
 <dates>
 <discovery>2014-02-04</discovery>
 <entry>2014-02-04</entry>
 <modified>2014-02-05</modified>
 </dates>
 </vuln>

<vuln vid="1753f0ff-8dd5-11e3-9b45-b4b52fce4ce8">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>25.0,1</gt><lt>27.0,1</lt></range>
	<range><lt>24.3.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>27.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.24</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>24.3.0</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.24</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>24.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2014-01 Miscellaneous memory safety hazards
	 (rv:27.0 / rv:24.3)
	 MFSA 2014-02 Clone protected content with XBL scopes
	 MFSA 2014-03 UI selection timeout missing on download
	 prompts
	 MFSA 2014-04 Incorrect use of discarded images by
	 RasterImage
	 MFSA 2014-05 Information disclosure with *FromPoint on
	 iframes
	 MFSA 2014-06 Profile path leaks to Android system log
	 MFSA 2014-07 XSLT stylesheets treated as styles in Content
	 Security Policy
	 MFSA 2014-08 Use-after-free with imgRequestProxy and image
	 proccessing
	 MFSA 2014-09 Cross-origin information leak through web
	 workers
	 MFSA 2014-10 Firefox default start page UI content invokable
	 by script
	 MFSA 2014-11 Crash when using web workers with asm.js
	 MFSA 2014-12 NSS ticket handling issues
	 MFSA 2014-13 Inconsistent JavaScript handling of access to
	 Window objects
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1477</cvename>
 <cvename>CVE-2014-1478</cvename>
 <cvename>CVE-2014-1479</cvename>
 <cvename>CVE-2014-1480</cvename>
 <cvename>CVE-2014-1481</cvename>
 <cvename>CVE-2014-1482</cvename>
 <cvename>CVE-2014-1483</cvename>
 <cvename>CVE-2014-1484</cvename>
 <cvename>CVE-2014-1485</cvename>
 <cvename>CVE-2014-1486</cvename>
 <cvename>CVE-2014-1487</cvename>
 <cvename>CVE-2014-1488</cvename>
 <cvename>CVE-2014-1489</cvename>
 <cvename>CVE-2014-1490</cvename>
 <cvename>CVE-2014-1491</cvename>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-01.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-02.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-03.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-04.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-05.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-06.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-07.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-08.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-09.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-10.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-11.html</url>
 <url>https://www.mozilla.org/security/announce/2014/mfsa2014-12.html</url>
 <url>http://www.mozilla.org/security/known-vulnerabilities/</url>
 </references>
 <dates>
 <discovery>2014-02-04</discovery>
 <entry>2014-02-04</entry>
 </dates>
 </vuln>

<vuln vid="111f1f84-1d14-4ff2-a9ea-cf07119c0d3b">
 <topic>libyaml heap overflow resulting in possible code execution</topic>
 <affects>
 <package>
	<name>libyaml</name>
	<range><lt>0.1.4_3</lt></range>
 </package>
 <package>
	<name>pkg</name>
	<range><lt>1.2.6</lt></range>
 </package>
 <package>
	<name>pkg-devel</name>
	<range><lt>1.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libyaml was prone to a heap overflow that could result in
	 arbitrary code execution. Pkg uses libyaml to parse
	 the package manifests in some cases. Pkg also used libyaml
	 to parse the remote repository until 1.2.
	RedHat Product Security Team reports on libyaml:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1033990">
	 A heap-based buffer overflow flaw was found in the way libyaml
	 parsed YAML tags. A remote attacker could provide a
	 specially-crafted YAML document that, when parsed by an application
	 using libyaml, would cause the application to crash or, potentially,
	 execute arbitrary code with the privileges of the user running the
	 application.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-6393</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1033990</url>
 </references>
 <dates>
 <discovery>2013-11-24</discovery>
 <entry>2014-02-01</entry>
 <modified>2014-02-01</modified>
 </dates>
 </vuln>

<vuln vid="a4c9e12d-88b7-11e3-8ada-10bf48e1088e">
 <topic>socat -- buffer overflow with data from command line</topic>
 <affects>
 <package>
	<name>socat</name>
	<range><lt>1.7.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Florian Weimer of the Red Hat Product Security Team reports:
	<blockquote cite="http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt">
	 Due to a missing check during assembly of the HTTP request line a long
	 target server name in the PROXY-CONNECT address can cause a stack buffer
	 overrun. Exploitation requires that the attacker is able to provide the
	 target server name to the PROXY-CONNECT address in the command line.
	 This can happen for example in scripts that receive data from untrusted
	 sources.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0019</cvename>
 <url>http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt</url>
 </references>
 <dates>
 <discovery>2014-01-24</discovery>
 <entry>2014-01-29</entry>
 </dates>
 </vuln>

<vuln vid="c7b5d72b-886a-11e3-9533-60a44c524f57">
 <topic>otrs -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><lt>3.1.19</lt></range>
	<range><gt>3.2.*</gt><lt>3.2.14</lt></range>
	<range><gt>3.3.*</gt><lt>3.3.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OTRS Project reports:
	<blockquote cite="https://www.otrs.com/security-advisory-2014-02-sql-injection-issue/">
	 SQL injection issue
	</blockquote>
	<blockquote cite="https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface/">
	 An attacker that managed to take over the session of a logged in customer
	 could create tickets and/or send follow-ups to existing tickets due to
	 missing challenge token checks.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1471</cvename>
 <url>https://www.otrs.com/security-advisory-2014-02-sql-injection-issue/</url>
 <url>https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface/</url>
 </references>
 <dates>
 <discovery>2014-01-28</discovery>
 <entry>2014-01-28</entry>
 <modified>2014-02-06</modified>
 </dates>
 </vuln>

<vuln vid="d1dfc4c7-8791-11e3-a371-6805ca0b3d42">
 <topic>rt42 -- denial-of-service attack via the email gateway</topic>
 <affects>
 <package>
	<name>rt42</name>
	<range><ge>4.2</ge><lt>4.2.1_3</lt></range>
	<range><ge>4.2.2</ge><lt>4.2.2_2</lt></range>
 </package>
 <package>
	<name>p5-Email-Address-List</name>
	<range><lt>0.02</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The RT development team reports:
	<blockquote cite="http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html">
	 Versions of RT between 4.2.0 and 4.2.2 (inclusive) are
	 vulnerable to a denial-of-service attack via the email
	 gateway; any installation which accepts mail from untrusted
	 sources is vulnerable, regardless of the permissions
	 configuration inside RT. This vulnerability is assigned
	 CVE-2014-1474.
	 This vulnerability is caused by poor parsing performance
	 in the Email::Address::List module, which RT depends on. We
	 recommend that affected users upgrade their version of
	 Email::Address::List to v0.02 or above, which resolves the
	 issue. Due to a communications mishap, the release on CPAN
	 will temporarily appear as "unauthorized," and the
	 command-line cpan client will hence not install it. We
	 expect this to be resolved shortly; in the meantime, the
	 release is also available from our server.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-1474</cvename>
 <url>http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html</url>
 </references>
 <dates>
 <discovery>2014-01-27</discovery>
 <entry>2014-01-27</entry>
 </dates>
 </vuln>

<vuln vid="efa663eb-8754-11e3-9a47-00163e1ed244">
 <topic>strongswan -- multiple DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>strongswan</name>
	<range><lt>5.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	strongSwan Project reports:
	<blockquote cite="http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6076%29.html">
	 A DoS vulnerability triggered by crafted IKEv1 fragmentation
	 payloads was discovered in strongSwan's IKE daemon charon. All
	 versions since 5.0.2 are affected.
	</blockquote>
	<blockquote cite="http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6075%29.html">
	 A DoS vulnerability and potential authorization bypass triggered
	 by a crafted ID_DER_ASN1_DN ID payload was discovered in strongSwan.
	 All versions since 4.3.3 are affected.
	</blockquote>
	<blockquote cite="http://www.strongswan.org/blog/2013/08/01/strongswan-denial-of-service-vulnerability-%28cve-2013-5018%29.html">
	 A DoS vulnerability in strongSwan was discovered, which is
	 triggered by XAuth usernames and EAP identities in versions
	 5.0.3 and 5.0.4.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-5018</cvename>
 <cvename>CVE-2013-6075</cvename>
 <cvename>CVE-2013-6076</cvename>
 <url>http://www.strongswan.org/blog/2013/08/01/strongswan-denial-of-service-vulnerability-%28cve-2013-5018%29.html</url>
 <url>http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6075%29.html</url>
 <url>http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6076%29.html</url>
 </references>
 <dates>
 <discovery>2013-11-01</discovery>
 <entry>2014-01-27</entry>
 </dates>
 </vuln>

<vuln vid="d9dbe6e8-84da-11e3-98bd-080027f2d077">
 <topic>varnish -- DoS vulnerability in Varnish HTTP cache</topic>
 <affects>
 <package>
	<name>varnish</name>
	<range><lt>3.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Varnish Cache Project reports:
	<blockquote cite="https://www.varnish-cache.org/lists/pipermail/varnish-announce/2013-October/000686.html">
	 If Varnish receives a certain illegal request, and the subroutine
	 'vcl_error{}' restarts the request, the varnishd worker process
	 will crash with an assert.
	 
	 The varnishd management process will restart the worker process, but
	 there will be a brief interruption of service and the cache will be
	 emptied, causing more traffic to go to the backend.
	 
	 We are releasing this advisory because restarting from vcl_error{} is
	 both fairly common and documented.
	 This is purely a denial of service vulnerability, there is no risk of
	 privilege escalation.
	 Workaround
	 Insert this at the top of your VCL file:
	 <pre>
		sub vcl_error {
			if (obj.status == 400 || obj.status == 413) {
				return(deliver);
			}
		}

Or add this test at the top of your existing vcl_error{}.
	 </pre>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4484</cvename>
 <mlist>https://www.varnish-cache.org/lists/pipermail/varnish-announce/2013-October/000686.html</mlist>
 </references>
 <dates>
 <discovery>2013-10-30</discovery>
 <entry>2014-01-25</entry>
 </dates>
 </vuln>

<vuln vid="c0ef849e-84ac-11e3-bec4-9c4e36909cc0">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.335</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="http://helpx.adobe.com/security/products/flash-player/apsb14-02.html">
	 These updates address vulnerabilities that could cause a crash
	 and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0491</cvename>
 <cvename>CVE-2014-0492</cvename>
 <url>http://helpx.adobe.com/security/products/flash-player/apsb14-02.html</url>
 </references>
 <dates>
 <discovery>2014-01-14</discovery>
 <entry>2014-01-24</entry>
 </dates>
 </vuln>

<vuln vid="6d08fa63-83bf-11e3-bdba-080027ef73ec">
 <topic>HTMLDOC -- buffer overflow issues when reading AFM files and parsing page sizes</topic>
 <affects>
 <package>
	<name>htmldoc</name>
	<range><lt>1.8.28</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michael Sweet reports:
	<blockquote cite="http://www.msweet.org/projects.php?Z1">
	 HTMLDOC 1.8.28 fixes some known security issues and
	 formatting bugs. Changes include:
	 <ul>
	 <li>SECURITY: Fixed three buffer overflow issues when
	 reading AFM files and parsing page sizes.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.msweet.org/projects.php?Z1</url>
 </references>
 <dates>
 <discovery>2014-01-06</discovery>
 <entry>2014-01-22</entry>
 <modified>2014-01-23</modified>
 </dates>
 </vuln>

<vuln vid="81f1fdc2-7ec7-11e3-a6c6-00163e1ed244">
 <topic>virtualbox-ose -- local vulnerability</topic>
 <affects>
 <package>
	<name>virtualbox-ose</name>
	<range><lt>4.2.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oracle reports:
	<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html">
	 Unspecified vulnerability in the Oracle VM VirtualBox
	 component in Oracle Virtualization VirtualBox prior to
	 3.2.20, 4.0.22, 4.1.30, 4.2.22, and 4.3.6 allows local
	 users to affect confidentiality, integrity, and availability
	 via unknown vectors related to Core.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-5892</cvename>
 <url>http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</url>
 </references>
 <dates>
 <discovery>2014-01-15</discovery>
 <entry>2014-01-16</entry>
 </dates>
 </vuln>

<vuln vid="3d95c9a7-7d5c-11e3-a8c1-206a8a720317">
 <topic>ntpd DRDoS / Amplification Attack using ntpdc monlist command</topic>
 <affects>
 <package>
	<name>ntp</name>
	<range><lt>4.2.7p26</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>8.3</ge><lt>8.3_14</lt></range>
	<range><ge>8.4</ge><lt>8.4_7</lt></range>
	<range><ge>9.1</ge><lt>9.1_10</lt></range>
	<range><ge>9.2</ge><lt>9.2_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ntp.org reports:
	<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#DRDoS_Amplification_Attack_using">
	 Unrestricted access to the monlist feature in
	 ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote
	 attackers to cause a denial of service (traffic
	 amplification) via forged (1) REQ_MON_GETLIST or (2)
	 REQ_MON_GETLIST_1 requests, as exploited in the wild in
	 December 2013
	 Use noquery to your default restrictions to block all
	 status queries.
	 Use disable monitor to disable the ``ntpdc -c monlist''
	 command while still allowing other status queries.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-5211</cvename>
 <freebsdsa>SA-14:02.ntpd</freebsdsa>
 <url>http://support.ntp.org/bin/view/Main/SecurityNotice#DRDoS_Amplification_Attack_using</url>
 </references>
 <dates>
 <discovery>2014-01-01</discovery>
 <entry>2014-01-14</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="ba04a373-7d20-11e3-8992-00132034b086">
 <topic>nagios -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>nagios</name>
	<range><lt>3.5.1_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Eric Stanley reports:
	<blockquote cite="http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/">
	 Most CGIs previously incremented the input variable counter twice
	 when it encountered a long key value. This could cause the CGI to
	 read past the end of the list of CGI variables.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-7108</cvename>
 <cvename>CVE-2013-7205</cvename>
 <url>http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1046113</url>
 </references>
 <dates>
 <discovery>2013-12-20</discovery>
 <entry>2014-01-14</entry>
 </dates>
 </vuln>

<vuln vid="cb252f01-7c43-11e3-b0a6-005056a37f68">
 <topic>bind -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><lt>9.9.4.2</lt></range>
 </package>
 <package>
	<name>bind99-base</name>
	<range><lt>9.9.4.2</lt></range>
 </package>
 <package>
	<name>bind98</name>
	<range><lt>9.8.6.2</lt></range>
 </package>
 <package>
	<name>bind98-base</name>
	<range><lt>9.8.6.2</lt></range>
 </package>
 <package>
	<name>bind96</name>
	<range><lt>9.6.3.2.ESV.R10.2</lt></range>
 </package>
 <package>
	<name>bind96-base</name>
	<range><lt>9.6.3.2.ESV.R10.2</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.2</ge><lt>9.2_3</lt></range>
	<range><ge>9.1</ge><lt>9.1_10</lt></range>
	<range><ge>8.4</ge><lt>8.4_7</lt></range>
	<range><ge>8.3</ge><lt>8.3_14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01078/74/">
	 Because of a defect in handling queries for NSEC3-signed zones,
	 BIND can crash with an "INSIST" failure in name.c when processing
	 queries possessing certain properties. By exploiting this defect
	 an attacker deliberately constructing a query with the right
	 properties could achieve denial of service against an authoritative
	 nameserver serving NSEC3-signed zones.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2014-0591</cvename>
 <freebsdsa>SA-14:04.bind</freebsdsa>
 <url>https://kb.isc.org/article/AA-01078/74/</url>
 </references>
 <dates>
 <discovery>2014-01-08</discovery>
 <entry>2014-01-13</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="28c575fa-784e-11e3-8249-001cc0380077">
 <topic>libXfont -- Stack buffer overflow in parsing of BDF font files in libXfont</topic>
 <affects>
 <package>
	<name>libXfont</name>
	<range><lt>1.4.7,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	freedesktop.org reports:
	<blockquote cite="http://lists.x.org/archives/xorg-announce/2014-January/002389.html">
	 A BDF font file containing a longer than expected string can cause
	 a buffer overflow on the stack. Testing in X servers built with
	 Stack Protector restulted in an immediate crash when reading a
	 user-proveded specially crafted font.
	 As libXfont is used to read user-specified font files in all X
	 servers distributed by X.Org, including the Xorg server which is
	 often run with root privileges or as setuid-root in order to access
	 hardware, this bug may lead to an unprivileged user acquiring root
	 privileges in some systems.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-6462</cvename>
 <url>http://lists.x.org/archives/xorg-announce/2014-January/002389.html</url>
 </references>
 <dates>
 <discovery>2013-12-24</discovery>
 <entry>2014-01-08</entry>
 </dates>
 </vuln>

<vuln vid="5aaa257e-772d-11e3-a65a-3c970e169bc2">
 <topic>openssl -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.1_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL development team reports:
	<blockquote cite="http://www.openssl.org/news/openssl-1.0.1-notes.html">
	 Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014]:
	 <ul>
	 <li>Fix for TLS record tampering bug [CVE-2013-4353]</li>
	 <li>Fix for TLS version checking bug [CVE-2013-6449]</li>
	 <li>Fix for DTLS retransmission bug [CVE-2013-6450]</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-14:03.openssl</freebsdsa>
 <cvename>CVE-2013-4353</cvename>
 <cvename>CVE-2013-6449</cvename>
 <cvename>CVE-2013-6450</cvename>
 <url>http://www.openssl.org/news/openssl-1.0.1-notes.html</url>
 </references>
 <dates>
 <discovery>2014-01-06</discovery>
 <entry>2014-01-06</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="3e33a0bb-6b2f-11e3-b042-20cf30e32f6d">
 <topic>OpenX -- SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>openx</name>
	<range><lt>3.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Revive reports:
	<blockquote cite="http://www.revive-adserver.com/security/revive-sa-2013-001/">
	 An SQL-injection vulnerability was recently discovered and reported
	 to the Revive Adserver team by Florian Sander. The vulnerability is
	 known to be already exploited to gain unauthorised access to the
	 application using brute force mechanisms, however other kind of
	 attacks might be possible and/or already in use. The risk is rated
	 to be critical as the most common end goal of the attackers is to
	 spread malware to the visitors of all the websites and ad networks
	 that the ad server is being used on.
	 The vulnerability is also present and exploitable in OpenX Source
	 2.8.11 and earlier versions, potentially back to phpAdsNew 2.0.x.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.revive-adserver.com/security/revive-sa-2013-001/</url>
 <url>http://www.kreativrauschen.com/blog/2013/12/18/zero-day-vulnerability-in-openx-source-2-8-11-and-revive-adserver-3-0-1/</url>
 <cvename>CVE-2013-7149</cvename>
 </references>
 <dates>
 <discovery>2013-12-20</discovery>
 <entry>2013-12-22</entry>
 </dates>
 </vuln>

<vuln vid="4e1f4abc-6837-11e3-9cda-3c970e169bc2">
 <topic>cURL library -- cert name check ignore with GnuTLS</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.21.4</ge><lt>7.33.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cURL project reports:
	<blockquote cite="http://curl.haxx.se/docs/adv_20131217.html">
	 libcurl is vulnerable to a case of missing out the checking
	 of the certificate CN or SAN name field when the digital
	 signature verification is turned off.
	 libcurl offers two separate and independent options for
	 verifying a server's TLS certificate. CURLOPT_SSL_VERIFYPEER
	 and CURLOPT_SSL_VERIFYHOST. The first one tells libcurl to
	 verify the trust chain using a CA cert bundle, while the
	 second tells libcurl to make sure that the name fields in
	 the server certificate meets the criteria. Both options are
	 enabled by default.
	 This flaw had the effect that when an application disabled
	 CURLOPT_SSL_VERIFYPEER, libcurl mistakenly also skipped the
	 CURLOPT_SSL_VERIFYHOST check. Applications can disable
	 CURLOPT_SSL_VERIFYPEER and still achieve security by doing
	 the check on its own using other means.
	 The curl command line tool is not affected by this problem
	 as it either enables both options or disables both at the
	 same time.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://curl.haxx.se/docs/adv_20131217.html</url>
 <cvename>CVE-2013-6422</cvename>
 </references>
 <dates>
 <discovery>2013-12-17</discovery>
 <entry>2013-12-18</entry>
 </dates>
 </vuln>

<vuln vid="2e5715f8-67f7-11e3-9811-b499baab0cbe">
 <topic>gnupg -- RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis attack</topic>
 <affects>
 <package>
	<name>gnupg</name>
	<range><lt>1.4.16</lt></range>
 </package>
 <package>
	<name>gnupg1</name>
	<range><lt>1.4.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Werner Koch reports:
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000337.html">
	 CVE-2013-4576 has been assigned to this security bug.
	 The paper describes two attacks. The first attack allows
	 to distinguish keys: An attacker is able to notice which key is
	 currently used for decryption. This is in general not a problem but
	 may be used to reveal the information that a message, encrypted to a
	 commonly not used key, has been received by the targeted machine. We
	 do not have a software solution to mitigate this attack.
	 The second attack is more serious. It is an adaptive
	 chosen ciphertext attack to reveal the private key. A possible
	 scenario is that the attacker places a sensor (for example a standard
	 smartphone) in the vicinity of the targeted machine. That machine is
	 assumed to do unattended RSA decryption of received mails, for example
	 by using a mail client which speeds up browsing by opportunistically
	 decrypting mails expected to be read soon. While listening to the
	 acoustic emanations of the targeted machine, the smartphone will send
	 new encrypted messages to that machine and re-construct the private
	 key bit by bit. A 4096 bit RSA key used on a laptop can be revealed
	 within an hour.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4576</cvename>
 <url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000337.html</url>
 </references>
 <dates>
 <discovery>2013-12-18</discovery>
 <entry>2013-12-18</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="0c39bafc-6771-11e3-868f-0025905a4771">
 <topic>asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk10</name>
	<range><lt>10.12.4</lt></range>
 </package>
 <package>
	<name>asterisk11</name>
	<range><lt>11.6.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><lt>1.8.24.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/security">
	 A 16 bit SMS message that contains an odd message length value will
	 cause the message decoding loop to run forever. The message buffer is
	 not on the stack but will be overflowed resulting in corrupted memory
	 and an immediate crash.
	 External control protocols, such as the Asterisk Manager Interface,
	 often have the ability to get and set channel variables; this allows
	 the execution of dialplan functions. Dialplan functions within
	 Asterisk are incredibly powerful, which is wonderful for building
	 applications using Asterisk. But during the read or write execution,
	 certain diaplan functions do much more. For example, reading the SHELL()
	 function can execute arbitrary commands on the system Asterisk is
	 running on. Writing to the FILE() function can change any file that
	 Asterisk has write access to. When these functions are executed from an
	 external protocol, that execution could result in a privilege escalation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-7100</cvename>
 <url>http://downloads.asterisk.org/pub/security/AST-2013-006.pdf</url>
 <url>http://downloads.asterisk.org/pub/security/AST-2013-007.pdf</url>
 <url>https://www.asterisk.org/security</url>
 </references>
 <dates>
 <discovery>2013-12-16</discovery>
 <entry>2013-12-17</entry>
 </dates>
 </vuln>

<vuln vid="3b86583a-66a7-11e3-868f-0025905a4771">
 <topic>phpmyfaq -- arbitrary PHP code execution vulnerability</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><lt>2.8.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyFAQ team reports:
	<blockquote cite="http://www.phpmyfaq.de/advisory_2013-11-26.php">
	 Secunia noticed while analysing the advisory that authenticated
	 users with "Right to add attachments" are able to exploit an already
	 publicly known issue in the bundled Ajax File Manager of phpMyFAQ version
	 2.8.3, which leads to arbitrary PHP code execution for authenticated
	 users with the permission "Right to add attachments".
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://en.securitylab.ru/lab/PT-2013-41</url>
 <url>http://www.phpmyfaq.de/advisory_2013-11-26.php</url>
 </references>
 <dates>
 <discovery>2013-11-26</discovery>
 <entry>2013-12-16</entry>
 <modified>2013-12-17</modified>
 </dates>
 </vuln>

<vuln vid="44d0f8dc-6607-11e3-bb11-0025900931f8">
 <topic>zabbix -- shell command injection vulnerability</topic>
 <affects>
 <package>
	<name>zabbix2-agent</name>
	<range><lt>2.0.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Recurity Labs Team project reports:
	<blockquote cite="https://support.zabbix.com/browse/ZBX-7479">
	 Zabbix agent is vulnerable to remote command execution
	 from the Zabbix server in some cases.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-6824</cvename>
 <url>https://support.zabbix.com/browse/ZBX-7479</url>
 </references>
 <dates>
 <discovery>2013-12-03</discovery>
 <entry>2013-12-16</entry>
 </dates>
 </vuln>

<vuln vid="47b4e713-6513-11e3-868f-0025905a4771">
 <topic>PHP5 -- memory corruption in openssl_x509_parse()</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><ge>5.4.0</ge><lt>5.4.23</lt></range>
 </package>
 <package>
	<name>php53</name>
	<range><lt>5.3.28</lt></range>
 </package>
 <package>
	<name>php55</name>
	<range><ge>5.5.0</ge><lt>5.5.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Esser reports:
	<blockquote cite="https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html">
	 The PHP function openssl_x509_parse() uses a helper function
	 called asn1_time_to_time_t() to convert timestamps from ASN1
	 string format into integer timestamp values. The parser within
	 this helper function is not binary safe and can therefore be
	 tricked to write up to five NUL bytes outside of an allocated
	 buffer.
	 This problem can be triggered by x509 certificates that contain
	 NUL bytes in their notBefore and notAfter timestamp fields and
	 leads to a memory corruption that might result in arbitrary
	 code execution.
	 Depending on how openssl_x509_parse() is used within a PHP
	 application the attack requires either a malicious cert signed
	 by a compromised/malicious CA or can be carried out with a
	 self-signed cert.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-6420</cvename>
 <url>https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html</url>
 </references>
 <dates>
 <discovery>2013-12-13</discovery>
 <entry>2013-12-14</entry>
 </dates>
 </vuln>

<vuln vid="dd116b19-64b3-11e3-868f-0025905a4771">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>25.0,1</gt><lt>26.0,1</lt></range>
	<range><lt>24.2.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>26.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.23</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>24.2.0</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.23</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>24.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2013-116 JPEG information leak
	 MFSA 2013-105 Application Installation doorhanger persists on
	 navigation
	 MFSA 2013-106 Character encoding cross-origin XSS attack
	 MFSA 2013-107 Sandbox restrictions not applied to nested object
	 elements
	 MFSA 2013-108 Use-after-free in event listeners
	 MFSA 2013-109 Use-after-free during Table Editing
	 MFSA 2013-110 Potential overflow in JavaScript binary search
	 algorithms
	 MFSA 2013-111 Segmentation violation when replacing ordered list
	 elements
	 MFSA 2013-112 Linux clipboard information disclosure though
	 selection paste
	 MFSA 2013-113 Trust settings for built-in roots ignored during EV
	 certificate validation
	 MFSA 2013-114 Use-after-free in synthetic mouse movement
	 MFSA 2013-115 GetElementIC typed array stubs can be generated
	 outside observed typesets
	 MFSA 2013-116 JPEG information leak
	 MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2013-5609</cvename>
	<cvename>CVE-2013-5610</cvename>
	<cvename>CVE-2013-5611</cvename>
	<cvename>CVE-2013-5612</cvename>
	<cvename>CVE-2013-5613</cvename>
	<cvename>CVE-2013-5614</cvename>
	<cvename>CVE-2013-5615</cvename>
	<cvename>CVE-2013-5616</cvename>
	<cvename>CVE-2013-5618</cvename>
	<cvename>CVE-2013-5619</cvename>
	<cvename>CVE-2013-6629</cvename>
	<cvename>CVE-2013-6630</cvename>
	<cvename>CVE-2013-6671</cvename>
	<cvename>CVE-2013-6672</cvename>
	<cvename>CVE-2013-6673</cvename>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-104.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-105.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-106.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-107.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-108.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-109.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-110.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-111.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-112.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-113.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-114.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-115.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-116.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-117.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
 </references>
 <dates>
 <discovery>2013-12-09</discovery>
 <entry>2013-12-14</entry>
 </dates>
 </vuln>

<vuln vid="613e45d1-6154-11e3-9b62-000c292e4fd8">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba34</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>samba35</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>samba36</name>
	<range><gt>3.6.*</gt><lt>3.6.22</lt></range>
 </package>
 <package>
	<name>samba4</name>
	<range><gt>4.0.*</gt><lt>4.0.13</lt></range>
 </package>
 <package>
	<name>samba41</name>
	<range><gt>4.1.*</gt><lt>4.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba project reports:
	<blockquote cite="http://www.samba.org/samba/latest_news.html#4.1.3">
	 These are security releases in order to address CVE-2013-4408
	 (DCE-RPC fragment length field is incorrectly checked) and CVE-2012-6150
	 (pam_winbind login without require_membership_of restrictions).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-6150</cvename>
 <cvename>CVE-2013-4408</cvename>
 <url>http://www.samba.org/samba/security/CVE-2012-6150</url>
 <url>http://www.samba.org/samba/security/CVE-2013-4408</url>
 </references>
 <dates>
 <discovery>2012-06-12</discovery>
 <entry>2013-12-11</entry>
 </dates>
 </vuln>

<vuln vid="6a806960-3016-44ed-8575-8614a7cb57c7">
 <topic>rails -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-actionmailer</name>
	<range><lt>3.2.16</lt></range>
 </package>
 <package>
	<name>rubygem-actionpack</name>
	<range><lt>3.2.16</lt></range>
 </package>
 <package>
	<name>rubygem-activemodel</name>
	<range><lt>3.2.16</lt></range>
 </package>
 <package>
	<name>rubygem-activerecord</name>
	<range><lt>3.2.16</lt></range>
 </package>
 <package>
	<name>rubygem-activeresource</name>
	<range><lt>3.2.16</lt></range>
 </package>
 <package>
	<name>rubygem-activesupport</name>
	<range><lt>3.2.16</lt></range>
 </package>
 <package>
	<name>rubygem-rails</name>
	<range><lt>3.2.16</lt></range>
 </package>
 <package>
	<name>rubygem-railties</name>
	<range><lt>3.2.16</lt></range>
 </package>
 <package>
	<name>rubygem-actionpack4</name>
	<range><lt>4.0.2</lt></range>
 </package>
 <package>
	<name>rubygem-activesupport4</name>
	<range><lt>4.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Rails weblog:
	<blockquote cite="http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/">
	 Rails 3.2.16 and 4.0.2 have been released! These two
	 releases contain important security fixes, so please upgrade
	 as soon as possible! In order to make upgrading as smooth as
	 possible, we've only included commits directly related to
	 each security issue.
	 The security fixes in 3.2.16 are:
	 <ul>
	 <li>CVE-2013-4491</li>
	 <li>CVE-2013-6414</li>
	 <li>CVE-2013-6415</li>
	 <li>CVE-2013-6417</li>
	 </ul>
	 The security fixes in 4.0.2 are:
	 <ul>
	 <li>CVE-2013-4491</li>
	 <li>CVE-2013-6414</li>
	 <li>CVE-2013-6415</li>
	 <li>CVE-2013-6416</li>
	 <li>CVE-2013-6417</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4491</cvename>
 <cvename>CVE-2013-6414</cvename>
 <cvename>CVE-2013-6415</cvename>
 <cvename>CVE-2013-6416</cvename>
 <cvename>CVE-2013-6417</cvename>
 <url>http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/</url>
 </references>
 <dates>
 <discovery>2013-12-03</discovery>
 <entry>2013-12-08</entry>
 <modified>2014-04-23</modified>
 </dates>
 </vuln>

<vuln vid="d9649816-5e0d-11e3-8d23-3c970e169bc2">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal6</name>
	<range><lt>6.29</lt></range>
 </package>
 <package>
	<name>drupal7</name>
	<range><lt>7.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://drupal.org/SA-CORE-2013-003">
	 Multiple vulnerabilities were fixed in the supported Drupal
	 core versions 6 and 7.
	 <ul>
	 <li>Multiple vulnerabilities due to optimistic cross-site
	 request forgery protection (Form API validation - Drupal 6
	 and 7)</li>
	 <li>Multiple vulnerabilities due to weakness in pseudorandom
	 number generation using mt_rand() (Form API, OpenID and
	 random password generation - Drupal 6 and 7)</li>
	 <li>Code execution prevention (Files directory .htaccess for
	 Apache - Drupal 6 and 7)</li>
	 <li>Access bypass (Security token validation - Drupal 6 and 7)</li>
	 <li>Cross-site scripting (Image module - Drupal 7)</li>
	 <li>Cross-site scripting (Color module - Drupal 7)</li>
	 <li>Open redirect (Overlay module - Drupal 7)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://drupal.org/SA-CORE-2013-003</url>
 </references>
 <dates>
 <discovery>2013-11-20</discovery>
 <entry>2013-12-06</entry>
 </dates>
 </vuln>

<vuln vid="4158c57e-5d39-11e3-bc1e-6cf0490a8c18">
 <topic>Joomla! -- Core XSS Vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla2</name>
	<range><ge>2.5.*</ge><le>2.5.14</le></range>
 </package>
 <package>
	<name>joomla3</name>
	<range><ge>3.0.*</ge><le>3.1.5</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="http://developer.joomla.org/security/570-core-xss-20131101.html">
	<h2>[20131101] Core XSS Vulnerability</h2>
	 Inadequate filtering leads to XSS vulnerability in com_contact.
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/571-core-xss-20131102.html">
	 <h2>[20131102] Core XSS Vulnerability</h2>
	 Inadequate filtering leads to XSS vulnerability in com_contact, com_weblinks, com_newsfeeds.
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/572-core-xss-20131103.html">
	 <h2>[20131103] Core XSS Vulnerability</h2>
	 Inadequate filtering leads to XSS vulnerability in com_contact.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://developer.joomla.org/security/570-core-xss-20131101.html</url>
 <url>http://developer.joomla.org/security/571-core-xss-20131102.html</url>
 <url>http://developer.joomla.org/security/572-core-xss-20131103.html</url>
 </references>
 <dates>
 <discovery>2013-11-01</discovery>
 <entry>2013-12-04</entry>
 <modified>2014-04-23</modified>
 </dates>
 </vuln>

<vuln vid="d2073237-5b52-11e3-80f7-c86000cbc6ec">
 <topic>OpenTTD -- Denial of service using forcefully crashed aircrafts</topic>
 <affects>
 <package>
	<name>openttd</name>
	<range><ge>0.3.6</ge><lt>1.3.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenTTD Team reports:
	<blockquote cite="https://security.openttd.org/en/CVE-2013-6411">
	 The problem is caused by incorrectly handling the fact that
	 the aircraft circling the corner airport will be outside of the
	 bounds of the map. In the 'out of fuel' crash code the height
	 of the tile under the aircraft is determined. In this case
	 that means a tile outside of the allocated map array, which
	 could occasionally trigger invalid reads.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-6411</cvename>
 <url>https://security.openttd.org/en/CVE-2013-6411</url>
 <url>http://bugs.openttd.org/task/5820</url>
 <url>http://vcs.openttd.org/svn/changeset/26134</url>
 </references>
 <dates>
 <discovery>2013-11-28</discovery>
 <entry>2013-11-28</entry>
 </dates>
 </vuln>

<vuln vid="620cf713-5a99-11e3-878d-20cf30e32f6d">
 <topic>monitorix -- serious bug in the built-in HTTP server</topic>
 <affects>
 <package>
	<name>monitorix</name>
	<range><lt>3.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Monitorix Project reports:
	<blockquote cite="http://www.monitorix.org/news.html#N331">
	 A serious bug in the built-in HTTP server. It was discovered that the
	 handle_request() routine did not properly perform input sanitization
	 which led into a number of security vulnerabilities. An unauthenticated,
	 remote attacker could exploit this flaw to execute arbitrary commands on
	 the remote host. All users still using older versions are advised to
	 upgrade to this version, which resolves this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.monitorix.org/news.html#N331</url>
 <url>https://github.com/mikaku/Monitorix/issues/30</url>
 </references>
 <dates>
 <discovery>2013-11-21</discovery>
 <entry>2013-12-01</entry>
 </dates>
 </vuln>

<vuln vid="e3244a7b-5603-11e3-878d-20cf30e32f6d">
 <topic>subversion -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><ge>1.4.0</ge><lt>1.7.14</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion Project reports:
	<blockquote cite="http://subversion.apache.org/security/">
	 mod_dontdothat does not restrict requests from serf based clients
	 mod_dontdothat allows you to block update REPORT requests against certain
	 paths in the repository. It expects the paths in the REPORT request
	 to be absolute URLs. Serf based clients send relative URLs instead
	 of absolute URLs in many cases. As a result these clients are not blocked
	 as configured by mod_dontdothat.
	 mod_dav_svn assertion triggered by non-canonical URLs in autoversioning commits
	 When SVNAutoversioning is enabled via SVNAutoversioning on
	 commits can be made by single HTTP requests such as MKCOL and
	 PUT. If Subversion is built with assertions enabled any such
	 requests that have non-canonical URLs, such as URLs with a
	 trailing /, may trigger an assert. An assert will cause the
	 Apache process to abort.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4505</cvename>
 <cvename>CVE-2013-4558</cvename>
 <url>http://subversion.apache.org/security/CVE-2013-4505-advisory.txt</url>
 <url>http://subversion.apache.org/security/CVE-2013-4558-advisory.txt</url>
 </references>
 <dates>
 <discovery>2013-11-15</discovery>
 <entry>2013-11-25</entry>
 </dates>
 </vuln>

<vuln vid="742eb9e4-e3cb-4f5a-b94e-0e9a39420600">
 <topic>ruby-gems -- Algorithmic Complexity Vulnerability</topic>
 <affects>
 <package>
	<name>ruby19-gems</name>
	<range><lt>1.8.27</lt></range>
 </package>
 <package>
	<name>ruby20-gems</name>
	<range><lt>1.8.27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby Gem developers report:
	<blockquote cite="http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html">
	 The patch for CVE-2013-4363 was insufficiently verified so the
	 combined regular expression for verifying gem version remains
	 vulnerable following CVE-2013-4363.
	 RubyGems validates versions with a regular expression that is
	 vulnerable to denial of service due to backtracking. For specially
	 crafted RubyGems versions attackers can cause denial of service
	 through CPU consumption.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4363</cvename>
 </references>
 <dates>
 <discovery>2013-09-24</discovery>
 <entry>2013-11-24</entry>
 </dates>
 </vuln>

<vuln vid="54237182-9635-4a8b-92d7-33bfaeed84cd">
 <topic>ruby-gems -- Algorithmic Complexity Vulnerability</topic>
 <affects>
 <package>
	<name>ruby19-gems</name>
	<range><lt>1.8.26</lt></range>
 </package>
 <package>
	<name>ruby20-gems</name>
	<range><lt>1.8.26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby Gem developers report:
	<blockquote cite="http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html">
	 RubyGems validates versions with a regular expression that is
	 vulnerable to denial of service due to backtracking. For specially
	 crafted RubyGems versions attackers can cause denial of service
	 through CPU consumption.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4287</cvename>
 </references>
 <dates>
 <discovery>2013-09-09</discovery>
 <entry>2013-11-24</entry>
 </dates>
 </vuln>

<vuln vid="cc9043cf-7f7a-426e-b2cc-8d1980618113">
 <topic>ruby -- Heap Overflow in Floating Point Parsing</topic>
 <affects>
 <package>
	<name>ruby19</name>
	<range><lt>1.9.3.484,1</lt></range>
 </package>
 <package>
	<name>ruby20</name>
	<range><lt>2.0.0.353,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby developers report:
	<blockquote cite="https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-in-floating-point-parsing-cve-2013-4164/">
	 Any time a string is converted to a floating point value, a
	 specially crafted string can cause a heap overflow. This can lead
	 to a denial of service attack via segmentation faults and possibly
	 arbitrary code execution. Any program that converts input of
	 unknown origin to floating point values (especially common when
	 accepting JSON) are vulnerable.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.ruby-lang.org/en/news/2013/11/22/ruby-1-9-3-p484-is-released/</url>
 <url>https://www.ruby-lang.org/en/news/2013/11/22/ruby-2-0-0-p353-is-released/</url>
 <cvename>CVE-2013-4164</cvename>
 </references>
 <dates>
 <discovery>2013-11-22</discovery>
 <entry>2013-11-23</entry>
 </dates>
 </vuln>

<vuln vid="479efd57-516e-11e3-9b62-000c292e4fd8">
 <topic>samba -- Private key in key.pem world readable</topic>
 <affects>
 <package>
	<name>samba4</name>
	<range><gt>4.0.*</gt><lt>4.0.11</lt></range>
 </package>
 <package>
	<name>samba41</name>
	<range><gt>4.1.*</gt><lt>4.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba project reports:
	<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4476">
	 Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is
	 provided over SSL, uses world-readable permissions for a private key,
	 which allows local users to obtain sensitive information by reading the
	 key file, as demonstrated by access to the local filesystem on an AD
	 domain controller.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4476</cvename>
 <url>http://www.samba.org/samba/security/CVE-2013-4476</url>
 </references>
 <dates>
 <discovery>2013-06-12</discovery>
 <entry>2013-11-19</entry>
 </dates>
 </vuln>

<vuln vid="a4f08579-516c-11e3-9b62-000c292e4fd8">
 <topic>samba -- ACLs are not checked on opening an alternate data stream on a file or directory</topic>
 <affects>
 <package>
	<name>samba34</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>samba35</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>samba36</name>
	<range><gt>3.6.*</gt><lt>3.6.20</lt></range>
 </package>
 <package>
	<name>samba4</name>
	<range><gt>4.0.*</gt><lt>4.0.11</lt></range>
 </package>
 <package>
	<name>samba41</name>
	<range><gt>4.1.*</gt><lt>4.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba project reports:
	<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4475">
	 Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x,
	 3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying
	 file or directory ACL when opening an alternate data stream.
	 According to the SMB1 and SMB2+ protocols the ACL on an underlying
	 file or directory should control what access is allowed to alternate
	 data streams that are associated with the file or directory.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4475</cvename>
 <url>http://www.samba.org/samba/security/CVE-2013-4475</url>
 </references>
 <dates>
 <discovery>2013-06-12</discovery>
 <entry>2013-11-19</entry>
 </dates>
 </vuln>

<vuln vid="94b6264a-5140-11e3-8b22-f0def16c5c1b">
 <topic>nginx -- Request line parsing vulnerability</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><ge>0.8.41</ge><lt>1.4.4,1</lt></range>
 </package>
 <package>
	<name>nginx-devel</name>
	<range><ge>0.8.41</ge><lt>1.5.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The nginx project reports:
	<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html">
	 Ivan Fratric of the Google Security Team discovered a bug in nginx, which might
	 allow an attacker to bypass security restrictions in certain configurations by
	 using a specially crafted request, or might have potential other impact
	 (CVE-2013-4547).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4547</cvename>
 <url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html</url>
 </references>
 <dates>
 <discovery>2013-11-19</discovery>
 <entry>2013-11-19</entry>
 </dates>
 </vuln>

<vuln vid="adcbdba2-4c27-11e3-9848-98fc11cdc4f5">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.327</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-26.html">
	 These updates address vulnerabilities that could cause a crash
	 and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-5329</cvename>
 <cvename>CVE-2013-5330</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb13-26.html</url>
 </references>
 <dates>
 <discovery>2013-11-12</discovery>
 <entry>2013-11-12</entry>
 </dates>
 </vuln>

<vuln vid="5709d244-4873-11e3-8a46-000d601460a4">
 <topic>OpenSSH -- Memory corruption in sshd</topic>
 <affects>
 <package>
	<name>openssh-portable</name>
	<range><ge>6.2.p2,1</ge><lt>6.4.p1,1</lt></range>
 </package>
 <package>
	<name>openssh-portable-base</name>
	<range><ge>6.2.p2,1</ge><lt>6.4.p1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSH development team reports:
	<blockquote cite="http://www.openssh.com/txt/gcmrekey.adv">
	 A memory corruption vulnerability exists in the post-
	 authentication sshd process when an AES-GCM cipher
	 (aes128-gcm@openssh.com or aes256-gcm@openssh.com) is
	 selected during kex exchange.
	 If exploited, this vulnerability might permit code execution
	 with the privileges of the authenticated user and may
	 therefore allow bypassing restricted shell/command
	 configurations.
	 Either upgrade to 6.4 or disable AES-GCM in the server
	 configuration. The following sshd_config option will disable
	 AES-GCM while leaving other ciphers active:
	 Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openssh.com/txt/gcmrekey.adv</url>
 </references>
 <dates>
 <discovery>2013-11-07</discovery>
 <entry>2013-11-08</entry>
 <modified>2013-11-13</modified>
 </dates>
 </vuln>

<vuln vid="f969bad7-46fc-11e3-b6ee-00269ee29e57">
 <topic>Quassel IRC -- SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>quassel</name>
	<range><lt>0.9.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Quassel IRC developers report:
	<blockquote cite="http://www.quassel-irc.org/node/120">
	 SQL injection vulnerability in Quassel IRC before 0.9.1,
	 when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used,
	 allows remote attackers to execute arbitrary SQL commands via
	 a \ (backslash) in a message.
	</blockquote>
 </body>
 </description>
 <references>
	 <cvename>CVE-2013-4422</cvename>
 </references>
 <dates>
 <discovery>2013-10-07</discovery>
 <entry>2013-11-06</entry>
 </dates>
 </vuln>

<vuln vid="81f866ad-41a4-11e3-a4af-0025905a4771">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>24.1.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>25.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.22</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>24.1.0</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.22</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>24.1.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2013-93 Miscellaneous memory safety hazards (rv:25.0 /
	 rv:24.1 / rv:17.0.10)
	 MFSA 2013-94 Spoofing addressbar though SELECT element
	 MFSA 2013-95 Access violation with XSLT and uninitialized data
	 MFSA 2013-96 Improperly initialized memory and overflows in some
	 JavaScript functions
	 MFSA 2013-97 Writing to cycle collected object during image
	 decoding
	 MFSA 2013-98 Use-after-free when updating offline cache
	 MFSA 2013-99 Security bypass of PDF.js checks using iframes
	 MFSA 2013-100 Miscellaneous use-after-free issues found through
	 ASAN fuzzing
	 MFSA 2013-101 Memory corruption in workers
	 MFSA 2013-102 Use-after-free in HTML document templates
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2013-1739</cvename>
	<cvename>CVE-2013-5590</cvename>
	<cvename>CVE-2013-5591</cvename>
	<cvename>CVE-2013-5592</cvename>
	<cvename>CVE-2013-5593</cvename>
	<cvename>CVE-2013-5595</cvename>
	<cvename>CVE-2013-5596</cvename>
	<cvename>CVE-2013-5597</cvename>
	<cvename>CVE-2013-5598</cvename>
	<cvename>CVE-2013-5599</cvename>
	<cvename>CVE-2013-5600</cvename>
	<cvename>CVE-2013-5601</cvename>
	<cvename>CVE-2013-5602</cvename>
	<cvename>CVE-2013-5603</cvename>
	<cvename>CVE-2013-5604</cvename>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-93.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-94.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-95.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-96.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-97.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-98.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-99.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-100.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-101.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-102.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
 </references>
 <dates>
 <discovery>2013-10-29</discovery>
 <entry>2013-10-30</entry>
 <modified>2013-10-31</modified>
 </dates>
 </vuln>

<vuln vid="4e23644c-cb93-4f83-9e20-5bc07ad9b39f">
 <topic>mod_pagespeed -- critical cross-site scripting (XSS) vulnerability</topic>
 <affects>
 <package>
	<name>mod_pagespeed</name>
	<range><lt>1.2.24.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mod_pagespeed developers report:
	<blockquote cite="https://groups.google.com/forum/#!msg/mod-pagespeed-announce/oo015UHRxMc/JcAuf1hE8L8J">
	 Various versions of mod_pagespeed are subject to critical
	 cross-site scripting (XSS) vulnerability, CVE-2013-6111. This
	 permits a hostile third party to execute JavaScript in users'
	 browsers in context of the domain running mod_pagespeed, which
	 could permit theft of users' cookies or data on the site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-6111</cvename>
 </references>
 <dates>
 <discovery>2013-10-04</discovery>
 <entry>2013-10-28</entry>
 </dates>
 </vuln>

<vuln vid="9065b930-3d8b-11e3-bd1a-e840f2096bd0">
 <topic>gnutls -- denial of service</topic>
 <affects>
 <package>
	<name>gnutls3</name>
	<range><lt>3.1.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Salvatore Bonaccorso reports:
	<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2013-3">
	 This vulnerability affects the DANE library of gnutls 3.1.x and
	 gnutls 3.2.x. A server that returns more 4 DANE entries could
	 corrupt the memory of a requesting client.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4466</cvename>
 <url>http://www.gnutls.org/security.html#GNUTLS-SA-2013-3</url>
 </references>
 <dates>
 <discovery>2013-10-25</discovery>
 <entry>2013-10-25</entry>
 <modified>2013-11-01</modified>
 </dates>
 </vuln>

<vuln vid="9a57c607-3cab-11e3-b4d9-bcaec565249c">
 <topic>xorg-server -- use-after-free</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<range><ge>1.7.0</ge><lt>1.7.7_11</lt></range>
	<range><ge>1.12.0</ge><lt>1.12.4_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Alan Coopersmith reports:
	<blockquote cite="http://lists.x.org/archives/xorg-announce/2013-October/002332.html">
	 Pedro Ribeiro (pedrib at gmail.com) reported an issue to the X.Org
	 security team in which an authenticated X client can cause an X
	 server to use memory after it was freed, potentially leading to
	 crash and/or memory corruption.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4396</cvename>
 <url>http://lists.x.org/archives/xorg-announce/2013-October/002332.html</url>
 </references>
 <dates>
 <discovery>2013-10-08</discovery>
 <entry>2013-10-24</entry>
 </dates>
 </vuln>

<vuln vid="c0f122e2-3897-11e3-a084-3c970e169bc2">
 <topic>pycrypto -- PRNG reseed race condition</topic>
 <affects>
 <package>
	<name>py26-pycrypto</name>
	<range><lt>2.6.1</lt></range>
 </package>
 <package>
	<name>py27-pycrypto</name>
	<range><lt>2.6.1</lt></range>
 </package>
 <package>
	<name>py31-pycrypto</name>
	<range><lt>2.6.1</lt></range>
 </package>
 <package>
	<name>py32-pycrypto</name>
	<range><lt>2.6.1</lt></range>
 </package>
 <package>
	<name>py33-pycrypto</name>
	<range><lt>2.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dwayne Litzenberger reports:
	<blockquote cite="http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html">
	 In PyCrypto before v2.6.1, the Crypto.Random pseudo-random
	 number generator (PRNG) exhibits a race condition that may cause
	 it to generate the same 'random' output in multiple processes that
	 are forked from each other. Depending on the application, this
	 could reveal sensitive information or cryptographic keys to remote
	 attackers.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1445</cvename>
 <url>http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html</url>
 </references>
 <dates>
 <discovery>2013-10-17</discovery>
 <entry>2013-10-19</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="043d3a78-f245-4938-9bc7-3d0d35dd94bf">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>zh-wordpress-zh_CN</name>
	<range><lt>3.6.1</lt></range>
 </package>
 <package>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>3.6.1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<range><lt>3.6.1</lt></range>
 </package>
 <package>
	<name>ja-wordpress</name>
	<range><lt>3.6.1</lt></range>
 </package>
 <package>
	<name>ru-wordpress</name>
	<range><lt>3.6.1</lt></range>
 </package>
 <package>
	<name>wordpress</name>
	<range><lt>3.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The wordpress development team reports:
	<blockquote cite="http://wordpress.org/news/2013/09/wordpress-3-6-1/">
	 <ul>
	 <li>Block unsafe PHP unserialization that could occur in limited
	 situations and setups, which can lead to remote code
	 execution.</li>
	 <li>Prevent a user with an Author role, using a specially crafted
	 request, from being able to create a post "written by" another
	 user.</li>
	 <li>Fix insufficient input validation that could result in
	 redirecting or leading a user to another website.</li>
	 </ul>
	Additionally, we've adjusted security restrictions around file
	 uploads to mitigate the potential for cross-site scripting.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4338</cvename>
 <cvename>CVE-2013-4339</cvename>
 <cvename>CVE-2013-4340</cvename>
 <cvename>CVE-2013-5738</cvename>
 <cvename>CVE-2013-5739</cvename>
 <url>http://wordpress.org/news/2013/09/wordpress-3-6-1/</url>
 </references>
 <dates>
 <discovery>2013-09-11</discovery>
 <entry>2013-10-19</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="206f9826-a06d-4927-9a85-771c37010b32">
 <topic>node.js -- DoS Vulnerability</topic>
 <affects>
 <package>
	<name>node</name>
	<range><lt>0.10.21</lt></range>
 </package>
 <package>
	<name>node-devel</name>
	<range><lt>0.11.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	node.js developers report
	<blockquote cite="http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/">
	 This release contains a security fix for the http server implementation, please upgrade as soon as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/</url>
 </references>
 <dates>
 <discovery>2013-10-19</discovery>
 <entry>2013-10-19</entry>
 </dates>
 </vuln>

<vuln vid="e135f0c9-375f-11e3-80b7-20cf30e32f6d">
 <topic>bugzilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><ge>4.0.0</ge><lt>4.0.11</lt></range>
 </package>
 <package>
	<name>bugzilla40</name>
	<range><ge>4.0.0</ge><lt>4.0.11</lt></range>
 </package>
 <package>
	<name>bugzilla42</name>
	<range><ge>4.2.0</ge><lt>4.2.7</lt></range>
 </package>
 <package>
	<name>bugzilla44</name>
	<range><ge>4.4</ge><lt>4.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/4.0.10/">
	 <h1>Cross-Site Request Forgery</h1>
	 When a user submits changes to a bug right after another
	 user did, a midair collision page is displayed to inform
	 the user about changes recently made. This page contains
	 a token which can be used to validate the changes if the
	 user decides to submit his changes anyway. A regression
	 in Bugzilla 4.4 caused this token to be recreated if a
	 crafted URL was given, even when no midair collision page
	 was going to be displayed, allowing an attacker to bypass
	 the token check and abuse a user to commit changes on his
	 behalf.
	 <h1>Cross-Site Request Forgery</h1>
	 When an attachment is edited, a token is generated to
	 validate changes made by the user. Using a crafted URL,
	 an attacker could force the token to be recreated,
	 allowing him to bypass the token check and abuse a user
	 to commit changes on his behalf.
	 <h1>Cross-Site Scripting</h1>
	 Some parameters passed to editflagtypes.cgi were not
	 correctly filtered in the HTML page, which could lead
	 to XSS.
	 <h1>Cross-Site Scripting</h1>
	 Due to an incomplete fix for CVE-2012-4189, some
	 incorrectly filtered field values in tabular reports
	 could lead to XSS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1733</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=911593</url>
 <cvename>CVE-2013-1734</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=913904</url>
 <cvename>CVE-2013-1742</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=924802</url>
 <cvename>CVE-2013-1743</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=924932</url>
 </references>
 <dates>
 <discovery>2013-10-16</discovery>
 <entry>2013-10-17</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="8c9b48d1-3715-11e3-a624-00262d8b701d">
 <topic>dropbear -- exposure of sensitive information, DoS</topic>
 <affects>
 <package>
	<name>dropbear</name>
	<range><ge>2012.55</ge><lt>2013.59</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Dropbear project reports:
	<blockquote cite="http://secunia.com/advisories/55173/">
	 A weakness and a vulnerability have been reported in Dropbear
	 SSH Server, which can be exploited by malicious people to disclose
	 certain sensitive information and cause a DoS.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>62958</bid>
 <bid>62993</bid>
 <cvename>CVE-2013-4421</cvename>
 <cvename>CVE-2013-4434</cvename>
 <url>http://secunia.com/advisories/55173</url>
 </references>
 <dates>
 <discovery>2013-05-08</discovery>
 
 <entry>2013-10-17</entry>
 </dates>
 </vuln>

<vuln vid="9003b500-31e3-11e3-b0d0-20cf30e32f6d">
 <topic>mod_fcgid -- possible heap buffer overwrite</topic>
 <affects>
 <package>
	<name>ap22-mod_fcgid</name>
	<range><lt>2.3.9</lt></range>
 </package>
 <package>
	<name>ap24-mod_fcgid</name>
	<range><lt>2.3.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache Project reports:
	<blockquote cite="https://mail-archives.apache.org/mod_mbox/httpd-cvs/201309.mbox/%3C20130929174048.13B962388831@eris.apache.org%3E">
	 Fix possible heap buffer overwrite.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4365</cvename>
 </references>
 <dates>
 <discovery>2013-09-29</discovery>
 <entry>2013-10-10</entry>
 </dates>
 </vuln>

<vuln vid="749b5587-2da1-11e3-b1a9-b499baab0cbe">
 <topic>gnupg -- possible infinite recursion in the compressed packet parser</topic>
 <affects>
 <package>
	<name>gnupg</name>
	<range><lt>1.4.15</lt></range>
	<range><ge>2.0.0</ge><lt>2.0.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Werner Koch reports:
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000333.html">
	 Special crafted input data may be used to cause a denial of service
against GPG (GnuPG's OpenPGP part) and some other OpenPGP
implementations. All systems using GPG to process incoming data are
affected..
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4402</cvename>
 </references>
 <dates>
 <discovery>2013-10-05</discovery>
 <entry>2013-10-05</entry>
 </dates>
 </vuln>

<vuln vid="5c34664f-2c2b-11e3-87c2-00215af774f0">
 <topic>xinetd -- ignores user and group directives for TCPMUX services</topic>
 <affects>
 <package>
	<name>xinetd</name>
	<range><lt>2.3.15_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	xinetd would execute configured TCPMUX services without dropping
	 privilege to match the service configuration allowing the service to
	 run with same privilege as the xinetd process (root).
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4342</cvename>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=324678</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=1006100</url>
 </references>
 <dates>
 <discovery>2005-08-23</discovery>
 <entry>2013-10-03</entry>
 </dates>
 </vuln>

<vuln vid="ccefac3e-2aed-11e3-af10-000c29789cb5">
 <topic>polarssl -- Timing attack against protected RSA-CRT implementation</topic>
 <affects>
 <package>
	<name>polarssl</name>
	<range><lt>1.2.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PolarSSL Project reports:
	<blockquote cite="https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05">
	 The researchers Cyril Arnaud and Pierre-Alain Fouque
	 investigated the PolarSSL RSA implementation and discovered
	 a bias in the implementation of the Montgomery multiplication
	 that we used. For which they then show that it can be used to
	 mount an attack on the RSA key. Although their test attack is
	 done on a local system, there seems to be enough indication
	 that this can properly be performed from a remote system as
	 well.
	 All versions prior to PolarSSL 1.2.9 and 1.3.0 are affected
	 if a third party can send arbitrary handshake messages to your
	 server.
	 If correctly executed, this attack reveals the entire private
	 RSA key after a large number of attack messages (&gt; 600.000 on
	 a local machine) are sent to show the timing differences.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-5915</cvename>
 <url>https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05</url>
 <url>https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released</url>
 </references>
 <dates>
 <discovery>2013-10-01</discovery>
 <entry>2013-10-02</entry>
 </dates>
 </vuln>

<vuln vid="e1f99d59-81aa-4662-bf62-c1076f5016c8">
 <topic>py-graphite-web -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py26-graphite-web</name>
	<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
 </package>
 <package>
	<name>py27-graphite-web</name>
	<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
 </package>
 <package>
	<name>py31-graphite-web</name>
	<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
 </package>
 <package>
	<name>py32-graphite-web</name>
	<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
 </package>
 <package>
	<name>py33-graphite-web</name>
	<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Graphite developers report:
	<blockquote cite="http://graphite.readthedocs.org/en/0.9.11/releases/0_9_11.html">
	 This release contains several security fixes for cross-site
	 scripting (XSS) as well as a fix for a remote-execution exploit in
	 graphite-web (CVE-2013-5903).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-5093</cvename>
 <url>https://github.com/rapid7/metasploit-framework/pull/2260</url>
 </references>
 <dates>
 <discovery>2013-08-21</discovery>
 <entry>2013-09-30</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="05dc6efa-2370-11e3-95b7-00e0814cab4e">
 <topic>django -- denial-of-service via large passwords</topic>
 <affects>
 <package>
	<name>py26-django</name>
	<range><ge>1.5</ge><lt>1.5.4</lt></range>
	<range><ge>1.4</ge><lt>1.4.8</lt></range>
 </package>
 <package>
	<name>py27-django</name>
	<range><ge>1.5</ge><lt>1.5.4</lt></range>
	<range><ge>1.4</ge><lt>1.4.8</lt></range>
 </package>
 <package>
	<name>py26-django-devel</name>
	<range><lt>20130922,1</lt></range>
 </package>
 <package>
	<name>py27-django-devel</name>
	<range><lt>20130922,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Django project reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2013/sep/15/security/">
	 These releases address a denial-of-service attack against Django's
	 authentication framework. All users of Django are encouraged to
	 upgrade immediately.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1443</cvename>
 <url>https://www.djangoproject.com/weblog/2013/sep/15/security/</url>
 </references>
 <dates>
 <discovery>2013-09-15</discovery>
 <entry>2013-09-22</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="b72bad1c-20ed-11e3-be06-000c29ee3065">
 <topic>FreeBSD -- Cross-mount links between nullfs(5) mounts</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.1</ge><lt>9.1_7</lt></range>
	<range><ge>8.4</ge><lt>8.4_4</lt></range>
	<range><ge>8.3</ge><lt>8.3_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem Description:
	The nullfs(5) implementation of the VOP_LINK(9) VFS
	 operation does not check whether the source and target of
	 the link are both in the same nullfs instance. It is
	 therefore possible to create a hardlink from a location in
	 one nullfs instance to a file in another, as long as the
	 underlying (source) filesystem is the same.
	Impact:
	If multiple nullfs views into the same filesystem are
	 mounted in different locations, a user with read access to
	 one of these views and write access to another will be able
	 to create a hard link from the latter to a file in the
	 former, even though they are, from the user's perspective,
	 different filesystems. The user may thereby gain write
	 access to files which are nominally on a read-only
	 filesystem.
 </body>
 </description>
 <references>
 <cvename>CVE-2013-5710</cvename>
 <freebsdsa>SA-13:13.nullfs</freebsdsa>
 </references>
 <dates>
 <discovery>2013-09-10</discovery>
 <entry>2013-09-19</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="4d87d357-202c-11e3-be06-000c29ee3065">
 <topic>FreeBSD -- Insufficient credential checks in network ioctl(2)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.1</ge><lt>9.1_7</lt></range>
	<range><ge>8.4</ge><lt>8.4_4</lt></range>
	<range><ge>8.3</ge><lt>8.3_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem Description:
	As is commonly the case, the IPv6 and ATM network layer
	 ioctl request handlers are written in such a way that an
	 unrecognized request is passed on unmodified to the link
	 layer, which will either handle it or return an error
	 code.
	Network interface drivers, however, assume that the
	 SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and
	 SIOCSIFNETMASK requests have been handled at the network
	 layer, and therefore do not perform input validation or
	 verify the caller's credentials. Typical link-layer actions
	 for these requests may include marking the interface as "up"
	 and resetting the underlying hardware.
	Impact:
	An unprivileged user with the ability to run arbitrary code
	 can cause any network interface in the system to perform the
	 link layer actions associated with a SIOCSIFADDR,
	 SIOCSIFBRDADDR, SIOCSIFDSTADDR or SIOCSIFNETMASK ioctl
	 request; or trigger a kernel panic by passing a specially
	 crafted address structure which causes a network interface
	 driver to dereference an invalid pointer.
	Although this has not been confirmed, the possibility that
	 an attacker may be able to execute arbitrary code in kernel
	 context cannot be ruled out.
 </body>
 </description>
 <references>
 <cvename>CVE-2013-5691</cvename>
 <freebsdsa>SA-13:12.ifioctl</freebsdsa>
 </references>
 <dates>
 <discovery>2013-09-10</discovery>
 <entry>2013-09-19</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="7dfed67b-20aa-11e3-b8d8-0025905a4771">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>18.0,1</gt><lt>24.0,1</lt></range>
	<range><lt>17.0.9,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>17.0.9,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.21</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.9</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.21</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>24.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 /
	 rv:17.0.9)
	 MFSA 2013-77 Improper state in HTML5 Tree Builder with templates
	 MFSA 2013-78 Integer overflow in ANGLE library
	 MFSA 2013-79 Use-after-free in Animation Manager during stylesheet
	 cloning
	 MFSA 2013-80 NativeKey continues handling key messages after
	 widget is destroyed
	 MFSA 2013-81 Use-after-free with select element
	 MFSA 2013-82 Calling scope for new Javascript objects can lead to
	 memory corruption
	 MFSA 2013-83 Mozilla Updater does not lock MAR file after
	 signature verification
	 MFSA 2013-84 Same-origin bypass through symbolic links
	 MFSA 2013-85 Uninitialized data in IonMonkey
	 MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA
	 graphic drivers
	 MFSA 2013-87 Shared object library loading from writable location
	 MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes
	 MFSA 2013-89 Buffer overflow with multi-column, lists, and floats
	 MFSA 2013-90 Memory corruption involving scrolling
	 MFSA 2013-91 User-defined properties on DOM proxies get the wrong
	 "this" object
	 MFSA 2013-92 GC hazard with default compartments and frame chain
	 restoration
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2013-1718</cvename>
	<cvename>CVE-2013-1719</cvename>
	<cvename>CVE-2013-1720</cvename>
	<cvename>CVE-2013-1721</cvename>
	<cvename>CVE-2013-1722</cvename>
	<cvename>CVE-2013-1723</cvename>
	<cvename>CVE-2013-1724</cvename>
	<cvename>CVE-2013-1725</cvename>
	<cvename>CVE-2013-1726</cvename>
	<cvename>CVE-2013-1727</cvename>
	<cvename>CVE-2013-1728</cvename>
	<cvename>CVE-2013-1729</cvename>
	<cvename>CVE-2013-1730</cvename>
	<cvename>CVE-2013-1731</cvename>
	<cvename>CVE-2013-1732</cvename>
	<cvename>CVE-2013-1735</cvename>
	<cvename>CVE-2013-1736</cvename>
	<cvename>CVE-2013-1737</cvename>
	<cvename>CVE-2013-1738</cvename>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-76.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-77.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-78.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-79.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-80.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-81.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-82.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-83.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-84.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-85.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-86.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-87.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-88.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-89.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-90.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-91.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-92.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
 </references>
 <dates>
 <discovery>2013-08-17</discovery>
 <entry>2013-08-18</entry>
 <modified>2013-09-19</modified>
 </dates>
 </vuln>

<vuln vid="5bd6811f-1c75-11e3-ba72-98fc11cdc4f5">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.310</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-21.html">
	 These updates address vulnerabilities that could cause a crash
	 and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-3361</cvename>
 <cvename>CVE-2013-3362</cvename>
 <cvename>CVE-2013-3363</cvename>
 <cvename>CVE-2013-5324</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb13-21.html</url>
 </references>
 <dates>
 <discovery>2013-09-10</discovery>
 <entry>2013-09-13</entry>
 </dates>
 </vuln>

<vuln vid="a851b305-1bc3-11e3-95b7-00e0814cab4e">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py26-django</name>
	<range><ge>1.5</ge><lt>1.5.3</lt></range>
	<range><ge>1.4</ge><lt>1.4.7</lt></range>
 </package>
 <package>
	<name>py27-django</name>
	<range><ge>1.5</ge><lt>1.5.3</lt></range>
	<range><ge>1.4</ge><lt>1.4.7</lt></range>
 </package>
 <package>
	<name>py26-django-devel</name>
	<range><lt>20130912,1</lt></range>
 </package>
 <package>
	<name>py27-django-devel</name>
	<range><lt>20130912,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Django project reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/">
	 These releases address a directory-traversal vulnerability in one
	 of Django's built-in template tags. While this issue requires some
	 fairly specific factors to be exploitable, we encourage all users
	 of Django to upgrade promptly.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4315</cvename>
 <url>https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/</url>
 </references>
 <dates>
 <discovery>2013-09-10</discovery>
 <entry>2013-09-12</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="f8a913cc-1322-11e3-8ffa-20cf30e32f6d">
 <topic>svnserve is vulnerable to a local privilege escalation vulnerability via symlink attack.</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><ge>1.4.0</ge><lt>1.6.23_2</lt></range>
	<range><ge>1.7.0</ge><lt>1.7.13</lt></range>
	<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion Project reports:
	<blockquote cite="http://subversion.apache.org/security/CVE-2013-4277-advisory.txt">
	 svnserve takes a --pid-file option which creates a file containing the
	 process id it is running as. It does not take steps to ensure that the file
	 it has been directed at is not a symlink. If the pid file is in a directory
	 writeable by unprivileged users, the destination could be replaced by a
	 symlink allowing for privilege escalation. svnserve does not create a pid
	 file by default.
	 All versions are only vulnerable when the --pid-file=ARG option is used.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4277</cvename>
 <url>http://subversion.apache.org/security/CVE-2013-4277-advisory.txt</url>
 </references>
 <dates>
 <discovery>2013-08-30</discovery>
 <entry>2013-09-02</entry>
 </dates>
 </vuln>

<vuln vid="b3b8d491-0fbb-11e3-8c50-1c6f65c11ee6">
 <topic>cacti -- allow remote attackers to execute arbitrary SQL commands</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>0.8.8b</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cacti release reports:
	<blockquote cite="http://www.cacti.net/release_notes_0_8_8b.php">
	 Multiple security vulnerabilities have been fixed:
	 <ul>
	 <li>SQL injection vulnerabilities</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1434</cvename>
 <cvename>CVE-2013-1435</cvename>
 <url>http://www.cacti.net/release_notes_0_8_8b.php</url>
 </references>
 <dates>
 <discovery>2013-08-06</discovery>
 <entry>2013-08-29</entry>
 </dates>
 </vuln>

<vuln vid="fd2bf3b5-1001-11e3-ba94-0025905a4771">
 <topic>asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk11</name>
	<range><gt>11.*</gt><lt>11.5.1</lt></range>
 </package>
 <package>
	<name>asterisk10</name>
	<range><gt>10.*</gt><lt>10.12.3</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.21.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/security">
	 Remote Crash From Late Arriving SIP ACK With SDP
	 Remote Crash when Invalid SDP is sent in SIP Request
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-5641</cvename>
 <cvename>CVE-2013-5642</cvename>
 <url>http://downloads.asterisk.org/pub/security/AST-2013-004.html</url>
 <url>http://downloads.asterisk.org/pub/security/AST-2013-005.html</url>
 <url>https://www.asterisk.org/security</url>
 </references>
 <dates>
 <discovery>2013-08-27</discovery>
 <entry>2013-08-28</entry>
 <modified>2013-08-29</modified>
 </dates>
 </vuln>

<vuln vid="4d087b35-0990-11e3-a9f4-bcaec565249c">
 <topic>gstreamer-ffmpeg -- Multiple vulnerabilities in bundled libav</topic>
 <affects>
 <package>
	<name>gstreamer-ffmpeg</name>
	<range><lt>0.10.13_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://libav.org/releases/libav-0.7.7.changelog">
	 Bundled version of libav in gstreamer-ffmpeg contains a number of
	 vulnerabilities.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3892</cvename>
 <cvename>CVE-2011-3893</cvename>
 <cvename>CVE-2011-3895</cvename>
 <cvename>CVE-2011-3929</cvename>
 <cvename>CVE-2011-3936</cvename>
 <cvename>CVE-2011-3937</cvename>
 <cvename>CVE-2011-3940</cvename>
 <cvename>CVE-2011-3945</cvename>
 <cvename>CVE-2011-3947</cvename>
 <cvename>CVE-2011-3951</cvename>
 <cvename>CVE-2011-3952</cvename>
 <cvename>CVE-2011-4031</cvename>
 <cvename>CVE-2011-4351</cvename>
 <cvename>CVE-2011-4352</cvename>
 <cvename>CVE-2011-4353</cvename>
 <cvename>CVE-2011-4364</cvename>
 <cvename>CVE-2011-4579</cvename>
 <cvename>CVE-2012-0848</cvename>
 <cvename>CVE-2012-0850</cvename>
 <cvename>CVE-2012-0851</cvename>
 <cvename>CVE-2012-0852</cvename>
 <cvename>CVE-2012-0853</cvename>
 <cvename>CVE-2012-0858</cvename>
 <cvename>CVE-2012-0947</cvename>
 <cvename>CVE-2012-2772</cvename>
 <cvename>CVE-2012-2775</cvename>
 <cvename>CVE-2012-2777</cvename>
 <cvename>CVE-2012-2779</cvename>
 <cvename>CVE-2012-2783</cvename>
 <cvename>CVE-2012-2784</cvename>
 <cvename>CVE-2012-2786</cvename>
 <cvename>CVE-2012-2787</cvename>
 <cvename>CVE-2012-2788</cvename>
 <cvename>CVE-2012-2790</cvename>
 <cvename>CVE-2012-2791</cvename>
 <cvename>CVE-2012-2793</cvename>
 <cvename>CVE-2012-2794</cvename>
 <cvename>CVE-2012-2798</cvename>
 <cvename>CVE-2012-2800</cvename>
 <cvename>CVE-2012-2801</cvename>
 <cvename>CVE-2012-2803</cvename>
 <cvename>CVE-2012-5144</cvename>
 <url>http://libav.org/releases/libav-0.7.7.changelog</url>
 </references>
 <dates>
 <discovery>2013-08-20</discovery>
 <entry>2013-08-20</entry>
 </dates>
 </vuln>

<vuln vid="689c2bf7-0701-11e3-9a25-002590860428">
 <topic>GnuPG and Libgcrypt -- side-channel attack vulnerability</topic>
 <affects>
 <package>
	<name>libgcrypt</name>
	<range><lt>1.5.3</lt></range>
 </package>
 <package>
	<name>linux-f10-libgcrypt</name>
	<range><lt>1.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Werner Koch of the GNU project reports:
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000329.html">
	 Noteworthy changes in version 1.5.3:
	 Mitigate the Yarom/Falkner flush+reload side-channel attack on RSA secret keys...
	 Note that Libgcrypt is used by GnuPG 2.x and thus this release fixes the above
	 problem. The fix for GnuPG less than 2.0 can be found in the just released GnuPG
	 1.4.14.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4242</cvename>
 <url>http://eprint.iacr.org/2013/448</url>
 <url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000329.html</url>
 <url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html</url>
 </references>
 <dates>
 <discovery>2013-07-18</discovery>
 <entry>2013-08-17</entry>
 </dates>
 </vuln>

<vuln vid="2b2f6092-0694-11e3-9e8e-000c29f6ae42">
 <topic>puppet -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>puppet</name>
	<range><ge>2.7</ge><lt>2.7.23</lt></range>
	<range><ge>3.0</ge><lt>3.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Puppet Labs reports:
	<blockquote cite="http://puppetlabs.com/security/cve/cve-2013-4761/">
	 By using the `resource_type` service, an attacker could
	 cause puppet to load arbitrary Ruby files from the puppet
	 master node's file system. While this behavior is not
	 enabled by default, `auth.conf` settings could be modified
	 to allow it. The exploit requires local file system access
	 to the Puppet Master.
	 Puppet Module Tool (PMT) did not correctly control
	 permissions of modules it installed, instead transferring
	 permissions that existed when the module was built.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4761</cvename>
 <cvename>CVE-2013-4956</cvename>
 <url>http://puppetlabs.com/security/cve/cve-2013-4761/</url>
 <url>http://puppetlabs.com/security/cve/cve-2013-4956/</url>
 </references>
 <dates>
 <discovery>2013-07-05</discovery>
 <entry>2013-08-16</entry>
 </dates>
 </vuln>

<vuln vid="9a0a892e-05d8-11e3-ba09-000c29784fd1">
 <topic>lcms2 -- Null Pointer Dereference Denial of Service Vulnerability</topic>
 <affects>
 <package>
	<name>lcms2</name>
	<range><lt>2.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mageia security team reports:
	<blockquote cite="http://advisories.mageia.org/MGASA-2013-0240.html">
	 It was discovered that Little CMS did not properly verify certain
	 memory allocations. If a user or automated system using Little CMS
	 were tricked into opening a specially crafted file, an attacker
	 could cause Little CMS to crash (CVE-2013-4160).
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4160</cvename>
 <url>http://advisories.mageia.org/MGASA-2013-0240.html</url>
 <url>https://bugs.mageia.org/show_bug.cgi?id=10816</url>
 </references>
 <dates>
 <discovery>2013-07-22</discovery>
 <entry>2013-08-15</entry>
 <modified>2013-08-19</modified>
 </dates>
 </vuln>

<vuln vid="72bf9e21-03df-11e3-bd8d-080027ef73ec">
 <topic>polarssl -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>polarssl</name>
	<range><lt>1.2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Paul Bakker reports:
	<blockquote cite="https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03">
	 A bug in the logic of the parsing of PEM encoded certificates in
	 x509parse_crt() can result in an infinite loop, thus hogging processing
	 power.
	 While parsing a Certificate message during the SSL/TLS handshake,
	 PolarSSL extracts the presented certificates and sends them on to
	 be parsed. As the RFC specifies that the certificates in the
	 Certificate message are always X.509 certificates in DER format,
	 bugs in the decoding of PEM certificates should normally not be
	 triggerable via the SSL/TLS handshake.
	 Versions of PolarSSL prior to 1.1.7 in the 1.1 branch and prior
	 to 1.2.8 in the 1.2 branch call the generic x509parse_crt()
	 function for parsing during the handshake. x509parse_crt() is a
	 generic functions that wraps parsing of both PEM-encoded and
	 DER-formatted certificates. As a result it is possible to craft
	 a Certificate message that includes a PEM encoded certificate in
	 the Certificate message that triggers the infinite loop.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4623</cvename>
 <url>https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03</url>
 </references>
 <dates>
 <discovery>2013-06-21</discovery>
 <entry>2013-08-13</entry>
 <modified>2013-08-15</modified>
 </dates>
 </vuln>

<vuln vid="e21c7c7a-0116-11e3-9e83-3c970e169bc2">
 <topic>samba -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>samba34</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>samba35</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>samba36</name>
	<range><gt>3.6.*</gt><lt>3.6.17</lt></range>
 </package>
 <package>
	<name>samba4</name>
	<range><gt>4.0.*</gt><lt>4.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba project reports:
	<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4124">
	 All current released versions of Samba are vulnerable to
	 a denial of service on an authenticated or guest connection.
	 A malformed packet can cause the smbd server to loop the CPU
	 performing memory allocations and preventing any further service.
	 A connection to a file share, or a local account is needed
	 to exploit this problem, either authenticated or unauthenticated
	 if guest connections are allowed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4124</cvename>
 <url>http://www.samba.org/samba/security/CVE-2013-4124</url>
 </references>
 <dates>
 <discovery>2013-08-05</discovery>
 <entry>2013-08-09</entry>
 <modified>2013-08-09</modified>
 </dates>
 </vuln>

<vuln vid="0998e79d-0055-11e3-905b-0025905a4771">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>18.0,1</gt><lt>23.0,1</lt></range>
	<range><lt>17.0.8,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>17.0.8,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.20</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.8</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.20</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 /
	 rv:17.0.8)
	 MFSA 2013-64 Use after free mutating DOM during SetBody
	 MFSA 2013-65 Buffer underflow when generating CRMF requests
	 MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and
	 Mozilla Updater
	 MFSA 2013-67 Crash during WAV audio file decoding
	 MFSA 2013-68 Document URI misrepresentation and masquerading
	 MFSA 2013-69 CRMF requests allow for code execution and XSS
	 attacks
	 MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes
	 MFSA 2013-71 Further Privilege escalation through Mozilla Updater
	 MFSA 2013-72 Wrong principal used for validating URI for some
	 Javascript components
	 MFSA 2013-73 Same-origin bypass with web workers and
	 XMLHttpRequest
	 MFSA 2013-74 Firefox full and stub installer DLL hijacking
	 MFSA 2013-75 Local Java applets may read contents of local file
	 system
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2013-1701</cvename>
	<cvename>CVE-2013-1702</cvename>
	<cvename>CVE-2013-1704</cvename>
	<cvename>CVE-2013-1705</cvename>
	<cvename>CVE-2013-1706</cvename>
	<cvename>CVE-2013-1707</cvename>
	<cvename>CVE-2013-1708</cvename>
	<cvename>CVE-2013-1709</cvename>
	<cvename>CVE-2013-1710</cvename>
	<cvename>CVE-2013-1711</cvename>
	<cvename>CVE-2013-1712</cvename>
	<cvename>CVE-2013-1713</cvename>
	<cvename>CVE-2013-1714</cvename>
	<cvename>CVE-2013-1715</cvename>
	<cvename>CVE-2013-1717</cvename>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-63.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-64.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-65.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-66.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-67.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-68.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-69.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-70.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-71.html</url>
	<url>https://www.mozilla.org/security/announce/2013/mfsa2013-72.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
 </references>
 <dates>
 <discovery>2013-08-06</discovery>
 <entry>2013-08-08</entry>
 </dates>
 </vuln>

<vuln vid="4b448a96-ff73-11e2-b28d-080027ef73ec">
 <topic>PuTTY -- Four security holes in versions before 0.63</topic>
 <affects>
 <package>
	<name>putty</name>
	<range><lt>0.63</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Tatham reports:
	<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html">
	 This [0.63] release fixes multiple security holes in previous versions of
	 PuTTY, which can allow an SSH-2 server to make PuTTY overrun or
	 underrun buffers and crash. [...]
	 
	 These vulnerabilities can be triggered before host key verification,
	 which means that you are not even safe if you trust the server you
	 think you're connecting to, since it could be spoofed over the
	 network and the host key check would not detect this before the attack
	 could take place.
	 
	 Additionally, when PuTTY authenticated with a user's private key, the
	 private key or information equivalent to it was accidentally kept in
	 PuTTY's memory for the rest of its run, where it could be retrieved by
	 other processes reading PuTTY's memory, or written out to swap files
	 or crash dumps. This release fixes that as well.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4206</cvename>
 <cvename>CVE-2013-4207</cvename>
 <cvename>CVE-2013-4208</cvename>
 <cvename>CVE-2013-4852</cvename>
 <mlist msgid="E1V6lUs-0007kP-40@atreus.tartarus.org">http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html</mlist>
 <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html</url>
 <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html</url>
 <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html</url>
 <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature-stringlen.html</url>
 </references>
 <dates>
 <discovery>2013-07-08</discovery>
 <entry>2013-08-07</entry>
 </dates>
 </vuln>

<vuln vid="e6839625-fdfa-11e2-9430-20cf30e32f6d">
 <topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
 <affects>
 <package>
	<name>typo3</name>
	<range><ge>4.5.0</ge><lt>4.5.29</lt></range>
	<range><ge>4.7.0</ge><lt>4.7.14</lt></range>
	<range><ge>6.1.0</ge><lt>6.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Typo Security Team reports:
	<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-002/">
	 It has been discovered that TYPO3 Core is vulnerable to
	 Cross-Site Scripting and Remote Code Execution.
	 TYPO3 bundles flash files for video and audio playback. Old
	 versions of FlowPlayer and flashmedia are susceptible to
	 Cross-Site Scripting. No authentication is required to exploit
	 this vulnerability.
	 The file upload component and the File Abstraction Layer are
	 failing to check for denied file extensions, which allows
	 authenticated editors (even with limited permissions) to
	 upload php files with arbitrary code, which can then be
	 executed in web server's context.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3642</cvename>
 <cvename>CVE-2013-1464</cvename>
 </references>
 <dates>
 <discovery>2013-07-30</discovery>
 <entry>2013-08-05</entry>
 </dates>
 </vuln>

<vuln vid="17326fd5-fcfb-11e2-9bb9-6805ca0b3d42">
 <topic>phpMyAdmin -- clickJacking protection can be bypassed</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>4.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php">
	 phpMyAdmin has a number of mechanisms to avoid a
	 clickjacking attack, however these mechanisms either work
	 only in modern browser versions, or can be bypassed.
	 "We have no solution for 3.5.x, due to the proposed
	 solution requiring JavaScript. We don't want to introduce a
	 dependency to JavaScript in the 3.5.x family."
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php</url>
 </references>
 <dates>
 <discovery>2013-08-04</discovery>
 <entry>2013-08-04</entry>
 </dates>
 </vuln>

<vuln vid="f4a0212f-f797-11e2-9bb9-6805ca0b3d42">
 <topic>phpMyAdmin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.0</ge><lt>4.0.4.2</lt></range>
 </package>
 <package>
	<name>phpMyAdmin35</name>
	<range><ge>3.5</ge><lt>3.5.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php">
	 XSS due to unescaped HTML Output when executing a SQL query.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php">
	 5 XSS vulnerabilities in setup, chart display, process
	 list, and logo link.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php">
	 If a crafted version.json would be presented, an XSS
	 could be introduced.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php">
	 Full path disclosure vulnerabilities.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php">
	 XSS vulnerability when a text to link transformation is
	 used.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php">
	 Self-XSS due to unescaped HTML output in schema
	 export.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php">
	 SQL injection vulnerabilities, producing a privilege
	 escalation (control user).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php</url>
 <url>http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/3.5.8.2/phpMyAdmin-3.5.8.2-notes.html/view</url>
 <url>http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/4.0.4.2/phpMyAdmin-4.0.4.2-notes.html/view</url>
 </references>
 <dates>
 <discovery>2013-07-28</discovery>
 <entry>2013-07-28</entry>
 <modified>2013-07-29</modified>
 </dates>
 </vuln>

<vuln vid="049332d2-f6e1-11e2-82f3-000c29ee3065">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>3.5.2,1</lt></range>
 </package>
 <package>
	<name>zh-wordpress-zh_CN</name>
	<range><lt>3.5.2</lt></range>
 </package>
 <package>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>3.5.2</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<range><lt>3.5.2</lt></range>
 </package>
 <package>
	<name>ja-wordpress</name>
	<range><lt>3.5.2</lt></range>
 </package>
 <package>
	<name>ru-wordpress</name>
	<range><lt>3.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The wordpress development team reports:
	<blockquote cite="https://wordpress.org/news/2013/06/wordpress-3-5-2/">
	 <ul>
	 <li>Blocking server-side request forgery attacks, which could
	 potentially enable an attacker to gain access to a site</li>
	 <li>Disallow contributors from improperly publishing posts</li>
	 <li>An update to the SWFUpload external library to fix cross-site
	 scripting vulnerabilities</li>
	 <li>Prevention of a denial of service attack, affecting sites
	 using password-protected posts</li>
	 <li>An update to an external TinyMCE library to fix a cross-site
	 scripting vulnerability</li>
	 <li>Multiple fixes for cross-site scripting</li>
	 <li>Avoid disclosing a full file path when a upload fails</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2199</cvename>
 <cvename>CVE-2013-2200</cvename>
 <cvename>CVE-2013-2201</cvename>
 <cvename>CVE-2013-2202</cvename>
 <cvename>CVE-2013-2203</cvename>
 <cvename>CVE-2013-2204</cvename>
 <cvename>CVE-2013-2205</cvename>
 <url>https://wordpress.org/news/2013/06/wordpress-3-5-2/</url>
 </references>
 <dates>
 <discovery>2013-06-21</discovery>
 <entry>2013-07-27</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="7943e521-f648-11e2-8607-3c970e169bc2">
 <topic>bind -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><gt>9.9.3</gt><lt>9.9.3.2</lt></range>
 </package>
 <package>
	<name>bind99-base</name>
	<range><gt>9.9.3</gt><lt>9.9.3.2</lt></range>
 </package>
 <package>
	<name>bind98</name>
	<range><gt>9.8.5</gt><lt>9.8.5.2</lt></range>
 </package>
 <package>
	<name>bind98-base</name>
	<range><gt>9.8.5</gt><lt>9.8.5.2</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.0</ge><lt>9.1_5</lt></range>
	<range><ge>8.4</ge><lt>8.4_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-01015/0">
	 A specially crafted query that includes malformed
	 rdata can cause named to terminate with an assertion
	 failure while rejecting the malformed query.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4854</cvename>
 <freebsdsa>SA-13:07.bind</freebsdsa>
 <url>https://kb.isc.org/article/AA-01015/0</url>
 </references>
 <dates>
 <discovery>2013-07-26</discovery>
 <entry>2013-07-26</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="80771b89-f57b-11e2-bf21-b499baab0cbe">
 <topic>gnupg -- side channel attack on RSA secret keys</topic>
 <affects>
 <package>
	<name>gnupg</name>
	<range><lt>1.4.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Yarom and Falkner paper reports:
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html">
	 Flush+Reload is a cache side-channel attack that monitors access to
	 data in shared pages. In this paper we demonstrate how to use the
	 attack to extract private encryption keys from GnuPG. The high
	 resolution and low noise of the Flush+Reload attack enables a spy
	 program to recover over 98% of the bits of the private key in a
	 single decryption or signing round. Unlike previous attacks, the
	 attack targets the last level L3 cache. Consequently, the spy
	 program and the victim do not need to share the execution core of
	 the CPU. The attack is not limited to a traditional OS and can be
	 used in a virtualised environment, where it can attack programs
	 executing in a different VM.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://eprint.iacr.org/2013/448</url>
 <url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html</url>
 </references>
 <dates>
 <discovery>2013-07-18</discovery>
 <entry>2013-07-25</entry>
 <modified>2013-07-26</modified>
 </dates>
 </vuln>

<vuln vid="c4d412c8-f4d1-11e2-b86c-000c295229d5">
 <topic>openafs -- single-DES cell-wide key brute force vulnerability</topic>
 <affects>
 <package>
	<name>openafs</name>
	<range><lt>1.6.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenAFS Project reports:
	<blockquote cite="http://openafs.org/pages/security/OPENAFS-SA-2013-003.txt">
	 The small size of the DES key space permits an attacker to brute
	 force a cell's service key and then forge traffic from any user
	 within the cell. The key space search can be performed in under 1
	 day at a cost of around $100 using publicly available services.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4134</cvename>
 <url>http://openafs.org/pages/security/OPENAFS-SA-2013-003.txt</url>
 <url>http://openafs.org/pages/security/how-to-rekey.txt</url>
 <url>http://openafs.org/pages/security/install-rxkad-k5-1.6.txt</url>
 </references>
 <dates>
 <discovery>2013-07-24</discovery>
 <entry>2013-07-25</entry>
 </dates>
 </vuln>

<vuln vid="2ae24334-f2e6-11e2-8346-001e8c75030d">
 <topic>subversion -- remotely triggerable "Assertion failed" DoS vulnerability or read overflow.</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><ge>1.8.0</ge><lt>1.8.1</lt></range>
	<range><ge>1.7.0</ge><lt>1.7.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion Project reports:
	<blockquote cite="http://subversion.apache.org/security/CVE-2013-4131-advisory.txt">
	 Subversion's mod_dav_svn Apache HTTPD server module will trigger an assertion
	 on some requests made against a revision root. This can lead to a DoS.
	 If assertions are disabled it will trigger a read overflow which may cause a
	 SEGFAULT (or equivalent) or undefined behavior.
	 Commit access is required to exploit this.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4131</cvename>
 <url>http://subversion.apache.org/security/CVE-2013-4131-advisory.txt</url>
 </references>
 <dates>
 <discovery>2013-07-19</discovery>
 <entry>2013-07-24</entry>
 <modified>2013-07-25</modified>
 </dates>
 </vuln>

<vuln vid="2fbfd455-f2d0-11e2-8a46-000d601460a4">
 <topic>suPHP -- Privilege escalation</topic>
 <affects>
 <package>
	<name>suphp</name>
	<range><lt>0.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	suPHP developer Sebastian Marsching reports:
	<blockquote cite="https://lists.marsching.com/pipermail/suphp/2013-May/002552.html">
	 When the suPHP_PHPPath was set, mod_suphp would use the specified PHP
	 executable to pretty-print PHP source files (MIME type
	 x-httpd-php-source or application/x-httpd-php-source).
	 However, it would not sanitize the environment. Thus a user that was
	 allowed to use the SetEnv directive in a .htaccess file (AllowOverride
	 FileInfo) could make PHP load a malicious configuration file (e.g.
	 loading malicious extensions).
	 As the PHP process for highlighting the source file was run with the
	 privileges of the user Apache HTTPd was running as, a local attacker
	 could probably execute arbitrary code with the privileges of this user.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.marsching.com/pipermail/suphp/2013-May/002552.html</url>
 </references>
 <dates>
 <discovery>2013-05-20</discovery>
 <entry>2013-07-22</entry>
 </dates>
 </vuln>

<vuln vid="ca4d63fb-f15c-11e2-b183-20cf30e32f6d">
 <topic>apache24 -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>apache24</name>
	<range><lt>2.4.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache HTTP SERVER PROJECT reports:
	<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.4.html">
	 mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn
	 with the source href (sent as part of the request body as XML) pointing
	 to a URI that is not configured for DAV will trigger a segfault.
	 mod_session_dbd: Make sure that dirty flag is respected when saving
	 sessions, and ensure the session ID is changed each time the session
	 changes. This changes the format of the updatesession SQL statement.
	 Existing configurations must be changed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1896</cvename>
 <cvename>CVE-2013-2249</cvename>
 <url>http://www.apache.org/dist/httpd/Announcement2.4.html</url>
 </references>
 <dates>
 <discovery>2013-07-11</discovery>
 <entry>2013-07-20</entry>
 <modified>2013-07-21</modified>
 </dates>
 </vuln>

<vuln vid="9b037a0d-ef2c-11e2-b4a0-8c705af55518">
 <topic>gallery -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gallery3</name>
	<range><lt>3.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Red Hat Security Response Team reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2013/07/04/7">
	 Gallery upstream has released 3.0.9 version, correcting two
	 security flaws:
	 Issue #1 - Improper stripping of URL fragments in flowplayer
	 SWF file might lead to reply attacks (a different flaw than
	 CVE-2013-2138).
	 Issue #2 - gallery3: Multiple information exposure flaws in
	 data rest core module.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2240</cvename>
 <cvename>CVE-2013-2241</cvename>
 <url>http://sourceforge.net/apps/trac/gallery/ticket/2073</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=981197</url>
 <url>http://sourceforge.net/apps/trac/gallery/ticket/2074</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=981198</url>
 <url>http://galleryproject.org/gallery_3_0_9</url>
 </references>
 <dates>
 <discovery>2013-06-28</discovery>
 <entry>2013-07-17</entry>
 </dates>
 </vuln>

<vuln vid="31b145f2-d9d3-49a9-8023-11cf742205dc">
 <topic>PHP5 -- Heap corruption in XML parser</topic>
 <affects>
 <package>
	<name>php53</name>
	<range><lt>5.3.27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP development team reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4113">
	 ext/xml/xml.c in PHP before 5.3.27 does not properly
	 consider parsing depth, which allows remote attackers to
	 cause a denial of service (heap memory corruption) or
	 possibly have unspecified other impact via a crafted
	 document that is processed by the xml_parse_into_struct
	 function.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4113</cvename>
 <url>https://bugs.php.net/bug.php?id=65236</url>
 </references>
 <dates>
 <discovery>2013-07-10</discovery>
 <entry>2013-07-16</entry>
 </dates>
 </vuln>

<vuln vid="5def3175-f3f9-4476-ba40-b46627cc638c">
 <topic>PHP5 -- Integer overflow in Calendar module</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><ge>5.4.0</ge><lt>5.4.16</lt></range>
 </package>
 <package>
	<name>php53</name>
	<range><lt>5.3.26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP development team reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4635">
	 Integer overflow in the SdnToJewish function in jewish.c
	 in the Calendar component in PHP before 5.3.26 and 5.4.x
	 before 5.4.16 allows context-dependent attackers to cause a
	 denial of service (application hang) via a large argument to
	 the jdtojewish function.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4635</cvename>
 <url>https://bugs.php.net/bug.php?id=64895</url>
 </references>
 <dates>
 <discovery>2013-05-22</discovery>
 <entry>2013-07-16</entry>
 </dates>
 </vuln>

<vuln vid="df428c01-ed91-11e2-9466-98fc11cdc4f5">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.297</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-17.html">
	 These updates address vulnerabilities that could cause a crash
	 and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-3344</cvename>
 <cvename>CVE-2013-3345</cvename>
 <cvename>CVE-2013-3347</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb13-17.html</url>
 </references>
 <dates>
 <discovery>2013-07-09</discovery>
 <entry>2013-07-15</entry>
 <modified>2013-07-18</modified>
 </dates>
 </vuln>

<vuln vid="30a04ab4-ed7b-11e2-8643-8c705af55518">
 <topic>squid -- denial of service</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><ge>3.2</ge><lt>3.2.12</lt></range>
	<range><ge>3.3</ge><lt>3.3.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid project reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2013_3.txt">
	 Due to incorrect data validation Squid is vulnerable to a
	 denial of service attack when processing specially crafted
	 HTTP requests
	 This problem allows any client who can generate HTTP requests
	 to perform a denial of service attack on the Squid service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4123</cvename>
 <url>http://www.squid-cache.org/Advisories/SQUID-2013_3.txt</url>
 </references>
 <dates>
 <discovery>2013-07-13</discovery>
 <entry>2013-07-15</entry>
 </dates>
 </vuln>

<vuln vid="04320e7d-ea66-11e2-a96e-60a44c524f57">
 <topic>libzrtpcpp -- multiple security vulnerabilities</topic>
 <affects>
 <package>
	<name>libzrtpcpp</name>
	<range><lt>2.3.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mark Dowd reports:
	<blockquote cite="http://blog.azimuthsecurity.com/2013/06/attacking-crypto-phones-weaknesses-in.html">
	 Vulnerability 1. Remote Heap Overflow: If an attacker sends a
	 packet larger than 1024 bytes that gets stored temporarily (which
	 occurs many times - such as when sending a ZRTP Hello packet), a
	 heap overflow will occur, leading to potential arbitrary code
	 execution on the vulnerable host.
	 Vulnerability 2. Multiple Stack Overflows: ZRTPCPP contains
	 multiple stack overflows that arise when preparing a response
	 to a client's ZRTP Hello packet.
	 Vulnerability 3. Information Leaking / Out of Bounds Reads:
	 The ZRTPCPP library performs very little validation regarding the
	 expected size of a packet versus the actual amount of data
	 received. This can lead to both information leaking and out
	 of bounds data reads (usually resulting in a crash).
	 Information leaking can be performed for example by sending
	 a malformed ZRTP Ping packet.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2221</cvename>
 <cvename>CVE-2013-2222</cvename>
 <cvename>CVE-2013-2223</cvename>
 </references>
 <dates>
 <discovery>2013-06-27</discovery>
 <entry>2013-07-11</entry>
 </dates>
 </vuln>

<vuln vid="ebd877b9-7ef4-4375-b1fd-c67780581898">
 <topic>ruby -- Hostname check bypassing vulnerability in SSL client</topic>
 <affects>
 <package>
	<name>ruby19</name>
	<range><lt>1.9.3.448,1</lt></range>
 </package>
 <package>
	<name>ruby18</name>
	<range><lt>1.8.7.374,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby Developers report:
	<blockquote cite="http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/">
	 Ruby's SSL client implements hostname identity check but it does
	 not properly handle hostnames in the certificate that contain null
	 bytes.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4073</cvename>
 <url>http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/</url>
 </references>
 <dates>
 <discovery>2013-06-27</discovery>
 <entry>2013-07-11</entry>
 <modified>2013-09-24</modified>
 </dates>
 </vuln>

<vuln vid="e3e788aa-e9fd-11e2-a96e-60a44c524f57">
 <topic>otrs -- Sql Injection + Xss Issue</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><lt>3.2.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OTRS Project reports:
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-05/">
	 An attacker with a valid agent login could manipulate URLs leading to SQL injection. An attacker with a valid agent login could manipulate URLs in the ITSM ConfigItem search, leading to a JavaScript code injection (XSS) problem.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4717</cvename>
 <cvename>CVE-2013-4718</cvename>
 <url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-05/</url>
 </references>
 <dates>
 <discovery>2013-07-09</discovery>
 <entry>2013-07-11</entry>
 </dates>
 </vuln>

<vuln vid="f3d24aee-e5ad-11e2-b183-20cf30e32f6d">
 <topic>apache22 -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>apache22</name>
	<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
 </package>
 <package>
	<name>apache22-event-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
 </package>
 <package>
	<name>apache22-itk-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
 </package>
 <package>
	<name>apache22-peruser-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
 </package>
 <package>
	<name>apache22-worker-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Apache HTTP SERVER PROJECT reports:</h1>
	<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.25">
	 The mod_rewrite module in the Apache HTTP Server 2.2.x before
	 2.2.25 writes data to a log file without sanitizing
	 non-printable characters, which might allow remote attackers to
	 execute arbitrary commands via an HTTP request containing an
	 escape sequence for a terminal emulator.
	 mod_dav: Sending a MERGE request against a URI handled by
	 mod_dav_svn with the source href (sent as part of the request
	 body as XML) pointing to a URI that is not configured for DAV
	 will trigger a segfault.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1862</cvename>
 <cvename>CVE-2013-1896</cvename>
 </references>
 <dates>
 <discovery>2013-06-21</discovery>
 <entry>2013-07-05</entry>
 <modified>2013-07-10</modified>
 </dates>
 </vuln>

<vuln vid="1b93f6fe-e1c1-11e2-948d-6805ca0b3d42">
 <topic>phpMyAdmin -- Global variable scope injection</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.0</ge><lt>4.0.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php">
	 The import.php script was vulnerable to GLOBALS variable
	 injection. Therefore, an attacker could manipulate any
	 configuration parameter.
	 This vulnerability can be triggered only by someone who
	 logged in to phpMyAdmin, as the usual token protection
	 prevents non-logged-in users from accessing the required
	 form.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php</url>
 <cvename>CVE-2013-4729</cvename>
 </references>
 <dates>
 <discovery>2013-06-30</discovery>
 <entry>2013-06-30</entry>
 </dates>
 </vuln>

<vuln vid="81da673e-dfe1-11e2-9389-08002798f6ff">
 <topic>apache-xml-security-c -- heap overflow during XPointer evaluation</topic>
 <affects>
 <package>
	<name>apache-xml-security-c</name>
	<range><lt>1.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation reports:
	<blockquote cite="http://santuario.apache.org/secadv.data/CVE-2013-2210.txt">
	 The attempted fix to address CVE-2013-2154 introduced the
	 possibility of a heap overflow, possibly leading to arbitrary code
	 execution, in the processing of malformed XPointer expressions in the
	 XML Signature Reference processing code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2210</cvename>
 <url>http://santuario.apache.org/secadv.data/CVE-2013-2210.txt</url>
 </references>
 <dates>
 <discovery>2013-06-27</discovery>
 <entry>2013-06-28</entry>
 </dates>
 </vuln>

<vuln vid="b3fcb387-de4b-11e2-b1c6-0025905a4771">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>18.0,1</gt><lt>22.0,1</lt></range>
	<range><lt>17.0.7,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>17.0.7,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.19</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.7</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.19</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 Miscellaneous memory safety hazards (rv:22.0 / rv:17.0.7)
	 Title: Memory corruption found using Address Sanitizer
	 Privileged content access and execution via XBL
	 Arbitrary code execution within Profiler
	 Execution of unmapped memory through onreadystatechange
	 Data in the body of XHR HEAD requests leads to CSRF attacks
	 SVG filters can lead to information disclosure
	 PreserveWrapper has inconsistent behavior
	 Sandbox restrictions not applied to nested frame elements
	 X-Frame-Options ignored when using server push with multi-part
	 responses
	 XrayWrappers can be bypassed to run user defined methods in a
	 privileged context
	 getUserMedia permission dialog incorrectly displays location
	 Homograph domain spoofing in .com, .net and .name
	 Inaccessible updater can lead to local privilege escalation
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2013-1682</cvename>
	<cvename>CVE-2013-1683</cvename>
	<cvename>CVE-2013-1684</cvename>
	<cvename>CVE-2013-1685</cvename>
	<cvename>CVE-2013-1686</cvename>
	<cvename>CVE-2013-1687</cvename>
	<cvename>CVE-2013-1688</cvename>
	<cvename>CVE-2013-1690</cvename>
	<cvename>CVE-2013-1692</cvename>
	<cvename>CVE-2013-1693</cvename>
	<cvename>CVE-2013-1694</cvename>
	<cvename>CVE-2013-1695</cvename>
	<cvename>CVE-2013-1696</cvename>
	<cvename>CVE-2013-1697</cvename>
	<cvename>CVE-2013-1698</cvename>
	<cvename>CVE-2013-1699</cvename>
	<cvename>CVE-2013-1700</cvename>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-49.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-50.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-51.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-52.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-53.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-54.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-55.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-56.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-57.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-58.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-59.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-60.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-61.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-62.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
 </references>
 <dates>
 <discovery>2013-06-25</discovery>
 <entry>2013-06-26</entry>
 </dates>
 </vuln>

<vuln vid="01cf67b3-dc3b-11e2-a6cd-c48508086173">
 <topic>cURL library -- heap corruption in curl_easy_unescape</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.7</ge><lt>7.24.0_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cURL developers report:
	<blockquote cite="http://curl.haxx.se/docs/adv_20130622.html">
	 libcurl is vulnerable to a case of bad checking of the
	 input data which may lead to heap corruption.
	 The function curl_easy_unescape() decodes URL-encoded
	 strings to raw binary data. URL-encoded octets are
	 represented with %HH combinations where HH is a two-digit
	 hexadecimal number. The decoded string is written to an
	 allocated memory area that the function returns to the
	 caller.
	 The function takes a source string and a length
	 parameter, and if the length provided is 0 the function will
	 instead use strlen() to figure out how much data to
	 parse.
	 The "%HH" parser wrongly only considered the case where a
	 zero byte would terminate the input. If a length-limited
	 buffer was passed in which ended with a '%' character which
	 was followed by two hexadecimal digits outside of the buffer
	 libcurl was allowed to parse alas without a terminating
	 zero, libcurl would still parse that sequence as well. The
	 counter for remaining data to handle would then be decreased
	 too much and wrap to become a very large integer and the
	 copying would go on too long and the destination buffer that
	 is allocated on the heap would get overwritten.
	 We consider it unlikely that programs allow user-provided
	 strings unfiltered into this function. Also, only the not
	 zero-terminated input string use case is affected by this
	 flaw. Exploiting this flaw for gain is probably possible for
	 specific circumstances but we consider the general risk for
	 this to be low.
	 The curl command line tool is not affected by this
	 problem as it doesn't use this function.
	 There are no known exploits available at this time.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2174</cvename>
 <url>http://curl.haxx.se/docs/adv_20130622.html</url>
 </references>
 <dates>
 <discovery>2013-06-22</discovery>
 <entry>2013-06-23</entry>
 <modified>2013-07-01</modified>
 </dates>
 </vuln>

<vuln vid="b162b218-c547-4ba2-ae31-6fdcb61bc763">
 <topic>puppet -- Unauthenticated Remote Code Execution Vulnerability</topic>
 <affects>
 <package>
	<name>puppet</name>
	<range><ge>2.7</ge><lt>2.7.22</lt></range>
	<range><ge>3.0</ge><lt>3.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Puppet Developers report:
	<blockquote cite="http://puppetlabs.com/security/cve/cve-2013-3567/">
	 When making REST api calls, the puppet master takes YAML from an
	 untrusted client, deserializes it, and then calls methods on the
	 resulting object. A YAML payload can be crafted to cause the
	 deserialization to construct an instance of any class available in
	 the ruby process, which allows an attacker to execute code
	 contained in the payload.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-3567</cvename>
 </references>
 <dates>
 <discovery>2013-06-13</discovery>
 <entry>2013-06-22</entry>
 <modified>2013-08-01</modified>
 </dates>
 </vuln>

<vuln vid="8b97d289-d8cf-11e2-a1f5-60a44c524f57">
 <topic>otrs -- information disclosure</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><lt>3.2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OTRS Project reports:
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-04/">
	 An attacker with a valid agent login could manipulate URLs in the ticket
	 watch mechanism to see contents of tickets they are not permitted to see.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-4088</cvename>
 <url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-04/</url>
 </references>
 <dates>
 <discovery>2013-06-18</discovery>
 <entry>2013-06-19</entry>
 </dates>
 </vuln>

<vuln vid="abef280d-d829-11e2-b71c-8c705af55518">
 <topic>FreeBSD -- Privilege escalation via mmap</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.0</ge><lt>9.1_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13%3a06.mmap.asc">
	 Due to insufficient permission checks in the virtual memory
	 system, a tracing process (such as a debugger) may be able to
	 modify portions of the traced process's address space to which
	 the traced process itself does not have write access.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2171</cvename>
 <freebsdsa>SA-13:06.mmap</freebsdsa>
 </references>
 <dates>
 <discovery>2013-06-18</discovery>
 <entry>2013-06-18</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="279e5f4b-d823-11e2-928e-08002798f6ff">
 <topic>apache-xml-security-c -- heap overflow</topic>
 <affects>
 <package>
	<name>apache-xml-security-c</name>
	<range><lt>1.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation reports:
	<blockquote cite="http://santuario.apache.org/secadv.data/CVE-2013-2156.txt">
	 A heap overflow exists in the processing of the PrefixList
	 attribute optionally used in conjunction with Exclusive
	 Canonicalization, potentially allowing arbitary code execution.
	 If verification of the signature occurs prior to actual evaluation of a
	 signing key, this could be exploited by an unauthenticated attacker.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2156</cvename>
 <url>http://santuario.apache.org/secadv.data/CVE-2013-2156.txt</url>
 </references>
 <dates>
 <discovery>2013-06-18</discovery>
 <entry>2013-06-18</entry>
 </dates>
 </vuln>

<vuln vid="80af2677-d6c0-11e2-8f5e-001966155bea">
 <topic>tor -- guard discovery</topic>
 <affects>
 <package>
	<name>tor-devel</name>
	<range><lt>0.2.4.13.a_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Tor Project reports:
	<blockquote cite="https://gitweb.torproject.org/tor.git/commit/2a95f3171681ee53c97ccba9d80f4454b462aaa7">
	 Disable middle relay queue overfill detection code due to possible guard discovery attack
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://trac.torproject.org/projects/tor/ticket/9072</url>
 </references>
 <dates>
 <discovery>2013-06-15</discovery>
 <entry>2013-06-16</entry>
 </dates>
 </vuln>

<vuln vid="4e9e410b-d462-11e2-8d57-080027019be0">
 <topic>dbus -- local dos</topic>
 <affects>
 <package>
	<name>dbus</name>
	<range><lt>1.6.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon McVittie reports:
	<blockquote cite="http://lists.freedesktop.org/archives/dbus/2013-June/015696.html">
	 Alexandru Cornea discovered a vulnerability in libdbus caused
	 by an implementation bug in _dbus_printf_string_upper_bound().
	 This vulnerability can be exploited by a local user to crash
	 system services that use libdbus, causing denial of service.
	 It is platform-specific: x86-64 Linux is known to be affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2168</cvename>
 <url>http://lists.freedesktop.org/archives/dbus/2013-June/015696.html</url>
 </references>
 <dates>
 <discovery>2013-06-13</discovery>
 <entry>2013-06-13</entry>
 </dates>
 </vuln>

<vuln vid="fce67546-d2e7-11e2-a9bf-98fc11cdc4f5">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.291</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-16.html">
	 These updates address vulnerabilities that could cause a crash
	 and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-3343</cvename>
 </references>
 <dates>
 <discovery>2013-06-11</discovery>
 <entry>2013-06-14</entry>
 <modified>2013-06-18</modified>
 </dates>
 </vuln>

<vuln vid="d7a43ee6-d2d5-11e2-9894-002590082ac6">
 <topic>owncloud -- Multiple security vulnerabilities</topic>
 <affects>
 <package>
	<name>owncloud</name>
	<range><lt>5.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The ownCloud development team reports:
	<blockquote cite="http://owncloud.org/about/security/advisories/">
	 oC-SA-2013-019 / CVE-2013-2045: Multiple SQL Injections.
	 Credit to Mateusz Goik (aliantsoft.pl).
	 oC-SA-2013-020 / CVE-2013-[2039,2085]: Multiple directory traversals.
	 Credit to Mateusz Goik (aliantsoft.pl).
	 oC-SQ-2013-021 / CVE-2013-[2040-2042]: Multiple XSS vulnerabilities.
	 Credit to Mateusz Goik (aliantsoft.pl) and Kacper R. (http://devilteam.pl).
	 oC-SA-2013-022 / CVE-2013-2044: Open redirector.
	 Credit to Mateusz Goik (aliantsoft.pl).
	 oC-SA-2013-023 / CVE-2013-2047: Password autocompletion.
	 oC-SA-2013-024 / CVE-2013-2043: Privilege escalation in the calendar application.
	 Credit to Mateusz Goik (aliantsoft.pl).
	 oC-SA-2013-025 / CVE-2013-2048: Privilege escalation and CSRF in the API.
	 oC-SA-2013-026 / CVE-2013-2089: Incomplete blacklist vulnerability.
	 oC-SA-2013-027 / CVE-2013-2086: CSRF token leakage.
	 oC-SA-2013-028 / CVE-2013-[2149-2150]: Multiple XSS vulnerabilities.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://owncloud.org/about/security/advisories/oC-SA-2013-019/</url>
 <url>http://owncloud.org/about/security/advisories/oC-SA-2013-020/</url>
 <url>http://owncloud.org/about/security/advisories/oC-SA-2013-021/</url>
 <url>http://owncloud.org/about/security/advisories/oC-SA-2013-022/</url>
 <url>http://owncloud.org/about/security/advisories/oC-SA-2013-023/</url>
 <url>http://owncloud.org/about/security/advisories/oC-SA-2013-024/</url>
 <url>http://owncloud.org/about/security/advisories/oC-SA-2013-025/</url>
 <url>http://owncloud.org/about/security/advisories/oC-SA-2013-026/</url>
 <url>http://owncloud.org/about/security/advisories/oC-SA-2013-027/</url>
 <url>http://owncloud.org/about/security/advisories/oC-SA-2013-028/</url>
 <cvename>CVE-2013-2039</cvename>
 <cvename>CVE-2013-2040</cvename>
 <cvename>CVE-2013-2041</cvename>
 <cvename>CVE-2013-2042</cvename>
 <cvename>CVE-2013-2043</cvename>
 <cvename>CVE-2013-2044</cvename>
 <cvename>CVE-2013-2045</cvename>
 <cvename>CVE-2013-2047</cvename>
 <cvename>CVE-2013-2048</cvename>
 <cvename>CVE-2013-2085</cvename>
 <cvename>CVE-2013-2086</cvename>
 <cvename>CVE-2013-2089</cvename>
 <cvename>CVE-2013-2149</cvename>
 <cvename>CVE-2013-2150</cvename>
 </references>
 <dates>
 <discovery>2013-05-14</discovery>
 <entry>2013-06-11</entry>
 </dates>
 </vuln>

<vuln vid="59e7163c-cf84-11e2-907b-0025905a4770">
 <topic>php5 -- Heap based buffer overflow in quoted_printable_encode</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.4.16</lt></range>
 </package>
 <package>
	<name>php53</name>
	<range><lt>5.3.26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP development team reports:
	<blockquote cite="http://www.php.net/ChangeLog-5.php">
	 A Heap-based buffer overflow flaw was found in the php
	 quoted_printable_encode() function. A remote attacker could use
	 this flaw to cause php to crash or execute arbirary code with the
	 permission of the user running php
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2110</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=964969</url>
 </references>
 <dates>
 <discovery>2013-06-06</discovery>
 <entry>2013-06-07</entry>
 </dates>
 </vuln>

<vuln vid="72f35727-ce83-11e2-be04-005056a37f68">
 <topic>dns/bind9* -- A recursive resolver can be crashed by a query for a malformed zone</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><gt>9.9.3</gt><lt>9.9.3.1</lt></range>
 </package>
 <package>
	<name>bind99-base</name>
	<range><gt>9.9.3</gt><lt>9.9.3.1</lt></range>
 </package>
 <package>
	<name>bind98</name>
	<range><gt>9.8.5</gt><lt>9.8.5.1</lt></range>
 </package>
 <package>
	<name>bind98-base</name>
	<range><gt>9.8.5</gt><lt>9.8.5.1</lt></range>
 </package>
 <package>
	<name>bind96</name>
	<range><gt>9.6.3.1.ESV.R9</gt><lt>9.6.3.2.ESV.R9</lt></range>
 </package>
 <package>
	<name>bind96-base</name>
	<range><gt>9.6.3.1.ESV.R9</gt><lt>9.6.3.2.ESV.R9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-00967">
	 A bug has been discovered in the most recent releases of
	 BIND 9 which has the potential for deliberate exploitation
	 as a denial-of-service attack. By sending a recursive
	 resolver a query for a record in a specially malformed zone,
	 an attacker can cause BIND 9 to exit with a fatal
	 "RUNTIME_CHECK" error in resolver.c.
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2013-3919</cvename>
 </references>
 <dates>
 <discovery>2013-06-04</discovery>
 <entry>2013-06-06</entry>
 <modified>2013-06-07</modified>
 </dates>
 </vuln>

<vuln vid="6b97436c-ce1e-11e2-9cb2-6805ca0b3d42">
 <topic>phpMyAdmin -- XSS due to unescaped HTML output in Create View page</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>4.0</ge><lt>4.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php">
	 When creating a view with a crafted name and an incorrect
	 CREATE statement, it is possible to trigger an XSS.
	 This vulnerability can be triggered only by someone who
	 logged in to phpMyAdmin, as the usual token protection
	 prevents non-logged-in users from accessing the required
	 form.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php</url>
 <cvename>CVE-2013-3742</cvename>
 </references>
 <dates>
 <discovery>2013-06-05</discovery>
 <entry>2013-06-05</entry>
 </dates>
 </vuln>

<vuln vid="a3c2dee5-cdb9-11e2-b9ce-080027019be0">
 <topic>telepathy-gabble -- TLS verification bypass</topic>
 <affects>
 <package>
	<name>telepathy-gabble</name>
	<range><lt>0.16.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon McVittie reports:
	<blockquote cite="http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html">
	 This release fixes a man-in-the-middle attack.
	 If you use an unencrypted connection to a "legacy Jabber"
	 (pre-XMPP) server, this version of Gabble will not connect
	 until you make one of these configuration changes:
	 . upgrade the server software to something that supports XMPP 1.0; or
	 . use an encrypted "old SSL" connection, typically on port 5223
	 (old-ssl); or
	 . turn off "Encryption required (TLS/SSL)" (require-encryption).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1431</cvename>
 <url>http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html</url>
 </references>
 <dates>
 <discovery>2013-05-27</discovery>
 <entry>2013-06-05</entry>
 </dates>
 </vuln>

<vuln vid="2eebebff-cd3b-11e2-8f09-001b38c3836c">
 <topic>xorg -- protocol handling issues in X Window System client libraries</topic>
 <affects>
 <package>
	<name>libX11</name>
	<range><lt>1.6.0</lt></range>
 </package>
 <package>
	<name>libXext</name>
	<range><lt>1.3.2</lt></range>
 </package>
 <package>
	<name>libXfixes</name>
	<range><lt>5.0.1</lt></range>
 </package>
 <package>
	<name>libXi</name>
	<range><lt>1.7_1</lt></range>
 </package>
 <package>
	<name>libXinerama</name>
	<range><lt>1.1.3</lt></range>
 </package>
 <package>
	<name>libXp</name>
	<range><lt>1.0.2</lt></range>
 </package>
 <package>
	<name>libXrandr</name>
	<range><lt>1.4.1</lt></range>
 </package>
 <package>
	<name>libXrender</name>
	<range><lt>0.9.7_1</lt></range>
 </package>
 <package>
	<name>libXres</name>
	<range><lt>1.0.7</lt></range>
 </package>
 <package>
	<name>libXtst</name>
	<range><lt>1.2.2</lt></range>
 </package>
 <package>
	<name>libXv</name>
	<range><lt>1.0.8</lt></range>
 </package>
 <package>
	<name>libXvMC</name>
	<range><lt>1.0.7_1</lt></range>
 </package>
 <package>
	<name>libXxf86dga</name>
	<range><lt>1.1.4</lt></range>
 </package>
 <package>
	<name>libdmx</name>
	<range><lt>1.1.3</lt></range>
 </package>
 <package>
	<name>libxcb</name>
	<range><lt>1.9.1</lt></range>
 </package>
 <package>
	<name>libGL</name>
	<range><lt>7.6.1_4</lt></range>
	<range><gt>7.8.0</gt><lt>8.0.5_4</lt></range>
 </package>
 <package>
	<name>xf86-video-openchrome</name>
	<range><lt>0.3.3</lt></range>
 </package>
 <package>
	<name>libFS</name>
	<range><lt>1.0.5</lt></range>
 </package>
 <package>
	<name>libXxf86vm</name>
	<range><lt>1.1.3</lt></range>
 </package>
 <package>
	<name>libXt</name>
	<range><lt>1.1.4</lt></range>
 </package>
 <package>
	<name>libXcursor</name>
	<range><lt>1.1.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	freedesktop.org reports:
	<blockquote cite="http://www.x.org/wiki/Development/Security/Advisory-2013-05-23">
	 Ilja van Sprundel, a security researcher with IOActive, has
	 discovered a large number of issues in the way various X client
	 libraries handle the responses they receive from servers, and has
	 worked with X.Org's security team to analyze, confirm, and fix
	 these issues.
	 Most of these issues stem from the client libraries trusting the
	 server to send correct protocol data, and not verifying that the
	 values will not overflow or cause other damage. Most of the time X
	 clients &amp; servers are run by the same user, with the server
	 more privileged from the clients, so this is not a problem, but
	 there are scenarios in which a privileged client can be connected
	 to an unprivileged server, for instance, connecting a setuid X
	 client (such as a screen lock program) to a virtual X server (such
	 as Xvfb or Xephyr) which the user has modified to return invalid
	 data, potentially allowing the user to escalate their privileges.
	 The vulnerabilities include:
	 Integer overflows calculating memory needs for replies.
	 Sign extension issues calculating memory needs for replies.
	 Buffer overflows due to not validating length or offset values in
	 replies.
	 Integer overflows parsing user-specified files.
	 Unbounded recursion parsing user-specified files.
	 Memory corruption due to unchecked return values.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1981</cvename>
 <cvename>CVE-2013-1982</cvename>
 <cvename>CVE-2013-1983</cvename>
 <cvename>CVE-2013-1984</cvename>
 <cvename>CVE-2013-1985</cvename>
 <cvename>CVE-2013-1986</cvename>
 <cvename>CVE-2013-1987</cvename>
 <cvename>CVE-2013-1988</cvename>
 <cvename>CVE-2013-1989</cvename>
 <cvename>CVE-2013-1990</cvename>
 <cvename>CVE-2013-1991</cvename>
 <cvename>CVE-2013-1992</cvename>
 <cvename>CVE-2013-1993</cvename>
 <cvename>CVE-2013-1994</cvename>
 <cvename>CVE-2013-1995</cvename>
 <cvename>CVE-2013-1996</cvename>
 <cvename>CVE-2013-1997</cvename>
 <cvename>CVE-2013-1998</cvename>
 <cvename>CVE-2013-1999</cvename>
 <cvename>CVE-2013-2000</cvename>
 <cvename>CVE-2013-2001</cvename>
 <cvename>CVE-2013-2002</cvename>
 <cvename>CVE-2013-2003</cvename>
 <cvename>CVE-2013-2004</cvename>
 <cvename>CVE-2013-2005</cvename>
 <cvename>CVE-2013-2062</cvename>
 <cvename>CVE-2013-2063</cvename>
 <cvename>CVE-2013-2064</cvename>
 <cvename>CVE-2013-2066</cvename>
 </references>
 <dates>
 <discovery>2013-05-23</discovery>
 <entry>2013-06-04</entry>
 </dates>
 </vuln>

<vuln vid="e3f64457-cccd-11e2-af76-206a8a720317">
 <topic>krb5 -- UDP ping-pong vulnerability in the kpasswd (password changing) service. [CVE-2002-2443]</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><le>1.11.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	No advisory has been released yet.
	<blockquote cite="http://web.mit.edu/kerberos/www/krb5-1.11/">
	 schpw.c in the kpasswd service in kadmind in MIT Kerberos 5
	 (aka krb5) before 1.11.3 does not properly validate UDP packets
	 before sending responses, which allows remote attackers to cause
	 a denial of service (CPU and bandwidth consumption) via a forged
	 packet that triggers a communication loop, as demonstrated by
	 krb_pingpong.nasl, a related issue to CVE-1999-0103.
	 [CVE-2002-2443].
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2002-2443</cvename>
 <url>http://web.mit.edu/kerberos/www/krb5-1.11/</url>
 </references>
 <dates>
 <discovery>2013-05-10</discovery>
 <entry>2013-06-03</entry>
 </dates>
 </vuln>

<vuln vid="0bf376b7-cc6b-11e2-a424-14dae938ec40">
 <topic>net/openafs -- buffer overflow</topic>
 <affects>
 <package>
	<name>openafs</name>
	<range><lt>1.6.2.*</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nickolai Zeldovich reports:
	<blockquote cite="http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt">
	 An attacker with the ability to manipulate AFS directory ACLs may
	 crash the fileserver hosting that volume.
	 In addition, once a corrupt ACL is placed on a fileserver, its
	 existence may crash client utilities manipulating ACLs
	 on that server.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt</url>
 <cvename>CVE-2013-1794</cvename>
 </references>
 <dates>
 <discovery>2013-02-27</discovery>
 <entry>2013-06-03</entry>
 </dates>
 </vuln>

<vuln vid="9dfb63b8-8f36-11e2-b34d-000c2957946c">
 <topic>www/mod_security -- NULL pointer dereference DoS</topic>
 <affects>
 <package>
	<name>mod_security</name>
	<range><lt>2.7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/archive/1/526746">
	 When ModSecurity receives a request body with a size bigger than the
	 value set by the "SecRequestBodyInMemoryLimit" and with a "Content-Type"
	 that has no request body processor mapped to it, ModSecurity will
	 systematically crash on every call to "forceRequestBodyVariable".
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2765</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2765</url>
 </references>
 <dates>
 <discovery>2013-05-27</discovery>
 <entry>2013-06-03</entry>
 </dates>
 </vuln>

<vuln vid="1225549f-ca91-11e2-b3b8-f0def16c5c1b">
 <topic>passenger -- security vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-passenger</name>
	<range><lt>4.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Phusion reports:
	<blockquote cite="http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/">
	 A denial of service and arbitrary code execution by hijacking temp files. [CVE-2013-2119]
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2119</cvename>
 <url>http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/</url>
 </references>
 <dates>
 <discovery>2013-05-29</discovery>
 <entry>2013-06-01</entry>
 </dates>
 </vuln>

<vuln vid="ce502902-ca39-11e2-9673-001e8c75030d">
 <topic>devel/subversion -- svnserve remotely triggerable DoS</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><ge>1.7.0</ge><lt>1.7.10</lt></range>
	<range><ge>1.0.0</ge><lt>1.6.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion team reports:
	 <blockquote cite="http://subversion.apache.org/security/CVE-2013-2112-advisory.txt">
	 Subversion's svnserve server process may exit when an incoming TCP connection
	 is closed early in the connection process.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2112</cvename>
 </references>
 <dates>
 <discovery>2013-05-31</discovery>
 <entry>2013-05-31</entry>
 </dates>
 </vuln>

<vuln vid="6d0bf320-ca39-11e2-9673-001e8c75030d">
 <topic>devel/subversion -- contrib hook-scripts can allow arbitrary code execution</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><ge>1.7.0</ge><lt>1.7.10</lt></range>
	<range><ge>1.2.0</ge><lt>1.6.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion team reports:
	 <blockquote cite="http://subversion.apache.org/security/CVE-2013-2088-advisory.txt">
	 The script contrib/hook-scripts/check-mime-type.pl does not escape
	 argv arguments to 'svnlook' that start with a hyphen. This could be
	 used to cause 'svnlook', and hence check-mime-type.pl, to error out.
	 The script contrib/hook-scripts/svn-keyword-check.pl parses filenames
	 from the output of 'svnlook changed' and passes them to a further
	 shell command (equivalent to the 'system()' call of the C standard
	 library) without escaping them. This could be used to run arbitrary
	 shell commands in the context of the user whom the pre-commit script
	 runs as (the user who owns the repository).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2088</cvename>
 </references>
 <dates>
 <discovery>2013-05-31</discovery>
 <entry>2013-05-31</entry>
 </dates>
 </vuln>

<vuln vid="787d21b9-ca38-11e2-9673-001e8c75030d">
 <topic>devel/subversion -- fsfs repositories can be corrupted by newline characters in filenames</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><ge>1.7.0</ge><lt>1.7.10</lt></range>
	<range><ge>1.1.0</ge><lt>1.6.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion team reports:
	 <blockquote cite="http://subversion.apache.org/security/CVE-2013-1968-advisory.txt">
	 If a filename which contains a newline character (ASCII 0x0a) is
	 committed to a repository using the FSFS format, the resulting
	 revision is corrupt.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1968</cvename>
 </references>
 <dates>
 <discovery>2013-05-31</discovery>
 <entry>2013-05-31</entry>
 </dates>
 </vuln>

<vuln vid="0a799a8e-c9d4-11e2-a424-14dae938ec40">
 <topic>irc/bitchx -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>BitchX</name>
	<range><lt>1.2.*,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	bannedit reports:
	<blockquote cite="http://www.cvedetails.com/cve/CVE-2007-4584/">
	 Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC
	 servers to execute arbitrary code via a long string in a MODE
	 command, related to the p_mode variable.
	</blockquote>
	Nico Golde reports:
	<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=449149">
	 There is a security issue in ircii-pana in bitchx' hostname
	 command. The e_hostname function (commands.c) uses tmpnam to
	 create a temporary file which is known to be insecure.
	</blockquote>
	Chris reports:
	<blockquote cite="http://secunia.com/advisories/27556">
	 Chris has reported a vulnerability in the Cypress script for
	 BitchX, which can be exploited by malicious people to disclose
	 potentially sensitive information or to compromise a vulnerable
	 system.

The vulnerability is caused due to malicious code being present
	 in the modules/mdop.m file. This can be exploited to disclose the
	 content of various system files or to execute arbitrary shell
	 commands.

Successful exploitation allows execution of arbitrary code, but
	 requires the control of the "lsyn.webhop.net" domain.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-4584</cvename>
 <cvename>CVE-2007-5839</cvename>
 <cvename>CVE-2007-5922</cvename>
 </references>
 <dates>
 <discovery>2007-08-28</discovery>
 <entry>2013-05-31</entry>
 </dates>
 </vuln>

<vuln vid="19751e06-c798-11e2-a373-000c29833058">
 <topic>znc -- null pointer dereference in webadmin module</topic>
 <affects>
 <package>
	<name>znc</name>
	<range><lt>1.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	No advisory has been released yet.
	<blockquote cite="https://github.com/znc/znc/commit/2bd410ee5570cea127233f1133ea22f25174eb28">
	 Fix NULL pointer dereference in webadmin.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://github.com/znc/znc/commit/2bd410ee5570cea127233f1133ea22f25174eb28</url>
 </references>
 <dates>
 <discovery>2013-05-27</discovery>
 <entry>2013-05-28</entry>
 </dates>
 </vuln>

<vuln vid="6d87c2e9-c64d-11e2-9c22-50465d9ff992">
 <topic>socat -- FD leak</topic>
 <affects>
 <package>
	<name>socat</name>
	<range><lt>1.7.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gerhard Rieger reports:
	<blockquote cite="http://seclists.org/oss-sec/2013/q2/411">
	 Under certain circumstances an FD leak occurs and can be misused for
	 denial of service attacks against socat running in server mode.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-3571</cvename>
 <url>http://seclists.org/oss-sec/2013/q2/411</url>
 </references>
 <dates>
 <discovery>2013-05-26</discovery>
 <entry>2013-05-26</entry>
 </dates>
 </vuln>

<vuln vid="79789daa-8af8-4e21-a47f-e8a645752bdb">
 <topic>ruby -- Object taint bypassing in DL and Fiddle in Ruby</topic>
 <affects>
 <package>
	<name>ruby19</name>
	<range><lt>1.9.3.429,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby Developers report:
	<blockquote cite="http://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/">
	 There is a vulnerability in DL and Fiddle in Ruby where tainted
	 strings can be used by system calls regardless of the $SAFE level
	 set in Ruby.
	 
	 Native functions exposed to Ruby with DL or Fiddle do not check the
	 taint values set on the objects passed in. This can result in
	 tainted objects being accepted as input when a SecurityError
	 exception should be raised.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2065</cvename>
 <url>http://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/</url>
 </references>
 <dates>
 <discovery>2013-05-14</discovery>
 <entry>2013-05-26</entry>
 </dates>
 </vuln>

<vuln vid="4fb45a1c-c5d0-11e2-8400-001b216147b0">
 <topic>couchdb -- DOM based Cross-Site Scripting via Futon UI</topic>
 <affects>
 <package>
	<name>couchdb</name>
	<range><lt>1.2.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jan Lehnardt reports:
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F@apache.org%3E">
	 Query parameters passed into the browser-based test suite
	 are not sanitised, and can be used to load external resources.
	 An attacker may execute JavaScript code in the browser, using
	 the context of the remote user.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5650</cvename>
 <url>http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F@apache.org%3E</url>
 </references>
 <dates>
 <discovery>2012-01-14</discovery>
 <entry>2013-05-26</entry>
 </dates>
 </vuln>

<vuln vid="a5b24a6b-c37c-11e2-addb-60a44c524f57">
 <topic>otrs -- information disclosure</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><lt>3.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OTRS Project reports:
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-03/">
	 An attacker with a valid agent login could manipulate URLs in the ticket split mechanism to see contents of tickets and they are not permitted to see.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-3551</cvename>
 <url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-03/</url>
 </references>
 <dates>
 <discovery>2013-05-22</discovery>
 <entry>2013-05-23</entry>
 </dates>
 </vuln>

<vuln vid="661bd031-c37d-11e2-addb-60a44c524f57">
 <topic>otrs -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><lt>3.1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OTRS Project reports:
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-02/">
	 An attacker with permission to write changes, workorder items or FAQ articles could inject JavaScript code into the articles which would be executed by the browser of other users reading the article.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2637</cvename>
 <url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-02/</url>
 </references>
 <dates>
 <discovery>2013-04-02</discovery>
 <entry>2013-05-23</entry>
 </dates>
 </vuln>

<vuln vid="3a429192-c36a-11e2-97a9-6805ca0b3d42">
 <topic>RT -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rt38</name>
	<range><ge>3.8</ge><lt>3.8.17</lt></range>
 </package>
 <package>
	<name>rt40</name>
	<range><ge>4.0</ge><lt>4.0.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Thomas Sibley reports:
	<blockquote cite="http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html">
	 We discovered a number of security vulnerabilities which
	 affect both RT 3.8.x and RT 4.0.x. We are releasing RT
	 versions 3.8.17 and 4.0.13 to resolve these vulnerabilities,
	 as well as patches which apply atop all released versions of
	 3.8 and 4.0.
	 The vulnerabilities addressed by 3.8.17, 4.0.13, and the
	 below patches include the following:
	 RT 4.0.0 and above are vulnerable to a limited privilege
	 escalation leading to unauthorized modification of ticket
	 data. The DeleteTicket right and any custom lifecycle
	 transition rights may be bypassed by any user with
	 ModifyTicket. This vulnerability is assigned
	 CVE-2012-4733.
	 RT 3.8.0 and above include a version of bin/rt that uses
	 semi-predictable names when creating tempfiles. This could
	 possibly be exploited by a malicious user to overwrite files
	 with permissions of the user running bin/rt. This
	 vulnerability is assigned CVE-2013-3368.
	 RT 3.8.0 and above allow calling of arbitrary Mason
	 components (without control of arguments) for users who can
	 see administration pages. This could be used by a malicious
	 user to run private components which may have negative
	 side-effects. This vulnerability is assigned
	 CVE-2013-3369.
	 RT 3.8.0 and above allow direct requests to private
	 callback components. Though no callback components ship
	 with RT, this could be used to exploit an extension or local
	 callback which uses the arguments passed to it insecurely.
	 This vulnerability is assigned CVE-2013-3370.
	 RT 3.8.3 and above are vulnerable to cross-site scripting
	 (XSS) via attachment filenames. The vector is difficult to
	 exploit due to parsing requirements. Additionally, RT 4.0.0
	 and above are vulnerable to XSS via maliciously-crafted
	 "URLs" in ticket content when RT's "MakeClicky" feature is
	 configured. Although not believed to be exploitable in the
	 stock configuration, a patch is also included for RTIR 2.6.x
	 to add bulletproofing. These vulnerabilities are assigned
	 CVE-2013-3371.
	 RT 3.8.0 and above are vulnerable to an HTTP header
	 injection limited to the value of the Content-Disposition
	 header. Injection of other arbitrary response headers is
	 not possible. Some (especially older) browsers may allow
	 multiple Content-Disposition values which could lead to XSS.
	 Newer browsers contain security measures to prevent this.
	 Thank you to Dominic Hargreaves for reporting this
	 vulnerability. This vulnerability is assigned
	 CVE-2013-3372.
	 RT 3.8.0 and above are vulnerable to a MIME header
	 injection in outgoing email generated by RT. The vectors
	 via RT's stock templates are resolved by this patchset, but
	 any custom email templates should be updated to ensure that
	 values interpolated into mail headers do not contain
	 newlines. This vulnerability is assigned CVE-2013-3373.
	 RT 3.8.0 and above are vulnerable to limited session
	 re-use when using the file-based session store,
	 Apache::Session::File. RT's default session configuration
	 only uses Apache::Session::File for Oracle. RT instances
	 using Oracle may be locally configured to use the
	 database-backed Apache::Session::Oracle, in which case
	 sessions are never re-used. The extent of session re-use is
	 limited to information leaks of certain user preferences and
	 caches, such as queue names available for ticket creation.
	 Thank you to Jenny Martin for reporting the problem that
	 lead to discovery of this vulnerability. This vulnerability
	 is assigned CVE-2013-3374.
	</blockquote>
 </body>
 </description>
 <references>
	<url>http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html</url>
	<url>http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html</url>
	<url>http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html</url>
	<cvename>CVE-2012-4733</cvename>
	<cvename>CVE-2013-3368</cvename>
	<cvename>CVE-2013-3369</cvename>
	<cvename>CVE-2013-3370</cvename>
	<cvename>CVE-2013-3371</cvename>
	<cvename>CVE-2013-3372</cvename>
	<cvename>CVE-2013-3373</cvename>
	<cvename>CVE-2013-3374</cvename>
 </references>
 <dates>
 <discovery>2013-05-22</discovery>
 <entry>2013-05-23</entry>
 </dates>
 </vuln>

<vuln vid="c72a2494-c08b-11e2-bb21-083e8ed0f47b">
 <topic>plib -- stack-based buffer overflow</topic>
 <affects>
 <package>
	<name>plib</name>
	<range><lt>1.8.5_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4552">
	 Stack-based buffer overflow in the error function in
	 ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to
	 execute arbitrary code via a crafted 3d model file that
	 triggers a long error message, as demonstrated by a .ase
	 file.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>55839</bid>
 <cvename>CVE-2012-4552</cvename>
 <mlist>http://www.openwall.com/lists/oss-security/2012/10/29/8</mlist>
 </references>
 <dates>
 <discovery>2012-10-09</discovery>
 <entry>2013-05-19</entry>
 </dates>
 </vuln>

<vuln vid="13bf0602-c08a-11e2-bb21-083e8ed0f47b">
 <topic>plib -- buffer overflow</topic>
 <affects>
 <package>
	<name>plib</name>
	<range><lt>1.8.5_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="https://secunia.com/advisories/47297">
	 A vulnerability has been discovered in PLIB, which can be
	 exploited by malicious people to compromise an application
	 using the library. The vulnerability is caused due to a
	 boundary error within the "ulSetError()" function
	 (src/util/ulError.cxx) when creating the error message,
	 which can be exploited to overflow a static buffer.
	 Successful exploitation allows the execution of arbitrary
	 code but requires that the attacker can e.g. control the
	 content of an overly long error message passed to the
	 "ulSetError()" function.
	 The vulnerability is confirmed in version 1.8.5. Other
	 versions may also be affected.
	 Originally reported in TORCS by Andres Gomez.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4620</cvename>
 <mlist>http://openwall.com/lists/oss-security/2011/12/21/2</mlist>
 </references>
 <dates>
 <discovery>2011-12-21</discovery>
 <entry>2013-05-19</entry>
 </dates>
 </vuln>

<vuln vid="a0c65049-bddd-11e2-a0f6-001060e06fd4">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.285</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-14.html">
	 These updates address vulnerabilities that could cause a crash
	 and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2728</cvename>
 <cvename>CVE-2013-3324</cvename>
 <cvename>CVE-2013-3325</cvename>
 <cvename>CVE-2013-3326</cvename>
 <cvename>CVE-2013-3327</cvename>
 <cvename>CVE-2013-3328</cvename>
 <cvename>CVE-2013-3329</cvename>
 <cvename>CVE-2013-3330</cvename>
 <cvename>CVE-2013-3331</cvename>
 <cvename>CVE-2013-3332</cvename>
 <cvename>CVE-2013-3333</cvename>
 <cvename>CVE-2013-3334</cvename>
 <cvename>CVE-2013-3335</cvename>
 </references>
 <dates>
 <discovery>2013-05-14</discovery>
 <entry>2013-05-16</entry>
 </dates>
 </vuln>

<vuln vid="4a1ca8a4-bd82-11e2-b7a0-d43d7e0c7c02">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>18.0,1</gt><lt>21.0,1</lt></range>
	<range><lt>17.0.6,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>17.0.6,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.17.1</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.6</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.17.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2013-41 Miscellaneous memory safety hazards (rv:21.0
	 / rv:17.0.6)
	 MFSA 2013-42 Privileged access for content level constructor
	 MFSA 2013-43 File input control has access to full path
	 MFSA 2013-44 Local privilege escalation through Mozilla
	 Maintenance Service
	 MFSA 2013-45 Mozilla Updater fails to update some Windows Registry
	 entries
	 MFSA 2013-46 Use-after-free with video and onresize event
	 MFSA 2013-47 Uninitialized functions in DOMSVGZoomEvent
	 MFSA 2013-48 Memory corruption found using Address Sanitizer
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-1942</cvename>
	<cvename>CVE-2013-0801</cvename>
	<cvename>CVE-2013-1669</cvename>
	<cvename>CVE-2013-1670</cvename>
	<cvename>CVE-2013-1671</cvename>
	<cvename>CVE-2013-1672</cvename>
	<cvename>CVE-2013-1674</cvename>
	<cvename>CVE-2013-1675</cvename>
	<cvename>CVE-2013-1676</cvename>
	<cvename>CVE-2013-1677</cvename>
	<cvename>CVE-2013-1678</cvename>
	<cvename>CVE-2013-1679</cvename>
	<cvename>CVE-2013-1680</cvename>
	<cvename>CVE-2013-1681</cvename>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-40.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-41.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-42.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-43.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-44.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-45.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-46.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-47.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-48.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
 </references>
 <dates>
 <discovery>2013-05-14</discovery>
 <entry>2013-05-15</entry>
 <modified>2013-05-21</modified>
 </dates>
 </vuln>

<vuln vid="efaa4071-b700-11e2-b1b9-f0def16c5c1b">
 <topic>nginx -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><ge>1.2.0,1</ge><le>1.2.8,1</le></range>
	<range><ge>1.3.0,1</ge><lt>1.4.1,1</lt></range>
 </package>
 <package>
	<name>nginx-devel</name>
	<range><ge>1.1.4</ge><le>1.2.8</le></range>
	<range><ge>1.3.0</ge><lt>1.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 The nginx project reports:
 <blockquote cite="http://nginx.org/en/security_advisories.html">
	A stack-based buffer overflow might occur in a worker process
	 process while handling a specially crafted request, potentially
	 resulting in arbitrary code execution. [CVE-2013-2028]
	A security problem related to CVE-2013-2028 was identified,
	 affecting some previous nginx versions if proxy_pass to
	 untrusted upstream HTTP servers is used.
	The problem may lead to a denial of service or a disclosure of a
	 worker process memory on a specially crafted response from an
	 upstream proxied server. [CVE-2013-2070]
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2028</cvename>
 <cvename>CVE-2013-2070</cvename>
 <url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000114.html</url>
 <url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html</url>
 </references>
 <dates>
 <discovery>2013-05-07</discovery>
 <entry>2013-05-07</entry>
 <modified>2013-05-16</modified>
 </dates>
 </vuln>

<vuln vid="6ff570cb-b418-11e2-b279-20cf30e32f6d">
 <topic>strongSwan -- ECDSA signature verification issue</topic>
 <affects>
 <package>
	<name>strongswan</name>
	<range><lt>5.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	strongSwan security team reports:
	<blockquote cite="http://www.strongswan.org/blog/2013/04/30/strongswan-5.0.4-released-%28cve-2013-2944%29.html">
	 If the openssl plugin is used for ECDSA signature verification an empty,
	 zeroed or otherwise invalid signature is handled as a legitimate one.
	 Both IKEv1 and IKEv2 are affected.
	 Affected are only installations that have enabled and loaded the OpenSSL
	 crypto backend (--enable-openssl). Builds using the default crypto backends
	 are not affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2944</cvename>
 </references>
 <dates>
 <discovery>2013-04-30</discovery>
 <entry>2013-05-03</entry>
 </dates>
 </vuln>

<vuln vid="622e14b1-b40c-11e2-8441-00e0814cab4e">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>1.514</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory reports:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02">
	 This advisory announces multiple security vulnerabilities that
	 were found in Jenkins core.
	 <ol>
	 <li>
	 SECURITY-63 / CVE-2013-2034
	 This creates a cross-site request forgery (CSRF) vulnerability
		 on Jenkins master, where an anonymous attacker can trick an
		 administrator to execute arbitrary code on Jenkins master by
		 having him open a specifically crafted attack URL.
	 There's also a related vulnerability where the permission
		 check on this ability is done imprecisely, which may affect
		 those who are running Jenkins instances with a custom
		 authorization strategy plugin.
	 </li>
	 <li>
	 SECURITY-67 / CVE-2013-2033
	 This creates a cross-site scripting (XSS) vulnerability, where
		 an attacker with a valid user account on Jenkins can execute
		 JavaScript in the browser of other users, if those users are
		 using certain browsers.
	 </li>
	 <li>
	 SECURITY-69 / CVE-2013-2034
	 This is another CSRF vulnerability that allows an attacker to
		 cause a deployment of binaries to Maven repositories. This
		 vulnerability has the same CVE ID as SEUCRITY-63.
	 </li>
	 <li>
	 SECURITY-71 / CVE-2013-1808
	 This creates a cross-site scripting (XSS) vulnerability.
	 </li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02</url>
 <cvename>CVE-2013-2034</cvename>
 <cvename>CVE-2013-2033</cvename>
 <cvename>CVE-2013-2034</cvename>
 <cvename>CVE-2013-1808</cvename>
 </references>
 <dates>
 <discovery>2013-05-02</discovery>
 <entry>2013-05-03</entry>
 </dates>
 </vuln>

<vuln vid="e66a6e2f-b0d5-11e2-9164-0016e6dcb562">
 <topic>FreeBSD -- NFS remote denial of service</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>8.3</ge><lt>8.3_8</lt></range>
	<range><ge>9.1</ge><lt>9.1_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:05.nfsserver.asc">
	 Insufficient input validation in the NFS server allows an
	 attacker to cause the underlying file system to treat a
	 regular file as a directory.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-3266</cvename>
 <freebsdsa>SA-13:05.nfsserver</freebsdsa>
 </references>
 <dates>
 <discovery>2013-04-21</discovery>
 <entry>2013-04-29</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="57df803e-af34-11e2-8d62-6cf0490a8c18">
 <topic>Joomla! -- XXS and DDoS vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla</name>
	<range><ge>2.0.*</ge><lt>2.5.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The JSST and the Joomla! Security Center report:
	<blockquote cite="http://developer.joomla.org/security/80-20130405-core-xss-vulnerability.html">
	 <h2>[20130405] - Core - XSS Vulnerability</h2>
	 Inadequate filtering leads to XSS vulnerability in Voting plugin.
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/81-20130403-core-xss-vulnerability.html">
	 <h2>[20130403] - Core - XSS Vulnerability</h2>
	 Inadequate filtering allows possibility of XSS exploit in some
	 circumstances.
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/82-20130402-core-information-disclosure.html">
	 <h2>[20130402] - Core - Information Disclosure</h2>
	 Inadequate permission checking allows unauthorised user to see
	 permission settings in some circumstances.
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/83-20130404-core-xss-vulnerability.html">
	 <h2>[20130404] - Core - XSS Vulnerability</h2>
	 Use of old version of Flash-based file uploader leads to XSS
	 vulnerability.
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/84-20130401-core-privilege-escalation.html">
	 <h2>[20130401] - Core - Privilege Escalation</h2>
	 Inadequate permission checking allows unauthorised user to delete
	 private messages.
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/85-20130406-core-dos-vulnerability.html">
	 <h2>[20130406] - Core - DOS Vulnerability</h2>
	 Object unserialize method leads to possible denial of service
	 vulnerability.
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/86-20130407-core-xss-vulnerability.html">
	 <h2>[20130407] - Core - XSS Vulnerability</h2>
	 Inadequate filtering leads to XSS vulnerability in highlighter
	 plugin
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-3059</cvename>
 <cvename>CVE-2013-3058</cvename>
 <cvename>CVE-2013-3057</cvename>
 <url>http://developer.joomla.org/security/83-20130404-core-xss-vulnerability.html</url>
 <cvename>CVE-2013-3056</cvename>
 <cvename>CVE-2013-3242</cvename>
 <cvename>CVE-2013-3267</cvename>
 </references>
 <dates>
 <discovery>2013-04-24</discovery>
 <entry>2013-04-27</entry>
 </dates>
 </vuln>

<vuln vid="8c8fa44d-ad15-11e2-8cea-6805ca0b3d42">
 <topic>phpMyAdmin -- Multiple security vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>3.5</ge><lt>3.5.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-2.php">
	 In some PHP versions, the preg_replace() function can be
	 tricked into executing arbitrary PHP code on the
	 server. This is done by passing a crafted argument as the
	 regular expression, containing a null byte. phpMyAdmin does
	 not correctly sanitize an argument passed to preg_replace()
	 when using the "Replace table prefix" feature, opening the
	 way to this vulnerability..
	 This vulnerability can be triggered only by someone who
	 logged in to phpMyAdmin, as the usual token protection
	 prevents non-logged-in users to access the required
	 form.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-3.php">
	 phpMyAdmin can be configured to save an export file on
	 the web server, via its SaveDir directive. With this in
	 place, it's possible, either via a crafted filename template
	 or a crafted table name, to save a double extension file
	 like foobar.php.sql. In turn, an Apache webserver on which
	 there is no definition for the MIME type "sql" (the default)
	 will treat this saved file as a ".php" script, leading to
	 remote code execution.
	 This vulnerability can be triggered only by someone who
	 logged in to phpMyAdmin, as the usual token protection
	 prevents non-logged-in users to access the required
	 form. Moreover, the SaveDir directive is empty by default,
	 so a default configuration is not vulnerable. The
	 $cfg['SaveDir'] directive must be configured, and the server
	 must be running Apache with mod_mime to be exploitable.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-3238</cvename>
 <cvename>CVE-2013-3239</cvename>
 </references>
 <dates>
 <discovery>2013-04-24</discovery>
 <entry>2013-04-24</entry>
 </dates>
 </vuln>

<vuln vid="aeb962f6-ab8d-11e2-b3f5-003067c2616f">
 <topic>tinc -- Buffer overflow</topic>
 <affects>
 <package>
	<name>tinc</name>
	<range><lt>1.0.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	tinc-vpn.org reports:
	<blockquote cite="http://www.tinc-vpn.org/news/">
	 Drop packets forwarded via TCP if they are too big.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1428</cvename>
 </references>
 <dates>
 <discovery>2013-01-26</discovery>
 <entry>2013-04-22</entry>
 </dates>
 </vuln>

<vuln vid="7280c3f6-a99a-11e2-8cef-6805ca0b3d42">
 <topic>phpMyAdmin -- XSS due to unescaped HTML output in GIS visualisation page</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>3.5</ge><lt>3.5.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php">
	 When modifying a URL parameter with a crafted value it
	 is possible to trigger an XSS.
	 These XSS can only be triggered when a valid database is
	 known and when a valid cookie token is used.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1937</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php</url>
 </references>
 <dates>
 <discovery>2013-04-18</discovery>
 <entry>2013-04-20</entry>
 </dates>
 </vuln>

<vuln vid="a592e991-a919-11e2-ade0-8c705af55518">
 <topic>roundcube -- arbitrary file disclosure vulnerability</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><lt>0.8.6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RoundCube development team reports:
	<blockquote cite="http://lists.roundcube.net/pipermail/dev/2013-March/022337.html">
	 After getting reports about a possible vulnerability
	 of Roundcube which allows an attacker to modify its
	 users preferences in a way that he/she can then read
	 files from the server, we now published updated packages
	 as well as patches that fix this security issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1904</cvename>
 <url>https://secunia.com/advisories/52806/</url>
 </references>
 <dates>
 <discovery>2013-03-27</discovery>
 <entry>2013-04-19</entry>
 </dates>
 </vuln>

<vuln vid="8ff84335-a7da-11e2-b3f5-003067c2616f">
 <topic>jasper -- buffer overflow</topic>
 <affects>
 <package>
	<name>jasper</name>
	<range><lt>1.900.1_12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Fedora reports:
	<blockquote cite="http://www.kb.cert.org/vuls/id/887409">
	 JasPer fails to properly decode marker segments and other
	 sections in malformed JPEG2000 files. Malformed inputs can
	 cause heap buffer overflows which in turn may result in
	 execution of attacker-controlled code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3520</cvename>
 <cvename>CVE-2008-3522</cvename>
 <cvename>CVE-2011-4516</cvename>
 <cvename>CVE-2011-4517</cvename>
 <url>http://www.kb.cert.org/vuls/id/887409</url>
 </references>
 <dates>
 <discovery>2011-12-09</discovery>
 <entry>2013-04-18</entry>
 </dates>
 </vuln>

<vuln vid="2070c79a-8e1e-11e2-b34d-000c2957946c">
 <topic>ModSecurity -- XML External Entity Processing Vulnerability</topic>
 <affects>
 <package>
	<name>mod_security</name>
	<range><gt>2.*</gt><lt>2.7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Positive Technologies has reported a vulnerability in ModSecurity,
	 which can be exploited by malicious people to disclose potentially
	 sensitive information or cause a DoS (Denial Of Serice).
	The vulnerability is caused due to an error when parsing external
	 XML entities and can be exploited to e.g. disclose local files or
	 cause excessive memory and CPU consumption.
	<blockquote cite="https://secunia.com/advisories/52847/">
	 .
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1915</cvename>
 <url>https://secunia.com/advisories/52847/</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1915</url>
 <url>https://bugs.gentoo.org/show_bug.cgi?id=464188</url>
 </references>
 <dates>
 <discovery>2013-04-02</discovery>
 <entry>2013-04-16</entry>
 </dates>
 </vuln>

<vuln vid="a2ff483f-a5c6-11e2-9601-000d601460a4">
 <topic>sieve-connect -- TLS hostname verification was not occurring</topic>
 <affects>
 <package>
	<name>sieve-connect</name>
	<range><lt>0.85</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	sieve-connect developer Phil Pennock reports:
	<blockquote cite="http://mail.globnix.net/pipermail/sieve-connect-announce/2013/000005.html">
	 sieve-connect was not actually verifying TLS certificate identities
	 matched the expected hostname.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://mail.globnix.net/pipermail/sieve-connect-announce/2013/000005.html</url>
 </references>
 <dates>
 <discovery>2013-04-14</discovery>
 <entry>2013-04-15</entry>
 </dates>
 </vuln>

<vuln vid="15236023-a21b-11e2-a460-208984377b34">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.280</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-12.html">
	 These updates address vulnerabilities that could cause a crash
	 and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1383</cvename>
 <cvename>CVE-2013-1384</cvename>
 <cvename>CVE-2013-1385</cvename>
 <cvename>CVE-2013-1386</cvename>
 </references>
 <dates>
 <discovery>2013-04-09</discovery>
 <entry>2013-04-10</entry>
 </dates>
 </vuln>

<vuln vid="db0c4b00-a24c-11e2-9601-000d601460a4">
 <topic>rubygem-rails -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-rails</name>
	<range><lt>3.2.13</lt></range>
 </package>
 <package>
	<name>rubygem-actionpack</name>
	<range><lt>3.2.13</lt></range>
 </package>
 <package>
	<name>rubygem-activerecord</name>
	<range><lt>3.2.13</lt></range>
 </package>
 <package>
	<name>rubygem-activesupport</name>
	<range><lt>3.2.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails team reports:
	<blockquote cite="http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/">
	 Rails versions 3.2.13 has been released. This release
	 contains important security fixes. It is recommended
	 users upgrade as soon as possible.
	 Four vulnerabilities have been discovered and fixed:
	 <ol>
	 <li>(CVE-2013-1854) Symbol DoS vulnerability in Active Record</li>
	 <li>(CVE-2013-1855) XSS vulnerability in sanitize_css in Action Pack</li>
	 <li>(CVE-2013-1856) XML Parsing Vulnerability affecting JRuby users</li>
	 <li>(CVE-2013-1857) XSS Vulnerability in the `sanitize` helper of Ruby on Rails</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2013-1854</cvename>
	<cvename>CVE-2013-1856</cvename>
	<cvename>CVE-2013-1856</cvename>
	<cvename>CVE-2013-1857</cvename>
	<url>http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/</url>
	<url>https://groups.google.com/forum/#!topic/ruby-security-ann/o0Dsdk2WrQ0</url>
	<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_QHo4BqnN8</url>
	<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/KZwsQbYsOiI</url>
	<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/zAAU7vGTPvI</url>
 </references>
 <dates>
 <discovery>2013-03-18</discovery>
 <entry>2013-04-10</entry>
 </dates>
 </vuln>

<vuln vid="1431f2d6-a06e-11e2-b9e0-001636d274f3">
 <topic>NVIDIA UNIX driver -- ARGB cursor buffer overflow in "NoScanout" mode</topic>
 <affects>
 <package>
	<name>nvidia-driver</name>
	<range><ge>310.14</ge><lt>310.44</lt></range>
	<range><ge>195.22</ge><lt>304.88</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVIDIA Unix security team reports:
	<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3290">
	 When the NVIDIA driver for the X Window System is operated in
	 "NoScanout" mode, and an X client installs an ARGB cursor that
	 is larger than the expected size (64x64 or 256x256, depending on
	 the driver version), the driver will overflow a buffer. This
	 can cause a denial of service (e.g., an X server segmentation
	 fault), or could be exploited to achieve arbitrary code
	 execution. Because the X server runs as setuid root in many
	 configurations, an attacker could potentially use this
	 vulnerability in those configurations to gain root privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0131</cvename>
 <url>http://nvidia.custhelp.com/app/answers/detail/a_id/3290</url>
 </references>
 <dates>
 <discovery>2013-03-27</discovery>
 <entry>2013-04-08</entry>
 </dates>
 </vuln>

<vuln vid="cebed39d-9e6f-11e2-b3f5-003067c2616f">
 <topic>opera -- moderately severe issue</topic>
 <affects>
 <package>
	<name>opera</name>
	<range><lt>12.15</lt></range>
 </package>
 <package>
	<name>opera-devel</name>
	<range><lt>12.15</lt></range>
 </package>
 <package>
	<name>linux-opera</name>
	<range><lt>12.15</lt></range>
 </package>
 <package>
	<name>linux-opera-devel</name>
	<range><lt>12.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera reports:
	<blockquote cite="http://www.opera.com/support/kb/view/1042/">
	 Fixed a moderately severe issue, as reported by Attila Suszte.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.opera.com/docs/changelogs/unified/1215/</url>
 <url>http://www.opera.com/support/kb/view/1046/</url>
 <url>http://www.opera.com/support/kb/view/1047/</url>
 </references>
 <dates>
 <discovery>2013-04-04</discovery>
 <entry>2014-04-30</entry>
 </dates>
 </vuln>

<vuln vid="b6beb137-9dc0-11e2-882f-20cf30e32f6d">
 <topic>Subversion -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
	<range><ge>1.0.0</ge><lt>1.6.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion team reports:
	 <blockquote cite="http://subversion.apache.org/security/CVE-2013-1845-advisory.txt">
	 Subversion's mod_dav_svn Apache HTTPD server module will use excessive
	 amounts of memory when a large number of properties are set or deleted
	 on a node.
	</blockquote>
	 <blockquote cite="http://subversion.apache.org/security/CVE-2013-1846-advisory.txt">
	 Subversion's mod_dav_svn Apache HTTPD server module will crash when
	 a LOCK request is made against activity URLs.
	</blockquote>
	<blockquote cite="http://subversion.apache.org/security/CVE-2013-1847-advisory.txt">
	 Subversion's mod_dav_svn Apache HTTPD server module will crash in some
	 circumstances when a LOCK request is made against a non-existent URL.
	</blockquote>
	<blockquote cite="http://subversion.apache.org/security/CVE-2013-1849-advisory.txt">
	 Subversion's mod_dav_svn Apache HTTPD server module will crash when a
	 PROPFIND request is made against activity URLs.
	</blockquote>
	<blockquote cite="http://subversion.apache.org/security/CVE-2013-1884-advisory.txt">
	 Subversion's mod_dav_svn Apache HTTPD server module will crash when a
	 log REPORT request receives a limit that is out of the allowed range.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1845</cvename>
 <cvename>CVE-2013-1846</cvename>
 <cvename>CVE-2013-1847</cvename>
 <cvename>CVE-2013-1849</cvename>
 <cvename>CVE-2013-1884</cvename>
 </references>
 <dates>
 <discovery>2013-04-05</discovery>
 <entry>2013-04-05</entry>
 </dates>
 </vuln>

<vuln vid="eae8e3cf-9dfe-11e2-ac7f-001fd056c417">
 <topic>otrs -- Information disclosure and Data manipulation</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><lt>3.1.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OTRS Project reports:
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-01/">
		An attacker with a valid agent login could manipulate URLs in the
		 object linking mechanism to see titles of tickets and other objects
		 that are not obliged to be seen. Furthermore, links to objects without
		 permission can be placed and removed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2625</cvename>
 <url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-01/</url>
 </references>
 <dates>
 <discovery>2013-04-02</discovery>
 <entry>2013-04-05</entry>
 </dates>
 </vuln>

<vuln vid="3f332f16-9b6b-11e2-8fe9-08002798f6ff">
 <topic>PostgreSQL -- anonymous remote access data corruption vulnerability</topic>
 <affects>
 <package>
	<name>postgresql-server</name>
	<range><ge>8.3.0</ge><lt>8.3.21_1</lt></range>
	<range><ge>8.4.0</ge><lt>8.4.17</lt></range>
	<range><ge>9.0.0</ge><lt>9.0.13</lt></range>
	<range><ge>9.1.0</ge><lt>9.1.9</lt></range>
	<range><ge>9.2.0</ge><lt>9.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL project reports:
	<blockquote cite="http://www.postgresql.org/about/news/1456/">
	 
	 The PostgreSQL Global Development Group has released a security
	 update to all current versions of the PostgreSQL database system,
	 including versions 9.2.4, 9.1.9, 9.0.13, and 8.4.17. This update
	 fixes a high-exposure security vulnerability in versions 9.0 and
	 later. All users of the affected versions are strongly urged to apply
	 the update *immediately*.
	 
	 
	 A major security issue (for versions 9.x only) fixed in this release,
	 [CVE-2013-1899](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899),
	 makes it possible for a connection request containing a database name
	 that begins with "-" to be crafted that can damage or destroy files
	 within a server's data directory. Anyone with access to the port the
	 PostgreSQL server listens on can initiate this request. This issue was
	 discovered by Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source
	 Software Center.
	 
	 
	 Two lesser security fixes are also included in this release:
	 [CVE-2013-1900](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1900),
	 wherein random numbers generated by contrib/pgcrypto functions may be
	 easy for another database user to guess (all versions), and
	 [CVE-2013-1901](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1901),
	 which mistakenly allows an unprivileged user to run commands that
	 could interfere with in-progress backups (for versions 9.x only).
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1899</cvename>
 <cvename>CVE-2013-1900</cvename>
 <cvename>CVE-2013-1901</cvename>
 </references>
 <dates>
 <discovery>2013-04-04</discovery>
 <entry>2013-04-04</entry>
 </dates>
 </vuln>

<vuln vid="94976433-9c74-11e2-a9fc-d43d7e0c7c02">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>18.0,1</gt><lt>20.0,1</lt></range>
	<range><lt>17.0.5,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>17.0.5,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.17</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.5</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.17</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2013-30 Miscellaneous memory safety hazards (rv:20.0 /
	 rv:17.0.5)
	 MFSA 2013-31 Out-of-bounds write in Cairo library
	 MFSA 2013-32 Privilege escalation through Mozilla Maintenance
	 Service
	 MFSA 2013-33 World read and write access to app_tmp directory on
	 Android
	 MFSA 2013-34 Privilege escalation through Mozilla Updater
	 MFSA 2013-35 WebGL crash with Mesa graphics driver on Linux
	 MFSA 2013-36 Bypass of SOW protections allows cloning of protected
	 nodes
	 MFSA 2013-37 Bypass of tab-modal dialog origin disclosure
	 MFSA 2013-38 Cross-site scripting (XSS) using timed history
	 navigations
	 MFSA 2013-39 Memory corruption while rendering grayscale PNG
	 images
	 MFSA 2013-40 Out-of-bounds array read in CERT_DecodeCertPackage
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2013-0788</cvename>
	<cvename>CVE-2013-0789</cvename>
	<cvename>CVE-2013-0790</cvename>
	<cvename>CVE-2013-0791</cvename>
	<cvename>CVE-2013-0792</cvename>
	<cvename>CVE-2013-0793</cvename>
	<cvename>CVE-2013-0794</cvename>
	<cvename>CVE-2013-0795</cvename>
	<cvename>CVE-2013-0796</cvename>
	<cvename>CVE-2013-0797</cvename>
	<cvename>CVE-2013-0798</cvename>
	<cvename>CVE-2013-0799</cvename>
	<cvename>CVE-2013-0800</cvename>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-30.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-31.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-32.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-33.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-34.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-35.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-36.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-37.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-38.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-39.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-40.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
 </references>
 <dates>
 <discovery>2013-04-02</discovery>
 <entry>2013-04-03</entry>
 <modified>2013-04-08</modified>
 </dates>
 </vuln>

<vuln vid="13031d98-9bd1-11e2-a7be-8c705af55518">
 <topic>FreeBSD -- BIND remote denial of service</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.0</ge><lt>9.0_7</lt></range>
	<range><ge>9.1</ge><lt>9.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:04.bind.asc">
	 A flaw in a library used by BIND allows an
	 attacker to deliberately cause excessive memory
	 consumption by the named(8) process. This
	 affects both recursive and authoritative
	 servers.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2266</cvename>
 <freebsdsa>SA-13:04.bind</freebsdsa>
 <url>https://kb.isc.org/article/AA-00871</url>
 </references>
 <dates>
 <discovery>2013-04-02</discovery>
 <entry>2013-04-02</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="69bfc852-9bd0-11e2-a7be-8c705af55518">
 <topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>8.3</ge><lt>8.3_7</lt></range>
	<range><ge>9.0</ge><lt>9.0_7</lt></range>
	<range><ge>9.1</ge><lt>9.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:03.openssl.asc">
	 A flaw in the OpenSSL handling of OCSP response
	 verification could be exploited to cause a denial of
	 service attack.
	 OpenSSL has a weakness in the handling of CBC
	 ciphersuites in SSL, TLS and DTLS. The weakness could reveal
	 plaintext in a timing attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0166</cvename>
 <cvename>CVE-2013-0169</cvename>
 <freebsdsa>SA-13:03.openssl</freebsdsa>
 <url>http://www.openssl.org/news/secadv_20130205.txt</url>
 </references>
 <dates>
 <discovery>2013-04-02</discovery>
 <entry>2013-04-02</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="92f30415-9935-11e2-ad4c-080027ef73ec">
 <topic>OpenVPN -- potential side-channel/timing attack when comparing HMACs</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><lt>2.0.9_4</lt></range>
	<range><ge>2.1.0</ge><lt>2.2.2_2</lt></range>
	<range><ge>2.3.0</ge><lt>2.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenVPN project reports:
	<blockquote cite="https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc">
	 OpenVPN 2.3.0 and earlier running in UDP mode are subject
	 to chosen ciphertext injection due to a non-constant-time
	 HMAC comparison function.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc</url>
 <cvename>CVE-2013-2061</cvename>
 <url>http://www.openwall.com/lists/oss-security/2013/05/06/6</url>
 <url>https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee</url>
 </references>
 <dates>
 <discovery>2013-03-19</discovery>
 <entry>2013-03-31</entry>
 <modified>2013-06-01</modified>
 </dates>
 </vuln>

<vuln vid="843a4641-9816-11e2-9c51-080027019be0">
 <topic>libxml2 -- cpu consumption Dos</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.8.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kurt Seifried reports:
	<blockquote cite="http://seclists.org/oss-sec/2013/q1/391">
	 libxml2 is affected by the expansion of internal entities
	 (which can be used to consume resources) and external entities
	 (which can cause a denial of service against other services,
	 be used to port scan, etc.)..
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0338</cvename>
 <cvename>CVE-2013-0339</cvename>
 <url>http://seclists.org/oss-sec/2013/q1/391</url>
 <url>https://security-tracker.debian.org/tracker/CVE-2013-0338</url>
 <url>https://security-tracker.debian.org/tracker/CVE-2013-0339</url>
 </references>
 <dates>
 <discovery>2013-02-21</discovery>
 <entry>2013-03-29</entry>
 </dates>
 </vuln>

<vuln vid="daf0a339-9850-11e2-879e-d43d7e0c7c02">
 <topic>asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk11</name>
	<range><gt>11.*</gt><lt>11.2.2</lt></range>
 </package>
 <package>
	<name>asterisk10</name>
	<range><gt>10.*</gt><lt>10.12.2</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.20.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/security">
	 Buffer Overflow Exploit Through SIP SDP Header
	 Username disclosure in SIP channel driver
	 Denial of Service in HTTP server
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-2685</cvename>
 <cvename>CVE-2013-2686</cvename>
 <cvename>CVE-2013-2264</cvename>
 <url>http://downloads.asterisk.org/pub/security/AST-2013-001.html</url>
 <url>http://downloads.asterisk.org/pub/security/AST-2013-002.html</url>
 <url>http://downloads.asterisk.org/pub/security/AST-2013-003.html</url>
 <url>https://www.asterisk.org/security</url>
 </references>
 <dates>
 <discovery>2013-03-27</discovery>
 <entry>2013-03-29</entry>
 </dates>
 </vuln>

<vuln vid="7a282e49-95b6-11e2-8433-0800273fe665">
 <topic>dns/bind9* -- Malicious Regex Can Cause Memory Exhaustion</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><lt>9.9.2.2</lt></range>
 </package>
 <package>
	<name>bind99-base</name>
	<range><lt>9.9.2.2</lt></range>
 </package>
 <package>
	<name>bind98</name>
	<range><lt>9.8.4.2</lt></range>
 </package>
 <package>
	<name>bind98-base</name>
	<range><lt>9.8.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-00871">
	 A critical defect in BIND 9 allows an attacker to cause
	 excessive memory consumption in named or other programs
	 linked to libdns.
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2013-2266</cvename>
 </references>
 <dates>
 <discovery>2013-03-11</discovery>
 <entry>2013-03-27</entry>
 </dates>
 </vuln>

<vuln vid="6adca5e9-95d2-11e2-8549-68b599b52a02">
 <topic>firebird -- Remote Stack Buffer Overflow</topic>
 <affects>
 <package>
	<name>firebird25-server</name>
	<range><ge>2.5.0</ge><le>2.5.2</le></range>
 </package>
 <package>
	<name>firebird21-server</name>
	<range><ge>2.1.0</ge><le>2.1.5</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Firebird Project reports:
	<blockquote cite="http://tracker.firebirdsql.org/browse/CORE-4058">
	 The FirebirdSQL server is vulnerable to a stack buffer overflow
	 that can be triggered when an unauthenticated user sends a
	 specially crafted packet. The result can lead to remote code
	 execution as the user which runs the FirebirdSQL server.
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2013-2492</cvename>
	<url>https://gist.github.com/zeroSteiner/85daef257831d904479c</url>
 </references>
 <dates>
 <discovery>2013-01-31</discovery>
 <entry>2013-03-06</entry>
 </dates>
 </vuln>

<vuln vid="a8818f7f-9182-11e2-9bdf-d48564727302">
 <topic>optipng -- use-after-free vulnerability</topic>
 <affects>
 <package>
	<name>optipng</name>
	<range><ge>0.7</ge><lt>0.7.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="https://secunia.com/advisories/50654">
	 A vulnerability has been reported in OptiPNG, which can be
	 exploited by malicious people to potentially compromise a user's
	 system.
	 The vulnerability is caused due to a use-after-free error related
	 to the palette reduction functionality. No further information is
	 currently available.
	 Success exploitation may allow execution of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4432</cvename>
 <url>https://secunia.com/advisories/50654</url>
 </references>
 <dates>
 <discovery>2012-09-16</discovery>
 <entry>2013-03-21</entry>
 </dates>
 </vuln>

<vuln vid="1d23109a-9005-11e2-9602-d43d7e0c7c02">
 <topic>php5 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.4.13</lt></range>
 </package>
 <package>
	<name>php53</name>
	<range><lt>5.3.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP development team reports:
	<blockquote cite="http://www.php.net/ChangeLog-5.php">
	 PHP does not validate the relationship between the soap.wsdl_cache_dir
	 directive and the open_basedir directive, which allows remote attackers to
	 bypass intended access restrictions by triggering the creation of cached
	 SOAP WSDL files in an arbitrary directory.
	 The SOAP parser in PHP allows remote attackers to read arbitrary files
	 via a SOAP WSDL file containing an XML external entity declaration in
	 conjunction with an entity reference, related to an XML External Entity
	 (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1635</cvename>
 <cvename>CVE-2013-1643</cvename>
 </references>
 <dates>
 <discovery>2013-03-04</discovery>
 <entry>2013-03-18</entry>
 </dates>
 </vuln>

<vuln vid="edd201a5-8fc3-11e2-b131-000c299b62e1">
 <topic>piwigo -- CSRF/Path Traversal</topic>
 <affects>
 <package>
	<name>piwigo</name>
	<range><lt>2.4.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	High-Tech Bridge Security Research Lab reports:
	<blockquote cite="http://piwigo.org/releases/2.4.7">
	 The CSRF vulnerability exists due to insufficient verification of the
	 HTTP request origin in "/admin.php" script. A remote attacker can trick
	 a logged-in administrator to visit a specially crafted webpage and
	 create arbitrary PHP file on the remote server.
	 The path traversal vulnerability exists due to insufficient filtration
	 of user-supplied input in "dl" HTTP GET parameter passed to
	 "/install.php" script. The script is present on the system after
	 installation by default, and can be accessed by attacker without any
	 restrictions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1468</cvename>
 <cvename>CVE-2013-1469</cvename>
 <url>http://piwigo.org/bugs/view.php?id=0002843</url>
 <url>http://piwigo.org/bugs/view.php?id=0002844</url>
 <url>http://dl.packetstormsecurity.net/1302-exploits/piwigo246-traversalxsrf.txt</url>
 </references>
 <dates>
 <discovery>2013-02-06</discovery>
 <entry>2013-03-18</entry>
 </dates>
 </vuln>

<vuln vid="d881d254-70c6-11e2-862d-080027a5ec9a">
 <topic>libexif -- multiple remote vulnerabilities</topic>
 <affects>
 <package>
	<name>libexif</name>
	<range><lt>0.6.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libexif project security advisory:
	<blockquote cite="http://sourceforge.net/mailarchive/message.php?msg_id=29534027">
	 A number of remotely exploitable issues were discovered in libexif
	 and exif, with effects ranging from information leakage to potential
	 remote code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2812</cvename>
 <cvename>CVE-2012-2813</cvename>
 <cvename>CVE-2012-2814</cvename>
 <cvename>CVE-2012-2836</cvename>
 <cvename>CVE-2012-2837</cvename>
 <cvename>CVE-2012-2840</cvename>
 <cvename>CVE-2012-2841</cvename>
 <cvename>CVE-2012-2845</cvename>
 <bid>54437</bid>
 </references>
 <dates>
 <discovery>2012-07-12</discovery>
 <entry>2013-03-13</entry>
 </dates>
 </vuln>

<vuln vid="5ff40cb4-8b92-11e2-bdb6-001060e06fd4">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.275</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-09.html">
	 These updates address vulnerabilities that could cause a crash
	 and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0646</cvename>
 <cvename>CVE-2013-0650</cvename>
 <cvename>CVE-2013-1371</cvename>
 <cvename>CVE-2013-1375</cvename>
 </references>
 <dates>
 <discovery>2013-03-12</discovery>
 <entry>2013-03-12</entry>
 </dates>
 </vuln>

<vuln vid="cda566a0-2df0-4eb0-b70e-ed7a6fb0ab3c">
 <topic>puppet27 and puppet -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>puppet</name>
	<range><ge>3.0</ge><lt>3.1.1</lt></range>
 </package>
 <package>
	<name>puppet27</name>
	<range><ge>2.7</ge><lt>2.7.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Moses Mendoza reports:
	<blockquote cite="https://puppetlabs.com/blog/security-updates-new-releases-of-puppet-and-puppet-enterprise/">
	 A vulnerability found in Puppet could allow an authenticated client
	 to cause the master to execute arbitrary code while responding to a
	 catalog request. Specifically, in order to exploit the
	 vulnerability, the puppet master must be made to invoke the
	 'template' or 'inline_template' functions during catalog compilation.
	 
	 A vulnerability found in Puppet could allow an authenticated client
	 to connect to a puppet master and perform unauthorized actions.
	 Specifically, given a valid certificate and private key, an agent
	 could retrieve catalogs from the master that it is not authorized
	 to access or it could poison the puppet master's caches for any
	 puppet-generated data that supports caching such as catalogs,
	 nodes, facts, and resources. The extent and severity of this
	 vulnerability varies depending on the specific configuration of the
	 master: for example, whether it is using storeconfigs or not, which
	 version, whether it has access to the cache or not, etc.
	 
	 A vulnerability has been found in Puppet which could allow
	 authenticated clients to execute arbitrary code on agents that have
	 been configured to accept kick connections. This vulnerability is
	 not present in the default configuration of puppet agents, but if
	 they have been configured to listen for incoming connections
	 ('listen=true'), and the agent's auth.conf has been configured to
	 allow access to the `run` REST endpoint, then a client could
	 construct an HTTP request which could execute arbitrary code. The
	 severity of this issue is exacerbated by the fact that puppet
	 agents typically run as root.
	 
	 A vulnerability has been found in Puppet that could allow a client
	 negotiating a connection to a master to downgrade the master's
	 SSL protocol to SSLv2. This protocol has been found to contain
	 design weaknesses. This issue only affects systems running older
	 versions (pre 1.0.0) of openSSL. Newer versions explicitly disable
	 SSLv2.
	 
	 A vulnerability found in Puppet could allow unauthenticated clients
	 to send requests to the puppet master which would cause it to load
	 code unsafely. While there are no reported exploits, this
	 vulnerability could cause issues like those described in Rails
	 CVE-2013-0156. This vulnerability only affects puppet masters
	 running Ruby 1.9.3 and higher.
	 
	 This vulnerability affects puppet masters 0.25.0 and above. By
	 default, auth.conf allows any authenticated node to submit a report
	 for any other node. This can cause issues with compliance. The
	 defaults in auth.conf have been changed.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1640</cvename>
 <cvename>CVE-2013-1652</cvename>
 <cvename>CVE-2013-1653</cvename>
 <cvename>CVE-2013-1654</cvename>
 <cvename>CVE-2013-1655</cvename>
 <cvename>CVE-2013-2275</cvename>
 <url>https://puppetlabs.com/security/cve/cve-2013-1640/</url>
 <url>https://puppetlabs.com/security/cve/cve-2013-1652/</url>
 <url>https://puppetlabs.com/security/cve/cve-2013-1653/</url>
 <url>https://puppetlabs.com/security/cve/cve-2013-1654/</url>
 <url>https://puppetlabs.com/security/cve/cve-2013-1655/</url>
 <url>https://puppetlabs.com/security/cve/cve-2013-2275/</url>
 <url>https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/f_gybceSV6E</url>
 <url>https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/kgDyaPhHniw</url>
 </references>
 <dates>
 <discovery>2013-03-13</discovery>
 <entry>2013-03-13</entry>
 </dates>
 </vuln>

<vuln vid="04042f95-14b8-4382-a8b9-b30e365776cf">
 <topic>puppet26 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>puppet26</name>
	<range><ge>2.6</ge><lt>2.6.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Moses Mendoza reports:
	<blockquote cite="https://puppetlabs.com/blog/security-updates-new-releases-of-puppet-and-puppet-enterprise/">
	 A vulnerability found in Puppet could allow an authenticated client
	 to cause the master to execute arbitrary code while responding to a
	 catalog request. Specifically, in order to exploit the
	 vulnerability, the puppet master must be made to invoke the
	 'template' or 'inline_template' functions during catalog compilation.
	 
	 A vulnerability found in Puppet could allow an authenticated client
	 to connect to a puppet master and perform unauthorized actions.
	 Specifically, given a valid certificate and private key, an agent
	 could retrieve catalogs from the master that it is not authorized
	 to access or it could poison the puppet master's caches for any
	 puppet-generated data that supports caching such as catalogs,
	 nodes, facts, and resources. The extent and severity of this
	 vulnerability varies depending on the specific configuration of the
	 master: for example, whether it is using storeconfigs or not, which
	 version, whether it has access to the cache or not, etc.
	 
	 A vulnerability has been found in Puppet that could allow a client
	 negotiating a connection to a master to downgrade the master's
	 SSL protocol to SSLv2. This protocol has been found to contain
	 design weaknesses. This issue only affects systems running older
	 versions (pre 1.0.0) of openSSL. Newer versions explicitly disable
	 SSLv2.
	 
	 A vulnerability found in Puppet could allow an authenticated client
	 to execute arbitrary code on a puppet master that is running in the
	 default configuration, or an agent with `puppet kick` enabled.
	 Specifically, a properly authenticated and connected puppet agent
	 could be made to construct an HTTP PUT request for an authorized
	 report that actually causes the execution of arbitrary code on the
	 master.
	 
	 This vulnerability affects puppet masters 0.25.0 and above. By
	 default, auth.conf allows any authenticated node to submit a report
	 for any other node. This can cause issues with compliance. The
	 defaults in auth.conf have been changed.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1640</cvename>
 <cvename>CVE-2013-1652</cvename>
 <cvename>CVE-2013-1654</cvename>
 <cvename>CVE-2013-2274</cvename>
 <cvename>CVE-2013-2275</cvename>
 <url>https://puppetlabs.com/security/cve/cve-2013-1640/</url>
 <url>https://puppetlabs.com/security/cve/cve-2013-1652/</url>
 <url>https://puppetlabs.com/security/cve/cve-2013-1654/</url>
 <url>https://puppetlabs.com/security/cve/cve-2013-2274/</url>
 <url>https://puppetlabs.com/security/cve/cve-2013-2275/</url>
 </references>
 <dates>
 <discovery>2013-03-13</discovery>
 <entry>2013-03-13</entry>
 </dates>
 </vuln>

<vuln vid="68c1f75b-8824-11e2-9996-c48508086173">
 <topic>perl -- denial of service via algorithmic complexity attack on hashing routines</topic>
 <affects>
 <package>
	<name>perl</name>
	<name>perl-threaded</name>
	<range><lt>5.12.4_5</lt></range>
	<range><ge>5.14.0</ge><lt>5.14.2_3</lt></range>
	<range><ge>5.16.0</ge><lt>5.16.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Perl developers report:
	<blockquote cite="http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html">
	 In order to prevent an algorithmic complexity attack
	 against its hashing mechanism, perl will sometimes
	 recalculate keys and redistribute the contents of a hash.
	 This mechanism has made perl robust against attacks that
	 have been demonstrated against other systems.
	 Research by Yves Orton has recently uncovered a flaw in
	 the rehashing code which can result in pathological
	 behavior. This flaw could be exploited to carry out a
	 denial of service attack against code that uses arbitrary
	 user input as hash keys.
	 Because using user-provided strings as hash keys is a
	 very common operation, we urge users of perl to update their
	 perl executable as soon as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1667</cvename>
 <url>http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html</url>
 </references>
 <dates>
 <discovery>2013-03-04</discovery>
 <entry>2013-03-10</entry>
 <modified>2016-08-22</modified>
 </dates>
 </vuln>

<vuln vid="549787c1-8916-11e2-8549-68b599b52a02">
 <topic>libpurple -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libpurple</name>
	<range><lt>2.10.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pidgin reports:
	<blockquote cite="https://developer.pidgin.im/wiki/ChangeLog">
	 libpurple
	 Fix a crash when receiving UPnP responses with abnormally long values.
	 MXit
	 Fix two bugs where a remote MXit user could possibly specify a local file
	 path to be written to.
	 Fix a bug where the MXit server or a man-in-the-middle could potentially
	 send specially crafted data that could overflow a buffer and lead to a crash
	 or remote code execution.
	 Sametime
	 Fix a crash in Sametime when a malicious server sends us an abnormally long
	 user ID.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0274</cvename>
 <cvename>CVE-2013-0271</cvename>
 <cvename>CVE-2013-0272</cvename>
 <cvename>CVE-2013-0273</cvename>
 <url>https://developer.pidgin.im/wiki/ChangeLog</url>
 </references>
 <dates>
 <discovery>2013-02-13</discovery>
 <entry>2013-03-10</entry>
 <modified>2013-03-16</modified>
 </dates>
 </vuln>

<vuln vid="630c8c08-880f-11e2-807f-d43d7e0c7c02">
 <topic>mozilla -- use-after-free in HTML Editor</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>18.0,1</gt><lt>19.0.2,1</lt></range>
	<range><lt>17.0.3,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>17.0.4,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.16.1</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.4</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.16.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0.4</lt></range>
	<range><lt>10.0.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2013-29 Use-after-free in HTML Editor
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2013-0787</cvename>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-29.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
 </references>
 <dates>
 <discovery>2013-03-07</discovery>
 <entry>2013-03-08</entry>
 </dates>
 </vuln>

<vuln vid="b9a347ac-8671-11e2-b73c-0019d18c446a">
 <topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
 <affects>
 <package>
	<name>typo3</name>
	<range><ge>4.5.0</ge><lt>4.5.23</lt></range>
	<range><ge>4.6.0</ge><lt>4.6.16</lt></range>
	<range><ge>4.7.0</ge><lt>4.7.8</lt></range>
	<range><ge>6.0.0</ge><lt>6.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Typo Security Team reports:
	<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/">
	 Extbase Framework - Failing to sanitize user input, the Extbase
	 database abstraction layer is susceptible to SQL Injection. TYPO3
	 sites which have no Extbase extensions installed are not affected.
	 Extbase extensions are affected if they use the Query Object Model
	 and relation values are user generated input. Credits go to Helmut
	 Hummel and Markus Opahle who discovered and reported the issue.
	 Access tracking mechanism - Failing to validate user provided
	 input, the access tracking mechanism allows redirects to arbitrary
	 URLs. To fix this vulnerability, we had to break existing
	 behaviour of TYPO3 sites that use the access tracking mechanism
	 (jumpurl feature) to transform links to external sites. The link
	 generation has been changed to include a hash that is checked
	 before redirecting to an external URL. This means that old links
	 that have been distributed (e.g. by a newsletter) will not work
	 any more.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/</url>
 </references>
 <dates>
 <discovery>2013-03-06</discovery>
 <entry>2013-03-06</entry>
 </dates>
 </vuln>

<vuln vid="c97219b6-843d-11e2-b131-000c299b62e1">
 <topic>stunnel -- Remote Code Execution</topic>
 <affects>
 <package>
	<name>stunnel</name>
	<range><ge>4.21</ge><lt>4.55</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michal Trojnara reports:
	<blockquote cite="https://www.stunnel.org/CVE-2013-1762.html">
	 64-bit versions of stunnel with the following conditions:
	 * NTLM authentication enabled
	 * CONNECT protocol negotiation enabled
	 * Configured in SSL client mode
	 * An attacker that can either control the proxy server specified in
	 the "connect" option or execute MITM attacks on the TCP session
	 between stunnel and the proxy
	 Can be exploited for remote code execution. The code is executed
	 within the configured chroot directory, with privileges of the
	 configured user and group.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1762</cvename>
 <url>https://www.stunnel.org/CVE-2013-1762.html</url>
 </references>
 <dates>
 <discovery>2013-03-03</discovery>
 <entry>2013-03-03</entry>
 </dates>
 </vuln>

<vuln vid="9c88d8a8-8372-11e2-a010-20cf30e32f6d">
 <topic>apache22 -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>apache22</name>
	<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
 </package>
 <package>
	<name>apache22-event-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
 </package>
 <package>
	<name>apache22-itk-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
 </package>
 <package>
	<name>apache22-peruser-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
 </package>
 <package>
	<name>apache22-worker-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Apache HTTP SERVER PROJECT reports:</h1>
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_22.html">
	 <h1>low: XSS due to unescaped hostnames CVE-2012-3499</h1>
	 Various XSS flaws due to unescaped hostnames and URIs HTML output in
	 mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp.
	 <h1>moderate: XSS in mod_proxy_balancer CVE-2012-4558</h1>
	 A XSS flaw affected the mod_proxy_balancer manager interface.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3499</cvename>
 <cvename>CVE-2012-4558</cvename>
 </references>
 <dates>
 <discovery>2012-10-07</discovery>
 <entry>2013-03-02</entry>
 </dates>
 </vuln>

<vuln vid="764344fb-8214-11e2-9273-902b343deec9">
 <topic>sudo -- Authentication bypass when clock is reset</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><lt>1.8.6.p7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Todd Miller reports:
	<blockquote cite="http://www.sudo.ws/sudo/alerts/epoch_ticket.html">
	 The flaw may allow someone with physical access to a machine that
	 is not password-protected to run sudo commands without knowing the
	 logged in user's password. On systems where sudo is the principal
	 way of running commands as root, such as on Ubuntu and Mac OS X,
	 there is a greater chance that the logged in user has run sudo
	 before and thus that an attack would succeed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1775</cvename>
 <url>http://www.sudo.ws/sudo/alerts/epoch_ticket.html</url>
 </references>
 <dates>
 <discovery>2013-02-27</discovery>
 <entry>2013-03-01</entry>
 </dates>
 </vuln>

<vuln vid="82cfd919-8213-11e2-9273-902b343deec9">
 <topic>sudo -- Potential bypass of tty_tickets constraints</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><lt>1.8.6.p7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Todd Miller reports:
	<blockquote cite="http://www.sudo.ws/sudo/alerts/tty_tickets.html">
	 A (potentially malicious) program run by a user with sudo access
	 may be able to bypass the "tty_ticket" constraints. In order for
	 this to succeed there must exist on the machine a terminal device
	 that the user has previously authenticated themselves on via sudo
	 within the last time stamp timeout (5 minutes by default).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1776</cvename>
 <url>http://www.sudo.ws/sudo/alerts/tty_tickets.html</url>
 </references>
 <dates>
 <discovery>2013-02-27</discovery>
 <entry>2013-03-01</entry>
 </dates>
 </vuln>

<vuln vid="aa7764af-0b5e-4ddc-bc65-38ad697a484f">
 <topic>rubygem-dragonfly -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>rubygem18-dragonfly</name>
	<name>rubygem19-dragonfly</name>
	<name>rubygem20-dragonfly</name>
	<range><lt>0.9.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mark Evans reports:
	<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo">
	 Unfortnately there is a security vulnerability in Dragonfly when
	 used with Rails which would potentially allow an attacker to run
	 arbitrary code on a host machine using carefully crafted
	 requests.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1756</cvename>
 </references>
 <dates>
 <discovery>2013-02-19</discovery>
 <entry>2013-02-28</entry>
 </dates>
 </vuln>

<vuln vid="dbdac023-80e1-11e2-9a29-001060e06fd4">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.273</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb13-08.html">
	 These updates address vulnerabilities that could cause a crash
	 and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0504</cvename>
 <cvename>CVE-2013-0643</cvename>
 <cvename>CVE-2013-0648</cvename>
 </references>
 <dates>
 <discovery>2013-02-26</discovery>
 <entry>2013-02-27</entry>
 </dates>
 </vuln>

<vuln vid="84065569-7fb4-11e2-9c5a-000d601460a4">
 <topic>otrs -- XSS vulnerability could lead to remote code execution</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><ge>3.1.*</ge><lt>3.1.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OTRS Project reports:
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03">
	 This advisory covers vulnerabilities discovered in the OTRS core
	 system. This is a variance of the XSS vulnerability, where an attacker
	 could send a specially prepared HTML email to OTRS which would cause
	 JavaScript code to be executed in your browser while displaying the
	 email. In this case this is achieved by using javascript source
	 attributes with whitespaces.
	 Affected by this vulnerability are all releases of OTRS 2.4.x up to
	 and including 2.4.14, 3.0.x up to and including 3.0.16 and 3.1.x up to
	 and including 3.1.10.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4751</cvename>
 <url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03</url>
 </references>
 <dates>
 <discovery>2012-10-16</discovery>
 <entry>2013-02-25</entry>
 </dates>
 </vuln>

<vuln vid="d60199df-7fb3-11e2-9c5a-000d601460a4">
 <topic>otrs -- XSS vulnerability in Firefox and Opera could lead to remote code execution</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><ge>3.1.*</ge><lt>3.1.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OTRS Project reports:
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-02/">
	 This advisory covers vulnerabilities discovered in the OTRS core
	 system. This is a variance of the XSS vulnerability, where an attacker
	 could send a specially prepared HTML email to OTRS which would cause
	 JavaScript code to be executed in your browser while displaying the
	 email in Firefox and Opera. In this case this is achieved with an
	 invalid HTML structure with nested tags.
	 Affected by this
	 vulnerability are all releases of OTRS 2.4.x up to and including
	 2.4.13, 3.0.x up to and including 3.0.15 and 3.1.x up to and including
	 3.1.9 in combination with Firefox and Opera.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4600</cvename>
 <url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-02</url>
 </references>
 <dates>
 <discovery>2012-08-30</discovery>
 <entry>2013-02-25</entry>
 </dates>
 </vuln>

<vuln vid="b50cbbc0-7fb2-11e2-9c5a-000d601460a4">
 <topic>otrs -- XSS vulnerability in Internet Explorer could lead to remote code execution</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><ge>3.1.*</ge><lt>3.1.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OTRS Project reports:
	<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01">
	 This advisory covers vulnerabilities discovered in the OTRS core
	 system. Due to the XSS vulnerability in Internet Explorer an attacker
	 could send a specially prepared HTML email to OTRS which would cause
	 JavaScript code to be executed in your Internet Explorer while
	 displaying the email.
	 Affected by this vulnerability are all releases of OTRS 2.4.x up to
	 and including 2.4.12, 3.0.x up to and including 3.0.14 and 3.1.x up to
	 and including 3.1.8 in combination with Internet Explorer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2582</cvename>
 <url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01</url>
 </references>
 <dates>
 <discovery>2012-08-22</discovery>
 <entry>2013-02-25</entry>
 </dates>
 </vuln>

<vuln vid="844cf3f5-9259-4b3e-ac9e-13ca17333ed7">
 <topic>ruby -- DoS vulnerability in REXML</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>1.9,1</ge><lt>1.9.3.392,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby developers report:
	<blockquote cite="http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/">
	 Unrestricted entity expansion can lead to a DoS vulnerability in
	 REXML. (The CVE identifier will be assigned later.) We strongly
	 recommend to upgrade ruby.
	 
	 When reading text nodes from an XML document, the REXML parser can
	 be coerced in to allocating extremely large string objects which
	 can consume all of the memory on a machine, causing a denial of
	 service.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/</url>
 </references>
 <dates>
 <discovery>2013-02-22</discovery>
 <entry>2013-02-24</entry>
 </dates>
 </vuln>

<vuln vid="e1aa3bdd-839a-4a77-8617-cca439a8f9fc">
 <topic>rubygem-ruby_parser -- insecure tmp file usage</topic>
 <affects>
 <package>
	<name>rubygem18-ruby_parser</name>
	<name>rubygem19-ruby_parser</name>
	<name>rubygem20-ruby_parser</name>
	<range><lt>3.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michael Scherer reports:
	<blockquote cite="http://seclists.org/oss-sec/2013/q1/393">
	 This is a relatively minor tmp file usage issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0162</cvename>
 </references>
 <dates>
 <discovery>2013-02-24</discovery>
 <entry>2013-02-24</entry>
 </dates>
 </vuln>

<vuln vid="21c59f5e-7cc5-11e2-9c11-080027a5ec9a">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py26-django</name>
	<name>py27-django</name>
	<range><ge>1.3</ge><lt>1.3.6</lt></range>
	<range><ge>1.4</ge><lt>1.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Django Project reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2013/feb/19/security/">
	 These security releases fix four issues: one potential phishing
	 vector, one denial-of-service vector, an information leakage issue,
	 and a range of XML vulnerabilities.
	 <ol>
	 <li>
	 Host header poisoning
	 an attacker could cause Django to generate and display URLs that
	 link to arbitrary domains. This could be used as part of a phishing
	 attack. These releases fix this problem by introducing a new
	 setting, ALLOWED_HOSTS, which specifies a whitelist of domains your
	 site is known to respond to.
	 Important: by default Django 1.3.6 and 1.4.4 set ALLOWED_HOSTS to
	 allow all hosts. This means that to actually fix the security
	 vulnerability you should define this setting yourself immediately
	 after upgrading.
	 </li>
	 <li>
	 Formset denial-of-service
	 an attacker can abuse Django's tracking of the number of forms in
	 a formset to cause a denial-of-service attack. This has been fixed
	 by adding a default maximum number of forms of 1,000. You can still
	 manually specify a bigger max_num, if you wish, but 1,000 should be
	 enough for anyone.
	 </li>
	 <li>
	 XML attacks
	 Django's serialization framework was vulnerable to attacks via XML
	 entity expansion and external references; this is now fixed.
	 However, if you're parsing arbitrary XML in other parts of your
	 application, we recommend you look into the defusedxml Python
	 packages which remedy this anywhere you parse XML, not just via
	 Django's serialization framework.
	 </li>
	 <li>
	 Data leakage via admin history log
	 Django's admin interface could expose supposedly-hidden
	 information via its history log. This has been fixed.
	 </li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1664</cvename>
 <cvename>CVE-2013-1665</cvename>
 <cvename>CVE-2013-0305</cvename>
 <cvename>CVE-2013-0306</cvename>
 <bid>58022</bid>
 <bid>58061</bid>
 </references>
 <dates>
 <discovery>2013-02-21</discovery>
 <entry>2013-02-24</entry>
 </dates>
 </vuln>

<vuln vid="f54584bc-7d2b-11e2-9bd1-206a8a720317">
 <topic>krb5 -- null pointer dereference in the KDC PKINIT code [CVE-2013-1415]</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><le>1.11</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	No advisory has been released yet.
	<blockquote cite="http://web.mit.edu/kerberos/www/krb5-1.11/">
	 Fix a null pointer dereference in the KDC PKINIT code [CVE-2013-1415].
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-1415</cvename>
 <url>http://web.mit.edu/kerberos/www/krb5-1.11/</url>
 </references>
 <dates>
 <discovery>2013-02-21</discovery>
 <entry>2013-02-22</entry>
 </dates>
 </vuln>

<vuln vid="3c90e093-7c6e-11e2-809b-6c626d99876c">
 <topic>FreeBSD -- glob(3) related resource exhaustion</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_12</lt></range>
	<range><ge>8.3</ge><lt>8.3_6</lt></range>
	<range><ge>9.0</ge><lt>9.0_6</lt></range>
	<range><ge>9.1</ge><lt>9.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:02.libc.asc">
	 GLOB_LIMIT is supposed to limit the number of paths to prevent against
	 memory or CPU attacks. The implementation however is insufficient.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-13:02.libc</freebsdsa>
 <cvename>CVE-2010-2632</cvename>
 </references>
 <dates>
 <discovery>2013-02-19</discovery>
 <entry>2013-02-21</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="4671cdc9-7c6d-11e2-809b-6c626d99876c">
 <topic>FreeBSD -- BIND remote DoS with deliberately crafted DNS64 query</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>9.0</ge><lt>9.0_6</lt></range>
	<range><ge>9.1</ge><lt>9.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:01.bind.asc">
	 Due to a software defect a crafted query can cause named(8) to crash
	 with an assertion failure.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-13:01.bind</freebsdsa>
 <cvename>CVE-2012-5688</cvename>
 </references>
 <dates>
 <discovery>2013-02-19</discovery>
 <entry>2013-02-21</entry>
 </dates>
 </vuln>

<vuln vid="a4d71e4c-7bf4-11e2-84cd-d43d7e0c7c02">
 <topic>drupal7 -- Denial of service</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://drupal.org/SA-CORE-2013-002">
	 Drupal core's Image module allows for the on-demand generation
	 of image derivatives. This capability can be abused by requesting
	 a large number of new derivatives which can fill up the server disk
	 space, and which can cause a very high CPU load. Either of these
	 effects may lead to the site becoming unavailable or unresponsive.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0316</cvename>
 <url>https://drupal.org/SA-CORE-2013-002</url>
 </references>
 <dates>
 <discovery>2013-02-20</discovery>
 <entry>2013-02-21</entry>
 </dates>
 </vuln>

<vuln vid="58c15292-7b61-11e2-95da-001e8c1a8a0e">
 <topic>nss-pam-ldapd -- file descriptor buffer overflow</topic>
 <affects>
 <package>
	<name>nss-pam-ldapd</name>
	<range><lt>0.8.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Garth Mollett reports:
	<blockquote cite="http://arthurdejong.org/nss-pam-ldapd/CVE-2013-0288">
	 A file descriptor overflow issue in the use of FD_SET()
	 in nss-pam-ldapd can lead to a stack-based buffer overflow.
	 An attacker could, under some circumstances, use this flaw
	 to cause a process that has the NSS or PAM module loaded to
	 crash or potentially execute arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0288</cvename>
 </references>
 <dates>
 <discovery>2013-02-18</discovery>
 <entry>2013-02-20</entry>
 </dates>
 </vuln>

<vuln vid="1c8a039b-7b23-11e2-b17b-20cf30e32f6d">
 <topic>bugzilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<name>de-bugzilla</name>
	<name>ru-bugzilla</name>
	<name>ja-bugzilla</name>
	<range><ge>3.6.0</ge><lt>3.6.13</lt></range>
	<range><ge>4.0.0</ge><lt>4.0.10</lt></range>
	<range><ge>4.2.0</ge><lt>4.2.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/3.6.12/">
	 <h1>Cross-Site Scripting</h1>
	 When viewing a single bug report, which is the default,
	 the bug ID is validated and rejected if it is invalid.
	 But when viewing several bug reports at once, which is
	 specified by the format=multiple parameter, invalid bug
	 IDs can go through and are sanitized in the HTML page
	 itself. But when an invalid page format is passed to the
	 CGI script, the wrong HTML page is called and data are not
	 correctly sanitized, which can lead to XSS.
	 <h1>Information Leak</h1>
	 When running a query in debug mode, the generated SQL
	 query used to collect the data is displayed. The way this
	 SQL query is built permits the user to determine if some
	 confidential field value (such as a product name) exists.
	 This problem only affects Bugzilla 4.0.9 and older. Newer
	 releases are not affected by this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0785</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=842038</url>
 <cvename>CVE-2013-0786</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=824399</url>
 </references>
 <dates>
 <discovery>2013-02-19</discovery>
 <entry>2013-02-20</entry>
 <modified>2013-03-31</modified>
 </dates>
 </vuln>

<vuln vid="e3f0374a-7ad6-11e2-84cd-d43d7e0c7c02">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>18.0,1</gt><lt>19.0,1</lt></range>
	<range><lt>17.0.3,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>17.0.3,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.16</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.3</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.16</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0.3</lt></range>
	<range><lt>10.0.12</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 /
	 rv:17.0.3)
	 MFSA 2013-22 Out-of-bounds read in image rendering
	 MFSA 2013-23 Wrapped WebIDL objects can be wrapped again
	 MFSA 2013-24 Web content bypass of COW and SOW security wrappers
	 MFSA 2013-25 Privacy leak in JavaScript Workers
	 MFSA 2013-26 Use-after-free in nsImageLoadingContent
	 MFSA 2013-27 Phishing on HTTPS connection through malicious proxy
	 MFSA 2013-28 Use-after-free, out of bounds read, and buffer
	 overflow issues found using Address Sanitizer
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2013-0765</cvename>
	<cvename>CVE-2013-0772</cvename>
	<cvename>CVE-2013-0773</cvename>
	<cvename>CVE-2013-0774</cvename>
	<cvename>CVE-2013-0775</cvename>
	<cvename>CVE-2013-0776</cvename>
	<cvename>CVE-2013-0783</cvename>
	<cvename>CVE-2013-0784</cvename>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-20.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-21.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-22.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-23.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-24.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-25.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-26.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-27.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
 </references>
 <dates>
 <discovery>2013-02-19</discovery>
 <entry>2013-02-19</entry>
 <modified>2013-02-20</modified>
 </dates>
 </vuln>

<vuln vid="fcfdabb7-f14d-4e61-a7d5-cfefb4b99b15">
 <topic>Ruby Rack Gem -- Multiple Issues</topic>
 <affects>
 <package>
	<name>rubygem18-rack</name>
	<range><lt>1.4.5</lt></range>
 </package>
 <package>
	<name>rubygem19-rack</name>
	<range><lt>1.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Rack developers report:
	<blockquote cite="http://www.ruby-forum.com/topic/4410659">
	 Today we are proud to announce the release of Rack 1.4.5.
	 Fix CVE-2013-0263, timing attack against Rack::Session::Cookie
	 Fix CVE-2013-0262, symlink path traversal in Rack::File
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0262</cvename>
 <cvename>CVE-2013-0263</cvename>
 </references>
 <dates>
 <discovery>2013-02-08</discovery>
 <entry>2013-02-17</entry>
 </dates>
 </vuln>

<vuln vid="beab40bf-c1ca-4d2b-ad46-2f14bac8a968">
 <topic>Ruby Activemodel Gem -- Circumvention of attr_protected</topic>
 <affects>
 <package>
	<name>rubygem18-activemodel</name>
	<range><lt>3.2.12</lt></range>
 </package>
 <package>
	<name>rubygem19-activemodel</name>
	<range><lt>3.2.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aaron Patterson reports:
	<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/AFBKNY7VSH8">
	 The attr_protected method allows developers to specify a blacklist
	 of model attributes which users should not be allowed to assign to.
	 By using a specially crafted request, attackers could circumvent
	 this protection and alter values that were meant to be protected.
	 All users running an affected release should either upgrade or use
	 one of the work arounds immediately. Users should also consider
	 switching from attr_protected to the whitelist method
	 attr_accessible which is not vulnerable to this attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0276</cvename>
 </references>
 <dates>
 <discovery>2013-02-11</discovery>
 <entry>2013-02-17</entry>
 </dates>
 </vuln>

<vuln vid="7fe5b84a-78eb-11e2-8441-00e0814cab4e">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>1.501</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory reports:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16">
	 This advisory announces multiple security vulnerabilities that
	 were found in Jenkins core.
	 <ol>
	 <li>One of the vulnerabilities allows cross-site request
	 forgery (CSRF) attacks on Jenkins master, which causes an user
	 to make unwanted actions on Jenkins. Another vulnerability
	 enables cross-site scripting (XSS) attacks, which has the similar
	 consequence. Another vulnerability allowed an attacker to bypass
	 the CSRF protection mechanism in place, thereby mounting more CSRF
	 attackes. These attacks allow an attacker without direct access to
	 Jenkins to mount an attack.</li>
	 <li>In the fourth vulnerability, a malicious user of Jenkins can trick
	 Jenkins into building jobs that he does not have direct access to.</li>
	 <li>And lastly, a vulnerability allows a malicious user of Jenkins to
	 mount a denial of service attack by feeding a carefully crafted
	 payload to Jenkins.</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16</url>
 </references>
 <dates>
 <discovery>2013-02-16</discovery>
 <entry>2013-02-17</entry>
 </dates>
 </vuln>

<vuln vid="f7809d9e-6af0-11e2-8e32-080027d768d3">
 <topic>poweradmin -- multiple XSS vulnerabilities</topic>
 <affects>
 <package>
 <name>poweradmin</name>
 <range><lt>2.1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Multiple cross-site scripting (XSS) vulnerabilities
	<blockquote cite="https://www.poweradmin.org/trac/ticket/468">
	 Multiple scripts are vulnerable to XSS attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>55619</bid>
 <url>http://packetstormsecurity.com/files/116698/Poweradmin-Cross-Site-Scripting.html</url>
 </references>
 <dates>
 <discovery>2012-01-12</discovery>
 <entry>2013-02-16</entry>
 </dates>
 </vuln>

<vuln vid="c79eb109-a754-45d7-b552-a42099eb2265">
 <topic>Ruby -- Denial of Service and Unsafe Object Creation Vulnerability in JSON</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>1.9,1</ge><lt>1.9.3.385,1</lt></range>
 </package>
 <package>
	<name>rubygem18-json</name>
	<range><lt>1.7.7</lt></range>
 </package>
 <package>
	<name>rubygem19-json</name>
	<range><lt>1.7.7</lt></range>
 </package>
 <package>
	<name>rubygem18-json_pure</name>
	<range><lt>1.7.7</lt></range>
 </package>
 <package>
	<name>rubygem19-json_pure</name>
	<range><lt>1.7.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aaron Patterson reports:
	<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_YvCpLzL58">
	 When parsing certain JSON documents, the JSON gem can be coerced in
	 to creating Ruby symbols in a target system. Since Ruby symbols
	 are not garbage collected, this can result in a denial of service
	 attack.
	 The same technique can be used to create objects in a target system
	 that act like internal objects. These "act alike" objects can be
	 used to bypass certain security mechanisms and can be used as a
	 spring board for SQL injection attacks in Ruby on Rails.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0269</cvename>
 </references>
 <dates>
 <discovery>2013-02-11</discovery>
 <entry>2013-02-16</entry>
 </dates>
 </vuln>

<vuln vid="d3e96508-056b-4259-88ad-50dc8d1978a6">
 <topic>Ruby -- XSS exploit of RDoc documentation generated by rdoc</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>1.9,1</ge><lt>1.9.3.385,1</lt></range>
 </package>
 <package>
	<name>rubygem18-rdoc</name>
	<range><lt>3.12.1</lt></range>
 </package>
 <package>
	<name>rubygem19-rdoc</name>
	<range><lt>3.12.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby developers report:
	<blockquote cite="http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/">
	 RDoc documentation generated by rdoc bundled with ruby are
	 vulnerable to an XSS exploit. All ruby users are recommended to
	 update ruby to newer version which includes security-fixed RDoc. If
	 you are publishing RDoc documentation generated by rdoc, you are
	 recommended to apply a patch for the documentaion or re-generate it
	 with security-fixed RDoc.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0256</cvename>
 </references>
 <dates>
 <discovery>2013-02-06</discovery>
 <entry>2013-02-16</entry>
 </dates>
 </vuln>

<vuln vid="414e6a41-7204-11e2-8599-001060e06fd4">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.262</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb13-04.html">
	 These updates address vulnerabilities that could cause a crash
	 and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0633</cvename>
 <cvename>CVE-2013-0634</cvename>
 <url>https://www.adobe.com/support/security/bulletins/apsb13-04.html</url>
 </references>
 <dates>
 <discovery>2013-02-07</discovery>
 <entry>2013-02-08</entry>
 </dates>
 </vuln>

<vuln vid="00b0d8cd-7097-11e2-98d9-003067c2616f">
 <topic>OpenSSL -- TLS 1.1, 1.2 denial of service</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.1_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL security team reports:
	<blockquote cite="http://www.openssl.org/news/secadv_20130205.txt">
	 A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1
	 and TLS 1.2 on AES-NI supporting platforms can be exploited in a
	 DoS attack.
	 A flaw in the OpenSSL handling of OCSP response verification can
	 be exploited in a denial of service attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2686</cvename>
 <cvename>CVE-2013-0166</cvename>
 <cvename>CVE-2013-0169</cvename>
 <url>http://www.openssl.org/news/secadv_20120510.txt</url>
 </references>
 <dates>
 <discovery>2013-02-05</discovery>
 <entry>2013-02-06</entry>
 </dates>
 </vuln>

<vuln vid="8c773d7f-6cbb-11e2-b242-c8600054b392">
 <topic>mysql/mariadb/percona server -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><ge>5.1</ge><lt>5.1.67</lt></range>
	<range><ge>5.5</ge><lt>5.5.29</lt></range>
 </package>
 <package>
 <name>mariadb-server</name>
 <range><ge>5.3</ge><lt>5.3.12</lt></range>
 <range><ge>5.5</ge><lt>5.5.29</lt></range>
 </package>
 <package>
 <name>percona-server</name>
 <range><ge>5.5</ge><lt>5.5.29.29.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ORACLE reports:
	<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html">
	 Multiple SQL injection vulnerabilities in the replication code
	 Stack-based buffer overflow
	 Heap-based buffer overflow
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4414</cvename>
 <cvename>CVE-2012-5611</cvename>
 <cvename>CVE-2012-5612</cvename>
 <cvename>CVE-2012-5615</cvename>
 <cvename>CVE-2012-5627</cvename>
 <url>https://mariadb.atlassian.net/browse/MDEV-4029</url>
 <url>https://mariadb.atlassian.net/browse/MDEV-MDEV-729</url>
 <url>https://mariadb.atlassian.net/browse/MDEV-MDEV-729</url>
 <url>http://www.mysqlperformanceblog.com/2013/01/23/announcing-percona-server-5-5-29-29-4/</url>
 </references>
 <dates>
 <discovery>2012-12-01</discovery>
 <entry>2013-02-01</entry>
 </dates>
 </vuln>

<vuln vid="ea0f45e2-6c4b-11e2-98d9-003067c2616f">
 <topic>opera -- execution of arbitrary code</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<name>linux-opera-devel</name>
	<range><lt>12.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera reports:
	<blockquote cite="http://www.opera.com/support/kb/view/1042/">
	 Particular DOM event manipulations can cause Opera to crash. In
	 some cases, this crash might occur in a way that allows execution
	 of arbitrary code. To inject code, additional techniques would
	 have to be employed.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.opera.com/support/kb/view/1042/</url>
 <url>http://www.opera.com/support/kb/view/1043/</url>
 </references>
 <dates>
 <discovery>2013-01-30</discovery>
 <entry>2013-02-01</entry>
 </dates>
 </vuln>

<vuln vid="2ea6ce3d-6afd-11e2-9d4e-bcaec524bf84">
 <topic>upnp -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>upnp</name>
	<range><lt>1.6.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Project changelog reports:
	<blockquote cite="http://pupnp.sourceforge.net/ChangeLog">
	 This patch addresses three possible buffer overflows in
	 function unique_service_name().The three issues have the
	 folowing CVE numbers:
	 <ul>
	 <li>CVE-2012-5958 Issue #2: Stack buffer overflow of Tempbuf</li>
	 <li>CVE-2012-5959 Issue #4: Stack buffer overflow of Event-&gt;UDN</li>
	 <li>CVE-2012-5960 Issue #8: Stack buffer overflow of Event-&gt;UDN</li>
	 </ul>
	 Notice that the following issues have already been dealt by
	 previous work:
	 <ul>
	 <li>CVE-2012-5961 Issue #1: Stack buffer overflow of Evt-&gt;UDN</li>
	 <li>CVE-2012-5962 Issue #3: Stack buffer overflow of Evt-&gt;DeviceType</li>
	 <li>CVE-2012-5963 Issue #5: Stack buffer overflow of Event-&gt;UDN</li>
	 <li>CVE-2012-5964 Issue #6: Stack buffer overflow of Event-&gt;DeviceType</li>
	 <li>CVE-2012-5965 Issue #7: Stack buffer overflow of Event-&gt;DeviceType</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5958</cvename>
 <cvename>CVE-2012-5959</cvename>
 <cvename>CVE-2012-5960</cvename>
 <cvename>CVE-2012-5961</cvename>
 <cvename>CVE-2012-5962</cvename>
 <cvename>CVE-2012-5963</cvename>
 <cvename>CVE-2012-5964</cvename>
 <cvename>CVE-2012-5965</cvename>
 </references>
 <dates>
 <discovery>2012-11-21</discovery>
 <entry>2013-01-30</entry>
 </dates>
 </vuln>

<vuln vid="559e00b7-6a4d-11e2-b6b0-10bf48230856">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>3.5.1,1</lt></range>
 </package>
 <package>
	<name>zh-wordpress-zh_CN</name>
	<range><lt>3.5.1</lt></range>
 </package>
 <package>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>3.5.1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<range><lt>3.5.1</lt></range>
 </package>
 <package>
	<name>ja-wordpress</name>
	<range><lt>3.5.1</lt></range>
 </package>
 <package>
	<name>ru-wordpress</name>
	<range><lt>3.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wordpress reports:
	<blockquote cite="http://wordpress.org/news/2013/01/wordpress-3-5-1/">
	 WordPress 3.5.1 also addresses the following security issues:
	 <ul>
	 <li>A server-side request forgery vulnerability and remote port
	 scanning using pingbacks. This vulnerability, which could
	 potentially be used to expose information and compromise a
	 site, affects all previous WordPress versions. This was fixed
	 by the WordPress security team. We'd like to thank security
	 researchers <a href="http://codeseekah.com/">Gennady
	 Kovshenin</a> and <a href="http://www.ethicalhack3r.co.uk/">Ryan
	 Dewhurst</a> for reviewing our work.</li>
	 <li>Two instances of cross-site scripting via shortcodes and post
	 content. These issues were discovered by Jon Cave of the WordPress
	 security team.</li>
	 <li>A cross-site scripting vulnerability in the external library
	 Plupload. Thanks to the Moxiecode team for working with us on
	 this, and for releasing Plupload 1.5.5 to address this issue.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0235</cvename>
 <cvename>CVE-2013-0236</cvename>
 <cvename>CVE-2013-0237</cvename>
 </references>
 <dates>
 <discovery>2013-01-24</discovery>
 <entry>2013-01-29</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="3886cafe-668c-11e2-94b8-1c4bd681f0cf">
 <topic>django-cms -- XSS Vulnerability</topic>
 <affects>
 <package>
	<name>py-django-cms</name>
	<range><lt>2.3.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cross-site scripting (XSS) vulnerability
	<blockquote cite="https://www.django-cms.org/en/blog/2012/12/04/2-3-5-security-release/">
	 Jonas Obrist reports: The security issue allows users with limited
	 admin access to elevate their privileges through XSS injection
	 using the page_attribute template tag. Only users with admin access
	 and the permission to edit at least one django CMS page object
	 could exploit this vulnerability. Websites that do not use the
	 page_attribute template tag are not affected.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.django-cms.org/en/blog/2012/12/04/2-3-5-security-release/</url>
 </references>
 <dates>
 <discovery>2012-12-04</discovery>
 <entry>2013-01-25</entry>
 </dates>
 </vuln>

<vuln vid="1827f213-633e-11e2-8d93-c8600054b392">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal6</name>
	<range><lt>6.28</lt></range>
 </package>
 <package>
	<name>drupal7</name>
	<range><lt>7.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="https://drupal.org/SA-CORE-2013-001">
	 Cross-site scripting (Various core and contributed modules)
	 Access bypass (Book module printer friendly version)
	 Access bypass (Image module)
	</blockquote>
 </body>
 </description>
 <references>
	<url>https://drupal.org/SA-CORE-2013-001</url>
 </references>
 <dates>
 <discovery>2013-01-16</discovery>
 <entry>2013-01-20</entry>
 </dates>
 </vuln>

<vuln vid="1b9b199f-5efd-11e2-a1ee-c48508086173">
 <topic>ettercap -- buffer overflow in target list parsing</topic>
 <affects>
 <package>
	<name>ettercap</name>
	<range><lt>0.7.4.1</lt></range>
	<range><ge>0.7.5</ge><lt>0.7.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Host target list parsing routine in ettercap
	 0.7.4-series prior to 0.7.4.1 and 0.7.5-series
	 is prone to the stack-based buffer overflow that
	 may lead to the code execution with the privileges
	 of the ettercap process.
	In order to trigger this vulnerability, user or service
	 that use ettercap should be tricked to pass the crafted list
	 of targets via the "-j" option.
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0722</cvename>
 <url>http://www.exploit-db.com/exploits/23945/</url>
 <url>https://secunia.com/advisories/51731/</url>
 </references>
 <dates>
 <discovery>2013-01-07</discovery>
 <entry>2013-01-16</entry>
 </dates>
 </vuln>

<vuln vid="d5e0317e-5e45-11e2-a113-c48508086173">
 <topic>java 7.x -- security manager bypass</topic>
 <affects>
 <package>
	<name>openjdk7</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>linux-sun-jdk</name>
	<range><ge>7.0</ge><lt>7.11</lt></range>
 </package>
 <package>
	<name>linux-sun-jre</name>
	<range><ge>7.0</ge><lt>7.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US CERT reports:
	<blockquote cite="http://www.kb.cert.org/vuls/id/625617">
	 Java 7 Update 10 and earlier versions of Java 7 contain a
	 vulnerability that can allow a remote, unauthenticated
	 attacker to execute arbitrary code on a vulnerable
	 system.
	 The Java JRE plug-in provides its own Security Manager.
	 Typically, a web applet runs with a security manager
	 provided by the browser or Java Web Start plugin. Oracle's
	 document states, "If there is a security manager already
	 installed, this method first calls the security manager's
	 checkPermission method with a
	 RuntimePermission("setSecurityManager") permission to ensure
	 it's safe to replace the existing security manager. This may
	 result in throwing a SecurityException".
	 By leveraging the vulnerability in the Java Management
	 Extensions (JMX) MBean components, unprivileged Java code
	 can access restricted classes. By using that vulnerability
	 in conjunction with a second vulnerability involving the
	 Reflection API and the invokeWithArguments method of the
	 MethodHandle class, an untrusted Java applet can escalate
	 its privileges by calling the the setSecurityManager()
	 function to allow full privileges, without requiring code
	 signing. Oracle Java 7 update 10 and earlier Java 7 versions
	 are affected. The invokeWithArguments method was introduced
	 with Java 7, so therefore Java 6 is not affected.
	 This vulnerability is being attacked in the wild, and is
	 reported to be incorporated into exploit kits. Exploit code
	 for this vulnerability is also publicly available.
	</blockquote>
	Esteban Guillardoy from Immunity Inc. additionally clarifies
	 on the recursive reflection exploitation technique:
	<blockquote cite="https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf">
	 The real issue is in the native
	 sun.reflect.Reflection.getCallerClass method.
	 We can see the following information in the Reflection
	 source code:
	 Returns the class of the method realFramesToSkip frames
	 up the stack (zero-based), ignoring frames associated with
	 java.lang.reflect.Method.invoke() and its
	 implementation.
	 So what is happening here is that they forgot to skip the
	 frames related to the new Reflection API and only the old
	 reflection API is taken into account.
	</blockquote>
	This exploit does not only affect Java applets, but every
	 piece of software that relies on the Java Security Manager for
	 sandboxing executable code is affected: malicious code can
	 totally disable Security Manager.
	For users who are running native Web browsers with enabled
	 Java plugin, the workaround is to remove the java/icedtea-web
	 port and restart all browser instances.
	For users who are running Linux Web browser flavors, the
	 workaround is either to disable the Java plugin in browser
	 or to upgrade linux-sun-* packages to the non-vulnerable
	 version.
	It is not recommended to run untrusted applets using
	 appletviewer, since this may lead to the execution of the
	 malicious code on vulnerable versions on JDK/JRE.
 </body>
 </description>
 <references>
 <cvename>CVE-2013-0433</cvename>
 <certvu>625617</certvu>
 <url>http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html</url>
 <url>https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf</url>
 </references>
 <dates>
 <discovery>2013-01-10</discovery>
 <entry>2013-01-14</entry>
 </dates>
 </vuln>

<vuln vid="97c22a94-5b8b-11e2-b131-000c299b62e1">
 <topic>nagios -- buffer overflow in history.cgi</topic>
 <affects>
 <package>
	<name>nagios</name>
	<range><lt>3.4.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	full disclosure reports:
	<blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0108.html">
	 history.cgi is vulnerable to a buffer overflow due to the use of
	 sprintf with user supplied data that has not been restricted in size.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-6096</cvename>
 <url>http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0108.html</url>
 <url>http://nagios.svn.sourceforge.net/viewvc/nagios?view=revision&amp;revision=2547</url>
 </references>
 <dates>
 <discovery>2012-12-21</discovery>
 <entry>2013-01-10</entry>
 </dates>
 </vuln>

<vuln vid="a4ed6632-5aa9-11e2-8fcb-c8600054b392">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>17.0.2,1</lt></range>
	<range><lt>10.0.12,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>17.0.2,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.15</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>17.0.2</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.15</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0.2</lt></range>
	<range><lt>10.0.12</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.12</lt></range>
 </package>
 <package>
	<name>ca_root_nss</name>
	<range><lt>3.14.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2013-01 Miscellaneous memory safety hazards (rv:18.0/
	 rv:10.0.12 / rv:17.0.2)
	 MFSA 2013-02 Use-after-free and buffer overflow issues found using
	 Address Sanitizer
	 MFSA 2013-03 Buffer Overflow in Canvas
	 MFSA 2013-04 URL spoofing in addressbar during page loads
	 MFSA 2013-05 Use-after-free when displaying table with many
	 columns and column groups
	 MFSA 2013-06 Touch events are shared across iframes
	 MFSA 2013-07 Crash due to handling of SSL on threads
	 MFSA 2013-08 AutoWrapperChanger fails to keep objects alive during
	 garbage collection
	 MFSA 2013-09 Compartment mismatch with quickstubs returned values
	 MFSA 2013-10 Event manipulation in plugin handler to bypass
	 same-origin policy
	 MFSA 2013-11 Address space layout leaked in XBL objects
	 MFSA 2013-12 Buffer overflow in Javascript string concatenation
	 MFSA 2013-13 Memory corruption in XBL with XML bindings containing
	 SVG
	 MFSA 2013-14 Chrome Object Wrapper (COW) bypass through changing
	 prototype
	 MFSA 2013-15 Privilege escalation through plugin objects
	 MFSA 2013-16 Use-after-free in serializeToStream
	 MFSA 2013-17 Use-after-free in ListenerManager
	 MFSA 2013-18 Use-after-free in Vibrate
	 MFSA 2013-19 Use-after-free in Javascript Proxy objects
	 MFSA 2013-20 Mis-issued TURKTRUST certificates
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-5829</cvename>
	<cvename>CVE-2013-0743</cvename>
	<cvename>CVE-2013-0744</cvename>
	<cvename>CVE-2013-0745</cvename>
	<cvename>CVE-2013-0746</cvename>
	<cvename>CVE-2013-0747</cvename>
	<cvename>CVE-2013-0748</cvename>
	<cvename>CVE-2013-0749</cvename>
	<cvename>CVE-2013-0750</cvename>
	<cvename>CVE-2013-0751</cvename>
	<cvename>CVE-2013-0752</cvename>
	<cvename>CVE-2013-0753</cvename>
	<cvename>CVE-2013-0754</cvename>
	<cvename>CVE-2013-0755</cvename>
	<cvename>CVE-2013-0756</cvename>
	<cvename>CVE-2013-0757</cvename>
	<cvename>CVE-2013-0758</cvename>
	<cvename>CVE-2013-0759</cvename>
	<cvename>CVE-2013-0760</cvename>
	<cvename>CVE-2013-0761</cvename>
	<cvename>CVE-2013-0762</cvename>
	<cvename>CVE-2013-0763</cvename>
	<cvename>CVE-2013-0764</cvename>
	<cvename>CVE-2013-0766</cvename>
	<cvename>CVE-2013-0767</cvename>
	<cvename>CVE-2013-0768</cvename>
	<cvename>CVE-2013-0769</cvename>
	<cvename>CVE-2013-0770</cvename>
	<cvename>CVE-2013-0771</cvename>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-01.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-02.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-03.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-04.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-05.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-06.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-07.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-08.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-09.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-10.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-11.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-12.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-13.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-14.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-15.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-16.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-17.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-18.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-19.html</url>
	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-20.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
 </references>
 <dates>
 <discovery>2013-01-08</discovery>
 <entry>2013-01-09</entry>
 </dates>
 </vuln>

<vuln vid="ca5d3272-59e3-11e2-853b-00262d5ed8ee">
 <topic>rubygem-rails -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-rails</name>
	<range><lt>3.2.11</lt></range>
 </package>
 <package>
	<name>rubygem-actionpack</name>
	<range><lt>3.2.11</lt></range>
 </package>
 <package>
	<name>rubygem-activerecord</name>
	<range><lt>3.2.11</lt></range>
 </package>
 <package>
	<name>rubygem-activesupport</name>
	<range><lt>3.2.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails team reports:
	<blockquote cite="http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/">
	 Two high-risk vulnerabilities have been discovered:
	 (CVE-2013-0155) There is a vulnerability when Active Record is
	 used in conjunction with JSON parameter parsing.
	 Due to the way Active Record interprets parameters in combination
	 with the way that JSON parameters are parsed, it is possible for an
	 attacker to issue unexpected database queries with "IS NULL" or
	 empty "WHERE" clauses. This issue does not let an attacker insert
	 arbitrary values into an SQL query, however they can cause the
	 query to check for NULL or eliminate a WHERE clause when most users
	 would not expect it.
	 (CVE-2013-0156) There are multiple weaknesses in the parameter
	 parsing code for Ruby on Rails which allows attackers to bypass
	 authentication systems, inject arbitrary SQL, inject and execute
	 arbitrary code, or perform a DoS attack on a Rails application.
	 The parameter parsing code of Ruby on Rails allows applications to
	 automatically cast values from strings to certain data types.
	 Unfortunately the type casting code supported certain conversions
	 which were not suitable for performing on user-provided data
	 including creating Symbols and parsing YAML. These unsuitable
	 conversions can be used by an attacker to compromise a Rails
	 application.
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2013-0155</cvename>
	<cvename>CVE-2013-0156</cvename>
	<url>http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/</url>
	<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/t1WFuuQyavI</url>
	<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/61bkgvnSGTQ</url>
 </references>
 <dates>
 <discovery>2013-01-08</discovery>
 <entry>2013-01-08</entry>
 </dates>
 </vuln>

<vuln vid="b4051b52-58fa-11e2-853b-00262d5ed8ee">
 <topic>rubygem-rails -- SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-rails</name>
	<range><lt>3.2.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby on Rails team reports:
	<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM">
	 There is a SQL injection vulnerability in Active Record in ALL
	 versions. Due to the way dynamic finders in Active Record extract
	 options from method parameters, a method parameter can mistakenly
	 be used as a scope. Carefully crafted requests can use the scope
	 to inject arbitrary SQL.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5664</cvename>
 <url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM</url>
 </references>
 <dates>
 <discovery>2013-01-02</discovery>
 <entry>2013-01-07</entry>
 </dates>
 </vuln>

<vuln vid="3a65d33b-5950-11e2-b66b-00e0814cab4e">
 <topic>jenkins -- HTTP access to the server to retrieve the master cryptographic key</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>1.498</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory reports:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04">
	 This advisory announces a security vulnerability that was found
	 in Jenkins core.
	 An attacker can then use this master cryptographic key to mount
	 remote code execution attack against the Jenkins master, or
	 impersonate arbitrary users in making REST API calls.
	 There are several factors that mitigate some of these problems
	 that may apply to specific installations.
	 <ul>
	 <li>The particular attack vector is only applicable on Jenkins
		 instances that have slaves attached to them, and allow
		 anonymous read access.</li>
	 <li>Jenkins allows users to re-generate the API tokens. Those
		 re-generated API tokens cannot be impersonated by the
		 attacker.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
	 <url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04</url>
 </references>
 <dates>
 <discovery>2013-01-04</discovery>
 <entry>2013-01-08</entry>
 </dates>
 </vuln>

<vuln vid="1b769b72-582b-11e2-b66b-00e0814cab4e">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>django</name>
	<range><lt>1.4.3</lt></range>
 </package>
 <package>
	<name>django13</name>
	<range><lt>1.3.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Django Project reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2012/dec/10/security/">
	<ol>
	 <li>
	 Host header poisoning
	 Several earlier Django security releases focused on the issue of
	 poisoning the HTTP Host header, causing Django to generate URLs
	 pointing to arbitrary, potentially-malicious domains.
	 In response to further input received and reports of continuing
	 issues following the previous release, we're taking additional
	 steps to tighten Host header validation. Rather than attempt to
	 accommodate all features HTTP supports here, Django's Host header
	 validation attempts to support a smaller, but far more common, subset:
	 <ul>
		<li>Hostnames must consist of characters [A-Za-z0-9] plus hyphen
		 ('-') or dot ('.').</li>
		<li>IP addresses -- both IPv4 and IPv6 -- are permitted.</li>
		<li>Port, if specified, is numeric.</li>
	 </ul>
	 Any deviation from this will now be rejected, raising the exception
	 django.core.exceptions.SuspiciousOperation.
	 </li>
	 <li>
	 Redirect poisoning
	 Also following up on a previous issue: in July of this year, we made
	 changes to Django's HTTP redirect classes, performing additional
	 validation of the scheme of the URL to redirect to (since, both
	 within Django's own supplied applications and many third-party
	 applications, accepting a user-supplied redirect target is a common
	 pattern).
	 Since then, two independent audits of the code turned up further
	 potential problems. So, similar to the Host-header issue, we are
	 taking steps to provide tighter validation in response to reported
	 problems (primarily with third-party applications, but to a certain
	 extent also within Django itself). This comes in two parts:
	 <ol>
		<li>A new utility function, django.utils.http.is_safe_url, is
		 added; this function takes a URL and a hostname, and checks
		 that the URL is either relative, or if absolute matches the
		 supplied hostname. This function is intended for use whenever
		 user-supplied redirect targets are accepted, to ensure that
		 such redirects cannot lead to arbitrary third-party sites.</li>
		<li>All of Django's own built-in views -- primarily in the
		 authentication system -- which allow user-supplied redirect
		 targets now use is_safe_url to validate the supplied URL.</li>
	 </ol>
	 </li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
	<url>https://www.djangoproject.com/weblog/2012/dec/10/security/</url>
 </references>
 <dates>
 <discovery>2012-12-10</discovery>
 <entry>2013-01-06</entry>
 </dates>
 </vuln>

<vuln vid="1ae613c3-5728-11e2-9483-14dae938ec40">
 <topic>freetype -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>freetype2</name>
	<range><lt>2.4.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The FreeType Project reports:
	<blockquote cite="http://sourceforge.net/projects/freetype/files/freetype2/2.4.11/README/view">
	 Some vulnerabilities in the BDF implementation have been fixed.
	 Users of this font format should upgrade.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://sourceforge.net/projects/freetype/files/freetype2/2.4.11/README/view</url>
 </references>
 <dates>
 <discovery>2012-12-20</discovery>
 <entry>2013-01-05</entry>
 </dates>
 </vuln>

<vuln vid="a264b1b0-5726-11e2-9483-14dae938ec40">
 <topic>moinmoin -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moinmoin</name>
	<range><lt>1.9.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MoinMoin developers report the following vulnerabilities
	 as fixed in version 1.9.6:
	<blockquote cite="http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES">
	 <ul>
	 <li>remote code execution vulnerability in
	 twikidraw/anywikidraw action,</li>
	 <li>path traversal vulnerability in AttachFile action,</li>
	 <li>XSS issue, escape page name in rss link.</li>
	 </ul>
	</blockquote>
	CVE entries at MITRE furher clarify:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-6081">
	 Multiple unrestricted file upload vulnerabilities in the
	 (1) twikidraw (action/twikidraw.py) and (2) anywikidraw
	 (action/anywikidraw.py) actions in MoinMoin before 1.9.6
	 allow remote authenticated users with write permissions to
	 execute arbitrary code by uploading a file with an
	 executable extension, then accessing it via a direct request
	 to the file in an unspecified directory, as exploited in the
	 wild in July 2012.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-6080">
	 Directory traversal vulnerability in the
	 _do_attachment_move function in the AttachFile action
	 (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5
	 allows remote attackers to overwrite arbitrary files via a
	 .. (dot dot) in a file name.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-6082">
	 Cross-site scripting (XSS) vulnerability in the rsslink
	 function in theme/__init__.py in MoinMoin 1.9.5 allows
	 remote attackers to inject arbitrary web script or HTML
	 via the page name in a rss link.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-6081</cvename>
 <cvename>CVE-2012-6080</cvename>
 <cvename>CVE-2012-6082</cvename>
 <url>http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES</url>
 <url>http://www.debian.org/security/2012/dsa-2593</url>
 </references>
 <dates>
 <discovery>2012-12-29</discovery>
 <entry>2013-01-05</entry>
 <modified>2013-01-06</modified>
 </dates>
 </vuln>

<vuln vid="f7c87a8a-55d5-11e2-a255-c8600054b392">
 <topic>asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk11</name>
	<range><gt>11.*</gt><lt>11.1.2</lt></range>
 </package>
 <package>
	<name>asterisk10</name>
	<range><gt>10.*</gt><lt>10.11.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.19.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/security">
	 Crashes due to large stack allocations when using TCP
	 Denial of Service Through Exploitation of Device State Caching
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5976</cvename>
 <cvename>CVE-2012-5977</cvename>
 <url>http://downloads.digium.com/pub/security/AST-2012-014.html</url>
 <url>http://downloads.digium.com/pub/security/AST-2012-015.html</url>
 <url>https://www.asterisk.org/security</url>
 </references>
 <dates>
 <discovery>2013-01-02</discovery>
 <entry>2013-01-03</entry>
 </dates>
 </vuln>

<vuln vid="4108cc57-54d7-11e2-9483-14dae938ec40">
 <topic>ircd-ratbox and charybdis -- remote DoS vulnerability</topic>
 <affects>
 <package>
	<name>ircd-ratbox</name>
	<range><gt>2.*</gt><lt>3.0.8</lt></range>
 </package>
 <package>
	<name>charybdis</name>
	<range><lt>3.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	atheme.org reports:
	<blockquote cite="http://www.ratbox.org/ASA-2012-12-31.txt">
	 All versions of Charybdis are vulnerable to a remotely-triggered
	 crash bug caused by code originating from ircd-ratbox 2.0.
	 (Incidentally, this means all versions since ircd-ratbox 2.0 are
	 also vulnerable.)
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.ratbox.org/ASA-2012-12-31.txt</url>
 </references>
 <dates>
 <discovery>2012-12-31</discovery>
 <entry>2013-01-02</entry>
 </dates>
 </vuln>

<vuln vid="101f0aae-52d1-11e2-87fe-f4ce46b9ace8">
 <topic>puppet -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>puppet</name>
	<range><gt>2.6.*</gt><lt>2.6.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	puppet -- multiple vulnerabilities
	<blockquote cite="http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.6.17">
	 Arbitrary file read on the puppet master from authenticated clients (high). It is possible to construct an HTTP get request from an authenticated client with a valid certificate that will return the contents of an arbitrary file on the Puppet master that the master has read-access to.
	 Arbitrary file delete/D.O.S on Puppet Master from authenticated clients (high). Given a Puppet master with the "Delete" directive allowed in auth.conf for an authenticated host, an attacker on that host can send a specially crafted Delete request that can cause an arbitrary file deletion on the Puppet master, potentially causing a denial of service attack. Note that this vulnerability does *not* exist in Puppet as configured by default.
	 Insufficient input validation for agent hostnames (low). An attacker could trick the administrator into signing an attacker's certificate rather than the intended one by constructing specially crafted certificate requests containing specific ANSI control sequences. It is possible to use the sequences to rewrite the order of text displayed to an administrator such that display of an invalid certificate and valid certificate are transposed. If the administrator signs the attacker's certificate, the attacker can then man-in-the-middle the agent.
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-3864</cvename>
	<cvename>CVE-2012-3865</cvename>
	<cvename>CVE-2012-3867</cvename>
	<url>http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.6.17</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-3864/</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-3865/</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-3867/</url>
 </references>
 <dates>
 <discovery>2012-07-10</discovery>
 <entry>2012-12-30</entry>
 </dates>
 </vuln>

<vuln vid="13320091-52a6-11e2-a289-1c4bd681f0cf">
 <topic>otrs -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><lt>3.1.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OTRS Security Advisory reports:
	<blockquote cite="http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-03/">
	 This advisory covers vulnerabilities discovered in the OTRS core
system. This is a variance of the XSS vulnerability, where an attacker could
send a specially prepared HTML email to OTRS which would cause JavaScript code
to be executed in your browser while displaying the email. In this case this is
achieved by using javascript source attributes with whitespaces.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4751</cvename>
 <url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03/</url>
<url>http://www.kb.cert.org/vuls/id/603276</url>
 </references>
 <dates>
 <discovery>2012-10-16</discovery>
 <entry>2012-12-30</entry>
 </dates>
 </vuln>

<vuln vid="95a69d1a-52a5-11e2-a289-1c4bd681f0cf">
 <topic>otrs -- XSS vulnerability in Firefox and Opera</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><lt>3.1.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OTRS Security Advisory reports:
	<blockquote cite="http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-02/">
	 This advisory covers vulnerabilities discovered in the OTRS core
system. This is a variance of the XSS vulnerability, where an attacker could
send a specially prepared HTML email to OTRS which would cause JavaScript code
to be executed in your browser while displaying the email in Firefox and Opera.
In this case this is achieved with an invalid HTML structure with nested tags.

	</blockquote>
 </body>
 </description>
 <references>
<cvename>CVE-2012-4600</cvename>
 <url>http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-02/</url>
 </references>
 <dates>
 <discovery>2012-08-30</discovery>
 <entry>2012-12-30</entry>
 </dates>
 </vuln>

<vuln vid="49a6026a-52a3-11e2-a289-1c4bd681f0cf">
 <topic>otrs -- XSS vulnerability in Internet Explorer</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><lt>3.1.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OTRS Security Advisory reports:
	<blockquote cite="http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-01/">
	 This advisory covers vulnerabilities discovered in the OTRS core
system. Due to the XSS vulnerability in Internet Explorer an attacker could send
a specially prepared HTML email to OTRS which would cause JavaScript code to be
executed in your Internet Explorer while displaying the email.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2582</cvename>
 <url>http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-01/</url>
 </references>
 <dates>
 <discovery>2012-08-22</discovery>
 <entry>2012-12-30</entry>
 </dates>
 </vuln>

<vuln vid="c37de843-488e-11e2-a5c9-0019996bc1f7">
 <topic>squid -- denial of service</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.7.9_4</lt></range>
	<range><ge>3.1</ge><lt>3.1.23</lt></range>
	<range><ge>3.2</ge><lt>3.2.6</lt></range>
	<range><ge>3.3</ge><lt>3.3.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid developers report:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2012_1.txt">
	 Due to missing input validation Squid cachemgr.cgi tool
	 is vulnerable to a denial of service attack when processing
	 specially crafted requests.
	 This problem allows any client able to reach the
	 cachemgr.cgi to perform a denial of service attack on the
	 service host.
	 The nature of the attack may cause secondary effects
	 through resource consumption on the host server.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5643</cvename>
 <cvename>CVE-2013-0189</cvename>
 <url>http://www.squid-cache.org/Advisories/SQUID-2012_1.txt</url>
 </references>
 <dates>
 <discovery>2012-12-17</discovery>
 <entry>2012-12-28</entry>
 <modified>2013-05-02</modified>
 </dates>
 </vuln>

<vuln vid="85f33a8d-492f-11e2-aa75-003067c2616f">
 <topic>opera -- execution of arbitrary code</topic>
 <affects>
 <package>
	<name>opera</name>
	<range><lt>12.12</lt></range>
 </package>
 <package>
	<name>opera-devel</name>
	<range><lt>12.12</lt></range>
 </package>
 <package>
	<name>linux-opera</name>
	<range><lt>12.12</lt></range>
 </package>
 <package>
	<name>linux-opera-devel</name>
	<range><lt>12.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera reports:
	<blockquote cite="http://www.opera.com/support/kb/view/1038/">
	 When loading GIF images into memory, Opera should allocate the
	 correct amount of memory to store that image. Specially crafted
	 image files can cause Opera to allocate the wrong amount of memory.
	 Subsequent data may then overwrite unrelated memory with
	 attacker-controlled data. This can lead to a crash, which may also
	 execute that data as code.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.opera.com/support/kb/view/1038/</url>
 <url>http://www.opera.com/support/kb/view/1039/</url>
 </references>
 <dates>
 <discovery>2012-12-18</discovery>
 <entry>2012-12-18</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="1657a3e6-4585-11e2-a396-10bf48230856">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.258</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-27.html">
	 These updates address vulnerabilities that could cause a crash
	 and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5676</cvename>
 <cvename>CVE-2012-5677</cvename>
 <cvename>CVE-2012-5678</cvename>
 <url>https://www.adobe.com/support/security/bulletins/apsb12-27.html</url>
 </references>
 <dates>
 <discovery>2012-12-11</discovery>
 <entry>2012-12-14</entry>
 </dates>
 </vuln>

<vuln vid="953911fe-51ef-11e2-8e34-0022156e8794">
 <topic>tomcat -- bypass of CSRF prevention filter</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><ge>6.0.0</ge><le>6.0.35</le></range>
 </package>
 <package>
	<name>tomcat7</name>
	<range><ge>7.0.0</ge><le>7.0.31</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation reports:
	<blockquote cite="http://tomcat.apache.org/security-7.html">
	 The CSRF prevention filter could be bypassed if a request was made to a
	 protected resource without a session identifier present in the request.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4431</cvename>
 <url>http://tomcat.apache.org/security-6.html</url>
 <url>http://tomcat.apache.org/security-7.html</url>
 </references>
 <dates>
 <discovery>2012-12-04</discovery>
 <entry>2012-12-04</entry>
 <modified>2017-03-18</modified>
 </dates>
 </vuln>

<vuln vid="134acaa2-51ef-11e2-8e34-0022156e8794">
 <topic>tomcat -- denial of service</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><ge>6.0.0</ge><le>6.0.35</le></range>
 </package>
 <package>
	<name>tomcat7</name>
	<range><ge>7.0.0</ge><le>7.0.27</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation reports:
	<blockquote cite="http://tomcat.apache.org/security-7.html">
	 When using the NIO connector with sendfile and HTTPS enabled, if a
	 client breaks the connection while reading the response an infinite loop
	 is entered leading to a denial of service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4534</cvename>
 <url>http://tomcat.apache.org/security-6.html</url>
 <url>http://tomcat.apache.org/security-7.html</url>
 </references>
 <dates>
 <discovery>2012-12-04</discovery>
 <entry>2012-12-04</entry>
 <modified>2017-03-18</modified>
 </dates>
 </vuln>

<vuln vid="f599dfc4-3ec2-11e2-8ae1-001a8056d0b5">
 <topic>tomcat -- bypass of security constraints</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><ge>6.0.0</ge><le>6.0.35</le></range>
 </package>
 <package>
	<name>tomcat7</name>
	<range><ge>7.0.0</ge><le>7.0.29</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation reports:
	<blockquote cite="http://tomcat.apache.org/security-7.html">
	 When using FORM authentication it was possible to bypass the security
	 constraint checks in the FORM authenticator by appending
	 "/j_security_check" to the end of the URL if some other component
	 (such as the Single-Sign-On valve) had called request.setUserPrincipal()
	 before the call to FormAuthenticator#authenticate().
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3546</cvename>
 <url>http://tomcat.apache.org/security-6.html</url>
 <url>http://tomcat.apache.org/security-7.html</url>
 </references>
 <dates>
 <discovery>2012-12-04</discovery>
 <entry>2012-12-04</entry>
 <modified>2017-03-18</modified>
 </dates>
 </vuln>

<vuln vid="2892a8e2-3d68-11e2-8e01-0800273fe665">
 <topic>dns/bind9* -- servers using DNS64 can be crashed by a crafted query</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><lt>9.9.2.1</lt></range>
 </package>
 <package>
	<name>bind99-base</name>
	<range><lt>9.9.2.1</lt></range>
 </package>
 <package>
	<name>bind98</name>
	<range><lt>9.8.4.1</lt></range>
 </package>
 <package>
	<name>bind98-base</name>
	<range><lt>9.8.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-00828">
	 BIND 9 nameservers using the DNS64 IPv6 transition mechanism are
	 vulnerable to a software defect that allows a crafted query to
	 crash the server with a REQUIRE assertion failure. Remote
	 exploitation of this defect can be achieved without extensive
	 effort, resulting in a denial-of-service (DoS) vector against
	 affected servers.
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-5688</cvename>
 </references>
 <dates>
 <discovery>2012-11-27</discovery>
 <entry>2012-12-04</entry>
 </dates>
 </vuln>

<vuln vid="f524d8e0-3d83-11e2-807a-080027ef73ec">
 <topic>bogofilter -- heap corruption by invalid base64 input</topic>
 <affects>
 <package> <name>bogofilter</name>		<range><lt>1.2.3</lt></range> </package>
 <package> <name>bogofilter-sqlite</name>	<range><lt>1.2.3</lt></range> </package>
 <package> <name>bogofilter-tc</name>	<range><lt>1.2.3</lt></range> </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	David Relson reports:
	<blockquote cite="https://bogofilter.svn.sourceforge.net/svnroot/bogofilter/trunk/bogofilter/NEWS">
	 Fix a heap corruption in base64 decoder on invalid input.
		Analysis and patch by Julius Plenz, [FU Berlin, Germany].
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5468</cvename>
 <url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2012-01</url>
 </references>
 <dates>
 <discovery>2012-10-17</discovery>
 <entry>2012-12-03</entry>
 </dates>
 </vuln>

<vuln vid="aa4f86af-3172-11e2-ad21-20cf30e32f6d">
 <topic>YUI JavaScript library -- JavaScript injection exploits in Flash components</topic>
 <affects>
 <package>
	<name>yahoo-ui</name>
	<range><le>2.8.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The YUI team reports:
	<blockquote cite="http://yuilibrary.com/support/20121030-vulnerability/">
	 <h1>Vulnerability in YUI 2.4.0 through YUI 2.9.0</h1>
	 A XSS vulnerability has been discovered in some YUI 2 .swf files
	 from versions 2.4.0 through 2.9.0. This defect allows JavaScript
	 injection exploits to be created against domains that host affected
	 YUI .swf files.
	 If your site loads YUI 2 from a CDN (yui.yahooapis.com,
	 ajax.googleapis.com, etc.) and not from your own domain, you
	 are not affected. YUI 3 is not affected by this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5881</cvename>
 <cvename>CVE-2012-5882</cvename>
 <url>http://yuilibrary.com/support/20121030-vulnerability/</url>
 </references>
 <dates>
 <discovery>2012-10-30</discovery>
 <entry>2012-11-27</entry>
 <modified>2012-11-29</modified>
 </dates>
 </vuln>

<vuln vid="5536c8e4-36b3-11e2-a633-902b343deec9">
 <topic>FreeBSD -- Linux compatibility layer input validation error</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_11</lt></range>
	<range><ge>8.3</ge><lt>8.3_5</lt></range>
	<range><ge>9.0</ge><lt>9.0_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-12:08.linux.asc">
	 A programming error in the handling of some Linux system calls
	 may result in memory locations being accessed without proper
	 validation.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-12:08.linux</freebsdsa>
 <cvename>CVE-2012-4576</cvename>
 </references>
 <dates>
 <discovery>2012-11-22</discovery>
 <entry>2012-11-24</entry>
 </dates>
 </vuln>

<vuln vid="f115f693-36b2-11e2-a633-902b343deec9">
 <topic>FreeBSD -- Insufficient message length validation for EAP-TLS messages</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>8.3</ge><lt>8.3_5</lt></range>
	<range><ge>9.0</ge><lt>9.0_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-12:07.hostapd.asc">
	 The internal authentication server of hostapd does not
	 sufficiently validate the message length field of EAP-TLS
	 messages.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-12:07.hostapd</freebsdsa>
 <cvename>CVE-2012-4445</cvename>
 </references>
 <dates>
 <discovery>2012-11-22</discovery>
 <entry>2012-11-24</entry>
 </dates>
 </vuln>

<vuln vid="4b79538b-a450-11e2-9898-001060e06fd4">
 <topic>FreeBSD -- Multiple Denial of Service vulnerabilities with named(8)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_11</lt></range>
	<range><ge>8.3</ge><lt>8.3_5</lt></range>
	<range><ge>9.0</ge><lt>9.0_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-12:06.bind.asc">
	 The BIND daemon would crash when a query is made on a resource
	 record with RDATA that exceeds 65535 bytes.
	 The BIND daemon would lock up when a query is made on specific
	 combinations of RDATA.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-12:06.bind</freebsdsa>
 <cvename>CVE-2012-4244</cvename>
 <cvename>CVE-2012-5166</cvename>
 </references>
 <dates>
 <discovery>2012-11-22</discovery>
 <entry>2012-11-24</entry>
 </dates>
 </vuln>

<vuln vid="0925716f-34e2-11e2-aa75-003067c2616f">
 <topic>opera -- execution of arbitrary code</topic>
 <affects>
 <package>
	<name>opera</name>
	<range><lt>12.11</lt></range>
 </package>
 <package>
	<name>opera-devel</name>
	<range><lt>12.11</lt></range>
 </package>
 <package>
	<name>linux-opera</name>
	<range><lt>12.11</lt></range>
 </package>
 <package>
	<name>linux-opera-devel</name>
	<range><lt>12.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera reports:
	<blockquote cite="http://www.opera.com/support/kb/view/1036/">
	 When requesting pages using HTTP, Opera temporarily stores the
	 response in a buffer. In some cases, Opera may incorrectly allocate
	 too little space for a buffer, and may then store too much of the
	 response in that buffer. This causes a buffer overflow, which in
	 turn can lead to a memory corruption and crash. It is possible to
	 use this crash to execute the overflowing data as code, which may
	 be controlled by an attacking site.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.opera.com/support/kb/view/1036/</url>
 </references>
 <dates>
 <discovery>2012-11-19</discovery>
 <entry>2012-11-22</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="1cd3ca42-33e6-11e2-a255-5404a67eef98">
 <topic>lighttpd -- remote DoS in header parsing</topic>
 <affects>
 <package>
	<name>lighttpd</name>
	<range><gt>1.4.30</gt><lt>1.4.32</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Lighttpd security advisory reports:
	<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2012_01.txt">
	 Certain Connection header values will trigger an endless loop, for example:
	 "Connection: TE,,Keep-Alive"
	 On receiving such value, lighttpd will enter an endless loop,
	 detecting an empty token but not incrementing the current string
	 position, and keep reading the ',' again and again.
	 This bug was introduced in 1.4.31, when we fixed an "invalid read"
	 bug (it would try to read the byte before the string if it started
	 with ',', although the value wasn't actually used).
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-5533</cvename>
 </references>
 <dates>
 <discovery>2012-11-17</discovery>
 <entry>2012-11-21</entry>
 </dates>
 </vuln>

<vuln vid="d23119df-335d-11e2-b64c-c8600054b392">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>17.0,1</lt></range>
	<range><lt>10.0.11,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>10.0.11,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.14</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.11</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.14</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>17.0</lt></range>
	<range><lt>10.0.11</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2012-91 Miscellaneous memory safety hazards (rv:17.0/
	 rv:10.0.11)
	 MFSA 2012-92 Buffer overflow while rendering GIF images
	 MFSA 2012-93 evalInSanbox location context incorrectly applied
	 MFSA 2012-94 Crash when combining SVG text on path with CSS
	 MFSA 2012-95 Javascript: URLs run in privileged context on New Tab
	 page
	 MFSA 2012-96 Memory corruption in str_unescape
	 MFSA 2012-97 XMLHttpRequest inherits incorrect principal within
	 sandbox
	 MFSA 2012-98 Firefox installer DLL hijacking
	 MFSA 2012-99 XrayWrappers exposes chrome-only properties when not
	 in chrome compartment
	 MFSA 2012-100 Improper security filtering for cross-origin
	 wrappers
	 MFSA 2012-101 Improper character decoding in HZ-GB-2312 charset
	 MFSA 2012-102 Script entered into Developer Toolbar runs with
	 chrome privileges
	 MFSA 2012-103 Frames can shadow top.location
	 MFSA 2012-104 CSS and HTML injection through Style Inspector
	 MFSA 2012-105 Use-after-free and buffer overflow issues found
	 MFSA 2012-106 Use-after-free, buffer overflow, and memory
	 corruption issues found using Address Sanitizer
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-4201</cvename>
	<cvename>CVE-2012-4202</cvename>
	<cvename>CVE-2012-4203</cvename>
	<cvename>CVE-2012-4204</cvename>
	<cvename>CVE-2012-4205</cvename>
	<cvename>CVE-2012-4206</cvename>
	<cvename>CVE-2012-4207</cvename>
	<cvename>CVE-2012-4208</cvename>
	<cvename>CVE-2012-4209</cvename>
	<cvename>CVE-2012-4210</cvename>
	<cvename>CVE-2012-4212</cvename>
	<cvename>CVE-2012-4213</cvename>
	<cvename>CVE-2012-4214</cvename>
	<cvename>CVE-2012-4215</cvename>
	<cvename>CVE-2012-4216</cvename>
	<cvename>CVE-2012-4217</cvename>
	<cvename>CVE-2012-4218</cvename>
	<cvename>CVE-2012-5829</cvename>
	<cvename>CVE-2012-5830</cvename>
	<cvename>CVE-2012-5833</cvename>
	<cvename>CVE-2012-5835</cvename>
	<cvename>CVE-2012-5836</cvename>
	<cvename>CVE-2012-5837</cvename>
	<cvename>CVE-2012-5838</cvename>
	<cvename>CVE-2012-5839</cvename>
	<cvename>CVE-2012-5840</cvename>
	<cvename>CVE-2012-5841</cvename>
	<cvename>CVE-2012-5842</cvename>
	<cvename>CVE-2012-5843</cvename>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-90.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-91.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-92.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-93.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-94.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-95.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-96.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-97.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-98.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-99.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-100.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-101.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-102.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-103.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-104.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-105.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-106.html</url>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
 </references>
 <dates>
 <discovery>2012-11-20</discovery>
 <entry>2012-11-20</entry>
 </dates>
 </vuln>

<vuln vid="81826d12-317a-11e2-9186-406186f3d89d">
 <topic>weechat -- Arbitrary shell command execution via scripts</topic>
 <affects>
 <package>
	<name>weechat</name>
	<range><ge>0.3.0</ge><lt>0.3.9.2</lt></range>
 </package>
 <package>
	<name>weechat-devel</name>
	<range><lt>20121118</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sebastien Helleu reports:
	<blockquote cite="http://weechat.org/security/">
	 Untrusted command for function hook_process could lead to
	 execution of commands, because of shell expansions.
	 Workaround with a non-patched version: remove/unload all scripts
	 calling function hook_process (for maximum safety).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://weechat.org/security/</url>
 <url>https://savannah.nongnu.org/bugs/?37764</url>
 </references>
 <dates>
 <discovery>2012-11-15</discovery>
 <entry>2012-11-18</entry>
 <modified>2012-11-18</modified>
 </dates>
 </vuln>

<vuln vid="2b841f88-2e8d-11e2-ad21-20cf30e32f6d">
 <topic>bugzilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><ge>3.6.0</ge><lt>3.6.12</lt></range>
	<range><ge>4.0.0</ge><lt>4.0.9</lt></range>
	<range><ge>4.2.0</ge><lt>4.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/3.6.11/">
	 The following security issues have been discovered in
	 Bugzilla:
	 <h1>Information Leak</h1>
	 If the visibility of a custom field is controlled by a product
	 or a component of a product you cannot see, their names are
	 disclosed in the JavaScript code generated for this custom field
	 despite they should remain confidential.
	 Calling the User.get method with a 'groups' argument leaks the
	 existence of the groups depending on whether an error is thrown
	 or not. This method now also throws an error if the user calling
	 this method does not belong to these groups (independently of
	 whether the groups exist or not).
	 Trying to mark an attachment in a bug you cannot see as obsolete
	 discloses its description in the error message. The description
	 of the attachment is now removed from the error message.
	 <h1>Cross-Site Scripting</h1>
	 Due to incorrectly filtered field values in tabular reports,
	 it is possible to inject code leading to XSS.
	 A vulnerability in swfstore.swf from YUI2 allows JavaScript
	 injection exploits to be created against domains that host this
	 affected YUI .swf file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4199</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=731178</url>
 <cvename>CVE-2012-4198</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=781850</url>
 <cvename>CVE-2012-4197</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=802204</url>
 <cvename>CVE-2012-4189</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=790296</url>
 <cvename>CVE-2012-5881</cvename>
 <cvename>CVE-2012-5882</cvename>
 <cvename>CVE-2012-5883</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=808845</url>
 <url>http://yuilibrary.com/support/20121030-vulnerability/</url>
 </references>
 <dates>
 <discovery>2012-11-13</discovery>
 <entry>2012-11-14</entry>
 <modified>2012-11-27</modified>
 </dates>
 </vuln>

<vuln vid="79818ef9-2d10-11e2-9160-00262d5ed8ee">
 <topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
 <affects>
 <package>
	<name>typo3</name>
	<range><ge>4.5.0</ge><lt>4.5.21</lt></range>
	<range><ge>4.6.0</ge><lt>4.6.14</lt></range>
	<range><ge>4.7.0</ge><lt>4.7.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Typo Security Team reports:
	<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/">
	 TYPO3 Backend History Module - Due to missing encoding of user
	 input, the history module is susceptible to SQL Injection and
	 Cross-Site Scripting. A valid backend login is required to exploit
	 this vulnerability. Credits go to Thomas Worm who discovered and
	 reported the issue.
	 TYPO3 Backend API - Failing to properly HTML-encode user input the
	 tree render API (TCA-Tree) is susceptible to Cross-Site Scripting.
	 TYPO3 Versions below 6.0 does not make us of this API, thus is not
	 exploitable, if no third party extension is installed which uses
	 this API. A valid backend login is required to exploit this
	 vulnerability. Credits go to Richard Brain who discovered and
	 reported the issue.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/</url>
 </references>
 <dates>
 <discovery>2012-11-08</discovery>
 <entry>2012-11-12</entry>
 </dates>
 </vuln>

<vuln vid="a537b449-2b19-11e2-b339-90e6ba652cce">
 <topic>DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust</topic>
 <affects>
 <package>
	<name>opendkim</name>
	<range><lt>2.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US-CERT reports:
	<blockquote cite="http://www.kb.cert.org/vuls/id/268267">
	 DomainKeys Identified Mail (DKIM) Verifiers may
	 inappropriately convey message trust when messages are
	 signed using test or small bit signing keys.
	</blockquote>
 </body>
 </description>
 <references>
 <certvu>268267</certvu>
 </references>
 <dates>
 <discovery>2012-10-24</discovery>
 <entry>2012-11-12</entry>
 </dates>
 </vuln>

<vuln vid="e02c572f-2af0-11e2-bb44-003067b2972c">
 <topic>weechat -- Crash or freeze when decoding IRC colors in strings</topic>
 <affects>
 <package>
	<name>weechat</name>
	<range><ge>0.3.6</ge><lt>0.3.9.1</lt></range>
 </package>
 <package>
	<name>weechat-devel</name>
	<range><ge>20110614</ge><lt>20121110</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sebastien Helleu reports:
	<blockquote cite="https://savannah.nongnu.org/bugs/?37704">
	 A buffer overflow is causing a crash or freeze of WeeChat when
	 decoding IRC colors in strings.
	 Workaround for a non-patched version:
	 /set irc.network.colors_receive off
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5854</cvename>
 <freebsdpr>ports/173513</freebsdpr>
 <url>http://weechat.org/security/</url>
 <url>https://savannah.nongnu.org/bugs/?37704</url>
 </references>
 <dates>
 <discovery>2012-11-09</discovery>
 <entry>2012-11-10</entry>
 <modified>2012-11-13</modified>
 </dates>
 </vuln>

<vuln vid="5e647ca3-2aea-11e2-b745-001fd0af1a4c">
 <topic>ruby -- Hash-flooding DoS vulnerability for ruby 1.9</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>1.9</ge><lt>1.9.3.327</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The official ruby site reports:
	<blockquote cite="http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/">
	 Carefully crafted sequence of strings can cause a denial of service
	 attack on the service that parses the sequence to create a Hash
	 object by using the strings as keys. For instance, this
	 vulnerability affects web application that parses the JSON data
	 sent from untrusted entity.
	 This vulnerability is similar to CVS-2011-4815 for ruby 1.8.7. ruby
	 1.9 versions were using modified MurmurHash function but it's
	 reported that there is a way to create sequence of strings that
	 collide their hash values each other. This fix changes the Hash
	 function of String object from the MurmurHash to SipHash 2-4.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5371</cvename>
 <url>http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/</url>
 </references>
 <dates>
 <discovery>2012-11-10</discovery>
 <entry>2012-11-10</entry>
 </dates>
 </vuln>

<vuln vid="152e4c7e-2a2e-11e2-99c7-00a0d181e71d">
 <topic>tomcat -- authentication weaknesses</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><gt>5.5.0</gt><lt>5.5.36</lt></range>
	<range><gt>6.0.0</gt><lt>6.0.36</lt></range>
	<range><gt>7.0.0</gt><lt>7.0.30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation reports:
	<blockquote cite="http://tomcat.apache.org/security.html">
	 Three weaknesses in Tomcat's implementation of DIGEST
	 authentication were identified and resolved:
	 <ul>
	 <li> Tomcat tracked client rather than server nonces and nonce count.</li>
	 <li> When a session ID was present, authentication was bypassed.</li>
	 <li> The user name and password were not checked before when indicating
	 that a nonce was stale.</li>
	 </ul>
	 These issues reduced the security of DIGEST authentication making
	 replay attacks possible in some circumstances.
	 The first issue was identified by Tilmann Kuhn. The second and third
	 issues were identified by the Tomcat security team during the code
	 review resulting from the first issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3439</cvename>
 <url>http://tomcat.apache.org/security.html</url>
 <url>http://tomcat.apache.org/security-5.html</url>
 <url>http://tomcat.apache.org/security-6.html</url>
 <url>http://tomcat.apache.org/security-7.html</url>
 </references>
 <dates>
 <discovery>2012-11-05</discovery>
 <entry>2012-11-08</entry>
 <modified>2012-11-09</modified>
 </dates>
 </vuln>

<vuln vid="4ca26574-2a2c-11e2-99c7-00a0d181e71d">
 <topic>tomcat -- Denial of Service</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><gt>6.0.0</gt><lt>6.0.36</lt></range>
	<range><gt>7.0.0</gt><lt>7.0.28</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation reports:
	<blockquote cite="http://tomcat.apache.org/security.html">
	 The checks that limited the permitted size of request headers were
	 implemented too late in the request parsing process for the HTTP NIO
	 connector. This enabled a malicious user to trigger an
	 OutOfMemoryError by sending a single request with very large
	 headers. This issue was identified by Josh Spiewak.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2733</cvename>
 <url>http://tomcat.apache.org/security.html</url>
 <url>http://tomcat.apache.org/security-6.html</url>
 <url>http://tomcat.apache.org/security-7.html</url>
 </references>
 <dates>
 <discovery>2012-11-05</discovery>
 <entry>2012-11-08</entry>
 <modified>2012-11-09</modified>
 </dates>
 </vuln>

<vuln vid="4b8b748e-2a24-11e2-bb44-003067b2972c">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><le>11.2r202.243</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-22.html">
	 These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5274</cvename>
 <cvename>CVE-2012-5275</cvename>
 <cvename>CVE-2012-5276</cvename>
 <cvename>CVE-2012-5277</cvename>
 <cvename>CVE-2012-5278</cvename>
 <cvename>CVE-2012-5279</cvename>
 <cvename>CVE-2012-5280</cvename>
 <url>https://www.adobe.com/support/security/bulletins/apsb12-24.html</url>
 </references>
 <dates>
 <discovery>2012-10-08</discovery>
 <entry>2012-11-02</entry>
 </dates>
 </vuln>

<vuln vid="38daea4f-2851-11e2-9483-14dae938ec40">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<range><lt>12.10</lt></range>
 </package>
 <package>
	<name>opera-devel</name>
	<range><lt>12.10</lt></range>
 </package>
 <package>
	<name>linux-opera</name>
	<range><lt>12.10</lt></range>
 </package>
 <package>
	<name>linux-opera-devel</name>
	<range><lt>12.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera reports:
	<blockquote cite="http://www.opera.com/support/kb/view/1030/">
	 CORS (Cross-Origin Resource Sharing) allows web pages to retrieve
	 the contents of pages from other sites, with their permission,
	 as they would appear for the current user.
	 When requests are made in this way, the browser should only allow
	 the page content to be retrieved if the target site sends the
	 correct headers that give permission for their contents to be
	 used in this way. Specially crafted requests may trick Opera
	 into thinking that the target site has given permission when it
	 had not done so. This can result in the contents of any target page
	 being revealed to untrusted sites, including any
	 sensitive information or session IDs contained within the
	 source of those pages.
	</blockquote>
	Also reported are vulnerabilities involving SVG graphics and XSS.
 </body>
 </description>
 <references>
 <url>http://www.opera.com/support/kb/view/1030/</url>
 <url>http://www.opera.com/support/kb/view/1031/</url>
 <url>http://www.opera.com/support/kb/view/1033/</url>
 </references>
 <dates>
 <discovery>2012-11-06</discovery>
 <entry>2012-11-06</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="36533a59-2770-11e2-bb44-003067b2972c">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><le>11.2r202.238</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-22.html">
	 These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5248</cvename>
 <cvename>CVE-2012-5249</cvename>
 <cvename>CVE-2012-5250</cvename>
 <cvename>CVE-2012-5251</cvename>
 <cvename>CVE-2012-5252</cvename>
 <cvename>CVE-2012-5253</cvename>
 <cvename>CVE-2012-5254</cvename>
 <cvename>CVE-2012-5255</cvename>
 <cvename>CVE-2012-5256</cvename>
 <cvename>CVE-2012-5257</cvename>
 <cvename>CVE-2012-5258</cvename>
 <cvename>CVE-2012-5259</cvename>
 <cvename>CVE-2012-5260</cvename>
 <cvename>CVE-2012-5261</cvename>
 <cvename>CVE-2012-5262</cvename>
 <cvename>CVE-2012-5263</cvename>
 <cvename>CVE-2012-5264</cvename>
 <cvename>CVE-2012-5265</cvename>
 <cvename>CVE-2012-5266</cvename>
 <cvename>CVE-2012-5267</cvename>
 <cvename>CVE-2012-5269</cvename>
 <cvename>CVE-2012-5270</cvename>
 <cvename>CVE-2012-5271</cvename>
 <cvename>CVE-2012-5272</cvename>
 <cvename>CVE-2012-5285</cvename>
 <cvename>CVE-2012-5286</cvename>
 <cvename>CVE-2012-5287</cvename>
 <cvename>CVE-2012-5673</cvename>
 <cvename>CVE-2012-2034</cvename>
 <cvename>CVE-2012-2035</cvename>
 <cvename>CVE-2012-2036</cvename>
 <cvename>CVE-2012-2037</cvename>
 <cvename>CVE-2012-2038</cvename>
 <cvename>CVE-2012-2039</cvename>
 <cvename>CVE-2012-2040</cvename>
 <url>https://www.adobe.com/support/security/bulletins/apsb12-22.html</url>
 </references>
 <dates>
 <discovery>2012-10-08</discovery>
 <entry>2012-11-02</entry>
 </dates>
 </vuln>

<vuln vid="65539c54-2517-11e2-b9d6-20cf30e32f6d">
 <topic>apache22 -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>apache22</name>
	<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
 </package>
 <package>
	<name>apache22-event-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
 </package>
 <package>
	<name>apache22-itk-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
 </package>
 <package>
	<name>apache22-peruser-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
 </package>
 <package>
	<name>apache22-worker-mpm</name>
	<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Apache HTTP SERVER PROJECT reports:</h1>
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_22.html">
	 <h1>low: XSS in mod_negotiation when untrusted uploads are supported CVE-2012-2687</h1>
	 Possible XSS for sites which use mod_negotiation and
	 allow untrusted uploads to locations which have MultiViews enabled.
	 <h1>low: insecure LD_LIBRARY_PATH handling CVE-2012-0883</h1>
	 This issue was already fixed in port version 2.2.22_5
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2687</cvename>
 <cvename>CVE-2012-0833</cvename>
 </references>
 <dates>
 <discovery>2012-09-13</discovery>
 <entry>2012-11-02</entry>
 </dates>
 </vuln>

<vuln vid="ec89dc70-2515-11e2-8eda-000a5e1e33c6">
 <topic>webmin -- potential XSS attack via real name field</topic>
 <affects>
 <package>
	<name>webmin</name>
	<range><lt>1.600_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The webmin updates site reports
	<blockquote cite="http://www.webmin.com/updates.html">
	 Module: Change Passwords; Version: 1.600; Problem: Fix for potential XSS attack
	 via real name field; Solution: New module.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.webmin.com/updates.html</url>
 </references>
 <dates>
 <discovery>2012-11-02</discovery>
 <entry>2012-11-02</entry>
 </dates>
 </vuln>

<vuln vid="3decc87d-2498-11e2-b0c7-000d601460a4">
 <topic>ruby -- Unintentional file creation caused by inserting an illegal NUL character</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><gt>1.9.3,1</gt><lt>1.9.3.286,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The official ruby site reports:
	<blockquote cite="http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/">
	 A vulnerability was found that file creation routines can create
	 unintended files by strategically inserting NUL(s) in file paths.
	 This vulnerability has been reported as CVE-2012-4522.
	 Ruby can handle arbitrary binary patterns as Strings, including
	 NUL chars. On the other hand OSes and other libraries tend not.
	 They usually treat a NUL as an End of String mark. So to interface
	 them with Ruby, NUL chars should properly be avoided.
	 However methods like IO#open did not check the filename passed to
	 them, and just passed those strings to lower layer routines. This
	 led to create unintentional files.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4522</cvename>
 <url>http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/</url>
 <url>https://access.redhat.com/security/cve/CVE-2012-4522/</url>
 </references>
 <dates>
 <discovery>2012-10-12</discovery>
 <entry>2012-11-01</entry>
 </dates>
 </vuln>

<vuln vid="2a093853-2495-11e2-b0c7-000d601460a4">
 <topic>ruby -- $SAFE escaping vulnerability about Exception#to_s/NameError#to_s</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><gt>1.8.7,1</gt><lt>1.8.7.371,1</lt></range>
	<range><gt>1.9.3,1</gt><lt>1.9.3.286,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The official ruby site reports:
	<blockquote cite="http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/">
	 Vulnerabilities found for Exception#to_s, NameError#to_s, and
	 name_err_mesg_to_s() which is Ruby interpreter-internal API. A
	 malicious user code can bypass $SAFE check by utilizing one of
	 those security holes.
	 Ruby's $SAFE mechanism enables untrusted user codes to run in
	 $SAFE &gt;= 4 mode. This is a kind of sandboxing so some operations
	 are restricted in that mode to protect other data outside the
	 sandbox.
	 The problem found was around this mechanism. Exception#to_s,
	 NameError#to_s, and name_err_mesg_to_s() interpreter-internal API
	 was not correctly handling the $SAFE bits so a String object which
	 is not tainted can destructively be marked as tainted using them.
	 By using this an untrusted code in a sandbox can modify a
	 formerly-untainted string destructively.
	 Ruby 1.8 once had a similar security issue. It fixed
	 Exception#to_s and NameError#to_s, but name_err_mesg_to_str() issue
	 survived previous security fix
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4464</cvename>
 <cvename>CVE-2012-4466</cvename>
 <url>http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/</url>
 <url>https://access.redhat.com/security/cve/CVE-2012-4464/</url>
 </references>
 <dates>
 <discovery>2012-08-21</discovery>
 <entry>2012-11-01</entry>
 </dates>
 </vuln>

<vuln vid="4b738d54-2427-11e2-9817-c8600054b392">
 <topic>RT -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>rt40</name>
	<range><ge>4.0</ge><lt>4.0.8</lt></range>
 </package>
 <package>
	<name>rt38</name>
	<range><lt>3.8.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	BestPractical report:
	<blockquote cite="http://blog.bestpractical.com/2012/10/security-vulnerabilities-in-rt.html">
	 All versions of RT are vulnerable to an email header injection
	 attack. Users with ModifySelf or AdminUser can cause RT to add
	 arbitrary headers or content to outgoing mail. Depending on the
	 scrips that are configured, this may be be leveraged for information
	 leakage or phishing.
	 RT 4.0.0 and above and RTFM 2.0.0 and above contain a vulnerability
	 due to lack of proper rights checking, allowing any privileged user
	 to create Articles in any class.
	 All versions of RT with cross-site-request forgery (CSRF)
	 protection (RT 3.8.12 and above, RT 4.0.6 and above, and any
	 instances running the security patches released 2012-05-22) contain
	 a vulnerability which incorrectly allows though CSRF requests which
	 toggle ticket bookmarks.
	 All versions of RT are vulnerable to a confused deputy attack on
	 the user. While not strictly a CSRF attack, users who are not logged
	 in who are tricked into following a malicious link may, after
	 supplying their credentials, be subject to an attack which leverages
	 their credentials to modify arbitrary state. While users who were
	 logged in would have observed the CSRF protection page, users who
	 were not logged in receive no such warning due to the intervening
	 login process. RT has been extended to notify users of pending
	 actions during the login process.
	 RT 3.8.0 and above are susceptible to a number of vulnerabilities
	 concerning improper signing or encryption of messages using GnuPG;
	 if GnuPG is not enabled, none of the following affect you.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4730</cvename>
 <cvename>CVE-2012-4731</cvename>
 <cvename>CVE-2012-4732</cvename>
 <cvename>CVE-2012-4734</cvename>
 <cvename>CVE-2012-4735</cvename>
 <cvename>CVE-2012-4884</cvename>
 <url>http://blog.bestpractical.com/2012/10/security-vulnerabilities-in-rt.html</url>
 </references>
 <dates>
 <discovery>2012-10-26</discovery>
 <entry>2012-11-01</entry>
 </dates>
 </vuln>

<vuln vid="2adc3e78-22d1-11e2-b9f0-d0df9acfd7e5">
 <topic>drupal7 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal7</name>
	<range><lt>7.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="http://drupal.org/node/1815912">
	<ol>
	 <li>
	 Arbitrary PHP code execution
	 A bug in the installer code was identified that allows an attacker
	 to re-install Drupal using an external database server under certain
	 transient conditions. This could allow the attacker to execute
	 arbitrary PHP code on the original server.
	 </li>
	 <li>
	 Information disclosure - OpenID module
	 For sites using the core OpenID module, an information disclosure
	 vulnerability was identified that allows an attacker to read files
	 on the local filesystem by attempting to log in to the site using a
	 malicious OpenID server.
	 </li>
	</ol>
	</blockquote>
 </body>
 </description>
 <references>
	<url>http://drupal.org/node/1815912</url>
 </references>
 <dates>
 <discovery>2012-10-17</discovery>
 <entry>2012-10-31</entry>
 </dates>
 </vuln>

<vuln vid="6b3b1b97-207c-11e2-a03f-c8600054b392">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>16.0.2,1</lt></range>
	<range><lt>10.0.10,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>10.0.10,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.13.2</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.10</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.13.2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>16.0.2</lt></range>
	<range><lt>10.0.10</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2012-90 Fixes for Location object issues
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-4194</cvename>
	<cvename>CVE-2012-4195</cvename>
	<cvename>CVE-2012-4196</cvename>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-90.html</url>
 </references>
 <dates>
 <discovery>2012-10-26</discovery>
 <entry>2012-10-27</entry>
 </dates>
 </vuln>

<vuln vid="b0f3ab1f-1f3b-11e2-8fe9-0022156e8794">
 <topic>Exim -- remote code execution</topic>
 <affects>
 <package>
	<name>exim</name>
	<range><ge>4.70</ge><lt>4.80.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	This vulnerability affects Exim instances built with DKIM
	enabled (this is the default for FreeBSD Exim port) and running
	verification of DKIM signatures on the incoming mail
	messages.
	Phil Penncock reports:
	<blockquote cite="https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html">
	 This is a SECURITY release, addressing a CRITICAL remote
	 code execution flaw in versions of Exim between 4.70 and
	 4.80 inclusive, when built with DKIM support (the default).
	 This security vulnerability can be exploited by anyone
	 who can send email from a domain for which they control the
	 DNS.
	 You are not vulnerable if you built Exim with DISABLE_DKIM
	 or if you put this at the start of an ACL plumbed into
	 acl_smtp_connect or acl_smtp_rcpt:
	 <pre>warn control = dkim_disable_verify</pre>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5671</cvename>
 <url>https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html</url>
 </references>
 <dates>
 <discovery>2012-10-25</discovery>
 <entry>2012-10-26</entry>
 </dates>
 </vuln>

<vuln vid="5f326d75-1db9-11e2-bc8f-d0df9acfd7e5">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>django</name>
	<range><lt>1.4.2</lt></range>
 </package>
 <package>
	<name>django13</name>
	<range><lt>1.3.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Django Project reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2012/oct/17/security/">
	<ol>
	 <li>
	 Host header poisoning
	 Some parts of Django -- independent of end-user-written applications
	 -- make use of full URLs, including domain name, which are generated
	 from the HTTP Host header. Some attacks against this are beyond Django's
	 ability to control, and require the web server to be properly configured;
	 Django's documentation has for some time contained notes advising users
	 on such configuration.
	 Django's own built-in parsing of the Host header is, however, still
	 vulnerable, as was reported to us recently. The Host header parsing
	 in Django 1.3 and Django 1.4 -- specifically, django.http.HttpRequest.get_host()
	 -- was incorrectly handling username/password information in the header.
	 Thus, for example, the following Host header would be accepted by Django when
	 running on "validsite.com":
	 Host: validsite.com:random@evilsite.com
	 Using this, an attacker can cause parts of Django -- particularly the
	 password-reset mechanism -- to generate and display arbitrary URLs to users.
	 To remedy this, the parsing in HttpRequest.get_host() is being modified; Host
	 headers which contain potentially dangerous content (such as username/password
	 pairs) now raise the exception django.core.exceptions.SuspiciousOperation.
	 </li>
	 <li>
	 Documentation of HttpOnly cookie option
	 As of Django 1.4, session cookies are always sent with the HttpOnly flag, which
	 provides some additional protection from cross-site scripting attacks by denying
	 client-side scripts access to the session cookie.
	 Though not directly a security issue in Django, it has been reported that the
	 Django 1.4 documentation incorrectly described this change, by claiming that this
	 was now the default for all cookies set by the HttpResponse.set_cookie() method.
	 The Django documentation has been updated to reflect that this only applies to the
	 session cookie. Users of Django are encouraged to review their use of set_cookie()
	 to ensure that the HttpOnly flag is being set or unset appropriately.
	 </li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-4520</cvename>
	<url>https://www.djangoproject.com/weblog/2012/oct/17/security/</url>
 </references>
 <dates>
 <discovery>2012-10-17</discovery>
 <entry>2012-10-24</entry>
 </dates>
 </vuln>

<vuln vid="a7706414-1be7-11e2-9aad-902b343deec9">
 <topic>Wireshark -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<range><le>1.8.2_1</le></range>
 </package>
 <package>
	<name>wireshark-lite</name>
	<range><le>1.8.2_1</le></range>
 </package>
 <package>
	<name>tshark</name>
	<range><le>1.8.2_1</le></range>
 </package>
 <package>
	<name>tshark-lite</name>
	<range><le>1.8.2_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wireshark reports:
	<blockquote cite="http://www.wireshark.org/docs/relnotes/wireshark-1.8.3.html">
	 The HSRP dissector could go into an infinite loop.
	 The PPP dissector could abort.
	 Martin Wilck discovered an infinite loop in the DRDA
	 dissector.
	 Laurent Butti discovered a buffer overflow in the LDP
	 dissector.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5237</cvename>
 <cvename>CVE-2012-5238</cvename>
 <cvename>CVE-2012-5239</cvename>
 <cvename>CVE-2012-5240</cvename>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-26.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-27.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-28.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-29.html</url>
 <url>http://www.wireshark.org/docs/relnotes/wireshark-1.8.3.html</url>
 </references>
 <dates>
 <discovery>2012-10-02</discovery>
 <entry>2012-10-22</entry>
 <modified>2013-06-19</modified>
 </dates>
 </vuln>

<vuln vid="57652765-18aa-11e2-8382-00a0d181e71d">
 <topic>xlockmore -- local exploit</topic>
 <affects>
 <package>
	<name>xlockmore</name>
	<range><lt>5.40_1</lt></range>
 </package>
 <package>
	<name>ja-xlockmore</name>
	<range><lt>5.40_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ignatios Souvatzis of NetBSD reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2012/10/17/10">
	 Due to an error in the dclock screensaver in xlockmore, users who
	 explicitly use this screensaver or a random mix of screensavers using
	 something like "xlockmore -mode random" may have their screen unlocked
	 unexpectedly at a random time.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4524</cvename>
 <mlist>http://www.openwall.com/lists/oss-security/2012/10/17/10</mlist>
 </references>
 <dates>
 <discovery>2012-10-17</discovery>
 <entry>2012-10-17</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="e11955ca-187c-11e2-be36-00215af774f0">
 <topic>xinetd -- attackers can bypass access restrictions if tcpmux-servers service enabled</topic>
 <affects>
 <package>
	<name>xinetd</name>
	<range><lt>2.3.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Thomas Swan reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=790940">
	 xinetd allows for services to be configured with the TCPMUX
	 or TCPMUXPLUS service types, which makes those services
	 available on port 1, as per RFC 1078 [1], if the tcpmux-server
	 service is enabled. When the tcpmux-server service is enabled,
	 xinetd would expose _all_ enabled services via the tcpmux port,
	 instead of just the configured service(s). This could allow
	 a remote attacker to bypass firewall restrictions and access
	 services via the tcpmux port.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0862</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=790940</url>
 </references>
 <dates>
 <discovery>2012-02-15</discovery>
 <entry>2012-10-17</entry>
 </dates>
 </vuln>

<vuln vid="ec34d0c2-1799-11e2-b4ab-000c29033c32">
 <topic>Zend Framework -- Multiple vulnerabilities via XXE injection</topic>
 <affects>
 <package>
	<name>ZendFramework</name>
	<range><lt>1.11.13</lt></range>
 </package>
 <package>
	<name>magento</name>
	<range><lt>1.7.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Zend Framework team reports:
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2012-01">
	 The XmlRpc package of Zend Framework is vulnerable to XML
	 eXternal Entity Injection attacks (both server and client).
	 The SimpleXMLElement class (SimpleXML PHP extension) is used
	 in an insecure way to parse XML data. External entities can be
	 specified by adding a specific DOCTYPE element to XML-RPC
	 requests. By exploiting this vulnerability an application may be
	 coerced to open arbitrary files and/or TCP connections.
	 Additionally, the Zend_Dom, Zend_Feed, Zend_Soap, and
	 Zend_XmlRpc components are vulnerable to XML Entity Expansion
	 (XEE) vectors, leading to Denial of Service vectors. XEE attacks
	 occur when the XML DOCTYPE declaration includes XML entity
	 definitions that contain either recursive or circular references;
	 this leads to CPU and memory consumption, making Denial of
	 Service exploits trivial to implement.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3363</cvename>
 <url>https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt</url>
 <url>http://framework.zend.com/security/advisory/ZF2012-01</url>
 <url>http://framework.zend.com/security/advisory/ZF2012-02</url>
 <url>http://www.openwall.com/lists/oss-security/2012/06/26/2</url>
 <url>https://secunia.com/advisories/49665/</url>
 <url>http://www.magentocommerce.com/download/release_notes</url>
 </references>
 <dates>
 <discovery>2012-06-26</discovery>
 <entry>2012-10-16</entry>
 <modified>2015-10-14</modified>
 </dates>
 </vuln>

<vuln vid="f94befcd-1289-11e2-a25e-525400272390">
 <topic>gitolite -- path traversal vulnerability</topic>
 <affects>
 <package>
	<name>gitolite</name>
	<range><ge>3.01</ge><le>3.04</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sitaram Chamarty reports:
	<blockquote cite="https://groups.google.com/forum/#!topic/gitolite/K9SnQNhCQ-0/discussion">
	 I'm sorry to say there is a potential path traversal vulnerability in
	 v3. Thanks to Stephane Chazelas for finding it and alerting me.
	 Can it affect you? This can only affect you if you are using wild
	 card repos, *and* at least one of your patterns allows the string
	 "../" to match multiple times.
	 How badly can it affect you? A malicious user who *also* has the
	 ability to create arbitrary files in, say, /tmp (e.g., he has his own
	 userid on the same box), can compromise the entire "git" user.
	 Otherwise the worst he can do is create arbitrary repos in /tmp.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4506</cvename>
 <mlist msgid="CAMK1S_jotna+d_X2C-+es-M28i1aUBcsNeiXxwJ63EshQ8ht6w@mail.gmail.com">https://groups.google.com/forum/#!topic/gitolite/K9SnQNhCQ-0/discussion</mlist>
 </references>
 <dates>
 <discovery>2012-10-09</discovery>
 <entry>2012-10-15</entry>
 </dates>
 </vuln>

<vuln vid="ef417da3-1640-11e2-999b-e0cb4e266481">
 <topic>phpMyAdmin -- Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages and Fetching the version information from a non-SSL site is vulnerable to a MITM attack</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>3.5</ge><lt>3.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php">
	 When creating/modifying a trigger, event or procedure
	 with a crafted name, it is possible to trigger an XSS.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php">
	 To display information about the current phpMyAdmin
	 version on the main page, a piece of JavaScript is fetched
	 from the phpmyadmin.net website in non-SSL mode. A
	 man-in-the-middle could modify this script on the wire to
	 cause mischief.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-5339</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php</url>
 <cvename>CVE-2012-5368</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php</url>
 </references>
 <dates>
 <discovery>2012-10-08</discovery>
 <entry>2012-10-14</entry>
 </dates>
 </vuln>

<vuln vid="6e5a9afd-12d3-11e2-b47d-c8600054b392">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>16.0.1,1</lt></range>
	<range><lt>10.0.9,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>10.0.9,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.13.1</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.9</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.13.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>16.0.1</lt></range>
	<range><lt>10.0.9</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2012-74 Miscellaneous memory safety hazards (rv:16.0/
	 rv:10.0.8)
	 MFSA 2012-75 select element persistance allows for attacks
	 MFSA 2012-76 Continued access to initial origin after setting
	 document.domain
	 MFSA 2012-77 Some DOMWindowUtils methods bypass security checks
	 MFSA 2012-78 Reader Mode pages have chrome privileges
	 MFSA 2012-79 DOS and crash with full screen and history navigation
	 MFSA 2012-80 Crash with invalid cast when using instanceof
	 operator
	 MFSA 2012-81 GetProperty function can bypass security checks
	 MFSA 2012-82 top object and location property accessible by
	 plugins
	 MFSA 2012-83 Chrome Object Wrapper (COW) does not disallow acces
	 to privileged functions or properties
	 MFSA 2012-84 Spoofing and script injection through location.hash
	 MFSA 2012-85 Use-after-free, buffer overflow, and out of bounds
	 read issues found using Address Sanitizer
	 MFSA 2012-86 Heap memory corruption issues found using Address
	 Sanitizer
	 MFSA 2012-87 Use-after-free in the IME State Manager
	 MFSA 2012-88 Miscellaneous memory safety hazards (rv:16.0.1)
	 MFSA 2012-89 defaultValue security checks not applied
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-3982</cvename>
	<cvename>CVE-2012-3983</cvename>
	<cvename>CVE-2012-3984</cvename>
	<cvename>CVE-2012-3985</cvename>
	<cvename>CVE-2012-3986</cvename>
	<cvename>CVE-2012-3987</cvename>
	<cvename>CVE-2012-3988</cvename>
	<cvename>CVE-2012-3989</cvename>
	<cvename>CVE-2012-3990</cvename>
	<cvename>CVE-2012-3991</cvename>
	<cvename>CVE-2012-3992</cvename>
	<cvename>CVE-2012-3993</cvename>
	<cvename>CVE-2012-3994</cvename>
	<cvename>CVE-2012-3995</cvename>
	<cvename>CVE-2012-4179</cvename>
	<cvename>CVE-2012-4180</cvename>
	<cvename>CVE-2012-4181</cvename>
	<cvename>CVE-2012-4182</cvename>
	<cvename>CVE-2012-4183</cvename>
	<cvename>CVE-2012-4184</cvename>
	<cvename>CVE-2012-4186</cvename>
	<cvename>CVE-2012-4187</cvename>
	<cvename>CVE-2012-4188</cvename>
	<cvename>CVE-2012-4190</cvename>
	<cvename>CVE-2012-4191</cvename>
	<cvename>CVE-2012-4192</cvename>
	<cvename>CVE-2012-4193</cvename>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-74.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-75.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-76.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-77.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-78.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-79.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-80.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-81.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-82.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-83.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-84.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-85.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-86.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-87.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-88.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-89.html</url>
 </references>
 <dates>
 <discovery>2012-10-09</discovery>
 <entry>2012-10-10</entry>
 <modified>2012-10-11</modified>
 </dates>
 </vuln>

<vuln vid="57a700f9-12c0-11e2-9f86-001d923933b6">
 <topic>dns/bind9* -- crash on deliberately constructed combination of records</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><lt>9.9.1.4</lt></range>
 </package>
 <package>
	<name>bind99-base</name>
	<range><lt>9.9.1.4</lt></range>
 </package>
 <package>
	<name>bind98</name>
	<range><lt>9.8.3.4</lt></range>
 </package>
 <package>
	<name>bind98-base</name>
	<range><lt>9.8.3.4</lt></range>
 </package>
 <package>
	<name>bind97</name>
	<range><lt>9.7.6.4</lt></range>
 </package>
 <package>
	<name>bind97-base</name>
	<range><lt>9.7.6.4</lt></range>
 </package>
 <package>
	<name>bind96</name>
	<range><lt>9.6.3.1.ESV.R7.4</lt></range>
 </package>
 <package>
	<name>bind96-base</name>
	<range><lt>9.6.3.1.ESV.R7.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-00801/">
	 A deliberately constructed combination of records could cause named
	 to hang while populating the additional section of a response.
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-5166</cvename>
 </references>
 <dates>
 <discovery>2012-09-26</discovery>
 <entry>2012-10-10</entry>
 </dates>
 </vuln>

<vuln vid="dee44ba9-08ab-11e2-a044-d0df9acfd7e5">
 <topic>OpenX -- SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>openx</name>
	<range><lt>2.8.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/50598/">
	 A vulnerability has been discovered in OpenX, which can be
	 exploited by malicious people to conduct SQL injection
	 attacks.
	 Input passed via the "xajaxargs" parameter to
	 www/admin/updates-history.php (when "xajax" is set to
	 "expandOSURow") is not properly sanitised in e.g. the
	 "queryAuditBackupTablesByUpgradeId()" function
	 (lib/OA/Upgrade/DB_UpgradeAuditor.php) before being used in SQL
	 queries. This can be exploited to manipulate SQL queries by
	 injecting arbitrary SQL code.
	 The vulnerability is confirmed in version 2.8.9. Prior versions
	 may also be affected.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/50598/</url>
 </references>
 <dates>
 <discovery>2012-09-14</discovery>
 <entry>2012-09-27</entry>
 </dates>
 </vuln>

<vuln vid="73efb1b7-07ec-11e2-a391-000c29033c32">
 <topic>eperl -- Remote code execution</topic>
 <affects>
 <package>
	<name>eperl</name>
	<range><le>2.2.14_4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	David Madison reports:
	<blockquote cite="http://www.shmoo.com/mail/bugtraq/jun01/msg00286.shtml">
	 ePerl is a multipurpose Perl filter and interpreter program
	 for Unix systems. The ePerl preprocessor contains an input
	 validation error. The preprocessor allows foreign data to be
	 "safely" included using the 'sinclude' directive.
	 The problem occurs when a file referenced by a 'sinclude'
	 directive contains a 'include' directive; the contents of
	 the file referred to by the second directive will be loaded
	 and executed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2001-0733</cvename>
 <url>http://www.shmoo.com/mail/bugtraq/jun01/msg00286.shtml</url>
 <bid>2912</bid>
 <url>http://xforce.iss.net/xforce/xfdb/6743</url>
 <url>http://osvdb.org/show/osvdb/1880</url>
 </references>
 <dates>
 <discovery>2001-06-21</discovery>
 <entry>2012-09-26</entry>
 </dates>
 </vuln>

<vuln vid="98690c45-0361-11e2-a391-000c29033c32">
 <topic>ImageMagick and GraphicsMagick -- DoS via specially crafted PNG file</topic>
 <affects>
 <package>
	<name>ImageMagick</name>
	<range><le>6.7.8.6</le></range>
 </package>
 <package>
	<name>ImageMagick-nox11</name>
	<range><le>6.7.8.6</le></range>
 </package>
 <package>
	<name>GraphicsMagick</name>
	<range><ge>1.3.0</ge><le>1.3.16</le></range>
 </package>
 <package>
	<name>GraphicsMagick-nox11</name>
	<range><ge>1.3.0</ge><le>1.3.16</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kurt Seifried reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=844105">
	 There is an issue in ImageMagick that is also present in
	 GraphicsMagick. CVE-2011-3026 deals with libpng memory
	 allocation, and limitations have been added so that a bad PNG
	 can't cause the system to allocate a lot of memory and a
	 denial of service. However on further investigation of
	 ImageMagick, Tom Lane found that PNG malloc function
	 (Magick_png_malloc) in turn calls AcquireMagickMemory with an
	 improper size argument.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3438</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=844105</url>
 <bid>54716</bid>
 <url>http://secunia.com/advisories/50090</url>
 <url>http://xforce.iss.net/xforce/xfdb/77259</url>
 <url>http://osvdb.org/show/osvdb/84323</url>
 </references>
 <dates>
 <discovery>2012-07-28</discovery>
 <entry>2012-09-20</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="ec255bd8-02c6-11e2-92d1-000d601460a4">
 <topic>php5-sqlite -- open_basedir bypass</topic>
 <affects>
 <package>
	<name>php5-sqlite</name>
	<range><ge>5.2</ge><lt>5.2.17_11</lt></range>
	<range><ge>5.3</ge><lt>5.3.15</lt></range>
 </package>
 <package>
	<name>php52-sqlite</name>
	<range><lt>5.2.17_11</lt></range>
 </package>
 <package>
	<name>php53-sqlite</name>
	<range><lt>5.3.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE CVE team reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365">
	 The SQLite functionality in PHP before 5.3.15 allows remote
	 attackers to bypass the open_basedir protection mechanism via
	 unspecified vectors.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3365</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365</url>
 </references>
 <dates>
 <discovery>2012-06-14</discovery>
 <entry>2012-09-19</entry>
 </dates>
 </vuln>

<vuln vid="9b2a5e88-02b8-11e2-92d1-000d601460a4">
 <topic>php5 -- Denial of Service in php_date_parse_tzfile()</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><ge>5.2</ge><lt>5.2.17_11</lt></range>
	<range><ge>5.3</ge><lt>5.3.9</lt></range>
 </package>
 <package>
	<name>php52</name>
	<range><lt>5.2.17_11</lt></range>
 </package>
 <package>
	<name>php53</name>
	<range><lt>5.3.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE CVE team reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0789">
	 Memory leak in the timezone functionality in PHP before 5.3.9
	 allows remote attackers to cause a denial of service (memory
	 consumption) by triggering many strtotime function calls, which are
	 not properly handled by the php_date_parse_tzfile cache.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0789</cvename>
 <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0789</url>
 <url>https://bugs.php.net/bug.php?id=53502</url>
 </references>
 <dates>
 <discovery>2010-12-08</discovery>
 <entry>2012-09-19</entry>
 </dates>
 </vuln>

<vuln vid="53a0ddef-0208-11e2-8afa-0024e830109b">
 <topic>dns/bind9* -- Several vulnerabilities</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><lt>9.9.1.3</lt></range>
 </package>
 <package>
	<name>bind98</name>
	<range><lt>9.8.3.3</lt></range>
 </package>
 <package>
	<name>bind97</name>
	<range><lt>9.7.6.3</lt></range>
 </package>
 <package>
	<name>bind96</name>
	<range><lt>9.6.3.1.ESV.R7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-00788">
	 Prevents a crash when queried for a record whose RDATA exceeds
	 65535 bytes.
	 Prevents a crash when validating caused by using "Bad cache" data
	 before it has been initialized.
	 ISC_QUEUE handling for recursive clients was updated to address
	 a race condition that could cause a memory leak. This rarely
	 occurred with UDP clients, but could be a significant problem
	 for a server handling a steady rate of TCP queries.
	 A condition has been corrected where improper handling of
	 zero-length RDATA could cause undesirable behavior, including
	 termination of the named process.
	</blockquote>
 </body>
 </description>
 <references>
 <url/>
 </references>
 <dates>
 <discovery>2012-09-12</discovery>
 <entry>2012-09-18</entry>
 </dates>
 </vuln>

<vuln vid="d846af5b-00f4-11e2-b6d0-00e0814cab4e">
 <topic>jenkins -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>1.482</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory reports:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-09-17">
	 This advisory announces security vulnerabilities that were found
	 in Jenkins core and several plugins.
	 <ol>
	 <li>The first vulnerability in Jenkins core allows unprivileged
	 users to insert data into Jenkins master, which can lead to
	 remote code execution. For this vulnerability to be exploited,
	 the attacker must have an HTTP access to a Jenkins master, and
	 he must have a read access to Jenkins.</li>
	 <li>The second vulnerability in Jenkins core is a cross-site
	 scripting vulnerability. This allows an attacker to craft an URL
	 that points to Jenkins, and if a legitimate user clicks this link,
	 and the attacker will be able to hijack the user session.</li>
	 <li>The third vulnerability is a cross-site scripting vulnerability
	 in the Violations plugin</li>
	 <li>The fourth vulnerability is a cross-site scripting vulnerability
	 in The Continuous Integration Game plugin</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-09-17</url>
 </references>
 <dates>
 <discovery>2012-09-17</discovery>
 <entry>2012-09-17</entry>
 </dates>
 </vuln>

<vuln vid="62f36dfd-ff56-11e1-8821-001b2134ef46">
 <topic>vlc -- arbitrary code execution in Real RTSP and MMS support</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><lt>2.0.1,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jean-Baptiste Kempf, on behalf of the VideoLAN project reports:
	<blockquote cite="http://www.videolan.org/security/sa1201.html">
	 If successful, a malicious third party could crash the VLC
	 media player process. Arbitrary code execution could be possible
	 on some systems.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.videolan.org/security/sa1201.html</url>
 <url>http://www.videolan.org/security/sa1202.html</url>
 <cvename>CVE-2012-1775</cvename>
 <cvename>CVE-2012-1776</cvename>
 </references>
 <dates>
 <discovery>2012-03-12</discovery>
 <entry>2012-09-15</entry>
 </dates>
 </vuln>

<vuln vid="143f6932-fedb-11e1-ad4a-003067b2972c">
 <topic>bacula -- Console ACL Bypass</topic>
 <affects>
 <package>
	<name>bacula</name>
	<range><lt>5.2.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://secunia.com/advisories/50535/">
	 A security issue has been reported in Bacula, which can be
	 exploited by malicious users to bypass certain security
	 restrictions.
	 The security issue is caused due to an error within the implementation
	 of console ACLs, which can be exploited to gain access to certain
	 restricted functionality and e.g. dump resources.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4430</cvename>
 <url>http://www.bacula.org/git/cgit.cgi/bacula/commit/?id=67debcecd3d530c429e817e1d778e79dcd1db905</url>
 <url>https://secunia.com/advisories/50535/</url>
 <url>http://sourceforge.net/projects/bacula/files/bacula/5.2.11/ReleaseNotes/view</url>
 </references>
 <dates>
 <discovery>2012-09-12</discovery>
 <entry>2012-09-15</entry>
 </dates>
 </vuln>

<vuln vid="178ba4ea-fd40-11e1-b2ae-001fd0af1a4c">
 <topic>mod_pagespeed -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mod_pagespeed</name>
	<range><lt>0.10.22.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google Reports:
	<blockquote cite="https://developers.google.com/speed/docs/mod_pagespeed/announce-0.10.22.6">
	 mod_pagespeed 0.10.22.6 is a security update that fixes two
	 critical issues that affect earlier versions:
	 <ul>
	 <li>CVE-2012-4001, a problem with validation of own host name.</li>
	 <li>CVE-2012-4360, a cross-site scripting attack, which affects versions starting from 0.10.19.1.</li>
	 </ul>
	 The effect of the first problem is that it is possible to confuse
	 mod_pagespeed about its own host name, and to trick it into
	 fetching resources from other machines. This could be an issue if
	 the HTTP server has access to machines that are not otherwise
	 publicly visible.
	 The second problem would permit a hostile third party to execute
	 JavaScript in users' browsers in context of the domain running
	 mod_pagespeed, which could permit interception of users' cookies or
	 data on the site.
	 Because of the severity of the two problems, users are strongly
	 encouraged to update immediately.
	 Behavior Changes in the Update:
	 As part of the fix to the first issue, mod_pagespeed will not fetch
	 resources from machines other than localhost if they are not
	 explicitly mentioned in the configuration. This means that if you
	 need resources on the server's domain to be handled by some other
	 system, you'll need to explicitly use ModPagespeedMapOriginDomain
	 or ModPagespeedDomain to authorize that.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4001</cvename>
 <cvename>CVE-2012-4360</cvename>
 <url>https://developers.google.com/speed/docs/mod_pagespeed/announce-0.10.22.6</url>
 </references>
 <dates>
 <discovery>2012-09-12</discovery>
 <entry>2012-09-12</entry>
 </dates>
 </vuln>

<vuln vid="3bbbe3aa-fbeb-11e1-8bd8-0022156e8794">
 <topic>freeradius -- arbitrary code execution for TLS-based authentication</topic>
 <affects>
 <package>
	<name>freeradius</name>
	<range><ge>2.1.10</ge><lt>2.1.12_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	freeRADIUS security team reports:
	<blockquote cite="http://freeradius.org/security.html">
	 Overflow in EAP-TLS for 2.1.10, 2.1.11 and 2.1.12.
	 The issue was found by Timo Warns, and communicated to
	 security@freeradius.org. A sample exploit for the issue was
	 included in the notification.
	 The vulnerability was created in commit a368a6f4f4aaf on
	 August 18, 2010. Vulnerable versions include 2.1.10, 2.1.11,
	 and 2.1.12. Also anyone running the git "master" branch
	 after August 18, 2010 is vulnerable.
	 All sites using TLS-based EAP methods and the above
	 versions are vulnerable. The only configuration change which
	 can avoid the issue is to disable EAP-TLS, EAP-TTLS, and
	 PEAP.
	 An external attacker can use this vulnerability to
	 over-write the stack frame of the RADIUS server, and cause
	 it to crash. In addition, more sophisticated attacks may
	 gain additional privileges on the system running the RADIUS
	 server.
	 This attack does not require local network access to the
	 RADIUS server. It can be done by an attacker through a WiFi
	 Access Point, so long as the Access Point is configured to
	 use 802.1X authentication with the RADIUS server.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3547</cvename>
 <url>http://freeradius.org/security.html</url>
 <url>http://www.pre-cert.de/advisories/PRE-SA-2012-06.txt</url>
 </references>
 <dates>
 <discovery>2012-09-10</discovery>
 <entry>2012-09-11</entry>
 <modified>2012-09-11</modified>
 </dates>
 </vuln>

<vuln vid="c1e5f35e-f93d-11e1-b07f-00235a5f2c9a">
 <topic>emacs -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>emacs</name>
	<range><gt>24.*</gt><lt>24.2</lt></range>
	<range><gt>23.*</gt><le>23.4_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chong Yidong reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2012/08/13/1">
	 Paul Ling has found a security flaw in the file-local
	 variables code in GNU Emacs.
	 When the Emacs user option `enable-local-variables' is
	 set to `:safe' (the default value is t), Emacs should
	 automatically refuse to evaluate `eval' forms in file-local
	 variable sections. Due to the bug, Emacs instead
	 automatically evaluates such `eval' forms. Thus, if the user
	 changes the value of `enable-local-variables' to `:safe',
	 visiting a malicious file can cause automatic execution of
	 arbitrary Emacs Lisp code with the permissions of the
	 user.
	 The bug is present in Emacs 23.2, 23.3, 23.4, and
	 24.1.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>54969</bid>
 <cvename>CVE-2012-3479</cvename>
 <url>https://lists.gnu.org/archive/html/emacs-devel/2012-08/msg00802.html</url>
 <url>http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155</url>
 </references>
 <dates>
 <discovery>2012-08-13</discovery>
 <entry>2012-09-08</entry>
 <modified>2013-05-13</modified>
 </dates>
 </vuln>

<vuln vid="30149157-f926-11e1-95cd-001fd0af1a4c">
 <topic>wordpress -- multiple unspecified privilege escalation bugs</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>3.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Wordpress reports:
	<blockquote cite="http://wordpress.org/news/2012/09/wordpress-3-4-2/">
	 Version 3.4.2 also fixes a few security issues and contains some
	 security hardening. The vulnerabilities included potential
	 privilege escalation and a bug that affects multisite installs with
	 untrusted users. These issues were discovered and fixed by the
	 WordPress security team.
 </blockquote>
 </body>
 </description>
 <references>
 <url>http://wordpress.org/news/2012/09/wordpress-3-4-2/</url>
 </references>
 <dates>
 <discovery>2012-09-06</discovery>
 <entry>2012-09-07</entry>
 </dates>
 </vuln>

<vuln vid="4a8a98ab-f745-11e1-8bd8-0022156e8794">
 <topic>moinmoin -- cross-site scripting via RST parser</topic>
 <affects>
 <package>
	<name>moinmoin</name>
	<range><lt>1.9.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE CVE team reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1058">
	 Cross-site scripting (XSS) vulnerability in the
	 reStructuredText (rst) parser in parser/text_rst.py in
	 MoinMoin before 1.9.4, when docutils is installed or when
	 "format rst" is set, allows remote attackers to inject
	 arbitrary web script or HTML via a javascript: URL in the
	 refuri attribute.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>46476</bid>
 <cvename>CVE-2011-1058</cvename>
 <url>http://moinmo.in/SecurityFixes</url>
 </references>
 <dates>
 <discovery>2011-02-21</discovery>
 <entry>2012-09-05</entry>
 </dates>
 </vuln>

<vuln vid="4f99e2ef-f725-11e1-8bd8-0022156e8794">
 <topic>moinmoin -- wrong processing of group membership</topic>
 <affects>
 <package>
	<name>moinmoin</name>
	<range><ge>1.9</ge><lt>1.9.4_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MoinMoin developers report:
	<blockquote cite="http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16">
	 If you have group NAMES containing "All" or "Known" or
	 "Trusted", they behaved wrong until now (they erroneously
	 included All/Known/Trusted users even if you did not list
	 them as members), but will start working correctly with this
	 changeset.
	 E.g. AllFriendsGroup:
	 <ul>
	 <li>JoeDoe</li>
	 </ul>
	 AllFriendsGroup will now (correctly) include only JoeDoe.
	 It (erroneously) contained all users (including JoeDoe)
	 before.
	 E.g. MyTrustedFriendsGroup:
	 <ul>
	 <li>JoeDoe</li>
	 </ul>
	 MyTrustedFriendsGroup will now (correctly) include only
	 JoeDoe. It (erroneously) contained all trusted users and
	 JoeDoe before.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4404</cvename>
 <url>http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16</url>
 </references>
 <dates>
 <discovery>2012-09-03</discovery>
 <entry>2012-09-05</entry>
 <modified>2012-09-11</modified>
 </dates>
 </vuln>

<vuln vid="918f38cd-f71e-11e1-8bd8-0022156e8794">
 <topic>php5 -- header splitting attack via carriage-return character</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><ge>5.2</ge><lt>5.2.17_11</lt></range>
	<range><ge>5.3</ge><lt>5.3.11</lt></range>
	<range><ge>5.4</ge><lt>5.4.1</lt></range>
 </package>
 <package>
	<name>php52</name>
	<range><lt>5.2.17_11</lt></range>
 </package>
 <package>
	<name>php53</name>
	<range><lt>5.3.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Rui Hirokawa reports:
	<blockquote cite="https://bugs.php.net/bug.php?id=60227">
	 As of PHP 5.1.2, header() can no longer be used to send
	 multiple response headers in a single call to prevent the
	 HTTP Response Splitting Attack. header() only checks the
	 linefeed (LF, 0x0A) as line-end marker, it doesn't check the
	 carriage-return (CR, 0x0D).
	 However, some browsers including Google Chrome, IE also
	 recognize CR as the line-end.
	 The current specification of header() still has the
	 vulnerability against the HTTP header splitting attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1398</cvename>
 <url>https://bugs.php.net/bug.php?id=60227</url>
 </references>
 <dates>
 <discovery>2011-11-06</discovery>
 <entry>2012-09-05</entry>
 <modified>2012-09-19</modified>
 </dates>
 </vuln>

<vuln vid="b50913ce-f4a7-11e1-b135-003067b2972c">
 <topic>bitcoin -- denial of service</topic>
 <affects>
 <package>
	<name>bitcoin</name>
	<range><lt>0.6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://bitcointalk.org/?topic=88734">
	 A unspecified denial-of-service attack that could cause the
	 bitcoin process to become unresponsive was found.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3789</cvename>
 <url>https://bitcointalk.org/?topic=88734</url>
 </references>
 <dates>
 <discovery>2012-07-20</discovery>
 <entry>2012-09-02</entry>
 </dates>
 </vuln>

<vuln vid="6ad18fe5-f469-11e1-920d-20cf30e32f6d">
 <topic>bugzilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><ge>3.6.0</ge><lt>3.6.11</lt></range>
	<range><ge>4.0.0</ge><lt>4.0.8</lt></range>
	<range><ge>4.2.0</ge><lt>4.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/3.6.10/">
	 The following security issues have been discovered in
	 Bugzilla:
	 <h1>LDAP Injection</h1>
	 When the user logs in using LDAP, the username is not
	 escaped when building the uid=$username filter which is
	 used to query the LDAP directory. This could potentially
	 lead to LDAP injection.
	 <h1>Directory Browsing</h1>
	 Extensions are not protected against directory browsing
	 and users can access the source code of the templates
	 which may contain sensitive data.
	 Directory browsing is blocked in Bugzilla 4.3.3 only,
	 because it requires a configuration change in the Apache
	 httpd.conf file to allow local .htaccess files to use
	 Options -Indexes. To not break existing installations,
	 this fix has not been backported to stable branches.
	 The access to templates is blocked for all supported
	 branches except the old 3.6 branch, because this branch
	 doesn't have .htaccess in the bzr repository and cannot
	 be fixed easily for existing installations without
	 potentially conflicting with custom changes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3981</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=785470</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=785522</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=785511</url>
 </references>
 <dates>
 <discovery>2012-08-30</discovery>
 <entry>2012-09-01</entry>
 </dates>
 </vuln>

<vuln vid="342176a8-f464-11e1-8bd8-0022156e8794">
 <topic>GNU gatekeeper -- denial of service</topic>
 <affects>
 <package>
	<name>gatekeeper</name>
	<range><lt>3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jan Willamowius reports:
	<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3534">
	 GNU Gatekeeper before 3.1 does not limit the number
	 of connections to the status port, which allows remote
	 attackers to cause a denial of service (connection and
	 thread consumption) via a large number of connections.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3534</cvename>
 <url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3534</url>
 <url>http://www.openwall.com/lists/oss-security/2012/08/25/4</url>
 <url>http://www.gnugk.org/gnugk-3.1.html</url>
 </references>
 <dates>
 <discovery>2012-08-15</discovery>
 <entry>2012-09-01</entry>
 </dates>
 </vuln>

<vuln vid="7c0fecd6-f42f-11e1-b17b-000c2977ec30">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki</name>
	<range><ge>1.19</ge><lt>1.19.2</lt></range>
	<range><ge>1.18</ge><lt>1.18.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawiki reports:
	<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html">
	 (Bug 39700) Wikipedia administrator Writ Keeper discovered
	 a stored XSS (HTML injection) vulnerability. This was
	 possible due to the handling of link text on File: links for
	 nonexistent files. MediaWiki 1.16 and later is affected.
	 (Bug 39180) User Fomafix reported several DOM-based XSS
	 vulnerabilities, made possible by a combination of loose
	 filtering of the uselang parameter, and JavaScript gadgets
	 on various language Wikipedias.
	 (Bug 39180) During internal review, it was discovered that
	 CSRF tokens, available via the api, were not protected with
	 X-Frame-Options headers. This could lead to a CSRF vulnerability
	 if the API response is embedded in an external website using
	 using an iframe.
	 (Bug 39824) During internal review, it was discovered extensions
	 were not always allowed to prevent the account creation action.
	 This allowed users blocked by the GlobalBlocking extension to
	 create accounts.
	 (Bug 39184) During internal review, it was discovered that
	 password data was always saved to the local MediaWiki database
	 even if authentication was handled by an extension, such as LDAP.
	 This could allow a compromised MediaWiki installation to leak
	 information about user's LDAP passwords. Additionally, in situations
	 when an authentication plugin returned false in its strict
	 function, this would allow old passwords to be used for accounts
	 that did not exist in the external system, indefinitely.
	 (Bug 39823) During internal review, it was discovered that metadata
	 about blocks, hidden by a user with suppression rights, was visible
	 to administrators.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39700</url>
 <url>https://bugzilla.wikimedia.org/show_bug.cgi?id=37587</url>
 <url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39180</url>
 <url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39824</url>
 <url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39184</url>
 <url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39823</url>
 <cvename>CVE-2012-4377</cvename>
 <cvename>CVE-2012-4378</cvename>
 <cvename>CVE-2012-4379</cvename>
 <cvename>CVE-2012-4380</cvename>
 <cvename>CVE-2012-4381</cvename>
 <cvename>CVE-2012-4382</cvename>
 </references>
 <dates>
 <discovery>2012-08-27</discovery>
 <entry>2012-09-01</entry>
 </dates>
 </vuln>

<vuln vid="5415f1b3-f33d-11e1-8bd8-0022156e8794">
 <topic>wireshark -- denial of service in DRDA dissector</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
 </package>
 <package>
	<name>wireshark-lite</name>
	<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
 </package>
 <package>
	<name>tshark</name>
	<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
 </package>
 <package>
	<name>tshark-lite</name>
	<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RedHat security team reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=849926">
	 A denial of service flaw was found in the way Distributed
	 Relational Database Architecture (DRDA) dissector of
	 Wireshark, a network traffic analyzer, performed processing
	 of certain DRDA packet capture files. A remote attacker
	 could create a specially-crafted capture file that, when
	 opened could lead to wireshark executable to consume
	 excessive amount of CPU time and hang with an infinite
	 loop.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3548</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=849926</url>
 </references>
 <dates>
 <discovery>2012-08-21</discovery>
 <entry>2012-08-31</entry>
 <modified>2012-09-05</modified>
 </dates>
 </vuln>

<vuln vid="4c53f007-f2ed-11e1-a215-14dae9ebcf89">
 <topic>asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk</name>
	<range><gt>10.*</gt><lt>10.7.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.15.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/security">
	 Asterisk Manager User Unauthorized Shell Access
	 ACL rules ignored when placing outbound calls by certain IAX2
	 users
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2186</cvename>
 <cvename>CVE-2012-4737</cvename>
 <url>http://downloads.digium.com/pub/security/AST-2012-012.html</url>
 <url>http://downloads.digium.com/pub/security/AST-2012-013.html</url>
 <url>https://www.asterisk.org/security</url>
 </references>
 <dates>
 <discovery>2012-08-30</discovery>
 <entry>2012-08-30</entry>
 </dates>
 </vuln>

<vuln vid="2b8cad90-f289-11e1-a215-14dae9ebcf89">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>15.0,1</lt></range>
	<range><lt>10.0.7,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>10.0.7,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.12</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.7</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.12</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>15.0</lt></range>
	<range><lt>10.0.7</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2012-57 Miscellaneous memory safety hazards (rv:15.0/
	 rv:10.0.7)
	 MFSA 2012-58 Use-after-free issues found using Address
	 Sanitizer
	 MFSA 2012-59 Location object can be shadowed using
	 Object.defineProperty
	 MFSA 2012-60 Escalation of privilege through about:newtab
	 MFSA 2012-61 Memory corruption with bitmap format images with
	 negative height
	 MFSA 2012-62 WebGL use-after-free and memory corruption
	 MFSA 2012-63 SVG buffer overflow and use-after-free issues
	 MFSA 2012-64 Graphite 2 memory corruption
	 MFSA 2012-65 Out-of-bounds read in format-number in XSLT
	 MFSA 2012-66 HTTPMonitor extension allows for remote debugging
	 without explicit activation
	 MFSA 2012-67 Installer will launch incorrect executable following
	 new installation
	 MFSA 2012-68 DOMParser loads linked resources in extensions when
	 parsing text/html
	 MFSA 2012-69 Incorrect site SSL certificate data display
	 MFSA 2012-70 Location object security checks bypassed by chrome
	 code
	 MFSA 2012-71 Insecure use of __android_log_print
	 MFSA 2012-72 Web console eval capable of executing
	 chrome-privileged code
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-1956</cvename>
	<cvename>CVE-2012-1970</cvename>
	<cvename>CVE-2012-1971</cvename>
	<cvename>CVE-2012-1972</cvename>
	<cvename>CVE-2012-1973</cvename>
	<cvename>CVE-2012-1974</cvename>
	<cvename>CVE-2012-1975</cvename>
	<cvename>CVE-2012-1976</cvename>
	<cvename>CVE-2012-3956</cvename>
	<cvename>CVE-2012-3957</cvename>
	<cvename>CVE-2012-3958</cvename>
	<cvename>CVE-2012-3959</cvename>
	<cvename>CVE-2012-3960</cvename>
	<cvename>CVE-2012-3961</cvename>
	<cvename>CVE-2012-3962</cvename>
	<cvename>CVE-2012-3963</cvename>
	<cvename>CVE-2012-3964</cvename>
	<cvename>CVE-2012-3965</cvename>
	<cvename>CVE-2012-3966</cvename>
	<cvename>CVE-2012-3967</cvename>
	<cvename>CVE-2012-3968</cvename>
	<cvename>CVE-2012-3969</cvename>
	<cvename>CVE-2012-3970</cvename>
	<cvename>CVE-2012-3971</cvename>
	<cvename>CVE-2012-3972</cvename>
	<cvename>CVE-2012-3973</cvename>
	<cvename>CVE-2012-3974</cvename>
	<cvename>CVE-2012-3975</cvename>
	<cvename>CVE-2012-3976</cvename>
	<cvename>CVE-2012-3978</cvename>
	<cvename>CVE-2012-3979</cvename>
	<cvename>CVE-2012-3980</cvename>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-57.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-58.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-59.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-60.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-61.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-62.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-63.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-64.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-65.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-66.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-67.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-68.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-69.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-70.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-71.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-72.html</url>
 </references>
 <dates>
 <discovery>2012-08-28</discovery>
 <entry>2012-08-30</entry>
 </dates>
 </vuln>

<vuln vid="6dd5e45c-f084-11e1-8d0f-406186f3d89d">
 <topic>coppermine -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>coppermine</name>
	<range><lt>1.5.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Coppermine Team reports:
	<blockquote cite="http://forum.coppermine-gallery.net/index.php/topic,74682.0.html">
	 The release covers several path disclosure vulnerabilities. If
	 unpatched, it's possible to generate an error that will reveal the
	 full path of the script. A remote user can determine the full path
	 to the web root directory and other potentially sensitive
	 information. Furthermore, the release covers a recently discovered
	 XSS vulnerability that allows (if unpatched) a malevolent visitor to
	 include own script routines under certain conditions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-1613</cvename>
 <cvename>CVE-2012-1614</cvename>
 <mlist>http://seclists.org/oss-sec/2012/q2/11</mlist>
 <url>http://forum.coppermine-gallery.net/index.php/topic,74682.0.html</url>
 </references>
 <dates>
 <discovery>2012-03-29</discovery>
 <entry>2012-08-30</entry>
 </dates>
 </vuln>

<vuln vid="16846d1e-f1de-11e1-8bd8-0022156e8794">
 <topic>Java 1.7 -- security manager bypass</topic>
 <affects>
 <package>
	<name>openjdk</name>
	<range><ge>7.0</ge><lt>7.6.24_1</lt></range>
 </package>
 <package>
	<name>linux-sun-jdk</name>
	<range><ge>7.0</ge><lt>7.7</lt></range>
 </package>
 <package>
	<name>linux-sun-jre</name>
	<range><ge>7.0</ge><lt>7.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US-CERT reports:
	<blockquote cite="http://www.kb.cert.org/vuls/id/636312">
	 Oracle Java Runtime Environment (JRE) 1.7 contains a
	 vulnerability that may allow an applet to call
	 setSecurityManager in a way that allows setting of arbitrary
	 permissions.
	 By leveraging the public, privileged getField() function,
	 an untrusted Java applet can escalate its privileges by
	 calling the setSecurityManager() function to allow full
	 privileges, without requiring code signing.
	 This vulnerability is being actively exploited in the
	 wild, and exploit code is publicly available.
	</blockquote>
	This exploit does not only affect Java applets, but every
	piece of software that relies on the Java Security Manager for
	sandboxing executable code is affected: malicious code can
	totally disable Security Manager.
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4681</cvename>
 <certvu>636312</certvu>
 <url>http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html</url>
 <url>http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-August/020065.html</url>
 <url>http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html</url>
 </references>
 <dates>
 <discovery>2012-08-27</discovery>
 <entry>2012-08-30</entry>
 <modified>2012-08-31</modified>
 </dates>
 </vuln>

<vuln vid="18ce9a90-f269-11e1-be53-080027ef73ec">
 <topic>fetchmail -- chosen plaintext attack against SSL CBC initialization vectors</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><ge>6.3.9</ge><lt>6.3.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2012-01.txt">
	 Fetchmail version 6.3.9 enabled "all SSL workarounds" (SSL_OP_ALL)
	 which contains a switch to disable a countermeasure against certain
	 attacks against block ciphers that permit guessing the
	 initialization vectors, providing that an attacker can make the
	 application (fetchmail) encrypt some data for him -- which is not
	 easily the case.
	 Stream ciphers (such as RC4) are unaffected.
	 Credits to Apple Product Security for reporting this.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3389</cvename>
 </references>
 <dates>
 <discovery>2012-01-19</discovery>
 <entry>2012-08-30</entry>
 </dates>
 </vuln>

<vuln vid="c906e0a4-efa6-11e1-8fbf-001b77d09812">
 <topic>roundcube -- cross-site scripting in HTML email messages</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><ge>0.8.0,1</ge><lt>0.8.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RoundCube branch 0.8.x prior to the version 0.8.1 is prone
	to the cross-scripting attack (XSS) originating from incoming
	HTML e-mails: due to the lack of proper sanitization
	of JavaScript code inside the "href" attribute, sender
	could launch XSS attack when recipient opens the message
	in RoundCube interface.
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3508</cvename>
 <url>http://trac.roundcube.net/wiki/Changelog</url>
 <url>http://trac.roundcube.net/ticket/1488613</url>
 </references>
 <dates>
 <discovery>2012-08-14</discovery>
 <entry>2012-08-27</entry>
 </dates>
 </vuln>

<vuln vid="aa4d3d73-ef17-11e1-b593-00269ef07d24">
 <topic>Calligra, KOffice -- input validation failure</topic>
 <affects>
 <package>
	<name>koffice</name>
	<range><le>1.6.3_18,2</le></range>
 </package>
 <package>
	<name>koffice-kde4</name>
	<range><le>2.3.3_7</le></range>
 </package>
 <package>
	<name>calligra</name>
	<range><lt>2.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	KDE Security Advisory reports:
	<blockquote cite="http://www.kde.org/info/security/advisory-20120810-1.txt">
	 A flaw has been found which can allow malicious code to take
	 advantage of an input validation failure in the Microsoft import
	 filter in Calligra and KOffice. Exploitation can allow the attacker
	 to gain control of the running process and execute code on its
	 behalf.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3455</cvename>
 <cvename>CVE-2012-3456</cvename>
 <url>http://www.kde.org/info/security/advisory-20120810-1.txt</url>
 <url>http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_WP.pdf</url>
 </references>
 <dates>
 <discovery>2012-08-10</discovery>
 <entry>2012-08-26</entry>
 </dates>
 </vuln>

<vuln vid="ce680f0a-eea6-11e1-8bd8-0022156e8794">
 <topic>squidclamav -- cross-site scripting in default virus warning pages</topic>
 <affects>
 <package>
	<name>squidclamav</name>
	<range><lt>5.8</lt></range>
	<range><ge>6.0</ge><lt>6.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SquidClamav developers report:
	<blockquote cite="http://squidclamav.darold.net/news.html">
	 This release fix several security issues by escaping CGI
	 parameters.
	</blockquote>
	Prior to versions 6.7 and 5.8, CGI script clwarn.cgi was not
	properly sanitizing input variables, so they could be used to
	inject arbitrary strings to the generated page, leading
	to the cross-site scripting attacks.
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4667</cvename>
 <url>http://squidclamav.darold.net/news.html</url>
 </references>
 <dates>
 <discovery>2012-07-24</discovery>
 <entry>2012-08-25</entry>
 </dates>
 </vuln>

<vuln vid="8defa0f9-ee8a-11e1-8bd8-0022156e8794">
 <topic>squidclamav -- Denial of Service</topic>
 <affects>
 <package>
	<name>squidclamav</name>
	<range><lt>5.7_1</lt></range>
	<range><ge>6.0</ge><lt>6.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SquidClamav developers report:
	<blockquote cite="http://squidclamav.darold.net/news.html">
	 Add a workaround for a squidGuard bug that unescape
	 the URL and send it back unescaped. This result in garbage
	 staying into pipe of the system command call and could crash
	 squidclamav on next read or return false information.
	 This is specially true with URL containing the %0D or %0A
	 character.
	</blockquote>
	This vulnerability can be triggered only in configurations
	where external chained URL checker is configured via
	"squidguard" directive.
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3501</cvename>
 <url>http://squidclamav.darold.net/news.html</url>
 </references>
 <dates>
 <discovery>2012-07-24</discovery>
 <entry>2012-08-25</entry>
 <modified>2012-09-04</modified>
 </dates>
 </vuln>

<vuln vid="a7975581-ee26-11e1-8bd8-0022156e8794">
 <topic>inn -- plaintext command injection into encrypted channel</topic>
 <affects>
 <package>
	<name>inn</name>
	<range><lt>2.5.2_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	INN developers report:
	<blockquote cite="https://www.isc.org/software/inn/2.5.3article">
	 Fixed a possible plaintext command injection during the
	 negotiation of a TLS layer. The vulnerability detailed
	 in CVE-2011-0411 affects the STARTTLS and AUTHINFO SASL
	 commands. nnrpd now resets its read buffer upon
	 a successful negotiation of a TLS layer. It prevents
	 malicious commands, sent unencrypted, from being executed
	 in the new encrypted state of the session.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3523</cvename>
 <cvename>CVE-2011-0411</cvename>
 <url>https://www.isc.org/software/inn/2.5.3article</url>
 </references>
 <dates>
 <discovery>2012-08-14</discovery>
 <entry>2012-08-25</entry>
 </dates>
 </vuln>

<vuln vid="4d1d2f6d-ec94-11e1-8bd8-0022156e8794">
 <topic>jabberd -- domain spoofing in server dialback protocol</topic>
 <affects>
 <package>
	<name>jabberd</name>
	<range><lt>2.2.16_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	XMPP Standards Foundation reports:
	<blockquote cite="http://xmpp.org/resources/security-notices/server-dialback/">
	 Some implementations of the XMPP Server Dialback protocol
	 (RFC 3920/XEP-0220) have not been checking dialback
	 responses to ensure that validated results are correlated
	 with requests.
	 An attacking server could spoof one or more domains in
	 communicating with a vulnerable server implementation,
	 thereby avoiding the protections built into the Server
	 Dialback protocol.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3525</cvename>
 <url>http://xmpp.org/resources/security-notices/server-dialback/</url>
 </references>
 <dates>
 <discovery>2012-08-21</discovery>
 <entry>2012-08-23</entry>
 </dates>
 </vuln>

<vuln vid="a4598875-ec91-11e1-8bd8-0022156e8794">
 <topic>rssh -- configuration restrictions bypass</topic>
 <affects>
 <package>
	<name>rssh</name>
	<range><lt>2.3.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Derek Martin (rssh maintainer) reports:
	<blockquote cite="http://www.pizzashack.org/rssh/security.shtml">
	 John Barber reported a problem where, if the system
	 administrator misconfigures rssh by providing too few access
	 bits in the configuration file, the user will be given
	 default permissions (scp) to the entire system, potentially
	 circumventing any configured chroot. Fixing this required a
	 behavior change: in the past, using rssh without a config
	 file would give all users default access to use scp on an
	 unchrooted system. In order to correct the reported bug,
	 this feature has been eliminated, and you must now have a
	 valid configuration file. If no config file exists, all
	 users will be locked out.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.pizzashack.org/rssh/security.shtml</url>
 </references>
 <dates>
 <discovery>2010-08-01</discovery>
 <entry>2012-08-22</entry>
 </dates>
 </vuln>

<vuln vid="65b25acc-e63b-11e1-b81c-001b77d09812">
 <topic>rssh -- arbitrary command execution</topic>
 <affects>
 <package>
	<name>rssh</name>
	<range><lt>2.3.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Derek Martin (rssh maintainer) reports:
	<blockquote cite="http://sourceforge.net/mailarchive/message.php?msg_id=29235647">
	 Henrik Erkkonen has discovered that, through clever
	 manipulation of environment variables on the ssh command
	 line, it is possible to circumvent rssh. As far as I can
	 tell, there is no way to effect a root compromise, except of
	 course if the root account is the one you're attempting to
	 protect with rssh...
	</blockquote>
 </body>
 </description>
 <references>
 <bid>53430</bid>
 <cvename>CVE-2012-3478</cvename>
 <url>http://sourceforge.net/mailarchive/message.php?msg_id=29235647</url>
 </references>
 <dates>
 <discovery>2012-05-08</discovery>
 <entry>2012-08-22</entry>
 </dates>
 </vuln>

<vuln vid="c651c898-e90d-11e1-b230-0024e830109b">
 <topic>libotr -- buffer overflows</topic>
 <affects>
 <package>
	<name>libotr</name>
	<range><lt>3.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OTR developers report:
	<blockquote cite="http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html">
	 The otrl_base64_otr_decode() function and similar functions within OTR
	 suffer from buffer overflows in the case of malformed input;
	 specifically if a message of the format of "?OTR:===." is received
	 then a zero-byte allocation is performed without a similar correlation
	 between the subsequent base64 decoding write, as such it becomes
	 possible to write between zero and three bytes incorrectly to the
	 heap, albeit only with a value of '='.
	 Because this code path is highly utilized, specifically in the
	 reception of instant messages over pidgin or similar, this
	 vulnerability is considered severe even though in many platforms and
	 circumstances the bug would yield an unexploitable state and result
	 simply in denial of service.
	 The developers of OTR promptly fixed the errors and users of OTR are
	 advised to upgrade the software at the next release cycle.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3461</cvename>
 <url>http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html</url>
 </references>
 <dates>
 <discovery>2012-07-27</discovery>
 <entry>2012-08-18</entry>
 </dates>
 </vuln>

<vuln vid="0f62be39-e8e0-11e1-bea0-002354ed89bc">
 <topic>OpenTTD -- Denial of Service</topic>
 <affects>
 <package>
	<name>openttd</name>
	<range><le>1.2.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenTTD Team reports:
	<blockquote cite="http://security.openttd.org/en/CVE-2012-3436">
	 Denial of service (server) using ships on half tiles and
	 landscaping.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3436</cvename>
 <url>http://security.openttd.org/en/CVE-2012-3436</url>
 </references>
 <dates>
 <discovery>2012-07-25</discovery>
 <entry>2012-08-18</entry>
 </dates>
 </vuln>

<vuln vid="4cdfe875-e8d6-11e1-bea0-002354ed89bc">
 <topic>Wireshark -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<range><lt>1.8.2</lt></range>
 </package>
 <package>
	<name>wireshark-lite</name>
	<range><lt>1.8.2</lt></range>
 </package>
 <package>
	<name>tshark</name>
	<range><lt>1.8.2</lt></range>
 </package>
 <package>
	<name>tshark-lite</name>
	<range><lt>1.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wireshark reports:
	<blockquote cite="http://www.wireshark.org/docs/relnotes/wireshark-1.8.2.html">
	 It may be possible to make Wireshark crash by injecting a
	 malformed packet onto the wire or by convincing someone to read a
	 malformed packet trace file.
	 It may be possible to make Wireshark consume excessive CPU
	 resources by injecting a malformed packet onto the wire or by
	 convincing someone to read a malformed packet trace file.
	 The PPP dissector could crash.
	 The NFS dissector could use excessive amounts of CPU.
	 The DCP ETSI dissector could trigger a zero division.
	 The MongoDB dissector could go into a large loop.
	 The XTP dissector could go into an infinite loop.
	 The ERF dissector could overflow a buffer.
	 The AFP dissector could go into a large loop.
	 The RTPS2 dissector could overflow a buffer.
	 The GSM RLC MAC dissector could overflow a buffer.
	 The CIP dissector could exhaust system memory.
	 The STUN dissector could crash.
	 The EtherCAT Mailbox dissector could abort.
	 The CTDB dissector could go into a large loop.
	 The pcap-ng file parser could trigger a zero division.
	 The Ixia IxVeriWave file parser could overflow a buffer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4048</cvename>
 <cvename>CVE-2012-4049</cvename>
 <cvename>CVE-2012-4285</cvename>
 <cvename>CVE-2012-4286</cvename>
 <cvename>CVE-2012-4287</cvename>
 <cvename>CVE-2012-4288</cvename>
 <cvename>CVE-2012-4289</cvename>
 <cvename>CVE-2012-4290</cvename>
 <cvename>CVE-2012-4291</cvename>
 <cvename>CVE-2012-4292</cvename>
 <cvename>CVE-2012-4293</cvename>
 <cvename>CVE-2012-4294</cvename>
 <cvename>CVE-2012-4295</cvename>
 <cvename>CVE-2012-4296</cvename>
 <cvename>CVE-2012-4297</cvename>
 <cvename>CVE-2012-4298</cvename>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-11.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-12.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-13.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-14.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-15.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-16.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-17.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-18.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-19.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-20.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-21.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-22.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-23.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-24.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-25.html</url>
 </references>
 <dates>
 <discovery>2012-07-22</discovery>
 <entry>2012-08-18</entry>
 </dates>
 </vuln>

<vuln vid="07234e78-e899-11e1-b38d-0023ae8e59f0">
 <topic>databases/postgresql*-server -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql-server</name>
	<range><gt>8.3.*</gt><lt>8.3.20</lt></range>
	<range><gt>8.4.*</gt><lt>8.4.13</lt></range>
	<range><gt>9.0.*</gt><lt>9.0.9</lt></range>
	<range><gt>9.1.*</gt><lt>9.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL Global Development Group reports:
	<blockquote cite="http://www.postgresql.org/about/news/1407/">
	 The PostgreSQL Global Development Group today released
	 security updates for all active branches of the PostgreSQL
	 database system, including versions 9.1.5, 9.0.9, 8.4.13 and
	 8.3.20. This update patches security holes associated with
	 libxml2 and libxslt, similar to those affecting other open
	 source projects. All users are urged to update their
	 installations at the first available opportunity
	 Users who are relying on the built-in XML functionality to
	 validate external DTDs will need to implement a workaround, as
	 this security patch disables that functionality. Users who are
	 using xslt_process() to fetch documents or stylesheets from
	 external URLs will no longer be able to do so. The PostgreSQL
	 project regrets the need to disable both of these features in
	 order to maintain our security standards. These security issues
	 with XML are substantially similar to issues patched recently
	 by the Webkit (CVE-2011-1774), XMLsec (CVE-2011-1425) and PHP5
	 (CVE-2012-0057) projects.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3488</cvename>
 <cvename>CVE-2012-3489</cvename>
 <url>http://www.postgresql.org/about/news/1407/</url>
 </references>
 <dates>
 <discovery>2012-08-17</discovery>
 <entry>2012-08-17</entry>
 </dates>
 </vuln>

<vuln vid="db1d3340-e83b-11e1-999b-e0cb4e266481">
 <topic>phpMyAdmin -- Multiple XSS in Table operations, Database structure, Trigger and Visualize GIS data pages</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>3.5.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php">
	 Using a crafted table name, it was possible to produce a
	 XSS : 1) On the Database Structure page, creating a new
	 table with a crafted name 2) On the Database Structure page,
	 using the Empty and Drop links of the crafted table name 3)
	 On the Table Operations page of a crafted table, using the
	 'Empty the table (TRUNCATE)' and 'Delete the table (DROP)'
	 links 4) On the Triggers page of a database containing
	 tables with a crafted name, when opening the 'Add Trigger'
	 popup 5) When creating a trigger for a table with a crafted
	 name, with an invalid definition. Having crafted data in a
	 database table, it was possible to produce a XSS : 6) When
	 visualizing GIS data, having a crafted label name.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4345</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php</url>
 </references>
 <dates>
 <discovery>2012-08-12</discovery>
 <entry>2012-08-17</entry>
 </dates>
 </vuln>

<vuln vid="48bcb4b2-e708-11e1-a59d-000d601460a4">
 <topic>typo3 -- Multiple vulernabilities in TYPO3 Core</topic>
 <affects>
 <package>
	<name>typo3</name>
	<range><ge>4.5.0</ge><lt>4.5.19</lt></range>
	<range><ge>4.6.0</ge><lt>4.6.12</lt></range>
	<range><ge>4.7.0</ge><lt>4.7.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Typo Security Team reports:
	<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/">
	 It has been discovered that TYPO3 Core is vulnerable to Cross-Site
	 Scripting, Information Disclosure, Insecure Unserialize leading to
	 Arbitrary Code Execution.
	 TYPO3 Backend Help System - Due to a missing signature (HMAC) for a
	 parameter in the view_help.php file, an attacker could unserialize
	 arbitrary objects within TYPO3. We are aware of a working exploit,
	 which can lead to arbitrary code execution. A valid backend user
	 login or multiple successful cross site request forgery attacks are
	 required to exploit this vulnerability.
	 TYPO3 Backend - Failing to properly HTML-encode user input in
	 several places, the TYPO3 backend is susceptible to Cross-Site
	 Scripting. A valid backend user is required to exploit these
	 vulnerabilities.
	 TYPO3 Backend - Accessing the configuration module discloses the
	 Encryption Key. A valid backend user with access to the
	 configuration module is required to exploit this vulnerability.
	 TYPO3 HTML Sanitizing API - By not removing several HTML5
	 JavaScript events, the API method t3lib_div::RemoveXSS() fails to
	 filter specially crafted HTML injections, thus is susceptible to
	 Cross-Site Scripting. Failing to properly encode for JavaScript the
	 API method t3lib_div::quoteJSvalue(), it is susceptible to Cross-Site
	 Scripting.
	 TYPO3 Install Tool - Failing to properly sanitize user input, the
	 Install Tool is susceptible to Cross-Site Scripting.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/</url>
 </references>
 <dates>
 <discovery>2012-08-15</discovery>
 <entry>2012-08-15</entry>
 </dates>
 </vuln>

<vuln vid="83f9e943-e664-11e1-a66d-080027ef73ec">
 <topic>fetchmail -- two vulnerabilities in NTLM authentication</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><ge>5.0.8</ge><lt>6.3.21_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2012-02.txt">
	 With NTLM support enabled, fetchmail might mistake a server-side
	 error message during NTLM protocol exchange for protocol data,
	 leading to a SIGSEGV.
	 Also, with a carefully crafted NTLM challenge, a malicious server
	 might cause fetchmail to read from a bad memory location, betraying
	 confidential data. It is deemed hard, although not impossible, to
	 steal other accounts' data.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3482</cvename>
 </references>
 <dates>
 <discovery>2012-08-12</discovery>
 <entry>2012-08-14</entry>
 <modified>2012-08-27</modified>
 </dates>
 </vuln>

<vuln vid="55b498e2-e56c-11e1-bbd5-001c25e46b1d">
 <topic>Several vulnerabilities found in IcedTea-Web</topic>
 <affects>
 <package>
	<name>icedtea-web</name>
	<range><lt>1.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The IcedTea project team reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=840592">
	 CVE-2012-3422: Use of uninitialized instance pointers
	 An uninitialized pointer use flaw was found in IcedTea-Web web
	 browser plugin. A malicious web page could use this flaw make
	 IcedTea-Web browser plugin pass invalid pointer to a web browser.
	 Depending on the browser used, it may cause the browser to crash
	 or possibly execute arbitrary code.
	 The get_cookie_info() and get_proxy_info() call
	 getFirstInTableInstance() with the instance_to_id_map hash as
	 a parameter. If instance_to_id_map is empty (which can happen
	 when plugin was recently removed), getFirstInTableInstance()
	 returns an uninitialized pointer.
	</blockquote>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=841345">
	 CVE-2012-3423: Incorrect handling of non 0-terminated strings
	 It was discovered that the IcedTea-Web web browser plugin
	 incorrectly assumed that all strings provided by browser are NUL
	 terminated, which is not guaranteed by the NPAPI (Netscape Plugin
	 Application Programming Interface). When used in a browser that
	 does not NUL terminate NPVariant NPStrings, this could lead to
	 buffer over-read or over-write, resulting in possible information
	 leak, crash, or code execution.
	 Mozilla browsers currently NUL terminate strings, however recent
	 Chrome versions are known not to provide NUL terminated data.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3422</cvename>
 <cvename>CVE-2012-3423</cvename>
 <mlist>http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-July/019580.html</mlist>
 </references>
 <dates>
 <discovery>2012-07-31</discovery>
 <entry>2012-08-13</entry>
 </dates>
 </vuln>

<vuln vid="a14dee30-e3d7-11e1-a084-50e5492bd3dc">
 <topic>libcloud -- possible SSL MITM due to invalid regexp used to validate target server hostname</topic>
 <affects>
 <package>
	<name>py-libcloud</name>
	<range><lt>0.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The libcloud development team reports:
	<blockquote cite="http://libcloud.apache.org/security.html">
	 When establishing a secure (SSL / TLS) connection to a target server an invalid regular
	 expression has been used for performing the hostname verification. Subset instead of the
	 full target server hostname has been marked an an acceptable match for the given hostname.
	 For example, certificate with a hostname field of "aexample.com" was considered a valid
	 certificate for domain "example.com".
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3446</cvename>
 <url>http://seclists.org/fulldisclosure/2012/Aug/55</url>
 </references>
 <dates>
 <discovery>2012-08-01</discovery>
 <entry>2012-08-11</entry>
 </dates>
 </vuln>

<vuln vid="aca0d7e0-e38a-11e1-999b-e0cb4e266481">
 <topic>phpMyAdmin -- Path disclosure due to missing library</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>3.5.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php">
	 The show_config_errors.php script does not include a
	 library, so an error message shows the full path of this
	 file, leading to possible further attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-4219</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php</url>
 </references>
 <dates>
 <discovery>2012-08-03</discovery>
 <entry>2012-08-11</entry>
 </dates>
 </vuln>

<vuln vid="31db9a18-e289-11e1-a57d-080027a27dbf">
 <topic>rubygem-rails -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-rails</name>
	<range><lt>3.2.8</lt></range>
 </package>
 <package>
	<name>rubygem-actionpack</name>
	<range><lt>3.2.8</lt></range>
 </package>
 <package>
	<name>rubygem-activesupport</name>
	<range><lt>3.2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Rails core team reports:
	<blockquote cite="http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/">
	 This version contains three important security fixes, please upgrade immediately.
	 One of security fixes impacts all users and is related to HTML escaping code. The
	 other two fixes impacts people using select_tag's prompt option and strip_tags
	 helper from ActionPack.
	 CVE-2012-3463 Potential XSS Vulnerability in select_tag prompt.
	 CVE-2012-3464 Potential XSS Vulnerability in the HTML escaping code.
	 CVE-2012-3465 XSS Vulnerability in strip_tags.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3463</cvename>
 <cvename>CVE-2012-3464</cvename>
 <cvename>CVE-2012-3465</cvename>
 <url>https://groups.google.com/d/msg/rubyonrails-security/fV3QUToSMSw/eHBSFOUYHpYJ</url>
 <url>https://groups.google.com/d/msg/rubyonrails-security/kKGNeMrnmiY/r2yM7xy-G48J</url>
 <url>https://groups.google.com/d/msg/rubyonrails-security/FgVEtBajcTY/tYLS1JJTu38J</url>
 <url>http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/</url>
 </references>
 <dates>
 <discovery>2012-08-08</discovery>
 <entry>2012-08-10</entry>
 </dates>
 </vuln>

<vuln vid="8675efd5-e22c-11e1-a808-002354ed89bc">
 <topic>sudosh -- buffer overflow</topic>
 <affects>
 <package>
	<name>sudosh2</name>
	<range><le>1.0.2</le></range>
 </package>
 <package>
	<name>sudosh3</name>
	<range><le>3.2.0_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISS reports:
	<blockquote cite="http://xforce.iss.net/xforce/xfdb/55903">
	 sudosh2 and sudosh3 are vulnerable to a stack-based buffer
	 overflow, caused by improper bounds checking by the replay()
	 function. By persuading a victim to replay a specially-crafted
	 recorded sudo session, a local attacker could overflow a buffer
	 and execute arbitrary code on the system with elevated privileges
	 or cause the application to crash.
	</blockquote>
 </body>
 </description>
 <references>
	<url>http://xforce.iss.net/xforce/xfdb/55903</url>
	<url>http://secunia.com/advisories/38349</url>
	<url>http://secunia.com/advisories/38292</url>
 </references>
 <dates>
 <discovery>2010-01-17</discovery>
 <entry>2012-08-09</entry>
 </dates>
 </vuln>

<vuln vid="0f020b7b-e033-11e1-90a2-000c299b62e1">
 <topic>FreeBSD -- named(8) DNSSEC validation Denial of Service</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_10</lt></range>
	<range><ge>8.1</ge><lt>8.1_13</lt></range>
	<range><ge>8.2</ge><lt>8.2_10</lt></range>
	<range><ge>8.3</ge><lt>8.3_4</lt></range>
	<range><ge>9.0</ge><lt>9.0_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:05.bind.asc">
	 BIND 9 stores a cache of query names that are known to be failing
	 due to misconfigured name servers or a broken chain of trust.
	 Under high query loads, when DNSSEC validation is active, it is
	 possible for a condition to arise in which data from this cache of
	 failing queries could be used before it was fully initialized,
	 triggering an assertion failure.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-12:05.bind</freebsdsa>
 <cvename>CVE-2012-3817</cvename>
 </references>
 <dates>
 <discovery>2012-07-24</discovery>
 <entry>2012-08-07</entry>
 </dates>
 </vuln>

<vuln vid="36235c38-e0a8-11e1-9f4d-002354ed89bc">
 <topic>automake -- Insecure 'distcheck' recipe granted world-writable distdir</topic>
 <affects>
 <package>
	<name>automake</name>
	<range><ge>1.5.0</ge><lt>1.12.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GNU reports:
	<blockquote cite="https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html">
	 The recipe of the 'distcheck' target granted temporary
	 world-write permissions on the extracted distdir. This introduced
	 a locally exploitable race condition for those who run "make
	 distcheck" with a non-restrictive umask (e.g., 022) in a directory
	 that was accessible by others. A successful exploit would result
	 in arbitrary code execution with the privileges of the user
	 running "make distcheck".
	 It is important to stress that this vulnerability impacts not only
	 the Automake package itself, but all packages with
	 Automake-generated makefiles. For an effective fix it is necessary
	 to regenerate the Makefile.in files with a fixed Automake
	 version.
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-3386</cvename>
	<url>https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html</url>
 </references>
 <dates>
 <discovery>2012-07-09</discovery>
 <entry>2012-08-06</entry>
 <modified>2012-08-25</modified>
 </dates>
 </vuln>

<vuln vid="dbf338d0-dce5-11e1-b655-14dae9ebcf89">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>14.0.1,1</lt></range>
	<range><lt>10.0.6,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>10.0.6,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.11</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.6</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.11</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>14.0</lt></range>
	<range><lt>10.0.6</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2012-42 Miscellaneous memory safety hazards (rv:14.0/
	 rv:10.0.6)
	 MFSA 2012-43 Incorrect URL displayed in addressbar through drag and
	 drop
	 MFSA 2012-44 Gecko memory corruption
	 MFSA 2012-45 Spoofing issue with location
	 MFSA 2012-46 XSS through data: URLs
	 MFSA 2012-47 Improper filtering of javascript in HTML feed-view
	 MFSA 2012-48 use-after-free in nsGlobalWindow::PageHidden
	 MFSA 2012-49 Same-compartment Security Wrappers can be bypassed
	 MFSA 2012-50 Out of bounds read in QCMS
	 MFSA 2012-51 X-Frame-Options header ignored when duplicated
	 MFSA 2012-52 JSDependentString::undepend string conversion results
	 in memory corruption
	 MFSA 2012-53 Content Security Policy 1.0 implementation errors
	 cause data leakage
	 MFSA 2012-54 Clickjacking of certificate warning page
	 MFSA 2012-55 feed: URLs with an innerURI inherit security context
	 of page
	 MFSA 2012-56 Code execution through javascript: URLs
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-1949</cvename>
	<cvename>CVE-2012-1950</cvename>
	<cvename>CVE-2012-1951</cvename>
	<cvename>CVE-2012-1952</cvename>
	<cvename>CVE-2012-1953</cvename>
	<cvename>CVE-2012-1954</cvename>
	<cvename>CVE-2012-1955</cvename>
	<cvename>CVE-2012-1957</cvename>
	<cvename>CVE-2012-1958</cvename>
	<cvename>CVE-2012-1959</cvename>
	<cvename>CVE-2012-1960</cvename>
	<cvename>CVE-2012-1961</cvename>
	<cvename>CVE-2012-1962</cvename>
	<cvename>CVE-2012-1963</cvename>
	<cvename>CVE-2012-1964</cvename>
	<cvename>CVE-2012-1965</cvename>
	<cvename>CVE-2012-1966</cvename>
	<cvename>CVE-2012-1967</cvename>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-42.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-43.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-44.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-45.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-46.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-47.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-48.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-49.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-50.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-51.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-52.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-53.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-54.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-55.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-56.html</url>
 </references>
 <dates>
 <discovery>2012-07-17</discovery>
 <entry>2012-08-02</entry>
 </dates>
 </vuln>

<vuln vid="de2bc01f-dc44-11e1-9f4d-002354ed89bc">
 <topic>Apache -- Insecure LD_LIBRARY_PATH handling</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><le>2.2.22_5</le></range>
 </package>
 <package>
	<name>apache-event</name>
	<range><le>2.2.22_5</le></range>
 </package>
 <package>
	<name>apache-itk</name>
	<range><le>2.2.22_5</le></range>
 </package>
 <package>
	<name>apache-peruser</name>
	<range><le>2.2.22_5</le></range>
 </package>
 <package>
	<name>apache-worker</name>
	<range><le>2.2.22_5</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache reports:
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
	 Insecure handling of LD_LIBRARY_PATH was found that could lead to
	 the current working directory to be searched for DSOs. This could
	 allow a local user to execute code as root if an administrator runs
	 apachectl from an untrusted directory.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0883</cvename>
 <url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
 <url>http://www.apache.org/dist/httpd/CHANGES_2.4.2</url>
 </references>
 <dates>
 <discovery>2012-03-02</discovery>
 <entry>2012-08-01</entry>
 </dates>
 </vuln>

<vuln vid="f01292a0-db3c-11e1-a84b-00e0814cab4e">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py26-django</name>
	<range><ge>1.4</ge><lt>1.4.1</lt></range>
	<range><ge>1.3</ge><lt>1.3.2</lt></range>
 </package>
 <package>
	<name>py27-django</name>
	<range><ge>1.4</ge><lt>1.4.1</lt></range>
	<range><ge>1.3</ge><lt>1.3.2</lt></range>
 </package>
 <package>
	<name>py26-django-devel</name>
	<range><lt>20120731,1</lt></range>
 </package>
 <package>
	<name>py27-django-devel</name>
	<range><lt>20120731,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Django project reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/">
	 Today the Django team is issuing multiple releases --
	 Django 1.3.2 and Django 1.4.1 -- to remedy security issues
	 reported to us:
	 <ul>
	 <li>Cross-site scripting in authentication views</li>
	 <li>Denial-of-service in image validation</li>
	 <li>Denial-of-service via get_image_dimensions()</li>
	 </ul>
	 All users are encouraged to upgrade Django immediately.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3442</cvename>
 <cvename>CVE-2012-3443</cvename>
 <cvename>CVE-2012-3444</cvename>
 <url>https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/</url>
 </references>
 <dates>
 <discovery>2012-07-30</discovery>
 <entry>2012-07-31</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="58253655-d82c-11e1-907c-20cf30e32f6d">
 <topic>bugzilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><ge>3.6.0</ge><lt>3.6.10</lt></range>
	<range><ge>4.0.0</ge><lt>4.0.7</lt></range>
	<range><ge>4.2.0</ge><lt>4.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/3.6.9/">
	 The following security issues have been discovered in
	 Bugzilla:
	 <h1>Information Leak</h1>
	 Versions: 4.1.1 to 4.2.1, 4.3.1
	 In HTML bugmails, all bug IDs and attachment IDs are
	 linkified, and hovering these links displays a tooltip
	 with the bug summary or the attachment description if
	 the user is allowed to see the bug or attachment.
	 But when validating user permissions when generating the
	 email, the permissions of the user who edited the bug were
	 taken into account instead of the permissions of the
	 addressee. This means that confidential information could
	 be disclosed to the addressee if the other user has more
	 privileges than the addressee.
	 Plain text bugmails are not affected as bug and attachment
	 IDs are not linkified.
	 <h1>Information Leak</h1>
	 Versions: 2.17.5 to 3.6.9, 3.7.1 to 4.0.6, 4.1.1 to
	 4.2.1, 4.3.1
	 The description of a private attachment could be visible
	 to a user who hasn't permissions to access this attachment
	 if the attachment ID is mentioned in a public comment in
	 a bug that the user can see.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-1968</cvename>
 <cvename>CVE-2012-1969</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=777398</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=777586</url>
 </references>
 <dates>
 <discovery>2012-07-26</discovery>
 <entry>2012-07-27</entry>
 </dates>
 </vuln>

<vuln vid="17f369dc-d7e7-11e1-90a2-000c299b62e1">
 <topic>nsd -- Denial of Service</topic>
 <affects>
 <package>
	<name>nsd</name>
	<range><lt>3.2.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tom Hendrikx reports:
	<blockquote cite="http://www.nlnetlabs.nl/downloads/CVE-2012-2979.txt">
	 It is possible to crash (SIGSEGV) a NSD child server process by
	 sending it a DNS packet from any host on the internet and the per
	 zone stats build option is enabled. A crashed child process will
	 automatically be restarted by the parent process, but an attacker
	 may keep the NSD server occupied restarting child processes by
	 sending it a stream of such packets effectively preventing the
	 NSD server to serve.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2979</cvename>
 <url>http://www.nlnetlabs.nl/downloads/CVE-2012-2979.txt</url>
 </references>
 <dates>
 <discovery>2012-07-27</discovery>
 <entry>2012-07-27</entry>
 </dates>
 </vuln>

<vuln vid="ae2fa87c-4bca-4138-8be1-67ce2a19b3a8">
 <topic>rubygem-actionpack -- Denial of Service</topic>
 <affects>
 <package>
	<name>rubygem-actionpack</name>
	<range><lt>3.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM">
	 There is a DoS vulnerability in Action Pack digest authentication
	 handling in authenticate_or_request_with_http_digest.
	 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3424</cvename>
 <url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM</url>
 </references>
 <dates>
 <discovery>2012-07-26</discovery>
 <entry>2012-07-26</entry>
 </dates>
 </vuln>

<vuln vid="cdc4ff0e-d736-11e1-8221-e0cb4e266481">
 <topic>p5-RT-Authen-ExternalAuth -- privilege escalation</topic>
 <affects>
 <package>
	<name>p5-RT-Authen-ExternalAuth</name>
	<range><lt>0.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The RT development team reports:
	<blockquote cite="http://blog.bestpractical.com/2012/07/security-vulnerabilities-in-three-commonly-deployed-rt-extensions.html">
	 RT::Authen::ExternalAuth 0.10 and below (for all versions
	 of RT) are vulnerable to an escalation of privilege attack
	 where the URL of a RSS feed of the user can be used to
	 acquire a fully logged-in session as that user.
	 CVE-2012-2770 has been assigned to this vulnerability.
	 Users of RT 3.8.2 and above should upgrade to
	 RT::Authen::ExternalAuth 0.11, which resolves this
	 vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blog.bestpractical.com/2012/07/security-vulnerabilities-in-three-commonly-deployed-rt-extensions.html</url>
 <cvename>CVE-2012-2770</cvename>
 </references>
 <dates>
 <discovery>2012-07-25</discovery>
 <entry>2012-07-26</entry>
 </dates>
 </vuln>

<vuln vid="c7fa3618-d5ff-11e1-90a2-000c299b62e1">
 <topic>isc-dhcp -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>isc-dhcp41-server</name>
	<range><lt>4.1.e_5,2</lt></range>
 </package>
 <package>
	<name>isc-dhcp42-server</name>
	<range><lt>4.2.4_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://www.isc.org/announcement/bind-and-dhcp-security-updates-released">
	 An unexpected client identifier parameter can cause the ISC DHCP
	 daemon to segmentation fault when running in DHCPv6 mode,
	 resulting in a denial of service to further client requests. In
	 order to exploit this condition, an attacker must be able to send
	 requests to the DHCP server.
	 An error in the handling of malformed client identifiers can cause
	 a DHCP server running affected versions (see "Impact") to enter a
	 state where further client requests are not processed and the
	 server process loops endlessly, consuming all available CPU
	 cycles.
	 Under normal circumstances this condition should not be
	 triggered, but a non-conforming or malicious client could
	 deliberately trigger it in a vulnerable server. In order to
	 exploit this condition an attacker must be able to send requests
	 to the DHCP server.
	 Two memory leaks have been found and fixed in ISC DHCP. Both are
	 reproducible when running in DHCPv6 mode (with the -6 command-line
	 argument.) The first leak is confirmed to only affect servers
	 operating in DHCPv6 mode, but based on initial code analysis the
	 second may theoretically affect DHCPv4 servers (though this has
	 not been demonstrated.)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3570</cvename>
 <cvename>CVE-2012-3571</cvename>
 <cvename>CVE-2012-3954</cvename>
 <url>https://kb.isc.org/article/AA-00714</url>
 <url>https://kb.isc.org/article/AA-00712</url>
 <url>https://kb.isc.org/article/AA-00737</url>
 </references>
 <dates>
 <discovery>2012-07-24</discovery>
 <entry>2012-07-25</entry>
 </dates>
 </vuln>

<vuln vid="0bc67930-d5c3-11e1-bef6-0024e81297ae">
 <topic>dns/bind9* -- Heavy DNSSEC Validation Load Can Cause a 'Bad Cache' Assertion Failure</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><lt>9.9.1.2</lt></range>
 </package>
 <package>
	<name>bind98</name>
	<range><lt>9.8.3.2</lt></range>
 </package>
 <package>
	<name>bind97</name>
	<range><lt>9.7.6.2</lt></range>
 </package>
 <package>
	<name>bind96</name>
	<range><lt>9.6.3.1.ESV.R7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://kb.isc.org/article/AA-00729">
	 High numbers of queries with DNSSEC validation enabled can
	 cause an assertion failure in named, caused by using a 'bad cache'
	 data structure before it has been initialized.
	 BIND 9 stores a cache of query names that are known to be failing due
	 to misconfigured name servers or a broken chain of trust. Under high query
	 loads when DNSSEC validation is active, it is possible for a condition
	 to arise in which data from this cache of failing queries could be used
	 before it was fully initialized, triggering an assertion failure.
	 This bug cannot be encountered unless your server is doing DNSSEC
	 validation.
	</blockquote>
 </body>
 </description>
 <references>
	 <cvename>CVE-2012-3817</cvename>
	 <url>https://kb.isc.org/article/AA-00729</url>
 </references>
 <dates>
 <discovery>2012-07-24</discovery>
 <entry>2012-07-24</entry>
 </dates>
 </vuln>

<vuln vid="748aa89f-d529-11e1-82ab-001fd0af1a4c">
 <topic>rubygem-activerecord -- multiple vulnerabilities</topic>
 <affects>
	<package>
	 <name>rubygem-activemodel</name>
	 <range><lt>3.2.4</lt></range>
	</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	 rubygem-activerecord -- multiple vulernabilities
	 <blockquote>
	 Due to the way Active Record interprets parameters in
		 combination with the way that Rack parses query parameters, it
		 is possible for an attacker to issue unexpected database
		 queries with "IS NULL" where clauses. This issue does *not*
		 let an attacker insert arbitrary values into an SQL query,
		 however they can cause the query to check for NULL where most
		 users wouldn't expect it.
	 Due to the way Active Record handles nested query parameters,
		 an attacker can use a specially crafted request to inject some
		 forms of SQL into your application's SQL queries.
	 </blockquote>
	</body>
 </description>
 <references>
	<cvename>CVE-2012-2660</cvename>
	<cvename>CVE-2012-2661</cvename>
	<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/8SA-M3as7A8</url>
	<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/dUaiOOGWL1k</url>
 </references>
 <dates>
	<discovery>2012-05-31</discovery>
	<entry>2012-07-23</entry>
	<modified>2012-07-23</modified>
 </dates>
 </vuln>

<vuln vid="bdab0acd-d4cd-11e1-8a1c-14dae9ebcf89">
 <topic>php -- potential overflow in _php_stream_scandir</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><gt>5.4</gt><lt>5.4.5</lt></range>
	<range><ge>5.3</ge><lt>5.3.15</lt></range>
	<range><ge>5.2</ge><lt>5.2.17_10</lt></range>
 </package>
 <package>
	<name>php53</name>
	<range><lt>5.3.15</lt></range>
 </package>
 <package>
	<name>php52</name>
	<range><lt>5.2.17_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP Development Team reports:
	<blockquote cite="http://www.php.net/archive/2012.php#id2012-07-19-1">
	 The release of PHP 5.4.15 and 5.4.5 fix a potential overflow in
	 _php_stream_scandir
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-2688</cvename>
	<url>http://www.php.net/archive/2012.php#id2012-07-19-1</url>
 </references>
 <dates>
 <discovery>2012-07-19</discovery>
 <entry>2012-07-23</entry>
 <modified>2013-01-15</modified>
 </dates>
 </vuln>

<vuln vid="ce82bfeb-d276-11e1-92c6-14dae938ec40">
 <topic>dns/nsd -- DoS vulnerability from non-standard DNS packet</topic>
 <affects>
 <package>
	<name>nsd</name>
	<range><lt>3.2.11_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marek Vavrusa and Lubos Slovak report:
	<blockquote cite="http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt">
	 It is possible to crash (SIGSEGV) a NSD child server process
	 by sending it a non-standard DNS packet from any host on the
	 internet. A crashed child process will automatically be restarted
	 by the parent process, but an attacker may keep the NSD server
	 occupied restarting child processes by sending it a stream of
	 such packets effectively preventing the NSD server to serve.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2978</cvename>
 <freebsdpr>ports/170024</freebsdpr>
 <url>http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt</url>
 </references>
 <dates>
 <discovery>2012-07-19</discovery>
 <entry>2012-07-20</entry>
 <modified>2012-07-21</modified>
 </dates>
 </vuln>

<vuln vid="a460035e-d111-11e1-aff7-001fd056c417">
 <topic>libjpeg-turbo -- heap-based buffer overflow</topic>
 <affects>
 <package>
	<name>libjpeg-turbo</name>
	<range><lt>1.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://sourceforge.net/projects/libjpeg-turbo/files/1.2.1/README.txt">
	 The Changelog for version 1.2.1 says: Fixed a regression caused by
	 1.2.0[6] in which decompressing corrupt JPEG images (specifically,
	 images in which the component count was erroneously set to a large
	 value) would cause libjpeg-turbo to segfault.
	</blockquote>
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=826849">
	 A Heap-based buffer overflow was found in the way libjpeg-turbo
	 decompressed certain corrupt JPEG images in which the component count
	 was erroneously set to a large value. An attacker could create a
	 specially-crafted JPEG image that, when opened, could cause an
	 application using libpng to crash or, possibly, execute arbitrary code
	 with the privileges of the user running the application.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2806</cvename>
 <url>http://sourceforge.net/projects/libjpeg-turbo/files/1.2.1/README.txt</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=826849</url>
 </references>
 <dates>
 <discovery>2012-05-31</discovery>
 <entry>2012-07-18</entry>
 <modified>2012-07-19</modified>
 </dates>
 </vuln>

<vuln vid="2fe4b57f-d110-11e1-ac76-10bf48230856">
 <topic>Dokuwiki -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>dokuwiki</name>
	<range><lt>20120125_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia Research reports:
	<blockquote cite="http://secunia.com/advisories/49196/">
	 Secunia Research has discovered a vulnerability in DokuWiki, which can
	 be exploited by malicious people to conduct cross-site scripting
	 attacks.
	 Input passed to the "ns" POST parameter in lib/exe/ajax.php (when "call"
	 is set to "medialist" and "do" is set to "media") is not properly
	 sanitised within the "tpl_mediaFileList()" function in inc/template.php
	 before being returned to the user. This can be exploited to execute
	 arbitrary HTML and script code in a user's browser session in context
	 of an affected site.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/49196/</url>
 <cvename>CVE-2012-0283</cvename>
 </references>
 <dates>
 <discovery>2012-07-13</discovery>
 <entry>2012-07-18</entry>
 </dates>
 </vuln>

<vuln vid="3a6960ef-c8a8-11e1-9924-001fd0af1a4c">
 <topic>puppet -- multiple vulnerabilities</topic>
 <affects>
	<package>
	 <name>puppet</name>
	 <range><gt>2.7.*</gt><lt>2.7.18</lt></range>
	</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	 puppet -- multiple vulnerabilities
	 <blockquote cite="http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.7.18">
	 Arbitrary file read on the puppet master from authenticated
		 clients (high). It is possible to construct an HTTP get request
		 from an authenticated client with a valid certificate that will
		 return the contents of an arbitrary file on the Puppet master
		 that the master has read-access to.
	 Arbitrary file delete/D.O.S on Puppet Master from authenticated
		 clients (high). Given a Puppet master with the "Delete"
		 directive allowed in auth.conf for an authenticated host, an
		 attacker on that host can send a specially crafted Delete
		 request that can cause an arbitrary file deletion on the Puppet
		 master, potentially causing a denial of service attack. Note
		 that this vulnerability does *not* exist in Puppet as
		 configured by default.
	 The last_run_report.yaml is world readable (medium). The most
		 recent Puppet run report is stored on the Puppet master with
		 world-readable permissions. The report file contains the
		 context diffs of any changes to configuration on an agent,
		 which may contain sensitive information that an attacker can
		 then access. The last run report is overwritten with every
		 Puppet run.
	 Arbitrary file read on the Puppet master by an agent (medium).
		 This vulnerability is dependent upon vulnerability
		 "last_run_report.yml is world readable" above. By creating a
		 hard link of a Puppet-managed file to an arbitrary file that
		 the Puppet master can read, an attacker forces the contents to
		 be written to the puppet run summary. The context diff is
		 stored in last_run_report.yaml, which can then be accessed by
		 the attacker.
	 Insufficient input validation for agent hostnames (low). An
		 attacker could trick the administrator into signing an
		 attacker's certificate rather than the intended one by
		 constructing specially crafted certificate requests containing
		 specific ANSI control sequences. It is possible to use the
		 sequences to rewrite the order of text displayed to an
		 administrator such that display of an invalid certificate and
		 valid certificate are transposed. If the administrator signs
		 the attacker's certificate, the attacker can then
		 man-in-the-middle the agent.
	 Agents with certnames of IP addresses can be impersonated
		 (low). If an authenticated host with a certname of an IP
		 address changes IP addresses, and a second host assumes the
		 first host's former IP address, the second host will be treated
		 by the puppet master as the first one, giving the second host
		 access to the first host's catalog. Note: This will not be
		 fixed in Puppet versions prior to the forthcoming 3.x. Instead,
		 with this announcement IP-based authentication in Puppet &lt; 3.x
		 is deprecated.
	 </blockquote>
	</body>
 </description>
 <references>
	<cvename>CVE-2012-3864</cvename>
	<cvename>CVE-2012-3865</cvename>
	<cvename>CVE-2012-3866</cvename>
	<cvename>CVE-2012-3867</cvename>
	<url>http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.7.18</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-3864/</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-3865/</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-3866/</url>
	<url>http://puppetlabs.com/security/cve/cve-2012-3867/</url>
 </references>
 <dates>
	<discovery>2012-07-05</discovery>
	<entry>2012-07-10</entry>
 </dates>
 </vuln>

<vuln vid="4c1ac2dd-c788-11e1-be25-14dae9ebcf89">
 <topic>asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk</name>
	<range><gt>10.*</gt><lt>10.5.2</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.13.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/security">
	 Possible resource leak on uncompleted re-invite transactions.
	 Remote crash vulnerability in voice mail application.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3812</cvename>
 <url>http://downloads.digium.com/pub/security/AST-2012-010.html</url>
 <url>http://downloads.digium.com/pub/security/AST-2012-011.html</url>
 <url>https://www.asterisk.org/security</url>
 </references>
 <dates>
 <discovery>2012-07-05</discovery>
 <entry>2012-07-06</entry>
 <modified>2012-08-30</modified>
 </dates>
 </vuln>

<vuln vid="c28ee9cd-916e-4dcf-8ed3-e97e5846db6c">
 <topic>typo3 -- Cross-Site Scripting Vulnerability in TYPO3 Core</topic>
 <affects>
 <package>
	<name>typo3</name>
	<range><ge>4.5</ge><lt>4.5.17</lt></range>
	<range><ge>4.6</ge><lt>4.6.10</lt></range>
	<range><ge>4.7</ge><lt>4.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Typo3 Security Report (TYPO3-CORE-SA-2012-003):
	<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-003/">
	 TYPO3 bundles and uses an external JavaScript and Flash Upload Library
	 called swfupload. TYPO3 can be configured to use this Flash uploader.
		Input passed via the "movieName" parameter to swfupload.swf is not
		properly sanitised before being used in a call to
		"ExternalInterface.call()". This can be exploited to execute arbitrary
		script code in a user's browser session in context of an affected site.
		The existance of the swfupload library is sufficient to be vulnerable
		to the reported problem.
	</blockquote>
 </body>
 </description>
 <references>
	 <url>http://secunia.com/advisories/49780/</url>
	 <url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-003/</url>
 </references>
 <dates>
 <discovery>2012-07-04</discovery>
 <entry>2012-07-06</entry>
 </dates>
 </vuln>

<vuln vid="fd8bac56-c444-11e1-864b-001cc0877741">
 <topic>phpList -- SQL injection and XSS vulnerability</topic>
 <affects>
 <package>
	<name>phplist</name>
	<range><le>2.10.17</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Zero Science Lab reports:
	<blockquote cite="http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php">
	 Input passed via the parameter 'sortby' is not properly
	 sanitised before being returned to the user or used in SQL queries.
	 This can be exploited to manipulate SQL queries by injecting
	 arbitrary SQL code. The param 'num' is vulnerable to a XSS issue
	 where the attacker can execute arbitrary HTML and script code in
	 a user's browser session in context of an affected site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2740</cvename>
 <cvename>CVE-2012-2741</cvename>
 <bid>52657</bid>
 <url>https://www.phplist.com/?lid=567</url>
 <url>http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php</url>
 </references>
 <dates>
 <discovery>2012-03-21</discovery>
 <entry>2012-07-02</entry>
 </dates>
 </vuln>

<vuln vid="aed44c4e-c067-11e1-b5e0-000c299b62e1">
 <topic>FreeBSD -- Privilege escalation when returning from kernel</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_9</lt></range>
	<range><ge>8.1</ge><lt>8.1_12</lt></range>
	<range><ge>8.2</ge><lt>8.2_9</lt></range>
	<range><ge>8.3</ge><lt>8.3_3</lt></range>
	<range><ge>9.0</ge><lt>9.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc">
	 FreeBSD/amd64 runs on CPUs from different vendors. Due to varying
	 behaviour of CPUs in 64 bit mode a sanity check of the kernel may be
	 insufficient when returning from a system call.
	 Successful exploitation of the problem can lead to local kernel privilege
	 escalation, kernel data corruption and/or crash.
	 To exploit this vulnerability, an attacker must be able to run code with user
	 privileges on the target system.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-12:04.sysret</freebsdsa>
 <cvename>CVE-2012-0217</cvename>
 </references>
 <dates>
 <discovery>2012-06-12</discovery>
 <entry>2012-06-27</entry>
 </dates>
 </vuln>

<vuln vid="fc5231b6-c066-11e1-b5e0-000c299b62e1">
 <topic>FreeBSD -- Incorrect handling of zero-length RDATA fields in named(8)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_9</lt></range>
	<range><ge>8.1</ge><lt>8.1_11</lt></range>
	<range><ge>8.2</ge><lt>8.2_9</lt></range>
	<range><ge>8.3</ge><lt>8.3_3</lt></range>
	<range><ge>9.0</ge><lt>9.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:03.bind.asc">
	 The named(8) server does not properly handle DNS resource records where
	 the RDATA field is zero length, which may cause various issues for the
	 servers handling them.
	 Resolving servers may crash or disclose some portion of memory to the
	 client. Authoritative servers may crash on restart after transferring a
	 zone containing records with zero-length RDATA fields. These would
	 result in a denial of service, or leak of sensitive information.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-12:03.bind</freebsdsa>
 <cvename>CVE-2012-1667</cvename>
 </references>
 <dates>
 <discovery>2012-06-12</discovery>
 <entry>2012-06-27</entry>
 </dates>
 </vuln>

<vuln vid="185ff22e-c066-11e1-b5e0-000c299b62e1">
 <topic>FreeBSD -- Incorrect crypt() hashing</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_8</lt></range>
	<range><ge>8.1</ge><lt>8.1_10</lt></range>
	<range><ge>8.2</ge><lt>8.2_8</lt></range>
	<range><ge>8.3</ge><lt>8.3_2</lt></range>
	<range><ge>9.0</ge><lt>9.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:02.crypt.asc">
	 There is a programming error in the DES implementation used in crypt()
	 when handling input which contains characters that cannot be represented
	 with 7-bit ASCII.
	 When the input contains characters with only the most significant bit set
	 (0x80), that character and all characters after it will be ignored.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-12:02.crypt</freebsdsa>
 <cvename>CVE-2012-2143</cvename>
 </references>
 <dates>
 <discovery>2012-05-30</discovery>
 <entry>2012-06-27</entry>
 </dates>
 </vuln>

<vuln vid="2ae114de-c064-11e1-b5e0-000c299b62e1">
 <topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.4</ge><lt>7.4_8</lt></range>
	<range><ge>8.1</ge><lt>8.1_10</lt></range>
	<range><ge>8.2</ge><lt>8.2_8</lt></range>
	<range><ge>8.3</ge><lt>8.3_2</lt></range>
	<range><ge>9.0</ge><lt>9.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:01.openssl.asc">
	 OpenSSL fails to clear the bytes used as block cipher padding in SSL 3.0
	 records when operating as a client or a server that accept SSL 3.0
	 handshakes. As a result, in each record, up to 15 bytes of uninitialized
	 memory may be sent, encrypted, to the SSL peer. This could include
	 sensitive contents of previously freed memory. [CVE-2011-4576]
	 OpenSSL support for handshake restarts for server gated cryptography (SGC)
	 can be used in a denial-of-service attack. [CVE-2011-4619]
	 If an application uses OpenSSL's certificate policy checking when
	 verifying X509 certificates, by enabling the X509_V_FLAG_POLICY_CHECK
	 flag, a policy check failure can lead to a double-free. [CVE-2011-4109]
	 A weakness in the OpenSSL PKCS #7 code can be exploited using
	 Bleichenbacher's attack on PKCS #1 v1.5 RSA padding also known as the
	 million message attack (MMA). [CVE-2012-0884]
	 The asn1_d2i_read_bio() function, used by the d2i_*_bio and d2i_*_fp
	 functions, in OpenSSL contains multiple integer errors that can cause
	 memory corruption when parsing encoded ASN.1 data. This error can occur
	 on systems that parse untrusted ASN.1 data, such as X.509 certificates
	 or RSA public keys. [CVE-2012-2110]
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-12:01.openssl</freebsdsa>
 <cvename>CVE-2011-4576</cvename>
 <cvename>CVE-2011-4619</cvename>
 <cvename>CVE-2011-4109</cvename>
 <cvename>CVE-2012-0884</cvename>
 <cvename>CVE-2012-2110</cvename>
 </references>
 <dates>
 <discovery>2012-05-03</discovery>
 <entry>2012-06-27</entry>
 </dates>
 </vuln>

<vuln vid="f45c0049-be72-11e1-a284-0023ae8e59f0">
 <topic>pycrypto -- vulnerable ElGamal key generation</topic>
 <affects>
 <package>
	<name>py-pycrypto</name>
	<range><ge>2.5</ge><lt>2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dwayne C. Litzenberger of PyCrypto reports:
	<blockquote cite="http://lists.dlitz.net/pipermail/pycrypto/2012q2/000587.html">
	 In the ElGamal schemes (for both encryption and signatures), g is
	 supposed to be the generator of the entire Z^*_p group. However, in
	 PyCrypto 2.5 and earlier, g is more simply the generator of a random
	 sub-group of Z^*_p.
	 The result is that the signature space (when the key is used for
	 signing) or the public key space (when the key is used for encryption)
	 may be greatly reduced from its expected size of log(p) bits, possibly
	 down to 1 bit (the worst case if the order of g is 2).
	 While it has not been confirmed, it has also been suggested that an
	 attacker might be able to use this fact to determine the private key.
	 Anyone using ElGamal keys should generate new keys as soon as
	 practical.
	 Any additional information about this bug will be tracked at
	 https://bugs.launchpad.net/pycrypto/+bug/985164
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2417</cvename>
 <url>http://lists.dlitz.net/pipermail/pycrypto/2012q2/000587.html</url>
 <url>https://bugs.launchpad.net/pycrypto/+bug/985164</url>
 </references>
 <dates>
 <discovery>2012-05-24</discovery>
 <entry>2012-06-24</entry>
 </dates>
 </vuln>

<vuln vid="f46c4c6a-ba25-11e1-806a-001143cd36d8">
 <topic>joomla -- Privilege Escalation</topic>
 <affects>
 <package>
	<name>joomla</name>
	<range><lt>2.5.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Joomla! reported a Core Privilege Escalation::
	<blockquote cite="http://developer.joomla.org/security/news/470-20120601-core-privilege-escalation.html">
	 Inadequate checking leads to possible user privilege escalation..
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://developer.joomla.org/security/news/470-20120601-core-privilege-escalation.html</url>
 </references>
 <dates>
 <discovery>2012-04-29</discovery>
 <entry>2012-06-19</entry>
 </dates>
 </vuln>

<vuln vid="eb12ebee-b7af-11e1-b5e0-000c299b62e1">
 <topic>clamav -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.97.5</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><lt>20120612</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE Advisories report:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1419">
	 The TAR parser allows remote attackers to bypass malware detection
	 via a POSIX TAR file with an initial [aliases] character sequence.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1457">
	 The TAR parser allows remote attackers to bypass malware detection
	 via a TAR archive entry with a length field that exceeds the total
	 TAR file size.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1458">
	 The Microsoft CHM file parser allows remote attackers to bypass
	 malware detection via a crafted reset interval in the LZXC header
	 of a CHM file.
	</blockquote>
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1459">
	 The TAR file parser allows remote attackers to bypass malware
	 detection via a TAR archive entry with a length field
	 corresponding to that entire entry, plus part of the header ofxi
	 the next entry.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-1419</cvename>
 <cvename>CVE-2012-1457</cvename>
 <cvename>CVE-2012-1458</cvename>
 <cvename>CVE-2012-1459</cvename>
 </references>
 <dates>
 <discovery>2012-03-19</discovery>
 <entry>2012-06-16</entry>
 </dates>
 </vuln>

<vuln vid="3c8d1e5b-b673-11e1-be25-14dae9ebcf89">
 <topic>asterisk -- remote crash vulnerability</topic>
 <affects>
 <package>
	<name>asterisk10</name>
	<range><gt>10.*</gt><lt>10.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/security">
	 Skinny Channel Driver Remote Crash Vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-3553</cvename>
 <url>http://downloads.digium.com/pub/security/AST-2012-009.html</url>
 <url>https://www.asterisk.org/security</url>
 </references>
 <dates>
 <discovery>2012-06-14</discovery>
 <entry>2012-06-14</entry>
 </dates>
 </vuln>

<vuln vid="5140dc69-b65e-11e1-9425-001b21614864">
 <topic>ImageMagick -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ImageMagick</name>
	<range><lt>6.7.6.4</lt></range>
 </package>
 <package>
	<name>ImageMagick-nox11</name>
	<range><lt>6.7.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ImageMagick reports:
	<blockquote cite="http://www.cert.fi/en/reports/2012/vulnerability635606.html">
	 Three vulnerabilities have been identified in ImageMagick's
	 handling of JPEG and TIFF files. With these vulnerabilities, it is
	 possible to cause a denial of service situation in the target
	 system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0259</cvename>
 <cvename>CVE-2012-0260</cvename>
 <cvename>CVE-2012-1798</cvename>
 <url>http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&amp;t=20629</url>
 <url>http://www.cert.fi/en/reports/2012/vulnerability635606.html</url>
 </references>
 <dates>
 <discovery>2012-03-28</discovery>
 <entry>2012-06-14</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="55587adb-b49d-11e1-8df1-0004aca374af">
 <topic>mantis -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mantis</name>
	<range><lt>1.2.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mantis reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2012/06/09/1">
	 Roland Becker and Damien Regad (MantisBT developers) found that
	 any user able to report issues via the SOAP interface could also
	 modify any bugnotes (comments) created by other users. In a
	 default/typical MantisBT installation, SOAP API is enabled and any
	 user can sign up to report new issues. This vulnerability therefore
	 impacts upon many public facing MantisBT installations.
	 Roland Becker (MantisBT developer) found that the
	 delete_attachments_threshold permission was not being checked when
	 a user attempted to delete an attachment from an issue. The more
	 generic update_bug_threshold permission was being checked instead.
	 MantisBT administrators may have been under the false impression
	 that their configuration of the delete_attachments_threshold was
	 successfully preventing unwanted users from deleting
	 attachments.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2691</cvename>
 <cvename>CVE-2012-2692</cvename>
 <mlist>http://www.openwall.com/lists/oss-security/2012/06/09/1</mlist>
 <mlist>http://sourceforge.net/mailarchive/forum.php?thread_name=1339229952.28538.22%40d.hx.id.au&amp;forum_name=mantisbt-dev</mlist>
 </references>
 <dates>
 <discovery>2012-06-09</discovery>
 <entry>2012-06-12</entry>
 <modified>2012-06-13</modified>
 </dates>
 </vuln>

<vuln vid="38195f00-b215-11e1-8132-003067b2972c">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.236</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb12-14.html">
	 These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2034</cvename>
 <cvename>CVE-2012-2035</cvename>
 <cvename>CVE-2012-2036</cvename>
 <cvename>CVE-2012-2037</cvename>
 <cvename>CVE-2012-2038</cvename>
 <cvename>CVE-2012-2039</cvename>
 <cvename>CVE-2012-2040</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb12-14.html</url>
 </references>
 <dates>
 <discovery>2012-06-08</discovery>
 <entry>2012-06-09</entry>
 </dates>
 </vuln>

<vuln vid="bfecf7c1-af47-11e1-9580-4061862b8c22">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>13.0,1</lt></range>
	<range><lt>10.0.5,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>10.0.5,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.10</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.5</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.10</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>13.0</lt></range>
	<range><lt>10.0.5</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2012-34 Miscellaneous memory safety hazards (rv:13.0/ rv:10.0.5)
	 MFSA 2012-36 Content Security Policy inline-script bypass
	 MFSA 2012-37 Information disclosure though Windows file shares and shortcut files
	 MFSA 2012-38 Use-after-free while replacing/inserting a node in a document
	 MFSA 2012-39 NSS parsing errors with zero length items
	 MFSA 2012-40 Buffer overflow and use-after-free issues found using Address Sanitizer
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2011-3101</cvename>
	<cvename>CVE-2012-0441</cvename>
	<cvename>CVE-2012-1938</cvename>
	<cvename>CVE-2012-1939</cvename>
	<cvename>CVE-2012-1937</cvename>
	<cvename>CVE-2012-1940</cvename>
	<cvename>CVE-2012-1941</cvename>
	<cvename>CVE-2012-1944</cvename>
	<cvename>CVE-2012-1945</cvename>
	<cvename>CVE-2012-1946</cvename>
	<cvename>CVE-2012-1947</cvename>
	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-34.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-36.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-37.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-38.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-39.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-40.html</url>
 </references>
 <dates>
 <discovery>2012-06-05</discovery>
 <entry>2012-06-05</entry>
 </dates>
 </vuln>

<vuln vid="1e14d46f-af1f-11e1-b242-00215af774f0">
 <topic>quagga -- BGP OPEN denial of service vulnerability</topic>
 <affects>
 <package>
	<name>quagga</name>
	<range><le>0.99.20.1</le></range>
 </package>
 <package>
	<name>quagga-re</name>
	<range><lt>0.99.17.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CERT reports:
	<blockquote cite="http://www.kb.cert.org/vuls/id/962587">
	 If a pre-configured BGP peer sends a specially-crafted OPEN
	 message with a malformed ORF capability TLV, Quagga bgpd process
	 will erroneously try to consume extra bytes from the input packet
	 buffer. The process will detect a buffer overrun attempt before
	 it happens and immediately terminate with an error message. All
	 BGP sessions established by the attacked router will be closed
	 and its BGP routing disrupted.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-1820</cvename>
 <url>http://www.kb.cert.org/vuls/id/962587</url>
 </references>
 <dates>
 <discovery>2012-06-04</discovery>
 <entry>2012-06-05</entry>
 </dates>
 </vuln>

<vuln vid="de6d8290-aef7-11e1-898f-14dae938ec40">
 <topic>mail/sympa* -- Multiple vulnerabilities in Sympa archive management</topic>
 <affects>
 <package>
	<name>sympa</name>
	<range><lt>6.0.7</lt></range>
	<range><gt>6.1.*</gt><lt>6.1.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	David Verdin reports:
	<blockquote cite="http://www.sympa.org/security_advisories#security_breaches_in_archives_management">
	 Multiple vulnerabilities have been discovered in Sympa archive
	 management that allow to skip the scenario-based authorization
	 mechanisms.
	 This vulnerability allows the attacker to:
	 <ul>
	 <li>display the archives management page ('arc_manage')</li>
	 <li>download the list's archives</li>
	 <li>delete the list's archives</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.sympa.org/security_advisories#security_breaches_in_archives_management</url>
 </references>
 <dates>
 <discovery>2012-05-15</discovery>
 <entry>2012-06-05</entry>
 </dates>
 </vuln>

<vuln vid="1ecc0d3f-ae8e-11e1-965b-0024e88a8c98">
 <topic>dns/bind9* -- zero-length RDATA can cause named to terminate, reveal memory</topic>
 <affects>
 <package>
	<name>bind99</name>
	<range><lt>9.9.1.1</lt></range>
 </package>
 <package>
	<name>bind98</name>
	<range><lt>9.8.3.1</lt></range>
 </package>
 <package>
	<name>bind97</name>
	<range><lt>9.7.6.1</lt></range>
 </package>
 <package>
	<name>bind96</name>
	<range><lt>9.6.3.1.ESV.R7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="http://www.isc.org/software/bind/advisories/cve-2012-1667">
	 Processing of DNS resource records where the rdata field is zero length
	 may cause various issues for the servers handling them.
	 Processing of these records may lead to unexpected outcomes. Recursive
	 servers may crash or disclose some portion of memory to the client.
	 Secondary servers may crash on restart after transferring a zone
	 containing these records. Master servers may corrupt zone data if the
	 zone option "auto-dnssec" is set to "maintain". Other unexpected
	 problems that are not listed here may also be encountered.
	 Impact: This issue primarily affects recursive nameservers.
	 Authoritative nameservers will only be impacted if an administrator
	 configures experimental record types with no data. If the server is
	 configured this way, then secondaries can crash on restart after
	 transferring that zone. Zone data on the master can become corrupted if
	 the zone with those records has named configured to manage the DNSSEC
	 key rotation.
	</blockquote>
 </body>
 </description>
 <references>
	 <cvename>CVE-2012-1667</cvename>
	 <url>http://www.isc.org/software/bind/advisories/cve-2012-1667</url>
 </references>
 <dates>
 <discovery>2012-06-04</discovery>
 <entry>2012-06-04</entry>
 <modified>2012-06-06</modified>
 </dates>
 </vuln>

<vuln vid="a8864f8f-aa9e-11e1-a284-0023ae8e59f0">
 <topic>databases/postgresql*-server -- crypt vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql-server</name>
	<range><gt>8.3.*</gt><lt>8.3.18_1</lt></range>
	<range><gt>8.4.*</gt><lt>8.4.11_1</lt></range>
	<range><gt>9.0.*</gt><lt>9.0.7_2</lt></range>
	<range><gt>9.1.*</gt><lt>9.1.3_1</lt></range>
	<range><gt>9.2.*</gt><lt>9.2.b1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL Global Development Group reports:
	<blockquote cite="http://www.postgresql.org/about/news/1397/">
	 Today the PHP, OpenBSD and FreeBSD communities announced updates to
	 patch a security hole involving their crypt() hashing algorithms. This
	 issue is described in CVE-2012-2143. This vulnerability also affects a
	 minority of PostgreSQL users, and will be fixed in an update release on
	 June 4, 2012.
	 Affected users are those who use the crypt(text, text) function
	 with DES encryption in the optional pg_crypto module. Passwords
	 affected are those that contain characters that cannot be
	 represented with 7-bit ASCII. If a password contains a character
	 that has the most significant bit set (0x80), and DES encryption
	 is used, that character and all characters after it will be ignored.
	</blockquote>
 </body>
 </description>
 <references>
	 <cvename>CVE-2012-2143</cvename>
	 <url>http://www.postgresql.org/about/news/1397/</url>
	 <url>http://git.postgresql.org/gitweb/?p=postgresql.git;a=patch;h=932ded2ed51e8333852e370c7a6dad75d9f236f9</url>
 </references>
 <dates>
 <discovery>2012-05-30</discovery>
 <entry>2012-05-30</entry>
 <modified>2012-05-31</modified>
 </dates>
 </vuln>

<vuln vid="47f13540-c4cb-4971-8dc6-28d0dabfd9cd">
 <topic>nut -- upsd can be remotely crashed</topic>
 <affects>
 <package>
	<name>nut</name>
	<range><ge>2.4.0</ge><le>2.6.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Networkupstools project reports:
	<blockquote cite="http://trac.networkupstools.org/projects/nut/changeset/3633">
	 NUT server (upsd), from versions 2.4.0 to 2.6.3, are exposed to
	 crashes when receiving random data from the network.
	 This issue is related to the way NUT parses characters, especially
	 from the network. Non printable characters were missed from strings
	 operation (such as strlen), but still copied to the buffer, causing
	 an overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2944</cvename>
 <url>http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1027934.html</url>
 <url>http://trac.networkupstools.org/projects/nut/changeset/3633</url>
 </references>
 <dates>
 <discovery>2012-05-30</discovery>
 <entry>2012-05-30</entry>
 </dates>
 </vuln>

<vuln vid="359f615d-a9e1-11e1-8a66-14dae9ebcf89">
 <topic>asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk16</name>
	<range><gt>1.6.*</gt><le>1.6.2.24</le></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.12.1</lt></range>
 </package>
 <package>
	<name>asterisk10</name>
	<range><gt>10.*</gt><lt>10.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/security">
	 Remote crash vulnerability in IAX2 channel driver.
	 Skinny Channel Driver Remote Crash Vulnerability
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2947</cvename>
 <url>http://downloads.digium.com/pub/security/AST-2012-007.html</url>
 <cvename>CVE-2012-2948</cvename>
 <url>http://downloads.digium.com/pub/security/AST-2012-008.html</url>
 <url>https://www.asterisk.org/security</url>
 </references>
 <dates>
 <discovery>2012-05-29</discovery>
 <entry>2012-05-29</entry>
 <modified>2012-05-29</modified>
 </dates>
 </vuln>

<vuln vid="617959ce-a5f6-11e1-a284-0023ae8e59f0">
 <topic>haproxy -- buffer overflow</topic>
 <affects>
 <package>
	<name>haproxy</name>
	<range><lt>1.4.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	HAProxy reports:
	<blockquote cite="http://haproxy.1wt.eu/news.html">
	 A flaw was reported in HAProxy where, due to a boundary error
	 when copying data into the trash buffer, an external attacker could
	 cause a buffer overflow. Exploiting this flaw could lead to the
	 execution of arbitrary code, however it requires non-default settings
	 for the global.tune.bufsize configuration option (must be set to a
	 value greater than the default), and also that header rewriting is
	 enabled (via, for example, the regrep or rsprep directives).
	 This flaw is reported against 1.4.20, prior versions may also be
	 affected.
	</blockquote>
 </body>
 </description>
 <references>
	 <cvename>CVE-2012-2391</cvename>
	 <url>https://secunia.com/advisories/49261/</url>
	 <url>http://haproxy.1wt.eu/download/1.4/src/CHANGELOG</url>
	 <url>http://haproxy.1wt.eu/git?p=haproxy-1.4.git;a=commit;h=30297cb17147a8d339eb160226bcc08c91d9530b</url>
	 <url>http://haproxy.1wt.eu/news.html</url>
 </references>
 <dates>
 <discovery>2012-05-21</discovery>
 <entry>2012-05-24</entry>
 <modified>2012-05-29</modified>
 </dates>
 </vuln>

<vuln vid="e0a969e4-a512-11e1-90b4-e0cb4e266481">
 <topic>RT -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>rt40</name>
	<range><ge>4.0</ge><lt>4.0.6</lt></range>
 </package>
 <package>
	<name>rt38</name>
	<range><lt>3.8.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	BestPractical report:
	<blockquote cite="http://blog.bestpractical.com/2012/05/security-vulnerabilities-in-rt.html">
	 Internal audits of the RT codebase have uncovered a
	 number of security vulnerabilities in RT. We are releasing
	 versions 3.8.12 and 4.0.6 to resolve these vulnerabilities,
	 as well as patches which apply atop all released versions of
	 3.8 and 4.0.
	 The vulnerabilities addressed by 3.8.12, 4.0.6, and the
	 below patches include the following:
	 The previously released tool to upgrade weak password
	 hashes as part of CVE-2011-0009 was an incomplete fix and
	 failed to upgrade passwords of disabled users.
	 RT versions 3.0 and above contain a number of cross-site
	 scripting (XSS) vulnerabilities which allow an attacker to
	 run JavaScript with the user's credentials. CVE-2011-2083 is
	 assigned to this vulnerability.
	 RT versions 3.0 and above are vulnerable to multiple
	 information disclosure vulnerabilities. This includes the
	 ability for privileged users to expose users' previous
	 password hashes -- this vulnerability is particularly
	 dangerous given RT's weak hashing previous to the fix in
	 CVE-2011-0009. A separate vulnerability allows privileged
	 users to obtain correspondence history for any ticket in
	 RT. CVE-2011-2084 is assigned to this vulnerability.
	 All publicly released versions of RT are vulnerable to
	 cross-site request forgery (CSRF). CVE-2011-2085 is assigned
	 to this vulnerability.
	 We have also added a separate configuration option
	 ($RestrictLoginReferrer) to prevent login CSRF, a different
	 class of CSRF attack.
	 RT versions 3.6.1 and above are vulnerable to a remote
	 execution of code vulnerability if the optional VERP
	 configuration options ($VERPPrefix and $VERPDomain) are
	 enabled. RT 3.8.0 and higher are vulnerable to a limited
	 remote execution of code which can be leveraged for
	 privilege escalation. RT 4.0.0 and above contain a
	 vulnerability in the global $DisallowExecuteCode option,
	 allowing sufficiently privileged users to still execute code
	 even if RT was configured to not allow it. CVE-2011-4458 is
	 assigned to this set of vulnerabilities.
	 RT versions 3.0 and above may, under some circumstances,
	 still respect rights that a user only has by way of a
	 currently-disabled group. CVE-2011-4459 is assigned to this
	 vulnerability.
	 RT versions 2.0 and above are vulnerable to a SQL
	 injection attack, which allow privileged users to obtain
	 arbitrary information from the database. CVE-2011-4460 is
	 assigned to this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0009</cvename>
 <cvename>CVE-2011-2082</cvename>
 <cvename>CVE-2011-2083</cvename>
 <cvename>CVE-2011-2084</cvename>
 <cvename>CVE-2011-2085</cvename>
 <cvename>CVE-2011-4458</cvename>
 <cvename>CVE-2011-4459</cvename>
 <cvename>CVE-2011-4460</cvename>
 <url>http://blog.bestpractical.com/2012/05/security-vulnerabilities-in-rt.html</url>
 </references>
 <dates>
 <discovery>2012-05-22</discovery>
 <entry>2012-05-23</entry>
 </dates>
 </vuln>

<vuln vid="78c39232-a345-11e1-9d81-d0df9acfd7e5">
 <topic>sympa -- Multiple Security Bypass Vulnerabilities</topic>
 <affects>
 <package>
	<name>sympa</name>
	<range><lt>6.1.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia team reports:
	<blockquote cite="http://secunia.com/advisories/49045/">
	 Multiple vulnerabilities have been reported in Sympa, which can be
	 exploited by malicious people to bypass certain security
	 restrictions.
	 The vulnerabilities are caused due to the application allowing
	 access to archive functions without checking credentials. This can
	 be exploited to create, download, and delete an archive.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2352</cvename>
 <url>http://secunia.com/advisories/49045/</url>
 </references>
 <dates>
 <discovery>2012-05-14</discovery>
 <entry>2012-05-21</entry>
 </dates>
 </vuln>

<vuln vid="495b46fd-a30f-11e1-82c9-d0df9acfd7e5">
 <topic>foswiki -- Script Insertion Vulnerability via unchecked user registration fields</topic>
 <affects>
 <package>
	<name>foswiki</name>
	<range><lt>1.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Foswiki team reports:
	<blockquote cite="http://foswiki.org/Support/SecurityAlert-CVE-2012-1004">
	 When a new user registers, the new user can add arbitrary HTML and
	 script code into the user topic which is generated by the
	 RegistrationAgent via standard registration fields such as
	 "FirstName" or "OrganisationName".
	 By design, Foswiki's normal editing features allow arbitrary HTML
	 markup, including script code, to be inserted into any topic anyway,
	 assuming the authenticated user has CHANGE permission - which is the
	 case on many Foswiki sites. However, the assumption that only
	 authenticated users with CHANGE permission may create script content
	 is false if new users exploit the vulnerability detailed in this
	 alert to manipulate the registration agent into creating that
	 content for them.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-1004</cvename>
 <url>http://foswiki.org/Support/SecurityAlert-CVE-2012-1004</url>
 </references>
 <dates>
 <discovery>2012-04-13</discovery>
 <entry>2012-05-21</entry>
 </dates>
 </vuln>

<vuln vid="b8ae4659-a0da-11e1-a294-bcaec565249c">
 <topic>libxml2 -- An off-by-one out-of-bounds write by XPointer</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.7.8_3</lt></range>
 </package>
 <package>
	<name>linux-f10-libxml2</name>
	<range><lt>2.7.8_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google chrome team reports:
	<blockquote cite="http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html">
	 An off-by-one out-of-bounds write flaw was found in the way libxml, a library
	 for providing XML and HTML support, evaluated certain XPointer parts (XPointer
	 is used by libxml to include only the part from the returned XML document, that
	 can be accessed using the XPath expression given with the XPointer). A remote
	 attacker could provide a specially-crafted XML file, which once opened in an
	 application, linked against libxml, would lead to that application crash, or,
	 potentially arbitrary code execution with the privileges of the user running
	 the application.
	 Note: The flaw to be exploited requires the particular application, linked
	 against libxml, to use the XPointer evaluation functionality.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3202</cvename>
 <url>http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3102</url>
 </references>
 <dates>
 <discovery>2012-05-15</discovery>
 <entry>2012-05-18</entry>
 <modified>2014-04-30</modified>
 </dates>
 </vuln>

<vuln vid="f5f00804-a03b-11e1-a284-0023ae8e59f0">
 <topic>inspircd -- buffer overflow</topic>
 <affects>
 <package>
	<name>inspircd</name>
	<range><ge>1.2</ge><lt>1.2.9</lt></range>
	<range><ge>2.0</ge><lt>2.0.5_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	InspIRCd reports:
	<blockquote cite="http://inspircd.github.com/">
	 InspIRCd contains a heap corruption vulnerability that exists in the
	 dns.cpp code. The res[] buffer is allocated on the heap and can be
	 overflowed. The res[] buffer can be exploited during its deallocation.
	 The number of overflowed bytes can be controlled with DNS compression
	 features.
	</blockquote>
 </body>
 </description>
 <references>
	 <cvename>CVE-2012-1836</cvename>
	 <url>http://inspircd.github.com/</url>
 </references>
 <dates>
 <discovery>2012-03-19</discovery>
 <entry>2012-05-17</entry>
 <modified>2012-06-21</modified>
 </dates>
 </vuln>

<vuln vid="aa71daaa-9f8c-11e1-bd0a-0082a0c18826">
 <topic>pidgin-otr -- format string vulnerability</topic>
 <affects>
 <package>
	<name>pidgin-otr</name>
	<range><lt>3.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The authors report:
	<blockquote cite="http://www.cypherpunks.ca/otr/">
	 Versions 3.2.0 and earlier of the pidgin-otr plugin contain
	 a format string security flaw. This flaw could potentially be
	 exploited by a remote attacker to cause arbitrary code to be
	 executed on the user's machine.
	 The flaw is in pidgin-otr, not in libotr. Other applications
	 that use libotr are not affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2369</cvename>
 <url>http://www.cypherpunks.ca/otr/</url>
 </references>
 <dates>
 <discovery>2012-05-16</discovery>
 <entry>2012-05-16</entry>
 </dates>
 </vuln>

<vuln vid="b3435b68-9ee8-11e1-997c-002354ed89bc">
 <topic>sudo -- netmask vulnerability</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><le>1.8.4_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Todd Miller reports:
	<blockquote cite="http://www.sudo.ws/sudo/alerts/netmask.html">
	 Sudo supports granting access to commands on a per-host basis.
	 The host specification may be in the form of a host name, a
	 netgroup, an IP address, or an IP network (an IP address with an
	 associated netmask).
	 When IPv6 support was added to sudo, a bug was introduced that
	 caused the IPv6 network matching code to be called when an IPv4
	 network address does not match. Depending on the value of the
	 uninitialized portion of the IPv6 address, it is possible for the
	 IPv4 network number to match when it should not. This bug only
	 affects IP network matching and does not affect simple IP address
	 matching.
	 The reported configuration that exhibited the bug was an
	 LDAP-based sudo installation where the sudoRole object contained
	 multiple sudoHost entries, each containing a different IPv4
	 network. File-based sudoers should be affected as well as the
	 same matching code is used.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2337</cvename>
 <url>http://www.sudo.ws/sudo/alerts/netmask.html</url>
 </references>
 <dates>
 <discovery>2012-05-16</discovery>
 <entry>2012-05-16</entry>
 </dates>
 </vuln>

<vuln vid="dba5d1c9-9f29-11e1-b511-003067c2616f">
 <topic>OpenSSL -- DTLS and TLS 1.1, 1.2 denial of service</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL security team reports:
	<blockquote cite="http://www.openssl.org/news/secadv_20120510.txt">
	 A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1, 1.2 and
	 DTLS can be exploited in a denial of service attack on both clients and
	 servers.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2333</cvename>
 <url>http://www.openssl.org/news/secadv_20120510.txt</url>
 </references>
 <dates>
 <discovery>2012-05-10</discovery>
 <entry>2012-05-10</entry>
 </dates>
 </vuln>

<vuln vid="6601127c-9e09-11e1-b5e0-000c299b62e1">
 <topic>socat -- Heap-based buffer overflow</topic>
 <affects>
 <package>
	<name>socat</name>
	<range><lt>1.7.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The socat development team reports:
	<blockquote cite="http://www.dest-unreach.org/socat/contrib/socat-secadv3.html">
	 This vulnerability can be exploited when socat is invoked with the
	 READLINE address (this is usually only used interactively) without
	 option "prompt" and without option "noprompt" and an attacker succeeds
	 to provide malicious data to the other (arbitrary) address that is then
	 transferred by socat to the READLINE address for output.
	 Successful exploitation may allow an attacker to execute arbitrary
	 code with the privileges of the socat process.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0219</cvename>
 <url>www.dest-unreach.org/socat/contrib/socat-secadv3.html</url>
 </references>
 <dates>
 <discovery>2012-05-14</discovery>
 <entry>2012-05-14</entry>
 </dates>
 </vuln>

<vuln vid="59b68b1e-9c78-11e1-b5e0-000c299b62e1">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><gt>5.4</gt><lt>5.4.3</lt></range>
	<range><lt>5.3.13</lt></range>
 </package>
 <package>
	<name>php53</name>
	<range><lt>5.3.13</lt></range>
 </package>
 <package>
	<name>php52</name>
	<range><lt>5.2.17_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP Development Team reports:
	<blockquote cite="http://www.php.net/archive/2012.php#id2012-05-08-1">
	 The release of PHP 5.4.13 and 5.4.3 complete a fix for the
	 vulnerability in CGI-based setups as originally described in
	 CVE-2012-1823. (CVE-2012-2311)
	 Note: mod_php and php-fpm are not vulnerable to this attack.
	 PHP 5.4.3 fixes a buffer overflow vulnerability in the
	 apache_request_headers() (CVE-2012-2329).
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-1823</cvename>
	<cvename>CVE-2012-2311</cvename>
	<cvename>CVE-2012-2329</cvename>
 </references>
 <dates>
 <discovery>2012-05-08</discovery>
 <entry>2012-05-12</entry>
 </dates>
 </vuln>

<vuln vid="64f8b72d-9c4e-11e1-9c94-000bcdf0a03b">
 <topic>libpurple -- Invalid memory dereference in the XMPP protocol plug-in by processing serie of specially-crafted file transfer requests</topic>
 <affects>
 <package>
	<name>libpurple</name>
	<range><lt>2.10.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pidgin reports:
	<blockquote cite="http://pidgin.im/news/security/?id=62">
	 A series of specially crafted file transfer requests can cause clients to reference invalid memory. The user must have accepted one of the file transfer requests.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2214</cvename>
 </references>
 <dates>
 <discovery>2012-05-06</discovery>
 <entry>2012-05-12</entry>
 </dates>
 </vuln>

<vuln vid="0d3547ab-9b69-11e1-bdb1-525401003090">
 <topic>PivotX -- 'ajaxhelper.php' Cross Site Scripting Vulnerability</topic>
 <affects>
 <package>
	<name>pivotx</name>
	<range><le>2.3.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	High-Tech Bridge reports:
	<blockquote cite="https://www.htbridge.com/advisory/HTB23087">
	 Input passed via the "file" GET parameter to
	 /pivotx/ajaxhelper.php is not properly sanitised before
	 being returned to the user. This can be exploited to
	 execute arbitrary HTML and script code in administrator's
	 browser session in context of the affected website.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>52159</bid>
 <cvename>CVE-2012-2274</cvename>
 <url>https://www.htbridge.com/advisory/HTB23087</url>
 </references>
 <dates>
 <discovery>2012-05-09</discovery>
 <entry>2012-05-12</entry>
 <modified>2012-05-14</modified>
 </dates>
 </vuln>

<vuln vid="b91234e7-9a8b-11e1-b666-001636d274f3">
 <topic>NVIDIA UNIX driver -- access to arbitrary system memory</topic>
 <affects>
 <package>
	<name>nvidia-driver</name>
	<range><gt>173.14.35_2</gt><lt>295.71</lt></range>
	<range><gt>96.43.20_3</gt><lt>173.14.35</lt></range>
	<range><gt>71.86.15_3</gt><lt>96.43.20_2</lt></range>
	<range><lt>71.86.15_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NVIDIA Unix security team reports:
	<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3109">
	 Security vulnerability CVE-2012-0946 in the NVIDIA UNIX driver
	 was disclosed to NVIDIA on March 20th, 2012. The vulnerability
	 makes it possible for an attacker who has read and write access
	 to the GPU device nodes to reconfigure GPUs to gain access to
	 arbitrary system memory. NVIDIA is not aware of any reports of
	 this vulnerability, outside of the disclosure which was made
	 privately to NVIDIA.
	 NVIDIA has identified the root cause of the vulnerability and
	 has released updated drivers which close it. [NVIDIA encourages]
	 all users with Geforce 8 or newer, G80 Quadro or newer, and all
	 Tesla GPUs to update their drivers to 295.40 or later.
	</blockquote>
	Later, it was additionally discovered that similar exploit could
	 be achieved through remapping of VGA window:
	<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3140">
	 NVIDIA received notification of a security exploit that uses
	 NVIDIA UNIX device files to map and program registers to redirect
	 the VGA window. Through the VGA window, the exploit can access
	 any region of physical system memory. This arbitrary memory
	 access can be further exploited, for example, to escalate user
	 privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0946</cvename>
 <cvename>CVE-2012-4225</cvename>
 </references>
 <dates>
 <discovery>2012-03-20</discovery>
 <entry>2012-05-10</entry>
 <modified>2012-09-12</modified>
 </dates>
 </vuln>

<vuln vid="3d55b961-9a2e-11e1-a2ef-001fd0af1a4c">
 <topic>rubygem-mail -- multiple vulnerabilities</topic>
 <affects>
	<package>
	 <name>rubygem-mail</name>
	 <range><lt>2.4.4</lt></range>
	</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	 rubygem-mail -- multiple vulnerabilities
	 <blockquote cite="http://seclists.org/oss-sec/2012/q2/190">
	 Two issues were fixed. They are a file system traversal in file_delivery method and arbitrary command execution when using exim or sendmail from the command line.
	 </blockquote>
	</body>
 </description>
 <references>
	<cvename>CVE-2012-2139</cvename>
	<cvename>CVE-2012-2140</cvename>
	<url>http://seclists.org/oss-sec/2012/q2/190</url>
 </references>
 <dates>
	<discovery>2012-03-14</discovery>
	<entry>2012-05-09</entry>
 </dates>
 </vuln>

<vuln vid="a1d0911f-987a-11e1-a2ef-001fd0af1a4c">
 <topic>node -- private information disclosure</topic>
 <affects>
	<package>
	 <name>node</name>
	 <name>node-devel</name>
	 <range><lt>0.6.17</lt></range>
	</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	 Private information disclosure
	 <blockquote cite="http://blog.nodejs.org/2012/05/07/http-server-security-vulnerability-please-upgrade-to-0-6-17/">
	 An attacker can cause private information disclosure.
	 </blockquote>
	</body>
 </description>
 <references>
	<url>http://blog.nodejs.org/2012/05/07/http-server-security-vulnerability-please-upgrade-to-0-6-17/</url>
 </references>
 <dates>
	<discovery>2012-04-17</discovery>
	<entry>2012-05-07</entry>
 </dates>
 </vuln>

<vuln vid="725ab25a-987b-11e1-a2ef-001fd0af1a4c">
 <topic>p5-Config-IniFiles -- unsafe temporary file creation</topic>
 <affects>
	<package>
	 <name>p5-Config-IniFiles</name>
	 <range><lt>2.71</lt></range>
	</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	 Unsafe Temporary file creation
	 <blockquote cite="https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59">
 Config::IniFiles used a predictable name for its temporary
		 file without opening it correctly.
	 </blockquote>
	</body>
 </description>
 <references>
	<cvename>CVE-2012-2451</cvename>
	<url>https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59</url>
 </references>
 <dates>
	<discovery>2012-05-02</discovery>
	<entry>2012-05-07</entry>
 </dates>
 </vuln>

<vuln vid="60de13d5-95f0-11e1-806a-001143cd36d8">
 <topic>php -- vulnerability in certain CGI-based setups</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><gt>5.4</gt><lt>5.4.2</lt></range>
	<range><lt>5.3.12</lt></range>
 </package>
 <package>
	<name>php53</name>
	<range><lt>5.3.12</lt></range>
 </package>
 <package>
	<name>php4</name>
	<range><lt>4.4.10</lt></range>
 </package>
 <package>
	<name>php52</name>
	<range><lt>5.2.17_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	php development team reports:
	<blockquote cite="http://www.php.net/archive/2012.php#id2012-05-03-1">
	 Security Enhancements and Fixes in PHP 5.3.12:
	 <ul>
	 <li>Initial fix for cgi-bin ?-s cmdarg parse issue
	 (CVE-2012-1823)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-1823</cvename>
 </references>
 <dates>
 <discovery>2012-05-03</discovery>
 <entry>2012-05-05</entry>
 </dates>
 </vuln>

<vuln vid="18dffa02-946a-11e1-be9d-000c29cc39d3">
 <topic>WebCalendar -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>WebCalendar-devel</name>
	<range><le>1.2.4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hanno Boeck reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2012/04/28/1">
	 Fixes [are now available] for various security vulnerabilities
	 including LFI (local file inclusion), XSS (cross site scripting)
	 and others.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-1495</cvename>
 <cvename>CVE-2012-1496</cvename>
 <url>http://packetstormsecurity.org/files/112332/WebCalendar-1.2.4-Remote-Code-Execution.html</url>
 <url>http://packetstormsecurity.org/files/112323/WebCalendar-1.2.4-Pre-Auth-Remote-Code-Injection.html</url>
 <url>http://archives.neohapsis.com/archives/bugtraq/2012-04/0182.html</url>
 </references>
 <dates>
 <discovery>2012-04-28</discovery>
 <entry>2012-05-02</entry>
 </dates>
 </vuln>

<vuln vid="2cde1892-913e-11e1-b44c-001fd0af1a4c">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
	<package>
	 <name>php53</name>
	 <range><lt>5.3.11</lt></range>
	</package>
	<package>
	 <name>php5</name>
	 <range><lt>5.3.11</lt></range>
	</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	 php development team reports:
	 <blockquote cite="http://www.php.net/archive/2012.php#id2012-04-26-1">
	 Security Enhancements for both PHP 5.3.11 and PHP 5.4.1:
	 <ul>
	 <li>Insufficient validating of upload name leading to corrupted $_FILES indices. (CVE-2012-1172) </li>
	 <li>Add open_basedir checks to readline_write_history and readline_read_history.</li>
	 </ul>
	 Security Enhancements for both PHP 5.3.11 only:
	 <ul>
	 <li>Regression in magic_quotes_gpc fix for CVE-2012-0831.</li>
	 </ul>
	 </blockquote>
	</body>
 </description>
 <references>
	<cvename>CVE-2012-0831</cvename>
	<cvename>CVE-2012-1172</cvename>
	<url>http://www.php.net/archive/2012.php#id2012-04-26-1</url>
 </references>
 <dates>
	<discovery>2012-03-01</discovery>
	<entry>2012-04-28</entry>
	<modified>2012-05-04</modified>
 </dates>
 </vuln>

<vuln vid="0fa15e08-92ec-11e1-a94a-00215c6a37bb">
 <topic>samba -- incorrect permission checks vulnerability</topic>
 <affects>
 <package>
	<name>samba34</name>
	<range><gt>3.4.*</gt><lt>3.4.17</lt></range>
 </package>
 <package>
	<name>samba35</name>
	<range><gt>3.5.*</gt><lt>3.5.15</lt></range>
 </package>
 <package>
	<name>samba36</name>
	<range><gt>3.6.*</gt><lt>3.6.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba project reports:
	<blockquote cite="http://www.samba.org/samba/security/CVE-2012-2111">
	 Samba versions 3.4.x to 3.6.4 inclusive are affected
	 by a vulnerability that allows arbitrary users to modify
	 privileges on a file server.
	 Security checks were incorrectly applied to the Local
	 Security Authority (LSA) remote proceedure calls (RPC)
	 CreateAccount, OpenAccount, AddAccountRights and
	 RemoveAccountRights allowing any authenticated user
	 to modify the privileges database.
	 This is a serious error, as it means that authenticated
	 users can connect to the LSA and grant themselves the
	 "take ownership" privilege. This privilege is used by the
	 smbd file server to grant the ability to change ownership
	 of a file or directory which means users could take ownership
	 of files or directories they do not own.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2111</cvename>
 </references>
 <dates>
 <discovery>2012-04-30</discovery>
 <entry>2012-04-30</entry>
 </dates>
 </vuln>

<vuln vid="b428e6b3-926c-11e1-8d7b-003067b2972c">
 <topic>portupgrade-devel -- lack of distfile checksums</topic>
 <affects>
 <package>
	<name>portupgrade-devel</name>
	<range><lt>0,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ports security team reports:
	The portupgrade-devel port fetched directly from a git
	 respository without checking against a known good
	 SHA hash. This means that it is possible that packages
	 built using this port may not match the one vetted
	 by the maintainer. Users are advised to rebuild
	 portupgrade-devel from known good sources.
 </body>
 </description>
 <references>
 <mlist>http://web.archiveorange.com/archive/v/6ETvLYPz7CfFT9tiHKiI</mlist>
 <mlist>http://www.freebsd.org/cgi/getmsg.cgi?fetch=100677+0+/usr/local/www/db/text/2012/cvs-ports/20120506.cvs-ports</mlist>
 </references>
 <dates>
 <discovery>2012-04-30</discovery>
 <entry>2012-04-30</entry>
 <modified>2012-05-06</modified>
 </dates>
 </vuln>

<vuln vid="5d85976a-9011-11e1-b5e0-000c299b62e1">
 <topic>net-snmp -- Remote DoS</topic>
 <affects>
 <package>
	<name>net-snmp</name>
	<range><lt>5.7.1_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Red Hat Security Response Team reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=815813">
	 An array index error, leading to out-of heap-based buffer read flaw was
	 found in the way the net-snmp agent performed lookups in the
	 extension table. When certain MIB subtrees were handled by the
	 extend directive, a remote attacker (having read privileges to the
	 subntree) could use this flaw to cause a denial of service condition
	 via an SNMP GET request involving a non-existent extension table
	 entry.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2141</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=815813</url>
 <url>http://www.openwall.com/lists/oss-security/2012/04/26/2</url>
 </references>
 <dates>
 <discovery>2012-04-26</discovery>
 <entry>2012-04-27</entry>
 </dates>
 </vuln>

<vuln vid="380e8c56-8e32-11e1-9580-4061862b8c22">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>11.0,1</gt><lt>12.0,1</lt></range>
	<range><lt>10.0.4,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>10.0.4,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.9</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.4</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.9</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>11.0</gt><lt>12.0</lt></range>
	<range><lt>10.0.4</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>10.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2012-20 Miscellaneous memory safety hazards (rv:12.0/ rv:10.0.4)
	 MFSA 2012-21 Multiple security flaws fixed in FreeType v2.4.9
	 MFSA 2012-22 use-after-free in IDBKeyRange
	 MFSA 2012-23 Invalid frees causes heap corruption in gfxImageSurface
	 MFSA 2012-24 Potential XSS via multibyte content processing errors
	 MFSA 2012-25 Potential memory corruption during font rendering using cairo-dwrite
	 MFSA 2012-26 WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error
	 MFSA 2012-27 Page load short-circuit can lead to XSS
	 MFSA 2012-28 Ambiguous IPv6 in Origin headers may bypass webserver access restrictions
	 MFSA 2012-29 Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues
	 MFSA 2012-30 Crash with WebGL content using textImage2D
	 MFSA 2012-31 Off-by-one error in OpenType Sanitizer
	 MFSA 2012-32 HTTP Redirections and remote content can be read by javascript errors
	 MFSA 2012-33 Potential site identity spoofing when loading RSS and Atom feeds
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2011-1187</cvename>
	<cvename>CVE-2011-3062</cvename>
	<cvename>CVE-2012-0467</cvename>
	<cvename>CVE-2012-0468</cvename>
	<cvename>CVE-2012-0469</cvename>
	<cvename>CVE-2012-0470</cvename>
	<cvename>CVE-2012-0471</cvename>
	<cvename>CVE-2012-0472</cvename>
	<cvename>CVE-2012-0473</cvename>
	<cvename>CVE-2012-0474</cvename>
	<cvename>CVE-2012-0475</cvename>
	<cvename>CVE-2012-0477</cvename>
	<cvename>CVE-2012-0478</cvename>
	<cvename>CVE-2012-0479</cvename>
	<cvename>CVE-2012-1126</cvename>
	<cvename>CVE-2012-1127</cvename>
	<cvename>CVE-2012-1128</cvename>
	<cvename>CVE-2012-1129</cvename>
	<cvename>CVE-2012-1130</cvename>
	<cvename>CVE-2012-1131</cvename>
	<cvename>CVE-2012-1132</cvename>
	<cvename>CVE-2012-1133</cvename>
	<cvename>CVE-2012-1134</cvename>
	<cvename>CVE-2012-1135</cvename>
	<cvename>CVE-2012-1136</cvename>
	<cvename>CVE-2012-1137</cvename>
	<cvename>CVE-2012-1138</cvename>
	<cvename>CVE-2012-1139</cvename>
	<cvename>CVE-2012-1140</cvename>
	<cvename>CVE-2012-1141</cvename>
	<cvename>CVE-2012-1142</cvename>
	<cvename>CVE-2012-1143</cvename>
	<cvename>CVE-2012-1144</cvename>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-20.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-21.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-22.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-23.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-24.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-25.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-26.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-27.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-28.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-29.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-30.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-31.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-32.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-33.html</url>
 </references>
 <dates>
 <discovery>2012-04-24</discovery>
 <entry>2012-04-24</entry>
 </dates>
 </vuln>

<vuln vid="a04247f1-8d9c-11e1-93c7-00215c6a37bb">
 <topic>Dokuwiki -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>dokuwiki</name>
	<range><lt>20120125_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Andy Webber reports:
	<blockquote cite="http://bugs.dokuwiki.org/index.php?do=details&amp;task_id=2487">
	 Add User appears to be vulnerable to Cross Site Request Forgery (CSRF/XSRF).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2128</cvename>
 <cvename>CVE-2012-2129</cvename>
 </references>
 <dates>
 <discovery>2012-04-17</discovery>
 <entry>2012-04-23</entry>
 </dates>
 </vuln>

<vuln vid="1c5abbe2-8d7f-11e1-a374-14dae9ebcf89">
 <topic>asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk16</name>
	<range><gt>1.6.*</gt><lt>1.6.2.24</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.11.1</lt></range>
 </package>
 <package>
	<name>asterisk10</name>
	<range><gt>10.*</gt><lt>10.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/security">
	 Remote Crash Vulnerability in SIP Channel Driver
	 Heap Buffer Overflow in Skinny Channel Driver
	 Asterisk Manager User Unauthorized Shell Access
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.digium.com/pub/security/AST-2012-004.html</url>
 <cvename>CVE-2012-2414</cvename>
 <url>http://downloads.digium.com/pub/security/AST-2012-005.html</url>
 <cvename>CVE-2012-2415</cvename>
 <url>http://downloads.digium.com/pub/security/AST-2012-006.html</url>
 <cvename>CVE-2012-2416</cvename>
 </references>
 <dates>
 <discovery>2012-04-23</discovery>
 <entry>2012-04-23</entry>
 </dates>
 </vuln>

<vuln vid="b384cc5b-8d56-11e1-8d7b-003067b2972c">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>3.3.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wordpress reports:
	<blockquote cite="https://codex.wordpress.org/Version_3.3.2">
	 External code has been updated to
	 non-vulnerable versions.
	 In addition the following bugs have been fixed:
	 <ul>
	 <li>Limited privilege escalation where a site administrator could
	 deactivate network-wide plugins when running a WordPress network under
	 particular circumstances.</li>
	 <li>Cross-site scripting vulnerability when making URLs
	 clickable.</li>
	 <li>Cross-site scripting vulnerabilities in redirects after posting
	 comments in older browsers, and when filtering URLs.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2399</cvename>
 <cvename>CVE-2012-2400</cvename>
 <cvename>CVE-2012-2401</cvename>
 <cvename>CVE-2012-2402</cvename>
 <cvename>CVE-2012-2403</cvename>
 <cvename>CVE-2012-2404</cvename>
 <url>https://codex.wordpress.org/Version_3.3.2</url>
 </references>
 <dates>
 <discovery>2012-04-20</discovery>
 <entry>2012-04-23</entry>
 </dates>
 </vuln>

<vuln vid="7184f92e-8bb8-11e1-8d7b-003067b2972c">
 <topic>OpenSSL -- integer conversions result in memory corruption</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL security team reports:
	<blockquote cite="http://www.openssl.org/news/secadv_20120419.txt">
	 A potentially exploitable vulnerability has been discovered in the OpenSSL
	 function asn1_d2i_read_bio.
	 Any application which uses BIO or FILE based functions to read untrusted DER
	 format data is vulnerable. Affected functions are of the form d2i_*_bio or
	 d2i_*_fp, for example d2i_X509_bio or d2i_PKCS12_fp.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2110</cvename>
 <mlist msgid="20120419103522.GN30784@cmpxchg8b.com">http://marc.info/?l=full-disclosure&amp;m=133483221408243</mlist>
 <url>http://www.openssl.org/news/secadv_20120419.txt</url>
 </references>
 <dates>
 <discovery>2012-04-19</discovery>
 <entry>2012-04-21</entry>
 </dates>
 </vuln>

<vuln vid="09c87973-8b9d-11e1-b393-20cf30e32f6d">
 <topic>bugzilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><ge>3.6.0</ge><lt>3.6.9</lt></range>
	<range><ge>4.0.0</ge><lt>4.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>A Bugzilla Security Advisory reports:</h1>
	<blockquote cite="http://www.bugzilla.org/security/3.6.8/">
	 The following security issues have been discovered in
	 Bugzilla:
	 <h1>Unauthorized Access</h1>
	 Due to a lack of proper validation of the X-FORWARDED-FOR
	 header of an authentication request, an attacker could bypass
	 the current lockout policy used for protection against brute-
	 force password discovery. This vulnerability can only be
	 exploited if the 'inbound_proxies' parameter is set.
	 <h1>Cross Site Scripting</h1>
	 A JavaScript template used by buglist.cgi could be used
	 by a malicious script to permit an attacker to gain access
	 to some information about bugs he would not normally be
	 allowed to see, using the victim's credentials. To be
	 exploitable, the victim must be logged in when visiting
	 the attacker's malicious page.
	 All affected installations are encouraged to upgrade as soon
	 as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0465</cvename>
 <cvename>CVE-2012-0466</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=728639</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=745397</url>
 </references>
 <dates>
 <discovery>2012-04-18</discovery>
 <entry>2012-04-21</entry>
 </dates>
 </vuln>

<vuln vid="67516177-88ec-11e1-9a10-0023ae8e59f0">
 <topic>typo -- Cross-Site Scripting</topic>
 <affects>
 <package>
	<name>typo3</name>
	<range><ge>4.6.0</ge><le>4.6.7</le></range>
	<range><ge>4.5.0</ge><le>4.5.14</le></range>
	<range><ge>4.4.0</ge><le>4.4.14</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Typo Security Team reports:
	<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002/">
	 Failing to properly encode the output, the default TYPO3
	 Exception Handler is susceptible to Cross-Site Scripting. We
	 are not aware of a possibility to exploit this vulnerability
	 without third party extensions being installed that put user
	 input in exception messages. However, it has come to our
	 attention that extensions using the extbase MVC framework can
	 be used to exploit this vulnerability if these extensions
	 accept objects in controller actions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2112</cvename>
	<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002/</url>
 </references>
 <dates>
 <discovery>2012-04-17</discovery>
 <entry>2012-04-18</entry>
 </dates>
 </vuln>

<vuln vid="0c14dfa7-879e-11e1-a2a0-00500802d8f7">
 <topic>nginx -- Buffer overflow in the ngx_http_mp4_module</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><lt>1.0.15</lt></range>
 </package>
 <package>
	<name>nginx-devel</name>
	<range><lt>1.1.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The nginx project reports:
	<blockquote cite="http://nginx.org/en/security_advisories.html">
	 Buffer overflow in the ngx_http_mp4_module
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-2089</cvename>
 <url>http://nginx.org/en/security_advisories.html</url>
 </references>
 <dates>
 <discovery>2012-04-12</discovery>
 <entry>2012-04-16</entry>
 </dates>
 </vuln>

<vuln vid="c80a3d93-8632-11e1-a374-14dae9ebcf89">
 <topic>phpmyfaq -- Remote PHP Code Execution Vulnerability</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><lt>2.7.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyFAQ project reports:
	<blockquote cite="http://www.phpmyfaq.de/advisory_2011-10-25.php">
	 The bundled ImageManager library allows injection of arbitrary
	 PHP code to execute arbitrary PHP code and upload malware and
	 trojan horses.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyfaq.de/advisory_2012-04-14.php</url>
 </references>
 <dates>
 <discovery>2012-04-14</discovery>
 <entry>2012-04-14</entry>
 </dates>
 </vuln>

<vuln vid="607d2108-a0e4-423a-bf78-846f2a8f01b0">
 <topic>puppet -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>puppet</name>
	<range><gt>2.7.*</gt><lt>2.7.12_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://puppetlabs.com/security/">
	 Multiple vulnerabilities exist in puppet that can result in
	 arbitrary code execution, arbitrary file read access, denial of
	 service, and arbitrary file write access. Please review the
	 details in each of the CVEs for additional information.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-1906</cvename>
 <cvename>CVE-2012-1986</cvename>
 <cvename>CVE-2012-1987</cvename>
 <cvename>CVE-2012-1988</cvename>
 <cvename>CVE-2012-1989</cvename>
 <url>http://puppetlabs.com/security/cve/cve-2012-1906/</url>
 <url>http://puppetlabs.com/security/cve/cve-2012-1986/</url>
 <url>http://puppetlabs.com/security/cve/cve-2012-1987/</url>
 <url>http://puppetlabs.com/security/cve/cve-2012-1988/</url>
 <url>http://puppetlabs.com/security/cve/cve-2012-1989/</url>
 </references>
 <dates>
 <discovery>2012-03-26</discovery>
 <entry>2012-04-10</entry>
 </dates>
 </vuln>

<vuln vid="baf37cd2-8351-11e1-894e-00215c6a37bb">
 <topic>samba -- "root" credential remote code execution</topic>
 <affects>
 <package>
	<name>samba34</name>
	<range><gt>3.4.*</gt><lt>3.4.16</lt></range>
 </package>
 <package>
	<name>samba35</name>
	<range><gt>3.5.*</gt><lt>3.5.14</lt></range>
 </package>
 <package>
	<name>samba36</name>
	<range><gt>3.6.*</gt><lt>3.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samba development team reports:
	<blockquote cite="http://www.samba.org/samba/security/CVE-2012-1182">
	 Samba versions 3.6.3 and all versions previous to this
	 are affected by a vulnerability that allows remote code
	 execution as the "root" user from an anonymous connection.
	 As this does not require an authenticated connection it
	 is the most serious vulnerability possible in a program,
	 and users and vendors are encouraged to patch their Samba
	 installations immediately.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-1182</cvename>
 </references>
 <dates>
 <discovery>2012-04-10</discovery>
 <entry>2012-04-10</entry>
 </dates>
 </vuln>

<vuln vid="7f448dc1-82ca-11e1-b393-20cf30e32f6d">
 <topic>bugzilla Cross-Site Request Forgery</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><ge>4.0.0</ge><lt>4.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla Security Advisory reports:
	<blockquote cite="http://www.bugzilla.org/security/4.0.4/">
	 The following security issues have been discovered in
	 Bugzilla:
	 <ul>
	 <li>Due to a lack of validation of the enctype form attribute
	 when making POST requests to xmlrpc.cgi, a possible CSRF
	 vulnerability was discovered. If a user visits an HTML page
	 with some malicious HTML code in it, an attacker could make
	 changes to a remote Bugzilla installation on behalf of the
	 victim's account by using the XML-RPC API on a site running
	 mod_perl. Sites running under mod_cgi are not affected.
	 Also, the user would have had to be already logged in to the
	 target site for the vulnerability to work.</li>
	 </ul>
	 All affected installations are encouraged to upgrade as soon
	 as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0453</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=725663</url>
 </references>
 <dates>
 <discovery>2012-02-22</discovery>
 <entry>2012-04-10</entry>
 </dates>
 </vuln>

<vuln vid="20923a0d-82ba-11e1-8d7b-003067b2972c">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.2r202.228</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-07.html">
	 Multiple Priority 2 vulnerabilities could cause a crash and
	 potentially allow an attacker to take control of the affected
	 system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0724</cvename>
 <cvename>CVE-2012-0725</cvename>
 <cvename>CVE-2012-0772</cvename>
 <cvename>CVE-2012-0773</cvename>
 <url>https://www.adobe.com/support/security/bulletins/apsb12-07.html</url>
 </references>
 <dates>
 <discovery>2012-04-05</discovery>
 <entry>2012-04-10</entry>
 </dates>
 </vuln>

<vuln vid="262b92fe-81c8-11e1-8899-001ec9578670">
 <topic>png -- memory corruption/possible remote code execution</topic>
 <affects>
 <package>
	<name>png</name>
	<name>linux-f10-png</name>
	<range><lt>1.4.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PNG project reports:
	<blockquote cite="http://www.libpng.org/pub/png/libpng.html">
	 libpng fails to correctly handle malloc() failures for text
	 chunks (in png_set_text_2()), which can lead to memory
	 corruption and the possibility of remote code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3048</cvename>
 <url>http://www.libpng.org/pub/png/libpng.html</url>
 </references>
 <dates>
 <discovery>2012-03-29</discovery>
 <entry>2012-04-08</entry>
 </dates>
 </vuln>

<vuln vid="462e2d6c-8017-11e1-a571-bcaec565249c">
 <topic>freetype -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>freetype2</name>
	<range><lt>2.4.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Freetype project reports:
	<blockquote cite="https://sourceforge.net/projects/freetype/files/freetype2/2.4.9/README/view">
	 Multiple vulnerabilities exist in freetype that can result in
	 application crashes and remote code execution. Please review
	 the details in each of the CVEs for additional information.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-1126</cvename>
 <cvename>CVE-2012-1127</cvename>
 <cvename>CVE-2012-1128</cvename>
 <cvename>CVE-2012-1129</cvename>
 <cvename>CVE-2012-1130</cvename>
 <cvename>CVE-2012-1131</cvename>
 <cvename>CVE-2012-1132</cvename>
 <cvename>CVE-2012-1133</cvename>
 <cvename>CVE-2012-1134</cvename>
 <cvename>CVE-2012-1135</cvename>
 <cvename>CVE-2012-1136</cvename>
 <cvename>CVE-2012-1137</cvename>
 <cvename>CVE-2012-1138</cvename>
 <cvename>CVE-2012-1139</cvename>
 <cvename>CVE-2012-1140</cvename>
 <cvename>CVE-2012-1141</cvename>
 <cvename>CVE-2012-1142</cvename>
 <cvename>CVE-2012-1143</cvename>
 <cvename>CVE-2012-1144</cvename>
 <url>https://sourceforge.net/projects/freetype/files/freetype2/2.4.9/README/view</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=806270</url>
 </references>
 <dates>
 <discovery>2012-03-08</discovery>
 <entry>2012-04-06</entry>
 </dates>
 </vuln>

<vuln vid="49314321-7fd4-11e1-9582-001b2134ef46">
 <topic>mutt-devel -- failure to check SMTP TLS server certificate</topic>
 <affects>
 <package>
	<name>mutt-devel</name>
	<range><lt>1.5.21_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dave B reports on Full Disclosure:
	<blockquote cite="http://seclists.org/fulldisclosure/2011/Mar/87">
	 It seems that mutt fails to check the validity of a SMTP
	 servers certificate during a TLS connection. [...]
	 This means that an attacker could potentially MITM a
	 mutt user connecting to their SMTP server even when the
	 user has forced a TLS connection.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1429</cvename>
 <url>http://seclists.org/fulldisclosure/2011/Mar/87</url>
 </references>
 <dates>
 <discovery>2012-03-08</discovery>
 <entry>2012-04-06</entry>
 </dates>
 </vuln>

<vuln vid="7289214f-7c55-11e1-ab3b-000bcdf0a03b">
 <topic>libpurple -- Remote DoS via an MSN OIM message that lacks UTF-8 encoding</topic>
 <affects>
 <package>
	<name>libpurple</name>
	<range><lt>2.10.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US-CERT reports:
	<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1178">
	 The msn_oim_report_to_user function in oim.c in the MSN protocol
	 plugin in libpurple in Pidgin before 2.10.2 allows remote servers
	 to cause a denial of service (application crash) via an OIM message
	 that lacks UTF-8 encoding.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-1178</cvename>
 </references>
 <dates>
 <discovery>2012-03-15</discovery>
 <entry>2012-04-01</entry>
 </dates>
 </vuln>

<vuln vid="a81161d2-790f-11e1-ac16-e0cb4e266481">
 <topic>phpMyAdmin -- Path disclosure due to missing verification of file presence</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><gt>3.4</gt><lt>3.4.10.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php">
	 The show_config_errors.php scripts did not validate the presence
	 of the configuration file, so an error message shows the full path
	 of this file, leading to possible further attacks. For the error
	 messages to be displayed, php.ini's error_reporting must be set to
	 E_ALL and display_errors must be On (these settings are not
	 recommended on a production server in the PHP manual).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-1902</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php</url>
 </references>
 <dates>
 <discovery>2012-03-28</discovery>
 <entry>2012-03-28</entry>
 </dates>
 </vuln>

<vuln vid="60f81af3-7690-11e1-9423-00235a5f2c9a">
 <topic>raptor/raptor2 -- XXE in RDF/XML File Interpretation</topic>
 <affects>
 <package>
	<name>raptor2</name>
	<range><lt>2.0.7</lt></range>
 </package>
 <package>
	<name>raptor</name>
	<range><lt>1.4.21_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Timothy D. Morgan reports:
	<blockquote cite="http://www.vsecurity.com/resources/advisory/20120324-1/">
	 In December 2011, VSR identified a vulnerability in multiple open
	 source office products (including OpenOffice, LibreOffice, KOffice,
	 and AbiWord) due to unsafe interpretation of XML files with custom
	 entity declarations. Deeper analysis revealed that the
	 vulnerability was caused by acceptance of external entities by the
	 libraptor library, which is used by librdf and is in turn used by
	 these office products.
	 In the context of office applications, these vulnerabilities could
	 allow for XML External Entity (XXE) attacks resulting in file theft
	 and a loss of user privacy when opening potentially malicious ODF
	 documents. For other applications which depend on librdf or
	 libraptor, potentially serious consequences could result from
	 accepting RDF/XML content from untrusted sources, though the impact
	 may vary widely depending on the context.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0037</cvename>
 <url>http://seclists.org/fulldisclosure/2012/Mar/281</url>
 <url>http://www.vsecurity.com/resources/advisory/20120324-1/</url>
 </references>
 <dates>
 <discovery>2012-03-24</discovery>
 <entry>2012-03-25</entry>
 </dates>
 </vuln>

<vuln vid="42a2c82a-75b9-11e1-89b4-001ec9578670">
 <topic>quagga -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>quagga</name>
	<range><lt>0.99.20.1</lt></range>
 </package>
 <package>
	<name>quagga-re</name>
	<range><lt>0.99.17.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CERT reports:
	<blockquote cite="http://www.kb.cert.org/vuls/id/551715">
	 The ospfd implementation of OSPF in Quagga allows a remote
	 attacker (on a local network segment with OSPF enabled) to cause
	 a denial of service (daemon aborts due to an assert) with a
	 malformed OSPF LS-Update message.
	 The ospfd implementation of OSPF in Quagga allows a remote
	 attacker (on a local network segment with OSPF enabled) to cause
	 a denial of service (daemon crash) with a malformed OSPF Network-
	 LSA message.
	 The bgpd implementation of BGP in Quagga allows remote attackers
	 to cause a denial of service (daemon aborts due to an assert) via
	 BGP Open message with an invalid AS4 capability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0249</cvename>
 <cvename>CVE-2012-0250</cvename>
 <cvename>CVE-2012-0255</cvename>
 <url>http://www.kb.cert.org/vuls/id/551715</url>
 </references>
 <dates>
 <discovery>2012-03-23</discovery>
 <entry>2012-03-24</entry>
 <modified>2012-03-26</modified>
 </dates>
 </vuln>

<vuln vid="acab2f88-7490-11e1-865f-00e0814cab4e">
 <topic>Apache Traffic Server -- heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>trafficserver</name>
	<range><lt>3.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CERT-FI reports:
	<blockquote cite="https://www.cert.fi/en/reports/2012/vulnerability612884.html">
	 A heap overflow vulnerability has been found in the HTTP
	 (Hypertext Transfer Protocol) protocol handling of Apache
	 Traffic Server. The vulnerability allows an attacker to cause
	 a denial of service or potentially to execute his own code by
	 sending a specially modified HTTP message to an affected
	 server.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0256</cvename>
 </references>
 <dates>
 <discovery>2012-03-22</discovery>
 <entry>2012-03-24</entry>
 </dates>
 </vuln>

<vuln vid="2e7e9072-73a0-11e1-a883-001cc0a36e12">
 <topic>libtasn1 -- ASN.1 length decoding vulnerability</topic>
 <affects>
 <package>
	<name>libtasn1</name>
	<range><lt>2.12</lt></range>
 </package>
 <package>
	<name>gnutls</name>
	<range><lt>2.12.18</lt></range>
 </package>
 <package>
	<name>gnutls-devel</name>
	<range><gt>2.99</gt><lt>3.0.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mu Dynamics, Inc. reports:
	<blockquote cite="http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5959">
	 Various functions using the ASN.1 length decoding logic in
	 Libtasn1 were incorrectly assuming that the return value from
	 asn1_get_length_der is always less than the length of the
	 enclosing ASN.1 structure, which is only true for valid
	 structures and not for intentionally corrupt or otherwise
	 buggy structures.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-1569</cvename>
 </references>
 <dates>
 <discovery>2012-03-20</discovery>
 <entry>2012-03-21</entry>
 <modified>2012-03-24</modified>
 </dates>
 </vuln>

<vuln vid="aecee357-739e-11e1-a883-001cc0a36e12">
 <topic>gnutls -- possible overflow/Denial of service vulnerabilities</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>2.12.18</lt></range>
 </package>
 <package>
	<name>gnutls-devel</name>
	<range><gt>2.99</gt><lt>3.0.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mu Dynamics, Inc. reports:
	<blockquote cite="http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5959">
	 The block cipher decryption logic in GnuTLS assumed that a
	 record containing any data which was a multiple of the block
	 size was valid for further decryption processing, leading to
	 a heap corruption vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-1573</cvename>
 </references>
 <dates>
 <discovery>2012-03-20</discovery>
 <entry>2012-03-21</entry>
 <modified>2012-03-24</modified>
 </dates>
 </vuln>

<vuln vid="0d530174-6eef-11e1-afd6-14dae9ebcf89">
 <topic>asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk14</name>
	<range><gt>1.4.*</gt><lt>1.4.44</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><gt>1.6.*</gt><lt>1.6.2.23</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.10.1</lt></range>
 </package>
 <package>
	<name>asterisk10</name>
	<range><gt>10.*</gt><lt>10.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Asterisk project reports:
	<blockquote cite="https://www.asterisk.org/security">
	 Stack Buffer Overflow in HTTP Manager
	 Remote Crash Vulnerability in Milliwatt Application
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2012-002.html</url>
 <url>http://downloads.asterisk.org/pub/security/AST-2012-003.html</url>
 </references>
 <dates>
 <discovery>2012-03-15</discovery>
 <entry>2012-03-15</entry>
 </dates>
 </vuln>

<vuln vid="60eb344e-6eb1-11e1-8ad7-00e0815b8da8">
 <topic>OpenSSL -- CMS and S/MIME Bleichenbacher attack</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.0_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL Team reports:
	<blockquote cite="http://www.openssl.org/news/secadv_20120312.txt">
	 A weakness in the OpenSSL CMS and PKCS #7 code can be exploited
	 using Bleichenbacher's attack on PKCS #1 v1.5 RSA padding
	 also known as the million message attack (MMA).
	 Only users of CMS, PKCS #7, or S/MIME decryption operations are
	 affected. A successful attack needs on average 2^20 messages. In
	 practice only automated systems will be affected as humans will
	 not be willing to process this many messages.
	 SSL/TLS applications are *NOT* affected by this problem since
	 the SSL/TLS code does not use the PKCS#7 or CMS decryption
	 code.
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-0884</cvename>
	<url>http://www.openssl.org/news/secadv_20120312.txt</url>
 </references>
 <dates>
 <discovery>2012-03-12</discovery>
 <entry>2012-03-15</entry>
 </dates>
 </vuln>

<vuln vid="29194cb8-6e9f-11e1-8376-f0def16c5c1b">
 <topic>nginx -- potential information leak</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><lt>1.0.14,1</lt></range>
 </package>
 <package>
	<name>nginx-devel</name>
	<range><lt>1.1.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	nginx development team reports:
	<blockquote cite="http://nginx.net/CHANGES">
	 Matthew Daley recently discovered a security problem
	 which may lead to a disclosure of previously freed memory
	 on specially crafted response from an upstream server,
	 potentially resulting in sensitive information leak.
	</blockquote>
 </body>
 </description>
 <references>
	<url>http://nginx.net/CHANGES</url>
 </references>
 <dates>
 <discovery>2012-03-15</discovery>
 <entry>2012-03-15</entry>
 </dates>
 </vuln>

<vuln vid="a1050b8b-6db3-11e1-8b37-0011856a6e37">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>4.0,1</gt><lt>10.0.3,1</lt></range>
	<range><ge>3.6.*,1</ge><lt>3.6.28</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>10.0.3,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.8</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>10.0.3</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.8</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>4.0</gt><lt>10.0.3</lt></range>
	<range><gt>3.1.*</gt><lt>3.1.20</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.28</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2012-13 XSS with Drag and Drop and Javascript: URL
	 MFSA 2012-14 SVG issues found with Address Sanitizer
	 MFSA 2012-15 XSS with multiple Content Security Policy headers
	 MFSA 2012-16 Escalation of privilege with Javascript: URL as home page
	 MFSA 2012-17 Crash when accessing keyframe cssText after dynamic modification
	 MFSA 2012-18 window.fullScreen writeable by untrusted content
	 MFSA 2012-19 Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28)
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-0451</cvename>
	<cvename>CVE-2012-0455</cvename>
	<cvename>CVE-2012-0456</cvename>
	<cvename>CVE-2012-0457</cvename>
	<cvename>CVE-2012-0458</cvename>
	<cvename>CVE-2012-0459</cvename>
	<cvename>CVE-2012-0460</cvename>
	<cvename>CVE-2012-0461</cvename>
	<cvename>CVE-2012-0462</cvename>
	<cvename>CVE-2012-0463</cvename>
	<cvename>CVE-2012-0464</cvename>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-13.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-14.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-15.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-16.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-17.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-18.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-19.html</url>
 </references>
 <dates>
 <discovery>2012-03-13</discovery>
 <entry>2012-03-14</entry>
 <modified>2012-03-18</modified>
 </dates>
 </vuln>

<vuln vid="6d329b64-6bbb-11e1-9166-001e4f0fb9b1">
 <topic>portaudit -- auditfile remote code execution</topic>
 <affects>
 <package>
	<name>portaudit</name>
	<range><lt>0.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michael Gmelin and Jörg Scheinert has reported a remote
	 command execution vulnerability in portaudit.
	An attacker who can get the user to use a specially crafted
	 audit file will be able to run commands on the users system,
	 with the privileges of the user running running portaudit
	 (often root).
	The attack could e.g. happen through DNS hijacking or a man
	 in the middle attack.
	Note that if the user has set up portaudit to run from
	 periodic this attack could happen without direct user
	 interaction.
	In the FreeBSD Ports Collection (bsd.port.mk) the check for
	 vulnerable ports at install-time directly operates on the
	 auditfile and has the same vulnerability as portaudit. As
	 the Ports Collection infrastructure does not have a version
	 number just be sure to have a Ports Collection new enough to
	 contain the fix for portaudit. Note that this is only
	 a problem for users which has portaudit installed, as they will
	 not have the audit database installed or downloaded
	 otherwise.
 </body>
 </description>
 <references>
 <url>http://cvsweb.FreeBSD.org/ports/ports-mgmt/portaudit/Makefile#rev1.30</url>
 <url>http://cvsweb.FreeBSD.org/ports/Mk/bsd.port.mk#rev1.707</url>
 </references>
 <dates>
 <discovery>2012-03-11</discovery>
 <entry>2012-03-11</entry>
 </dates>
 </vuln>

<vuln vid="9da3834b-6a50-11e1-91af-003067b2972c">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.1r102.63</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-05.html">
	 These vulnerabilities could cause a crash and potentially allow
	 an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0768</cvename>
 <cvename>CVE-2012-0769</cvename>
 <url>https://www.adobe.com/support/security/bulletins/apsb12-05.html</url>
 </references>
 <dates>
 <discovery>2012-03-05</discovery>
 <entry>2012-03-09</entry>
 </dates>
 </vuln>

<vuln vid="9448a82f-6878-11e1-865f-00e0814cab4e">
 <topic>jenkins -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>jenkins</name>
	<range><lt>1.453</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jenkins Security Advisory reports:
	<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-03-05">
	 An XSS vulnerability was found in Jenkins core, which allows an
	 attacker to inject malicious HTMLs to pages served by Jenkins.
	 This allows an attacker to escalate his privileges by hijacking
	 sessions of other users. This vulnerability affects all
	 versions.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-03-05</url>
 </references>
 <dates>
 <discovery>2012-03-05</discovery>
 <entry>2012-03-07</entry>
 </dates>
 </vuln>

<vuln vid="eba70db4-6640-11e1-98af-00262d8b701d">
 <topic>dropbear -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>dropbear</name>
	<range><ge>0.51</ge><lt>2012.55</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Dropbear project reports:
	<blockquote cite="http://xforce.iss.net/xforce/xfdb/73444">
	 Dropbear SSH Server could allow a remote authenticated attacker
	 to execute arbitrary code on the system, caused by a use-after-
	 free error. If a command restriction is enforced, an attacker
	 could exploit this vulnerability to execute arbitrary code on
	 the system with root privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>52159</bid>
 <cvename>CVE-2012-0920</cvename>
 <url>http://secunia.com/advisories/48147</url>
 <url>http://xforce.iss.net/xforce/xfdb/73444</url>
 </references>
 <dates>
 <discovery>2012-02-22</discovery>
 <entry>2012-03-04</entry>
 </dates>
 </vuln>

<vuln vid="46aeba13-64a1-11e1-bc16-0023ae8e59f0">
 <topic>openx -- undisclosed security issue</topic>
 <affects>
 <package>
	<name>openx</name>
	<range><lt>2.8.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenX does not provide information about vulnerabilities beyond their
	 existence.
 </body>
 </description>
 <references>
 <url>http://blog.openx.org/12/security-matters-3</url>
 </references>
 <dates>
 <discovery>2011-12-01</discovery>
 <entry>2012-03-02</entry>
 <modified>2012-07-08</modified>
 </dates>
 </vuln>

<vuln vid="174b8864-6237-11e1-be18-14dae938ec40">
 <topic>databases/postgresql*-client -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql-client</name>
	<range><lt>8.3.18</lt></range>
	<range><ge>8.4</ge><lt>8.4.11</lt></range>
	<range><ge>9</ge><lt>9.0.7</lt></range>
	<range><ge>9.1</ge><lt>9.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL Global Development Group reports:
	<blockquote cite="http://www.postgresql.org/about/news/1377/">
	 These vulnerabilities could allow users to define triggers that
	 execute functions on which the user does not have EXECUTE
	 permission, allow SSL certificate spoofing and allow line breaks
	 in object names to be exploited to execute code when loading a
	 pg_dump file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0866</cvename>
 <cvename>CVE-2012-0867</cvename>
 <cvename>CVE-2012-0868</cvename>
 <url>http://www.postgresql.org/about/news/1377/</url>
 </references>
 <dates>
 <discovery>2012-02-27</discovery>
 <entry>2012-02-28</entry>
 </dates>
 </vuln>

<vuln vid="f63bf080-619d-11e1-91af-003067b2972c">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>11.1r102.62</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-03.html">
	 These vulnerabilities could cause a crash and potentially allow
	 an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0751</cvename>
 <cvename>CVE-2012-0752</cvename>
 <cvename>CVE-2012-0753</cvename>
 <cvename>CVE-2012-0754</cvename>
 <cvename>CVE-2012-0755</cvename>
 <cvename>CVE-2012-0756</cvename>
 <cvename>CVE-2012-0767</cvename>
 <url>https://www.adobe.com/support/security/bulletins/apsb12-03.html</url>
 </references>
 <dates>
 <discovery>2012-02-15</discovery>
 <entry>2012-02-27</entry>
 </dates>
 </vuln>

<vuln vid="57f1a624-6197-11e1-b98c-bcaec565249c">
 <topic>libxml2 -- heap buffer overflow</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<name>linux-f10-libxml2</name>
	<range><lt>2.7.8_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Google chrome team reports:
	<blockquote cite="http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html">
	 Heap-based buffer overflow in libxml2, allows remote attackers
	 to cause a denial of service or possibly have unspecified other
	 impact via unknown vectors.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3919</cvename>
 <url>http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html</url>
 </references>
 <dates>
 <discovery>2012-01-05</discovery>
 <entry>2012-02-27</entry>
 </dates>
 </vuln>

<vuln vid="ba51c2f7-5b43-11e1-8288-00262d5ed8ee">
 <topic>plib -- remote code execution via buffer overflow</topic>
 <affects>
 <package>
	<name>torcs</name>
	<range><lt>1.3.3</lt></range>
 </package>
 <package>
	<name>plib</name>
	<range><le>1.8.5_3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/47297/">
	 A vulnerability has been discovered in PLIB, which can be
	 exploited by malicious people to compromise an application using
	 the library.
	 The vulnerability is caused due to a boundary error within the
	 "ulSetError()" function (src/util/ulError.cxx) when creating the
	 error message, which can be exploited to overflow a static
	 buffer.
	 Successful exploitation allows the execution of arbitrary code
	 but requires that the attacker can e.g. control the content of
	 an overly long error message passed to the "ulSetError()"
	 function.
	 The vulnerability is confirmed in version 1.8.5. Other versions
	 may also be affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4620</cvename>
 <url>http://secunia.com/advisories/47297/</url>
 <url>http://torcs.sourceforge.net/index.php?name=News&amp;file=article&amp;sid=79</url>
 </references>
 <dates>
 <discovery>2011-12-21</discovery>
 <entry>2012-02-19</entry>
 </dates>
 </vuln>

<vuln vid="fdd1c316-5a3d-11e1-8d3e-e0cb4e266481">
 <topic>phpMyAdmin -- XSS in replication setup</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><gt>3.4</gt><lt>3.4.10.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php">
	 It was possible to conduct XSS using a crafted database name.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-1190</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php</url>
 </references>
 <dates>
 <discovery>2012-02-18</discovery>
 <entry>2012-02-18</entry>
 </dates>
 </vuln>

<vuln vid="da317bc9-59a6-11e1-bc16-0023ae8e59f0">
 <topic>piwik -- xss and click-jacking issues</topic>
 <affects>
 <package>
	<name>piwik</name>
	<range><lt>1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Piwik Team reports:
	<blockquote cite="http://piwik.org/blog/2012/02/7775/">
	 We would like to thank the following security researchers for
	 their responsible disclosure of XSS and click-jacking issues:
	 Piotr Duszynski, Sergey Markov, Mauro Gentile.
	</blockquote>
 </body>
 </description>
 <references>
	 <url>"http://piwik.org/blog/2012/02/7775/"</url>
 </references>
 <dates>
 <discovery>2012-02-16</discovery>
 <entry>2012-02-16</entry>
 </dates>
 </vuln>

<vuln vid="d7dbd2db-599c-11e1-a2fb-14dae9ebcf89">
 <topic>mozilla -- heap-buffer overflow</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><ge>10.0,1</ge><lt>10.0.2,1</lt></range>
	<range><ge>3.6.*,1</ge><lt>3.6.27</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><ge>10.0,1</ge><lt>10.0.2,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><ge>2.7</ge><lt>2.7.2</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><ge>10.0</ge><lt>10.0.2</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><ge>2.7</ge><lt>2.7.2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><ge>10.0</ge><lt>10.0.2</lt></range>
	<range><gt>3.1.*</gt><lt>3.1.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2012-11 libpng integer overflow
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2011-3026</cvename>
	<url>https://www.mozilla.org/security/announce/2012/mfsa2012-11.html</url>
 </references>
 <dates>
 <discovery>2012-02-16</discovery>
 <entry>2012-02-17</entry>
 <modified>2012-03-18</modified>
 </dates>
 </vuln>

<vuln vid="b4f8be9e-56b2-11e1-9fb7-003067b2972c">
 <topic>Python -- DoS via malformed XML-RPC / HTTP POST request</topic>
 <affects>
 <package>
	<name>python32</name>
	<range><le>3.2.2_2</le></range>
 </package>
 <package>
	<name>python31</name>
	<range><le>3.1.4_2</le></range>
 </package>
 <package>
	<name>python27</name>
	<range><le>2.7.2_3</le></range>
 </package>
 <package>
	<name>python26</name>
	<range><le>2.6.7_2</le></range>
 </package>
 <package>
	<name>python25</name>
	<range><le>2.5.6_2</le></range>
 </package>
 <package>
	<name>python24</name>
	<range><le>2.4.5_8</le></range>
 </package>
 <package>
	<name>pypy</name>
	
	<range><le>1.7</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jan Lieskovsky reports,
	<blockquote cite="http://bugs.python.org/issue14001">
	 A denial of service flaw was found in the way Simple XML-RPC
	 Server module of Python processed client connections, that were
	 closed prior the complete request body has been received. A
	 remote attacker could use this flaw to cause Python Simple
	 XML-RPC based server process to consume excessive amount of
	 CPU.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0845</cvename>
 <url>http://bugs.python.org/issue14001</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=789790</url>
 <url>https://bugs.pypy.org/issue1047</url>
 </references>
 <dates>
 <discovery>2012-02-13</discovery>
 <entry>2012-02-14</entry>
 <modified>2012-02-26</modified>
 </dates>
 </vuln>

<vuln vid="2b20fd5f-552e-11e1-9fb7-003067b2972c">
 <topic>WebCalendar -- Persistent XSS</topic>
 <affects>
 <package>
	<name>WebCalendar</name>
	<range><le>1.2.4</le></range>
 </package>
 <package>
	<name>WebCalendar-devel</name>
	<range><le>1.2.4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	tom reports,
	<blockquote cite="http://seclists.org/bugtraq/2012/Jan/128">
	 There is no sanitation on the input of the location variable
	 allowing for persistent XSS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0846</cvename>
 <url>http://sourceforge.net/tracker/?func=detail&amp;aid=3472745&amp;group_id=3870&amp;atid=103870</url>
 </references>
 <dates>
 <discovery>2012-01-11</discovery>
 <entry>2012-02-12</entry>
 <modified>2012-02-13</modified>
 </dates>
 </vuln>

<vuln vid="eba9aa94-549c-11e1-b6b7-0011856a6e37">
 <topic>mozilla -- use-after-free in nsXBLDocumentInfo::ReadPrototypeBindings</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><ge>10.0,1</ge><lt>10.0.1,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><ge>10.0,1</ge><lt>10.0.1,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><ge>2.7</ge><lt>2.7.1</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><ge>10.0</ge><lt>10.0.1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><ge>2.7</ge><lt>2.7.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><ge>10.0</ge><lt>10.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2012-10 use after free in nsXBLDocumentInfo::ReadPrototypeBindings
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-0452</cvename>
	<url>https://www.mozilla.org/security/announce/2012/mfsa2012-10.html</url>
 </references>
 <dates>
 <discovery>2012-02-10</discovery>
 <entry>2012-02-11</entry>
 </dates>
 </vuln>

<vuln vid="1c4cab30-5468-11e1-9fb7-003067b2972c">
 <topic>bip -- buffer overflow</topic>
 <affects>
 <package>
	<name>bip</name>
	<range><le>0.8.8</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Julien Tinnes reports,
	<blockquote cite="https://projects.duckcorp.org/issues/269">
	 Bip doesn't check if fd is equal or larger than FD_SETSIZE.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0806</cvename>
 <url>https://projects.duckcorp.org/projects/bip/repository/revisions/222a33cb84a2e52ad55a88900b7895bf9dd0262c</url>
 <url>https://projects.duckcorp.org/issues/269</url>
 </references>
 <dates>
 <discovery>2012-01-07</discovery>
 <entry>2012-02-11</entry>
 </dates>
 </vuln>

<vuln vid="039d057e-544e-11e1-9fb7-003067b2972c">
 <topic>surf -- private information disclosure</topic>
 <affects>
 <package>
	<name>surf</name>
	<range><le>0.4.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	surf does not protect its cookie jar against access read access from
	other local users
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0842</cvename>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659296</url>
 </references>
 <dates>
 <discovery>2012-02-10</discovery>
 <entry>2012-02-11</entry>
 </dates>
 </vuln>

<vuln vid="7c769c89-53c2-11e1-8e52-00163e22ef61">
 <topic>glpi -- remote attack via crafted POST request</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>0.80.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GLPI project reports:
	<blockquote cite="http://www.glpi-project.org/spip.php?page=annonce&amp;id_breve=237&amp;lang=en">
	 The autocompletion functionality in GLPI before 0.80.2 does not
	 blacklist certain username and password fields, which allows
	 remote attackers to obtain sensitive information via a crafted
	 POST request.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.glpi-project.org/spip.php?page=annonce&amp;id_breve=237&amp;lang=en</url>
 <url>https://forge.indepnet.net/issues/3017</url>
 <cvename>CVE-2011-2720</cvename>
 </references>
 <dates>
 <discovery>2011-07-20</discovery>
 <entry>2012-02-10</entry>
 <modified>2013-06-19</modified>
 </dates>
 </vuln>

<vuln vid="10720fe8-51e0-11e1-91c1-00215c6a37bb">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal6</name>
	<range><lt>6.23</lt></range>
 </package>
 <package>
	<name>drupal7</name>
	<range><lt>7.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal development team reports:
	<blockquote cite="http://drupal.org/node/1425084">
	 <h3>Cross Site Request Forgery vulnerability in Aggregator
	 module</h3>
	 CVE: CVE-2012-0826
	 An XSRF vulnerability can force an aggregator feed to update.
	 Since some services are rate-limited (e.g. Twitter limits
	 requests to 150 per hour) this could lead to a denial of
	 service.
	 This issue affects Drupal 6.x and 7.x.
	 <h3>OpenID not verifying signed attributes in SREG and AX</h3>
	 CVE: CVE-2012-0825
	 A group of security researchers identified a flaw in how some
	 OpenID relying parties implement Attribute Exchange (AX). Not
	 verifying that attributes being passed through AX have been
	 signed could allow an attacker to modify users' information.
	 This issue affects Drupal 6.x and 7.x.
	 <h3>Access bypass in File module</h3>
	 CVE: CVE-2012-0827
	 When using private files in combination with certain field
	 access modules, the File module will allow users to download
	 the file even if they do not have access to view the field it
	 was attached to.
	 This issue affects Drupal 7.x only.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0825</cvename>
 <cvename>CVE-2012-0826</cvename>
 <cvename>CVE-2012-0827</cvename>
 </references>
 <dates>
 <discovery>2012-02-01</discovery>
 <entry>2012-02-07</entry>
 </dates>
 </vuln>

<vuln vid="309542b5-50b9-11e1-b0d8-00151735203a">
 <topic>bugzilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><ge>2.4.*</ge><lt>3.6.8</lt></range>
	<range><ge>4.0.*</ge><lt>4.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla Security Advisory reports:
	<blockquote cite="http://www.bugzilla.org/security/3.4.12/">
	 The following security issues have been discovered in
	 Bugzilla:
	 <ul>
	 <li>Account Impersonation:
	 When a user creates a new account, Bugzilla doesn't correctly
	 reject email addresses containing non-ASCII characters, which
	 could be used to impersonate another user account. Such email
	 addresses could look visually identical to other valid email
	 addresses, and an attacker could try to confuse other users
	 and be added to bugs he shouldn't have access to.</li>
	 <li>Cross-Site Request Forgery:
	 Due to a lack of validation of the Content-Type head when
	 making POST requests to jsonrpc.cgi, a possible CSRF
	 vulnerability was discovered. If a user visits an HTML page
	 with some malicious JS code in it, an attacker could make
	 changes to a remote Bugzilla installation on behalf of the
	 victim's account by using the JSON-RPC API. The user would
	 have had to be already logged in to the target site for the
	 vulnerability to work.</li>
	 </ul>
	 All affected installations are encouraged to upgrade as soon as
	 possible.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0448</cvename>
 <cvename>CVE-2012-0440</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=714472</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=718319</url>
 </references>
 <dates>
 <discovery>2012-01-31</discovery>
 <entry>2012-02-06</entry>
 </dates>
 </vuln>

<vuln vid="3fd040be-4f0b-11e1-9e32-0025900931f8">
 <topic>php -- arbitrary remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><ge>5.3.9</ge><lt>5.3.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/47806/">
	 A vulnerability has been reported in PHP, which can be exploited
	 by malicious people to compromise a vulnerable system.
	 The vulnerability is caused due to a logic error within the
	 "php_register_variable_ex()" function (php_variables.c) when
	 hashing form posts and updating a hash table, which can be
	 exploited to execute arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0830</cvename>
 <url>http://www.php.net/archive/2012.php#id2012-02-02-1</url>
 <url>http://secunia.com/advisories/47806/</url>
 </references>
 <dates>
 <discovery>2012-02-02</discovery>
 <entry>2012-02-04</entry>
 <modified>2012-02-06</modified>
 </dates>
 </vuln>

<vuln vid="6e7ad1d7-4e27-11e1-8e12-90e6ba8a36a2">
 <topic>mathopd -- directory traversal vulnerability</topic>
 <affects>
 <package>
	<name>mathopd</name>
	<range><lt>1.5p7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michiel Boland reports:
	<blockquote cite="http://www.mathopd.org/security.html">
	 The software has a vulnerability that could lead to directory
	 traversal if the '*' construct for mass virtual hosting is
	 used.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist msgid="4F2AFEF2.5040708@boland.org">http://www.mail-archive.com/mathopd%40mathopd.org/msg00392.html</mlist>
 <url>http://www.mathopd.org/security.html</url>
 </references>
 <dates>
 <discovery>2012-02-02</discovery>
 <entry>2012-02-03</entry>
 </dates>
 </vuln>

<vuln vid="4b7dbfab-4c6b-11e1-bc16-0023ae8e59f0">
 <topic>apache -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><gt>2.*</gt><lt>2.2.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE MITRE reports:
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_22.html">
	 An exposure was found when using mod_proxy in reverse proxy
	 mode. In certain configurations using RewriteRule with proxy
	 flag or ProxyPassMatch, a remote attacker could cause the reverse
	 proxy to connect to an arbitrary server, possibly disclosing
	 sensitive information from internal web servers not directly
	 accessible to attacker.
	 Integer overflow in the ap_pregsub function in server/util.c in
	 the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through
	 2.2.21, when the mod_setenvif module is enabled, allows local
	 users to gain privileges via a .htaccess file with a crafted
	 SetEnvIf directive, in conjunction with a crafted HTTP request
	 header, leading to a heap-based buffer overflow.
	 An additional exposure was found when using mod_proxy in
	 reverse proxy mode. In certain configurations using RewriteRule
	 with proxy flag or ProxyPassMatch, a remote attacker could cause
	 the reverse proxy to connect to an arbitrary server, possibly
	 disclosing sensitive information from internal web servers
	 not directly accessible to attacker.
	 A flaw was found in mod_log_config. If the '%{cookiename}C' log
	 format string is in use, a remote attacker could send a specific
	 cookie causing a crash. This crash would only be a denial of
	 service if using a threaded MPM.
	 A flaw was found in the handling of the scoreboard. An
	 unprivileged child process could cause the parent process to
	 crash at shutdown rather than terminate cleanly.
	 A flaw was found in the default error response for status code
	 400. This flaw could be used by an attacker to expose
	 "httpOnly" cookies when no custom ErrorDocument is specified.
	</blockquote>
 </body>
 </description>
 <references>
	 <cvename>CVE-2011-3368</cvename>
	 <cvename>CVE-2011-3607</cvename>
	 <cvename>CVE-2011-4317</cvename>
	 <cvename>CVE-2012-0021</cvename>
	 <cvename>CVE-2012-0031</cvename>
	 <cvename>CVE-2012-0053</cvename>
 </references>
 <dates>
 <discovery>2011-10-05</discovery>
 <entry>2012-01-31</entry>
 </dates>
 </vuln>

<vuln vid="0a9e2b72-4cb7-11e1-9146-14dae9ebcf89">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>4.0,1</gt><lt>10.0,1</lt></range>
	<range><ge>3.6.*,1</ge><lt>3.6.26</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>10.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.7</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>10.0</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.7</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>4.0</gt><lt>10.0</lt></range>
	<range><gt>3.1.*</gt><lt>3.1.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2012-01 Miscellaneous memory safety hazards (rv:10.0/
	 rv:1.9.2.26)
	 MFSA 2012-02 Overly permissive IPv6 literal syntax
	 MFSA 2012-03 iframe element exposed across domains via name
	 attribute
	 MFSA 2012-04 Child nodes from nsDOMAttribute still accessible
	 after removal of nodes
	 MFSA 2012-05 Frame scripts calling into untrusted objects bypass
	 security checks
	 MFSA 2012-06 Uninitialized memory appended when encoding icon
	 images may cause information disclosure
	 MFSA 2012-07 Potential Memory Corruption When Decoding Ogg Vorbis
	 files
	 MFSA 2012-08 Crash with malformed embedded XSLT stylesheets
	 MFSA 2012-09 Firefox Recovery Key.html is saved with unsafe
	 permission
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2012-0442</cvename>
	<cvename>CVE-2012-0443</cvename>
	<cvename>CVE-2011-3670</cvename>
	<cvename>CVE-2012-0445</cvename>
	<cvename>CVE-2011-3659</cvename>
	<cvename>CVE-2012-0446</cvename>
	<cvename>CVE-2012-0447</cvename>
	<cvename>CVE-2012-0449</cvename>
	<cvename>CVE-2012-0450</cvename>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-01.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-02.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-03.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-04.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-05.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-06.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-07.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-08.html</url>
	<url>http://www.mozilla.org/security/announce/2012/mfsa2012-09.html</url>
 </references>
 <dates>
 <discovery>2012-01-31</discovery>
 <entry>2012-02-01</entry>
 <modified>2012-03-18</modified>
 </dates>
 </vuln>

<vuln vid="7c920bb7-4b5f-11e1-9f47-00e0815b8da8">
 <topic>sudo -- format string vulnerability</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><ge>1.8.0</ge><lt>1.8.3_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Todd Miller reports:
	<blockquote cite="http://www.gratisoft.us/sudo/alerts/sudo_debug.html">
	 Sudo 1.8.0 introduced simple debugging support that was primarily
	 intended for use when developing policy or I/O logging plugins.
	 The sudo_debug() function contains a flaw where the program name
	 is used as part of the format string passed to the fprintf()
	 function. The program name can be controlled by the caller,
	 either via a symbolic link or, on some systems, by setting argv[0]
	 when executing sudo.
	 Using standard format string vulnerability exploitation
	 techniques it is possible to leverage this bug to achieve root
	 privileges.
	 Exploitation of the bug does not require that the attacker be
	 listed in the sudoers file. As such, we strongly suggest that
	 affected sites upgrade from affected sudo versions as soon as
	 possible.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0809</cvename>
 <url>http://www.gratisoft.us/sudo/alerts/sudo_debug.html</url>
 </references>
 <dates>
 <discovery>2012-01-30</discovery>
 <entry>2012-01-30</entry>
 <modified>2012-01-31</modified>
 </dates>
 </vuln>

<vuln vid="e51d5b1a-4638-11e1-9f47-00e0815b8da8">
 <topic>FreeBSD -- pam_ssh() does not validate service names</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_9</lt></range>
	<range><ge>7.4</ge><lt>7.4_5</lt></range>
	<range><ge>8.1</ge><lt>8.1_7</lt></range>
	<range><ge>8.2</ge><lt>8.2_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:10.pam.asc">
	<h1>Problem Description:</h1>
	Some third-party applications, including KDE's kcheckpass command,
	 allow the user to specify the name of the policy on the command
	 line. Since OpenPAM treats the policy name as a path relative to
	 /etc/pam.d or /usr/local/etc/pam.d, users who are permitted to run
	 such an application can craft their own policies and cause the
	 application to load and execute their own modules.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-11:10.pam</freebsdsa>
 <cvename>CVE-2011-4122</cvename>
 </references>
 <dates>
 <discovery>2011-12-23</discovery>
 <entry>2012-01-29</entry>
 </dates>
 </vuln>

<vuln vid="eda151d8-4638-11e1-9f47-00e0815b8da8">
 <topic>FreeBSD -- pam_ssh improperly grants access when user account has unencrypted SSH private keys</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_9</lt></range>
	<range><ge>7.4</ge><lt>7.4_5</lt></range>
	<range><ge>8.1</ge><lt>8.1_7</lt></range>
	<range><ge>8.2</ge><lt>8.2_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:09.pam_ssh.asc">
	<h1>Problem Description:</h1>
	The OpenSSL library call used to decrypt private keys ignores the
	 passphrase argument if the key is not encrypted. Because the
	 pam_ssh module only checks whether the passphrase provided by the
	 user is null, users with unencrypted SSH private keys may
	 successfully authenticate themselves by providing a dummy
	 passphrase.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-11:09.pam_ssh</freebsdsa>
 </references>
 <dates>
 <discovery>2011-12-23</discovery>
 <entry>2012-01-29</entry>
 <modified>2013-06-18</modified>
 </dates>
 </vuln>

<vuln vid="f56390a4-4638-11e1-9f47-00e0815b8da8">
 <topic>FreeBSD -- Buffer overflow in handling of UNIX socket addresses</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_8</lt></range>
	<range><ge>7.4</ge><lt>7.4_4</lt></range>
	<range><ge>8.1</ge><lt>8.1_6</lt></range>
	<range><ge>8.2</ge><lt>8.2_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:05.unix.asc">
	<h1>Problem Description:</h1>
	When a UNIX-domain socket is attached to a location using the
	 bind(2) system call, the length of the provided path is not
	 validated. Later, when this address was returned via other system
	 calls, it is copied into a fixed-length buffer.
	Linux uses a larger socket address structure for UNIX-domain
	 sockets than FreeBSD, and the FreeBSD's linux emulation code did
	 not translate UNIX-domain socket addresses into the correct size
	 of structure.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-11:05.unix</freebsdsa>
 </references>
 <dates>
 <discovery>2011-09-28</discovery>
 <entry>2012-01-29</entry>
 </dates>
 </vuln>

<vuln vid="fee94342-4638-11e1-9f47-00e0815b8da8">
 <topic>FreeBSD -- errors handling corrupt compress file in compress(1) and gzip(1)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_7</lt></range>
	<range><ge>7.4</ge><lt>7.4_3</lt></range>
	<range><ge>8.1</ge><lt>8.1_5</lt></range>
	<range><ge>8.2</ge><lt>8.2_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:04.compress.asc">
	<h1>Problem Description:</h1>
	The code used to decompress a file created by compress(1) does not
	 do sufficient boundary checks on compressed code words, allowing
	 reference beyond the decompression table, which may result in a
	 stack overflow or an infinite loop when the decompressor encounters
	 a corrupted file.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-11:04.compress</freebsdsa>
 <cvename>CVE-2011-2895</cvename>
 </references>
 <dates>
 <discovery>2011-09-28</discovery>
 <entry>2012-01-29</entry>
 </dates>
 </vuln>

<vuln vid="87261557-a450-11e2-9898-001060e06fd4">
 <topic>FreeBSD -- Network ACL mishandling in mountd(8)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_5</lt></range>
	<range><ge>7.4</ge><lt>7.4_1</lt></range>
	<range><ge>8.1</ge><lt>8.1_3</lt></range>
	<range><ge>8.2</ge><lt>8.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:01.mountd.asc">
	<h1>Problem Description:</h1>
	While parsing the exports(5) table, a network mask in the form of
	 "-network=netname/prefixlength" results in an incorrect network mask
	 being computed if the prefix length is not a multiple of 8.
	For example, specifying the ACL for an export as "-network
	 192.0.2.0/23" would result in a netmask of 255.255.127.0 being used
	 instead of the correct netmask of 255.255.254.0.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-11:01.mountd</freebsdsa>
 <cvename>CVE-2011-1739</cvename>
 </references>
 <dates>
 <discovery>2011-04-20</discovery>
 <entry>2012-01-29</entry>
 </dates>
 </vuln>

<vuln vid="93688f8f-4935-11e1-89b4-001ec9578670">
 <topic>postfixadmin -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>postfixadmin</name>
	<range><lt>2.3.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Postfix Admin Team reports:
	<blockquote cite="http://sourceforge.net/projects/postfixadmin/forums/forum/676076/topic/4977778">
	 Multiple XSS vulnerabilities exist: 
	 - XSS with $_GET[domain] in templates/menu.php and
	 edit-vacation 
	 - XSS in some create-domain input fields 
	 - XSS in create-alias and edit-alias error message 
	 - XSS (by values stored in the database) in fetchmail list
	 view, list-domain and list-virtual
	 Multiple SQL injection issues exist: 
	 - SQL injection in pacrypt() (if $CONF[encrypt] ==
	 'mysql_encrypt') 
	 - SQL injection in backup.php - the dump was not mysql_escape()d,
	 therefore users could inject SQL (for example in the vacation message)
	 which will be executed when restoring the database dump.
	 WARNING: database dumps created with backup.php from 2.3.4 or older
	 might contain malicious SQL. Double-check before using them!
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0811</cvename>
 <cvename>CVE-2012-0812</cvename>
 <url>http://sourceforge.net/projects/postfixadmin/forums/forum/676076/topic/4977778</url>
 </references>
 <dates>
 <discovery>2012-01-27</discovery>
 <entry>2012-01-27</entry>
 </dates>
 </vuln>

<vuln vid="e465159c-4817-11e1-89b4-001ec9578670">
 <topic>mpack -- Information disclosure</topic>
 <affects>
 <package>
	<name>mpack</name>
	<range><lt>1.6_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The oss-security list reports:
	<blockquote cite="http://openwall.com/lists/oss-security/2011/12/31/1">
	 Incorrect permissions on temporary files can lead to
	 information disclosure.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4919</cvename>
 <url>http://openwall.com/lists/oss-security/2011/12/31/1</url>
 </references>
 <dates>
 <discovery>2011-12-31</discovery>
 <entry>2012-01-26</entry>
 </dates>
 </vuln>

<vuln vid="fa2f386f-4814-11e1-89b4-001ec9578670">
 <topic>acroread9 -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>acroread9</name>
	<range><lt>9.4.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Adobe Security Team reports:
	<blockquote cite="http://www.adobe.com/support/security/advisories/apsa11-04.html">
	 An unspecified vulnerability in the U3D component allows
	 remote attackers to execute arbitrary code (or cause a denial
	 of service attack) via unknown vectors.
	</blockquote>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-24.html">
	 A heap-based buffer overflow allows attackers to execute
	 arbitrary code via unspecified vectors.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2462</cvename>
 <cvename>CVE-2011-1353</cvename>
 <cvename>CVE-2011-2431</cvename>
 <cvename>CVE-2011-2432</cvename>
 <cvename>CVE-2011-2433</cvename>
 <cvename>CVE-2011-2434</cvename>
 <cvename>CVE-2011-2435</cvename>
 <cvename>CVE-2011-2436</cvename>
 <cvename>CVE-2011-2437</cvename>
 <cvename>CVE-2011-2438</cvename>
 <cvename>CVE-2011-2439</cvename>
 <cvename>CVE-2011-2440</cvename>
 <cvename>CVE-2011-2441</cvename>
 <cvename>CVE-2011-2442</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb11-24.html</url>
 <url>http://www.adobe.com/support/security/advisories/apsa11-04.html</url>
 </references>
 <dates>
 <discovery>2011-12-07</discovery>
 <entry>2012-01-26</entry>
 </dates>
 </vuln>

<vuln vid="3ebb2dc8-4609-11e1-9f47-00e0815b8da8">
 <topic>Wireshark -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
	<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
 </package>
 <package>
	<name>wireshark-lite</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
	<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
 </package>
 <package>
	<name>tshark</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
	<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
 </package>
 <package>
	<name>tshark-lite</name>
	<range><ge>1.4</ge><lt>1.4.11</lt></range>
	<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wireshark reports:
	<blockquote cite="http://www.wireshark.org/docs/relnotes/wireshark-1.6.5.html">
	 Laurent Butti discovered that Wireshark failed to properly check
	 record sizes for many packet capture file formats
	 Wireshark could dereference a NULL pointer and crash.
	 The RLC dissector could overflow a buffer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0041</cvename>
 <cvename>CVE-2012-0066</cvename>
 <cvename>CVE-2012-0067</cvename>
 <cvename>CVE-2012-0068</cvename>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-01.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-02.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2012-03.html</url>
 <url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6663</url>
 <url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6666</url>
 <url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6667</url>
 <url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6668</url>
 <url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6669</url>
 <url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6670</url>
 <url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6634</url>
 <url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6391</url>
 </references>
 <dates>
 <discovery>2010-01-10</discovery>
 <entry>2012-01-23</entry>
 </dates>
 </vuln>

<vuln vid="7d2336c2-4607-11e1-9f47-00e0815b8da8">
 <topic>spamdyke -- Buffer Overflow Vulnerabilities</topic>
 <affects>
 <package>
	<name>spamdyke</name>
	<range><lt>4.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://www.spamdyke.org/documentation/Changelog.txt">
	 Fixed a number of very serious errors in the usage of
	 snprintf()/vsnprintf().
	 The return value was being used as the length of the string
	 printed into the buffer, but the return value really indicates
	 the length of the string that *could* be printed if the buffer
	 were of infinite size. Because the returned value could be
	 larger than the buffer's size, this meant remotely exploitable
	 buffer overflows were possible, depending on spamdyke's
	 configuration.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0802</cvename>
 <url>https://secunia.com/advisories/47548/</url>
 <url>http://www.spamdyke.org/documentation/Changelog.txt</url>
 </references>
 <dates>
 <discovery>2012-01-15</discovery>
 <entry>2012-01-23</entry>
 </dates>
 </vuln>

<vuln vid="5c5f19ce-43af-11e1-89b4-001ec9578670">
 <topic>OpenSSL -- DTLS Denial of Service</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.0_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL Team reports:
	<blockquote cite="http://www.openssl.org/news/secadv_20120118.txt">
	 A flaw in the fix to CVE-2011-4108 can be exploited in a
	 denial of service attack. Only DTLS applications using OpenSSL
	 1.0.0f and 0.9.8s are affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0050</cvename>
 <url>http://www.openssl.org/news/secadv_20120118.txt</url>
 </references>
 <dates>
 <discovery>2012-01-18</discovery>
 <entry>2012-01-20</entry>
 </dates>
 </vuln>

<vuln vid="dd698b76-42f7-11e1-a1b6-14dae9ebcf89">
 <topic>asterisk -- SRTP Video Remote Crash Vulnerability</topic>
 <affects>
 <package>
	<name>asterisk18</name>
	<range><lt>1.8.8.2</lt></range>
 </package>
 <package>
	<name>asterisk10</name>
	<range><lt>10.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Asterisk project reports:
	<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2012-001.html">
	 An attacker attempting to negotiate a secure video stream can
	 crash Asterisk if video support has not been enabled and the
	 res_srtp Asterisk module is loaded.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2012-001.html</url>
 </references>
 <dates>
 <discovery>2012-01-15</discovery>
 <entry>2012-01-20</entry>
 <modified>2013-06-19</modified>
 </dates>
 </vuln>

<vuln vid="7f5ccb1d-439b-11e1-bc16-0023ae8e59f0">
 <topic>tomcat -- Denial of Service</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><gt>5.5.0</gt><lt>5.5.35</lt></range>
 </package>
 <package>
	<name>tomcat</name>
	<range><gt>6.0.0</gt><lt>6.0.34</lt></range>
 </package>
 <package>
	<name>tomcat</name>
	<range><gt>7.0.0</gt><lt>7.0.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Tomcat security team reports:
	<blockquote cite="http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.35">
	 Analysis of the recent hash collision vulnerability identified
	 unrelated inefficiencies with Apache Tomcat's handling of large
	 numbers of parameters and parameter values. These inefficiencies
	 could allow an attacker, via a specially crafted request, to
	 cause large amounts of CPU to be used which in turn could create
	 a denial of service. The issue was addressed by modifying the
	 Tomcat parameter handling code to efficiently process large
	 numbers of parameters and parameter values.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0022</cvename>
 <url>http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.35</url>
 <url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.34</url>
 <url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.23</url>
 </references>
 <dates>
 <discovery>2011-10-21</discovery>
 <entry>2012-01-17</entry>
 </dates>
 </vuln>

<vuln vid="1ac858b0-3fae-11e1-a127-0013d3ccd9df">
 <topic>OpenTTD -- Denial of service (server) via slow read attack</topic>
 <affects>
 <package>
	<name>openttd</name>
	<range><ge>0.3.5</ge><lt>1.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenTTD Team reports:
	<blockquote cite="http://security.openttd.org/en/CVE-2012-0049">
	 Using a slow read type attack it is possible to prevent anyone
	 from joining a server with virtually no resources. Once
	 downloading the map no other downloads of the map can start, so
	 downloading really slowly will prevent others from joining.
	 This can be further aggravated by the pause-on-join setting in
	 which case the game is paused and the players cannot continue
	 the game during such an attack. This attack requires that the
	 user is not banned and passes the authorization to the server,
	 although for many servers there is no server password and thus
	 authorization is easy.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0049</cvename>
 <url>http://security.openttd.org/en/CVE-2012-0049</url>
 </references>
 <dates>
 <discovery>2012-01-06</discovery>
 <entry>2012-01-16</entry>
 </dates>
 </vuln>

<vuln vid="91be81e7-3fea-11e1-afc7-2c4138874f7d">
 <topic>Multiple implementations -- DoS via hash algorithm collision</topic>
 <affects>
 <package>
	<name>jruby</name>
	<range><lt>1.6.5.1</lt></range>
 </package>
 <package>
	<name>ruby</name>
	<name>ruby+nopthreads</name>
	<name>ruby+nopthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><lt>1.8.7.357,1</lt></range>
 </package>
 <package>
	<name>rubygem-rack</name>
	<range><lt>1.3.6,3</lt></range>
 </package>
 <package>
	<name>v8</name>
	<range><lt>3.8.5</lt></range>
 </package>
 <package>
	<name>redis</name>
	<range><le>2.4.6</le></range>
 </package>
 <package>
	<name>node</name>
	<range><lt>0.6.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	oCERT reports:
	<blockquote cite="http://www.ocert.org/advisories/ocert-2011-003.html">
	 A variety of programming languages suffer from a denial-of-service
	 (DoS) condition against storage functions of key/value pairs in
	 hash data structures, the condition can be leveraged by exploiting
	 predictable collisions in the underlying hashing algorithms.
	 The issue finds particular exposure in web server applications
	 and/or frameworks. In particular, the lack of sufficient limits
	 for the number of parameters in POST requests in conjunction with
	 the predictable collision properties in the hashing functions of
	 the underlying languages can render web applications vulnerable
	 to the DoS condition. The attacker, using specially crafted HTTP
	 requests, can lead to a 100% of CPU usage which can last up to
	 several hours depending on the targeted application and server
	 performance, the amplification effect is considerable and
	 requires little bandwidth and time on the attacker side.
	 The condition for predictable collisions in the hashing functions
	 has been reported for the following language implementations:
	 Java, JRuby, PHP, Python, Rubinius, Ruby. In the case of the
	 Ruby language, the 1.9.x branch is not affected by the
	 predictable collision condition since this version includes a
	 randomization of the hashing function.
	 The vulnerability outlined in this advisory is practically
	 identical to the one reported in 2003 and described in the paper
	 Denial of Service via Algorithmic Complexity Attacks which
	 affected the Perl language.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4838</cvename>
 <cvename>CVE-2011-4815</cvename>
 <cvename>CVE-2011-5036</cvename>
 <cvename>CVE-2011-5037</cvename>
 <url>http://www.ocert.org/advisories/ocert-2011-003.html</url>
 <url>http://www.nruns.com/_downloads/advisory28122011.pdf</url>
 </references>
 <dates>
 <discovery>2011-12-28</discovery>
 <entry>2012-01-16</entry>
 <modified>2012-01-20</modified>
 </dates>
 </vuln>

<vuln vid="ea2ddc49-3e8e-11e1-8095-5404a67eef98">
 <topic>ffmpeg -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ffmpeg</name>
	<range><lt>0.7.11,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ubuntu Security Notice USN-1320-1 reports:
	<blockquote cite="http://www.ubuntu.com/usn/usn-1320-1">
	 Phillip Langlois discovered that FFmpeg incorrectly handled
	 certain malformed QDM2 streams. If a user were tricked into opening
	 a crafted QDM2 stream file, an attacker could cause a denial of
	 service via application crash, or possibly execute arbitrary code
	 with the privileges of the user invoking the program.
	 (CVE-2011-4351)
	 Phillip Langlois discovered that FFmpeg incorrectly handled
	 certain malformed VP3 streams. If a user were tricked into opening
	 a crafted file, an attacker could cause a denial of service via
	 application crash, or possibly execute arbitrary code with the
	 privileges of the user invoking the program. (CVE-2011-4352)
	 Phillip Langlois discovered that FFmpeg incorrectly handled
	 certain malformed VP5 and VP6 streams. If a user were tricked into
	 opening a crafted file, an attacker could cause a denial of service
	 via application crash, or possibly execute arbitrary code with the
	 privileges of the user invoking the program. (CVE-2011-4353)
	 It was discovered that FFmpeg incorrectly handled certain
	 malformed VMD files. If a user were tricked into opening a crafted
	 VMD file, an attacker could cause a denial of service via
	 application crash, or possibly execute arbitrary code with the
	 privileges of the user invoking the program. (CVE-2011-4364)
	 Phillip Langlois discovered that FFmpeg incorrectly handled
	 certain malformed SVQ1 streams. If a user were tricked into opening
	 a crafted SVQ1 stream file, an attacker could cause a denial of
	 service via application crash, or possibly execute arbitrary code
	 with the privileges of the user invoking the program.
	 (CVE-2011-4579)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4351</cvename>
 <cvename>CVE-2011-4352</cvename>
 <cvename>CVE-2011-4353</cvename>
 <cvename>CVE-2011-4364</cvename>
 <cvename>CVE-2011-4579</cvename>
 <url>http://www.ubuntu.com/usn/usn-1320-1</url>
 </references>
 <dates>
 <discovery>2011-09-14</discovery>
 <entry>2012-01-14</entry>
 </dates>
 </vuln>

<vuln vid="78cc8a46-3e56-11e1-89b4-001ec9578670">
 <topic>OpenSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.0_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenSSL Team reports:
	<blockquote cite="http://openssl.org/news/secadv_20120104.txt">
	 6 security flaws have been fixed in OpenSSL 1.0.0f:
	 If X509_V_FLAG_POLICY_CHECK is set in OpenSSL 0.9.8,
	 then a policy check failure can lead to a double-free.
	 OpenSSL prior to 1.0.0f and 0.9.8s failed to clear the
	 bytes used as block cipher padding in SSL 3.0 records.
	 As a result, in each record, up to 15 bytes of
	 uninitialized memory may be sent, encrypted, to the SSL
	 peer. This could include sensitive contents of
	 previously freed memory.
	 RFC 3779 data can be included in certificates, and if
	 it is malformed, may trigger an assertion failure.
	 This could be used in a denial-of-service attack.
	 Support for handshake restarts for server gated
	 cryptograpy (SGC) can be used in a denial-of-service
	 attack.
	 A malicious TLS client can send an invalid set of GOST
	 parameters which will cause the server to crash due to
	 lack of error checking. This could be used in a
	 denial-of-service attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4108</cvename>
 <cvename>CVE-2011-4109</cvename>
 <cvename>CVE-2011-4576</cvename>
 <cvename>CVE-2011-4577</cvename>
 <cvename>CVE-2011-4619</cvename>
 <cvename>CVE-2012-0027</cvename>
 <url>http://openssl.org/news/secadv_20120104.txt</url>
 </references>
 <dates>
 <discovery>2012-01-04</discovery>
 <entry>2012-01-14</entry>
 </dates>
 </vuln>

<vuln vid="1800886c-3dde-11e1-89b4-001ec9578670">
 <topic>isc-dhcp-server -- DoS in DHCPv6</topic>
 <affects>
 <package>
	<name>isc-dhcp42-server</name>
	<range><lt>4.2.3_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://www.isc.org/software/dhcp/advisories/cve-2011-4868">
	 Due to improper handling of a DHCPv6 lease structure, ISC DHCP
	 servers that are serving IPv6 address pools AND using Dynamic
	 DNS can encounter a segmentation fault error while updating lease
	 status under certain conditions.
	 The potential exists for this condition to be intentionally
	 triggered, resulting in effective denial of service to
	 clients expecting service from the affected server.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4868</cvename>
 <url>https://www.isc.org/software/dhcp/advisories/cve-2011-4868</url>
 </references>
 <dates>
 <discovery>2012-01-13</discovery>
 <entry>2012-01-13</entry>
 </dates>
 </vuln>

<vuln vid="3338f87c-3d5f-11e1-a00a-000c6eb41cf7">
 <topic>PowerDNS -- Denial of Service Vulnerability</topic>
 <affects>
 <package>
	<name>powerdns</name>
	<name>powerdns-devel</name>
	<range><lt>3.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PowerDNS Team reports:
	<blockquote cite="http://www.powerdns.com/news/powerdns-security-advisory-2012-01.html">
	 Using well crafted UDP packets, one or more PowerDNS servers
	 could be made to enter a tight packet loop, causing temporary
	 denial of service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0206</cvename>
 </references>
 <dates>
 <discovery>2012-01-10</discovery>
 <entry>2012-01-12</entry>
 </dates>
 </vuln>

<vuln vid="d3921810-3c80-11e1-97e8-00215c6a37bb">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5</name>
	<name>php5-exif</name>
	<range><lt>5.3.9</lt></range>
 </package>
 <package>
	<name>php52</name>
	<range><lt>5.2.17_5</lt></range>
 </package>
 <package>
	<name>php52-exif</name>
	<range><lt>5.2.17_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	php development team reports:
	<blockquote cite="http://www.php.net/archive/2012.php#id2012-01-11-1">
	 Security Enhancements and Fixes in PHP 5.3.9:
	 <ul>
	 <li>Added max_input_vars directive to prevent attacks
	 based on hash collisions. (CVE-2011-4885)</li>
	 <li>Fixed bug #60150 (Integer overflow during the parsing
	 of invalid exif header). (CVE-2011-4566)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4566</cvename>
 <cvename>CVE-2011-4885</cvename>
 <url>http://www.nruns.com/_downloads/advisory28122011.pdf</url>
 </references>
 <dates>
 <discovery>2011-12-29</discovery>
 <entry>2012-01-11</entry>
 <modified>2012-01-19</modified>
 </dates>
 </vuln>

<vuln vid="e7fd27b2-3ae9-11e1-8b5c-00262d5ed8ee">
 <topic>torcs -- untrusted local library loading</topic>
 <affects>
 <package>
	<name>torcs</name>
	<range><lt>1.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	TORCS News reports:
	<blockquote cite="http://torcs.sourceforge.net/index.php?name=News&amp;file=article&amp;sid=77">
	 An insecure change to LD_LIBRARY_PATH allows loading of libraries
	 in directories other than the standard paths. This can be a
	 problem when downloading and installing untrusted content from the
	 Internet.
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2010-3384</cvename>
	<url>http://torcs.sourceforge.net/index.php?name=News&amp;file=article&amp;sid=77</url>
	<url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=3089384&amp;group_id=3777&amp;atid=103777</url>
 </references>
 <dates>
 <discovery>2010-10-20</discovery>
 <entry>2012-01-09</entry>
 </dates>
 </vuln>

<vuln vid="a47af810-3a17-11e1-a1be-00e0815b8da8">
 <topic>spamdyke -- STARTTLS Plaintext Injection Vulnerability</topic>
 <affects>
 <package>
	<name>spamdyke</name>
	<range><lt>4.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/47435/">
	 The vulnerability is caused due to the TLS implementation not
	 properly clearing transport layer buffers when upgrading from
	 plaintext to ciphertext after receiving the "STARTTLS" command.
	 This can be exploited to insert arbitrary plaintext data (e.g.
	 SMTP commands) during the plaintext phase, which will then be
	 executed after upgrading to the TLS ciphertext phase.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2012-0070</cvename>
 <url>http://secunia.com/advisories/47435/</url>
 <url>http://www.spamdyke.org/documentation/Changelog.txt</url>
 </references>
 <dates>
 <discovery>2012-01-04</discovery>
 <entry>2012-01-08</entry>
 <modified>2012-01-23</modified>
 </dates>
 </vuln>

<vuln vid="0c7a3ee2-3654-11e1-b404-20cf30e32f6d">
 <topic>bugzilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><ge>2.4.*</ge><lt>3.6.7</lt></range>
	<range><ge>4.0.*</ge><lt>4.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla Security Advisory reports:
	<blockquote cite="http://www.bugzilla.org/security/3.4.12/">
	 The following security issues have been discovered in Bugzilla:
	 <ul>
	 <li>Tabular and graphical reports, as well as new charts have
	 a debug mode which displays raw data as plain text. This
	 text is not correctly escaped and a crafted URL could use
	 this vulnerability to inject code leading to XSS.</li>
	 <li>The User.offer_account_by_email WebService method ignores
	 the user_can_create_account setting of the authentication
	 method and generates an email with a token in it which the
	 user can use to create an account. Depending on the
	 authentication method being active, this could allow the
	 user to log in using this account.
	 Installations where the createemailregexp parameter is
	 empty are not vulnerable to this issue.</li>
	 <li>The creation of bug reports and of attachments is not
	 protected by a token and so they can be created without the
	 consent of a user if the relevant code is embedded in an
	 HTML page and the user visits this page. This behavior was
	 intentional to let third-party applications submit new bug
	 reports and attachments easily. But as this behavior can be
	 abused by a malicious user, it has been decided to block
	 submissions with no valid token starting from version 4.2rc1.
	 Older branches are not patched to not break these third-party
	 applications after the upgrade.</li>
	 </ul>
	 All affected installations are encouraged to upgrade as soon
	 as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3657</cvename>
 <cvename>CVE-2011-3667</cvename>
 <cvename>CVE-2011-3668</cvename>
 <cvename>CVE-2011-3669</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=697699</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=711714</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=703975</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=703983</url>
 </references>
 <dates>
 <discovery>2011-11-28</discovery>
 <entry>2012-01-05</entry>
 </dates>
 </vuln>

<vuln vid="810df820-3664-11e1-8fe3-00215c6a37bb">
 <topic>WordPress -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>3.3.1,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>3.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	WordPress development team reports:
	<blockquote cite="http://wordpress.org/news/2012/01/wordpress-3-3-1/">
	 WordPress 3.3.1 is now available. This maintenance release
	 fixes 15 issues with WordPress 3.3, as well as a fix for a
	 cross-site scripting vulnerability that affected version 3.3.
	 Thanks to Joshua H., Hoang T., Stefan Zimmerman, Chris K., and
	 the Go Daddy security team for responsibly disclosing the bug
	 to our security team.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://threatpost.com/en_us/blogs/xss-bug-found-wordpress-33-010312</url>
 </references>
 <dates>
 <discovery>2012-01-03</discovery>
 <entry>2012-01-03</entry>
 </dates>
 </vuln>

<vuln vid="048c77df-3211-11e1-9583-14dae938ec40">
 <topic>zabbix-frontend -- multiple XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>zabbix-frontend</name>
	<range><lt>1.8.10,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Martina Matari reports:
	<blockquote cite="https://support.zabbix.com/browse/ZBX-4015">
	 These URLs (hostgroups.php, usergrps.php) are vulnerable to
	 persistent XSS attacks due to improper sanitation of gname
	 variable when creating user and host groups.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://support.zabbix.com/browse/ZBX-4015</url>
 </references>
 <dates>
 <discovery>2011-08-04</discovery>
 <entry>2011-12-29</entry>
 </dates>
 </vuln>

<vuln vid="c6521b04-314b-11e1-9cf4-5404a67eef98">
 <topic>lighttpd -- remote DoS in HTTP authentication</topic>
 <affects>
 <package>
	<name>lighttpd</name>
	<range><lt>1.4.30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US-CERT/NIST reports:
	<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4362">
	 Integer signedness error in the base64_decode function in the
	 HTTP authentication functionality (http_auth.c) in lighttpd 1.4
	 before 1.4.30 and 1.5 before SVN revision 2806 allows remote
	 attackers to cause a denial of service (segmentation fault)
	 via crafted base64 input that triggers an out-of-bounds read
	 with a negative index.
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2011-4362</cvename>
 </references>
 <dates>
 <discovery>2011-11-29</discovery>
 <entry>2011-12-28</entry>
 </dates>
 </vuln>

<vuln vid="4ddc78dc-300a-11e1-a2aa-0016ce01e285">
 <topic>krb5-appl -- telnetd code execution vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_9</lt></range>
	<range><ge>7.4</ge><lt>7.4_5</lt></range>
	<range><ge>8.1</ge><lt>8.1_7</lt></range>
	<range><ge>8.2</ge><lt>8.2_5</lt></range>
 </package>
 <package>
	<name>krb5-appl</name>
	<range><lt>1.0.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MIT Kerberos Team reports:
	<blockquote cite="http://security.FreeBSD.org/advisories/FreeBSD-SA-11:08.telnetd.asc">
	 When an encryption key is supplied via the TELNET protocol,
	 its length is not validated before the key is copied into a
	 fixed-size buffer. Also see MITKRB5-SA-2011-008.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-11:08.telnetd</freebsdsa>
 <cvename>CVE-2011-4862</cvename>
 <url>http://security.FreeBSD.org/advisories/FreeBSD-SA-11:08.telnetd.asc</url>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-008.txt</url>
 </references>
 <dates>
 <discovery>2011-12-23</discovery>
 <entry>2011-12-26</entry>
 <modified>2012-01-29</modified>
 </dates>
 </vuln>

<vuln vid="022a4c77-2da4-11e1-b356-00215c6a37bb">
 <topic>proftpd -- arbitrary code execution vulnerability with chroot</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_9</lt></range>
	<range><ge>7.4</ge><lt>7.4_5</lt></range>
	<range><ge>8.1</ge><lt>8.1_6</lt></range>
	<range><ge>8.2</ge><lt>8.2_5</lt></range>
 </package>
 <package>
	<name>proftpd</name>
	<name>proftpd-mysql</name>
	<range><lt>1.3.3g_1</lt></range>
 </package>
 <package>
	<name>proftpd-devel</name>
	<range><lt>1.3.3.r4_3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The FreeBSD security advisory FreeBSD-SA-11:07.chroot reports:
	<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:07.chroot.asc">
	 If ftpd is configured to place a user in a chroot environment,
	 then an attacker who can log in as that user may be able to run
	 arbitrary code(...).
	</blockquote>
	Proftpd shares the same problem of a similar nature.
 </body>
 </description>
 <references>
 <freebsdsa>SA-11:07.chroot</freebsdsa>
 <url>http://seclists.org/fulldisclosure/2011/Nov/452</url>
 </references>
 <dates>
 <discovery>2011-11-30</discovery>
 <entry>2011-12-23</entry>
 <modified>2012-01-29</modified>
 </dates>
 </vuln>

<vuln vid="8c83145d-2c95-11e1-89b4-001ec9578670">
 <topic>phpMyAdmin -- Multiple XSS</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><gt>3.4</gt><lt>3.4.9.r1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php">
	 Using crafted url parameters, it was possible to produce XSS on
	 the export panels in the server, database and table sections.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php">
	 Crafted values entered in the setup interface can produce XSS;
	 also, if the config directory exists and is writeable, the XSS
	 payload can be saved to this directory.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4780</cvename>
 <cvename>CVE-2011-4782</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php</url>
 </references>
 <dates>
 <discovery>2011-12-16</discovery>
 <entry>2011-12-22</entry>
 </dates>
 </vuln>

<vuln vid="e3ff776b-2ba6-11e1-93c6-0011856a6e37">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>4.0,1</gt><lt>9.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>9.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.6</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>9.0</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.6</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>4.0</gt><lt>9.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)
	 MFSA 2011-54 Potentially exploitable crash in the YARR regular
	 expression library
	 MFSA 2011-55 nsSVGValue out-of-bounds access
	 MFSA 2011-56 Key detection without JavaScript via SVG
	 animation
	 MFSA 2011-58 Crash scaling video to extreme sizes
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2011-3658</cvename>
	<cvename>CVE-2011-3660</cvename>
	<cvename>CVE-2011-3661</cvename>
	<cvename>CVE-2011-3663</cvename>
	<cvename>CVE-2011-3665</cvename>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-53.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-54.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-55.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-56.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-58.html</url>
 </references>
 <dates>
 <discovery>2011-12-20</discovery>
 <entry>2011-12-21</entry>
 <modified>2011-12-21</modified>
 </dates>
 </vuln>

<vuln vid="7ba65bfd-2a40-11e1-b96e-00215af774f0">
 <topic>unbound -- denial of service vulnerabilities from nonstandard redirection and denial of existence</topic>
 <affects>
 <package>
	<name>unbound</name>
	<range><lt>1.4.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Unbound developer reports:
	<blockquote cite="http://www.unbound.net/downloads/CVE-2011-4528.txt">
	 Unbound crashes when confronted with a non-standard response
	 from a server for a domain. This domain produces duplicate RRs
	 from a certain type and is DNSSEC signed. Unbound also crashes
	 when confronted with a query that eventually, and under specific
	 circumstances, resolves to a domain that misses expected NSEC3
	 records.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4528</cvename>
 <url>http://unbound.nlnetlabs.nl/downloads/CVE-2011-4528.txt</url>
 </references>
 <dates>
 <discovery>2011-12-19</discovery>
 <entry>2011-12-19</entry>
 </dates>
 </vuln>

<vuln vid="3c957a3e-2978-11e1-89b4-001ec9578670">
 <topic>typo3 -- Remote Code Execution</topic>
 <affects>
 <package>
	<name>typo3</name>
	<range><ge>4.6</ge><lt>4.6.2</lt></range>
	<range><lt>4.5.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The typo3 security team reports:
	<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004/">
	 A crafted request to a vulnerable TYPO3 installation will allow
	 an attacker to load PHP code from an external source and to
	 execute it on the TYPO3 installation.
	 This is caused by a PHP file, which is part of the workspaces
	 system extension, that does not validate passed arguments.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4614</cvename>
 <url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004/</url>
 </references>
 <dates>
 <discovery>2011-12-16</discovery>
 <entry>2011-12-18</entry>
 </dates>
 </vuln>

<vuln vid="6c7d9a35-2608-11e1-89b4-001ec9578670">
 <topic>krb5 -- KDC null pointer dereference in TGS handling</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><ge>1.9</ge><lt>1.9.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MIT Kerberos Team reports:
	<blockquote cite="http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-007.txt">
	 In releases krb5-1.9 and later, the KDC can crash due to a NULL
	 pointer dereference in code that handles TGS (Ticket Granting
	 Service) requests. The trigger condition is trivial to produce
	 using unmodified client software, but requires the ability to
	 authenticate as a principal in the KDC's realm.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1530</cvename>
 <url>http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-007.txt</url>
 </references>
 <dates>
 <discovery>2011-12-11</discovery>
 <entry>2011-12-14</entry>
 </dates>
 </vuln>

<vuln vid="a4a809d8-25c8-11e1-b531-00215c6a37bb">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>linux-opera</name>
	<range><lt>11.60</lt></range>
 </package>
 <package>
	<name>opera-devel</name>
	<range><lt>11.60,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera software reports:
	<blockquote cite="http://www.opera.com/docs/changelogs/unix/1160/">
	 <ul>
	 <li>Fixed a moderately severe issue; details will be
	 disclosed at a later date</li>
	 <li>Fixed an issue that could allow pages to set cookies
	 or communicate cross-site for some top level domains;
	 see our <a href="http://www.opera.com/support/kb/view/1003/">advisory</a></li>
	 <li>Improved handling of certificate revocation corner
	 cases</li>
	 <li>Added a fix for a weakness in the SSL v3.0 and TLS 1.0
	 specifications, as reported by Thai Duong and Juliano Rizzo;
	 see our <a href="http://www.opera.com/support/kb/view/1004/">advisory</a></li>
	 <li>Fixed an issue where the JavaScript "in" operator
	 allowed leakage of cross-domain information, as reported
	 by David Bloom; see our <a href="http://www.opera.com/support/kb/view/1005/">advisory</a></li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3389</cvename>
 <cvename>CVE-2011-4681</cvename>
 <cvename>CVE-2011-4682</cvename>
 <cvename>CVE-2011-4683</cvename>
 <url>http://www.opera.com/support/kb/view/1003/</url>
 <url>http://www.opera.com/support/kb/view/1004/</url>
 <url>http://www.opera.com/support/kb/view/1005/</url>
 </references>
 <dates>
 <discovery>2011-12-06</discovery>
 <entry>2011-12-13</entry>
 </dates>
 </vuln>

<vuln vid="bbd5f486-24f1-11e1-95bc-080027ef73ec">
 <topic>PuTTY -- Password vulnerability</topic>
 <affects>
 <package>
	<name>putty</name>
	<range><ge>0.59</ge><lt>0.62</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Tatham reports:
	<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2011/000017.html">
	 PuTTY 0.62 fixes a security issue present in 0.59, 0.60 and 0.61.
	 If you log in using SSH-2 keyboard-interactive authentication
	 (which is the usual method used by modern servers to request a
	 password), the password you type was accidentally kept in PuTTY's
	 memory for the rest of its run, where it could be retrieved by
	 other processes reading PuTTY's memory, or written out to swap
	 files or crash dumps.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4607</cvename>
 <mlist>http://lists.tartarus.org/pipermail/putty-announce/2011/000017.html</mlist>
 <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/password-not-wiped.html</url>
 </references>
 <dates>
 <discovery>2011-12-10</discovery>
 <entry>2011-12-12</entry>
 <modified>2013-08-07</modified>
 </dates>
 </vuln>

<vuln vid="bb389137-21fb-11e1-89b4-001ec9578670">
 <topic>asterisk -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk18</name>
	<range><lt>1.8.7.2</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><lt>1.6.2.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Asterisk project reports:
	<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2011-013.html">
	 It is possible to enumerate SIP usernames when the general and
	 user/peer NAT settings differ in whether to respond to the port
	 a request is sent from or the port listed for responses in the
	 Via header.
	</blockquote>
	<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2011-014.html">
	 When the "automon" feature is enabled in features.conf, it is
	 possible to send a sequence of SIP requests that cause Asterisk
	 to dereference a NULL pointer and crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4597</cvename>
 <cvename>CVE-2011-4598</cvename>
 <url>http://downloads.asterisk.org/pub/security/AST-2011-013.html</url>
 <url>http://downloads.asterisk.org/pub/security/AST-2011-014.html</url>
 </references>
 <dates>
 <discovery>2011-12-08</discovery>
 <entry>2011-12-09</entry>
 </dates>
 </vuln>

<vuln vid="93be487e-211f-11e1-89b4-001ec9578670">
 <topic>isc-dhcp-server -- Remote DoS</topic>
 <affects>
 <package>
	<name>isc-dhcp42-server</name>
	<range><lt>4.2.3_1</lt></range>
 </package>
 <package>
	<name>isc-dhcp41-server</name>
	<range><lt>4.1.e_3,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-4539">
	 A bug exists which allows an attacker who is able to send DHCP
	 Request packets, either directly or through a relay, to remotely
	 crash an ISC DHCP server if that server is configured to evaluate
	 expressions using a regular expression (i.e. uses the "~=" or
	 "~~" comparison operators).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4539</cvename>
 </references>
 <dates>
 <discovery>2011-12-07</discovery>
 <entry>2011-12-07</entry>
 </dates>
 </vuln>

<vuln vid="ed536336-1c57-11e1-86f4-e0cb4e266481">
 <topic>phpMyAdmin -- Multiple XSS</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><gt>3.4</gt><lt>3.4.8.r1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php">
	 Using crafted database names, it was possible to produce XSS
	 in the Database Synchronize and Database rename panels. Using
	 an invalid and crafted SQL query, it was possible to produce
	 XSS when editing a query on a table overview panel or when
	 using the view creation dialog. Using a crafted column type,
	 it was possible to produce XSS in the table search and create
	 index dialogs.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4634</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php</url>
 </references>
 <dates>
 <discovery>2011-11-24</discovery>
 <entry>2011-12-01</entry>
 </dates>
 </vuln>

<vuln vid="eef56761-11eb-11e1-bb94-001c140104d4">
 <topic>hiawatha -- memory leak in PreventSQLi routine</topic>
 <affects>
 <package>
	<name>hiawatha</name>
	<range><ge>7.6</ge><lt>7.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hugo Leisink reports via private mail to maintainer:
	<blockquote>
	 The memory leak was introduced in version 7.6. It is in the
	 routing that checks for SQL injections. So, if you have set
	 PreventSQLi to 'no', there is no problem.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.hiawatha-webserver.org/changelog</url>
 </references>
 <dates>
 <discovery>2011-11-18</discovery>
 <entry>2011-11-18</entry>
 </dates>
 </vuln>

<vuln vid="90cc1494-10ac-11e1-b3ec-0024e830109b">
 <topic>BIND -- Remote DOS</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_9</lt></range>
	<range><ge>7.4</ge><lt>7.4_5</lt></range>
	<range><ge>8.1</ge><lt>8.1_7</lt></range>
	<range><ge>8.2</ge><lt>8.2_5</lt></range>
 </package>
 <package>
	<name>bind96</name>
	<range><lt>9.6.3.1.ESV.R5.1</lt></range>
 </package>
 <package>
	<name>bind97</name>
	<range><lt>9.7.4.1</lt></range>
 </package>
 <package>
	<name>bind98</name>
	<range><lt>9.8.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Internet Systems Consortium reports:
	<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-4313">
	 Organizations across the Internet reported crashes interrupting
	 service on BIND 9 nameservers performing recursive queries.
	 Affected servers crashed after logging an error in query.c with
	 the following message: "INSIST(! dns_rdataset_isassociated(sigrdataset))"
	 Multiple versions were reported being affected, including all
	 currently supported release versions of ISC BIND 9.
	 Because it may be possible to trigger this bug even on networks
	 that do not allow untrusted users to access the recursive name
	 servers (perhaps via specially crafted e-mail messages, and/or
	 malicious web sites) it is recommended that ALL operators of
	 recursive name servers upgrade immediately.
	</blockquote>
 </body>
 </description>
 <references>
	<freebsdsa>SA-11:06.bind</freebsdsa>
	<cvename>CVE-2011-4313</cvename>
	<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313</url>
	<url>https://www.isc.org/software/bind/advisories/cve-2011-4313</url>
 </references>
 <dates>
 <discovery>2011-11-16</discovery>
 <entry>2011-11-16</entry>
 <modified>2012-01-29</modified>
 </dates>
 </vuln>

<vuln vid="d8c901ff-0f0f-11e1-902b-20cf30e32f6d">
 <topic>Apache 1.3 -- mod_proxy reverse proxy exposure</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><lt>1.3.43</lt></range>
 </package>
 <package>
	<name>apache+ssl</name>
	<range><lt>1.3.43.1.59_2</lt></range>
 </package>
 <package>
	<name>apache+ipv6</name>
	<range><lt>1.3.43</lt></range>
 </package>
 <package>
	<name>apache+mod_perl</name>
	<range><lt>1.3.43</lt></range>
 </package>
 <package>
	<name>apache+mod_ssl</name>
	<range><lt>1.3.41+2.8.31_4</lt></range>
 </package>
 <package>
	<name>apache+mod_ssl+ipv6</name>
	<range><lt>1.3.41+2.8.31_4</lt></range>
 </package>
 <package>
	<name>ru-apache-1.3</name>
	<range><lt>1.3.43+30.23_1</lt></range>
 </package>
 <package>
	<name>ru-apache+mod_ssl</name>
	<range><lt>1.3.43+30.23_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache HTTP server project reports:
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_13.html">
	 An exposure was found when using mod_proxy in reverse proxy mode.
	 In certain configurations using RewriteRule with proxy flag, a
	 remote attacker could cause the reverse proxy to connect to an
	 arbitrary server, possibly disclosing sensitive information from
	 internal web servers not directly accessible to attacker. There
	 is no patch against this issue!
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2011-3368</cvename>
	<url>http://httpd.apache.org/security/vulnerabilities_13.html</url>
	<url>http://seclists.org/fulldisclosure/2011/Oct/232</url>
 </references>
 <dates>
 <discovery>2011-10-05</discovery>
 <entry>2011-11-14</entry>
 </dates>
 </vuln>

<vuln vid="7fb9e739-0e6d-11e1-87cd-00235a5f2c9a">
 <topic>kdeutils4 -- Directory traversal vulnerability</topic>
 <affects>
 <package>
	<name>kdeutils</name>
	<range><ge>4.0.*</ge><lt>4.7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tim Brown from Nth Dimention reports:
	<blockquote cite="http://seclists.org/fulldisclosure/2011/Oct/351">
	 I recently discovered that the Ark archiving tool is vulnerable
	 to directory traversal via malformed. When attempts are made to
	 view files within the malformed Zip file in Ark's default view,
	 the wrong file may be displayed due to incorrect construction of
	 the temporary file name. Whilst this does not allow the wrong
	 file to be overwritten, after closing the default view, Ark will
	 then attempt to delete the temporary file which could result in
	 the deletion of the incorrect file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2725</cvename>
 <url>http://seclists.org/fulldisclosure/2011/Oct/351</url>
 </references>
 <dates>
 <discovery>2011-10-19</discovery>
 <entry>2011-11-14</entry>
 </dates>
 </vuln>

<vuln vid="38560d79-0e42-11e1-902b-20cf30e32f6d">
 <topic>Apache APR -- DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>apr0</name>
	<range><lt>0.9.20.0.9.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Portable Runtime Project reports:
	<blockquote cite="http://www.apache.org/dist/apr/CHANGES-APR-0.9">
	 Reimplement apr_fnmatch() from scratch using a non-recursive
	 algorithm; now has improved compliance with the fnmatch()
	 spec.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0419</cvename>
 <url>http://www.apache.org/dist/apr/Announcement0.9.html</url>
 </references>
 <dates>
 <discovery>2011-05-19</discovery>
 <entry>2011-11-13</entry>
 </dates>
 </vuln>

<vuln vid="1f6ee708-0d22-11e1-b5bd-14dae938ec40">
 <topic>phpmyadmin -- Local file inclusion</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><gt>3.4</gt><lt>3.4.7.1</lt></range>
	<range><lt>3.3.10.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jan Lieskovsky reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php">
	 Importing a specially-crafted XML file which contains an XML
	 entity injection permits to retrieve a local file (limited by the
	 privileges of the user running the web server).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4107</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php</url>
 </references>
 <dates>
 <discovery>2011-11-10</discovery>
 <entry>2011-11-12</entry>
 </dates>
 </vuln>

<vuln vid="0e8e1212-0ce5-11e1-849b-003067b2972c">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.3r183.11</lt></range>
	<range><gt>11</gt><lt>11.1r102.55</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb11-28.html">
	 Critical vulnerabilities have been identified in Adobe Flash
	 Player 11.0.1.152 and earlier versions for Windows, Macintosh,
	 Linux and Solaris, and Adobe Flash Player 11.0.1.153 and earlier
	 versions for Android.
	</blockquote>
	In addition a patch was released for users of flash10.
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2445</cvename>
 <cvename>CVE-2011-2450</cvename>
 <cvename>CVE-2011-2451</cvename>
 <cvename>CVE-2011-2452</cvename>
 <cvename>CVE-2011-2453</cvename>
 <cvename>CVE-2011-2454</cvename>
 <cvename>CVE-2011-2455</cvename>
 <cvename>CVE-2011-2456</cvename>
 <cvename>CVE-2011-2457</cvename>
 <cvename>CVE-2011-2458</cvename>
 <cvename>CVE-2011-2459</cvename>
 <cvename>CVE-2011-2460</cvename>
 <url>https://www.adobe.com/support/security/bulletins/apsb11-28.html</url>
 </references>
 <dates>
 <discovery>2011-11-10</discovery>
 <entry>2011-11-11</entry>
 </dates>
 </vuln>

<vuln vid="7be92050-a450-11e2-9898-001060e06fd4">
 <topic>libxml -- Integer overflow</topic>
 <affects>
 <package>
	<name>libxml</name>
	<range><lt>1.8.17_5</lt></range>
 </package>
 <package>
	<name>libxml2</name>
	<name>linux-f10-libxml2</name>
	<range><lt>2.7.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Integer overflow in xpath.c, allows context-dependent attackers
	 to to cause a denial of service (crash) and possibly execute
	 arbitrary code via a crafted XML file that triggers a heap-based
	 buffer overflow when adding a new namespace node, related to
	 handling of XPath expressions.
 </body>
 </description>
 <references>
	<cvename>CVE-2011-1944</cvename>
 </references>
 <dates>
 <discovery>2011-09-02</discovery>
 <entry>2011-11-10</entry>
 <modified>2011-11-12</modified>
 </dates>
 </vuln>

<vuln vid="ce4b3af8-0b7c-11e1-846b-00235409fd3e">
 <topic>libxml -- Multiple use-after-free vulnerabilities</topic>
 <affects>
 <package>
	<name>libxml</name>
	<range><lt>1.8.17_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple use-after-free vulnerabilities in libxml 1.8.17 that
	 allow context-dependent attackers to cause a denial of service
	 (application crash) via crafted (1) Notation or (2) Enumeration
	 attribute types in an XML file.
 </body>
 </description>
 <references>
	<cvename>CVE-2009-2416</cvename>
 </references>
 <dates>
 <discovery>2009-08-03</discovery>
 <entry>2011-11-10</entry>
 <modified>2011-11-12</modified>
 </dates>
 </vuln>

<vuln vid="5a7d4110-0b7a-11e1-846b-00235409fd3e">
 <topic>libxml -- Stack consumption vulnerability</topic>
 <affects>
 <package>
	<name>libxml</name>
	<range><lt>1.8.17_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stack consumption vulnerability allows context-dependent
	 attackers to cause a denial of service (application crash) via
	 a large depth of element declarations in a DTD.
 </body>
 </description>
 <references>
	<cvename>CVE-2009-2414</cvename>
 </references>
 <dates>
 <discovery>2009-08-03</discovery>
 <entry>2011-11-10</entry>
 <modified>2011-11-12</modified>
 </dates>
 </vuln>

<vuln vid="bdec8dc2-0b3b-11e1-b722-001cc0476564">
 <topic>gnutls -- client session resumption vulnerability</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>2.12.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GnuTLS team reports:
	<blockquote cite="http://www.gnu.org/software/gnutls/security.html">
	 GNUTLS-SA-2011-2 Possible buffer overflow/Denial of service.
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2011-4128</cvename>
	<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5596</url>
 </references>
 <dates>
 <discovery>2011-11-08</discovery>
 <entry>2011-11-10</entry>
 </dates>
 </vuln>

<vuln vid="6c8ad3e8-0a30-11e1-9580-4061862b8c22">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>4.0,1</gt><lt>8.0,1</lt></range>
	<range><gt>3.6.*,1</gt><lt>3.6.24,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.24</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>8.0,1</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>8.0</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>4.0</gt><lt>8.0</lt></range>
	<range><lt>3.1.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2011-46 loadSubScript unwraps XPCNativeWrapper scope
	 parameter (1.9.2 branch)
	 MFSA 2011-47 Potential XSS against sites using Shift-JIS
	 MFSA 2011-48 Miscellaneous memory safety hazards (rv:8.0)
	 MFSA 2011-49 Memory corruption while profiling using Firebug
	 MFSA 2011-50 Cross-origin data theft using canvas and Windows
	 D2D
	 MFSA 2011-51 Cross-origin image theft on Mac with integrated
	 Intel GPU
	 MFSA 2011-52 Code execution via NoWaiverWrapper
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2011-3647</cvename>
	<cvename>CVE-2011-3648</cvename>
	<cvename>CVE-2011-3649</cvename>
	<cvename>CVE-2011-3650</cvename>
	<cvename>CVE-2011-3651</cvename>
	<cvename>CVE-2011-3652</cvename>
	<cvename>CVE-2011-3653</cvename>
	<cvename>CVE-2011-3654</cvename>
	<cvename>CVE-2011-3655</cvename>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-46.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-47.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-48.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-49.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-50.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-51.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-52.html</url>
 </references>
 <dates>
 <discovery>2011-11-08</discovery>
 <entry>2011-11-08</entry>
 </dates>
 </vuln>

<vuln vid="9dde9dac-08f4-11e1-af36-003067b2972c">
 <topic>caml-light -- insecure use of temporary files</topic>
 <affects>
 <package>
	<name>caml-light</name>
	<range><le>0.75</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	caml-light uses mktemp() insecurely, and also does
	 unsafe things in /tmp during make install.
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4119</cvename>
 <mlist msgid="20111106200911.GC13652@netbsd.org">http://seclists.org/oss-sec/2011/q4/249</mlist>
 </references>
 <dates>
 <discovery>2011-11-02</discovery>
 <entry>2011-11-06</entry>
 </dates>
 </vuln>

<vuln vid="54075e39-04ac-11e1-a94e-bcaec565249c">
 <topic>freetype -- Some type 1 fonts handling vulnerabilities</topic>
 <affects>
 <package>
	<name>freetype2</name>
	<range><lt>2.4.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The FreeType project reports:
	<blockquote cite="http://sourceforge.net/projects/freetype/files/freetype2/2.4.7/README/view">
	 A couple of vulnerabilities in handling Type 1 fonts.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3256</cvename>
 <url>http://sourceforge.net/projects/freetype/files/freetype2/2.4.7/README/view</url>
 <url>https://bugzilla.redhat.com/attachment.cgi?id=528829&amp;action=diff</url>
 </references>
 <dates>
 <discovery>2011-10-12</discovery>
 <entry>2011-11-01</entry>
 </dates>
 </vuln>

<vuln vid="f08e2c15-ffc9-11e0-b0f3-bcaec565249c">
 <topic>cacti -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>0.8.7h</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Cacti Group reports:
	<blockquote cite="http://www.cacti.net/release_notes_0_8_7h.php">
	 SQL injection issue with user login, and cross-site scripting
	 issues.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.cacti.net/release_notes_0_8_7h.php</url>
 </references>
 <dates>
 <discovery>2011-09-26</discovery>
 <entry>2011-10-26</entry>
 </dates>
 </vuln>

<vuln vid="395e0faa-ffa7-11e0-8ac4-6c626dd55a41">
 <topic>phpmyfaq -- Remote PHP Code Injection Vulnerability</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><lt>2.6.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyFAQ project reports:
	<blockquote cite="http://www.phpmyfaq.de/advisory_2011-10-25.php">
	 The phpMyFAQ Team has learned of a serious security issue that
	 has been discovered in our bundled ImageManager library we use
	 in phpMyFAQ 2.6 and 2.7. The bundled ImageManager library
	 allows injection of arbitrary PHP code via POST requests.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyfaq.de/advisory_2011-10-25.php</url>
 <url>http://forum.phpmyfaq.de/viewtopic.php?f=3&amp;t=13402</url>
 </references>
 <dates>
 <discovery>2011-10-25</discovery>
 <entry>2011-10-26</entry>
 </dates>
 </vuln>

<vuln vid="edf47177-fe3f-11e0-a207-0014a5e3cda6">
 <topic>phpLDAPadmin -- Remote PHP code injection vulnerability</topic>
 <affects>
 <package>
	<name>phpldapadmin</name>
	<range><ge>1.2.0</ge><lt>1.2.1.1_1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	EgiX (n0b0d13s at gmail dot com) reports:
	<blockquote cite="http://packetstormsecurity.org/files/106120/phpldapadmin-inject.txt">
	 The $sortby parameter passed to 'masort' function in file
	 lib/functions.php isn't properly sanitized before being used in
	 a call to create_function() at line 1080. This can be exploited
	 to inject and execute arbitrary PHP code. The only possible
	 attack vector is when handling the 'query_engine' command, in
	 which input passed through $_REQUEST['orderby'] is passed as
	 $sortby parameter to 'masort' function.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://packetstormsecurity.org/files/106120/phpldapadmin-inject.txt</url>
 <url>http://sourceforge.net/tracker/?func=detail&amp;aid=3417184&amp;group_id=61828&amp;atid=498546</url>
 </references>
 <dates>
 <discovery>2011-10-23</discovery>
 <entry>2011-10-24</entry>
 </dates>
 </vuln>

<vuln vid="6d21a287-fce0-11e0-a828-00235a5f2c9a">
 <topic>kdelibs4, rekonq -- input validation failure</topic>
 <affects>
 <package>
	<name>kdelibs</name>
	<range><ge>4.0.*</ge><lt>4.7.2</lt></range>
 </package>
 <package>
	<name>rekonq</name>
	<range><lt>0.8.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	KDE Security Advisory reports:
	<blockquote cite="http://www.kde.org/info/security/advisory-20111003-1.txt">
	 The default rendering type for a QLabel is QLabel::AutoText,
	 which uses heuristics to determine whether to render the given
	 content as plain text or rich text. KSSL and Rekonq did not
	 properly force its QLabels to use QLabel::PlainText. As a result,
	 if given a certificate containing rich text in its fields, they
	 would render the rich text. Specifically, a certificate
	 containing a common name (CN) that has a table element will cause
	 the second line of the table to be displayed. This can allow
	 spoofing of the certificate's common name.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.kde.org/info/security/advisory-20111003-1.txt</url>
 <url>http://www.nth-dimension.org.uk/pub/NDSA20111003.txt.asc</url>
 <cvename>CVE-2011-3365</cvename>
 <cvename>CVE-2011-3366</cvename>
 </references>
 <dates>
 <discovery>2011-10-03</discovery>
 <entry>2011-10-23</entry>
 </dates>
 </vuln>

<vuln vid="411ecb79-f9bc-11e0-a7e6-6c626dd55a41">
 <topic>piwik -- unknown critical vulnerabilities</topic>
 <affects>
 <package>
	<name>piwik</name>
	<range><gt>1.1</gt><lt>1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/46461/">
	 Multiple vulnerabilities with an unknown impact have been
	 reported in Piwik. The vulnerabilities are caused due to
	 unspecified errors. No further information is currently
	 available.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/46461/</url>
 <url>http://piwik.org/blog/2011/10/piwik-1-6/</url>
 </references>
 <dates>
 <discovery>2011-10-18</discovery>
 <entry>2011-10-20</entry>
 </dates>
 </vuln>

<vuln vid="8441957c-f9b4-11e0-a78a-bcaec565249c">
 <topic>Xorg server -- two vulnerabilities in X server lock handling code</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<range><lt>1.7.7_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthieu Herrb reports:
	<blockquote cite="http://lists.freedesktop.org/archives/xorg-announce/2011-October/001744.html">
	 It is possible to deduce if a file exists or not by exploiting
	 the way that Xorg creates its lock files. This is caused by the
	 fact that the X server is behaving differently if the lock file
	 already exists as a symbolic link pointing to an existing or
	 non-existing file.
	 It is possible for a non-root user to set the permissions for
	 all users on any file or directory to 444, giving unwanted read
	 access or causing denies of service (by removing execute
	 permission). This is caused by a race between creating the lock
	 file and setting its access modes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4028</cvename>
 <cvename>CVE-2011-4029</cvename>
 </references>
 <dates>
 <discovery>2011-10-18</discovery>
 <entry>2011-10-18</entry>
 </dates>
 </vuln>

<vuln vid="a95092a6-f8f1-11e0-a7ea-00215c6a37bb">
 <topic>asterisk -- remote crash vulnerability in SIP channel driver</topic>
 <affects>
 <package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.7.1</lt></range>
 </package>
 <package>
	<name>asterisk</name>
	<range><gt>10.0.0.*</gt><lt>10.0.0.r1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Asterisk project reports:
	<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2011-012.html">
	 A remote authenticated user can cause a crash with a malformed
	 request due to an unitialized variable.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-4063</cvename>
 </references>
 <dates>
 <discovery>2011-10-17</discovery>
 <entry>2011-10-17</entry>
 </dates>
 </vuln>

<vuln vid="e454ca2f-f88d-11e0-b566-00163e01a509">
 <topic>PivotX -- Remote File Inclusion Vulnerability of TimThumb</topic>
 <affects>
 <package>
	<name>pivotx</name>
	<range><lt>2.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PivotX team reports:
	<blockquote cite="http://blog.pivotx.net/page/security">
	 TimThumb domain name security bypass and insecure cache
	 handling. PivotX before 2.3.0 includes a vulnerable version
	 of TimThumb.
	</blockquote>
	<blockquote cite="http://blog.pivotx.net/2011-10-14/timthumb-update-for-older-pivotx-installs">
	 If you are still running PivotX 2.2.6, you might be vulnerable
	 to a security exploit, that was patched previously. Version
	 2.3.0 doesn't have this issue, but any older version of PivotX
	 might be vulnerable.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>48963</bid>
 <url>https://secunia.com/advisories/45416/</url>
 </references>
 <dates>
 <discovery>2011-08-03</discovery>
 <entry>2011-10-17</entry>
 </dates>
 </vuln>

<vuln vid="9bad5ab1-f3f6-11e0-8b5c-b482fe3f522d">
 <topic>OpenTTD -- Multiple buffer overflows in validation of external data</topic>
 <affects>
 <package>
	<name>openttd</name>
	<range><ge>0.1.0</ge><lt>1.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenTTD Team reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3343">
	 Multiple buffer overflows in OpenTTD before 1.1.3 allow local
	 users to cause a denial of service (daemon crash) or possibly
	 gain privileges via (1) a crafted BMP file with RLE compression
	 or (2) crafted dimensions in a BMP file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3343</cvename>
 <url>http://security.openttd.org/en/CVE-2011-3343</url>
 </references>
 <dates>
 <discovery>2011-08-25</discovery>
 <entry>2011-10-16</entry>
 </dates>
 </vuln>

<vuln vid="78c25ed7-f3f9-11e0-8b5c-b482fe3f522d">
 <topic>OpenTTD -- Buffer overflows in savegame loading</topic>
 <affects>
 <package>
	<name>openttd</name>
	<range><ge>0.1.0</ge><lt>1.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenTTD Team reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3342">
	 Multiple buffer overflows in OpenTTD before 1.1.3 allow remote
	 attackers to cause a denial of service (daemon crash) or possibly
	 execute arbitrary code via vectors related to (1) NAME, (2) PLYR,
	 (3) CHTS, or (4) AIPL (aka AI config) chunk loading from a
	 savegame.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3342</cvename>
 <url>http://security.openttd.org/en/CVE-2011-3342</url>
 </references>
 <dates>
 <discovery>2011-08-08</discovery>
 <entry>2011-10-16</entry>
 </dates>
 </vuln>

<vuln vid="e77befb5-f3f9-11e0-8b5c-b482fe3f522d">
 <topic>OpenTTD -- Denial of service via improperly validated commands</topic>
 <affects>
 <package>
	<name>openttd</name>
	<range><ge>0.3.5</ge><lt>1.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenTTD Team reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3341">
	 Multiple off-by-one errors in order_cmd.cpp in OpenTTD before
	 1.1.3 allow remote attackers to cause a denial of service (daemon
	 crash) or possibly execute arbitrary code via a crafted
	 CMD_INSERT_ORDER command.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3341</cvename>
 <url>http://security.openttd.org/en/CVE-2011-3341</url>
 </references>
 <dates>
 <discovery>2011-08-25</discovery>
 <entry>2011-10-16</entry>
 </dates>
 </vuln>

<vuln vid="ab9be2c8-ef91-11e0-ad5a-00215c6a37bb">
 <topic>quagga -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>quagga</name>
	<range><lt>0.99.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CERT-FI reports:
	<blockquote cite="https://www.cert.fi/en/reports/2011/vulnerability539178.html">
	 Five vulnerabilities have been found in the BGP, OSPF, and
	 OSPFv3 components of Quagga. The vulnerabilities allow an
	 attacker to cause a denial of service or potentially to
	 execute his own code by sending a specially modified packets
	 to an affected server. Routing messages are typically accepted
	 from the routing peers. Exploiting these vulnerabilities may
	 require an established routing session (BGP peering or
	 OSPF/OSPFv3 adjacency) to the router.
	 The vulnerability <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3327">CVE-2011-3327</a>
	 is related to the extended communities handling in BGP
	 messages. Receiving a malformed BGP update can result
	 in a buffer overflow and disruption of IPv4 routing.
	 The vulnerability <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3326">CVE-2011-3326</a>
	 results from the handling of LSA (Link State Advertisement)
	 states in the OSPF service. Receiving a modified Link State
	 Update message with malicious state information can result in
	 denial of service in IPv4 routing.
	 The vulnerability <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3325">CVE-2011-3325</a>
	 is a denial of service vulnerability related to Hello message
	 handling by the OSPF service. As Hello messages are used to
	 initiate adjacencies, exploiting the vulnerability may be
	 feasible from the same broadcast domain without an established
	 adjacency. A malformed packet may result in denial of service
	 in IPv4 routing.
	 The vulnerabilities <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3324">CVE-2011-3324</a>
	 and <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3323">CVE-2011-3323</a>
	 are related to the IPv6 routing protocol (OSPFv3) implemented
	 in ospf6d daemon. Receiving modified Database Description and
	 Link State Update messages, respectively, can result in denial
	 of service in IPv6 routing.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3323</cvename>
 <cvename>CVE-2011-3324</cvename>
 <cvename>CVE-2011-3325</cvename>
 <cvename>CVE-2011-3326</cvename>
 <cvename>CVE-2011-3327</cvename>
 </references>
 <dates>
 <discovery>2011-09-26</discovery>
 <entry>2011-10-05</entry>
 </dates>
 </vuln>

<vuln vid="1fade8a3-e9e8-11e0-9580-4061862b8c22">
 <topic>Mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>4.0,1</gt><lt>7.0,1</lt></range>
	<range><gt>3.6.*,1</gt><lt>3.6.23,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.23</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>7.0,1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.4</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>7.0</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.4</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>4.0</gt><lt>7.0</lt></range>
	<range><lt>3.1.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2011-36 Miscellaneous memory safety hazards (rv:7.0 /
	 rv:1.9.2.23)
	 MFSA 2011-37 Integer underflow when using JavaScript RegExp
	 MFSA 2011-38 XSS via plugins and shadowed window.location
	 object
	 MFSA 2011-39 Defense against multiple Location headers due to
	 CRLF Injection
	 MFSA 2011-40 Code installation through holding down Enter
	 MFSA 2011-41 Potentially exploitable WebGL crashes
	 MFSA 2011-42 Potentially exploitable crash in the YARR regular
	 expression library
	 MFSA 2011-43 loadSubScript unwraps XPCNativeWrapper scope
	 parameter
	 MFSA 2011-44 Use after free reading OGG headers
	 MFSA 2011-45 Inferring Keystrokes from motion data
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2011-2372</cvename>
	<cvename>CVE-2011-2995</cvename>
	<cvename>CVE-2011-2996</cvename>
	<cvename>CVE-2011-2997</cvename>
	<cvename>CVE-2011-2999</cvename>
	<cvename>CVE-2011-3000</cvename>
	<cvename>CVE-2011-3001</cvename>
	<cvename>CVE-2011-3002</cvename>
	<cvename>CVE-2011-3003</cvename>
	<cvename>CVE-2011-3004</cvename>
	<cvename>CVE-2011-3005</cvename>
	<cvename>CVE-2011-3232</cvename>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-36.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-37.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-38.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-39.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-40.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-41.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-42.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-43.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-44.html</url>
	<url>http://www.mozilla.org/security/announce/2011/mfsa2011-45.html</url>
 </references>
 <dates>
 <discovery>2011-09-27</discovery>
 <entry>2011-09-28</entry>
 </dates>
 </vuln>

<vuln vid="53e531a7-e559-11e0-b481-001b2134ef46">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.3r183.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb11-26.html">
	 Critical vulnerabilities have been identified in Adobe Flash
	 Player 10.3.183.7 and earlier versions for Windows, Macintosh,
	 Linux and Solaris, and Adobe Flash Player 10.3.186.6 and earlier
	 versions for Android. These vulnerabilities could cause a crash
	 and potentially allow an attacker to take control of the
	 affected system.
	 There are reports that one of these vulnerabilities
	 (CVE-2011-2444) is being exploited in the wild in active
	 targeted attacks designed to trick the user into clicking on
	 a malicious link delivered in an email message. This universal
	 cross-site scripting issue could be used to take actions on a
	 user's behalf on any website or webmail provider if the user
	 visits a malicious website.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.adobe.com/support/security/bulletins/apsb11-26.html</url>
 <cvename>CVE-2011-2426</cvename>
 <cvename>CVE-2011-2427</cvename>
 <cvename>CVE-2011-2428</cvename>
 <cvename>CVE-2011-2429</cvename>
 <cvename>CVE-2011-2430</cvename>
 <cvename>CVE-2011-2444</cvename>
 </references>
 <dates>
 <discovery>2011-06-06</discovery>
 <entry>2011-09-22</entry>
 </dates>
 </vuln>

<vuln vid="e44fe906-df27-11e0-a333-001cc0a36e12">
 <topic>phpMyAdmin -- multiple XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>3.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php">
	 Firstly, if a row contains javascript code, after inline
	 editing this row and saving, the code is executed. Secondly,
	 missing sanitization on the db, table and column names leads
	 to XSS vulnerabilities.
	 Versions 3.4.0 to 3.4.4 were found vulnerable.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php</url>
 </references>
 <dates>
 <discovery>2011-09-11</discovery>
 <entry>2011-09-14</entry>
 </dates>
 </vuln>

<vuln vid="d01d10c7-de2d-11e0-b215-00215c6a37bb">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py23-django</name>
	<name>py24-django</name>
	<name>py25-django</name>
	<name>py26-django</name>
	<name>py27-django</name>
	<name>py30-django</name>
	<name>py31-django</name>
	<range><ge>1.3</ge><lt>1.3.1</lt></range>
	<range><ge>1.2</ge><lt>1.2.7</lt></range>
 </package>
 <package>
	<name>py23-django-devel</name>
	<name>py24-django-devel</name>
	<name>py25-django-devel</name>
	<name>py26-django-devel</name>
	<name>py27-django-devel</name>
	<name>py30-django-devel</name>
	<name>py31-django-devel</name>
	<range><lt>16758,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Django project reports:
	<blockquote cite="https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/">
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/</url>
 </references>
 <dates>
 <discovery>2011-09-09</discovery>
 <entry>2011-09-13</entry>
 <modified>2011-11-01</modified>
 </dates>
 </vuln>

<vuln vid="4ae68e7c-dda4-11e0-a906-00215c6a37bb">
 <topic>roundcube -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><lt>0.5.4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RoundCube development Team reports:
	<blockquote cite="http://sourceforge.net/news/?group_id=139281&amp;id=302769">
	 We just published a new release which fixes a recently
	 reported XSS vulnerability as an update to the stable 0.5
	 branch. Please update your installations with this new
	 version or patch them with the fix which is also published
	 in the downloads section or our sourceforge.net page.
	</blockquote>
	and:
	<blockquote cite="http://trac.roundcube.net/ticket/1488030">
	 During one of pen-tests I found that _mbox parameter is not
	 properly sanitized and reflected XSS attack is possible.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2937</cvename>
 </references>
 <dates>
 <discovery>2011-08-09</discovery>
 <entry>2011-09-13</entry>
 </dates>
 </vuln>

<vuln vid="b9f3ffa3-dd6c-11e0-b7fc-000a5e1e33c6">
 <topic>libsndfile -- PAF file processing integer overflow</topic>
 <affects>
 <package>
	<name>libsndfile</name>
	<range><lt>1.0.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/45125/">
	 Hossein Lotfi has discovered a vulnerability in libsndfile,
	 which can be exploited by malicious people to potentially
	 compromise an application using the library. The vulnerability
	 is caused due to an integer overflow error in the "paf24_init()"
	 function (src/paf.c) when processing Paris Audio (PAF) files.
	 This can be exploited to cause a heap-based buffer overflow via
	 a specially crafted file. Successful exploitation may allow
	 execution of arbitrary code. The vulnerability is confirmed in
	 version 1.0.24. Other versions may also be affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2696</cvename>
 <url>http://secunia.com/advisories/45125/</url>
 </references>
 <dates>
 <discovery>2011-07-12</discovery>
 <entry>2011-09-12</entry>
 </dates>
 </vuln>

<vuln vid="2ecb7b20-d97e-11e0-b2e2-00215c6a37bb">
 <topic>OpenSSL -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><ge>1.0.0</ge><lt>1.0.0_6</lt></range>
	<range><ge>0.9.8</ge><lt>1.0.0</lt></range>
 </package>
 <package>
	<name>linux-f10-openssl</name>
	<range><ge>0.9.8</ge><lt>0.9.8r</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL Team reports:
	<blockquote cite="http://openssl.org/news/secadv_20110906.txt">
	 Two security flaws have been fixed in OpenSSL 1.0.0e
	 Under certain circumstances OpenSSL's internal certificate
	 verification routines can incorrectly accept a CRL whose
	 nextUpdate field is in the past. (CVE-2011-3207)
	 OpenSSL server code for ephemeral ECDH ciphersuites is not
	 thread-safe, and furthermore can crash if a client violates
	 the protocol by sending handshake messages in incorrect
	 order. (CVE-2011-3210)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3207</cvename>
 <cvename>CVE-2011-3210</cvename>
 <url>http://www.openssl.org/news/secadv_20110906.txt</url>
 </references>
 <dates>
 <discovery>2011-09-06</discovery>
 <entry>2011-09-07</entry>
 <modified>2014-04-10</modified>
 </dates>
 </vuln>

<vuln vid="a83f25df-d775-11e0-8bf1-003067b2972c">
 <topic>XSS issue in MantisBT</topic>
 <affects>
 <package>
	<name>mantis</name>
	<range><ge>1.2.0</ge><lt>1.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.mantisbt.org/blog/?p=142">
	 Net.Edit0r from BlACK Hat Group reported an XSS issue in
	 search.php. All MantisBT users (including anonymous users that
	 are not logged in to public bug trackers) could be impacted by
	 this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/160368</freebsdpr>
 <cvename>CVE-2011-2938</cvename>
 </references>
 <dates>
 <discovery>2011-08-18</discovery>
 <entry>2011-09-05</entry>
 </dates>
 </vuln>

<vuln vid="e55f948f-d729-11e0-abd1-0017f22d6707">
 <topic>security/cfs -- buffer overflow</topic>
 <affects>
 <package>
	<name>cfs</name>
	<range><le>1.4.1_6</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian reports:
	<blockquote cite="http://www.debian.org/security/2002/dsa-116">
	 Zorgon found several buffer overflows in cfsd, a daemon that
	 pushes encryption services into the Unix(tm) file system.
	 We are not yet sure if these overflows can successfully be
	 exploited to gain root access to the machine running the CFS
	 daemon. However, since cfsd can easily be forced to die, a
	 malicious user can easily perform a denial of service attack
	 to it.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2002-0351</cvename>
 <url>http://www.debian.org/security/2002/dsa-116</url>
 </references>
 <dates>
 <discovery>2002-03-02</discovery>
 <entry>2011-09-04</entry>
 </dates>
 </vuln>

<vuln vid="1b27af46-d6f6-11e0-89a6-080027ef73ec">
 <topic>ca_root_nss -- extraction of explicitly-untrusted certificates into trust bundle</topic>
 <affects>
 <package>
	<name>ca_root_nss</name>
	<range><lt>3.12.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports that the ca-bundle.pl used in older
	 versions of the ca_root_nss FreeBSD port before 3.12.11 did not
	 take the Mozilla/NSS/CKBI untrusted markers into account and
	 would add certificates to the trust bundle that were marked
	 unsafe by Mozilla.
 </body>
 </description>
 <references>
 <freebsdpr>ports/160455</freebsdpr>
 </references>
 <dates>
 <discovery>2011-09-04</discovery>
 <entry>2011-09-04</entry>
 </dates>
 </vuln>

<vuln vid="aa5bc971-d635-11e0-b3cf-080027ef73ec">
 <topic>nss/ca_root_nss -- fraudulent certificates issued by DigiNotar.nl</topic>
 <affects>
 <package>
	<name>nss</name>
	<range><lt>3.12.11</lt></range>
	
 </package>
 <package>
	<name>ca_root_nss</name>
	<range><lt>3.12.11</lt></range>
	
 </package>
 <package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.22,1</lt></range>
	<range><gt>4.0.*,1</gt><lt>6.0.2,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.3.2</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.6.22,1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><gt>3.1.*</gt><lt>3.1.14</lt></range>
	<range><gt>5.0.*</gt><lt>6.0.2</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>3.1.14</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Heather Adkins, Google's Information Security Manager, reported that
	Google received
	<blockquote cite="http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html">
	 [...] reports of attempted SSL man-in-the-middle (MITM)
	 attacks against Google users, whereby someone tried to get between
	 them and encrypted Google services. The people affected were
	 primarily located in Iran. The attacker used a fraudulent SSL
	 certificate issued by DigiNotar, a root certificate authority that
	 should not issue certificates for Google (and has since revoked
	 it). [...]
	</blockquote>
	VASCO Data Security International Inc., owner of DigiNotar, issued a
	 press statement confirming this incident:
	<blockquote cite="http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx">
	 On July 19th 2011, DigiNotar detected an intrusion
	 into its Certificate Authority (CA) infrastructure, which resulted
	 in the fraudulent issuance of public key certificate requests for
	 a number of domains, including Google.com. [...] an external
	 security audit concluded that all fraudulently issued certificates
	 were
	 revoked. Recently, it was discovered that at least one fraudulent
	 certificate had not been revoked at the time. [...]
	</blockquote>
	Mozilla, maintainer of the NSS package, from which FreeBSD derived
	 ca_root_nss, stated that they:
	<blockquote cite="https://blog.mozilla.com/security/2011/09/02/diginotar-removal-follow-up/">
	 revoked our trust in the DigiNotar certificate authority from
	 all Mozilla software. This is not a temporary suspension, it is
	 a complete removal from our trusted root program. Complete
	 revocation of trust is a decision we treat with careful
	 consideration, and employ as a last resort.
	 Three central issues informed our decision:
	 <ol><li>Failure to notify. [...]</li>
	 <li>The scope of the breach remains unknown. [...]</li>
	 <li>The attack is not theoretical.</li></ol>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-34.html</url>
 <url>http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html</url>
 </references>
 <dates>
 <discovery>2011-07-19</discovery>
 <entry>2011-09-03</entry>
 <modified>2011-09-06</modified>
 </dates>
 </vuln>

<vuln vid="7f6108d2-cea8-11e0-9d58-0800279895ea">
 <topic>apache -- Range header DoS vulnerability</topic>
 <affects>
 <package>
	<name>apache</name>
	<name>apache-event</name>
	<name>apache-itk</name>
	<name>apache-peruser</name>
	<name>apache-worker</name>
	<range><gt>2.*</gt><lt>2.2.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache HTTP server project reports:
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192">
	 A denial of service vulnerability has been found in the way
	 the multiple overlapping ranges are handled by Apache HTTPD
	 server.
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2011-3192</cvename>
	<url>https://people.apache.org/~dirkx/CVE-2011-3192.txt</url>
	<url>https://svn.apache.org/viewvc?view=revision&amp;revision=1161534</url>
	<url>https://svn.apache.org/viewvc?view=revision&amp;revision=1162874</url>
 </references>
 <dates>
 <discovery>2011-08-24</discovery>
 <entry>2011-08-30</entry>
 <modified>2011-09-01</modified>
 </dates>
 </vuln>

<vuln vid="cdeb34e6-d00d-11e0-987e-00215c6a37bb">
 <topic>stunnel -- heap corruption vulnerability</topic>
 <affects>
 <package>
	<name>stunnel</name>
	<range><ge>4.40</ge><lt>4.42</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michal Trojnara reports:
	<blockquote cite="http://www.stunnel.org/pipermail/stunnel-announce/2011-August/000059.html">
	 Version 4.42, 2011.08.18, urgency: HIGH:
	 Fixed a heap corruption vulnerability in versions 4.40 and 4.41.
	 It may possibly be leveraged to perform DoS or remote code
	 execution attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>49254</bid>
 <cvename>CVE-2011-2940</cvename>
 </references>
 <dates>
 <discovery>2011-08-25</discovery>
 <entry>2011-08-26</entry>
 </dates>
 </vuln>

<vuln vid="75e26236-ce9e-11e0-b26a-00215c6a37bb">
 <topic>phpMyAdmin -- multiple XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>3.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-13.php">
	 Multiple XSS in the Tracking feature.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-3181</cvename>
 </references>
 <dates>
 <discovery>2011-08-24</discovery>
 <entry>2011-08-24</entry>
 </dates>
 </vuln>

<vuln vid="3f1df2f9-cd22-11e0-9bb2-00215c6a37bb">
 <topic>PHP -- crypt() returns only the salt for MD5</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><ge>5.3.7</ge><lt>5.3.7_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP development team reports:
	<blockquote cite="https://bugs.php.net/bug.php?id=55439">
	 If crypt() is executed with MD5 salts, the return value
	 consists of the salt only. DES and BLOWFISH salts work as
	 expected.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugs.php.net/bug.php?id=55439</url>
 </references>
 <dates>
 <discovery>2011-08-17</discovery>
 <entry>2011-08-23</entry>
 <modified>2011-08-30</modified>
 </dates>
 </vuln>

<vuln vid="057bf770-cac4-11e0-aea3-00215c6a37bb">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5</name>
	<name>php5-sockets</name>
	<range><lt>5.3.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP development team reports:
	<blockquote cite="http://www.php.net/ChangeLog-5.php#5.3.7">
	 Security Enhancements and Fixes in PHP 5.3.7:
	 <ul>
	 <li>Updated crypt_blowfish to 1.2. (CVE-2011-2483)</li>
	 <li>Fixed crash in error_log(). Reported by Mateusz
	 Kocielski</li>
	 <li>Fixed buffer overflow on overlog salt in crypt().</li>
	 <li>Fixed bug #54939 (File path injection vulnerability
	 in RFC1867 File upload filename). Reported by Krzysztof
	 Kotowicz. (CVE-2011-2202)</li>
	 <li>Fixed stack buffer overflow in socket_connect().
	 (CVE-2011-1938)</li>
	 <li>Fixed bug #54238 (use-after-free in substr_replace()).
	 (CVE-2011-1148)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>49241</bid>
 <cvename>CVE-2011-2483</cvename>
 <cvename>CVE-2011-2202</cvename>
 <cvename>CVE-2011-1938</cvename>
 <cvename>CVE-2011-1148</cvename>
 </references>
 <dates>
 <discovery>2011-08-18</discovery>
 <entry>2011-08-20</entry>
 </dates>
 </vuln>

<vuln vid="be77eff6-ca91-11e0-aea3-00215c6a37bb">
 <topic>rubygem-rails -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rubygem-rails</name>
	<range><lt>3.0.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/49179/discuss">
	 Ruby on Rails is prone to multiple vulnerabilities
	 including SQL-injection, information-disclosure,
	 HTTP-header-injection, security-bypass and cross-site
	 scripting issues.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>49179</bid>
 <url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6a1e473744bc389b</url>
 <url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/3420ac71aed312d6</url>
 <url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6ffc93bde0298768</url>
 <url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b9130749b74ea12</url>
 <url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/56bffb5923ab1195</url>
 </references>
 <dates>
 <discovery>2011-08-16</discovery>
 <entry>2011-08-19</entry>
 </dates>
 </vuln>

<vuln vid="0b53f5f7-ca8a-11e0-aea3-00215c6a37bb">
 <topic>dovecot -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><lt>1.2.17</lt></range>
	<range><gt>2.0</gt><lt>2.0.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Timo Sirainen reports:
	<blockquote cite="http://dovecot.org/pipermail/dovecot/2011-May/059086.html">
	 Fixed potential crashes and other problems when parsing header
	 names that contained NUL characters.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>47930</bid>
 <cvename>CVE-2011-1929</cvename>
 </references>
 <dates>
 <discovery>2011-05-25</discovery>
 <entry>2011-08-19</entry>
 </dates>
 </vuln>

<vuln vid="86baa0d4-c997-11e0-8a8e-00151735203a">
 <topic>OTRS -- Vulnerabilities in OTRS-Core allows read access to any file on local file system</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><gt>2.1.*</gt><lt>3.0.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OTRS Security Advisory reports:
	<blockquote cite="http://otrs.org/advisory/OSA-2011-03-en/">
	 <ul>
	 <li>An attacker with valid session and admin permissions could
	 get read access to any file on the servers local operating
	 system. For this it would be needed minimum one installed
	 OTRS package.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2746</cvename>
 <url>http://otrs.org/advisory/OSA-2011-03-en/</url>
 </references>
 <dates>
 <discovery>2011-08-16</discovery>
 <entry>2011-08-18</entry>
 </dates>
 </vuln>

<vuln vid="834591a9-c82f-11e0-897d-6c626dd55a41">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.20,1</lt></range>
	<range><gt>5.0.*,1</gt><lt>6.0,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><lt>2.3</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.6.20,1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>3.1.12</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>3.1.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2011-29 Security issues addressed in Firefox 6
	 MFSA 2011-28 Security issues addressed in Firefox 3.6.20
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-29.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-30.html</url>
 <cvename>CVE-2011-2982</cvename>
 <cvename>CVE-2011-0084</cvename>
 <cvename>CVE-2011-2981</cvename>
 <cvename>CVE-2011-2378</cvename>
 <cvename>CVE-2011-2984</cvename>
 <cvename>CVE-2011-2980</cvename>
 <cvename>CVE-2011-2983</cvename>
 <cvename>CVE-2011-2989</cvename>
 <cvename>CVE-2011-2991</cvename>
 <cvename>CVE-2011-2992</cvename>
 <cvename>CVE-2011-2985</cvename>
 <cvename>CVE-2011-2993</cvename>
 <cvename>CVE-2011-2988</cvename>
 <cvename>CVE-2011-2987</cvename>
 <cvename>CVE-2011-0084</cvename>
 <cvename>CVE-2011-2990</cvename>
 <cvename>CVE-2011-2986</cvename>
 </references>
 <dates>
 <discovery>2011-08-16</discovery>
 <entry>2011-08-16</entry>
 </dates>
 </vuln>

<vuln vid="56f4b3a6-c82c-11e0-a498-00215c6a37bb">
 <topic>Samba -- cross site scripting and request forgery vulnerabilities</topic>
 <affects>
 <package>
	<name>samba34</name>
	<range><gt>3.4.*</gt><lt>3.4.14</lt></range>
 </package>
 <package>
	<name>samba35</name>
	<range><gt>3.5.*</gt><lt>3.5.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samba security advisory reports:
	<blockquote cite="http://www.samba.org/samba/security/CVE-2011-2522">
	 All current released versions of Samba are vulnerable to a
	 cross-site request forgery in the Samba Web Administration Tool
	 (SWAT). By tricking a user who is authenticated with SWAT into
	 clicking a manipulated URL on a different web page, it is
	 possible to manipulate SWAT.
	</blockquote>
	<blockquote cite="http://www.samba.org/samba/security/CVE-2011-2694">
	 All current released versions of Samba are vulnerable to a
	 cross-site scripting issue in the Samba Web Administration Tool
	 (SWAT). On the "Change Password" field, it is possible to insert
	 arbitrary content into the "user" field.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>48901</bid>
 <bid>48899</bid>
 <cvename>CVE-2011-2522</cvename>
 <cvename>CVE-2011-2694</cvename>
 </references>
 <dates>
 <discovery>2011-07-27</discovery>
 <entry>2011-08-16</entry>
 </dates>
 </vuln>

<vuln vid="510b630e-c43b-11e0-916c-00e0815b8da8">
 <topic>isc-dhcp-server -- server halt upon processing certain packets</topic>
 <affects>
 <package>
	<name>isc-dhcp31-server</name>
	<range><lt>3.1.ESV_1,1</lt></range>
 </package>
 <package>
	<name>isc-dhcp41-server</name>
	<range><lt>4.1.e_2,2</lt></range>
 </package>
 <package>
	<name>isc-dhcp42-server</name>
	<range><lt>4.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2011-2748">
	 A pair of defects cause the server to halt upon processing
	 certain packets. The patch is to properly discard or process
	 those packets.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2748</cvename>
 <cvename>CVE-2011-2749</cvename>
 </references>
 <dates>
 <discovery>2011-08-10</discovery>
 <entry>2011-08-13</entry>
 </dates>
 </vuln>

<vuln vid="dc8741b9-c5d5-11e0-8a8e-00151735203a">
 <topic>bugzilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><ge>2.4.*</ge><lt>3.6.6</lt></range>
	<range><ge>4.0.*</ge><lt>4.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla Security Advisory reports:
	<blockquote cite="http://www.bugzilla.org/security/3.4.11/">
	 The following security issues have been discovered in Bugzilla:
	 <ul>
	 <li>Internet Explorer 8 and older, and Safari before 5.0.6 do
	 content sniffing when viewing a patch in "Raw Unified" mode,
	 which could trigger a cross-site scripting attack due to
	 the execution of malicious code in the attachment.</li>
	 <li>It is possible to determine whether or not certain group
	 names exist while creating or updating bugs.</li>
	 <li>Attachment descriptions with a newline in them could lead
	 to the injection of crafted headers in email notifications sent
	 to the requestee or the requester when editing an attachment
	 flag.</li>
	 <li>If an attacker has access to a user's session, he can modify
	 that user's email address without that user being notified
	 of the change.</li>
	 <li>Temporary files for uploaded attachments are not deleted
	 on Windows, which could let a user with local access to
	 the server read them.</li>
	 <li>Up to Bugzilla 3.4.11, if a BUGLIST cookie is compromised,
	 it can be used to inject HTML code when viewing a bug report,
	 leading to a cross-site scripting attack.</li>
	 </ul>
	 All affected installations are encouraged to upgrade as soon as
	 possible.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2379</cvename>
 <cvename>CVE-2011-2380</cvename>
 <cvename>CVE-2011-2979</cvename>
 <cvename>CVE-2011-2381</cvename>
 <cvename>CVE-2011-2978</cvename>
 <cvename>CVE-2011-2977</cvename>
 <cvename>CVE-2011-2976</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=637981</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=653477</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=674497</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=657158</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=670868</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=660502</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=660053</url>
 </references>
 <dates>
 <discovery>2011-08-04</discovery>
 <entry>2011-08-13</entry>
 </dates>
 </vuln>

<vuln vid="879b0242-c5b6-11e0-abd1-0017f22d6707">
 <topic>dtc -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dtc</name>
	<range><lt>0.32.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ansgar Burchardt reports:
	<blockquote cite="http://www.debian.org/security/2011/dsa-2179">
	 Ansgar Burchardt discovered several vulnerabilities in DTC, a
	 web control panel for admin and accounting hosting services:
	 The bw_per_moth.php graph contains an SQL injection
	 vulnerability; insufficient checks in bw_per_month.php can lead
	 to bandwidth usage information disclosure; after a registration,
	 passwords are sent in cleartext email messages and Authenticated
	 users could delete accounts using an obsolete interface which
	 was incorrectly included in the package.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0434</cvename>
 <cvename>CVE-2011-0435</cvename>
 <cvename>CVE-2011-0436</cvename>
 <cvename>CVE-2011-0437</cvename>
 <url>http://www.debian.org/security/2011/dsa-2179</url>
 </references>
 <dates>
 <discovery>2011-03-02</discovery>
 <entry>2011-08-13</entry>
 </dates>
 </vuln>

<vuln vid="304409c3-c3ef-11e0-8aa5-485d60cb5385">
 <topic>libXfont -- possible local privilege escalation</topic>
 <affects>
 <package>
	<name>libXfont</name>
	<range><lt>1.4.4_1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tomas Hoger reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=725760">
	 The compress/ LZW decompress implentation does not correctly
	 handle compressed streams that contain code words that were not
	 yet added to the decompression table. This may lead to
	 arbitrary memory corruption. Successfull exploitation may
	 possible lead to a local privilege escalation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2895</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=725760</url>
 </references>
 <dates>
 <discovery>2011-07-26</discovery>
 <entry>2011-08-11</entry>
 <modified>2012-03-13</modified>
 </dates>
 </vuln>

<vuln vid="5d374b01-c3ee-11e0-8aa5-485d60cb5385">
 <topic>freetype2 -- execute arbitrary code or cause denial of service</topic>
 <affects>
 <package>
	<name>freetype2</name>
	<range><lt>2.4.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Vincent Danen reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-0226">
	 Due to an error within the t1_decoder_parse_charstrings()
	 function (src/psaux/t1decode.c) and can be exploited to corrupt
	 memory by tricking a user into processing a specially-crafted
	 postscript Type1 font in an application that uses the freetype
	 library.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0226</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-0226</url>
 </references>
 <dates>
 <discovery>2011-07-19</discovery>
 <entry>2011-08-11</entry>
 </dates>
 </vuln>

<vuln vid="2c12ae0c-c38d-11e0-8eb7-001b2134ef46">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.3r183.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb11-21.html">
	 Critical vulnerabilities have been identified in Adobe Flash
	 Player 10.3.181.36 and earlier versions for Windows, Macintosh,
	 Linux and Solaris, and Adobe Flash Player 10.3.185.25 and
	 earlier versions for Android. These vulnerabilities could
	 cause a crash and potentially allow an attacker to take control
	 of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2130</cvename>
 <cvename>CVE-2011-2134</cvename>
 <cvename>CVE-2011-2135</cvename>
 <cvename>CVE-2011-2136</cvename>
 <cvename>CVE-2011-2137</cvename>
 <cvename>CVE-2011-2138</cvename>
 <cvename>CVE-2011-2139</cvename>
 <cvename>CVE-2011-2140</cvename>
 <cvename>CVE-2011-2414</cvename>
 <cvename>CVE-2011-2415</cvename>
 <cvename>CVE-2011-2416</cvename>
 <cvename>CVE-2011-2417</cvename>
 <cvename>CVE-2011-2425</cvename>
 <url>https://www.adobe.com/support/security/bulletins/apsb11-21.html</url>
 </references>
 <dates>
 <discovery>2011-05-13</discovery>
 <entry>2011-08-10</entry>
 <modified>2012-11-05</modified>
 </dates>
 </vuln>

<vuln vid="30cb4522-b94d-11e0-8182-485d60cb5385">
 <topic>libsoup -- unintentionally allow access to entire local filesystem</topic>
 <affects>
 <package>
	<name>libsoup</name>
	<range><lt>2.32.2_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dan Winship reports:
	<blockquote cite="http://mail.gnome.org/archives/ftp-release-list/2011-July/msg00176.html">
	 Fixed a security hole that caused some SoupServer users to
	 unintentionally allow accessing the entire local filesystem when
	 they thought they were only providing access to a single
	 directory.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2054</cvename>
 <url>http://mail.gnome.org/archives/ftp-release-list/2011-July/msg00176.html</url>
 <url>https://bugzilla.gnome.org/show_bug.cgi?id=653258</url>
 </references>
 <dates>
 <discovery>2011-06-23</discovery>
 <entry>2011-07-28</entry>
 </dates>
 </vuln>

<vuln vid="d79fc873-b5f9-11e0-89b4-001ec9578670">
 <topic>phpmyadmin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>3.4.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php">
	 XSS in table Print view.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php">
	 Via a crafted MIME-type transformation parameter, an attacker can
	 perform a local file inclusion.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php">
	 In the 'relational schema' code a parameter was not sanitized before
	 being used to concatenate a class name.
	 The end result is a local file inclusion vulnerability and code
	 execution.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php">
	 It was possible to manipulate the PHP session superglobal using
	 some of the Swekey authentication code.
	 This is very similar to PMASA-2011-5, documented in
	 7e4e5c53-a56c-11e0-b180-00216aa06fc2
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2011-2642</cvename>
	<cvename>CVE-2011-2643</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php</url>
 </references>
 <dates>
 <discovery>2011-07-23</discovery>
 <entry>2011-07-24</entry>
 <modified>2011-07-28</modified>
 </dates>
 </vuln>

<vuln vid="9f14cb36-b6fc-11e0-a044-445c73746d79">
 <topic>opensaml2 -- unauthenticated login</topic>
 <affects>
 <package>
	<name>opensaml2</name>
	<range><gt>0</gt><lt>2.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSAML developer reports:
	<blockquote cite="http://shibboleth.internet2.edu/secadv/secadv_20110725.txt">
	 The Shibboleth software relies on the OpenSAML libraries to
	 perform verification of signed XML messages such as attribute
	 queries or SAML assertions. Both the Java and C++ versions are
	 vulnerable to a so-called "wrapping attack" that allows a remote,
	 unauthenticated attacker to craft specially formed messages that
	 can be successfully verified, but contain arbitrary content.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1411</cvename>
 <mlist msgid="CA530061.113D6%cantor.2@osu.edu">https://groups.google.com/a/shibboleth.net/group/announce/browse_thread/thread/cf3e0d76afbb57d9</mlist>
 </references>
 <dates>
 <discovery>2011-07-25</discovery>
 <entry>2011-07-25</entry>
 </dates>
 </vuln>

<vuln vid="9a777c23-b310-11e0-832d-00215c6a37bb">
 <topic>rsync -- incremental recursion memory corruption vulnerability</topic>
 <affects>
 <package>
	<name>rsync</name>
	<range><gt>3.0</gt><lt>3.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	rsync development team reports:
	<blockquote cite="http://rsync.samba.org/ftp/rsync/src/rsync-3.0.8-NEWS">
	 Fixed a data-corruption issue when preserving hard-links
	 without preserving file ownership, and doing deletions either
	 before or during the transfer (CVE-2011-1097). This
	 fixes some assert errors in the hard-linking code, and some
	 potential failed checksums (via -c) that should have matched.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1097</cvename>
 <url>https://bugzilla.samba.org/show_bug.cgi?id=7936</url>
 </references>
 <dates>
 <discovery>2011-04-08</discovery>
 <entry>2011-07-20</entry>
 </dates>
 </vuln>

<vuln vid="fd64188d-a71d-11e0-89b4-001ec9578670">
 <topic>BIND -- Remote DoS against authoritative and recursive servers</topic>
 <affects>
 <package>
	<name>bind96</name>
	<range><lt>9.6.3.1.ESV.R4.3</lt></range>
 </package>
 <package>
	<name>bind97</name>
	<range><lt>9.7.3.3</lt></range>
 </package>
 <package>
	<name>bind98</name>
	<range><lt>9.8.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-2464">
	 A defect in the affected BIND 9 versions allows an attacker to
	 remotely cause the "named" process to exit using a specially
	 crafted packet.
	 This defect affects both recursive and authoritative servers.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2464</cvename>
 <url>https://www.isc.org/software/bind/advisories/cve-2011-2464</url>
 </references>
 <dates>
 <discovery>2011-07-05</discovery>
 <entry>2011-07-05</entry>
 </dates>
 </vuln>

<vuln vid="4ccee784-a721-11e0-89b4-001ec9578670">
 <topic>BIND -- Remote DoS with certain RPZ configurations</topic>
 <affects>
 <package>
	<name>bind98</name>
	<range><lt>9.8.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-2465">
	 Two defects were discovered in ISC's BIND 9.8 code. These
	 defects only affect BIND 9.8 servers which have recursion
	 enabled and which use a specific feature of the software known
	 as Response Policy Zones (RPZ) and where the RPZ zone contains
	 a specific rule/action pattern.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2465</cvename>
 <url>https://www.isc.org/software/bind/advisories/cve-2011-2465</url>
 </references>
 <dates>
 <discovery>2011-07-05</discovery>
 <entry>2011-07-05</entry>
 </dates>
 </vuln>

<vuln vid="7e4e5c53-a56c-11e0-b180-00216aa06fc2">
 <topic>phpmyadmin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>3.4.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin development team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php">
	 It was possible to manipulate the PHP session superglobal using
	 some of the Swekey authentication code. This could open a path
	 for other attacks.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php">
	 An unsanitized key from the Servers array is written in a comment
	 of the generated config. An attacker can modify this key by
	 modifying the SESSION superglobal array. This allows the attacker
	 to close the comment and inject code.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php">
	 Through a possible bug in PHP running on Windows systems a NULL
	 byte can truncate the pattern string allowing an attacker to
	 inject the /e modifier causing the preg_replace function to
	 execute its second argument as PHP code.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php">
	 Fixed filtering of a file path in the MIME-type transformation
	 code, which allowed for directory traversal.
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2011-2505</cvename>
	<cvename>CVE-2011-2506</cvename>
	<cvename>CVE-2011-2507</cvename>
	<cvename>CVE-2011-2508</cvename>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php</url>
	<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php</url>
 </references>
 <dates>
 <discovery>2011-07-02</discovery>
 <entry>2011-07-03</entry>
 <modified>2011-07-28</modified>
 </dates>
 </vuln>

<vuln vid="40544e8c-9f7b-11e0-9bec-6c626dd55a41">
 <topic>Asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk14</name>
	<range><gt>1.4.*</gt><lt>1.4.41.2</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><gt>1.6.*</gt><lt>1.6.2.18.2</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk Development Team reports:
	<blockquote cite="http://www.asterisk.org/node/51650">
	 AST-2011-008: If a remote user sends a SIP packet containing a
	 NULL, Asterisk assumes available data extends past the null to
	 the end of the packet when the buffer is actually truncated when
	 copied. This causes SIP header parsing to modify data past the
	 end of the buffer altering unrelated memory structures. This
	 vulnerability does not affect TCP/TLS connections.
	 AST-2011-009: A remote user sending a SIP packet containing a
	 Contact header with a missing left angle bracket causes Asterisk
	 to access a null pointer.
	 AST-2011-010: A memory address was inadvertently transmitted
	 over the network via IAX2 via an option control frame and the
	 remote party would try to access it.
	 Possible enumeration of SIP users due to differing
	 authentication responses.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2529</cvename>
 <cvename>CVE-2011-2535</cvename>
 <cvename>CVE-2011-2536</cvename>
 <url>http://downloads.asterisk.org/pub/security/AST-2011-008.html</url>
 <url>http://downloads.asterisk.org/pub/security/AST-2011-009.html</url>
 <url>http://downloads.asterisk.org/pub/security/AST-2011-010.html</url>
 <url>http://downloads.asterisk.org/pub/security/AST-2011-011.html</url>
 </references>
 <dates>
 <discovery>2011-06-24</discovery>
 <entry>2011-06-25</entry>
 <modified>2011-06-29</modified>
 </dates>
 </vuln>

<vuln vid="01d3ab7d-9c43-11e0-bc0f-0014a5e3cda6">
 <topic>ejabberd -- remote denial of service vulnerability</topic>
 <affects>
 <package>
	<name>ejabberd</name>
	<range><lt>2.1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	It's reported in CVE advisory that:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1753">
	 expat_erl.c in ejabberd before 2.1.7 and 3.x before
	 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect
	 recursion during entity expansion, which allows remote attackers
	 to cause a denial of service (memory and CPU consumption) via a
	 crafted XML document containing a large number of nested entity
	 references, a similar issue to CVE-2003-1564.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1753</cvename>
 <url>http://www.ejabberd.im/ejabberd-2.1.7</url>
 </references>
 <dates>
 <discovery>2011-04-27</discovery>
 <entry>2011-06-24</entry>
 </dates>
 </vuln>

<vuln vid="dfe40cff-9c3f-11e0-9bec-6c626dd55a41">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.5.*,1</gt><lt>3.5.20,1</lt></range>
	<range><gt>3.6.*,1</gt><lt>3.6.18,1</lt></range>
	<range><gt>4.0.*,1</gt><lt>5.0,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.6.18,1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>3.1.11</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>3.1.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2011-19 Miscellaneous memory safety hazards
	 (rv:3.0/1.9.2.18)
	 MFSA 2011-20 Use-after-free vulnerability when viewing XUL
	 document with script disabled
	 MFSA 2011-21 Memory corruption due to multipart/x-mixed-replace
	 images
	 MFSA 2011-22 Integer overflow and arbitrary code execution in
	 Array.reduceRight()
	 MFSA 2011-23 Multiple dangling pointer vulnerabilities
	 MFSA 2011-24 Cookie isolation error
	 MFSA 2011-25 Stealing of cross-domain images using WebGL
	 textures
	 MFSA 2011-26 Multiple WebGL crashes
	 MFSA 2011-27 XSS encoding hazard with inline SVG
	 MFSA 2011-28 Non-whitelisted site can trigger xpinstall
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-19.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-20.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-21.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-22.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-23.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-24.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-25.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-26.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-27.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-28.html</url>
 </references>
 <dates>
 <discovery>2011-06-21</discovery>
 <entry>2011-06-21</entry>
 <modified>2011-06-23</modified>
 </dates>
 </vuln>

<vuln vid="bfdbc7ec-9c3f-11e0-9bec-6c626dd55a41">
 <topic>Samba -- Denial of service - memory corruption</topic>
 <affects>
 <package>
	<name>samba34</name>
	<range><gt>3.4.*</gt><lt>3.4.12</lt></range>
 </package>
 <package>
	<name>samba35</name>
	<range><gt>3.5.*</gt><lt>3.5.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba team reports:
	<blockquote cite="http://www.samba.org/samba/security/CVE-2011-0719.html">
	 Samba is vulnerable to a denial of service, caused by a memory
	 corruption error related to missing range checks on file
	 descriptors being used in the "FD_SET" macro. By performing a
	 select on a bad file descriptor set, a remote attacker could
	 exploit this vulnerability to cause the application to crash or
	 possibly execute arbitrary code on the system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0719</cvename>
 <url>http://www.samba.org/samba/security/CVE-2011-0719.html</url>
 <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0719</url>
 </references>
 <dates>
 <discovery>2011-02-28</discovery>
 <entry>2011-06-21</entry>
 </dates>
 </vuln>

<vuln vid="23c8423e-9bff-11e0-8ea2-0019d18c446a">
 <topic>Piwik -- remote command execution vulnerability</topic>
 <affects>
 <package>
	<name>piwik</name>
	<range><ge>1.2</ge><lt>1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Piwik security advisory reports:
	<blockquote cite="http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/">
	 The Piwik 1.5 release addresses a critical security
	 vulnerability, which affect all Piwik users that have let
	 granted some access to the "anonymous" user.
	 Piwik contains a remotely exploitable vulnerability that could
	 allow a remote attacker to execute arbitrary code. Only
	 installations that have granted untrusted view access to their
	 stats (ie. grant "view" access to a website to anonymous) are
	 at risk.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/158084</freebsdpr>
 <url>http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/</url>
 </references>
 <dates>
 <discovery>2011-06-21</discovery>
 <entry>2011-06-21</entry>
 </dates>
 </vuln>

<vuln vid="0b535cd0-9b90-11e0-800a-00215c6a37bb">
 <topic>Dokuwiki -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>dokuwiki</name>
	<range><lt>20110525a</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dokuwiki reports:
	<blockquote cite="http://www.freelists.org/post/dokuwiki/Hotfix-Release-20110525a-Rincewind">
	 We just released a Hotfix Release "2011-05-25a Rincewind".
	 It contains the following changes:
	 Security fix for a Cross Site Scripting vulnerability.
	 Malicious users could abuse DokuWiki's RSS embedding mechanism
	 to create links containing arbitrary JavaScript. Note: this
	 security problem is present in at least Anteater and Rincewind
	 but probably in older releases as well.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.freelists.org/post/dokuwiki/Hotfix-Release-20110525a-Rincewind</url>
 </references>
 <dates>
 <discovery>2011-06-14</discovery>
 <entry>2011-06-20</entry>
 </dates>
 </vuln>

<vuln vid="55a528e8-9787-11e0-b24a-001b2134ef46">
 <topic>linux-flashplugin -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.3r181.26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-18.html">
	 A critical vulnerability has been identified in Adobe Flash
	 Player 10.3.181.23 and earlier versions for Windows, Macintosh,
	 Linux and Solaris, and Adobe Flash Player 10.3.185.23 and
	 earlier versions for Android. This memory corruption
	 vulnerability (CVE-2011-2110) could cause a crash and
	 potentially allow an attacker to take control of the affected
	 system. There are reports that this vulnerability is being
	 exploited in the wild in targeted attacks via malicious Web
	 pages.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2110</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb11-18.html</url>
 </references>
 <dates>
 <discovery>2011-05-13</discovery>
 <entry>2011-06-15</entry>
 </dates>
 </vuln>

<vuln vid="3145faf1-974c-11e0-869e-000c29249b2e">
 <topic>ikiwiki -- tty hijacking via ikiwiki-mass-rebuild</topic>
 <affects>
 <package>
	<name>ikiwiki</name>
	<range><lt>3.20110608</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The IkiWiki development team reports:
	<blockquote cite="http://ikiwiki.info/security/#index40h2">
	 Ludwig Nussel discovered a way for users to hijack root's tty
	 when ikiwiki-mass-rebuild was run. Additionally, there was
	 some potential for information disclosure via symlinks.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1408</cvename>
 <url>http://ikiwiki.info/security/#index40h2</url>
 </references>
 <dates>
 <discovery>2011-06-08</discovery>
 <entry>2011-06-15</entry>
 </dates>
 </vuln>

<vuln vid="57573136-920e-11e0-bdc9-001b2134ef46">
 <topic>linux-flashplugin -- cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.3r181.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-13.html">
	 An important vulnerability has been identified in Adobe
	 Flash Player 10.3.181.16 and earlier versions for Windows,
	 Macintosh, Linux and Solaris, and Adobe Flash Player
	 10.3.185.22 and earlier versions for Android. This universal
	 cross-site scripting vulnerability (CVE-2011-2107) could be
	 used to take actions on a user's behalf on any website or
	 webmail provider, if the user visits a malicious website.
	 There are reports that this vulnerability is being exploited
	 in the wild in active targeted attacks designed to trick
	 the user into clicking on a malicious link delivered in an
	 email message.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2107</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb11-13.html</url>
 </references>
 <dates>
 <discovery>2011-05-13</discovery>
 <entry>2011-06-08</entry>
 </dates>
 </vuln>

<vuln vid="1e1421f0-8d6f-11e0-89b4-001ec9578670">
 <topic>BIND -- Large RRSIG RRsets and Negative Caching DoS</topic>
 <affects>
 <package>
	<name>bind9-sdb-ldap</name>
	<name>bind9-sdb-postgresql</name>
	<range><lt>9.4.3.4</lt></range>
 </package>
 <package>
	<name>bind96</name>
	<range><lt>9.6.3.1.ESV.R4.1</lt></range>
 </package>
 <package>
	<name>bind97</name>
	<range><lt>9.7.3.1</lt></range>
 </package>
 <package>
	<name>bind98</name>
	<range><lt>9.8.0.2</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>7.3</ge><lt>7.3_6</lt></range>
	<range><ge>7.4</ge><lt>7.4_2</lt></range>
	<range><ge>8.1</ge><lt>8.1_4</lt></range>
	<range><ge>8.2</ge><lt>8.2_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="http://www.isc.org/software/bind/advisories/cve-2011-1910">
	 A BIND 9 DNS server set up to be a caching resolver is
	 vulnerable to a user querying a domain with very large resource
	 record sets (RRSets) when trying to negatively cache a response.
	 This can cause the BIND 9 DNS server (named process) to crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1910</cvename>
 <freebsdsa>SA-11:02.bind</freebsdsa>
 <url>http://www.isc.org/software/bind/advisories/cve-2011-1910</url>
 </references>
 <dates>
 <discovery>2011-05-26</discovery>
 <entry>2011-06-04</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="f7d838f2-9039-11e0-a051-080027ef73ec">
 <topic>fetchmail -- STARTTLS denial of service</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><lt>6.3.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2011-01.txt">
	 Fetchmail version 5.9.9 introduced STLS support for POP3,
	 version 6.0.0 added STARTTLS for IMAP. However, the actual
	 S(TART)TLS-initiated in-band SSL/TLS negotiation was not guarded
	 by a timeout.
	 Depending on the operating system defaults as to TCP stream
	 keepalive mode, fetchmail hangs in excess of one week after
	 sending STARTTLS were observed if the connection failed without
	 notifying the operating system, for instance, through network
	 outages or hard server crashes.
	 A malicious server that does not respond, at the network level,
	 after acknowledging fetchmail's STARTTLS or STLS request, can
	 hold fetchmail in this protocol state, and thus render fetchmail
	 unable to complete the poll, or proceed to the next server,
	 effecting a denial of service.
	 SSL-wrapped mode on dedicated ports was unaffected by this
	 problem, so can be used as a workaround.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1947</cvename>
 <url>http://www.fetchmail.info/fetchmail-SA-2011-01.txt</url>
 <url>https://gitorious.org/fetchmail/fetchmail/commit/7dc67b8cf06f74aa57525279940e180c99701314</url>
 </references>
 <dates>
 <discovery>2011-04-28</discovery>
 <entry>2011-06-06</entry>
 </dates>
 </vuln>

<vuln vid="34ce5817-8d56-11e0-b5a2-6c626dd55a41">
 <topic>asterisk -- Remote crash vulnerability</topic>
 <affects>
 <package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk Development Team reports:
	<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-June/000325.html">
	 If a remote user initiates a SIP call and the recipient picks
	 up, the remote user can reply with a malformed Contact header
	 that Asterisk will improperly handle and cause a crash due to a
	 segmentation fault.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-2216</cvename>
 <url>http://downloads.asterisk.org/pub/security/AST-2011-007.pdf</url>
 </references>
 <dates>
 <discovery>2011-06-02</discovery>
 <entry>2011-06-02</entry>
 </dates>
 </vuln>

<vuln vid="e27a1af3-8d21-11e0-a45d-001e8c75030d">
 <topic>Subversion -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><lt>1.6.17</lt></range>
 </package>
 <package>
	<name>subversion-freebsd</name>
	<range><lt>1.6.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion team reports:
	<blockquote cite="http://subversion.apache.org/security/CVE-2011-1752-advisory.txt">
	 Subversion's mod_dav_svn Apache HTTPD server module will
	 dereference a NULL pointer if asked to deliver baselined WebDAV
	 resources.
	 This can lead to a DoS. An exploit has been tested, and tools
	 or users have been observed triggering this problem in the
	 wild.
	</blockquote>
	<blockquote cite="http://subversion.apache.org/security/CVE-2011-1783-advisory.txt">
	 Subversion's mod_dav_svn Apache HTTPD server module may in
	 certain scenarios enter a logic loop which does not exit and
	 which allocates memory in each iteration, ultimately exhausting
	 all the available memory on the server.
	 This can lead to a DoS. There are no known instances of this
	 problem being observed in the wild, but an exploit has been
	 tested.
	</blockquote>
	<blockquote cite="http://subversion.apache.org/security/CVE-2011-1921-advisory.txt">
	 Subversion's mod_dav_svn Apache HTTPD server module may leak to
	 remote users the file contents of files configured to be
	 unreadable by those users.
	 There are no known instances of this problem being observed in
	 the wild, but an exploit has been tested.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1752</cvename>
 <cvename>CVE-2011-1783</cvename>
 <cvename>CVE-2011-1921</cvename>
 </references>
 <dates>
 <discovery>2011-05-28</discovery>
 <entry>2011-06-02</entry>
 </dates>
 </vuln>

<vuln vid="1acf9ec5-877d-11e0-b937-001372fd0af2">
 <topic>drupal6 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal6</name>
	<range><lt>6.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Team reports:
	<blockquote cite="http://drupal.org/node/1168756">
	 A reflected cross site scripting vulnerability was discovered
	 in Drupal's error handler. Drupal displays PHP errors in the
	 messages area, and a specially crafted URL can cause malicious
	 scripts to be injected into the message. The issue can be
	 mitigated by disabling on-screen error display at admin /
	 settings / error-reporting. This is the recommended setting
	 for production sites.
	 When using re-colorable themes, color inputs are not sanitized.
	 Malicious color values can be used to insert arbitrary CSS and
	 script code. Successful exploitation requires the "Administer
	 themes" permission.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://drupal.org/node/1168756</url>
 </references>
 <dates>
 <discovery>2011-05-25</discovery>
 <entry>2011-05-26</entry>
 </dates>
 </vuln>

<vuln vid="e4833927-86e5-11e0-a6b4-000a5e1e33c6">
 <topic>Erlang -- ssh library uses a weak random number generator</topic>
 <affects>
 <package>
	<name>erlang</name>
	<range><lt>r14b03</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US-CERT reports:
	<blockquote cite="http://www.kb.cert.org/vuls/id/178990">
	 The Erlang/OTP ssh library implements a number of
	 cryptographic operations that depend on cryptographically
	 strong random numbers. Unfortunately the RNG used by the
	 library is not cryptographically strong, and is further
	 weakened by the use of predictable seed material. The RNG
	 (Wichman-Hill) is not mixed with an entropy source.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0766</cvename>
 <url>http://www.erlang.org/download/otp_src_R14B03.readme</url>
 <url>https://github.com/erlang/otp/commit/f228601de45c5b53241b103af6616453c50885a5</url>
 </references>
 <dates>
 <discovery>2011-05-25</discovery>
 <entry>2011-05-25</entry>
 </dates>
 </vuln>

<vuln vid="dc96ac1f-86b1-11e0-9e85-00215af774f0">
 <topic>Unbound -- an empty error packet handling assertion failure</topic>
 <affects>
 <package>
	<name>unbound</name>
	<range><lt>1.4.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Unbound developer reports:
	<blockquote cite="http://unbound.nlnetlabs.nl/downloads/CVE-2011-1922.txt">
	 NLnet Labs was notified of an error in Unbound's code-path
	 for error replies which is triggered under special conditions.
	 The error causes the program to abort.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1922</cvename>
 <url>http://unbound.nlnetlabs.nl/downloads/CVE-2011-1922.txt</url>
 </references>
 <dates>
 <discovery>2011-05-25</discovery>
 <entry>2011-05-25</entry>
 </dates>
 </vuln>

<vuln vid="115a1389-858e-11e0-a76c-000743057ca2">
 <topic>Pubcookie Login Server -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>pubcookie-login-server</name>
	<range><lt>3.3.2d</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nathan Dors, Pubcookie Project reports:
	<blockquote cite="http://pubcookie.org/news/20070606-login-secadv.html">
	 A new non-persistent XSS vulnerability was found in the
	 Pubcookie login server's compiled binary "index.cgi" CGI
	 program. The CGI program mishandles untrusted data when
	 printing responses to the browser. This makes the program
	 vulnerable to carefully crafted requests containing script
	 or HTML. If an attacker can lure an unsuspecting user to
	 visit carefully staged content, the attacker can use it to
	 redirect the user to his or her local Pubcookie login page
	 and attempt to exploit the XSS vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://pubcookie.org/news/20070606-login-secadv.html</url>
 </references>
 <dates>
 <discovery>2007-05-25</discovery>
 <entry>2011-05-23</entry>
 </dates>
 </vuln>

<vuln vid="1ca8228f-858d-11e0-a76c-000743057ca2">
 <topic>mod_pubcookie -- Empty Authentication Security Advisory</topic>
 <affects>
 <package>
	<name>ap20-mod_pubcookie</name>
	<range><ge>3.1.0</ge><lt>3.3.2b</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nathan Dors, Pubcookie Project reports:
	<blockquote cite="http://pubcookie.org/news/20061106-empty-auth-secadv.html">
	 An Abuse of Functionality vulnerability in the Pubcookie
	 authentication process was found. This vulnerability allows an
	 attacker to appear as if he or she were authenticated using an
	 empty userid when such a userid isn't expected. Unauthorized
	 access to web content and applications may result where access
	 is restricted to users who can authenticate successfully but
	 where no additional authorization is performed after
	 authentication.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://pubcookie.org/news/20061106-empty-auth-secadv.html</url>
 </references>
 <dates>
 <discovery>2006-10-04</discovery>
 <entry>2011-05-23</entry>
 </dates>
 </vuln>

<vuln vid="7af2fb85-8584-11e0-96b7-00300582f9fc">
 <topic>ViewVC -- user-reachable override of cvsdb row limit</topic>
 <affects>
 <package>
	<name>viewvc</name>
	<range><lt>1.1.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ViewVC.org reports:
	<blockquote cite="http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2536&amp;r2=2574">
	 Security fix: remove user-reachable override of cvsdb row limit.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://viewvc.tigris.org/source/browse/*checkout*/viewvc/branches/1.1.x/CHANGES</url>
 </references>
 <dates>
 <discovery>2011-05-17</discovery>
 <entry>2011-05-23</entry>
 </dates>
 </vuln>

<vuln vid="99a5590c-857e-11e0-96b7-00300582f9fc">
 <topic>Apache APR -- DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>apr1</name>
	<range><lt>1.4.5.1.3.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Portable Runtime Project reports:
	<blockquote cite="http://www.apache.org/dist/apr/CHANGES-APR-1.4">
	 A flaw was discovered in the apr_fnmatch() function in the
	 Apache Portable Runtime (APR) library 1.4.4 (or any backported
	 versions that contained the upstream fix for CVE-2011-0419).
	 This could cause httpd workers to enter a hung state (100% CPU
	 utilization).
	 apr-util 1.3.11 could cause crashes with httpd's
	 mod_authnz_ldap in some situations.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>47929</bid>
 <cvename>CVE-2011-1928</cvename>
 <cvename>CVE-2011-0419</cvename>
 <url>http://www.apache.org/dist/apr/Announcement1.x.html</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1928</url>
 </references>
 <dates>
 <discovery>2011-05-19</discovery>
 <entry>2011-05-23</entry>
 </dates>
 </vuln>

<vuln vid="d226626c-857f-11e0-95cc-001b2134ef46">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.3r181.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-12.html">
	 Critical vulnerabilities have been identified in Adobe Flash
	 Player 10.2.159.1 and earlier versions (Adobe Flash Player
	 10.2.154.28 and earlier for Chrome users) for Windows,
	 Macintosh, Linux and Solaris, and Adobe Flash Player 10.2.157.51
	 and earlier versions for Android. These vulnerabilities could
	 cause the application to crash and could potentially allow an
	 attacker to take control of the affected system. There are
	 reports of malware attempting to exploit one of the
	 vulnerabilities, CVE-2011-0627, in the wild via a Flash (.swf)
	 file embedded in a Microsoft Word (.doc) or Microsoft Excel
	 (.xls) file delivered as an email attachment targeting the
	 Windows platform. However, to date, Adobe has not obtained a
	 sample that successfully completes an attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0579</cvename>
 <cvename>CVE-2011-0618</cvename>
 <cvename>CVE-2011-0619</cvename>
 <cvename>CVE-2011-0620</cvename>
 <cvename>CVE-2011-0621</cvename>
 <cvename>CVE-2011-0622</cvename>
 <cvename>CVE-2011-0623</cvename>
 <cvename>CVE-2011-0624</cvename>
 <cvename>CVE-2011-0625</cvename>
 <cvename>CVE-2011-0626</cvename>
 <cvename>CVE-2011-0627</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb11-12.html</url>
 </references>
 <dates>
 <discovery>2011-01-20</discovery>
 <entry>2011-05-23</entry>
 </dates>
 </vuln>

<vuln vid="e666498a-852a-11e0-8f78-080027ef73ec">
 <topic>Opera -- code injection vulnerability through broken frameset handling</topic>
 <affects>
 <package><name>opera</name><range><lt>11.11</lt></range></package>
 <package><name>opera-devel</name><range><lt>11.11</lt></range></package>
 <package><name>linux-opera</name><range><lt>11.11</lt></range></package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera Software ASA reports:
	<blockquote cite="http://www.opera.com/docs/changelogs/unix/1111/">
	 Fixed an issue with framesets that could allow execution of
	 arbitrary code, as reported by an anonymous contributor working
	 with the SecuriTeam Secure Disclosure program.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.opera.com/docs/changelogs/unix/1111/</url>
 <url>http://www.opera.com/support/kb/view/992/</url>
 </references>
 <dates>
 <discovery>2011-05-18</discovery>
 <entry>2011-05-23</entry>
 </dates>
 </vuln>

<vuln vid="1495f931-8522-11e0-a1c1-00215c6a37bb">
 <topic>pureftpd -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>pure-ftpd</name>
	<range><lt>1.0.32</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pure-FTPd development team reports:
	<blockquote cite="http://www.pureftpd.org/project/pure-ftpd/news">
	 Support for braces expansion in directory listings has been
	 disabled -- Cf. CVE-2011-0418.
	 Fix a STARTTLS flaw similar to Postfix's CVE-2011-0411.
	 If you're using TLS, upgrading is recommended.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>46767</bid>
 <cvename>CVE-2011-0418</cvename>
 <cvename>CVE-2011-1575</cvename>
 </references>
 <dates>
 <discovery>2011-04-01</discovery>
 <entry>2011-05-23</entry>
 </dates>
 </vuln>

<vuln vid="36594c54-7be7-11e0-9838-0022156e8794">
 <topic>Exim -- remote code execution and information disclosure</topic>
 <affects>
 <package>
	<name>exim</name>
	<range><ge>4.70</ge><lt>4.76</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Release notes for Exim 4.76 says:
	<blockquote cite="ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.76">
	 Bugzilla 1106: CVE-2011-1764 - DKIM log line was subject to
	 a format-string attack -- SECURITY: remote arbitrary code
	 execution.
	 DKIM signature header parsing was double-expanded, second
	 time unintentionally subject to list matching rules, letting
	 the header cause arbitrary Exim lookups (of items which can
	 occur in lists, *not* arbitrary string expansion). This
	 allowed for information disclosure.
	</blockquote>
	Also, impact assessment was redone shortly after the original
	 announcement:
	<blockquote cite="https://lists.exim.org/lurker/message/20110512.102909.8136175a.en.html">
	 Further analysis revealed that the second security was
	 more severe than I realised at the time that I wrote the
	 announcement. The second security issue has been assigned
	 CVE-2011-1407 and is also a remote code execution flaw.
	 For clarity: both issues were introduced with 4.70.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1764</cvename>
 <cvename>CVE-2011-1407</cvename>
 <mlist msgid="20110512102909.GA58484@redoubt.spodhuis.org">https://lists.exim.org/lurker/message/20110512.102909.8136175a.en.html</mlist>
 <url>http://bugs.exim.org/show_bug.cgi?id=1106</url>
 </references>
 <dates>
 <discovery>2011-05-10</discovery>
 <entry>2011-05-14</entry>
 </dates>
 </vuln>

<vuln vid="00b296b6-7db1-11e0-96b7-00300582f9fc">
 <topic>Apache APR -- DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>apr1</name>
	<range><lt>1.4.4.1.3.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Portable Runtime Project reports:
	<blockquote cite="http://www.apache.org/dist/apr/CHANGES-APR-1.4">
	 Note especially a security fix to APR 1.4.4, excessive CPU
	 consumption was possible due to an unconstrained, recursive
	 invocation of apr_fnmatch, as apr_fnmatch processed '*' wildcards.
	 Reimplement apr_fnmatch() from scratch using a non-recursive
	 algorithm now has improved compliance with the fnmatch() spec.
	 (William Rowe)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0419</cvename>
 <url>http://www.apache.org/dist/apr/Announcement1.x.html</url>
 </references>
 <dates>
 <discovery>2011-05-10</discovery>
 <entry>2011-05-12</entry>
 </dates>
 </vuln>

<vuln vid="34e8ccf5-7d71-11e0-9d83-000c29cc39d3">
 <topic>Zend Framework -- potential SQL injection when using PDO_MySql</topic>
 <affects>
 <package>
	<name>ZendFramework</name>
	<range><lt>1.11.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Zend Framework team reports:
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2011-02">
	 Developers using non-ASCII-compatible encodings in conjunction
	 with the MySQL PDO driver of PHP may be vulnerable to SQL
	 injection attacks. Developers using ASCII-compatible encodings
	 like UTF8 or latin1 are not affected by this PHP issue.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://framework.zend.com/security/advisory/ZF2011-02</url>
 <url>http://zend-framework-community.634137.n4.nabble.com/Zend-Framework-1-11-6-and-1-10-9-released-td3503741.html</url>
 </references>
 <dates>
 <discovery>2011-05-06</discovery>
 <entry>2011-05-13</entry>
 </dates>
 </vuln>

<vuln vid="3fadb7c6-7b0a-11e0-89b4-001ec9578670">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki</name>
	<range><lt>1.16.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mediawiki reports:
	<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html">
	 (Bug 28534) XSS vulnerability for IE 6 clients. This is the
	 third attempt at fixing bug 28235.
	 (Bug 28639) Potential privilege escalation when
	 $wgBlockDisablesLogin is enabled.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.wikimedia.org/show_bug.cgi?id=28534</url>
 <url>https://bugzilla.wikimedia.org/show_bug.cgi?id=28639</url>
 <url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html</url>
 <url>http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_5/phase3/RELEASE-NOTES</url>
 </references>
 <dates>
 <discovery>2011-04-14</discovery>
 <entry>2011-05-12</entry>
 </dates>
 </vuln>

<vuln vid="3eb2c100-738b-11e0-89f4-001e90d46635">
 <topic>Postfix -- memory corruption vulnerability</topic>
 <affects>
 <package>
	<name>postfix</name>
	<name>postfix-base</name>
	<range><ge>2.8.*,1</ge><lt>2.8.3,1</lt></range>
	<range><ge>2.7.*,1</ge><lt>2.7.4,1</lt></range>
	<range><ge>2.6.*,1</ge><lt>2.6.10,1</lt></range>
	<range><ge>2.5.*,2</ge><lt>2.5.13,2</lt></range>
	<range><le>2.4.16,1</le></range>
 </package>
 <package>
	<name>postfix-current</name>
	<name>postfix-current-base</name>
	<range><lt>2.9.20110501,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Postfix SMTP server has a memory corruption error, when the
	 Cyrus SASL library is used with authentication mechanisms other
	 than PLAIN and LOGIN (ANONYMOUS is not affected, but should not
	 be used for other reasons). This memory corruption is known to
	 result in a program crash (SIGSEV).
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1720</cvename>
 <url>http://www.postfix.org/CVE-2011-1720.html</url>
 </references>
 <dates>
 <discovery>2011-05-09</discovery>
 <entry>2011-05-09</entry>
 </dates>
 </vuln>

<vuln vid="04b7d46c-7226-11e0-813a-6c626dd55a41">
 <topic>Mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.17,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.19,1</lt></range>
	<range><gt>4.0.*,1</gt><lt>4.0.1,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.17</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.6.17,1</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.19</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.14</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2011-12 Miscellaneous memory safety hazards
	 MFSA 2011-13 Multiple dangling pointer vulnerabilities
	 MFSA 2011-14 Information stealing via form history
	 MFSA 2011-15 Escalation of privilege through Java Embedding Plugin
	 MFSA 2011-16 Directory traversal in resource: protocol
	 MFSA 2011-17 WebGLES vulnerabilities
	 MFSA 2011-18 XSLT generate-id() function heap address leak
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-12.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-13.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-14.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-15.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-16.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-17.html</url>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-18.html</url>
 </references>
 <dates>
 <discovery>2011-04-28</discovery>
 <entry>2011-04-29</entry>
 </dates>
 </vuln>

<vuln vid="3c7d565a-6c64-11e0-813a-6c626dd55a41">
 <topic>Asterisk -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>asterisk14</name>
	<range><gt>1.4.*</gt><lt>1.4.40.1</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><gt>1.6.*</gt><lt>1.6.2.17.3</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.3.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk Development Team reports:
	<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-April/000316.html">
	 It is possible for a user of the Asterisk Manager Interface to
	 bypass a security check and execute shell commands when they
	 should not have that ability. Sending the "Async" header with
	 the "Application" header during an Originate action, allows
	 authenticated manager users to execute shell commands. Only
	 users with the "system" privilege should be able to do this.
	 On systems that have the Asterisk Manager Interface, Skinny, SIP
	 over TCP, or the built in HTTP server enabled, it is possible for
	 an attacker to open as many connections to asterisk as he wishes.
	 This will cause Asterisk to run out of available file descriptors
	 and stop processing any new calls. Additionally, disk space can
	 be exhausted as Asterisk logs failures to open new file
	 descriptors.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1507</cvename>
 <url>http://downloads.asterisk.org/pub/security/AST-2011-005.pdf</url>
 <url>http://downloads.asterisk.org/pub/security/AST-2011-006.pdf</url>
 </references>
 <dates>
 <discovery>2011-04-21</discovery>
 <entry>2011-04-21</entry>
 </dates>
 </vuln>

<vuln vid="6a4bfe75-692a-11e0-bce7-001eecdd401a">
 <topic>VLC -- Heap corruption in MP4 demultiplexer</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><ge>1.0.0</ge><lt>1.1.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	VideoLAN project reports:
	<blockquote cite="http://www.videolan.org/security/sa1103.html">
	 When parsing some MP4 (MPEG-4 Part 14) files, insufficient
	 buffer size might lead to corruption of the heap.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.videolan.org/security/sa1103.html</url>
 </references>
 <dates>
 <discovery>2011-04-07</discovery>
 <entry>2011-04-17</entry>
 </dates>
 </vuln>

<vuln vid="32b05547-6913-11e0-bdc4-001b2134ef46">
 <topic>linux-flashplugin -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
 </package>
 <package>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.2r159.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="http://www.adobe.com/support/security/advisories/apsa11-02.html">
	 A critical vulnerability exists in Flash Player 10.2.153.1
	 and earlier versions (Adobe Flash Player 10.2.154.25 and
	 earlier for Chrome users) for Windows, Macintosh, Linux
	 and Solaris, Adobe Flash Player 10.2.156.12 and earlier
	 versions for Android, and the Authplay.dll component that
	 ships with Adobe Reader and Acrobat X (10.0.2) and earlier
	 10.x and 9.x versions for Windows and Macintosh operating
	 systems.
	 This vulnerability (CVE-2011-0611) could cause a crash
	 and potentially allow an attacker to take control of the
	 affected system. There are reports that this vulnerability
	 is being exploited in the wild in targeted attacks via a
	 malicious Web page or a Flash (.swf) file embedded in a
	 Microsoft Word (.doc) or Microsoft Excel (.xls) file
	 delivered as an email attachment, targeting the Windows
	 platform. At this time, Adobe is not aware of any attacks
	 via PDF targeting Adobe Reader and Acrobat. Adobe Reader
	 X Protected Mode mitigations would prevent an exploit of
	 this kind from executing.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0611</cvename>
 <url>http://www.adobe.com/support/security/advisories/apsa11-02.html</url>
 </references>
 <dates>
 <discovery>2011-01-20</discovery>
 <entry>2011-04-17</entry>
 </dates>
 </vuln>

<vuln vid="bf171509-68dd-11e0-afe6-0003ba02bf30">
 <topic>rt -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>rt36</name>
	<range><lt>3.6.11</lt></range>
 </package>
 <package>
	<name>rt38</name>
	<range><lt>3.8.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Best Practical reports:
	<blockquote cite="http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html">
	 In the process of preparing the release of RT 4.0.0, we performed
	 an extensive security audit of RT's source code. During this
	 audit, several vulnerabilities were found which affect earlier
	 releases of RT.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1685</cvename>
 <cvename>CVE-2011-1686</cvename>
 <cvename>CVE-2011-1687</cvename>
 <cvename>CVE-2011-1688</cvename>
 <cvename>CVE-2011-1689</cvename>
 <cvename>CVE-2011-1690</cvename>
 <url>http://secunia.com/advisories/44189</url>
 </references>
 <dates>
 <discovery>2011-04-14</discovery>
 <entry>2011-04-17</entry>
 </dates>
 </vuln>

<vuln vid="6a3c3e5c-66cb-11e0-a116-c535f3aa24f0">
 <topic>krb5 -- MITKRB5-SA-2011-004, kadmind invalid pointer free() [CVE-2011-0285]</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><ge>1.7</ge><lt>1.7.2</lt></range>
	<range><ge>1.8</ge><lt>1.8.4</lt></range>
	<range><eq>1.9</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An advisory published by the MIT Kerberos team says:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt">
	 The password-changing capability of the MIT krb5 administration
	 daemon (kadmind) has a bug that can cause it to attempt to free()
	 an invalid pointer under certain error conditions. This can cause
	 the daemon to crash or induce the execution of arbitrary code
	 (which is believed to be difficult). No exploit that executes
	 arbitrary code is known to exist, but it is easy to trigger a
	 denial of service manually.
	 Some platforms detect attempted freeing of invalid pointers and
	 protectively terminate the process, preventing arbitrary code
	 execution on those platforms.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0285</cvename>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt</url>
 </references>
 <dates>
 <discovery>2011-04-12</discovery>
 <entry>2011-04-14</entry>
 </dates>
 </vuln>

<vuln vid="7edac52a-66cd-11e0-9398-5d45f3aa24f0">
 <topic>krb5 -- MITKRB5-SA-2011-003, KDC vulnerable to double-free when PKINIT enabled</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><ge>1.7</ge><lt>1.7.2</lt></range>
	<range><ge>1.8</ge><lt>1.8.4</lt></range>
	<range><eq>1.9</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An advisory published by the MIT Kerberos team says:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-003.txt">
	 The MIT Kerberos 5 Key Distribution Center (KDC) daemon is
	 vulnerable to a double-free condition if the Public Key
	 Cryptography for Initial Authentication (PKINIT) capability is
	 enabled, resulting in daemon crash or arbitrary code execution
	 (which is believed to be difficult).
	 An unauthenticated remote attacker can induce a double-free
	 event, causing the KDC daemon to crash (denial of service),
	 or to execute arbitrary code. Exploiting a double-free event
	 to execute arbitrary code is believed to be difficult.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0284</cvename>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-003.txt</url>
 </references>
 <dates>
 <discovery>2011-03-15</discovery>
 <entry>2011-04-14</entry>
 </dates>
 </vuln>

<vuln vid="4ab413ea-66ce-11e0-bf05-d445f3aa24f0">
 <topic>krb5 -- MITKRB5-SA-2011-002, KDC vulnerable to hang when using LDAP back end</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><ge>1.7</ge><lt>1.7.2</lt></range>
	<range><ge>1.8</ge><le>1.8.4</le></range>
	<range><eq>1.9</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An advisory published by the MIT Kerberos team says:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-002.txt">
	 The MIT krb5 Key Distribution Center (KDC) daemon is vulnerable
	 to denial of service attacks from unauthenticated remote
	 attackers. CVE-2011-0281 and CVE-2011-0282 occur only in KDCs
	 using LDAP back ends, but CVE-2011-0283 occurs in all krb5-1.9
	 KDCs.
	 Exploit code is not known to exist, but the vulnerabilities are
	 easy to trigger manually. The trigger for CVE-2011-0281 has
	 already been disclosed publicly, but that fact might not be
	 obvious to casual readers of the message in which it was
	 disclosed. The triggers for CVE-2011-0282 and CVE-2011-0283
	 have not yet been disclosed publicly, but they are also
	 trivial.
	 CVE-2011-0281: An unauthenticated remote attacker can cause a KDC
	 configured with an LDAP back end to become completely unresponsive
	 until restarted.
	 CVE-2011-0282: An unauthenticated remote attacker can cause a KDC
	 configured with an LDAP back end to crash with a null pointer
	 dereference.
	 CVE-2011-0283: An unauthenticated remote attacker can cause a
	 krb5-1.9 KDC with any back end to crash with a null pointer
	 dereference.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0281</cvename>
 <cvename>CVE-2011-0282</cvename>
 <cvename>CVE-2011-0283</cvename>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-002.txt</url>
 </references>
 <dates>
 <discovery>2011-02-08</discovery>
 <entry>2011-04-14</entry>
 </dates>
 </vuln>

<vuln vid="64f24a1e-66cf-11e0-9deb-f345f3aa24f0">
 <topic>krb5 -- MITKRB5-SA-2011-001, kpropd denial of service</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><ge>1.7</ge><lt>1.7.2</lt></range>
	<range><ge>1.8</ge><lt>1.8.4</lt></range>
	<range><eq>1.9</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An advisory published by the MIT Kerberos team says:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-001.txt">
	 The MIT krb5 KDC database propagation daemon (kpropd) is
	 vulnerable to a denial-of-service attack triggered by invalid
	 network input. If a kpropd worker process receives invalid
	 input that causes it to exit with an abnormal status, it can
	 cause the termination of the listening process that spawned it,
	 preventing the slave KDC it was running on from receiving
	 database updates from the master KDC.
	 Exploit code is not known to exist, but the vulnerabilities are
	 easy to trigger manually.
	 An unauthenticated remote attacker can cause kpropd running in
	 standalone mode (the "-S" option) to terminate its listening
	 process, preventing database propagations to the KDC host on
	 which it was running. Configurations where kpropd runs in
	 incremental propagation mode ("iprop") or as an inetd server
	 are not affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-4022</cvename>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-001.txt</url>
 </references>
 <dates>
 <discovery>2011-02-08</discovery>
 <entry>2011-04-14</entry>
 </dates>
 </vuln>

<vuln vid="2eccb24f-61c0-11e0-b199-0015f2db7bde">
 <topic>xrdb -- root hole via rogue hostname</topic>
 <affects>
 <package>
	<name>xrdb</name>
	<range><lt>1.0.6_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Hopf reports:
	<blockquote cite="http://lists.freedesktop.org/archives/xorg-announce/2011-April/001636.html">
	 By crafting hostnames with shell escape characters, arbitrary
	 commands can be executed in a root environment when a display
	 manager reads in the resource database via xrdb.
	 These specially crafted hostnames can occur in two environments:
	 Systems are affected are: systems set their hostname via DHCP,
	 and the used DHCP client allows setting of hostnames with illegal
	 characters. And systems that allow remote logins via xdmcp.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0465</cvename>
 <url>http://lists.freedesktop.org/archives/xorg-announce/2011-April/001636.html</url>
 </references>
 <dates>
 <discovery>2011-04-05</discovery>
 <entry>2011-04-14</entry>
 </dates>
 </vuln>

<vuln vid="a4372a68-652c-11e0-a25a-00151735203a">
 <topic>OTRS -- Several XSS attacks possible</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><gt>2.3.*</gt><lt>3.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OTRS Security Advisory reports:
	<blockquote cite="http://otrs.org/advisory/OSA-2011-01-en/">
	 <ul>
	 <li>Several XSS attacks possible:
	 An attacker could trick a logged in user to following a prepared
	 URL inside of the OTRS system which causes a page to be shown that
	 possibly includes malicious !JavaScript code because of incorrect
	 escaping during the generation of the HTML page.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1518</cvename>
 <url>http://otrs.org/advisory/OSA-2011-01-en/</url>
 </references>
 <dates>
 <discovery>2011-03-12</discovery>
 <entry>2011-04-12</entry>
 </dates>
 </vuln>

<vuln vid="7e69f00d-632a-11e0-9f3a-001d092480a4">
 <topic>isc-dhcp-client -- dhclient does not strip or escape shell meta-characters</topic>
 <affects>
 <package>
	<name>isc-dhcp31-client</name>
	<range><lt>3.1.ESV_1,1</lt></range>
 </package>
 <package>
	<name>isc-dhcp41-client</name>
	<range><lt>4.1.e,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2011-0997">
	 ISC dhclient did not strip or escape certain shell meta-characters
	 in responses from the dhcp server (like hostname) before passing the
	 responses on to dhclient-script. Depending on the script and OS,
	 this can result in execution of exploit code on the client.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0997</cvename>
 <certvu>107886</certvu>
 </references>
 <dates>
 <discovery>2011-04-05</discovery>
 <entry>2011-04-10</entry>
 </dates>
 </vuln>

<vuln vid="b9281fb9-61b2-11e0-b1ce-0019d1a7ece2">
 <topic>tinyproxy -- ACL lists ineffective when range is configured</topic>
 <affects>
 <package>
	<name>tinyproxy</name>
	<range><lt>1.8.2_2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 When including a line to allow a network of IP addresses, the access to tinyproxy
	 56 is actually allowed for all IP addresses.
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1499</cvename>
 <url>https://banu.com/bugzilla/show_bug.cgi?id=90</url>
 </references>
 <dates>
 <discovery>2010-05-18</discovery>
 <entry>2011-04-08</entry>
 </dates>
 </vuln>

<vuln vid="b2a40507-5c88-11e0-9e85-00215af774f0">
 <topic>quagga -- two DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>quagga</name>
	<range><lt>0.99.17_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Quagga developers report:
	<blockquote cite="http://www.quagga.net/news2.php?y=2011&amp;m=3&amp;d=21#id1300723200">
	 Quagga 0.99.18 has been released.
	 This release fixes 2 denial of services in bgpd, which can be
	 remotely triggered by malformed AS-Pathlimit or Extended-Community
	 attributes. These issues have been assigned CVE-2010-1674 and
	 CVE-2010-1675. Support for AS-Pathlimit has been removed with this
	 release.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1674</cvename>
 <cvename>CVE-2010-1675</cvename>
 <url>http://www.quagga.net/news2.php?y=2011&amp;m=3&amp;d=21#id1300723200</url>
 </references>
 <dates>
 <discovery>2010-04-30</discovery>
 <entry>2011-04-01</entry>
 </dates>
 </vuln>

<vuln vid="c6fbd447-59ed-11e0-8d04-0015f2db7bde">
 <topic>gdm -- privilege escalation vulnerability</topic>
 <affects>
 <package>
	<name>gdm</name>
	<range><lt>2.30.5_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sebastian Krahmer reports:
	<blockquote cite="http://mail.gnome.org/archives/distributor-list/2011-March/msg00008.html">
	 It was discovered that the GNOME Display Manager (gdm) cleared the cache
	 directory, which is owned by an unprivileged user, with the privileges of the
	 root user. A race condition exists in gdm where a local user could take
	 advantage of this by writing to the cache directory between ending the session
	 and the signal to clean up the session, which could lead to the execution of
	 arbitrary code as the root user.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0727</cvename>
 <url>http://mail.gnome.org/archives/distributor-list/2011-March/msg00008.html</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=688323</url>
 </references>
 <dates>
 <discovery>2011-03-28</discovery>
 <entry>2011-03-29</entry>
 </dates>
 </vuln>

<vuln vid="fe853666-56ce-11e0-9668-001fd0d616cf">
 <topic>php -- ZipArchive segfault with FL_UNCHANGED on empty archive</topic>
 <affects>
 <package>
	<name>php5-zip</name>
	<range><lt>5.3.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US-CERT/NIST reports:
	<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0421">
	 The _zip_name_locate function in zip_name_locate.c in the Zip extension
	 in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED
	 argument, which might allow context-dependent attackers to cause a
	 denial of service (application crash) via an empty ZIP archive that is
	 processed with a (1) locateName or (2) statName operation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0421</cvename>
 </references>
 <dates>
 <discovery>2011-03-20</discovery>
 <entry>2011-03-25</entry>
 </dates>
 </vuln>

<vuln vid="cc3bfec6-56cd-11e0-9668-001fd0d616cf">
 <topic>php -- crash on crafted tag in exif</topic>
 <affects>
 <package>
	<name>php5-exif</name>
	<range><lt>5.3.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US-CERT/NIST reports:
	<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0708">
	 exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms
	 performs an incorrect cast, which allows remote attackers to cause a
	 denial of service (application crash) via an image with a crafted
	 Image File Directory (IFD) that triggers a buffer over-read.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0708</cvename>
 </references>
 <dates>
 <discovery>2011-03-20</discovery>
 <entry>2011-03-25</entry>
 </dates>
 </vuln>

<vuln vid="501ee07a-5640-11e0-985a-001b2134ef46">
 <topic>linux-flashplugin -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
 </package>
 <package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.2r153</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="http://www.adobe.com/support/security/advisories/apsa11-01.html">
	 A critical vulnerability exists in Adobe Flash Player
	 10.2.152.33 and earlier versions (Adobe Flash Player
	 10.2.154.18 and earlier for Chrome users) for Windows,
	 Macintosh, Linux and Solaris operating systems, Adobe
	 Flash Player 10.1.106.16 and earlier versions for Android,
	 and the Authplay.dll component that ships with Adobe Reader
	 and Acrobat X (10.0.1) and earlier 10.x and 9.x versions of
	 Reader and Acrobat for Windows and Macintosh operating systems.
	 This vulnerability (CVE-2011-0609) could cause a crash and
	 potentially allow an attacker to take control of the affected
	 system. There are reports that this vulnerability is being
	 exploited in the wild in targeted attacks via a Flash (.swf)
	 file embedded in a Microsoft Excel (.xls) file delivered as
	 an email attachment.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0609</cvename>
 <url>http://www.adobe.com/support/security/advisories/apsa11-01.html</url>
 </references>
 <dates>
 <discovery>2011-01-20</discovery>
 <entry>2011-03-24</entry>
 </dates>
 </vuln>

<vuln vid="b2f09169-55af-11e0-9d6f-000f20797ede">
 <topic>mozilla -- update to HTTPS certificate blacklist</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.16,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.18,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.16</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.6.16,1</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.18</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.13</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2011-11 Update to HTTPS certificate blacklist
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.mozilla.org/security/announce/2011/mfsa2011-11.html</url>
 </references>
 <dates>
 <discovery>2011-03-22</discovery>
 <entry>2011-03-24</entry>
 </dates>
 </vuln>

<vuln vid="14a6f516-502f-11e0-b448-bbfa2731f9c7">
 <topic>postfix -- plaintext command injection with SMTP over TLS</topic>
 <affects>
 <package>
	<name>postfix</name>
	<name>postfix-base</name>
	<range><ge>2.7.*,1</ge><lt>2.7.3,1</lt></range>
	<range><ge>2.6.*,1</ge><lt>2.6.9,1</lt></range>
	<range><ge>2.5.*,2</ge><lt>2.5.12,2</lt></range>
	<range><ge>2.4.*,1</ge><lt>2.4.16,1</lt></range>
 </package>
 <package>
	<name>postfix-current</name>
	<name>postfix-current-base</name>
	<range><lt>2.9.20100120,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wietse Venema has discovered a software flaw that allows
	 an attacker to inject client commands into an SMTP session
	 during the unprotected plaintext SMTP protocol phase, such
	 that the server will execute those commands during the SMTP-
	 over-TLS protocol phase when all communication is supposed
	 to be protected.
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0411</cvename>
 <url>http://www.postfix.org/CVE-2011-0411.html</url>
 <url>http://secunia.com/advisories/43646/</url>
 </references>
 <dates>
 <discovery>2011-03-07</discovery>
 <entry>2011-03-19</entry>
 </dates>
 </vuln>

<vuln vid="b13414c9-50ba-11e0-975a-000c29cc39d3">
 <topic>hiawatha -- integer overflow in Content-Length header parsing</topic>
 <affects>
 <package>
	<name>hiawatha</name>
	<range><lt>7.4_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hugo Leisink reports:
	<blockquote cite="http://www.hiawatha-webserver.org/weblog/16">
	 A bug has been found in version 7.4 of the Hiawatha webserver,
	 which could lead to a server crash. This is caused by an integer
	 overflow in the routine that reads the HTTP request. A too large
	 value of the Content-Length HTTP header results in an overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.hiawatha-webserver.org/weblog/16</url>
 <url>http://secunia.com/advisories/43660/</url>
 <url>http://securityvulns.com/Zdocument902.html</url>
 <url>http://packetstormsecurity.org/files/99021/Hiawatha-WebServer-7.4-Denial-Of-Service.html</url>
 <url>http://seclists.org/bugtraq/2011/Mar/65</url>
 </references>
 <dates>
 <discovery>2011-02-25</discovery>
 <entry>2011-03-17</entry>
 </dates>
 </vuln>

<vuln vid="bfe9c75e-5028-11e0-b2d2-00215c6a37bb">
 <topic>asterisk -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
 <name>asterisk16</name>
 <range><gt>1.6.*</gt><lt>1.6.2.17.1</lt></range>
 </package>
 <package>
 <name>asterisk18</name>
 <range><gt>1.8.*</gt><lt>1.8.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk Development Team reports:
	<blockquote cite="http://www.venturevoip.com/news.php?rssid=2521">
	 The releases of Asterisk 1.6.1.23, 1.6.2.17.1, and 1.8.3.1
	 resolve two issues:
	 <ul>
	 <li>Resource exhaustion in Asterisk Manager Interface
	 (AST-2011-003)</li>
	 <li>Remote crash vulnerability in TCP/TLS server
	 (AST-2011-004)</li>
	 </ul>
	 The issues and resolutions are described in the AST-2011-003
	 and AST-2011-004 security advisories.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2011-003.html</url>
 <url>http://downloads.asterisk.org/pub/security/AST-2011-004.html</url>
 </references>
 <dates>
 <discovery>2011-03-01</discovery>
 <entry>2011-03-16</entry>
 </dates>
 </vuln>

<vuln vid="8b986a05-4dbe-11e0-8b9a-02e0184b8d35">
 <topic>avahi -- denial of service</topic>
 <affects>
 <package>
	<name>avahi</name>
	<name>avahi-app</name>
	<name>avahi-autoipd</name>
	<name>avahi-gtk</name>
	<name>avahi-libdns</name>
	<name>avahi-qt3</name>
	<name>avahi-qt4</name>
	<name>avahi-sharp</name>
	<range><lt>0.6.29</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Avahi developers reports:
	<blockquote cite="http://secunia.com/advisories/43361/">
	 A vulnerability has been reported in Avahi, which can be exploited
	 by malicious people to cause a DoS (Denial of Service).
	 The vulnerability is caused due to an error when processing certain
	 UDP packets, which can be exploited to trigger an infinite loop by
	 e.g. sending an empty packet to port 5353/UDP.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1002</cvename>
 <cvename>CVE-2010-2244</cvename>
 <url>http://secunia.com/advisories/43361/</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=667187</url>
 </references>
 <dates>
 <discovery>2011-02-21</discovery>
 <entry>2011-03-13</entry>
 </dates>
 </vuln>

<vuln vid="64691c49-4b22-11e0-a226-00e0815b8da8">
 <topic>mailman -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>mailman</name>
	<range><lt>2.1.14_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0707">
	 Multiple cross-site scripting (XSS) vulnerabilities in
	 Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote
	 attackers to inject arbitrary web script or HTML via the (1)
	 full name or (2) username field in a confirmation message.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0707</cvename>
 <url>http://mail.python.org/pipermail/mailman-announce/2011-February/000157.html</url>
 </references>
 <dates>
 <discovery>2011-02-13</discovery>
 <entry>2011-03-10</entry>
 </dates>
 </vuln>

<vuln vid="cf96cd8d-48fb-11e0-98a6-0050569b2d21">
 <topic>redmine -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>redmine</name>
	<range><gt>1.0</gt><lt>1.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jean-Philippe Lang reports:
	<blockquote cite="http://www.redmine.org/news/53">
	 This maintenance release for 1.1.x users includes
	 13 bug fixes since 1.1.1 and a security fix (XSS
	 vulnerability affecting all Redmine versions from
	 1.0.1 to 1.1.1).
	 
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.redmine.org/news/53</url>
 </references>
 <dates>
 <discovery>2011-03-07</discovery>
 <entry>2011-03-07</entry>
 </dates>
 </vuln>

<vuln vid="e27ca763-4721-11e0-bdc4-001e8c75030d">
 <topic>subversion -- remote HTTP DoS vulnerability</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><ge>1.6</ge><le>1.6.15</le></range>
	<range><ge>1.5</ge><le>1.6.9</le></range>
 </package>
 <package>
	<name>subversion-freebsd</name>
	<range><ge>1.6</ge><le>1.6.15</le></range>
	<range><ge>1.5</ge><le>1.6.9</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Subversion project reports:
	<blockquote cite="http://subversion.apache.org/security/CVE-2011-0715-advisory.txt">
	 Subversion HTTP servers up to 1.5.9 (inclusive) or 1.6.15 (inclusive)
	 are vulnerable to a remotely triggerable NULL-pointer dereference.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0715</cvename>
 </references>
 <dates>
 <discovery>2011-02-27</discovery>
 <entry>2011-03-05</entry>
 </dates>
 </vuln>

<vuln vid="45f102cd-4456-11e0-9580-4061862b8c22">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.14,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.17,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.14</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.6.14,1</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.17</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.12</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><ge>3.1</ge><lt>3.1.8</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.12</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>3.1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2011-01 Miscellaneous memory safety hazards (rv:1.9.2.14/ 1.9.1.17)
	 MFSA 2011-02 Recursive eval call causes confirm dialogs to evaluate to true
	 MFSA 2011-03 Use-after-free error in JSON.stringify
	 MFSA 2011-04 Buffer overflow in JavaScript upvarMap
	 MFSA 2011-05 Buffer overflow in JavaScript atom map
	 MFSA 2011-06 Use-after-free error using Web Workers
	 MFSA 2011-07 Memory corruption during text run construction (Windows)
	 MFSA 2011-08 ParanoidFragmentSink allows javascript: URLs in chrome documents
	 MFSA 2011-09 Crash caused by corrupted JPEG image
	 MFSA 2011-10 CSRF risk with plugins and 307 redirects
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1585</cvename>
 <cvename>CVE-2011-0051</cvename>
 <cvename>CVE-2011-0053</cvename>
 <cvename>CVE-2011-0054</cvename>
 <cvename>CVE-2011-0055</cvename>
 <cvename>CVE-2011-0056</cvename>
 <cvename>CVE-2011-0057</cvename>
 <cvename>CVE-2011-0058</cvename>
 <cvename>CVE-2011-0059</cvename>
 <cvename>CVE-2011-0061</cvename>
 <cvename>CVE-2011-0062</cvename>
 <url>https://www.mozilla.org/security/announce/2011/mfsa2011-01.html</url>
 <url>https://www.mozilla.org/security/announce/2011/mfsa2011-02.html</url>
 <url>https://www.mozilla.org/security/announce/2011/mfsa2011-03.html</url>
 <url>https://www.mozilla.org/security/announce/2011/mfsa2011-04.html</url>
 <url>https://www.mozilla.org/security/announce/2011/mfsa2011-05.html</url>
 <url>https://www.mozilla.org/security/announce/2011/mfsa2011-06.html</url>
 <url>https://www.mozilla.org/security/announce/2011/mfsa2011-07.html</url>
 <url>https://www.mozilla.org/security/announce/2011/mfsa2011-08.html</url>
 <url>https://www.mozilla.org/security/announce/2011/mfsa2011-09.html</url>
 <url>https://www.mozilla.org/security/announce/2011/mfsa2011-10.html</url>
 </references>
 <dates>
 <discovery>2011-03-01</discovery>
 <entry>2011-03-01</entry>
 </dates>
 </vuln>

<vuln vid="be3dfe33-410b-11e0-9e02-00215c6a37bb">
 <topic>openldap -- two security bypass vulnerabilities</topic>
 <affects>
 <package>
	<name>openldap-server</name>
	<range><gt>2.4.0</gt><lt>2.4.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/43331/">
	 Two vulnerabilities have been reported in
	 OpenLDAP, which can be exploited by malicious
	 people to bypass certain security restrictions.
	 The vulnerabilities are reported in versions
	 prior to 2.4.24.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/43331/</url>
 </references>
 <dates>
 <discovery>2011-02-14</discovery>
 <entry>2011-02-25</entry>
 </dates>
 </vuln>

<vuln vid="65d16342-3ec8-11e0-9df7-001c42d23634">
 <topic>asterisk -- Exploitable Stack and Heap Array Overflows</topic>
 <affects>
 <package>
 <name>asterisk14</name>
 <range><gt>1.4.*</gt><lt>1.4.39.2</lt></range>
 </package>
 <package>
 <name>asterisk16</name>
 <range><gt>1.6.*</gt><lt>1.6.2.16.2</lt></range>
 </package>
 <package>
 <name>asterisk18</name>
 <range><gt>1.8.*</gt><lt>1.8.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk Development Team reports:
	<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-February/000302.html">
	 The releases of Asterisk 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and
	 1.8.2.4 resolve an issue that when decoding UDPTL packets, multiple
	 heap based arrays can be made to overflow by specially
	 crafted packets. Systems configured for T.38 pass through or
	 termination are vulnerable. The issue and resolution are described
	 in the AST-2011-002 security advisory.
	</blockquote>
 </body>
 </description>
 <references>
	<url>http://downloads.asterisk.org/pub/security/AST-2011-002.html</url>
	<url>http://secunia.com/advisories/43429/</url>
 </references>
 <dates>
 <discovery>2011-02-21</discovery>
 <entry>2011-02-22</entry>
 </dates>
 </vuln>

<vuln vid="ae0e5835-3cad-11e0-b654-00215c6a37bb">
 <topic>PivotX -- administrator password reset vulnerability</topic>
 <affects>
 <package>
	<name>pivotx</name>
	<range><lt>2.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US CERT reports:
	<blockquote cite="http://www.kb.cert.org/vuls/id/175068">
	 PivotX contains a vulnerability that allows an
	 attacker to change the password of any account
	 just by guessing the username. Version 2.2.4 has
	 been reported to not be affected.
	 This vulnerability is being exploited in the wild
	 and users should immediately upgrade to 2.2.5 or
	 later. Mitigation steps for users that have been
	 compromised have been posted to the <a href="http://forum.pivotx.net/viewtopic.php?f=2&amp;t=1967">PivotX
	 Support Community</a>.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-1035</cvename>
 </references>
 <dates>
 <discovery>2011-02-18</discovery>
 <entry>2011-02-20</entry>
 </dates>
 </vuln>

<vuln vid="553ec4ed-38d6-11e0-94b1-000c29ba66d2">
 <topic>tomcat -- Cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><gt>5.5.0</gt><lt>5.5.32</lt></range>
 </package>
 <package>
	<name>tomcat</name>
	<range><gt>6.0.0</gt><lt>6.0.30</lt></range>
 </package>
 <package>
	<name>tomcat</name>
	<range><gt>7.0.0</gt><lt>7.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Tomcat security team reports:
	<blockquote cite="http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32">
	 The HTML Manager interface displayed web applciation
	 provided data, such as display names, without filtering.
	 A malicious web application could trigger script execution
	 by an administartive user when viewing the manager pages.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0013</cvename>
 <url>http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32</url>
 <url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.30</url>
 <url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.6</url>
 </references>
 <dates>
 <discovery>2010-11-12</discovery>
 <entry>2011-02-15</entry>
 <modified>2011-09-30</modified>
 </dates>
 </vuln>

<vuln vid="cd68ff50-362b-11e0-ad36-00215c6a37bb">
 <topic>phpMyAdmin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>3.3.9.2</lt></range>
 </package>
 <package>
	<name>phpMyAdmin211</name>
	<range><lt>2.11.11.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpMyAdmin team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php">
	 It was possible to create a bookmark which would be executed
	 unintentionally by other users.
	</blockquote>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php">
	 When the files README, ChangeLog or LICENSE have been removed
	 from their original place (possibly by the distributor), the
	 scripts used to display these files can show their full path,
	 leading to possible further attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php</url>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php</url>
 </references>
 <dates>
 <discovery>2011-02-08</discovery>
 <entry>2011-02-11</entry>
 </dates>
 </vuln>

<vuln vid="4a3482da-3624-11e0-b995-001b2134ef46">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><le>9.0r289</le></range>
 </package>
 <package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.2r152</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-02.html">
	 Critical vulnerabilities have been identified in
	 Adobe Flash Player 10.1.102.64 and earlier versions for
	 Windows, Macintosh, Linux, and Solaris. These vulnerabilities
	 could cause the application to crash and could potentially
	 allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0558</cvename>
 <cvename>CVE-2011-0559</cvename>
 <cvename>CVE-2011-0560</cvename>
 <cvename>CVE-2011-0561</cvename>
 <cvename>CVE-2011-0571</cvename>
 <cvename>CVE-2011-0572</cvename>
 <cvename>CVE-2011-0573</cvename>
 <cvename>CVE-2011-0574</cvename>
 <cvename>CVE-2011-0575</cvename>
 <cvename>CVE-2011-0577</cvename>
 <cvename>CVE-2011-0578</cvename>
 <cvename>CVE-2011-0607</cvename>
 <cvename>CVE-2011-0608</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb11-02.html</url>
 </references>
 <dates>
 <discovery>2011-02-08</discovery>
 <entry>2011-02-11</entry>
 </dates>
 </vuln>

<vuln vid="53bde960-356b-11e0-8e81-0022190034c0">
 <topic>mupdf -- Remote System Access</topic>
 <affects>
 <package>
	<name>mupdf</name>
	<range><lt>0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/43020/">
	 The vulnerability is caused due to an error within the
	 "closedctd()" function in fitz/filt_dctd.c when processing PDF
	 files containing certain malformed JPEG images. This can be
	 exploited to cause a stack corruption by e.g. tricking a user
	 into opening a specially crafted PDF file.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>46027</bid>
 <url>http://secunia.com/advisories/43020/</url>
 </references>
 <dates>
 <discovery>2011-01-26</discovery>
 <entry>2011-02-10</entry>
 </dates>
 </vuln>

<vuln vid="1cae628c-3569-11e0-8e81-0022190034c0">
 <topic>rubygem-mail -- Remote Arbitrary Shell Command Injection Vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-mail</name>
	<range><lt>2.2.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/43077/">
	 Input passed via an email from address is not properly sanitised
	 in the "deliver()" function (lib/mail/network/delivery_methods/sendmail.rb)
	 before being used as a command line argument. This can be exploited
	 to inject arbitrary shell commands.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>46021</bid>
 <cvename>CVE-2011-0739</cvename>
 <url>http://secunia.com/advisories/43077/</url>
 <url>http://groups.google.com/group/mail-ruby/browse_thread/thread/e93bbd05706478dd?pli=1</url>
 </references>
 <dates>
 <discovery>2011-01-25</discovery>
 <entry>2011-02-10</entry>
 </dates>
 </vuln>

<vuln vid="7c492ea2-3566-11e0-8e81-0022190034c0">
 <topic>plone -- Remote Security Bypass</topic>
 <affects>
 <package>
	<name>plone</name>
	<range><ge>2.5</ge><lt>3</lt></range>
 </package>
 <package>
	<name>plone3</name>
	<range><ge>3</ge><le>3.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Plone developer reports:
	<blockquote cite="http://plone.org/products/plone/security/advisories/cve-2011-0720">
	 This is an escalation of privileges attack that can be used by
	 anonymous users to gain access to a Plone site's administration
	 controls, view unpublished content, create new content and modify a
	 site's skin. The sandbox protecting access to the underlying
	 system is still in place, and it does not grant access to other
	 applications running on the same Zope instance.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>46102</bid>
 <cvename>CVE-2011-0720</cvename>
 <url>http://plone.org/products/plone/security/advisories/cve-2011-0720</url>
 </references>
 <dates>
 <discovery>2011-02-02</discovery>
 <entry>2011-02-10</entry>
 </dates>
 </vuln>

<vuln vid="44ccfab0-3564-11e0-8e81-0022190034c0">
 <topic>exim -- local privilege escalation</topic>
 <affects>
 <package>
	<name>exim</name>
	<name>exim-ldap</name>
	<name>exim-ldap2</name>
	<name>exim-mysql</name>
	<name>exim-postgresql</name>
	<name>exim-sa-exim</name>
	<range><lt>4.74</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	exim.org reports:
	<blockquote cite="ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74">
	 CVE-2011-0017 - check return value of setuid/setgid. This is a
	 privilege escalation vulnerability whereby the Exim run-time user
	 can cause root to append content of the attacker's choosing to
	 arbitrary files.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0017</cvename>
 <url>ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74</url>
 </references>
 <dates>
 <discovery>2011-01-31</discovery>
 <entry>2011-02-10</entry>
 </dates>
 </vuln>

<vuln vid="f2b43905-3545-11e0-8e81-0022190034c0">
 <topic>openoffice.org -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openoffice.org</name>
	<range><lt>3.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenOffice.org Security Team reports:
	<blockquote cite="http://www.openoffice.org/security/bulletin.html">
	 Fixed in OpenOffice.org 3.3
	 <ul>
	 <li><a href="http://www.openoffice.org/security/cves/CVE-2010-2935_CVE-2010-2936.html">
		CVE-2010-2935 / CVE-2010-2936</a>: Security Vulnerability in OpenOffice.org related to PowerPoint document processing</li>
	 <li><a href="http://www.openoffice.org/security/cves/CVE-2010-3450.html">
		CVE-2010-3450</a>: Security Vulnerability in OpenOffice.org related to Extensions and filter package files</li>
	 <li><a href="http://www.openoffice.org/security/cves/CVE-2010-3451_CVE-2010-3452.html">
		CVE-2010-3451 / CVE-2010-3452</a>: Security Vulnerability in OpenOffice.org related to RTF document processing </li>
	 <li><a href="http://www.openoffice.org/security/cves/CVE-2010-3453_CVE-2010-3454.html">
		CVE-2010-3453 / CVE-2010-3454</a>: Security Vulnerability in OpenOffice.org related to Word document processing </li>
	 <li><a href="http://www.openoffice.org/security/cves/CVE-2010-3689.html">
		CVE-2010-3689</a>: Insecure LD_LIBRARY_PATH usage in OpenOffice.org shell scripts </li>
	 <li><a href="http://www.openoffice.org/security/cves/CVE-2010-3702_CVE-2010-3704.html">
		CVE-2010-3702 / CVE-2010-3704</a>: Security Vulnerability in OpenOffice.org's PDF Import extension resulting from 3rd party library XPDF</li>
	 <li><a href="http://www.openoffice.org/security/cves/CVE-2010-4008_CVE-2010-4494.html">
		CVE-2010-4008 / CVE-2010-4494</a>: Possible Security Vulnerability in OpenOffice.org resulting from 3rd party library LIBXML2 </li>
	 <li><a href="http://www.openoffice.org/security/cves/CVE-2010-4253.html">
		CVE-2010-4253</a>: Security Vulnerability in OpenOffice.org related to PNG file processing </li>
	 <li><a href="http://www.openoffice.org/security/cves/CVE-2010-4643.html">
		CVE-2010-4643</a>: Security Vulnerability in OpenOffice.org related to TGA file processing </li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openoffice.org/security/bulletin.html</url>
 <url>http://secunia.com/advisories/40775/</url>
 </references>
 <dates>
 <discovery>2010-08-04</discovery>
 <entry>2011-02-10</entry>
 </dates>
 </vuln>

<vuln vid="35ecdcbe-3501-11e0-afcd-0015f2db7bde">
 <topic>webkit-gtk2 -- Multiple vurnabilities.</topic>
 <affects>
 <package>
	<name>webkit-gtk2</name>
	<range><lt>1.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gustavo Noronha Silva reports:
	<blockquote cite="http://permalink.gmane.org/gmane.os.opendarwin.webkit.gtk/405">
	 This release has essentially security fixes. Refer to the
	 WebKit/gtk/NEWS file inside the tarball for details. We would like
	 to thank the Red Hat security team (Huzaifa Sidhpurwala in
	 particular) and Michael Gilbert from Debian for their help in
	 checking (and pushing!) security issues affecting the WebKitGTK+
	 stable branch for this release.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2901</cvename>
 <cvename>CVE-2010-4040</cvename>
 <cvename>CVE-2010-4042</cvename>
 <cvename>CVE-2010-4199</cvename>
 <cvename>CVE-2010-4492</cvename>
 <cvename>CVE-2010-4493</cvename>
 <cvename>CVE-2010-4578</cvename>
 <cvename>CVE-2011-0482</cvename>
 <cvename>CVE-2011-0778</cvename>
 <url>https://bugs.webkit.org/show_bug.cgi?id=48328</url>
 <url>https://bugs.webkit.org/show_bug.cgi?id=50710</url>
 <url>https://bugs.webkit.org/show_bug.cgi?id=50840</url>
 <url>https://bugs.webkit.org/show_bug.cgi?id=50932</url>
 <url>https://bugs.webkit.org/show_bug.cgi?id=51993</url>
 <url>https://bugs.webkit.org/show_bug.cgi?id=53265</url>
 <url>https://bugs.webkit.org/show_bug.cgi?id=53276</url>
 <url>http://permalink.gmane.org/gmane.os.opendarwin.webkit.gtk/405</url>
 </references>
 <dates>
 <discovery>2011-02-08</discovery>
 <entry>2011-02-10</entry>
 </dates>
 </vuln>

<vuln vid="ce6ce2f8-34ac-11e0-8103-00215c6a37bb">
 <topic>awstats -- arbitrary commands execution vulnerability</topic>
 <affects>
 <package>
	<name>awstats</name>
	<range><lt>7.0,1</lt></range>
 </package>
 <package>
	<name>awstats-devel</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Awstats change log reports:
	<blockquote cite="http://awstats.sourceforge.net/docs/awstats_changelog.txt">
	 <ul>
	 <li>Security fix (Traverse directory of LoadPlugin)</li>
	 <li>Security fix (Limit config to defined directory
	 to avoid access to external config file via a nfs
	 or webdav link).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-4367</cvename>
 <url>http://www.exploitdevelopment.com/Vulnerabilities/2010-WEB-001.html</url>
 <url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
 </references>
 <dates>
 <discovery>2010-05-01</discovery>
 <entry>2011-02-10</entry>
 </dates>
 </vuln>

<vuln vid="2eda0c54-34ab-11e0-8103-00215c6a37bb">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>11.01</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera reports:
	<blockquote cite="http://www.opera.com/docs/changelogs/unix/1101/">
	 Opera 11.01 is a recommended upgrade offering security and
	 stability enhancements.
	 The following security vulnerabilities have been fixed:
	 <ul>
	 <li>Removed support for "<code>javascript:</code>" URLs in
	 CSS -o-link values, to make it easier for sites to filter
	 untrusted CSS.</li>
	 <li>Fixed an issue where large form inputs could allow
	 execution of arbitrary code, as reported by Jordi Chancel;
	 see our <a href="http://www.opera.com/support/kb/view/982/">advisory</a>.</li>
	 <li>Fixed an issue which made it possible to carry out
	 clickjacking attacks against internal opera: URLs;
	 see our <a href="http://www.opera.com/support/kb/view/983/">advisory</a>.</li>
	 <li>Fixed issues which allowed web pages to gain limited
	 access to files on the user's computer; see our
	 <a href="http://www.opera.com/support/kb/view/984/">advisory</a>.</li>
	 <li>Fixed an issue where email passwords were not immediately
	 deleted when deleting private data; see our
	 <a href="http://www.opera.com/support/kb/view/986/">advisory</a>.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0450</cvename>
 <cvename>CVE-2011-0681</cvename>
 <cvename>CVE-2011-0682</cvename>
 <cvename>CVE-2011-0683</cvename>
 <cvename>CVE-2011-0684</cvename>
 <cvename>CVE-2011-0685</cvename>
 <cvename>CVE-2011-0686</cvename>
 <cvename>CVE-2011-0687</cvename>
 <url>http://www.opera.com/support/kb/view/982/</url>
 <url>http://www.opera.com/support/kb/view/983/</url>
 <url>http://www.opera.com/support/kb/view/984/</url>
 <url>http://secunia.com/advisories/43023</url>
 </references>
 <dates>
 <discovery>2011-01-26</discovery>
 <entry>2011-02-10</entry>
 </dates>
 </vuln>

<vuln vid="bd760627-3493-11e0-8103-00215c6a37bb">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py23-django</name>
	<name>py24-django</name>
	<name>py25-django</name>
	<name>py26-django</name>
	<name>py27-django</name>
	<name>py30-django</name>
	<name>py31-django</name>
	<range><gt>1.2</gt><lt>1.2.5</lt></range>
	<range><gt>1.1</gt><lt>1.1.4</lt></range>
 </package>
 <package>
	<name>py23-django-devel</name>
	<name>py24-django-devel</name>
	<name>py25-django-devel</name>
	<name>py26-django-devel</name>
	<name>py27-django-devel</name>
	<name>py30-django-devel</name>
	<name>py31-django-devel</name>
	<range><lt>15470,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django project reports:
	<blockquote cite="http://www.djangoproject.com/weblog/2011/feb/08/security/">
	 Today the Django team is issuing multiple releases --
	 Django 1.2.5 and Django 1.1.4 -- to remedy three security
	 issues reported to us. All users of affected versions of
	 Django are urged to upgrade immediately.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.djangoproject.com/weblog/2011/feb/08/security/</url>
 </references>
 <dates>
 <discovery>2011-02-08</discovery>
 <entry>2011-02-09</entry>
 </dates>
 </vuln>

<vuln vid="8d04cfbd-344d-11e0-8669-0025222482c5">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki</name>
	<range><lt>1.16.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Medawiki reports:
	<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html">
	 An arbitrary script inclusion vulnerability was discovered. The
	 vulnerability only allows execution of files with names ending in
	 ".php" which are already present in the local filesystem. Only servers
	 running Microsoft Windows and possibly Novell Netware are affected.
	 Despite these mitigating factors, all users are advised to upgrade,
	 since there is a risk of complete server compromise. MediaWiki 1.8.0
	 and later is affected.
	 Security researcher mghack discovered a CSS injection
	 vulnerability. For Internet Explorer and similar browsers, this is
	 equivalent to an XSS vulnerability, that is to say, it allows the
	 compromise of wiki user accounts. For other browsers, it allows private
	 data such as IP addresses and browsing patterns to be sent to a malicious
	 external web server. It affects all versions of MediaWiki. All users are
	 advised to upgrade.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0047</cvename>
 <url>https://bugzilla.wikimedia.org/show_bug.cgi?id=27094</url>
 <url>https://bugzilla.wikimedia.org/show_bug.cgi?id=27093</url>
 <url>http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/phase3/RELEASE-NOTES</url>
 <url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html</url>
 </references>
 <dates>
 <discovery>2011-02-01</discovery>
 <entry>2011-02-09</entry>
 </dates>
 </vuln>

<vuln vid="8c93e997-30e0-11e0-b300-485d605f4717">
 <topic>wordpress -- SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>3.0.2,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>zh-wordpress-zh_CN</name>
	<name>zh-wordpress-zh_TW</name>
	<range><lt>3.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Vendor reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4257">
	 SQL injection vulnerability in the do_trackbacks function in
	 wp-includes/comment.php in WordPress before 3.0.2 allows remote
	 authenticated users to execute arbitrary SQL commands via the Send
	 Trackbacks field.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-4257</cvename>
 <url>http://www.cvedetails.com/cve/CVE-2010-4257/</url>
 </references>
 <dates>
 <discovery>2010-11-16</discovery>
 <entry>2011-02-05</entry>
 <modified>2011-02-09</modified>
 </dates>
 </vuln>

<vuln vid="f9258873-2ee2-11e0-afcd-0015f2db7bde">
 <topic>vlc -- Insufficient input validation in MKV demuxer</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><lt>1.1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	VLC team reports:
	<blockquote cite="http://www.videolan.org/security/sa1102.html">
	 When parsing an invalid MKV (Matroska or WebM) file, input
	 validation are insufficient.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.videolan.org/security/sa1102.html</url>
 </references>
 <dates>
 <discovery>2011-01-26</discovery>
 <entry>2011-02-02</entry>
 </dates>
 </vuln>

<vuln vid="8015600f-2c80-11e0-9cc1-00163e5bf4f9">
 <topic>maradns -- denial of service when resolving a long DNS hostname</topic>
 <affects>
 <package>
	<name>maradns</name>
	<range><lt>1.4.06</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MaraDNS developer Sam Trenholme reports:
	<blockquote cite="http://samiam.org/blog/20110129.html">
	 ... a mistake in allocating an array of integers, allocating it
	 in bytes instead of sizeof(int) units. This resulted in a buffer
	 being too small, allowing it to be overwritten. The impact of this
	 programming error is that MaraDNS can be crashed by sending
	 MaraDNS a single "packet of death". Since the data placed in the
	 overwritten array cannot be remotely controlled (it is a list of
	 increasing integers), there is no way to increase privileges
	 exploiting this bug.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>45966</bid>
 <cvename>CVE-2011-0520</cvename>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610834</url>
 </references>
 <dates>
 <discovery>2011-01-23</discovery>
 <entry>2011-01-31</entry>
 </dates>
 </vuln>

<vuln vid="dc9f8335-2b3b-11e0-a91b-00e0815b8da8">
 <topic>isc-dhcp-server -- DHCPv6 crash</topic>
 <affects>
 <package>
	<name>isc-dhcp41-server</name>
	<range><le>4.1.2,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2011-0413">
	 When the DHCPv6 server code processes a message for an address
	 that was previously declined and internally tagged as abandoned
	 it can trigger an assert failure resulting in the server crashing.
	 This could be used to crash DHCPv6 servers remotely. This issue
	 only affects DHCPv6 servers. DHCPv4 servers are unaffected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0413</cvename>
 <url>http://www.isc.org/software/dhcp/advisories/cve-2011-0413</url>
 <url>http://www.kb.cert.org/vuls/id/686084</url>
 </references>
 <dates>
 <discovery>2011-01-26</discovery>
 <entry>2011-01-28</entry>
 </dates>
 </vuln>

<vuln vid="c8c927e5-2891-11e0-8f26-00151735203a">
 <topic>bugzilla -- multiple serious vulnerabilities</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><ge>2.14.*</ge><lt>3.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla Security Advisory reports:
	<blockquote cite="http://www.bugzilla.org/security/3.2.9/">
	 This advisory covers three security issues that have recently been
	 fixed in the Bugzilla code:
	 <ul>
	 <li>A weakness in Bugzilla could allow a user to gain unauthorized
	 access to another Bugzilla account.</li>
	 <li>A weakness in the Perl CGI.pm module allows injecting HTTP
	 headers and content to users via several pages in Bugzilla.</li>
	 <li>If you put a harmful "javascript:" or "data:" URL into
	 Bugzilla's "URL" field, then there are multiple situations in
	 which Bugzilla will unintentionally make that link clickable.</li>
	 <li>Various pages lack protection against cross-site request
	 forgeries.</li>
	 </ul>
	 All affected installations are encouraged to upgrade as soon as
	 possible.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>25425</bid>
 <cvename>CVE-2010-4568</cvename>
 <cvename>CVE-2010-2761</cvename>
 <cvename>CVE-2010-4411</cvename>
 <cvename>CVE-2010-4572</cvename>
 <cvename>CVE-2010-4567</cvename>
 <cvename>CVE-2010-0048</cvename>
 <cvename>CVE-2011-0046</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=621591</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=619594</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=591165</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=621572</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=619588</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=628034</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=621090</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=621105</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=621107</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=621108</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=621109</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=621110</url>
 </references>
 <dates>
 <discovery>2011-01-24</discovery>
 <entry>2011-01-25</entry>
 </dates>
 </vuln>

<vuln vid="7580f00e-280c-11e0-b7c8-00215c6a37bb">
 <topic>dokuwiki -- multiple privilege escalation vulnerabilities</topic>
 <affects>
 <package>
	<name>dokuwiki</name>
	<range><lt>20101107a</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dokuwiki reports:
	<blockquote cite="http://bugs.dokuwiki.org/index.php?do=details&amp;task_id=2136">
	 This security update fixes problems in the XMLRPC
	 interface where ACLs where not checked correctly
	 sometimes, making it possible to access and write
	 information that should not have been accessible/writable.
	 This only affects users who have enabled the XMLRPC
	 interface (default is off) and have enabled XMLRPC
	 access for users who can't access/write all content
	 anyway (default is nobody, see <a href="http://www.dokuwiki.org/config:xmlrpcuser">http://www.dokuwiki.org/config:xmlrpcuser</a>
	 for details).
	 This update also includes a fix for a problem in
	 the general ACL checking function that could be exploited
	 to gain access to restricted pages and media files in rare
	 conditions (when you had rights for an id you could get
	 the same rights on ids where one character has been
	 replaced by a ".").
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://bugs.dokuwiki.org/index.php?do=details&amp;task_id=2136</url>
 </references>
 <dates>
 <discovery>2011-01-16</discovery>
 <entry>2011-01-24</entry>
 </dates>
 </vuln>

<vuln vid="5ab9fb2a-23a5-11e0-a835-0003ba02bf30">
 <topic>asterisk -- Exploitable Stack Buffer Overflow</topic>
 <affects>
 <package>
	<name>asterisk14</name>
	<range><gt>1.4.*</gt><lt>1.4.39.1</lt></range>
 </package>
 <package>
	<name>asterisk16</name>
	<range><gt>1.6.*</gt><lt>1.6.2.16.1</lt></range>
 </package>
 <package>
	<name>asterisk18</name>
	<range><gt>1.8.*</gt><lt>1.8.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Asterisk Development Team reports:
	<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-January/000297.html">
	 The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1,
	 1.6.2.16.2, 1.8.1.2, and 1.8.2.1 resolve an issue when forming an
	 outgoing SIP request while in pedantic mode, which can cause a stack
	 buffer to be made to overflow if supplied with carefully crafted
	 caller ID information. The issue and resolution are described in the
	 AST-2011-001 security advisory.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://downloads.asterisk.org/pub/security/AST-2011-001.pdf</url>
 </references>
 <dates>
 <discovery>2011-01-18</discovery>
 <entry>2011-01-19</entry>
 </dates>
 </vuln>

<vuln vid="2c2d4e83-2370-11e0-a91b-00e0815b8da8">
 <topic>tarsnap -- cryptographic nonce reuse</topic>
 <affects>
 <package>
	<name>tarsnap</name>
	<range><ge>1.0.22</ge><le>1.0.27</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Colin Percival reports:
	<blockquote cite="http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html">
	 In versions 1.0.22 through 1.0.27 of Tarsnap, the CTR nonce value
	 is not incremented after each chunk is encrypted. (The CTR counter
	 is correctly incremented after each 16 bytes of data was processed,
	 but this counter is reset to zero for each new chunk.)
	 Note that since the Tarsnap client-server protocol is encrypted,
	 being able to intercept Tarsnap client-server traffic does not
	 provide an attacker with access to the data.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html</url>
 </references>
 <dates>
 <discovery>2011-01-18</discovery>
 <entry>2011-01-19</entry>
 </dates>
 </vuln>

<vuln vid="4c017345-1d89-11e0-bbee-0014a5e3cda6">
 <topic>MoinMoin -- cross-site scripting vulnerabilities</topic>
 <affects>
 <package>
	<name>moinmoin</name>
	<range><lt>1.9.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MoinMoin developers reports:
	<blockquote cite="http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES">
	 Fix XSS in Despam action (CVE-2010-0828)
	</blockquote>
	<blockquote cite="http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg">
	 Fix XSS issues
	 <ul>
	 <li>by escaping template name in messages</li>
	 <li>by fixing other places that had similar issues</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>39110</bid>
 <cvename>CVE-2010-0828</cvename>
 <url>http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES</url>
 <url>http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg</url>
 </references>
 <dates>
 <discovery>2010-04-05</discovery>
 <entry>2011-01-11</entry>
 </dates>
 </vuln>

<vuln vid="38bdf10e-2293-11e0-bfa4-001676740879">
 <topic>tor -- remote code execution and crash</topic>
 <affects>
 <package>
	<name>tor</name>
	<range><lt>0.2.1.29</lt></range>
 </package>
 <package>
	<name>tor-devel</name>
	<range><lt>0.2.2.21.a</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Tor Project reports:
	<blockquote cite="http://archives.seul.org/or/announce/Jan-2011/msg00000.html">
	 A remote heap overflow vulnerability that can allow remote
	 code execution. Other fixes address a variety of assert and crash
	 bugs, most of which we think are hard to exploit remotely.
	 All Tor users should upgrade.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>45832</bid>
 <cvename>CVE-2011-0427</cvename>
 <freebsdpr>ports/154099</freebsdpr>
 <mlist msgid="20110117155813.GG3300@moria.seul.org">http://archives.seul.org/or/announce/Jan-2011/msg00000.html</mlist>
 <url>https://gitweb.torproject.org/tor.git/blob/release-0.2.1:/ChangeLog</url>
 <url>https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ChangeLog</url>
 </references>
 <dates>
 <discovery>2011-01-15</discovery>
 <entry>2011-01-17</entry>
 </dates>
 </vuln>

<vuln vid="908f4cf2-1e8b-11e0-a587-001b77d09812">
 <topic>sudo -- local privilege escalation</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><ge>1.7.0</ge><lt>1.7.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Todd Miller reports:
	<blockquote cite="http://www.sudo.ws/sudo/alerts/runas_group_pw.html">
	 Beginning with sudo version 1.7.0 it has been possible
	 to grant permission to run a command using a specified
	 group via sudo's -g option (run as group), if allowed by
	 the sudoers file. A flaw exists in sudo's password
	 checking logic that allows a user to run a command
	 with only the group changed without being prompted
	 for a password.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2011-0010</cvename>
 <url>http://www.sudo.ws/sudo/alerts/runas_group_pw.html</url>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=609641</url>
 </references>
 <dates>
 <discovery>2011-01-11</discovery>
 <entry>2011-01-13</entry>
 </dates>
 </vuln>

<vuln vid="71612099-1e93-11e0-a587-001b77d09812">
 <topic>subversion -- multiple DoS</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><lt>1.6.15</lt></range>
 </package>
 <package>
	<name>subversion-freebsd</name>
	<range><lt>1.6.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Entry for CVE-2010-4539 says:
	<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4539">
	 The walk function in repos.c in the mod_dav_svn module
	 for the Apache HTTP Server, as distributed in Apache
	 Subversion before 1.6.15, allows remote authenticated
	 users to cause a denial of service (NULL pointer
	 dereference and daemon crash) via vectors that trigger
	 the walking of SVNParentPath collections.
	</blockquote>
	Entry for CVE-2010-4644 says:
	<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4644">
	 Multiple memory leaks in rev_hunt.c in Apache Subversion
	 before 1.6.15 allow remote authenticated users to cause
	 a denial of service (memory consumption and daemon crash)
	 via the -g option to the blame command.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>45655</bid>
 <cvename>CVE-2010-4539</cvename>
 <cvename>CVE-2010-4644</cvename>
 </references>
 <dates>
 <discovery>2011-01-02</discovery>
 <entry>2011-01-13</entry>
 </dates>
 </vuln>

<vuln vid="2b6ed5c7-1a7f-11e0-b61d-000c29d1636d">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.3.5</lt></range>
 </package>
 <package>
	<name>php52</name>
	<range><lt>5.2.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP developers reports:
	<blockquote cite="http://www.php.net/releases/5_3_5.php">
	 Security Enhancements and Fixes in PHP 5.3.5:
	 <ul>
	 <li>Fixed bug #53632 (PHP hangs on numeric value
	 2.2250738585072011e-308). (CVE-2010-4645)</li>
	 </ul>
	</blockquote>
	<blockquote cite="http://www.php.net/releases/5_2_17.php">
	 Security Enhancements and Fixes in PHP 5.2.17:
	 <ul>
	 <li>Fixed bug #53632 (PHP hangs on numeric value
	 2.2250738585072011e-308). (CVE-2010-4645)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-4645</cvename>
 </references>
 <dates>
 <discovery>2011-01-06</discovery>
 <entry>2011-01-09</entry>
 <modified>2011-01-09</modified>
 </dates>
 </vuln>

<vuln vid="e4fcf020-0447-11e0-becc-0022156e8794">
 <topic>exim -- local privilege escalation</topic>
 <affects>
 <package>
	<name>exim</name>
	<range><lt>4.73</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	David Woodhouse reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=661756#c3">
	 Secondly a privilege escalation where the trusted 'exim'
	 user is able to tell Exim to use arbitrary config files,
	 in which further ${run ...} commands will be invoked as
	 root.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-4345</cvename>
 <url>http://www.exim.org/lurker/message/20101209.022730.dbb6732d.en.html</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=661756#c3</url>
 </references>
 <dates>
 <discovery>2010-12-10</discovery>
 <entry>2011-01-08</entry>
 </dates>
 </vuln>

<vuln vid="e177c410-1943-11e0-9d1c-000c29ba66d2">
 <topic>mediawiki -- Clickjacking vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki</name>
	<range><gt>1.16</gt><lt>1.16.1</lt></range>
	<range><gt>1.15</gt><lt>1.15.5_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Clickjacking vulnerabilities:
	<blockquote cite="https://bugzilla.wikimedia.org/show_bug.cgi?id=26561">
	 Clickjacking is a type of vulnerability discovered in 2008, which
	 is similar to CSRF. The attack involves displaying the target webpage
	 in a iframe embedded in a malicious website. Using CSS, the submit button
	 of the form on the targeit webpage is made invisible, and then overlaid
	 with some button or link on the malicious website that encourages
	 the user to click on it.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://bugzilla.wikimedia.org/show_bug.cgi?id=26561</url>
 </references>
 <dates>
 <discovery>2011-01-04</discovery>
 <entry>2011-01-06</entry>
 </dates>
 </vuln>

<vuln vid="06a12e26-142e-11e0-bea2-0015f2db7bde">
 <topic>webkit-gtk2 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>webkit-gtk2</name>
	<range><lt>1.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gustavo Noronha Silva reports:
	<blockquote cite="http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS">
	 The patches to fix the following CVEs are included with help
	 from Huzaifa Sidhpurwala from the Red Hat security team.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1791</cvename>
 <cvename>CVE-2010-3812</cvename>
 <cvename>CVE-2010-3813</cvename>
 <cvename>CVE-2010-4197</cvename>
 <cvename>CVE-2010-4198</cvename>
 <cvename>CVE-2010-4204</cvename>
 <cvename>CVE-2010-4206</cvename>
 <cvename>CVE-2010-4577</cvename>
 <url>http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS</url>
 </references>
 <dates>
 <discovery>2010-12-28</discovery>
 <entry>2010-12-30</entry>
 </dates>
 </vuln>

<vuln vid="14a37474-1383-11e0-8a58-00215c6a37bb">
 <topic>django -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>py23-django</name>
	<name>py24-django</name>
	<name>py25-django</name>
	<name>py26-django</name>
	<name>py27-django</name>
	<name>py30-django</name>
	<name>py31-django</name>
	<range><gt>1.2</gt><lt>1.2.4</lt></range>
	<range><gt>1.1</gt><lt>1.1.3</lt></range>
 </package>
 <package>
	<name>py23-django-devel</name>
	<name>py24-django-devel</name>
	<name>py25-django-devel</name>
	<name>py26-django-devel</name>
	<name>py27-django-devel</name>
	<name>py30-django-devel</name>
	<name>py31-django-devel</name>
	<range><lt>15032,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django project reports:
	<blockquote cite="http://www.djangoproject.com/weblog/2010/dec/22/security/">
	 Today the Django team is issuing multiple releases
	 -- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 --
	 to remedy two security issues reported to us. All users
	 of affected versions of Django are urged to upgrade
	 immediately.
	 <h3>Information leakage in Django administrative interface</h3>
	 The Django administrative interface, django.contrib.admin
	 supports filtering of displayed lists of objects by fields
	 on the corresponding models, including across database-level
	 relationships. This is implemented by passing lookup arguments
	 in the querystring portion of the URL, and options on the
	 ModelAdmin class allow developers to specify particular
	 fields or relationships which will generate automatic links
	 for filtering.
	 <h3>Denial-of-service attack in password-reset mechanism</h3>
	 Django's bundled authentication framework,
	 django.contrib.auth, offers views which allow users to
	 reset a forgotten password. The reset mechanism involves
	 generating a one-time token composed from the user's ID,
	 the timestamp of the reset request converted to a base36
	 integer, and a hash derived from the user's current password
	 hash (which will change once the reset is complete, thus
	 invalidating the token).
	</blockquote>
 </body>
 </description>
 <references>
 <bid>45562</bid>
 <bid>45563</bid>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=665373</url>
 <url>http://secunia.com/advisories/42715/</url>
 </references>
 <dates>
 <discovery>2010-12-22</discovery>
 <entry>2010-12-29</entry>
 </dates>
 </vuln>

<vuln vid="ff8b419a-0ffa-11e0-becc-0022156e8794">
 <topic>Drupal Views plugin -- cross-site scripting</topic>
 <affects>
 <package>
	<name>drupal6-views</name>
	<range><lt>2.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal security team reports:
	<blockquote cite="http://drupal.org/node/999380">
	 The Views module provides a flexible method for Drupal site
	 designers to control how lists and tables of content are
	 presented. Under certain circumstances, Views could display
	 parts of the page path without escaping, resulting in a
	 relected Cross Site Scripting (XSS) vulnerability. An attacker
	 could exploit this to gain full administrative access.
	 Mitigating factors: This vulnerability only occurs with a
	 specific combination of configuration options for a specific
	 View, but this combination is used in the default Views
	 provided by some additional modules. A malicious user would
	 need to get an authenticated administrative user to visit a
	 specially crafted URL.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-4521</cvename>
 <url>http://drupal.org/node/999380</url>
 </references>
 <dates>
 <discovery>2010-12-15</discovery>
 <entry>2010-12-28</entry>
 </dates>
 </vuln>

<vuln vid="584c506d-0e98-11e0-b59b-0050569b2d21">
 <topic>redmine -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>redmine</name>
	<range><lt>1.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jean-Philippe Lang reports:
	<blockquote cite="http://www.redmine.org/news/49">
	 This release also fixes 3 security issues reported by
	 joernchen of Phenoelit:
	 <ul>
	 <li>logged in users may be able to access private data
	 (affected versions: 1.0.x)</li>
	 <li>persistent XSS vulnerability in textile formatter
	 (affected versions: all previous releases)</li>
	 <li>remote command execution in bazaar repository adapter
	 (affected versions: 0.9.x, 1.0.x)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.redmine.org/news/49</url>
 </references>
 <dates>
 <discovery>2010-12-23</discovery>
 <entry>2010-12-23</entry>
 </dates>
 </vuln>

<vuln vid="4bd33bc5-0cd6-11e0-bfa4-001676740879">
 <topic>tor -- remote crash and potential remote code execution</topic>
 <affects>
 <package>
	<name>tor</name>
	<range><lt>0.2.1.28</lt></range>
 </package>
 <package>
	<name>tor-devel</name>
	<range><lt>0.2.2.20-alpha</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Tor Project reports:
	<blockquote cite="http://archives.seul.org/or/announce/Dec-2010/msg00000.html">
	 Remotely exploitable bug that could be used to crash instances
	 of Tor remotely by overflowing on the heap. Remote-code execution
	 hasn't been confirmed, but can't be ruled out. Everyone should
	 upgrade.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>45500</bid>
 <cvename>CVE-2010-1676</cvename>
 <freebsdpr>ports/153326</freebsdpr>
 <mlist msgid="20101220135830.GU3300@moria.seul.org">http://archives.seul.org/or/announce/Dec-2010/msg00000.html</mlist>
 <mlist msgid="20101220141526.GS3255@moria.seul.org">http://archives.seul.org/or/talk/Dec-2010/msg00167.html</mlist>
 <url>https://gitweb.torproject.org/tor.git/blob/release-0.2.1:/ChangeLog</url>
 <url>https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ChangeLog</url>
 </references>
 <dates>
 <discovery>2010-12-17</discovery>
 <entry>2010-12-22</entry>
 </dates>
 </vuln>

<vuln vid="d560b346-08a2-11e0-bcca-0050568452ac">
 <topic>YUI JavaScript library -- JavaScript injection exploits in Flash components</topic>
 <affects>
 <package>
	<name>yahoo-ui</name>
	<range><lt>2.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The YUI team reports:
	<blockquote cite="http://yuilibrary.com/support/2.8.2/">
	 A security-related defect was introduced in the YUI 2 Flash
	 component infrastructure beginning with the YUI 2.4.0 release.
	 This defect allows JavaScript injection exploits to be created
	 against domains that host affected YUI .swf files.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-4207</cvename>
 <cvename>CVE-2010-4208</cvename>
 <cvename>CVE-2010-4209</cvename>
 <url>http://www.yuiblog.com/blog/2010/10/25/yui-2-8-2-security-update/</url>
 <url>http://secunia.com/advisories/41955</url>
 <url>http://www.openwall.com/lists/oss-security/2010/11/07/1</url>
 <url>http://yuilibrary.com/support/2.8.2/</url>
 </references>
 <dates>
 <discovery>2010-10-25</discovery>
 <entry>2010-12-15</entry>
 </dates>
 </vuln>

<vuln vid="2a41233d-10e7-11e0-becc-0022156e8794">
 <topic>php-zip -- multiple Denial of Service vulnerabilities</topic>
 <affects>
 <package>
	<name>php5-zip</name>
	<range><lt>5.3.4</lt></range>
 </package>
 <package>
	<name>php52-zip</name>
	<range><lt>5.2.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The following DoS conditions in Zip extension
	 were fixed in PHP 5.3.4 and PHP 5.2.15:
	<ul>
	 <li>
	 <blockquote cite="http://www.php.net/releases/5_3_4.php">
	 Fixed crash in zip extract method (possible
		CWE-170).
	 </blockquote>
	 </li>
	 <li>
	 <blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3709">
	 The ZipArchive::getArchiveComment function
		in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3
		allows context-dependent attackers to cause a denial
		of service (NULL pointer dereference and application
		crash) via a crafted ZIP archive.
	 </blockquote>
	 </li>
	</ul>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-3709</cvename>
 <url>http://www.php.net/releases/5_3_4.php</url>
 <url>http://www.php.net/releases/5_2_15.php</url>
 <url>http://securityreason.com/achievement_securityalert/90</url>
 </references>
 <dates>
 <discovery>2010-12-13</discovery>
 <entry>2011-01-13</entry>
 </dates>
 </vuln>

<vuln vid="c623f058-10e7-11e0-becc-0022156e8794">
 <topic>php-filter -- Denial of Service</topic>
 <affects>
 <package>
	<name>php5-filter</name>
	<range><lt>5.3.4</lt></range>
 </package>
 <package>
	<name>php52-filter</name>
	<range><lt>5.2.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The following DoS condition in filter extension
	 was fixed in PHP 5.3.4 and PHP 5.2.15:
 <blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3710">
	Stack consumption vulnerability in the filter_var
	 function in PHP 5.2.x through 5.2.14 and 5.3.x through
	 5.3.3, when FILTER_VALIDATE_EMAIL mode is used, allows
	 remote attackers to cause a denial of service (memory
	 consumption and application crash) via a long e-mail
	 address string.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-3710</cvename>
 <url>http://www.php.net/releases/5_3_4.php</url>
 <url>http://www.php.net/releases/5_2_15.php</url>
 </references>
 <dates>
 <discovery>2010-12-13</discovery>
 <entry>2011-01-13</entry>
 </dates>
 </vuln>

<vuln vid="1a0704e7-0edf-11e0-becc-0022156e8794">
 <topic>php-imap -- Denial of Service</topic>
 <affects>
 <package>
	<name>php5-imap</name>
	<range><lt>5.3.4</lt></range>
 </package>
 <package>
	<name>php52-imap</name>
	<range><lt>5.2.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The following DoS condition in IMAP extension
	 was fixed in PHP 5.3.4 and PHP 5.2.15:
	<blockquote cite="http://securitytracker.com/alerts/2010/Nov/1024761.html">
	A remote user can send specially crafted IMAP user name
	 or password data to trigger a double free memory error
	 in 'ext/imap/php_imap.c' and cause the target service
	 to crash.
	It may be possible to execute arbitrary code.
	 However, code execution was not confirmed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-4150</cvename>
 <url>http://www.php.net/releases/5_3_4.php</url>
 <url>http://www.php.net/releases/5_2_15.php</url>
 </references>
 <dates>
 <discovery>2010-12-13</discovery>
 <entry>2011-01-13</entry>
 </dates>
 </vuln>

<vuln vid="da3d381b-0ee6-11e0-becc-0022156e8794">
 <topic>pecl-phar -- format string vulnerability</topic>
 <affects>
 <package>
	<name>pecl-phar</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Entry for CVE-2010-2094 says:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2094">
	 Multiple format string vulnerabilities in the phar
	 extension in PHP 5.3 before 5.3.2 allow context-dependent
	 attackers to obtain sensitive information (memory
	 contents) and possibly execute arbitrary code via a
	 crafted phar:// URI that is not properly handled by the
	 (1) phar_stream_flush, (2) phar_wrapper_unlink,
	 (3) phar_parse_url, or (4) phar_wrapper_open_url functions
	 in ext/phar/stream.c; and the (5) phar_wrapper_open_dir
	 function in ext/phar/dirstream.c, which triggers errors
	 in the php_stream_wrapper_log_error function.
	</blockquote>
	PECL source code for PHAR extension shares the same code,
	 so it is vulnerable too.
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2094</cvename>
 <url>http://php-security.org/2010/05/14/mops-2010-024-php-phar_stream_flush-format-string-vulnerability/index.html</url>
 <url>http://php-security.org/2010/05/14/mops-2010-025-php-phar_wrapper_open_dir-format-string-vulnerability/index.htm</url>
 <url>http://php-security.org/2010/05/14/mops-2010-026-php-phar_wrapper_unlink-format-string-vulnerability/index.htm</url>
 <url>http://php-security.org/2010/05/14/mops-2010-027-php-phar_parse_url-format-string-vulnerabilities/index.htm</url>
 <url>http://php-security.org/2010/05/14/mops-2010-028-php-phar_wrapper_open_url-format-string-vulnerabilities/index.html</url>
 </references>
 <dates>
 <discovery>2010-12-13</discovery>
 <entry>2011-01-13</entry>
 </dates>
 </vuln>

<vuln vid="3761df02-0f9c-11e0-becc-0022156e8794">
 <topic>php -- NULL byte poisoning</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.3.4</lt></range>
 </package>
 <package>
	<name>php52</name>
	<range><lt>5.2.17_12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP-specific version of NULL-byte poisoning was briefly
	 described by ShAnKaR:
	<blockquote cite="http://www.securityfocus.com/archive/1/archive/1/445788/100/0/threaded">
	 Poison NULL byte vulnerability for perl CGI applications
	 was described in
	 <a href="http://artofhacking.com/files/phrack/phrack55/P55-07.TXT">[1]</a>.
	 ShAnKaR noted, that same vulnerability also affects
	 different PHP applications.
	</blockquote>
	PHP developers report that branch 5.3 received a fix:
	<blockquote cite="http://www.php.net/releases/5_3_4.php">
	 Paths with NULL in them (foo\0bar.txt) are now considered
	 as invalid (CVE-2006-7243).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-7243</cvename>
 <url>http://www.securityfocus.com/archive/1/archive/1/445788/100/0/threaded</url>
 <url>http://artofhacking.com/files/phrack/phrack55/P55-07.TXT</url>
 </references>
 <dates>
 <discovery>2010-12-10</discovery>
 <entry>2011-01-13</entry>
 <modified>2012-11-25</modified>
 </dates>
 </vuln>

<vuln vid="73634294-0fa7-11e0-becc-0022156e8794">
 <topic>php -- open_basedir bypass</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.3.4</lt></range>
 </package>
 <package>
	<name>php52</name>
	<range><lt>5.2.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MITRE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3436">
	 fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow
	 remote attackers to bypass open_basedir restrictions via
	 vectors related to the length of a filename.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>44723</bid>
 <cvename>CVE-2010-3436</cvename>
 </references>
 <dates>
 <discovery>2010-12-10</discovery>
 <entry>2011-01-13</entry>
 </dates>
 </vuln>

<vuln vid="f3148a05-0fa7-11e0-becc-0022156e8794">
 <topic>php -- corruption of $GLOBALS and $this variables via extract() method</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.3.4</lt></range>
 </package>
 <package>
	<name>php52</name>
	<range><lt>5.2.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Off-by-one error in the sanity validator for the extract()
	 method allowed attackers to replace the values of $GLOBALS
	 and $this when mode EXTR_OVERWRITE was used.
 </body>
 </description>
 <references>
 <url>http://www.mail-archive.com/php-cvs@lists.php.net/msg47722.html</url>
 <url>http://www.php.net/releases/5_2_15.php</url>
 </references>
 <dates>
 <discovery>2010-12-10</discovery>
 <entry>2011-01-13</entry>
 </dates>
 </vuln>

<vuln vid="1d8ff4a2-0445-11e0-8e32-000f20797ede">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.13,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.16,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.13</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.6.13,1</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.16</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.11</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><ge>3.1</ge><lt>3.1.7</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.11</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.11</lt></range>
	<range><ge>3.1</ge><lt>3.1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2010-74 Miscellaneous memory safety hazards (rv:1.9.2.13/ 1.9.1.16)
	 MFSA 2010-75 Buffer overflow while line breaking after document.write with long string
	 MFSA 2010-76 Chrome privilege escalation with window.open and isindex element
	 MFSA 2010-77 Crash and remote code execution using HTML tags inside a XUL tree
	 MFSA 2010-78 Add support for OTS font sanitizer
	 MFSA 2010-79 Java security bypass from LiveConnect loaded via data: URL meta refresh
	 MFSA 2010-80 Use-after-free error with nsDOMAttribute MutationObserver
	 MFSA 2010-81 Integer overflow vulnerability in NewIdArray
	 MFSA 2010-82 Incomplete fix for CVE-2010-0179
	 MFSA 2010-83 Location bar SSL spoofing using network error page
	 MFSA 2010-84 XSS hazard in multiple character encodings
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-3766</cvename>
 <cvename>CVE-2010-3767</cvename>
 <cvename>CVE-2010-3768</cvename>
 <cvename>CVE-2010-3769</cvename>
 <cvename>CVE-2010-3770</cvename>
 <cvename>CVE-2010-3771</cvename>
 <cvename>CVE-2010-3772</cvename>
 <cvename>CVE-2010-3773</cvename>
 <cvename>CVE-2010-3774</cvename>
 <cvename>CVE-2010-3775</cvename>
 <cvename>CVE-2010-3776</cvename>
 <cvename>CVE-2010-3777</cvename>
 <cvename>CVE-2010-3778</cvename>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-74.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-75.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-76.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-77.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-78.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-79.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-80.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-81.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-82.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-83.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-84.html</url>
 </references>
 <dates>
 <discovery>2010-12-09</discovery>
 <entry>2010-12-10</entry>
 </dates>
 </vuln>

<vuln vid="4ccbd40d-03f7-11e0-bf50-001a926c7637">
 <topic>krb5 -- client impersonation vulnerability</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MIT Kerberos team reports:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
	 MIT krb5 KDC may issue tickets not requested
	 by a client, based on an attacker-chosen KrbFastArmoredReq.
	 An authenticated remote attacker that controls a legitimate service
	 principal could obtain a valid service ticket to itself containing
	 valid KDC-generated authorization data for a client whose TGS-REQ it
	 has intercepted. The attacker could then use this ticket for
	 S4U2Proxy to impersonate the targeted client even if the client
	 never authenticated to the subverted service. The vulnerable
	 configuration is believed to be rare.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>45122</bid>
 <cvename>CVE-2010-4021</cvename>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
 <url>http://osvdb.org/69607</url>
 </references>
 <dates>
 <discovery>2010-11-30</discovery>
 <entry>2010-12-09</entry>
 </dates>
 </vuln>

<vuln vid="1d193bba-03f6-11e0-bf50-001a926c7637">
 <topic>krb5 -- RFC 3961 key-derivation checksum handling vulnerability</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><ge>1.8.0</ge><le>1.8.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MIT Kerberos team reports:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
	 MIT krb5 (releases incorrectly accepts RFC 3961
	 key-derivation checksums using RC4 keys when verifying AD-SIGNEDPATH
	 and AD-KDC-ISSUED authorization data.
	 An authenticated remote attacker that controls a legitimate service
	 principal has a 1/256 chance of forging the AD-SIGNEDPATH signature
	 if the TGT key is RC4, allowing it to use self-generated "evidence"
	 tickets for S4U2Proxy, instead of tickets obtained from the user or
	 with S4U2Self. Configurations using RC4 for the TGT key are
	 believed to be rare.
	 An authenticated remote attacker has a 1/256 chance of forging
	 AD-KDC-ISSUED signatures on authdata elements in tickets having
	 an RC4 service key, resulting in privilege escalation against
	 a service that relies on these signatures. There are no known
	 uses of the KDC-ISSUED authdata container at this time.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>45117</bid>
 <cvename>CVE-2010-4020</cvename>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
 <url>http://osvdb.org/69608</url>
 </references>
 <dates>
 <discovery>2010-11-30</discovery>
 <entry>2010-12-09</entry>
 </dates>
 </vuln>

<vuln vid="9f971cea-03f5-11e0-bf50-001a926c7637">
 <topic>krb5 -- unkeyed PAC checksum handling vulnerability</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MIT Kerberos team reports:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
	 MIT krb5 incorrectly accepts an unkeyed checksum for PAC
	 signatures.
	 An authenticated remote attacker can forge PACs if using a KDC that
	 does not filter client-provided PAC data. This can result in
	 privilege escalation against a service that relies on PAC contents
	 to make authorization decisions.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>45116</bid>
 <cvename>CVE-2010-1324</cvename>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
 <url>http://osvdb.org/69609</url>
 </references>
 <dates>
 <discovery>2010-11-30</discovery>
 <entry>2010-12-09</entry>
 </dates>
 </vuln>

<vuln vid="0d57c1d9-03f4-11e0-bf50-001a926c7637">
 <topic>krb5 -- multiple checksum handling vulnerabilities</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
	<range><ge>1.8.0</ge><le>1.8.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MIT Kerberos team reports:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
	 MIT krb incorrectly accepts an unkeyed
	 checksum with DES session keys for version 2 (RFC 4121)
	 of the GSS-API krb5 mechanism.
	 An unauthenticated remote attacker can forge GSS tokens that are
	 intended to be integrity-protected but unencrypted, if the targeted
	 pre-existing application session uses a DES session key.
	 MIT krb5 KDC incorrectly accepts RFC
	 3961 key-derivation checksums using RC4 keys when verifying the
	 req-checksum in a KrbFastArmoredReq.
	 An unauthenticated remote attacker has a 1/256 chance of swapping a
	 client-issued KrbFastReq into a different KDC-REQ, if the armor
	 key is RC4. The consequences are believed to be minor.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>45116</bid>
 <cvename>CVE-2010-1324</cvename>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
 <url>http://osvdb.org/69609</url>
 </references>
 <dates>
 <discovery>2010-11-30</discovery>
 <entry>2010-12-09</entry>
 </dates>
 </vuln>

<vuln vid="11bbccbc-03ee-11e0-bcdb-001fc61c2a55">
 <topic>krb5 -- multiple checksum handling vulnerabilities</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><ge>1.3.0</ge><lt>1.7.2</lt></range>
	<range><ge>1.8.0</ge><le>1.8.3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MIT Kerberos team reports:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
	 MIT krb5 clients incorrectly accept an unkeyed checksums
	 in the SAM-2 preauthentication challenge.
	 An unauthenticated remote attacker could alter a SAM-2 challenge,
	 affecting the prompt text seen by the user or the kind of response
	 sent to the KDC. Under some circumstances, this can negate the
	 incremental security benefit of using a single-use authentication
	 mechanism token.
	 MIT krb5 incorrectly accepts RFC 3961 key-derivation checksums
	 using RC4 keys when verifying KRB-SAFE messages.
	 An unauthenticated remote attacker has a 1/256 chance of forging
	 KRB-SAFE messages in an application protocol if the targeted
	 pre-existing session uses an RC4 session key. Few application
	 protocols use KRB-SAFE messages.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>45118</bid>
 <cvename>CVE-2010-1323</cvename>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
 <url>http://osvdb.org/69610</url>
 </references>
 <dates>
 <discovery>2010-11-30</discovery>
 <entry>2010-12-09</entry>
 </dates>
 </vuln>

<vuln vid="ed7fa1b4-ff59-11df-9759-080027284eaa">
 <topic>proftpd -- Compromised source packages backdoor</topic>
 <affects>
 <package>
	<name>proftpd</name>
	<range><eq>1.3.3c_2</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The ProFTPD Project team reports:
	<blockquote cite="http://proftpd.org/">
	 The security issue is caused due to the distribution of compromised
	 ProFTPD 1.3.3c source code packages via the project's main FTP server
	 and all of the mirror servers, which contain a backdoor allowing
	 remote root access.
	</blockquote>
 </body>
 </description>
 <references>
	 <url>http://sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00.1012011542220.12930%40familiar.castaglia.org</url>
	 <url>http://secunia.com/advisories/42449</url>
 </references>
 <dates>
 <discovery>2010-11-28</discovery>
 <entry>2010-12-04</entry>
 </dates>
 </vuln>

<vuln vid="753f8185-5ba9-42a4-be02-3f55ee580093">
 <topic>phpMyAdmin -- XSS attack in database search</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>3.3.8.1</lt></range>
 </package>
 <package>
	<name>phpMyAdmin211</name>
	<range><lt>2.11.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpMyAdmin team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php">
	 It was possible to conduct a XSS attack using spoofed request on the
	 db search script.
	</blockquote>
 </body>
 </description>
 <references>
	 <freebsdpr>ports/152685</freebsdpr>
	 <freebsdpr>ports/152686</freebsdpr>
	 <cvename>CVE-2010-4329</cvename>
	 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php</url>
 </references>
 <dates>
 <discovery>2010-11-29</discovery>
 <entry>2010-11-30</entry>
 </dates>
 </vuln>

<vuln vid="f154a3c7-f7f4-11df-b617-00e0815b8da8">
 <topic>isc-dhcp-server -- Empty link-address denial of service</topic>
 <affects>
 <package>
	<name>isc-dhcp41-server</name>
	<range><ge>4.1.0</ge><lt>4.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISC reports:
	<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2010-3611">
	 If the server receives a DHCPv6 packet containing one or more
	 Relay-Forward messages, and none of them supply an address in the
	 Relay-Forward link-address field, then the server will crash. This
	 can be used as a single packet crash attack vector.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-3611</cvename>
 <url>http://www.isc.org/software/dhcp/advisories/cve-2010-3611</url>
 <url>http://www.kb.cert.org/vuls/id/102047</url>
 </references>
 <dates>
 <discovery>2010-11-02</discovery>
 <entry>2010-11-24</entry>
 </dates>
 </vuln>

<vuln vid="373e412e-f748-11df-96cd-0015f2db7bde">
 <topic>OpenTTD -- Denial of service (server/client) via invalid read</topic>
 <affects>
 <package>
	<name>openttd</name>
	<range><ge>1.0.0</ge><lt>1.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenTTD Team reports:
	<blockquote cite="http://security.openttd.org/en/CVE-2010-4168">
	 When a client disconnects, without sending the "quit" or
	 "client error" message, the server has a chance of reading and
	 writing a just freed piece of memory. The writing can only
	 happen while the server is sending the map. Depending on what
	 happens directly after freeing the memory there is a chance of
	 segmentation fault, and thus a denial of service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-4168</cvename>
 <url>http://security.openttd.org/en/CVE-2010-4168</url>
 </references>
 <dates>
 <discovery>2010-11-20</discovery>
 <entry>2010-11-23</entry>
 </dates>
 </vuln>

<vuln vid="a3314314-f731-11df-a757-0011098ad87f">
 <topic>horde-base -- XSS: VCARD attachments vulnerability</topic>
 <affects>
 <package>
	<name>horde-base</name>
	<range><lt>3.3.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Horde team reports:
	<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/532">
	 The major changes compared to Horde version 3.3.10 are:
	 * Fixed XSS vulnerability when viewing details of a vCard.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://article.gmane.org/gmane.comp.horde.announce/532</url>
 <url>http://bugs.horde.org/ticket/9357</url>
 </references>
 <dates>
 <discovery>2010-11-02</discovery>
 <entry>2010-11-23</entry>
 </dates>
 </vuln>

<vuln vid="533d20e7-f71f-11df-9ae1-000bcdf0a03b">
 <topic>proftpd -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>proftpd</name>
	<range><lt>1.3.3c</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tippingpoint reports:
	<blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-10-229/">
	 This vulnerability allows remote attackers to execute arbitrary
	 code on vulnerable installations of ProFTPD. Authentication is not
	 required to exploit this vulnerability.
	 The flaw exists within the proftpd server component which
	 listens by default on TCP port 21. When reading user input if a
	 TELNET_IAC escape sequence is encountered the process
	 miscalculates a buffer length counter value allowing a user
	 controlled copy of data to a stack buffer. A remote attacker can
	 exploit this vulnerability to execute arbitrary code under the
	 context of the proftpd process.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>44562</bid>
 <cvename>CVE-2010-4221</cvename>
 <url>http://www.zerodayinitiative.com/advisories/ZDI-10-229/</url>
 </references>
 <dates>
 <discovery>2010-11-02</discovery>
 <entry>2010-11-23</entry>
 </dates>
 </vuln>

<vuln vid="3042c33a-f237-11df-9d02-0018fe623f2b">
 <topic>openssl -- TLS extension parsing race condition</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>1.0.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenSSL Team reports:
	<blockquote cite="http://openssl.org/news/secadv_20101116.txt">
	 Rob Hulswit has found a flaw in the OpenSSL TLS server extension
	 code parsing which on affected servers can be exploited in a buffer
	 overrun attack.
	 Any OpenSSL based TLS server is vulnerable if it is multi-threaded
	 and uses OpenSSL's internal caching mechanism. Servers that are
	 multi-process and/or disable internal session caching are NOT
	 affected.
	 In particular the Apache HTTP server (which never uses OpenSSL
	 internal caching) and Stunnel (which includes its own workaround)
	 are NOT affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-3864</cvename>
 <url>http://openssl.org/news/secadv_20101116.txt</url>
 </references>
 <dates>
 <discovery>2010-10-08</discovery>
 <entry>2010-11-17</entry>
 </dates>
 </vuln>

<vuln vid="76b597e4-e9c6-11df-9e10-001b2134ef46">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><lt>9.0r289</lt></range>
 </package>
 <package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.1r102</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-26.html">
	 Critical vulnerabilities have been identified in
	 Adobe Flash Player 10.1.85.3 and earlier versions for
	 Windows, Macintosh, Linux, and Solaris, and Adobe Flash Player
	 10.1.95.1 for Android. These vulnerabilities, including
	 CVE-2010-3654 referenced in Security Advisory APSA10-05,
	 could cause the application to crash and could potentially
	 allow an attacker to take control of the affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-3636</cvename>
 <cvename>CVE-2010-3637</cvename>
 <cvename>CVE-2010-3638</cvename>
 <cvename>CVE-2010-3639</cvename>
 <cvename>CVE-2010-3640</cvename>
 <cvename>CVE-2010-3641</cvename>
 <cvename>CVE-2010-3642</cvename>
 <cvename>CVE-2010-3643</cvename>
 <cvename>CVE-2010-3644</cvename>
 <cvename>CVE-2010-3645</cvename>
 <cvename>CVE-2010-3646</cvename>
 <cvename>CVE-2010-3647</cvename>
 <cvename>CVE-2010-3648</cvename>
 <cvename>CVE-2010-3649</cvename>
 <cvename>CVE-2010-3650</cvename>
 <cvename>CVE-2010-3652</cvename>
 <cvename>CVE-2010-3654</cvename>
 <cvename>CVE-2010-3676</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb10-26.html</url>
 <url>http://www.adobe.com/support/security/advisories/apsa10-05.html</url>
 </references>
 <dates>
 <discovery>2010-09-28</discovery>
 <entry>2010-11-06</entry>
 </dates>
 </vuln>

<vuln vid="b2eaa7c2-e64a-11df-bc65-0022156e8794">
 <topic>Wireshark -- DoS in the BER-based dissectors</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<range><ge>1.3</ge><lt>1.4.1</lt></range>
	<range><ge>1.0</ge><lt>1.2.12</lt></range>
 </package>
 <package>
	<name>wireshark-lite</name>
	<range><ge>1.3</ge><lt>1.4.1</lt></range>
	<range><ge>1.0</ge><lt>1.2.12</lt></range>
 </package>
 <package>
	<name>tshark</name>
	<range><ge>1.3</ge><lt>1.4.1</lt></range>
	<range><ge>1.0</ge><lt>1.2.12</lt></range>
 </package>
 <package>
	<name>tshark-lite</name>
	<range><ge>1.3</ge><lt>1.4.1</lt></range>
	<range><ge>1.0</ge><lt>1.2.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/41535">
	 A vulnerability has been discovered in Wireshark, which can
	 be exploited by malicious people to cause a DoS (Denial of
	 Service).
	 The vulnerability is caused due to an infinite recursion
	 error in the "dissect_unknown_ber()" function in
	 epan/dissectors/packet-ber.c and can be exploited to cause a
	 stack overflow e.g. via a specially crafted SNMP packet.
	 The vulnerability is confirmed in version 1.4.0 and
	 reported in version 1.2.11 and prior and version 1.4.0 and
	 prior.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-3445</cvename>
 <url>http://www.wireshark.org/lists/wireshark-announce/201010/msg00002.html</url>
 <url>http://www.wireshark.org/lists/wireshark-announce/201010/msg00001.html</url>
 </references>
 <dates>
 <discovery>2010-09-16</discovery>
 <entry>2010-11-05</entry>
 </dates>
 </vuln>

<vuln vid="4ab29e12-e787-11df-adfa-00e0815b8da8">
 <topic>Mailman -- cross-site scripting in web interface</topic>
 <affects>
 <package>
	<name>mailman</name>
	<range><lt>2.1.14</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/41265">
	 Two vulnerabilities have been reported in Mailman, which
	 can be exploited by malicious users to conduct script
	 insertion attacks.
	 Certain input passed via the list descriptions is not
	 properly sanitised before being displayed to the user. This
	 can be exploited to insert arbitrary HTML and script code,
	 which will be executed in a user's browser session in context
	 of an affected site when the malicious data is being
	 viewed.
	 Successful exploitation requires "list owner" permissions.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>43187</bid>
 <cvename>CVE-2010-3089</cvename>
 <url>http://secunia.com/advisories/41265</url>
 </references>
 <dates>
 <discovery>2010-09-14</discovery>
 <entry>2010-11-03</entry>
 </dates>
 </vuln>

<vuln vid="96e776c7-e75c-11df-8f26-00151735203a">
 <topic>OTRS -- Multiple XSS and denial of service vulnerabilities</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><gt>2.3.*</gt><lt>2.4.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OTRS Security Advisory reports:
	<blockquote cite="http://otrs.org/advisory/OSA-2010-02-en/">
	 <ul>
	 <li>Multiple Cross Site Scripting issues:
	 Missing HTML quoting allows authenticated agents or
	 customers to inject HTML tags. This vulnerability
	 allows an attacker to inject script code into the OTRS
	 web-interface which will be loaded and executed
	 in the browsers of system users.</li>
	 <li>Possible Denial of Service Attack:
	 Perl's regular expressions consume 100% CPU time
	 on the server if an agent or customer views an affected
	 article. To exploit this vulnerability the malicious user
	 needs to send extremely large HTML emails to your
	 system address.</li>
	 </ul>
	</blockquote>
	<blockquote cite="http://otrs.org/advisory/OSA-2010-03-en/">
	 AgentTicketZoom is vulnerable to XSS attacks from HTML e-mails:
	 Whenever a customer sends an HTML e-mail and RichText is enabled
	 in OTRS, javascript contained in the email can do everything
	 in the OTRS agent interface that the agent himself could do.
	 Most relevant is that this type of exploit can be used in such
	 a way that the agent won't even detect he is being exploited.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2080</cvename>
 <cvename>CVE-2010-4071</cvename>
 <url>http://otrs.org/advisory/OSA-2010-02-en/</url>
 <url>http://otrs.org/advisory/OSA-2010-03-en/</url>
 </references>
 <dates>
 <discovery>2010-09-15</discovery>
 <entry>2010-11-03</entry>
 </dates>
 </vuln>

<vuln vid="c223b00d-e272-11df-8e32-000f20797ede">
 <topic>mozilla -- Heap buffer overflow mixing document.write and DOM insertion</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.12,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.15,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.12</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.6.12,1</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.15</lt></range>
 </package>
 <package>
	<name>linux-seamonkey</name>
	<range><lt>2.0.10</lt></range>
 </package>
 <package>
	<name>linux-thunderbird</name>
	<range><lt>3.1.6</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.10</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.10</lt></range>
	<range><ge>3.1</ge><lt>3.1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2010-73 Heap buffer overflow mixing document.write and DOM insertion
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-3765</cvename>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-73.html</url>
 </references>
 <dates>
 <discovery>2010-10-27</discovery>
 <entry>2010-10-28</entry>
 </dates>
 </vuln>

<vuln vid="aab187d4-e0f3-11df-b1ea-001999392805">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<range><lt>10.63</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Opera Desktop Team reports:
	<blockquote cite="http://www.opera.com/docs/changelogs/unix/1063/">
	 <ul>
	 <li>Fixed an issue that allowed cross-domain checks to be bypassed,
	 allowing limited data theft using CSS, as reported by Isaac
	 Dawson.</li>
	 <li>Fixed an issue where manipulating the window could be used to
	 spoof the page address.</li>
	 <li>Fixed an issue with reloads and redirects that could allow
	 spoofing and cross-site scripting.</li>
	 <li>Fixed an issue that allowed private video streams to be
	 intercepted, as reported by Nirankush Panchbhai of Microsoft
	 Vulnerability Research.</li>
	 <li>Fixed an issue that caused JavaScript to run in the wrong
	 security context after manual interaction.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.opera.com/support/kb/view/971/</url>
 <url>http://www.opera.com/support/kb/view/972/</url>
 <url>http://www.opera.com/support/kb/view/973/</url>
 <url>http://www.opera.com/support/kb/view/974/</url>
 <url>http://www.opera.com/support/kb/view/976/</url>
 </references>
 <dates>
 <discovery>2010-10-12</discovery>
 <entry>2010-10-26</entry>
 </dates>
 </vuln>

<vuln vid="0ddb57a9-da20-4e99-b048-4366092f3d31">
 <topic>bzip2 -- integer overflow vulnerability</topic>
 <affects>
 <package>
 <name>bzip2</name>
 <range><lt>1.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Secunia reports:
 <blockquote cite="http://secunia.com/advisories/41452">
 A vulnerability has been reported in bzip2, which can be exploited by
	malicious people to cause a DoS (Denial of Service) or potentially
	compromise a vulnerable system.
 The vulnerability is caused due to an integer overflow in the
	"BZ2_decompress()" function in decompress.c and can be exploited to
	cause a crash or potentially execute arbitrary code.
 </blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-10:08.bzip2</freebsdsa>
 <freebsdpr>ports/151364</freebsdpr>
 <cvename>CVE-2010-0405</cvename>
 <bid>43331</bid>
	 <mlist>http://www.openwall.com/lists/oss-security/2010/09/21/4</mlist>
 <url>http://secunia.com/advisories/41452</url>
 </references>
 <dates>
 <discovery>2010-09-21</discovery>
 <entry>2010-10-25</entry>
 </dates>
 </vuln>

<vuln vid="18dc48fe-ca42-11df-aade-0050568f000c">
 <topic>FreeBSD -- Integer overflow in bzip2 decompression</topic>
 <affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.4</ge><lt>6.4_11</lt></range>
	<range><ge>7.1</ge><lt>7.1_14</lt></range>
	<range><ge>7.3</ge><lt>7.3_3</lt></range>
	<range><ge>8.0</ge><lt>8.0_5</lt></range>
	<range><ge>8.1</ge><lt>8.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When decompressing data, the run-length encoded values are not
	 adequately sanity-checked, allowing for an integer overflow.
 </body>
 </description>
 <references>
 <freebsdsa>SA-10:08.bzip2</freebsdsa>
 </references>
 <dates>
 <discovery>2010-09-20</discovery>
 <entry>2010-10-24</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="7a09a8df-ca41-11df-aade-0050568f000c">
 <topic>FreeBSD -- Lost mbuf flag resulting in data corruption</topic>
 <affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.1</ge><lt>7.1_13</lt></range>
	<range><ge>7.3</ge><lt>7.3_2</lt></range>
	<range><ge>8.0</ge><lt>8.0_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The read-only flag is not correctly copied when a mbuf buffer
	 reference is duplicated. When the sendfile(2) system call is used to
	 transmit data over the loopback interface, this can result in the
	 backing pages for the transmitted file being modified, causing data
	 corruption.
 </body>
 </description>
 <references>
 <freebsdsa>SA-10:07.mbuf</freebsdsa>
 </references>
 <dates>
 <discovery>2010-07-13</discovery>
 <entry>2010-10-24</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="0dc91089-ca41-11df-aade-0050568f000c">
 <topic>FreeBSD -- Unvalidated input in nfsclient</topic>
 <affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.2</ge><lt>7.2_8</lt></range>
	<range><ge>7.3</ge><lt>7.3_1</lt></range>
	<range><ge>8.0</ge><lt>8.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The NFS client subsystem fails to correctly validate the length of a
	 parameter provided by the user when a filesystem is mounted.
 </body>
 </description>
 <references>
 <freebsdsa>SA-10:06.nfsclient</freebsdsa>
 </references>
 <dates>
 <discovery>2010-05-27</discovery>
 <entry>2010-10-24</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="768cfe70-ca40-11df-aade-0050568f000c">
 <topic>FreeBSD -- OPIE off-by-one stack overflow</topic>
 <affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.4</ge><lt>6.4_10</lt></range>
	<range><ge>7.1</ge><lt>7.1_12</lt></range>
	<range><ge>7.2</ge><lt>7.2_8</lt></range>
	<range><ge>7.3</ge><lt>7.3_1</lt></range>
	<range><ge>8.0</ge><lt>8.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A programming error in the OPIE library could allow an off-by-one
	 buffer overflow to write a single zero byte beyond the end of an
	 on-stack buffer.
 </body>
 </description>
 <references>
 <freebsdsa>SA-10:05.opie</freebsdsa>
 </references>
 <dates>
 <discovery>2010-05-27</discovery>
 <entry>2010-10-24</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="f6eb2279-ca3f-11df-aade-0050568f000c">
 <topic>FreeBSD -- Insufficient environment sanitization in jail(8)</topic>
 <affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>8.0</ge><lt>8.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The jail(8) utility does not change the current working directory
	 while imprisoning. The current working directory can be accessed by
	 its descendants.
 </body>
 </description>
 <references>
 <freebsdsa>SA-10:04.jail</freebsdsa>
 </references>
 <dates>
 <discovery>2010-05-27</discovery>
 <entry>2010-10-24</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="97f09f2f-ca3f-11df-aade-0050568f000c">
 <topic>FreeBSD -- ZFS ZIL playback with insecure permissions</topic>
 <affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.1</ge><lt>7.1_10</lt></range>
	<range><ge>7.2</ge><lt>7.2_6</lt></range>
	<range><ge>8.0</ge><lt>8.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When replaying setattr transaction, the replay code would set the
	 attributes with certain insecure defaults, when the logged
	 transaction did not touch these attributes.
 </body>
 </description>
 <references>
 <freebsdsa>SA-10:03.zfs</freebsdsa>
 </references>
 <dates>
 <discovery>2010-01-06</discovery>
 <entry>2010-10-24</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="48103b0a-ca3f-11df-aade-0050568f000c">
 <topic>FreeBSD -- ntpd mode 7 denial of service</topic>
 <affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_15</lt></range>
	<range><ge>6.4</ge><lt>6.4_9</lt></range>
	<range><ge>7.1</ge><lt>7.1_10</lt></range>
	<range><ge>7.2</ge><lt>7.2_6</lt></range>
	<range><ge>8.0</ge><lt>8.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	If ntpd receives a mode 7 (MODE_PRIVATE) request or error response
	 from a source address not listed in either a 'restrict ... noquery'
	 or a 'restrict ... ignore' section it will log the even and send a
	 mode 7 error response.
 </body>
 </description>
 <references>
 <freebsdsa>SA-10:02.ntpd</freebsdsa>
 </references>
 <dates>
 <discovery>2010-01-06</discovery>
 <entry>2010-10-24</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="e500b9bf-ca3e-11df-aade-0050568f000c">
 <topic>FreeBSD -- BIND named(8) cache poisoning with DNSSEC validation</topic>
 <affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_15</lt></range>
	<range><ge>6.4</ge><lt>6.4_9</lt></range>
	<range><ge>7.1</ge><lt>7.1_10</lt></range>
	<range><ge>7.2</ge><lt>7.2_6</lt></range>
	<range><ge>8.0</ge><lt>8.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	If a client requests DNSSEC records with the Checking Disabled (CD)
	 flag set, BIND may cache the unvalidated responses. These responses
	 may later be returned to another client that has not set the CD
	 flag.
 </body>
 </description>
 <references>
 <freebsdsa>SA-10:01.bind</freebsdsa>
 </references>
 <dates>
 <discovery>2010-01-06</discovery>
 <entry>2010-10-24</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="6e87b696-ca3e-11df-aade-0050568f000c">
 <topic>FreeBSD -- Inappropriate directory permissions in freebsd-update(8)</topic>
 <affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_14</lt></range>
	<range><ge>6.4</ge><lt>6.4_8</lt></range>
	<range><ge>7.1</ge><lt>7.1_9</lt></range>
	<range><ge>7.2</ge><lt>7.2_5</lt></range>
	<range><ge>8.0</ge><lt>8.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When downloading updates to FreeBSD via 'freebsd-update fetch' or
	 'freebsd-update upgrade', the freebsd-update(8) utility copies
	 currently installed files into its working directory
	 (/var/db/freebsd-update by default) both for the purpose of merging
	 changes to configuration files and in order to be able to roll back
	 installed updates.
	The default working directory used by freebsd-update(8) is normally
	 created during the installation of FreeBSD with permissions which
	 allow all local users to see its contents, and freebsd-update(8) does
	 not take any steps to restrict access to files stored in said
	 directory.
 </body>
 </description>
 <references>
 <freebsdsa>SA-09:17.freebsd-update</freebsdsa>
 </references>
 <dates>
 <discovery>2009-12-03</discovery>
 <entry>2010-10-24</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="ad08d14b-ca3d-11df-aade-0050568f000c">
 <topic>FreeBSD -- Improper environment sanitization in rtld(1)</topic>
 <affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>7.1</ge><lt>7.1_9</lt></range>
	<range><ge>7.2</ge><lt>7.2_5</lt></range>
	<range><ge>8.0</ge><lt>8.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When running setuid programs rtld will normally remove potentially
	 dangerous environment variables. Due to recent changes in FreeBSD
	 environment variable handling code, a corrupt environment may
	 result in attempts to unset environment variables failing.
 </body>
 </description>
 <references>
 <freebsdsa>SA-09:16.rtld</freebsdsa>
 </references>
 <dates>
 <discovery>2009-12-03</discovery>
 <entry>2010-10-24</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="406779fd-ca3b-11df-aade-0050568f000c">
 <topic>FreeBSD -- SSL protocol flaw</topic>
 <affects>
	<package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_14</lt></range>
	<range><ge>6.4</ge><lt>6.4_8</lt></range>
	<range><ge>7.1</ge><lt>7.1_9</lt></range>
	<range><ge>7.2</ge><lt>7.2_5</lt></range>
	<range><ge>8.0</ge><lt>8.0_1</lt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The SSL version 3 and TLS protocols support session
	 renegotiation without cryptographically tying the new
	 session parameters to the old parameters.
 </body>
 </description>
 <references>
 <freebsdsa>SA-09:15.ssl</freebsdsa>
 </references>
 <dates>
 <discovery>2009-12-03</discovery>
 <entry>2010-10-24</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="c9a6ae4a-df8b-11df-9573-00262d5ed8ee">
 <topic>monotone -- remote denial of service in default setup</topic>
 <affects>
 <package>
	<name>monotone</name>
	<range><lt>0.48.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The monotone developers report:
	<blockquote cite="http://www.monotone.ca/NEWS">
	 Running "mtn ''" or "mtn ls ''" doesn't cause an internal
	 error anymore. In monotone 0.48 and earlier this behavior
	 could be used to crash a server remotely (but only if it was
	 configured to allow execution of remote commands).
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/151665</freebsdpr>
 <url>http://www.monotone.ca/NEWS</url>
 <url>http://www.thomaskeller.biz/blog/2010/10/22/monotone-0-48-1-released-please-update-your-servers/</url>
 </references>
 <dates>
 <discovery>2010-10-21</discovery>
 <entry>2010-10-24</entry>
 </dates>
 </vuln>

<vuln vid="c4f067b9-dc4a-11df-8e32-000f20797ede">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.11,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.14,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.11</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.6.11,1</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.14</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.9</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.9</lt></range>
	<range><ge>3.1</ge><lt>3.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2010-64 Miscellaneous memory safety hazards (rv:1.9.2.11/ 1.9.1.14)
	 MFSA 2010-65 Buffer overflow and memory corruption using document.write
	 MFSA 2010-66 Use-after-free error in nsBarProp
	 MFSA 2010-67 Dangling pointer vulnerability in LookupGetterOrSetter
	 MFSA 2010-68 XSS in gopher parser when parsing hrefs
	 MFSA 2010-69 Cross-site information disclosure via modal calls
	 MFSA 2010-70 SSL wildcard certificate matching IP addresses
	 MFSA 2010-71 Unsafe library loading vulnerabilities
	 MFSA 2010-72 Insecure Diffie-Hellman key exchange
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-3170</cvename>
 <cvename>CVE-2010-3173</cvename>
 <cvename>CVE-2010-3174</cvename>
 <cvename>CVE-2010-3175</cvename>
 <cvename>CVE-2010-3176</cvename>
 <cvename>CVE-2010-3177</cvename>
 <cvename>CVE-2010-3178</cvename>
 <cvename>CVE-2010-3179</cvename>
 <cvename>CVE-2010-3180</cvename>
 <cvename>CVE-2010-3181</cvename>
 <cvename>CVE-2010-3182</cvename>
 <cvename>CVE-2010-3183</cvename>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-64.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-65.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-66.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-67.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-68.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-69.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-70.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-71.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-72.html</url>
 </references>
 <dates>
 <discovery>2010-10-19</discovery>
 <entry>2010-10-20</entry>
 </dates>
 </vuln>

<vuln vid="e5090d2a-dbbe-11df-82f8-0015f2db7bde">
 <topic>Webkit-gtk2 -- Multiple Vulnabilities</topic>
 <affects>
 <package>
	<name>webkit-gtk2</name>
	<range><lt>1.2.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gustavo Noronha Silva reports:
	<blockquote cite="http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS">
	 The patches to fix the following CVEs are included with help from
	 Vincent Danen and other members of the Red Hat security team:
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1780</cvename>
 <cvename>CVE-2010-1807</cvename>
 <cvename>CVE-2010-1812</cvename>
 <cvename>CVE-2010-1814</cvename>
 <cvename>CVE-2010-1815</cvename>
 <cvename>CVE-2010-3113</cvename>
 <cvename>CVE-2010-3114</cvename>
 <cvename>CVE-2010-3115</cvename>
 <cvename>CVE-2010-3116</cvename>
 <cvename>CVE-2010-3255</cvename>
 <cvename>CVE-2010-3257</cvename>
 <cvename>CVE-2010-3259</cvename>
 <url>http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS</url>
 </references>
 <dates>
 <discovery>2010-10-01</discovery>
 <entry>2010-10-19</entry>
 </dates>
 </vuln>

<vuln vid="dd943fbb-d0fe-11df-95a8-00219b0fc4d8">
 <topic>apr -- multiple vunerabilities</topic>
 <affects>
 <package>
	<name>apr1</name>
	<range><lt>1.4.2.1.3.10</lt></range>
 </package>
 <package>
	<name>apr0</name>
	<range><lt>0.9.19.0.9.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/41701">
	 Multiple vulnerabilities have been reported in APR-util, which can
	 be exploited by malicious people to cause a DoS (Denial of
	 Service).
	 Two XML parsing vulnerabilities exist in the bundled version of
	 expat.
	 An error within the "apr_brigade_split_line()" function in
	 buckets/apr_brigade.c can be exploited to cause high memory
	 consumption.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>43673</bid>
 <cvename>CVE-2009-3560</cvename>
 <cvename>CVE-2009-3720</cvename>
 <cvename>CVE-2010-1623</cvename>
 <url>http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3</url>
 <url>http://secunia.com/advisories/41701</url>
 </references>
 <dates>
 <discovery>2010-10-02</discovery>
 <entry>2010-10-06</entry>
 <modified>2010-10-20</modified>
 </dates>
 </vuln>

<vuln vid="99021f88-ca3c-11df-be21-00e018aa7788">
 <topic>phpmyfaq -- cross site scripting vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><lt>2.6.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyFAQ project reports:
	<blockquote cite="http://www.phpmyfaq.de/advisory_2010-09-28.php">
	 The phpMyFAQ Team has learned of a security issue that has been
	 discovered in phpMyFAQ 2.6.x: phpMyFAQ doesn't sanitize
	 some variables in different pages correctly. With a
	 properly crafted URL it is e.g. possible to inject
	 JavaScript code into the output of a page, which could
	 result in the leakage of domain cookies (f.e. session
	 identifiers)..
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/151055</freebsdpr>
 <url>http://www.phpmyfaq.de/advisory_2010-09-28.php</url>
 </references>
 <dates>
 <discovery>2010-09-28</discovery>
 <entry>2010-10-02</entry>
 </dates>
 </vuln>

<vuln vid="e08c596e-cb28-11df-9c1b-0011098ad87f">
 <topic>horde-gollem -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>horde-gollem</name>
	<range><lt>1.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Horde team reports:
	<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/523">
	 The major changes compared to Gollem version H3 (1.1.1) are:
	 * Fixed an XSS vulnerability in the file viewer.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://article.gmane.org/gmane.comp.horde.announce/523</url>
 <url>http://git.horde.org/diff.php/gollem/docs/CHANGES?rt=horde&amp;r1=1.114.2.55&amp;r2=1.114.2.59&amp;ty=h</url>
 <url>http://bugs.horde.org/ticket/9191</url>
 </references>
 <dates>
 <discovery>2010-08-21</discovery>
 <entry>2010-09-28</entry>
 </dates>
 </vuln>

<vuln vid="6c4db192-cb23-11df-9c1b-0011098ad87f">
 <topic>horde-imp -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>horde-imp</name>
	<range><gt>4.2,1</gt><lt>4.3.8,1</lt></range>
	<range><lt>4.3.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Horde team reports:
	<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/516">
	 Thanks to Naumann IT Security Consulting for reporting the XSS
	 vulnerability.
	 The major changes compared to IMP version H3 (4.3.7) are:
	 * Fixed an XSS vulnerability in the Fetchmail configuration.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://article.gmane.org/gmane.comp.horde.announce/516</url>
 <url>http://git.horde.org/diff.php/imp/docs/CHANGES?rt=horde&amp;r1=1.699.2.424&amp;r2=1.699.2.430&amp;ty=h</url>
 </references>
 <dates>
 <discovery>2010-09-28</discovery>
 <entry>2010-09-28</entry>
 <modified>2011-09-23</modified>
 </dates>
 </vuln>

<vuln vid="8fc55043-cb1e-11df-9c1b-0011098ad87f">
 <topic>horde-base -- XSS and CSRF vulnerabilities</topic>
 <affects>
 <package>
	<name>horde-base</name>
	<range><lt>3.3.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Horde team reports:
	<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/515">
	 Thanks to Naumann IT Security Consulting for reporting the XSS
	 vulnerability.
	 Thanks to Secunia for releasing an advisory for the new CSRF
	 protection in the preference interface
	 The major changes compared to Horde version 3.3.8 are:
	 * Fixed XSS vulnerability in util/icon_browser.php.
	 * Protected preference forms against CSRF attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://article.gmane.org/gmane.comp.horde.announce/515</url>
 <url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?rt=horde&amp;r1=1.515.2.607&amp;r2=1.515.2.620&amp;ty=h</url>
 <url>http://secunia.com/advisories/39860/</url>
 <url>http://holisticinfosec.org/content/view/145/45/</url>
 </references>
 <dates>
 <discovery>2010-06-03</discovery>
 <entry>2010-09-28</entry>
 </dates>
 </vuln>

<vuln vid="80b6d6cc-c970-11df-bb18-0015587e2cc1">
 <topic>openx -- remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>openx</name>
	<range><lt>2.8.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenX project reported:
	<blockquote cite="http://blog.openx.org/09/security-update/">
	 It has been brought to our attention that there is a vulnerability
	 in the 2.8 downloadable version of OpenX that can result in a server
	 running the downloaded version of OpenX being compromised.
	</blockquote>
	This vulnerability exists in the file upload functionality
	 and allows attackers to upload and execute PHP code of
	 their choice.
 </body>
 </description>
 <references>
 <url>http://blog.openx.org/09/security-update/</url>
 <url>http://www.h-online.com/security/news/item/Web-sites-distribute-malware-via-hacked-OpenX-servers-1079099.html</url>
 </references>
 <dates>
 <discovery>2010-09-14</discovery>
 <entry>2010-09-26</entry>
 </dates>
 </vuln>

<vuln vid="e4dac715-c818-11df-a92c-0015587e2cc1">
 <topic>squid -- Denial of service vulnerability in request handling</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><ge>3.0.1</ge><lt>3.0.25_3</lt></range>
	<range><ge>3.1.0.1</ge><lt>3.1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid security advisory 2010:3 reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2010_3.txt">
	 Due to an internal error in string handling Squid is
	 vulnerable to a denial of service attack when processing
	 specially crafted requests.
	 This problem allows any trusted client to perform a
	 denial of service attack on the Squid service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-3072</cvename>
 <url>http://www.squid-cache.org/Advisories/SQUID-2010_3.txt</url>
 </references>
 <dates>
 <discovery>2010-08-30</discovery>
 <entry>2010-09-24</entry>
 </dates>
 </vuln>

<vuln vid="8a34d9e6-c662-11df-b2e1-001b2134ef46">
 <topic>linux-flashplugin -- remote code execution</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><lt>9.0r283</lt></range>
 </package>
 <package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.1r85</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="http://www.adobe.com/support/security/advisories/apsa10-03.html">
	 A critical vulnerability exists in Adobe Flash Player
	 10.1.82.76 and earlier versions for Windows, Macintosh,
	 Linux, Solaris, and Adobe Flash Player 10.1.92.10 for
	 Android. This vulnerability also affects Adobe Reader
	 9.3.4 and earlier versions for Windows, Macintosh and
	 UNIX, and Adobe Acrobat 9.3.4 and earlier versions for
	 Windows and Macintosh. This vulnerability (CVE-2010-2884)
	 could cause a crash and potentially allow an attacker
	 to take control of the affected system. There are
	 reports that this vulnerability is being actively
	 exploited in the wild against Adobe Flash Player on
	 Windows. Adobe is not aware of any attacks exploiting
	 this vulnerability against Adobe Reader or Acrobat to
	 date.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2884</cvename>
 <url>http://www.adobe.com/support/security/advisories/apsa10-03.html</url>
 </references>
 <dates>
 <discovery>2010-09-14</discovery>
 <entry>2010-09-22</entry>
 </dates>
 </vuln>

<vuln vid="3ff95dd3-c291-11df-b0dc-00215c6a37bb">
 <topic>django -- cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>py23-django</name>
	<name>py24-django</name>
	<name>py25-django</name>
	<name>py26-django</name>
	<name>py30-django</name>
	<name>py31-django</name>
	<range><gt>1.2</gt><lt>1.2.2</lt></range>
 </package>
 <package>
	<name>py23-django-devel</name>
	<name>py24-django-devel</name>
	<name>py25-django-devel</name>
	<name>py26-django-devel</name>
	<name>py30-django-devel</name>
	<name>py31-django-devel</name>
	<range><lt>13698,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django project reports:
	<blockquote cite="http://www.djangoproject.com/weblog/2010/sep/08/security-release/">
	 The provided template tag for inserting the CSRF
	 token into forms -- {% csrf_token %} -- explicitly
	 trusts the cookie value, and displays it as-is.
	 Thus, an attacker who is able to tamper with the
	 value of the CSRF cookie can cause arbitrary content
	 to be inserted, unescaped, into the outgoing HTML of
	 the form, enabling cross-site scripting (XSS) attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>43116</bid>
 <cvename>CVE-2010-3082</cvename>
 <url>http://xforce.iss.net/xforce/xfdb/61729</url>
 </references>
 <dates>
 <discovery>2010-09-13</discovery>
 <entry>2010-09-17</entry>
 </dates>
 </vuln>

<vuln vid="9bcfd7b6-bcda-11df-9a6a-0015f2db7bde">
 <topic>webkit-gtk2 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>webkit-gtk2</name>
	<range><lt>1.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gustavo Noronha Silva reports:
	<blockquote cite="http://gitorious.org/webkitgtk/stable/commit/9d07fda89aab7105962d933eef32ca15dda610d8">
	 With help from Vincent Danen and other members of the Red Hat
	 security team, the following CVE's where fixed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1781</cvename>
 <cvename>CVE-2010-1782</cvename>
 <cvename>CVE-2010-1784</cvename>
 <cvename>CVE-2010-1785</cvename>
 <cvename>CVE-2010-1786</cvename>
 <cvename>CVE-2010-1787</cvename>
 <cvename>CVE-2010-1788</cvename>
 <cvename>CVE-2010-1790</cvename>
 <cvename>CVE-2010-1792</cvename>
 <cvename>CVE-2010-1793</cvename>
 <cvename>CVE-2010-2647</cvename>
 <cvename>CVE-2010-2648</cvename>
 <cvename>CVE-2010-3119</cvename>
 <url>http://gitorious.org/webkitgtk/stable/commit/9d07fda89aab7105962d933eef32ca15dda610d8</url>
 </references>
 <dates>
 <discovery>2010-09-07</discovery>
 <entry>2010-09-10</entry>
 </dates>
 </vuln>

<vuln vid="f866d2af-bbba-11df-8a8d-0008743bf21a">
 <topic>vim6 -- heap-based overflow while parsing shell metacharacters</topic>
 <affects>
 <package>
	<name>vim6</name>
	<name>vim6+ruby</name>
	<range><ge>6.2.429</ge><lt>6.3.62</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Description for CVE-2008-3432 says:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3432">
	 Heap-based buffer overflow in the mch_expand_wildcards
	 function in os_unix.c in Vim 6.2 and 6.3 allows user-assisted
	 attackers to execute arbitrary code via shell metacharacters
	 in filenames, as demonstrated by the netrw.v3 test case.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3432</cvename>
 <url>http://www.openwall.com/lists/oss-security/2008/07/15/4</url>
 </references>
 <dates>
 <discovery>2008-07-31</discovery>
 <entry>2010-09-09</entry>
 </dates>
 </vuln>

<vuln vid="4a21ce2c-bb13-11df-8e32-000f20797ede">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.9,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.12,1</lt></range>
 </package>
 <package>
	<name>libxul</name>
	<range><gt>1.9.2.*</gt><lt>1.9.2.9</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.6.9,1</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.12</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.7</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.7</lt></range>
	<range><ge>3.1</ge><lt>3.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2010-49 Miscellaneous memory safety hazards (rv:1.9.2.9/ 1.9.1.12)
	 MFSA 2010-50 Frameset integer overflow vulnerability
	 MFSA 2010-51 Dangling pointer vulnerability using DOM plugin array
	 MFSA 2010-52 Windows XP DLL loading vulnerability
	 MFSA 2010-53 Heap buffer overflow in nsTextFrameUtils::TransformText
	 MFSA 2010-54 Dangling pointer vulnerability in nsTreeSelection
	 MFSA 2010-55 XUL tree removal crash and remote code execution
	 MFSA 2010-56 Dangling pointer vulnerability in nsTreeContentView
	 MFSA 2010-57 Crash and remote code execution in normalizeDocument
	 MFSA 2010-58 Crash on Mac using fuzzed font in data: URL
	 MFSA 2010-59 SJOW creates scope chains ending in outer object
	 MFSA 2010-60 XSS using SJOW scripted function
	 MFSA 2010-61 UTF-7 XSS by overriding document charset using object type attribute
	 MFSA 2010-62 Copy-and-paste or drag-and-drop into designMode document allows XSS
	 MFSA 2010-63 Information leak via XMLHttpRequest statusText
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2762</cvename>
 <cvename>CVE-2010-2763</cvename>
 <cvename>CVE-2010-2764</cvename>
 <cvename>CVE-2010-2765</cvename>
 <cvename>CVE-2010-2766</cvename>
 <cvename>CVE-2010-2767</cvename>
 <cvename>CVE-2010-2768</cvename>
 <cvename>CVE-2010-2769</cvename>
 <cvename>CVE-2010-2770</cvename>
 <cvename>CVE-2010-2760</cvename>
 <cvename>CVE-2010-3131</cvename>
 <cvename>CVE-2010-3166</cvename>
 <cvename>CVE-2010-3167</cvename>
 <cvename>CVE-2010-3168</cvename>
 <cvename>CVE-2010-3169</cvename>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-49.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-50.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-51.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-52.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-53.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-54.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-55.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-56.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-57.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-58.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-59.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-60.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-61.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-62.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-63.html</url>
 </references>
 <dates>
 <discovery>2010-09-07</discovery>
 <entry>2010-09-08</entry>
 <modified>2010-09-15</modified>
 </dates>
 </vuln>

<vuln vid="67b514c3-ba8f-11df-8f6e-000c29a67389">
 <topic>sudo -- Flaw in Runas group matching</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><ge>1.7.0</ge><lt>1.7.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Todd Miller reports:
	<blockquote cite="http://www.sudo.ws/sudo/alerts/runas_group.html">
	 Beginning with sudo version 1.7.0 it has been possible to grant
	 permission to run a command using a specified group via sudo -g
	 option (run as group). A flaw exists in the logic that matches
	 Runas groups in the sudoers file when the -u option is also
	 specified (run as user). This flaw results in a positive match for
	 the user specified via -u so long as the group specified via -g
	 is allowed by the sudoers file.
	 Exploitation of the flaw requires that Sudo be configured with
	 sudoers entries that contain a Runas group. Entries that do not
	 contain a Runas group, or only contain a Runas user are not
	 affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2956</cvename>
 <url>http://www.sudo.ws/sudo/alerts/runas_group.html</url>
 </references>
 <dates>
 <discovery>2010-09-07</discovery>
 <entry>2010-09-07</entry>
 </dates>
 </vuln>

<vuln vid="29b7e3f4-b6a9-11df-ae63-f255a795cb21">
 <topic>lftp -- multiple HTTP client download filename vulnerability</topic>
 <affects>
 <package>
	<name>lftp</name>
	<range><lt>4.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The get1 command, as used by lftpget, in LFTP before 4.0.6 does
	 not properly validate a server-provided filename before determining
	 the destination filename of a download, which allows remote servers
	 to create or overwrite arbitrary files via a Content-Disposition
	 header that suggests a crafted filename, and possibly execute
	 arbitrary code as a consequence of writing to a dotfile in a home
	 directory.
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2251</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=591580</url>
 </references>
 <dates>
 <discovery>2010-06-09</discovery>
 <entry>2010-09-03</entry>
 </dates>
 </vuln>

<vuln vid="d754b7d2-b6a7-11df-826c-e464a695cb21">
 <topic>wget -- multiple HTTP client download filename vulnerability</topic>
 <affects>
 <package>
	<name>wget</name>
	<name>wget-devel</name>
	<range><le>1.12_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GNU Wget version 1.12 and earlier uses a server-provided filename
	 instead of the original URL to determine the destination filename of
	 a download, which allows remote servers to create or overwrite
	 arbitrary files via a 3xx redirect to a URL with a .wgetrc filename
	 followed by a 3xx redirect to a URL with a crafted filename, and
	 possibly execute arbitrary code as a consequence of writing to a
	 dotfile in a home directory.
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2252</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=602797</url>
 </references>
 <dates>
 <discovery>2010-06-09</discovery>
 <entry>2010-09-03</entry>
 </dates>
 </vuln>

<vuln vid="3a7c5fc4-b50c-11df-977b-ecc31dd8ad06">
 <topic>p5-libwww -- possibility to remote servers to create file with a .(dot) character</topic>
 <affects>
 <package>
	<name>p5-libwww</name>
	<range><lt>5.835</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	lwp-download in libwww-perl before 5.835 does not reject downloads
	 to filenames that begin with a `.' (dot) character, which allows
	 remote servers to create or overwrite files via a 3xx redirect to a
	 URL with a crafted filename or a Content-Disposition header that
	 suggests a crafted filename, and possibly execute arbitrary code as
	 a consequence of writing to a dotfile in a home directory.
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2253</cvename>
 <url>http://cpansearch.perl.org/src/GAAS/libwww-perl-5.836/Changes</url>
 </references>
 <dates>
 <discovery>2010-06-09</discovery>
 <entry>2010-08-31</entry>
 </dates>
 </vuln>

<vuln vid="167953a4-b01c-11df-9a98-0015587e2cc1">
 <topic>quagga -- stack overflow and DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>quagga</name>
	<range><lt>0.99.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Red Hat security team reported two vulnerabilities:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2010/08/24/3">
	 A stack buffer overflow flaw was found in the way Quagga's bgpd
	 daemon processed Route-Refresh messages. A configured
	 Border Gateway Protocol (BGP) peer could send a
	 Route-Refresh message with specially-crafted Outbound
	 Route Filtering (ORF) record, which would cause the
	 master BGP daemon (bgpd) to crash or, possibly, execute
	 arbitrary code with the privileges of the user running
	 bgpd.
	 A NULL pointer dereference flaw was found in the way
	 Quagga's bgpd daemon parsed paths of autonomous systems
	 (AS). A configured BGP peer could send a BGP update AS
	 path request with unknown AS type, which could lead to
	 denial of service (bgpd daemon crash).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openwall.com/lists/oss-security/2010/08/24/3</url>
 <url>http://www.quagga.net/news2.php?y=2010&amp;m=8&amp;d=19#id1282241100</url>
 </references>
 <dates>
 <discovery>2010-08-24</discovery>
 <entry>2010-08-25</entry>
 </dates>
 </vuln>

<vuln vid="8cbf4d65-af9a-11df-89b8-00151735203a">
 <topic>bugzilla -- information disclosure, denial of service</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><gt>2.17.1</gt><lt>3.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla Security Advisory reports:
	<blockquote cite="http://www.bugzilla.org/security/3.2.7/">
	 <ul>
	 <li>Remote Information Disclosure:
	 An unprivileged user is normally not allowed to view
	 other users' group membership. But boolean charts
	 let the user use group-based pronouns, indirectly
	 disclosing group membership. This security fix
	 restricts the use of pronouns to groups the user
	 belongs to.</li>
	 <li>Notification Bypass:
	 Normally, when a user is impersonated, he receives
	 an email informing him that he is being impersonated,
	 containing the identity of the impersonator. However,
	 it was possible to impersonate a user without this
	 notification being sent.</li>
	 <li>Remote Information Disclosure:
	 An error message thrown by the "Reports" and "Duplicates"
	 page confirmed the non-existence of products, thus
	 allowing users to guess confidential product names.
	 (Note that the "Duplicates" page was not vulnerable
	 in Bugzilla 3.6rc1 and above though.)</li>
	 <li>Denial of Service:
	 If a comment contained the phrases "bug X" or
	 "attachment X", where X was an integer larger than the
	 maximum 32-bit signed integer size, PostgreSQL would
	 throw an error, and any page containing that comment would
	 not be viewable. On most Bugzillas, any user can enter
	 a comment on any bug, so any user could have used this to
	 deny access to one or all bugs. Bugzillas running on
	 databases other than PostgreSQL are not affected.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2756</cvename>
 <cvename>CVE-2010-2757</cvename>
 <cvename>CVE-2010-2758</cvename>
 <cvename>CVE-2010-2759</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=417048</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=450013</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=577139</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=519835</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=583690</url>
 </references>
 <dates>
 <discovery>2010-08-05</discovery>
 <entry>2010-08-24</entry>
 </dates>
 </vuln>

<vuln vid="b6069837-aadc-11df-82df-0015f2db7bde">
 <topic>OpenTTD -- Denial of service (server) via infinite loop</topic>
 <affects>
 <package>
	<name>openttd</name>
	<range><ge>1.0.1</ge><lt>1.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenTTD Team reports:
	<blockquote cite="http://security.openttd.org/en/CVE-2010-2534">
	 When multiple commands are queued (at the server) for execution
	 in the next game tick and an client joins the server can get into
	 an infinite loop. With the default settings triggering this bug
	 is difficult (if not impossible), however the larger value of
	 the "frame_freq" setting is easier it is to trigger the bug.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2534</cvename>
 <url>http://security.openttd.org/en/CVE-2010-2534</url>
 </references>
 <dates>
 <discovery>2010-06-27</discovery>
 <entry>2010-08-22</entry>
 </dates>
 </vuln>

<vuln vid="67a1c3ae-ad69-11df-9be6-0015587e2cc1">
 <topic>corkscrew -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>corkscrew</name>
	<range><le>2.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The affected corkscrew versions use sscanf calls without proper
	 bounds checking. In the authentication file parsing routine
	 this can cause an exploitable buffer overflow condition.
	 A similar but issue exists in the server response code but
	 appears to be non-exploitable.
 </body>
 </description>
 <references>
	<url>http://people.freebsd.org/~niels/issues/corkscrew-20100821.txt</url>
 </references>
 <dates>
 <discovery>2010-08-21</discovery>
 <entry>2010-08-21</entry>
 </dates>
 </vuln>

<vuln vid="274922b8-ad20-11df-af1f-00e0814cab4e">
 <topic>phpmyadmin -- Several XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>3.3.5.1</lt></range>
 </package>
 <package>
	<name>phpMyAdmin211</name>
	<range><lt>2.11.10.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpMyAdmin Team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php">
	 It was possible to conduct a XSS attack using crafted URLs org
	 POST parameters on several pages.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-3056</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php</url>
 </references>
 <dates>
 <discovery>2010-08-09</discovery>
 <entry>2010-08-21</entry>
 </dates>
 </vuln>

<vuln vid="68c7187a-abd2-11df-9be6-0015587e2cc1">
 <topic>slim -- insecure PATH assignment</topic>
 <affects>
 <package>
	<name>slim</name>
	<range><lt>1.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SLiM assigns logged on users a PATH in which the current
	 working directory ("./") is included. This PATH can allow
	 unintentional code execution through planted binaries and
	 has therefore been fixed SLiM version 1.3.2.
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2945</cvename>
 <url>http://seclists.org/oss-sec/2010/q3/198</url>
 </references>
 <dates>
 <discovery>2010-05-12</discovery>
 <entry>2010-08-19</entry>
 <modified>2010-08-20</modified>
 </dates>
 </vuln>

<vuln vid="34e0316a-aa91-11df-8c2e-001517289bf8">
 <topic>ruby -- UTF-7 encoding XSS vulnerability in WEBrick</topic>
 <affects>
 <package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.7.248_3,1</lt></range>
	<range><ge>1.9.*,1</ge><lt>1.9.1.430,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The official ruby site reports:
	<blockquote cite="http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/">
	 WEBrick have had a cross-site scripting vulnerability that allows
	 an attacker to inject arbitrary script or HTML via a crafted URI.
	 This does not affect user agents that strictly implement HTTP/1.1,
	 however, some user agents do not.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>40895</bid>
 <cvename>CVE-2010-0541</cvename>
 <url>http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/</url>
 </references>
 <dates>
 <discovery>2010-08-16</discovery>
 <entry>2010-08-17</entry>
 <modified>2010-08-20</modified>
 </dates>
 </vuln>

<vuln vid="b74a8076-9b1f-11df-9f58-021e8c343e76">
 <topic>isolate -- local root exploit</topic>
 <affects>
 <package>
	<name>isolate</name>
	<range><lt>20100717</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://code.google.com/p/isolate/">
	 Isolate currently suffers from some bad security bugs! These
	 are local root privilege escalation bugs. Thanks to the helpful
	 person who reported them (email Chris if you want credit!).
	 We're working to fix them ASAP, but until then, isolate is
	 unsafe and you should uninstall it. Sorry!
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/148911</freebsdpr>
 <url>http://code.google.com/p/isolate/</url>
 </references>
 <dates>
 <discovery>2010-07-29</discovery>
 <entry>2010-08-13</entry>
 </dates>
 </vuln>

<vuln vid="e7d91a3c-a7c9-11df-870c-00242b513d7c">
 <topic>vlc -- invalid id3v2 tags may lead to invalid memory dereferencing</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><gt>0.9.0,3</gt><lt>1.1.2_1,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	VideoLAN project reports:
	<blockquote cite="http://www.videolan.org/security/sa1004.html">
	 VLC fails to perform sufficient input validation when trying to
	 extract some meta-informations about input media through ID3v2
	 tags. In the failure case, VLC attempt dereference an invalid
	 memory address, and a crash will ensure.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2937</cvename>
 <url>http://www.videolan.org/security/sa1004.html</url>
 </references>
 <dates>
 <discovery>2010-07-29</discovery>
 <entry>2010-08-14</entry>
 </dates>
 </vuln>

<vuln vid="e19e74a4-a712-11df-b234-001b2134ef46">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><lt>9.0r280</lt></range>
 </package>
 <package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.1r82</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-16.html">
	 Critical vulnerabilities have been identified in Adobe
	 Flash Player version 10.1.53.64 and earlier. These
	 vulnerabilities could cause the application to crash and
	 could potentially allow an attacker to take control of the
	 affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-0209</cvename>
 <cvename>CVE-2010-2188</cvename>
 <cvename>CVE-2010-2213</cvename>
 <cvename>CVE-2010-2214</cvename>
 <cvename>CVE-2010-2215</cvename>
 <cvename>CVE-2010-2216</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb10-16.html</url>
 </references>
 <dates>
 <discovery>2010-01-06</discovery>
 <entry>2010-08-13</entry>
 </dates>
 </vuln>

<vuln vid="71273c4d-a6ec-11df-8a8d-0008743bf21a">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<range><lt>10.61</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Opera Destkop Team reports:
	<blockquote cite="http://www.opera.com/docs/changelogs/unix/1061/">
	 <ul>
	 <li>Fixed an issue where heap buffer overflow in HTML5 canvas could
	 be used to execute arbitrary code, as reported by Kuzzcc.</li>
	 <li>Fixed an issue where unexpected changes in tab focus could be
	 used to run programs from the Internet, as reported by Jakob Balle
	 and Sven Krewitt of Secunia.</li>
	 <li>Fixed an issue where news feed preview could subscribe to feeds
	 without interaction, as reported by Alexios Fakos.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.opera.com/support/search/view/966/</url>
 <url>http://www.opera.com/support/search/view/967/</url>
 <url>http://www.opera.com/support/search/view/968/</url>
 </references>
 <dates>
 <discovery>2010-08-12</discovery>
 <entry>2010-08-13</entry>
 </dates>
 </vuln>

<vuln vid="c2eac2b5-9a7d-11df-8e32-000f20797ede">
 <topic>firefox -- Dangling pointer crash regression from plugin parameter array fix</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.8,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.6.8,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2010-48 Dangling pointer crash regression from plugin parameter array fix
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2755</cvename>
 <url>https://www.mozilla.org/security/announce/2010/mfsa2010-48.html</url>
 </references>
 <dates>
 <discovery>2010-07-20</discovery>
 <entry>2010-08-09</entry>
 </dates>
 </vuln>

<vuln vid="26e1c48a-9fa7-11df-81b5-00e0814cab4e">
 <topic>Piwik -- Local File Inclusion Vulnerability</topic>
 <affects>
 <package>
	<name>piwik</name>
	<range><gt>0.6</gt><lt>0.6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Piwik versions 0.6 through 0.6.3 are vulnerable to arbitrary,
	 remote file inclusion using a directory traversal pattern infinite
	 a crafted request for a data renderer.
	<blockquote cite="http://secunia.com/advisories/40703">
	 A vulnerability has been reported in Piwik, which can before
	 exploited by malicious people to disclose potentially
	 sensitive information. Input passed to unspecified parameters
	 when requesting a data renderer is not properly verified before
	 being used to include files. This can be exploited to includes
	 arbitrary files from local resources via directory traversal
	 attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2786</cvename>
 <url>http://secunia.com/advisories/40703</url>
 </references>
 <dates>
 <discovery>2010-07-28</discovery>
 <entry>2010-08-04</entry>
 </dates>
 </vuln>

<vuln vid="43024078-9b63-11df-8983-001d60d86f38">
 <topic>libmspack -- infinite loop denial of service</topic>
 <affects>
 <package>
	<name>libmspack</name>
	<range><le>0.0.20060920</le></range>
 </package>
 <package>
	<name>cabextract</name>
	<range><lt>1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	There is a denial of service vulnerability in libmspack. The
	 libmspack code is built into cabextract, so it is also
	 vulnerable.
	Secunia reports:
 <blockquote cite="http://secunia.com/advisories/40719/">
	The vulnerability is caused due to an error when copying data
	 from an uncompressed block (block type 0) and can be exploited
	 to trigger an infinite loop by tricking an application using the
	 library into processing specially crafted MS-ZIP archives.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/40719/</url>
 </references>
 <dates>
 <discovery>2010-07-26</discovery>
 <entry>2010-07-30</entry>
 </dates>
 </vuln>

<vuln vid="28a7310f-9855-11df-8d36-001aa0166822">
 <topic>apache -- Remote DoS bug in mod_cache and mod_dav</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><ge>2.2.0</ge><lt>2.2.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache ChangeLog reports:
	<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.16">
	 mod_dav, mod_cache: Fix Handling of requests without a path segment.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1452</cvename>
 <url>http://www.apache.org/dist/httpd/CHANGES_2.2.16</url>
 <url>https://issues.apache.org/bugzilla/show_bug.cgi?id=49246</url>
 <url>http://svn.apache.org/viewvc?view=revision&amp;revision=966349</url>
 </references>
 <dates>
 <discovery>2010-07-21</discovery>
 <entry>2010-07-26</entry>
 </dates>
 </vuln>

<vuln vid="827bc2b7-95ed-11df-9160-00e0815b8da8">
 <topic>git -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>git</name>
	<range><ge>1.5.6</ge><lt>1.7.1.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Greg Brockman reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2010/07/22/1">
	 If an attacker were to create a crafted working copy where the
	 user runs any git command, the attacker could force execution
	 of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2542</cvename>
 <url>http://git.kernel.org/?p=git/git.git;a=commit;h=3c9d0414ed2db0167e6c828b547be8fc9f88fccc</url>
 <url>http://www.openwall.com/lists/oss-security/2010/07/22/1</url>
 </references>
 <dates>
 <discovery>2010-07-20</discovery>
 <entry>2010-07-23</entry>
 </dates>
 </vuln>

<vuln vid="0502c1cb-8f81-11df-a0bb-0050568452ac">
 <topic>codeigniter -- file upload class vulnerability</topic>
 <affects>
 <package>
	<name>codeigniter</name>
	<range><lt>1.7.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Derek Jones reports:
	<blockquote cite="http://codeigniter.com/news/codeigniter_1.7.2_security_patch/">
	 A fix has been implemented for a security flaw in
	 CodeIgniter 1.7.2. All applications using the File
	 Upload class should install the patch to ensure that
	 their application is not subject to a vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://codeigniter.com/news/codeigniter_1.7.2_security_patch/</url>
 <url>http://www.phpframeworks.com/news/p/16365/codeigniter-1-7-2-security-patch</url>
 </references>
 <dates>
 <discovery>2010-07-12</discovery>
 <entry>2010-07-21</entry>
 </dates>
 </vuln>

<vuln vid="8c2ea875-9499-11df-8e32-000f20797ede">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.7,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.11,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.6.7,1</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.11</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.6</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2010-34 Miscellaneous memory safety hazards (rv:1.9.2.7/ 1.9.1.11)
	 MFSA 2010-35 DOM attribute cloning remote code execution vulnerability
	 MFSA 2010-36 Use-after-free error in NodeIterator
	 MFSA 2010-37 Plugin parameter EnsureCachedAttrParamArrays remote code execution vulnerability
	 MFSA 2010-38 Arbitrary code execution using SJOW and fast native function
	 MFSA 2010-39 nsCSSValue::Array index integer overflow
	 MFSA 2010-40 nsTreeSelection dangling pointer remote code execution vulnerability
	 MFSA 2010-41 Remote code execution using malformed PNG image
	 MFSA 2010-42 Cross-origin data disclosure via Web Workers and importScripts
	 MFSA 2010-43 Same-origin bypass using canvas context
	 MFSA 2010-44 Characters mapped to U+FFFD in 8 bit encodings cause subsequent character to vanish
	 MFSA 2010-45 Multiple location bar spoofing vulnerabilities
	 MFSA 2010-46 Cross-domain data theft using CSS
	 MFSA 2010-47 Cross-origin data leakage from script filename in error messages
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-0654</cvename>
 <cvename>CVE-2010-1205</cvename>
 <cvename>CVE-2010-1206</cvename>
 <cvename>CVE-2010-1207</cvename>
 <cvename>CVE-2010-1208</cvename>
 <cvename>CVE-2010-1209</cvename>
 <cvename>CVE-2010-1210</cvename>
 <cvename>CVE-2010-1211</cvename>
 <cvename>CVE-2010-1212</cvename>
 <cvename>CVE-2010-1213</cvename>
 <cvename>CVE-2010-1214</cvename>
 <cvename>CVE-2010-1215</cvename>
 <cvename>CVE-2010-2751</cvename>
 <cvename>CVE-2010-2752</cvename>
 <cvename>CVE-2010-2753</cvename>
 <cvename>CVE-2010-2754</cvename>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-34.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-35.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-36.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-37.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-38.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-39.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-40.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-41.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-42.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-43.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-44.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-45.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-46.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-47.html</url>
 </references>
 <dates>
 <discovery>2010-07-20</discovery>
 <entry>2010-07-21</entry>
 </dates>
 </vuln>

<vuln vid="9a8fecef-92c0-11df-b140-0015f2db7bde">
 <topic>vte -- Classic terminal title set+query attack</topic>
 <affects>
 <package>
	<name>vte</name>
	<range><lt>0.24.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kees Cook reports:
	<blockquote cite="http://www.securityfocus.com/archive/1/512388">
	 Janne Snabb discovered that applications using VTE, such as
	 gnome-terminal, did not correctly filter window and icon title
	 request escape codes. If a user were tricked into viewing
	 specially crafted output in their terminal, a remote attacker
	 could execute arbitrary commands with user privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2713</cvename>
 <url>http://www.securityfocus.com/archive/1/512388</url>
 </references>
 <dates>
 <discovery>2010-07-15</discovery>
 <entry>2010-07-18</entry>
 </dates>
 </vuln>

<vuln vid="19419b3b-92bd-11df-b140-0015f2db7bde">
 <topic>webkit-gtk2 -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>webkit-gtk2</name>
	<range><lt>1.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gustavo Noronha reports:
	<blockquote cite="http://blog.kov.eti.br/?p=116">
	 Debian's Michael Gilbert has done a great job going through all
	 CVEs released about WebKit, and including patches in the Debian
	 package. 1.2.3 includes all of the commits from trunk to fix those,
	 too.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1386</cvename>
 <cvename>CVE-2010-1392</cvename>
 <cvename>CVE-2010-1405</cvename>
 <cvename>CVE-2010-1407</cvename>
 <cvename>CVE-2010-1416</cvename>
 <cvename>CVE-2010-1417</cvename>
 <cvename>CVE-2010-1418</cvename>
 <cvename>CVE-2010-1421</cvename>
 <cvename>CVE-2010-1422</cvename>
 <cvename>CVE-2010-1501</cvename>
 <cvename>CVE-2010-1664</cvename>
 <cvename>CVE-2010-1665</cvename>
 <cvename>CVE-2010-1758</cvename>
 <cvename>CVE-2010-1759</cvename>
 <cvename>CVE-2010-1760</cvename>
 <cvename>CVE-2010-1761</cvename>
 <cvename>CVE-2010-1762</cvename>
 <cvename>CVE-2010-1767</cvename>
 <cvename>CVE-2010-1770</cvename>
 <cvename>CVE-2010-1771</cvename>
 <cvename>CVE-2010-1772</cvename>
 <cvename>CVE-2010-1773</cvename>
 <cvename>CVE-2010-1774</cvename>
 <cvename>CVE-2010-2264</cvename>
 <url>http://blog.kov.eti.br/?p=116</url>
 </references>
 <dates>
 <discovery>2010-07-16</discovery>
 <entry>2010-07-18</entry>
 </dates>
 </vuln>

<vuln vid="ba61ce15-8a7b-11df-87ec-0050569b2d21">
 <topic>redmine -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>redmine</name>
	<range><lt>0.9.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Eric Davis reports:
	<blockquote cite="http://www.redmine.org/news/41">
	 This security release addresses some security
	 vulnerabilities found in the advanced subversion
	 integration module (Redmine.pm perl script).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.redmine.org/news/41</url>
 </references>
 <dates>
 <discovery>2010-07-08</discovery>
 <entry>2010-07-10</entry>
 </dates>
 </vuln>

<vuln vid="25ed4ff8-8940-11df-a339-0026189baca3">
 <topic>bogofilter -- heap underrun on malformed base64 input</topic>
 <affects>
 <package>
	<name>bogofilter</name>
	<range><lt>1.2.1_2</lt></range>
 </package>
 <package>
	<name>bogofilter-sqlite</name>
	<range><lt>1.2.1_1</lt></range>
 </package>
 <package>
	<name>bogofilter-tc</name>
	<range><lt>1.2.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Julius Plenz reports:
	<blockquote cite="http://www.bogofilter.org/pipermail/bogofilter-dev/2010-June/003475.html">
	 I found a bug in the base64_decode function which may cause memory
	 corruption when the function is executed on a malformed base64
	 encoded string.
	 If a string starting with an equal-sign is passed to the
	 base64_decode function it triggers a memory corruption that
	 in some cases makes bogofilter crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2494</cvename>
 <url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2010-01</url>
 </references>
 <dates>
 <discovery>2010-06-28</discovery>
 <entry>2010-07-06</entry>
 </dates>
 </vuln>

<vuln vid="f1331504-8849-11df-89b8-00151735203a">
 <topic>bugzilla -- information disclosure</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><gt>2.17.1</gt><lt>3.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla Security Advisory reports:
	<blockquote cite="http://www.bugzilla.org/security/3.2.6/">
	 <ul>
	 <li>Normally, information about time-tracking (estimated
	 hours, actual hours, hours worked, and deadlines) is
	 restricted to users in the "time-tracking group".
	 However, any user was able, by crafting their own
	 search URL, to search for bugs based using those
	 fields as criteria, thus possibly exposing sensitive
	 time-tracking information by a user seeing that a bug
	 matched their search.</li>
	 <li>If $use_suexec was set to "1" in the localconfig file,
	 then the localconfig file's permissions were set as
	 world-readable by checksetup.pl. This allowed any user
	 with local shell access to see the contents of the file,
	 including the database password and the site_wide_secret
	 variable used for CSRF protection.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1204</cvename>
 <cvename>CVE-2010-0180</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=309952</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=561797</url>
 </references>
 <dates>
 <discovery>2010-06-24</discovery>
 <entry>2010-07-05</entry>
 </dates>
 </vuln>

<vuln vid="8685d412-8468-11df-8d45-001d7d9eb79a">
 <topic>kvirc -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>kvirc</name>
	<name>kvirc-devel</name>
	<range><lt>4.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Two security vulnerabilities have been discovered:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2451">
	 Multiple format string vulnerabilities in the DCC functionality
	 in KVIrc 3.4 and 4.0 have unspecified impact and remote attack vectors.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2452">
	 Directory traversal vulnerability in the DCC functionality
	 in KVIrc 3.4 and 4.0 allows remote attackers to overwrite
	 arbitrary files via unknown vectors.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-2451</cvename>
 <cvename>CVE-2010-2452</cvename>
 <url>http://lists.omnikron.net/pipermail/kvirc/2010-May/000867.html</url>
 </references>
 <dates>
 <discovery>2010-05-17</discovery>
 <entry>2010-06-30</entry>
 </dates>
 </vuln>

<vuln vid="edef3f2f-82cf-11df-bcce-0018f3e2eb82">
 <topic>png -- libpng decompression buffer overflow</topic>
 <affects>
 <package>
	<name>png</name>
	<range>
	 <lt>1.4.3</lt>
	</range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PNG project describes the problem in an advisory:
	<blockquote cite="http://www.libpng.org/pub/png/libpng.html">
	 Several versions of libpng through 1.4.2 (and through 1.2.43
	 in the older series) contain a bug whereby progressive
	 applications such as web browsers (or the rpng2 demo app included
	 in libpng) could receive an extra row of image data beyond the
	 height reported in the header, potentially leading to an
	 out-of-bounds write to memory (depending on how the application
	 is written) and the possibility of execution of an attacker's
	 code with the privileges of the libpng user (including remote
	 compromise in the case of a libpng-based browser visiting a
	 hostile web site).
	</blockquote>
 </body>
 </description>
 <references>
 <bid>41174</bid>
 <cvename>CVE-2010-1205</cvename>
 <url>http://www.libpng.org/pub/png/libpng.html</url>
 </references>
 <dates>
 <discovery>2010-03-30</discovery>
 <entry>2010-06-28</entry>
 <modified>2010-06-28</modified>
 </dates>
 </vuln>

<vuln vid="66759ce6-7530-11df-9c33-000c29ba66d2">
 <topic>moodle -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moodle</name>
	<range><lt>1.9.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Moodle release notes report multiple vulnerabilities
	 which could allow cross site scripting, XSS attacks,
	 unauthorised deletion of attempts in some instances.
 </body>
 </description>
 <references>
 <url>http://docs.moodle.org/en/Moodle_1.9.9_release_notes</url>
 </references>
 <dates>
 <discovery>2010-06-08</discovery>
 <entry>2010-06-28</entry>
 </dates>
 </vuln>

<vuln vid="1cd87e2a-81e3-11df-81d8-00262d5ed8ee">
 <topic>mDNSResponder -- corrupted stack crash when parsing bad resolv.conf</topic>
 <affects>
 <package>
	<name>mDNSResponder</name>
	<range><le>214</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Juli Mallett reports:
	<blockquote>
	 mdnsd will crash on some systems with a corrupt stack and once
	 that's fixed it will still leak a file descriptor when parsing
	 resolv.conf. The crash is because scanf is used with %10s for a
	 buffer that is only 10 chars long. The buffer size needs increased
	 to 11 chars to hold the trailing NUL. To fix the leak, an fclose
	 needs added.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/147007</freebsdpr>
 </references>
 <dates>
 <discovery>2010-05-26</discovery>
 <entry>2010-06-27</entry>
 </dates>
 </vuln>

<vuln vid="77b9f9bc-7fdf-11df-8a8d-0008743bf21a">
 <topic>opera -- Data URIs can be used to allow cross-site scripting</topic>
 <affects>
 <package>
	<name>opera</name>
	<range><lt>10.11</lt></range>
 </package>
 <package>
	<name>opera-devel</name>
	<range><le>10.20_2,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Opera Desktop Team reports:
	<blockquote cite="http://www.opera.com/support/kb/view/955/">
	 Data URIs are allowed to run scripts that manipulate
	 pages from the site that directly opened them. In some cases, the opening site
	 is not correctly detected. In these cases, Data URIs may erroneously be able to
	 run scripts so that they interact with sites that did not directly cause them to
	 be opened.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.opera.com/support/kb/view/955/</url>
 </references>
 <dates>
 <discovery>2010-06-21</discovery>
 <entry>2010-06-25</entry>
 </dates>
 </vuln>

<vuln vid="e02e6a4e-6b26-11df-96b2-0015587e2cc1">
 <topic>cacti -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>0.8.7f</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple vulnerabilities have been reported to exist in older version of
	 Cacti. The release notes of Cacti 0.8.7f summarizes the problems as
	 follows:
	<blockquote cite="http://www.cacti.net/release_notes_0_8_7f.php">
	<ul>
	 <li>SQL injection and shell escaping issues</li>
	 <li>Cross-site scripting issues</li>
	 <li>Cacti Graph Viewer SQL injection vulnerability</li>
	</ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://php-security.org/2010/05/13/mops-2010-023-cacti-graph-viewer-sql-injection-vulnerability/index.html</url>
 <url>http://www.cacti.net/release_notes_0_8_7f.php</url>
 <url>http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php</url>
 <url>http://www.vupen.com/english/advisories/2010/1204</url>
 </references>
 <dates>
 <discovery>2010-05-24</discovery>
 <entry>2010-06-24</entry>
 </dates>
 </vuln>

<vuln vid="99858b7c-7ece-11df-a007-000f20797ede">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.6.*,1</gt><lt>3.6.4,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.10,1</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.10</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.5</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2010-33 User tracking across sites using Math.random()
	 MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present
	 MFSA 2010-31 focus() behavior can be used to inject or steal keystrokes
	 MFSA 2010-30 Integer Overflow in XSLT Node Sorting
	 MFSA 2010-29 Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal
	 MFSA 2010-28 Freed object reuse across plugin instances
	 MFSA 2010-27 Use-after-free error in nsCycleCollector::MarkRoots()
	 MFSA 2010-26 Crashes with evidence of memory corruption (rv:1.9.2.4/ 1.9.1.10)
	 MFSA 2010-25 Re-use of freed object due to scope confusion
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5913</cvename>
 <cvename>CVE-2010-0183</cvename>
 <cvename>CVE-2010-1121</cvename>
 <cvename>CVE-2010-1125</cvename>
 <cvename>CVE-2010-1197</cvename>
 <cvename>CVE-2010-1199</cvename>
 <cvename>CVE-2010-1196</cvename>
 <cvename>CVE-2010-1198</cvename>
 <cvename>CVE-2010-1200</cvename>
 <cvename>CVE-2010-1201</cvename>
 <cvename>CVE-2010-1202</cvename>
 <cvename>CVE-2010-1203</cvename>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-33.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-32.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-31.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-30.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-29.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-28.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-27.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-26.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-25.html</url>
 </references>
 <dates>
 <discovery>2010-06-22</discovery>
 <entry>2010-06-23</entry>
 </dates>
 </vuln>

<vuln vid="25673e6e-786b-11df-a921-0245fb008c0b">
 <topic>ziproxy -- security vulnerability in PNG decoder</topic>
 <affects>
 <package>
 <name>ziproxy</name>
 <range><ge>3.1.0</ge></range>
 <range><lt>3.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Daniel Mealha Cabrita reports:
 <blockquote cite="http://ziproxy.sourceforge.net/#news">
	 Fixed security vulnerability (heap-related) in PNG decoder.
	 (new bug from 3.1.0)
 </blockquote>
 </body>
 </description>
 <references>
 <url>http://ziproxy.sourceforge.net/#news</url>
 <mlist msgid="201006150731.30474.dancab@gmx.net">http://sourceforge.net/mailarchive/message.php?msg_name=201006150731.30474.dancab%40gmx.net</mlist>
 </references>
 <dates>
 <discovery>2010-06-15</discovery>
 <entry>2010-06-15</entry>
 </dates>
 </vuln>

<vuln vid="8816bf3a-7929-11df-bcce-0018f3e2eb82">
 <topic>tiff -- Multiple integer overflows</topic>
 <affects>
 <package>
	<name>tiff</name>
	<range><lt>3.9.4</lt></range>
 </package>
 <package>
	<name>linux-tiff</name>
	<name>linux-f10-tiff</name>
	<range><lt>3.9.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tielei Wang:
	<blockquote cite="http://www.ocert.org/advisories/ocert-2009-012.html">
	 Multiple integer overflows in inter-color spaces conversion
	 tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow
	 context-dependent attackers to execute arbitrary code via a
	 TIFF image with large (1) width and (2) height values, which
	 triggers a heap-based buffer overflow in the (a) cvt_whole_image
	 function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2347</cvename>
 <url>http://www.remotesensing.org/libtiff/v3.9.4.html</url>
 <url>http://www.ocert.org/advisories/ocert-2009-012.html</url>
 </references>
 <dates>
 <discovery>2009-05-22</discovery>
 <entry>2010-06-16</entry>
 </dates>
 </vuln>

<vuln vid="144e524a-77eb-11df-ae06-001b2134ef46">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><lt>9.0r277</lt></range>
 </package>
 <package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.1r53</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-14.html">
	 Critical vulnerabilities have been identified in Adobe
	 Flash Player version 10.0.45.2 and earlier. These
	 vulnerabilities could cause the application to crash and
	 could potentially allow an attacker to take control of the
	 affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4546</cvename>
 <cvename>CVE-2009-3793</cvename>
 <cvename>CVE-2010-1297</cvename>
 <cvename>CVE-2010-2160</cvename>
 <cvename>CVE-2010-2161</cvename>
 <cvename>CVE-2010-2162</cvename>
 <cvename>CVE-2010-2163</cvename>
 <cvename>CVE-2010-2164</cvename>
 <cvename>CVE-2010-2165</cvename>
 <cvename>CVE-2010-2166</cvename>
 <cvename>CVE-2010-2167</cvename>
 <cvename>CVE-2010-2169</cvename>
 <cvename>CVE-2010-2170</cvename>
 <cvename>CVE-2010-2171</cvename>
 <cvename>CVE-2010-2172</cvename>
 <cvename>CVE-2010-2173</cvename>
 <cvename>CVE-2010-2174</cvename>
 <cvename>CVE-2010-2175</cvename>
 <cvename>CVE-2010-2176</cvename>
 <cvename>CVE-2010-2177</cvename>
 <cvename>CVE-2010-2178</cvename>
 <cvename>CVE-2010-2179</cvename>
 <cvename>CVE-2010-2180</cvename>
 <cvename>CVE-2010-2181</cvename>
 <cvename>CVE-2010-2182</cvename>
 <cvename>CVE-2010-2183</cvename>
 <cvename>CVE-2010-2184</cvename>
 <cvename>CVE-2010-2185</cvename>
 <cvename>CVE-2010-2186</cvename>
 <cvename>CVE-2010-2187</cvename>
 <cvename>CVE-2010-2188</cvename>
 <cvename>CVE-2010-2189</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb10-14.html</url>
 </references>
 <dates>
 <discovery>2008-10-02</discovery>
 <entry>2010-06-14</entry>
 </dates>
 </vuln>

<vuln vid="313da7dc-763b-11df-bcce-0018f3e2eb82">
 <topic>tiff -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>tiff</name>
	<range><lt>3.9.3</lt></range>
 </package>
 <package>
	<name>linux-tiff</name>
	<range><lt>3.9.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kevin Finisterre reports:
	<blockquote cite="http://support.apple.com/kb/HT4196">
	 Multiple integer overflows in the handling of TIFF files may
	 result in a heap buffer overflow. Opening a maliciously crafted
	 TIFF file may lead to an unexpected application termination or
	 arbitrary code execution. The issues are addressed through
	 improved bounds checking. Credit to Kevin Finisterre of
	 digitalmunition.com for reporting these issues.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1411</cvename>
 <url>http://www.remotesensing.org/libtiff/v3.9.3.html</url>
 <url>http://support.apple.com/kb/HT4196</url>
 </references>
 <dates>
 <discovery>2010-04-15</discovery>
 <entry>2010-06-12</entry>
 </dates>
 </vuln>

<vuln vid="d42e5b66-6ea0-11df-9c8d-00e0815b8da8">
 <topic>sudo -- Secure path vulnerability</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><lt>1.7.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Todd Miller reports:
	<blockquote cite="http://sudo.ws/sudo/alerts/secure_path.html">
	 Most versions of the C library function getenv() return the
	 first instance of an environment variable to the caller. However,
	 some programs, notably the GNU Bourne Again SHell (bash), do
	 their own environment parsing and may choose the last instance
	 of a variable rather than the first one.
	 An attacker may manipulate the environment of the process that
	 executes Sudo such that a second PATH variable is present. When
	 Sudo runs a bash script, it is this second PATH variable that
	 is used by bash, regardless of whether or not Sudo has overwritten
	 the first instance of PATH. This may allow an attacker to
	 subvert the program being run under Sudo and execute commands
	 he/she would not otherwise be allowed to run.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1646</cvename>
 <url>http://sudo.ws/sudo/alerts/secure_path.html</url>
 </references>
 <dates>
 <discovery>2010-06-02</discovery>
 <entry>2010-06-02</entry>
 </dates>
 </vuln>

<vuln vid="b43004b8-6a53-11df-bc7b-0245fb008c0b">
 <topic>ziproxy -- atypical huge picture files vulnerability</topic>
 <affects>
 <package>
	<name>ziproxy</name>
	<range><lt>3.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ziproxy 3.0.1 release fixes a security vulnerability related
	 to atypical huge picture files (&gt;4GB of size once expanded).
 </body>
 </description>
 <references>
 <bid>40344</bid>
 <cvename>CVE-2010-1513</cvename>
 <url>http://ziproxy.sourceforge.net/#news</url>
 <url>http://secunia.com/advisories/39941</url>
 <mlist msgid="201005210019.37119.dancab@gmx.net">http://sourceforge.net/mailarchive/message.php?msg_name=201005210019.37119.dancab%40gmx.net</mlist>
 </references>
 <dates>
 <discovery>2010-05-20</discovery>
 <entry>2010-05-28</entry>
 </dates>
 </vuln>

<vuln vid="fc55e396-6deb-11df-8b8e-000c29ba66d2">
 <topic>mediawiki -- two security vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki</name>
	<range><lt>1.15.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Two security vulnerabilities were discovered:
	<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html">
	 Noncompliant CSS parsing behaviour in Internet Explorer
	 allows attackers to construct CSS strings which are treated
	 as safe by previous versions of MediaWiki, but are decoded
	 to unsafe strings by Internet Explorer.
	 A CSRF vulnerability was discovered in our login interface.
	 Although regular logins are protected as of 1.15.3, it was
	 discovered that the account creation and password reset
	 reset features were not protected from CSRF. This could lead
	 to unauthorised access to private wikis.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/39922/</url>
 <url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html</url>
 </references>
 <dates>
 <discovery>2010-05-28</discovery>
 <entry>2010-06-02</entry>
 </dates>
 </vuln>

<vuln vid="fcc39d22-5777-11df-bf33-001a92771ec2">
 <topic>redmine -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>redmine</name>
	<range><lt>0.9.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 The Redmine release announcement reports that
	 several cross side scripting vulnerabilities
	 and a potential data disclosure vulnerability have
	 been fixed in the latest release.
 </body>
 </description>
 <references>
 <url>http://www.redmine.org/news/39</url>
 </references>
 <dates>
 <discovery>2010-05-01</discovery>
 <entry>2010-05-14</entry>
 </dates>
 </vuln>

<vuln vid="28022228-5a0e-11df-942d-0015587e2cc1">
 <topic>wireshark -- DOCSIS dissector denial of service</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<range><le>1.2.6_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A vulnerability found in the DOCSIS dissector can cause
	 Wireshark to crash when a malformed packet trace file is
	 opened. This means that an attacker will have to trick a
	 victim into opening such a trace file before being able
	 to crash the application
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1455</cvename>
 <url>http://www.wireshark.org/security/wnpa-sec-2010-03.html</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2010-04.html</url>
 </references>
 <dates>
 <discovery>2010-05-05</discovery>
 <entry>2010-05-07</entry>
 </dates>
 </vuln>

<vuln vid="c0869649-5a0c-11df-942d-0015587e2cc1">
 <topic>piwik -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>piwik</name>
	<range><le>0.5.5</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Piwik security advisory reports:
	<blockquote cite="http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/">
	 A non-persistent, cross-site scripting vulnerability
	 (XSS) was found in Piwik's Login form that reflected
	 the form_url parameter without being properly escaped
	 or filtered.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1453</cvename>
 <url>http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/</url>
 </references>
 <dates>
 <discovery>2010-04-15</discovery>
 <entry>2010-05-07</entry>
 </dates>
 </vuln>

<vuln vid="7132c842-58e2-11df-8d80-0015587e2cc1">
 <topic>spamass-milter -- remote command execution vulnerability</topic>
 <affects>
 <package>
	<name>spamass-milter</name>
	<range><le>0.3.1_8</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The spamassassin milter plugin contains a vulnerability
	 that can allow remote attackers to execute commands on
	 affected systems.
	The vulnerability can be exploited trough a special-crafted
	 email header when the plugin was started with the '-x'
	 (expand) flag.
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1132</cvename>
 <url>http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html</url>
 <url>http://xforce.iss.net/xforce/xfdb/56732</url>
 </references>
 <dates>
 <discovery>2010-03-07</discovery>
 <entry>2010-05-06</entry>
 </dates>
 </vuln>

<vuln vid="694da5b4-5877-11df-8d80-0015587e2cc1">
 <topic>mediawiki -- authenticated CSRF vulnerability</topic>
 <affects>
 <package>
	<name>mediawiki</name>
	<range><lt>1.15.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A MediaWiki security announcement reports:
	<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html">
	 MediaWiki was found to be vulnerable to login CSRF.
	 An attacker who controls a user account on the target
	 wiki can force the victim to log in as the attacker,
	 via a script on an external website.
	 If the wiki is configured to allow user scripts, say
	 with "$wgAllowUserJs = true" in LocalSettings.php, then
	 the attacker can proceed to mount a phishing-style
	 attack against the victim to obtain their password.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1150</cvename>
 <url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html</url>
 <url>https://bugzilla.wikimedia.org/show_bug.cgi?id=23076</url>
 </references>
 <dates>
 <discovery>2010-04-07</discovery>
 <entry>2010-05-05</entry>
 </dates>
 </vuln>

<vuln vid="0491d15a-5875-11df-8d80-0015587e2cc1">
 <topic>lxr -- multiple XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>lxr</name>
	<range><le>0.9.6</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dan Rosenberg reports:
	<blockquote cite="http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com">
	 There are several cross-site scripting vulnerabilities
	 in LXR. These vulnerabilities could allow an attacker
	 to execute scripts in a user's browser, steal cookies
	 associated with vulnerable domains, redirect the user
	 to malicious websites, etc.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-4497</cvename>
 <freebsdpr>ports/146337</freebsdpr>
 <url>http://secunia.com/advisories/38117</url>
 <url>http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com</url>
 </references>
 <dates>
 <discovery>2010-01-05</discovery>
 <entry>2010-05-05</entry>
 </dates>
 </vuln>

<vuln vid="752ce039-5242-11df-9139-00242b513d7c">
 <topic>vlc -- unintended code execution with specially crafted data</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><lt>1.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	VideoLAN project reports:
	<blockquote cite="http://www.videolan.org/security/sa1003.html">
	 VLC media player suffers from various vulnerabilities when
	 attempting to parse malformatted or overly long byte streams.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>39629</bid>
 <url>http://www.videolan.org/security/sa1003.html</url>
 </references>
 <dates>
 <discovery>2010-04-19</discovery>
 <entry>2010-05-01</entry>
 <modified>2010-05-05</modified>
 </dates>
 </vuln>

<vuln vid="8d10038e-515c-11df-83fb-0015587e2cc1">
 <topic>joomla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla15</name>
	<range><ge>1.5.1</ge><le>1.5.15</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Joomla! reported the following vulnerabilities:
	<blockquote cite="http://developer.joomla.org/security/news/311-20100423-core-negative-values-for-limit-and-offset.html">
	 If a user entered a URL with a negative query limit
	 or offset, a PHP notice would display revealing information
	 about the system..
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/news/310-20100423-core-installer-migration-script.html">
	 The migration script in the Joomla! installer does not
	 check the file type being uploaded. If the installation
	 application is present, an attacker could use it to
	 upload malicious files to a server.
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/news/309-20100423-core-sessation-fixation.html">
	 Session id doesn't get modified when user logs in. A
	 remote site may be able to forward a visitor to the
	 Joomla! site and set a specific cookie. If the user
	 then logs in, the remote site can use that cookie to
	 authenticate as that user.
	</blockquote>
	<blockquote cite="http://developer.joomla.org/security/news/308-20100423-core-password-reset-tokens.html">
	 When a user requests a password reset, the reset tokens
	 were stored in plain text in the database. While this
	 is not a vulnerability in itself, it allows user accounts
	 to be compromised if there is an extension on the site
	 with an SQL injection vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://developer.joomla.org/security/news/308-20100423-core-password-reset-tokens.html</url>
 <url>http://developer.joomla.org/security/news/309-20100423-core-sessation-fixation.html</url>
 <url>http://developer.joomla.org/security/news/310-20100423-core-installer-migration-script.html</url>
 <url>http://developer.joomla.org/security/news/311-20100423-core-negative-values-for-limit-and-offset.html</url>
 </references>
 <dates>
 <discovery>2010-04-23</discovery>
 <entry>2010-04-26</entry>
 </dates>
 </vuln>

<vuln vid="5198ef84-4fdc-11df-83fb-0015587e2cc1">
 <topic>cacti -- SQL injection and command execution vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><le>0.8.7e4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Bonsai information security reports:
	<blockquote cite="http://www.bonsai-sec.com/en/research/vulnerability.php">
	 A Vulnerability has been discovered in Cacti, which
	 can be exploited by any user to conduct SQL Injection
	 attacks. Input passed via the "export_item_id" parameter
	 to "templates_export.php" script is not properly sanitized
	 before being used in a SQL query.
	</blockquote>
	 The same source also reported a command execution
	 vulnerability. This second issue can be exploited by
	 Cacti users who have the rights to modify device or
	 graph configurations.
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1431</cvename>
 <freebsdpr>ports/146021</freebsdpr>
 <url>http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php</url>
 <url>http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-sql-injection-0104.php</url>
 <url>http://www.debian.org/security/2010/dsa-2039</url>
 </references>
 <dates>
 <discovery>2010-04-21</discovery>
 <entry>2010-04-24</entry>
 <modified>2013-06-16</modified>
 </dates>
 </vuln>

<vuln vid="f6429c24-4fc9-11df-83fb-0015587e2cc1">
 <topic>moodle -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moodle</name>
	<range><lt>1.9.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Moodle release notes report multiple vulnerabilities
	 which could allow remote attackers to perform, amongst
	 others, cross site scripting, user enumeration and SQL
	 injection attacks.
 </body>
 </description>
 <references>
 <url>http://docs.moodle.org/en/Moodle_1.9.8_release_notes</url>
 </references>
 <dates>
 <discovery>2010-03-25</discovery>
 <entry>2010-04-24</entry>
 </dates>
 </vuln>

<vuln vid="3383e706-4fc3-11df-83fb-0015587e2cc1">
 <topic>tomcat -- information disclosure vulnerability</topic>
 <affects>
 <package>
	<name>tomcat</name>
	<range><gt>5.5.0</gt><lt>5.5.30</lt></range>
	<range><gt>6.0.0</gt><lt>6.0.27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache software foundation reports:
	<blockquote cite="http://seclists.org/bugtraq/2010/Apr/200">
	 The "WWW-Authenticate" header for BASIC and DIGEST
	 authentication includes a realm name. If a &lt;realm-name&gt;
	 element is specified for the application in web.xml it
	 will be used. However, a &lt;realm-name&gt; is not
	 specified then Tomcat will generate one.
	 In some circumstances this can expose the local
	 hostname or IP address of the machine running Tomcat.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1157</cvename>
 <freebsdpr>ports/146022</freebsdpr>
 <url>http://seclists.org/bugtraq/2010/Apr/200</url>
 </references>
 <dates>
 <discovery>2010-04-22</discovery>
 <entry>2010-04-24</entry>
 </dates>
 </vuln>

<vuln vid="86b8b655-4d1a-11df-83fb-0015587e2cc1">
 <topic>krb5 -- KDC double free vulnerability</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><ge>1.7</ge><lt>1.7.2</lt></range>
	<range><ge>1.8</ge><lt>1.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MIT Kerberos team reports:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-004.txt">
	 An authenticated remote attacker can crash the KDC by
	 inducing the KDC to perform a double free. Under some
	 circumstances on some platforms, this could also allow
	 malicious code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1320</cvename>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-004.txt</url>
 </references>
 <dates>
 <discovery>2010-04-20</discovery>
 <entry>2010-04-21</entry>
 </dates>
 </vuln>

<vuln vid="a4746a86-4c89-11df-83fb-0015587e2cc1">
 <topic>e107 -- code execution and XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>e107</name>
	<range><lt>0.7.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia Research reported two vulnerabilities in e107:
	The first problem affects installations that have the
	 Content Manager plugin enabled. This plugin does not
	 sanitize the "content_heading" parameter correctly and
	 is therefore vulnerable to a cross site scripting attack.
	The second vulnerability is related to the avatar upload
	 functionality. Images containing PHP code can be uploaded
	 and executed.
 </body>
 </description>
 <references>
 <bid>39540</bid>
 <cvename>CVE-2010-0996</cvename>
 <cvename>CVE-2010-0997</cvename>
 <freebsdpr>ports/145885</freebsdpr>
 <url>http://e107.org/comment.php?comment.news.864</url>
 <url>http://secunia.com/secunia_research/2010-43/</url>
 <url>http://secunia.com/secunia_research/2010-44/</url>
 <url>http://xforce.iss.net/xforce/xfdb/57932</url>
 </references>
 <dates>
 <discovery>2010-04-15</discovery>
 <entry>2010-04-20</entry>
 </dates>
 </vuln>

<vuln vid="09910d76-4c82-11df-83fb-0015587e2cc1">
 <topic>fetchmail -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range>
	 <ge>4.6.3</ge>
	 <le>6.3.16</le>
	</range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Fetchmail developer Matthias Andree reported a vulnerability
	 that allows remote attackers to crash the application
	 when it is runs in verbose mode.
	<blockquote cite="http://gitorious.org/fetchmail/fetchmail/commit/ec06293">
	 Fetchmail before release 6.3.17 did not properly
	 sanitize external input (mail headers and UID). When a
	 multi-character locale (such as UTF-8) was in use, this
	 could cause memory exhaustion and thus a denial of
	 service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1167</cvename>
 <freebsdpr>ports/145857</freebsdpr>
 <url>http://gitorious.org/fetchmail/fetchmail/commit/ec06293</url>
 <url>http://seclists.org/oss-sec/2010/q2/76</url>
 </references>
 <dates>
 <discovery>2010-04-18</discovery>
 <entry>2010-04-20</entry>
 </dates>
 </vuln>

<vuln vid="a2c4d3d5-4c7b-11df-83fb-0015587e2cc1">
 <topic>pidgin -- multiple remote denial of service vulnerabilities</topic>
 <affects>
 <package>
	<name>pidgin</name>
	<range><lt>2.6.6</lt></range>
 </package>
 <package>
	<name>libpurple</name>
	<range><lt>2.6.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Three denial of service vulnerabilities where found in
	 pidgin and allow remote attackers to crash the application.
	 The developers summarized these problems as follows:
	<blockquote cite="http://pidgin.im/news/security/?id=45">
	Pidgin can become unresponsive when displaying large
	 numbers of smileys
	</blockquote>
	<blockquote cite="http://pidgin.im/news/security/?id=44">
	Certain nicknames in group chat rooms can trigger a
	 crash in Finch
	</blockquote>
	<blockquote cite="http://pidgin.im/news/security/?id=43">
	 Failure to validate all fields of an incoming message
	 can trigger a crash
	</blockquote>
 </body>
 </description>
 <references>
 <bid>38294</bid>
 <cvename>CVE-2010-0277</cvename>
 <cvename>CVE-2010-0420</cvename>
 <cvename>CVE-2010-0423</cvename>
 <url>http://pidgin.im/news/security/?id=43</url>
 <url>http://pidgin.im/news/security/?id=44</url>
 <url>http://pidgin.im/news/security/?id=45</url>
 </references>
 <dates>
 <discovery>2010-02-18</discovery>
 <entry>2010-04-20</entry>
 </dates>
 </vuln>

<vuln vid="4fb5d2cd-4c77-11df-83fb-0015587e2cc1">
 <topic>png -- libpng decompression denial of service</topic>
 <affects>
 <package>
	<name>png</name>
	<range>
	 <gt>1.2.43</gt>
	 <lt>1.4.1</lt>
	</range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A vulnerability in libpng can result in denial of service
	 conditions when a remote attacker tricks a victim to open
	 a specially-crafted PNG file.
	The PNG project describes the problem in an advisory:
	<blockquote cite="http://libpng.sourceforge.net/ADVISORY-1.4.1.html">
	 Because of the efficient compression method used in
	 Portable Network Graphics (PNG) files, a small PNG file
	 can expand tremendously, acting as a "decompression
	 bomb".
	 Malformed PNG chunks can consume a large amount of CPU
	 and wall-clock time and large amounts of memory, up to
	 all memory available on a system
	</blockquote>
 </body>
 </description>
 <references>
 <bid>38478</bid>
 <certvu>576029</certvu>
 <cvename>CVE-2010-0205</cvename>
 <url>http://libpng.sourceforge.net/ADVISORY-1.4.1.html</url>
 <url>http://secunia.com/advisories/38774</url>
 <url>http://xforce.iss.net/xforce/xfdb/56661</url>
 </references>
 <dates>
 <discovery>2010-02-27</discovery>
 <entry>2010-04-20</entry>
 </dates>
 </vuln>

<vuln vid="c8c31c41-49ed-11df-83fb-0015587e2cc1">
 <topic>curl -- libcurl buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>curl</name>
	<range>
	 <ge>7.10.5</ge>
	 <lt>7.20.0</lt>
	</range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cURL project reports in a security advisory:
	<blockquote cite="http://curl.haxx.se/docs/adv_20100209.html">
	 Using the affected libcurl version to download compressed
	 content over HTTP, an application can ask libcurl to
	 automatically uncompress data. When doing so, libcurl
	 can wrongly send data up to 64K in size to the callback
	 which thus is much larger than the documented maximum
	 size.
	 An application that blindly trusts libcurl's max limit
	 for a fixed buffer size or similar is then a possible
	 target for a buffer overflow vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-0734</cvename>
 <url>http://curl.haxx.se/docs/adv_20100209.html</url>
 <url>http://www.debian.org/security/2010/dsa-2023</url>
 <url>http://www.openwall.com/lists/oss-security/2010/02/09/5</url>
 </references>
 <dates>
 <discovery>2010-02-09</discovery>
 <entry>2010-04-19</entry>
 </dates>
 </vuln>

<vuln vid="a04a3c13-4932-11df-83fb-0015587e2cc1">
 <topic>ejabberd -- queue overload denial of service vulnerability</topic>
 <affects>
 <package>
	<name>ejabberd</name>
	<range><lt>2.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Red Hat security response team reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2010/01/29/1">
	 A remotely exploitable DoS from XMPP client to ejabberd
	 server via too many "client2server" messages (causing the
	 message queue on the server to get overloaded, leading
	 to server crash) has been found.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>38003</bid>
 <cvename>CVE-2010-0305</cvename>
 <url>http://secunia.com/advisories/38337</url>
 <url>http://support.process-one.net/browse/EJAB-1173</url>
 <url>http://www.openwall.com/lists/oss-security/2010/01/29/1</url>
 <url>http://xforce.iss.net/xforce/xfdb/56025</url>
 </references>
 <dates>
 <discovery>2010-01-29</discovery>
 <entry>2010-04-19</entry>
 </dates>
 </vuln>

<vuln vid="3b7967f1-49e8-11df-83fb-0015587e2cc1">
 <topic>irssi -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>irssi</name>
	<range><lt>0.8.15</lt></range>
 </package>
 <package>
	<name>zh-irssi</name>
	<range><lt>0.8.15</lt></range>
 </package>
 <package>
	<name>irssi-devel</name>
	<range><lt>20100325</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Two vulnerabilities have found in irssi. The first issue
	 could allow man-in-the-middle attacks due to a missing
	 comparison of SSL server hostnames and the certificate
	 domain names (e.g. CN).
	A second vulnerability, related to the nick matching code,
	 could be triggered by remote attackers in order to crash
	 an irssi client when leaving a channel.
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1155</cvename>
 <cvename>CVE-2010-1156</cvename>
 <url>http://xforce.iss.net/xforce/xfdb/57790</url>
 <url>http://xforce.iss.net/xforce/xfdb/57791</url>
 </references>
 <dates>
 <discovery>2010-04-16</discovery>
 <entry>2010-04-19</entry>
 </dates>
 </vuln>

<vuln vid="a30573dc-4893-11df-a5f9-001641aeabdf">
 <topic>krb5 -- remote denial of service vulnerability</topic>
 <affects>
	<package>
	 <name>krb5</name>
	 <range><le>1.6.3_9</le></range>
	</package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An authenticated remote attacker can causing a denial
	 of service by using a newer version of the kadmin protocol
	 than the server supports.
	The MIT Kerberos team also reports the cause:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-003.txt">
	 The Kerberos administration daemon (kadmind) can crash
	 due to referencing freed memory.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>39247</bid>
 <cvename>CVE-2010-0629</cvename>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-003.txt</url>
 </references>
 <dates>
 <discovery>2010-04-06</discovery>
 <entry>2010-04-18</entry>
 </dates>
 </vuln>

<vuln vid="9ac0f9c4-492b-11df-83fb-0015587e2cc1">
 <topic>krb5 -- multiple denial of service vulnerabilities</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range>
	 <ge>1.7</ge><le>1.7_2</le>
	</range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Two vulnerabilities in krb5 can be used by remote
	 attackers in denial of service attacks. The MIT security
	 advisories report this as follows:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-001.txt">
	 An unauthenticated remote attacker can send an invalid
	 request to a KDC process that will cause it to crash
	 due to an assertion failure, creating a denial of
	 service.
	</blockquote>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt">
	 An unauthenticated remote attacker could cause a GSS-API
	 application, including the Kerberos administration
	 daemon (kadmind) to crash.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>38260</bid>
 <bid>38904</bid>
 <cvename>CVE-2010-0283</cvename>
 <cvename>CVE-2010-0628</cvename>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-001.txt</url>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt</url>
 </references>
 <dates>
 <discovery>2010-02-16</discovery>
 <entry>2010-04-19</entry>
 <modified>2013-06-16</modified>
 </dates>
 </vuln>

<vuln vid="5053420c-4935-11df-83fb-0015587e2cc1">
 <topic>mahara -- sql injection vulnerability</topic>
 <affects>
 <package>
	<name>mahara</name>
	<range><lt>1.1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Debian security team reports:
	<blockquote cite="http://www.debian.org/security/2010/dsa-2030">
	It was discovered that mahara, an electronic portfolio,
	 weblog, and resume builder is not properly escaping input
	 when generating a unique username based on a remote user
	 name from a single sign-on application. An attacker can
	 use this to compromise the mahara database via crafted
	 user names.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>39253</bid>
 <cvename>CVE-2010-0400</cvename>
 <url>http://www.debian.org/security/2010/dsa-2030</url>
 </references>
 <dates>
 <discovery>2010-04-06</discovery>
 <entry>2010-04-18</entry>
 </dates>
 </vuln>

<vuln vid="1a9f678d-48ca-11df-85f8-000c29a67389">
 <topic>sudo -- Privilege escalation with sudoedit</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><lt>1.7.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Todd Miller reports:
	<blockquote cite="">
	 Sudo's command matching routine expects actual commands to include
	 one or more slash ('/') characters. The flaw is that sudo's path
	 resolution code did not add a "./" prefix to commands found in the
	 current working directory. This creates an ambiguity between a
	 "sudoedit" command found in the cwd and the "sudoedit"
	 pseudo-command in the sudoers file. As a result, a user may be
	 able to run an arbitrary command named "sudoedit" in the current
	 working directory. For the attack to be successful, the PATH
	 environment variable must include "." and may not include any other
	 directory that contains a "sudoedit" command.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1163</cvename>
 <url>http://www.sudo.ws/pipermail/sudo-announce/2010-April/000093.html</url>
 <url>http://www.sudo.ws/sudo/alerts/sudoedit_escalate2.html</url>
 </references>
 <dates>
 <discovery>2010-04-09</discovery>
 <entry>2010-04-15</entry>
 </dates>
 </vuln>

<vuln vid="3987c5d1-47a9-11df-a0d5-0016d32f24fb">
 <topic>KDM -- local privilege escalation vulnerability</topic>
 <affects>
 <package>
	<name>kdebase</name>
	<range><le>3.5.10_6</le></range>
 </package>
 <package>
	<name>kdebase-workspace</name>
	<range><le>4.3.5_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	KDE Security Advisory reports:
	<blockquote cite="http://www.kde.org/info/security/advisory-20100413-1.txt">
	 KDM contains a race condition that allows local attackers
	 to make arbitrary files on the system world-writeable.
	 This can happen while KDM tries to create its control
	 socket during user login. A local attacker with a valid
	 local account can under certain circumstances make use of
	 this vulnerability to execute arbitrary code as root.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-0436</cvename>
 <url>http://www.kde.org/info/security/advisory-20100413-1.txt</url>
 </references>
 <dates>
 <discovery>2010-04-13</discovery>
 <entry>2010-04-14</entry>
 <modified>2010-04-14</modified>
 </dates>
 </vuln>

<vuln vid="805603a1-3e7a-11df-a5a1-0050568452ac">
 <topic>dojo -- cross-site scripting and other vulnerabilities</topic>
 <affects>
 <package>
	<name>dojo</name>
	<range><lt>1.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Dojo Toolkit team reports:
	<blockquote cite="http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/">
	 Some PHP files did not properly escape input.
	 Some files could operate like "open redirects". A bad actor
	 could form an URL that looks like it came from a trusted
	 site, but the user would be redirected or load content from
	 the bad actor's site.
	 A file exposed a more serious cross-site scripting
	 vulnerability with the possibility of executing code on the
	 domain where the file exists.
	 The Dojo build process defaulted to copying over tests and
	 demos, which are normally not needed and just increased the
	 number of files that could be targets of attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/</url>
 <url>http://osdir.com/ml/bugtraq.security/2010-03/msg00133.html</url>
 <url>http://packetstormsecurity.org/1003-exploits/dojo-xss.txt</url>
 <url>http://secunia.com/advisories/38964</url>
 <url>http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/</url>
 </references>
 <dates>
 <discovery>2010-03-11</discovery>
 <entry>2010-04-06</entry>
 </dates>
 </vuln>

<vuln vid="8ad1c404-3e78-11df-a5a1-0050568452ac">
 <topic>Zend Framework -- security issues in bundled Dojo library</topic>
 <affects>
 <package>
	<name>ZendFramework</name>
	<range><lt>1.10.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Zend Framework team reports:
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-07">
	 Several files in the bundled Dojo library were identified
	 as having potential exploits, and the Dojo team also advised
	 disabling or removing any PHP scripts in the Dojo library tree
	 when deploying to production.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/</url>
 <url>http://framework.zend.com/security/advisory/ZF2010-07</url>
 <url>http://osdir.com/ml/bugtraq.security/2010-03/msg00133.html</url>
 <url>http://packetstormsecurity.org/1003-exploits/dojo-xss.txt</url>
 <url>http://secunia.com/advisories/38964</url>
 <url>http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/</url>
 </references>
 <dates>
 <discovery>2010-04-01</discovery>
 <entry>2010-04-06</entry>
 </dates>
 </vuln>

<vuln vid="ec8f449f-40ed-11df-9edc-000f20797ede">
 <topic>firefox -- Re-use of freed object due to scope confusion</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.6,1</gt><lt>3.6.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2009-25 Re-use of freed object due to scope confusion
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1121</cvename>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-25.html</url>
 </references>
 <dates>
 <discovery>2010-04-01</discovery>
 <entry>2010-04-05</entry>
 </dates>
 </vuln>

<vuln vid="9ccfee39-3c3b-11df-9edc-000f20797ede">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>seamonkey</name>
	<range><gt>2.0</gt><lt>2.0.4</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.4</lt></range>
 </package>
 <package>
	<name>firefox</name>
	<range><gt>3.5.*,1</gt><lt>3.5.9,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.19,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.0.19,1</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.9</lt></range>
 </package>
 <package>
	<name>nss</name>
	<name>linux-f10-nss</name>
	<range><lt>3.12.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2010-24 XMLDocument::load() doesn't check nsIContentPolicy
	 MFSA 2010-23 Image src redirect to mailto: URL opens email editor
	 MFSA 2010-22 Update NSS to support TLS renegotiation indication
	 MFSA 2010-21 Arbitrary code execution with Firebug XMLHttpRequestSpy
	 MFSA 2010-20 Chrome privilege escalation via forced URL drag and drop
	 MFSA 2010-19 Dangling pointer vulnerability in nsPluginArray
	 MFSA 2010-18 Dangling pointer vulnerability in nsTreeContentView
	 MFSA 2010-17 Remote code execution with use-after-free in nsTreeSelection
	 MFSA 2010-16 Crashes with evidence of memory corruption (rv:1.9.2.2/ 1.9.1.9/ 1.9.0.19)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-0181</cvename>
 <cvename>CVE-2009-3555</cvename>
 <cvename>CVE-2010-0179</cvename>
 <cvename>CVE-2010-0178</cvename>
 <cvename>CVE-2010-0177</cvename>
 <cvename>CVE-2010-0176</cvename>
 <cvename>CVE-2010-0175</cvename>
 <cvename>CVE-2010-0174</cvename>
 <cvename>CVE-2010-0173</cvename>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-24.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-23.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-22.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-21.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-20.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-19.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-18.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-17.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-16.html</url>
 </references>
 <dates>
 <discovery>2010-03-30</discovery>
 <entry>2010-03-30</entry>
 </dates>
 </vuln>

<vuln vid="e050119b-3856-11df-b2b2-002170daae37">
 <topic>postgresql -- bitsubstr overflow</topic>
 <affects>
 <package>
	<name>postgresql-server</name>
	<range><ge>7.4</ge><lt>7.4.28</lt></range>
	<range><ge>8.0</ge><lt>8.0.24</lt></range>
	<range><ge>8.1</ge><lt>8.1.20</lt></range>
	<range><ge>8.2</ge><lt>8.2.16</lt></range>
	<range><ge>8.3</ge><lt>8.3.10</lt></range>
	<range><ge>8.4</ge><lt>8.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	BugTraq reports:
	<blockquote cite="http://www.securityfocus.com/bid/37973">
	 PostgreSQL is prone to a buffer-overflow
	 vulnerability because the application fails to
	 perform adequate boundary checks on user-supplied
	 data.
	 Attackers can exploit this issue to execute
	 arbitrary code with elevated privileges or
	 crash the affected application.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>37973</bid>
 <cvename>CVE-2010-0442</cvename>
 </references>
 <dates>
 <discovery>2010-01-27</discovery>
 <entry>2010-03-25</entry>
 </dates>
 </vuln>

<vuln vid="c175d72f-3773-11df-8bb8-0211d880e350">
 <topic>gtar -- buffer overflow in rmt client</topic>
 <affects>
 <package>
	<name>gtar</name>
	<range><lt>1.22_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jakob Lell reports:
	<blockquote cite="http://www.agrs.tu-berlin.de/index.php?id=78327">
	 The rmt client implementation of GNU Tar/Cpio contains
	 a heap-based buffer overflow which possibly allows
	 arbitrary code execution.
	 The problem can be exploited when using an
	 untrusted/compromised rmt server.
	</blockquote>
 </body>
 </description> <references>
 <cvename>CVE-2010-0624</cvename>
 <url>http://www.agrs.tu-berlin.de/index.php?id=78327</url>
 </references> <dates>
 <discovery>2010-03-24</discovery> <entry>2010-03-24</entry>
 </dates>
 </vuln>

<vuln vid="5d5ed535-3653-11df-9edc-000f20797ede">
 <topic>firefox -- WOFF heap corruption due to integer overflow</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.6,1</gt><lt>3.6.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2010-08 WOFF heap corruption due to integer overflow
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-1028</cvename>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-08.html</url>
 </references>
 <dates>
 <discovery>2010-03-22</discovery>
 <entry>2010-03-23</entry>
 </dates>
 </vuln>

<vuln vid="56cfe192-329f-11df-abb2-000f20797ede">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.19</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2010-07 Fixes for potentially exploitable crashes ported to the legacy branch
	 MFSA 2010-06 Scriptable plugin execution in SeaMonkey mail
	 MFSA 2009-68 NTLM reflection vulnerability
	 MFSA 2009-62 Download filename spoofing with RTL override
	 MFSA 2009-59 Heap buffer overflow in string to number conversion
	 MFSA 2009-49 TreeColumns dangling pointer vulnerability
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-0161</cvename>
 <cvename>CVE-2010-0163</cvename>
 <cvename>CVE-2009-3075</cvename>
 <cvename>CVE-2009-3072</cvename>
 <cvename>CVE-2009-2463</cvename>
 <cvename>CVE-2009-3385</cvename>
 <cvename>CVE-2009-3983</cvename>
 <cvename>CVE-2009-3376</cvename>
 <cvename>CVE-2009-0689</cvename>
 <cvename>CVE-2009-3077</cvename>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-07.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-06.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-68.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-62.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-59.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-49.html</url>
 </references>
 <dates>
 <discovery>2010-03-16</discovery>
 <entry>2010-03-19</entry>
 </dates>
 </vuln>

<vuln vid="e39caf05-2d6f-11df-aec2-000c29ba66d2">
 <topic>egroupware -- two vulnerabilities</topic>
 <affects>
 <package>
	<name>egroupware</name>
	<range><lt>1.6.003</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Egroupware Team report:
	<blockquote cite="http://www.egroupware.org/Home?category_id=95&amp;item=93">
	 Nahuel Grisolia from CYBSEC S.A. Security Systems found two security
	 problems in EGroupware:
	 Serious remote command execution (allowing to run arbitrary command
	 on the web server by simply issuing a HTTP request!).
	 A reflected cross-site scripting (XSS).
	 Both require NO valid EGroupware account and work without being logged
	 in!
	</blockquote>
 </body>
 </description>
 <references>
 <bid>38609</bid>
 <url>http://secunia.com/advisories/38859/</url>
 <url>http://www.egroupware.org/Home?category_id=95&amp;item=93</url>
 </references>
 <dates>
 <discovery>2010-03-09</discovery>
 <entry>2010-03-11</entry>
 </dates>
 </vuln>

<vuln vid="b3531fe1-2b03-11df-b6db-00248c9b4be7">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.22</lt></range>
 </package>
 <package>
	<name>drupal6</name>
	<range><lt>6.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Team reports:
	<blockquote cite="http://drupal.org/node/731710">
	 A user-supplied value is directly output during installation
	 allowing a malicious user to craft a URL and perform a cross-site
	 scripting attack. The exploit can only be conducted on sites not yet
	 installed.
	 The API function drupal_goto() is susceptible to a phishing attack.
	 An attacker could formulate a redirect in a way that gets the Drupal
	 site to send the user to an arbitrarily provided URL. No user
	 submitted data will be sent to that URL.
	 Locale module and dependent contributed modules do not sanitize the
	 display of language codes, native and English language names properly.
	 While these usually come from a preselected list, arbitrary
	 administrator input is allowed. This vulnerability is mitigated by the
	 fact that the attacker must have a role with the 'administer
	 languages' permission.
	 Under certain circumstances, a user with an open session that is
	 blocked can maintain his/her session on the Drupal site, despite being
	 blocked.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://drupal.org/node/731710</url>
 </references>
 <dates>
 <discovery>2010-03-03</discovery>
 <entry>2010-03-08</entry>
 </dates>
 </vuln>

<vuln vid="018a84d0-2548-11df-b4a3-00e0815b8da8">
 <topic>sudo -- Privilege escalation with sudoedit</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><lt>1.7.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Todd Miller reports:
	<blockquote cite="">
	 When sudo performs its command matching, there is a special case
	 for pseudo-commands in the sudoers file (currently, the only
	 pseudo-command is sudoedit). Unlike a regular command,
	 pseudo-commands do not begin with a slash ('/'). The flaw is that
	 sudo's the matching code would only check against the list of
	 pseudo-commands if the user-specified command also contained no
	 slashes. As a result, if the user ran "sudo ./sudoedit" the normal
	 matching code path was followed, which uses stat(2) to verify that
	 the user-specified command matches the one in sudoers. In this
	 case, it would compare the "./sudoedit" specified by the user with
	 "sudoedit" from the sudoers file, resulting in a positive
	 match.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.sudo.ws/pipermail/sudo-announce/2010-February/000092.html</url>
 <url>http://www.sudo.ws/sudo/alerts/sudoedit_escalate.html</url>
 <url>http://secunia.com/advisories/38659</url>
 <cvename>CVE-2010-0426</cvename>
 <bid>38362</bid>
 </references>
 <dates>
 <discovery>2010-01-29</discovery>
 <entry>2010-03-01</entry>
 </dates>
 </vuln>

<vuln vid="c97d7a37-2233-11df-96dd-001b2134ef46">
 <topic>openoffice.org -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openoffice.org</name>
	<range><lt>3.2.0</lt></range>
	<range><ge>3.2.20010101</ge><lt>3.2.20100203</lt></range>
	<range><ge>3.3.20010101</ge><lt>3.3.20100207</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenOffice.org Security Team reports:
	<blockquote cite="http://www.openoffice.org/security/bulletin.html">
	 Fixed in OpenOffice.org 3.2
	 CVE-2006-4339: Potential vulnerability from 3rd party
	 libxml2 libraries
	 CVE-2009-0217: Potential vulnerability from 3rd party
	 libxmlsec libraries
	 CVE-2009-2493: OpenOffice.org 3 for Windows bundles a vulnerable
	 version of MSVC Runtime
	 CVE-2009-2949: Potential vulnerability related to XPM file
	 processing
	 CVE-2009-2950: Potential vulnerability related to GIF file
	 processing
	 CVE-2009-3301/2: Potential vulnerability related to MS-Word
	 document processing
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.openoffice.org/security/bulletin.html</url>
 <url>http://www.openoffice.org/security/cves/CVE-2006-4339.html</url>
 <url>http://www.openoffice.org/security/cves/CVE-2009-0217.html</url>
 <url>http://www.openoffice.org/security/cves/CVE-2009-2493.html</url>
 <url>http://www.openoffice.org/security/cves/CVE-2009-2949.html</url>
 <url>http://www.openoffice.org/security/cves/CVE-2009-2950.html</url>
 <url>http://www.openoffice.org/security/cves/CVE-2009-3301-3302.html</url>
 <cvename>CVE-2006-4339</cvename>
 <cvename>CVE-2009-0217</cvename>
 <cvename>CVE-2009-2493</cvename>
 <cvename>CVE-2009-2949</cvename>
 <cvename>CVE-2009-2950</cvename>
 <cvename>CVE-2009-3301</cvename>
 <cvename>CVE-2009-3302</cvename>
 </references>
 <dates>
 <discovery>2006-08-24</discovery>
 <entry>2010-02-25</entry>
 <modified>2010-02-27</modified>
 </dates>
 </vuln>

<vuln vid="f82c85d8-1c6e-11df-abb2-000f20797ede">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.5.*,1</gt><lt>3.5.8,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.18,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.0.18,1</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.8</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<range><gt>2.0.*</gt><lt>2.0.3</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2010-05 XSS hazard using SVG document and binary Content-Type
	 MFSA 2010-04 XSS due to window.dialogArguments being readable cross-domain
	 MFSA 2010-03 Use-after-free crash in HTML parser
	 MFSA 2010-02 Web Worker Array Handling Heap Corruption Vulnerability
	 MFSA 2010-01 Crashes with evidence of memory corruption (rv:1.9.1.8/ 1.9.0.18)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-0159</cvename>
 <cvename>CVE-2010-0160</cvename>
 <cvename>CVE-2009-1571</cvename>
 <cvename>CVE-2009-3988</cvename>
 <cvename>CVE-2010-0162</cvename>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-01.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-02.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-03.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-04.html</url>
 <url>http://www.mozilla.org/security/announce/2010/mfsa2010-05.html</url>
 </references>
 <dates>
 <discovery>2010-02-17</discovery>
 <entry>2010-02-18</entry>
 <modified>2010-02-28</modified>
 </dates>
 </vuln>

<vuln vid="1a3bd81f-1b25-11df-bd1a-002170daae37">
 <topic>lighttpd -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>lighttpd</name>
	<range><lt>1.4.26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Lighttpd security advisory reports:
	<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt">
	 If you send the request data very slow (e.g. sleep
	 0.01 after each byte), lighttpd will easily use all
	 available memory and die (especially for parallel
	 requests), allowing a DoS within minutes.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>38036</bid>
 <cvename>CVE-2010-0295</cvename>
 <url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt</url>
 </references>
 <dates>
 <discovery>2010-02-02</discovery>
 <entry>2010-02-16</entry>
 </dates>
 </vuln>

<vuln vid="81d9dc0c-1988-11df-8e66-0019996bc1f7">
 <topic>squid -- Denial of Service vulnerability in HTCP</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><ge>2.7.1</ge><lt>2.7.7_4</lt></range>
	<range><ge>3.0.1</ge><lt>3.0.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid security advisory 2010:2 reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2010_2.txt">
	 Due to incorrect processing Squid is vulnerable to a
	 denial of service attack when receiving specially crafted
	 HTCP packets.
	 This problem allows any machine to perform a denial
	 of service attack on the Squid service when its HTCP port
	 is open.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-0639</cvename>
 <url>http://www.squid-cache.org/Advisories/SQUID-2010_2.txt</url>
 </references>
 <dates>
 <discovery>2010-02-12</discovery>
 <entry>2010-02-14</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="ff6519ad-18e5-11df-9bdd-001b2134ef46">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><lt>9.0r262</lt></range>
 </package>
 <package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.0r45</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-06.html">
	 A critical vulnerability has been identified in Adobe
	 Flash Player version 10.0.42.34 and earlier. This
	 vulnerability (CVE-2010-0186) could subvert the domain sandbox
	 and make unauthorized cross-domain requests. This update also
	 resolves a potential Denial of Service issue (CVE-2010-0187).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-0186</cvename>
 <cvename>CVE-2010-0187</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb10-06.html</url>
 </references>
 <dates>
 <discovery>2010-02-11</discovery>
 <entry>2010-02-13</entry>
 </dates>
 </vuln>

<vuln vid="0a82ac0c-1886-11df-b0d1-0015f2db7bde">
 <topic>gnome-screensaver -- Multiple monitor hotplug issues</topic>
 <affects>
 <package>
	<name>gnome-screensaver</name>
	<range><lt>2.28.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ray Strode reports:
	<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=609337">
	 Under certain circumstances it is possible to circumvent the security of screen
	 locking functionality of gnome-screensaver by changing the systems physical
	 monitor configuration.
	</blockquote>
	<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=609789">
	 gnome-screensaver can lose its keyboard grab when locked, exposing the system
	 to intrusion by adding and removing monitors.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-0414</cvename>
 <cvename>CVE-2010-0422</cvename>
 <url>https://bugzilla.gnome.org/show_bug.cgi?id=609337</url>
 <url>https://bugzilla.gnome.org/show_bug.cgi?id=609789</url>
 </references>
 <dates>
 <discovery>2010-02-08</discovery>
 <entry>2010-02-13</entry>
 </dates>
 </vuln>

<vuln vid="2a6a966f-1774-11df-b5c1-0026189baca3">
 <topic>fetchmail -- heap overflow on verbose X.509 display</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><ge>6.3.11</ge><lt>6.3.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2010-01.txt">
	 In verbose mode, fetchmail prints X.509 certificate subject and
	 issuer information to the user, and counts and allocates a malloc()
	 buffer for that purpose.
	 If the material to be displayed contains characters with high bit
	 set and the platform treats the "char" type as signed, this can cause
	 a heap buffer overrun because non-printing characters are escaped as
	 \xFF..FFnn, where nn is 80..FF in hex.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>38088</bid>
 <cvename>CVE-2010-0562</cvename>
 <url>http://www.fetchmail.info/fetchmail-SA-2010-01.txt</url>
 <mlist msgid="20100205014643.GA25506@merlin.emma.line.org">https://lists.berlios.de/pipermail/fetchmail-announce/2010-February/000073.html</mlist>
 </references>
 <dates>
 <discovery>2010-02-04</discovery>
 <entry>2010-02-12</entry>
 </dates>
 </vuln>

<vuln vid="bb0a8795-15dc-11df-bf0a-002170daae37">
 <topic>wireshark -- LWRES vulnerability</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<range><lt>1.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wireshark project reports:
	<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2010-02.html">
	 Babi discovered several buffer overflows in the
	 LWRES dissector.
	 It may be possible to make Wireshark crash remotely
	 or by convincing someone to read a malformed packet
	 trace file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-0304</cvename>
 <url>http://secunia.com/advisories/38257/</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2010-02.html</url>
 </references>
 <dates>
 <discovery>2010-01-27</discovery>
 <entry>2010-02-10</entry>
 </dates>
 </vuln>

<vuln vid="6b575419-14cf-11df-a628-001517351c22">
 <topic>otrs -- SQL injection</topic>
 <affects>
 <package>
	<name>otrs</name>
	<range><lt>2.4.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OTRS Security Advisory reports:
	<blockquote cite="http://otrs.org/advisory/OSA-2010-01-en/">
	 Missing security quoting for SQL statements allows agents and
	 customers to manipulate SQL queries. So it's possible for
	 authenticated users to inject SQL queries
	 via string manipulation of statements.
	 A malicious user may be able to manipulate SQL queries to read
	 or modify records in the database. This way it could also be
	 possible to get access to more permissions (e. g. administrator
	 permissions).
	 To use this vulnerability the malicious user needs to have
	 a valid Agent- or Customer-session.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-0438</cvename>
 <url>http://otrs.org/advisory/OSA-2010-01-en/</url>
 </references>
 <dates>
 <discovery>2010-02-08</discovery>
 <entry>2010-02-08</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="cae01d7b-110d-11df-955a-00219b0fc4d8">
 <topic>apache -- Prevent chunk-size integer overflow on platforms where sizeof(int) &lt; sizeof(long)</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><lt>1.3.42</lt></range>
 </package>
 <package>
	<name>apache+mod_perl</name>
	<range><lt>1.3.42</lt></range>
 </package>
 <package>
	<name>apache+ipv6</name>
	<range><lt>1.3.42</lt></range>
 </package>
 <package>
	<name>apache_fp</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>ru-apache</name>
	<range><lt>1.3.42+30.23</lt></range>
 </package>
 <package>
	<name>ru-apache+mod_ssl</name>
	<range><lt>1.3.42</lt></range>
 </package>
 <package>
	<name>apache+ssl</name>
	<range><lt>1.3.42.1.57_2</lt></range>
 </package>
 <package>
	<name>apache+mod_ssl</name>
	<name>apache+mod_ssl+ipv6</name>
	<name>apache+mod_ssl+mod_accel</name>
	<name>apache+mod_ssl+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_deflate</name>
	<name>apache+mod_ssl+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
	<range><lt>1.3.41+2.8.27_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache ChangeLog reports:
	<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_1.3.42">
	 Integer overflow in the ap_proxy_send_fb function in
	 proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before
	 1.3.42 on 64-bit platforms allows remote origin servers to cause a
	 denial of service (daemon crash) or possibly execute arbitrary code
	 via a large chunk size that triggers a heap-based buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0010</url>
 <url>http://www.security-database.com/detail.php?alert=CVE-2010-0010</url>
 <url>http://security-tracker.debian.org/tracker/CVE-2010-0010</url>
 <url>http://www.vupen.com/english/Reference-CVE-2010-0010.php</url>
 </references>
 <dates>
 <discovery>2009-06-30</discovery>
 <entry>2010-02-03</entry>
 <modified>2010-02-03</modified>
 </dates>
 </vuln>

<vuln vid="296ecb59-0f6b-11df-8bab-0019996bc1f7">
 <topic>squid -- Denial of Service vulnerability in DNS handling</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><ge>2.7.1</ge><lt>2.7.7_3</lt></range>
	<range><ge>3.0.1</ge><lt>3.0.23</lt></range>
	<range><ge>3.1.0.1</ge><lt>3.1.0.15_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid security advisory 2010:1 reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2010_1.txt">
	 Due to incorrect data validation Squid is vulnerable to a denial
	 of service attack when processing specially crafted DNS packets.
	 This problem allows any trusted client or external server who can
	 determine the squid receiving port to perform a short-term denial
	 of service attack on the Squid service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-0308</cvename>
 <url>http://www.squid-cache.org/Advisories/SQUID-2010_1.txt</url>
 </references>
 <dates>
 <discovery>2010-01-14</discovery>
 <entry>2010-02-01</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="696053c6-0f50-11df-a628-001517351c22">
 <topic>bugzilla -- information leak</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><gt>3.3.1</gt><lt>3.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla Security Advisory reports:
	<blockquote cite="http://www.bugzilla.org/security/3.0.10/">
	 When moving a bug from one product to another, an intermediate
	 page is displayed letting you select the groups the bug should
	 be restricted to in the new product. However, a regression in
	 the 3.4.x series made it ignore all groups which are not
	 available in both products. As a workaround, you had to move
	 the bug to the new product first and then restrict it to the
	 desired groups, in two distinct steps, which could make the bug
	 temporarily public.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3387</cvename>
 <url>http://www.bugzilla.org/security/3.0.10/</url>
 </references>
 <dates>
 <discovery>2010-01-31</discovery>
 <entry>2010-02-01</entry>
 </dates>
 </vuln>

<vuln vid="192609c8-0c51-11df-82a0-00248c9b4be7">
 <topic>irc-ratbox -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ircd-ratbox</name>
	<range><lt>2.2.9</lt></range>
 </package>
 <package>
	<name>ircd-ratbox-devel</name>
	<range><lt>3.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/archive/1/509201">
	 The first affects the /quote HELP module and allows a user
	 to trigger an IRCD crash on some platforms.
	 The second affects the /links processing module when the
	 flatten_links configuration option is not enabled.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-4016</cvename>
 <cvename>CVE-2010-0300</cvename>
 <url>http://www.debian.org/security/2010/dsa-1980</url>
 <url>http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000890.html</url>
 <url>http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000891.html</url>
 </references>
 <dates>
 <discovery>2010-01-25</discovery>
 <entry>2010-01-28</entry>
 </dates>
 </vuln>

<vuln vid="848539dc-0458-11df-8dd7-002170daae37">
 <topic>dokuwiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dokuwiki</name>
	<range><lt>20091225_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dokuwiki reports:
	<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&amp;task_id=1853">
	 The plugin does no checks against cross-site request
	 forgeries (CSRF) which can be exploited to e.g. change
	 the access control rules by tricking a logged in
	 administrator into visiting a malicious web site.
	</blockquote>
	<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&amp;task_id=1847">
	 The bug allows listing the names of arbitrary file on
	 the webserver - not their contents. This could leak
	 private information about wiki pages and server structure.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2010-0288</cvename>
 <cvename>CVE-2010-0287</cvename>
 <cvename>CVE-2010-0289</cvename>
 <url>http://bugs.splitbrain.org/index.php?do=details&amp;task_id=1847</url>
 <url>http://bugs.splitbrain.org/index.php?do=details&amp;task_id=1853</url>
 </references>
 <dates>
 <discovery>2010-01-17</discovery>
 <entry>2010-01-18</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="c9263916-006f-11df-94cb-0050568452ac">
 <topic>Zend Framework -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ZendFramework</name>
	<range><lt>1.9.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Zend Framework team reports:
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-06">
	 Potential XSS or HTML Injection vector in Zend_Json.
	</blockquote>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-05">
	 Potential XSS vector in Zend_Service_ReCaptcha_MailHide.
	</blockquote>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-04">
	 Potential MIME-type Injection in Zend_File_Transfer
	 Executive Summary.
	</blockquote>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-03">
	 Potential XSS vector in Zend_Filter_StripTags when
	 comments allowed.
	</blockquote>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-02">
	 Potential XSS vector in Zend_Dojo_View_Helper_Editor.
	</blockquote>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-01">
	 Potential XSS vectors due to inconsistent encodings.
	</blockquote>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2009-02">
	 XSS vector in Zend_Filter_StripTags.
	</blockquote>
	<blockquote cite="http://framework.zend.com/security/advisory/ZF2009-01">
	 LFI vector in Zend_View::setScriptPath() and render().
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://framework.zend.com/security/advisory/ZF2010-06</url>
 <url>http://framework.zend.com/security/advisory/ZF2010-05</url>
 <url>http://framework.zend.com/security/advisory/ZF2010-04</url>
 <url>http://framework.zend.com/security/advisory/ZF2010-03</url>
 <url>http://framework.zend.com/security/advisory/ZF2010-02</url>
 <url>http://framework.zend.com/security/advisory/ZF2010-01</url>
 <url>http://framework.zend.com/security/advisory/ZF2009-02</url>
 <url>http://framework.zend.com/security/advisory/ZF2009-01</url>
 </references>
 <dates>
 <discovery>2009-12-31</discovery>
 <entry>2010-01-11</entry>
 </dates>
 </vuln>

<vuln vid="dd8f2394-fd08-11de-b425-00215c6a37bb">
 <topic>powerdns-recursor -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><lt>3.1.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS Security Advisory reports:
	<blockquote cite="http://doc.powerdns.com/powerdns-advisory-2010-01.html">
	 PowerDNS Recursor up to and including 3.1.7.1 can be
	 brought down and probably exploited.
	</blockquote>
	<blockquote cite="http://doc.powerdns.com/powerdns-advisory-2010-02.html">
	 PowerDNS Recursor up to and including 3.1.7.1 can be
	 spoofed into accepting bogus data
	</blockquote>
 </body>
 </description>
 <references>
 <bid>37650</bid>
 <bid>37653</bid>
 <cvename>CVE-2009-4010</cvename>
 <cvename>CVE-2009-4009</cvename>
 </references>
 <dates>
 <discovery>2010-01-06</discovery>
 <entry>2010-01-09</entry>
 </dates>
 </vuln>

<vuln vid="56ba8728-f987-11de-b28d-00215c6a37bb">
 <topic>PEAR -- Net_Ping and Net_Traceroute remote arbitrary command injection</topic>
 <affects>
 <package>
	<name>pear-Net_Ping</name>
	<range><lt>2.4.5</lt></range>
 </package>
 <package>
	<name>pear-Net_Traceroute</name>
	<range><lt>0.21.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PEAR Security Advisory reports:
	<blockquote cite="http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/">
	 Multiple remote arbitrary command injections have been
	 found in the Net_Ping and Net_Traceroute.
	 When input from forms are used directly, the attacker
	 could pass variables that would allow him to execute
	 remote arbitrary command injections.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>37093</bid>
 <bid>37094</bid>
 <cvename>CVE-2009-4024</cvename>
 <cvename>CVE-2009-4025</cvename>
 <url>http://pear.php.net/advisory20091114-01.txt</url>
 </references>
 <dates>
 <discovery>2009-11-14</discovery>
 <entry>2010-01-04</entry>
 </dates>
 </vuln>

<vuln vid="751823d4-f189-11de-9344-00248c9b4be7">
 <topic>drupal -- multiple cross-site scripting</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.21</lt></range>
 </package>
 <package>
	<name>drupal6</name>
	<range><lt>6.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Team reports:
	<blockquote cite="http://drupal.org/node/661586">
	 The Contact module does not correctly handle certain user input
	 when displaying category information. Users privileged to create
	 contact categories can insert arbitrary HTML and script code into the
	 contact module administration page. Such a cross-site scripting attack
	 may lead to the malicious user gaining administrative access.
	 The Menu module does not correctly handle certain user input when
	 displaying the menu administration overview. Users privileged to
	 create new menus can insert arbitrary HTML and script code into the
	 menu module administration page. Such a cross-site scripting attack
	 may lead to the malicious user gaining administrative access.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-4370</cvename>
 <url>http://drupal.org/node/661586</url>
 </references>
 <dates>
 <discovery>2009-12-16</discovery>
 <entry>2009-12-25</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="4d6076fe-ee7a-11de-9cd0-001a926c7637">
 <topic>fuser -- missing user's privileges check</topic>
 <affects>
 <package>
	<name>fuser</name>
	<range><lt>1142334561_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Denis Barov reports:
	<blockquote>
	 sysutils/fuser allows user to send any signal to any process when
	 installed with suid bit.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/141852</freebsdpr>
 </references>
 <dates>
 <discovery>2009-09-15</discovery>
 <entry>2009-12-21</entry>
 </dates>
 </vuln>

<vuln vid="4465c897-ee5c-11de-b6ef-00215c6a37bb">
 <topic>monkey -- improper input validation vulnerability</topic>
 <affects>
 <package>
	<name>monkey</name>
	<range><lt>0.9.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Census Labs reports:
	<blockquote cite="http://census-labs.com/news/2009/12/14/monkey-httpd/">
	 We have discovered a remotely exploitable
	 "improper input validation" vulnerability in the Monkey
	 web server that allows an attacker to perform denial of
	 service attacks by repeatedly crashing worker threads
	 that process HTTP requests.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://census-labs.com/news/2009/12/14/monkey-httpd/</url>
 <url>http://groups.google.com/group/monkeyd/browse_thread/thread/055b4e9b83973861/</url>
 </references>
 <dates>
 <discovery>2009-12-14</discovery>
 <entry>2009-12-21</entry>
 </dates>
 </vuln>

<vuln vid="39a25a63-eb5c-11de-b650-00215c6a37bb">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.2.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP developers reports:
	<blockquote cite="http://www.php.net/releases/5_2_12.php">
	 This release focuses on improving the stability of the
	 PHP 5.2.x branch with over 60 bug fixes, some of which
	 are security related. All users of PHP 5.2 are encouraged
	 to upgrade to this release.
	 Security Enhancements and Fixes in PHP 5.2.12:
	 <ul>
	 <li>Fixed a safe_mode bypass in tempnam() identified by
	 Grzegorz Stachowiak. (CVE-2009-3557, Rasmus)</li>
	 <li>Fixed a open_basedir bypass in posix_mkfifo()
	 identified by Grzegorz Stachowiak. (CVE-2009-3558, Rasmus)</li>
	 <li>Added "max_file_uploads" INI directive, which can
	 be set to limit the number of file uploads per-request
	 to 20 by default, to prevent possible DOS via temporary
	 file exhaustion, identified by Bogdan Calin.
	 (CVE-2009-4017, Ilia)</li>
	 <li>Added protection for $_SESSION from interrupt
	 corruption and improved "session.save_path" check,
	 identified by Stefan Esser. (CVE-2009-4143, Stas)</li>
	 <li>Fixed bug #49785 (insufficient input string
	 validation of htmlspecialchars()). (CVE-2009-4142,
	 Moriyoshi, hello at iwamot dot com)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3557</cvename>
 <cvename>CVE-2009-3558</cvename>
 <cvename>CVE-2009-4017</cvename>
 <cvename>CVE-2009-4142</cvename>
 <cvename>CVE-2009-4143</cvename>
 <url>http://www.php.net/releases/5_2_12.php</url>
 </references>
 <dates>
 <discovery>2009-12-17</discovery>
 <entry>2009-12-17</entry>
 </dates>
 </vuln>

<vuln vid="e7bc5600-eaa0-11de-bd9c-00215c6a37bb">
 <topic>postgresql -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql-client</name>
	<name>postgresql-server</name>
	<range><ge>7.4</ge><lt>7.4.27</lt></range>
	<range><ge>8.0</ge><lt>8.0.23</lt></range>
	<range><ge>8.1</ge><lt>8.1.19</lt></range>
	<range><ge>8.2</ge><lt>8.2.15</lt></range>
	<range><ge>8.3</ge><lt>8.3.9</lt></range>
	<range><ge>8.4</ge><lt>8.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PostgreSQL project reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4034">
	 PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23,
	 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9,
	 and 8.4.x before 8.4.2 does not properly handle a '\0' character
	 in a domain name in the subject's Common Name (CN) field of an
	 X.509 certificate, which (1) allows man-in-the-middle attackers
	 to spoof arbitrary SSL-based PostgreSQL servers via a crafted
	 server certificate issued by a legitimate Certification Authority,
	 and (2) allows remote attackers to bypass intended client-hostname
	 restrictions via a crafted client certificate issued by a legitimate
	 Certification Authority, a related issue to CVE-2009-2408.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4136">
	 PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23,
	 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9,
	 and 8.4.x before 8.4.2 does not properly manage session-local
	 state during execution of an index function by a database
	 superuser, which allows remote authenticated users to gain
	 privileges via a table with crafted index functions, as
	 demonstrated by functions that modify (1) search_path or
	 (2) a prepared statement, a related issue to CVE-2007-6600
	 and CVE-2009-3230.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-4034</cvename>
 <cvename>CVE-2009-4136</cvename>
 </references>
 <dates>
 <discovery>2009-11-20</discovery>
 <entry>2009-12-17</entry>
 </dates>
 </vuln>

<vuln vid="5486669e-ea9f-11de-bd9c-00215c6a37bb">
 <topic>tptest -- pwd Remote Stack Buffer Overflow</topic>
 <affects>
 <package>
	<name>tptest</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/33785">
	 TPTEST is prone to a remote stack-based buffer-overflow
	 vulnerability. An attacker can exploit this issue to
	 execute arbitrary code within the context of the affected
	 application. Failed exploit attempts will result in a
	 denial-of-service condition.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>33785</bid>
 </references>
 <dates>
 <discovery>2009-02-16</discovery>
 <entry>2009-12-17</entry>
 </dates>
 </vuln>

<vuln vid="01c57d20-ea26-11de-bd39-00248c9b4be7">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.5.*,1</gt><lt>3.5.6,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.16,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.0.16,1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.0.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><ge>3.0</ge><lt>3.0.1</lt></range>
 </package>

</affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2009-71 GeckoActiveXObject exception messages can be used to
	 enumerate installed COM objects
	 MFSA 2009-70 Privilege escalation via chrome window.opener
	 MFSA 2009-69 Location bar spoofing vulnerabilities
	 MFSA 2009-68 NTLM reflection vulnerability
	 MFSA 2009-67 Integer overflow, crash in libtheora video
	 library
	 MFSA 2009-66 Memory safety fixes in liboggplay media library
	 MFSA 2009-65 Crashes with evidence of memory corruption (rv:1.9.1.6/
	 1.9.0.16)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3388</cvename>
 <cvename>CVE-2009-3389</cvename>
 <cvename>CVE-2009-3979</cvename>
 <cvename>CVE-2009-3980</cvename>
 <cvename>CVE-2009-3981</cvename>
 <cvename>CVE-2009-3982</cvename>
 <cvename>CVE-2009-3983</cvename>
 <cvename>CVE-2009-3984</cvename>
 <cvename>CVE-2009-3985</cvename>
 <cvename>CVE-2009-3986</cvename>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-71.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-70.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-69.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-68.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-67.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-66.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-65.html</url>
 </references>
 <dates>
 <discovery>2009-12-16</discovery>
 <entry>2009-12-16</entry>
 <modified>2010-01-21</modified>
 </dates>
 </vuln>

<vuln vid="1b3f854b-e4bd-11de-b276-000d8787e1be">
 <topic>freeradius -- remote packet of death vulnerability</topic>
 <affects>
 <package>
	<name>freeradius</name>
	<range><lt>1.1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	freeRADIUS Vulnerability Notifications reports:
	<blockquote cite="http://freeradius.org/security.html">
	 2009.09.09 v1.1.7 - Anyone who can send packets to
	 the server can crash it by sending a Tunnel-Password
	 attribute in an Access-Request packet. This
	 vulnerability is not otherwise exploitable. We have
	 released 1.1.8 to correct this vulnerability.
	 This issue is similar to the previous Tunnel-Password
	 issue noted below. The vulnerable versions are 1.1.3
	 through 1.1.7. Version 2.x is not affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3111</cvename>
 <url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3111</url>
 <url>http://freeradius.org/security.html</url>
 <url>http://www.milw0rm.com/exploits/9642</url>
 </references>
 <dates>
 <discovery>2009-09-09</discovery>
 <entry>2009-12-14</entry>
 <modified>2009-12-14</modified>
 </dates>
 </vuln>

<vuln vid="bec38383-e6cb-11de-bdd4-000c2930e89b">
 <topic>pligg -- Cross-Site Scripting and Cross-Site Request Forgery</topic>
 <affects>
 <package>
	<name>pligg</name>
	<range><lt>1.0.3b</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	secunia reports:
	<blockquote cite="http://secunia.com/advisories/37349">
	 Russ McRee has discovered some vulnerabilities in Pligg, which can
	 be exploited by malicious people to conduct cross-site scripting and
	 request forgery attacks.
	 Input passed via the "Referer" HTTP header to various scripts (e.g.
	 admin/admin_config.php, admin/admin_modules.php, delete.php, editlink.php,
	 submit.php, submit_groups.php, user_add_remove_links.php, and
	 user_settings.php) is not properly sanitised before being returned to
	 the user. This can be exploited to execute arbitrary HTML and script
	 code in a user's browser session in context of an affected site.
	 The application allows users to perform certain actions via HTTP
	 requests without performing any validity checks to verify the requests.
	 This can be exploited to e.g. create an arbitrary user with administrative
	 privileges if a logged-in administrative user visits a malicious web
	 site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-4786</cvename>
 <cvename>CVE-2009-4787</cvename>
 <cvename>CVE-2009-4788</cvename>
 <url>http://secunia.com/advisories/37349/</url>
 <url>http://www.pligg.com/blog/775/pligg-cms-1-0-3-release/</url>
 </references>
 <dates>
 <discovery>2009-12-02</discovery>
 <entry>2009-12-12</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="fcbf56dd-e667-11de-920a-00248c9b4be7">
 <topic>piwik -- php code execution</topic>
 <affects>
 <package>
	<name>piwik</name>
	<range><lt>0.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	secunia reports:
	<blockquote cite="http://secunia.com/advisories/37649">
	 Stefan Esser has reported a vulnerability in Piwik, which can be
	 exploited by malicious people to compromise a vulnerable system.
	 The vulnerability is caused due to the core/Cookie.php script using
	 "unserialize()" with user controlled input. This can be exploited to
	 e.g. execute arbitrary PHP code via the "__wakeup()" or "__destruct()"
	 methods of a serialized object passed via an HTTP cookie.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-4137</cvename>
 <url>http://secunia.com/advisories/37649/</url>
 <url>http://www.sektioneins.de/de/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/index.html</url>
 <url>http://piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation/</url>
 </references>
 <dates>
 <discovery>2009-12-10</discovery>
 <entry>2009-12-11</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="30211c45-e52a-11de-b5cd-00e0815b8da8">
 <topic>dovecot -- Insecure directory permissions</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><ge>1.2.*</ge><lt>1.2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dovecot author reports:
	<blockquote cite="http://www.dovecot.org/list/dovecot-news/2009-November/000143.html">
	 Dovecot v1.2.x had been creating base_dir (and its parents if
	 necessary) with 0777 permissions. The base_dir's permissions get
	 changed to 0755 automatically at startup, but you may need to
	 chmod the parent directories manually.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3897</cvename>
 <bid>37084</bid>
 <url>http://secunia.com/advisories/37443</url>
 </references>
 <dates>
 <discovery>2009-11-20</discovery>
 <entry>2009-12-10</entry>
 </dates>
 </vuln>

<vuln vid="3c1a672e-e508-11de-9f4a-001b2134ef46">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><lt>9.0r260</lt></range>
 </package>
 <package>
	<name>linux-f8-flashplugin</name>
	<name>linux-f10-flashplugin</name>
	<range><lt>10.0r42</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb09-19.html">
	 Critical vulnerabilities have been identified in Adobe
	 Flash Player version 10.0.32.18 and earlier. These
	 vulnerabilities could cause the application to crash and
	 could potentially allow an attacker to take control of the
	 affected system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3794</cvename>
 <cvename>CVE-2009-3796</cvename>
 <cvename>CVE-2009-3797</cvename>
 <cvename>CVE-2009-3798</cvename>
 <cvename>CVE-2009-3799</cvename>
 <cvename>CVE-2009-3800</cvename>
 <cvename>CVE-2009-3951</cvename>
 <url>http://www.zerodayinitiative.com/advisories/ZDI-09-092/</url>
 <url>http://www.zerodayinitiative.com/advisories/ZDI-09-093/</url>
 <url>http://www.adobe.com/support/security/bulletins/apsb09-19.html</url>
 </references>
 <dates>
 <discovery>2009-07-14</discovery>
 <entry>2009-12-09</entry>
 </dates>
 </vuln>

<vuln vid="eab8c3bd-e50c-11de-9cd0-001a926c7637">
 <topic>ruby -- heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><ge>1.9.1,1</ge><lt>1.9.1.376,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The official ruby site reports:
	<blockquote cite="http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/">
	 There is a heap overflow vulnerability in String#ljust,
	 String#center and String#rjust. This has allowed an attacker to run
	 arbitrary code in some rare cases.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-4124</cvename>
 <url>http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/</url>
 </references>
 <dates>
 <discovery>2009-11-30</discovery>
 <entry>2009-12-09</entry>
 </dates>
 </vuln>

<vuln vid="714c1406-e4cf-11de-883a-003048590f9e">
 <topic>rt -- Session fixation vulnerability</topic>
 <affects>
 <package>
	<name>rt</name>
	<range><lt>3.8.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/37546">
	 A vulnerability has been reported in RT, which can be exploited by
	 malicious people to conduct session fixation attacks.
	 The vulnerability is caused due to an error in the handling of
	 sessions and can be exploited to hijack another user's session by
	 tricking the user into logging in after following a specially crafted
	 link.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>37162</bid>
 <cvename>CVE-2009-3585</cvename>
 </references>
 <dates>
 <discovery>2009-12-01</discovery>
 <entry>2009-12-09</entry>
 </dates>
 </vuln>

<vuln vid="5f030587-e39a-11de-881e-001aa0166822">
 <topic>expat2 -- Parser crash with specially formatted UTF-8 sequences</topic>
 <affects>
 <package>
	<name>expat2</name>
	<name>linux-f10-expat</name>
	<range><lt>2.0.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720">
	 The updatePosition function in lib/xmltok_impl.c in
	 libexpat in Expat 2.0.1, as used in Python, PyXML,
	 w3c-libwww, and other software, allows context-dependent
	 attackers to cause a denial of service (application crash)
	 via an XML document with crafted UTF-8 sequences that
	 trigger a buffer over-read.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3720</cvename>
 </references>
 <dates>
 <discovery>2009-01-17</discovery>
 <entry>2009-12-08</entry>
 </dates>
 </vuln>

<vuln vid="e9fca207-e399-11de-881e-001aa0166822">
 <topic>expat2 -- buffer over-read and crash</topic>
 <affects>
 <package>
	<name>expat2</name>
	<range><lt>2.0.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560">
	 The big2_toUtf8 function in lib/xmltok.c in libexpat in
	 Expat 2.0.1, as used in the XML-Twig module for Perl, allows
	 context-dependent attackers to cause a denial of service
	 (application crash) via an XML document with malformed UTF-8
	 sequences that trigger a buffer over-read, related to the
	 doProlog function in lib/xmlparse.c.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3560</cvename>
 </references>
 <dates>
 <discovery>2009-10-05</discovery>
 <entry>2009-12-08</entry>
 </dates>
 </vuln>

<vuln vid="6431c4db-deb4-11de-9078-0030843d3802">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<range><lt>10.10.20091120</lt></range>
 </package>
 <package>
	<name>linux-opera</name>
	<range><lt>10.10</lt></range>
	</package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera Team reports:
	<blockquote cite="http://www.opera.com/docs/changelogs/unix/1010/">
	 <ul>
	 <li>Fixed a heap buffer overflow in string to number conversion</li>
	 <li>Fixed an issue where error messages could leak onto unrelated
	 sites</li>
	 <li>Fixed a moderately severe issue, as reported by Chris Evans of
	 the Google Security Team; details will be disclosed at a later
	 date.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0689</cvename>
 <cvename>CVE-2009-4071</cvename>
 <url>http://www.opera.com/support/kb/view/941/</url>
 <url>http://www.opera.com/support/kb/view/942/</url>
 </references>
 <dates>
 <discovery>2009-11-23</discovery>
 <entry>2009-12-01</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="77c14729-dc5e-11de-92ae-02e0184b8d35">
 <topic>libtool -- Library Search Path Privilege Escalation Issue</topic>
 <affects>
 <package>
	<name>libtool</name>
	<range><lt>2.2.6b</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia.com
	<blockquote cite="http://secunia.com/advisories/37414/">
	 Do not attempt to load an unqualified module.la file from the
	 current directory (by default) since doing so is insecure and is
	 not compliant with the documentation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3736</cvename>
 <url>http://secunia.com/advisories/37414/</url>
 <url>http://lists.gnu.org/archive/html/libtool/2009-11/msg00059.html</url>
 </references>
 <dates>
 <discovery>2009-11-25</discovery>
 <entry>2009-11-28</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="94edff42-d93d-11de-a434-0211d880e350">
 <topic>libvorbis -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libvorbis</name>
	<range><lt>1.2.3_1,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Ubuntu security team reports:
	<blockquote cite="http://www.ubuntu.com/usn/usn-861-1">
	 It was discovered that libvorbis did not correctly
	 handle certain malformed vorbis files. If a user were
	 tricked into opening a specially crafted vorbis file
	 with an application that uses libvorbis, an attacker
	 could cause a denial of service or possibly execute
	 arbitrary code with the user's privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1420</cvename>
 <cvename>CVE-2009-3379</cvename>
 </references>
 <dates>
 <discovery>2009-11-24</discovery>
 <entry>2009-11-24</entry>
 </dates>
 </vuln>

<vuln vid="92ca92c1-d859-11de-89f9-001517351c22">
 <topic>bugzilla -- information leak</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><gt>3.3.1</gt><lt>3.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla Security Advisory reports:
	<blockquote cite="http://www.bugzilla.org/security/3.4.3/">
	 When a bug is in a group, none of its information
	 (other than its status and resolution) should be visible
	 to users outside that group. It was discovered that
	 as of 3.3.2, Bugzilla was showing the alias of the bug
	 (a very short string used as a shortcut for looking up
	 the bug) to users outside of the group, if the protected
	 bug ended up in the "Depends On" or "Blocks" list of any
	 other bug.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3386</cvename>
 <url>http://www.bugzilla.org/security/3.4.3/</url>
 </references>
 <dates>
 <discovery>2009-11-18</discovery>
 <entry>2009-11-23</entry>
 </dates>
 </vuln>

<vuln vid="04104985-d846-11de-84e4-00215af774f0">
 <topic>cacti -- cross-site scripting issues</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>0.8.7e4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cacti development team reports:
	<blockquote cite="http://docs.cacti.net/#cross-site_scripting_fixes">
	 The Cross-Site Scripting patch has been posted.
	 This patch addresses cross-site scripting issues reported
	 by Moritz Naumann.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-4032</cvename>
 <url>http://docs.cacti.net/#cross-site_scripting_fixes</url>
 </references>
 <dates>
 <discovery>2009-11-21</discovery>
 <entry>2009-11-23</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="0640198a-d117-11de-b667-0030843d3802">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>2.8.6,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<range><lt>2.8.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	secunia reports:
	<blockquote cite="http://secunia.com/advisories/37332/">
	 The security issue is caused due to the wp_check_filetype()
	 function in /wp-includes/functions.php improperly validating uploaded
	 files. This can be exploited to execute arbitrary PHP code by
	 uploading a malicious PHP script with multiple extensions.
	 Successful exploitation of this vulnerability requires that Apache
	 is not configured to handle the mime-type for media files with an e.g.
	 "gif", "jpg", "png", "tif", "wmv" extension.
	 Input passed via certain parameters to press-this.php is not
	 properly sanitised before being displayed to the user. This can be
	 exploited to insert arbitrary HTML and script code, which will be
	 executed in a user's browser session in context of an affected site
	 when the malicious data is being viewed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3890</cvename>
 <cvename>CVE-2009-3891</cvename>
 <url>http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/</url>
 <url>http://secunia.com/advisories/37332/</url>
 </references>
 <dates>
 <discovery>2009-11-12</discovery>
 <entry>2009-11-14</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="68bda678-caab-11de-a97e-be89dfd1042e">
 <topic>p5-HTML-Parser -- denial of service</topic>
 <affects>
 <package>
	<name>p5-HTML-Parser</name>
	<range><lt>3.63</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3627">
	 The decode_entities function in util.c in HTML-Parser before
	 3.63 allows context-dependent attackers to cause a denial of service
	 (infinite loop) via an incomplete SGML numeric character reference,
	 which triggers generation of an invalid UTF-8 character.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>36807</bid>
 <cvename>CVE-2009-3627</cvename>
 <url>http://secunia.com/advisories/37155</url>
 </references>
 <dates>
 <discovery>2009-10-23</discovery>
 <entry>2009-11-06</entry>
 </dates>
 </vuln>

<vuln vid="4e8344a3-ca52-11de-8ee8-00215c6a37bb">
 <topic>gd -- '_gdGetColors' remote buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>gd</name>
	<range><lt>2.0.35_2,1</lt></range>
 </package>
 <package>
	<name>php5-gd</name>
	<range><lt>5.2.11_2</lt></range>
 </package>
 <package>
	<name>php4-gd</name>
	<range><lt>4.4.9_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546">
	 The _gdGetColors function in gd_gd.c in PHP 5.2.11 and
	 5.3.0, and the GD Graphics Library 2.x, does not properly
	 verify a certain colorsTotal structure member, which might
	 allow remote attackers to conduct buffer overflow or buffer
	 over-read attacks via a crafted GD file, a different
	 vulnerability than CVE-2009-3293.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>36712</bid>
 <cvename>CVE-2009-3546</cvename>
 <url>http://secunia.com/advisories/37069</url>
 <url>http://secunia.com/advisories/37080</url>
 </references>
 <dates>
 <discovery>2009-10-15</discovery>
 <entry>2009-11-05</entry>
 <modified>2010-06-17</modified>
 </dates>
 </vuln>

<vuln vid="6693bad2-ca50-11de-8ee8-00215c6a37bb">
 <topic>typo3 -- multiple vulnerabilities in TYPO3 Core</topic>
 <affects>
 <package>
	<name>typo3</name>
	<range><lt>4.2.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	TYPO3 develop team reports:
	<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/">
	 Affected versions: TYPO3 versions 4.0.13 and below, 4.1.12
	 and below, 4.2.9 and below, 4.3.0beta1 and below.
	 SQL injection, Cross-site scripting (XSS), Information
	 disclosure, Frame hijacking, Remote shell command execution
	 and Insecure Install Tool authentication/session handling.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>36801</bid>
 <cvename>CVE-2009-3628</cvename>
 <cvename>CVE-2009-3629</cvename>
 <cvename>CVE-2009-3630</cvename>
 <cvename>CVE-2009-3631</cvename>
 <cvename>CVE-2009-3632</cvename>
 <cvename>CVE-2009-3633</cvename>
 <cvename>CVE-2009-3634</cvename>
 <cvename>CVE-2009-3635</cvename>
 <cvename>CVE-2009-3636</cvename>
 <url>http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/</url>
 <url>http://secunia.com/advisories/37122/</url>
 </references>
 <dates>
 <discovery>2009-10-22</discovery>
 <entry>2009-11-05</entry>
 </dates>
 </vuln>

<vuln vid="3149ab1c-c8b9-11de-b87b-0011098ad87f">
 <topic>vlc -- stack overflow in MPA, AVI and ASF demuxer</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><ge>0.5.0</ge><lt>1.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	VideoLAN reports:
	<blockquote cite="http://www.videolan.org/security/sa0901.html">
	 When parsing a MP4, ASF or AVI file with an overly deep box
	 structure, a stack overflow might occur. It would overwrite the
	 return address and thus redirect the execution flow.
	 If successful, a malicious third party could trigger execution
	 of arbitrary code within the context of the VLC media player.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.videolan.org/security/sa0901.html</url>
 </references>
 <dates>
 <discovery>2009-09-14</discovery>
 <entry>2009-11-03</entry>
 </dates>
 </vuln>

<vuln vid="6f358f5a-c7ea-11de-a9f3-0030843d3802">
 <topic>KDE -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>kdebase-runtime</name>
	<range><ge>4.0.*</ge><lt>4.3.1_2</lt></range>
 </package>
 <package>
	<name>kdelibs</name>
	<range><ge>4.0.*</ge><lt>4.3.1_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	oCERT reports:
	<blockquote cite="http://www.ocert.org/advisories/ocert-2009-015.html">
	 Ark input sanitization errors: The KDE archiving tool, Ark,
	 performs insufficient validation which leads to specially crafted
	 archive files, using unknown MIME types, to be rendered using a KHTML
	 instance, this can trigger uncontrolled XMLHTTPRequests to remote
	 sites.
	 IO Slaves input sanitization errors: KDE protocol handlers perform
	 insufficient input validation, an attacker can craft malicious URI
	 that would trigger JavaScript execution. Additionally the 'help://'
	 protocol handler suffer from directory traversal. It should be noted
	 that the scope of this issue is limited as the malicious URIs cannot
	 be embedded in Internet hosted content.
	 KMail input sanitization errors: The KDE mail client, KMail, performs
	 insufficient validation which leads to specially crafted email
	 attachments, using unknown MIME types, to be rendered using a KHTML
	 instance, this can trigger uncontrolled XMLHTTPRequests to remote
	 sites.
	 The exploitation of these vulnerabilities is unlikely according to
	 Portcullis and KDE but the execution of active content is nonetheless
	 unexpected and might pose a threat.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.ocert.org/advisories/ocert-2009-015.html</url>
 </references>
 <dates>
 <discovery>2009-10-30</discovery>
 <entry>2009-11-02</entry>
 </dates>
 </vuln>

<vuln vid="2fda6bd2-c53c-11de-b157-001999392805">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<range><lt>10.01.20091019</lt></range>
 </package>
 <package>
	<name>linux-opera</name>
	<range><lt>10.01</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera Team Reports:
	<blockquote cite="http://www.opera.com/docs/changelogs/unix/1001/">
	 <ul>
	 <li>Fixed an issue where certain domain names could allow execution
	 of arbitrary code, as reported by Chris Weber of Casaba Security</li>
	 <li>Fixed an issue where scripts can run on the feed subscription
	 page, as reported by Inferno</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3831</cvename>
 <url>http://www.opera.com/support/kb/view/938/</url>
 <url>http://www.opera.com/support/kb/view/939/</url>
 </references>
 <dates>
 <discovery>2009-10-28</discovery>
 <entry>2009-10-31</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="83d7d149-b965-11de-a515-0022156e8794">
 <topic>Enhanced cTorrent -- stack-based overflow</topic>
 <affects>
 <package>
	<name>ctorrent</name>
	<range><lt>3.3.2_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Securityfocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/34584">
	 cTorrent and dTorrent are prone to a remote buffer-overflow
	 vulnerability because the software fails to properly
	 bounds-check user-supplied input before copying it to an
	 insufficiently sized memory buffer.
	 Successful exploits allow remote attackers to execute
	 arbitrary machine code in the context of a vulnerable
	 application. Failed exploit attempts will likely result in
	 denial-of-service conditions.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>34584</bid>
 <cvename>CVE-2009-1759</cvename>
 <url>http://sourceforge.net/tracker/?func=detail&amp;aid=2782875&amp;group_id=202532&amp;atid=981959</url>
 </references>
 <dates>
 <discovery>2009-10-15</discovery>
 <entry>2009-10-28</entry>
 </dates>
 </vuln>

<vuln vid="c87aa2d2-c3c4-11de-ab08-000f20797ede">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.5.*,1</gt><lt>3.5.4,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.15,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>3.0.15</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="http://www.mozilla.org/security/announce/">
	 MFSA 2009-64 Crashes with evidence of memory
	 corruption (rv:1.9.1.4/ 1.9.0.15)
	 MFSA 2009-63 Upgrade media libraries to fix memory
	 safety bugs
	 MFSA 2009-62 Download filename spoofing with RTL
	 override
	 MFSA 2009-61 Cross-origin data theft through
	 document.getSelection()
	 MFSA 2009-59 Heap buffer overflow in string to
	 number conversion
	 MFSA 2009-57 Chrome privilege escalation in
	 XPCVariant::VariantDataToJS()
	 MFSA 2009-56 Heap buffer overflow in GIF color map
	 parser
	 MFSA 2009-55 Crash in proxy auto-configuration
	 regexp parsing
	 MFSA 2009-54 Crash with recursive web-worker calls
	 MFSA 2009-53 Local downloaded file tampering
	 MFSA 2009-52 Form history vulnerable to stealing
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3380</cvename>
 <cvename>CVE-2009-3381</cvename>
 <cvename>CVE-2009-3382</cvename>
 <cvename>CVE-2009-3383</cvename>
 <cvename>CVE-2009-3379</cvename>
 <cvename>CVE-2009-3378</cvename>
 <cvename>CVE-2009-3377</cvename>
 <cvename>CVE-2009-3376</cvename>
 <cvename>CVE-2009-3375</cvename>
 <cvename>CVE-2009-1563</cvename>
 <cvename>CVE-2009-3374</cvename>
 <cvename>CVE-2009-3373</cvename>
 <cvename>CVE-2009-3372</cvename>
 <cvename>CVE-2009-3371</cvename>
 <cvename>CVE-2009-3274</cvename>
 <cvename>CVE-2009-3370</cvename>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-64.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-63.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-62.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-61.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-59.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-57.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-56.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-55.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-54.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-53.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-52.html</url>
 </references>
 <dates>
 <discovery>2009-10-27</discovery>
 <entry>2009-10-28</entry>
 <modified>2009-12-14</modified>
 </dates>
 </vuln>

<vuln vid="2544f543-c178-11de-b175-001cc0377035">
 <topic>elinks -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>elinks</name>
	<range><lt>0.11.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/36574/discuss">
	 ELinks is prone to an off-by-one buffer-overflow vulnerability
	 because the application fails to accurately reference the last
	 element of a buffer.
	 Attackers may leverage this issue to execute arbitrary code in
	 the context of the application. Failed attacks will cause
	 denial-of-service conditions.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>36574</bid>
 <cvename>CVE-2008-7224</cvename>
 <mlist msgid="20080204235429.GA28006@diku.dk">http://linuxfromscratch.org/pipermail/elinks-users/2008-February/001604.html</mlist>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=380347</url>
 </references>
 <dates>
 <discovery>2006-07-29</discovery>
 <entry>2009-10-25</entry>
 </dates>
 </vuln>

<vuln vid="692ab645-bf5d-11de-849b-00151797c2d4">
 <topic>squidGuard -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>squidGuard</name>
	<range><lt>1.4_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SquidGuard website reports:
	<blockquote cite="http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091015">
	 Patch 20091015 fixes one buffer overflow problem
	 in sgLog.c when overlong URLs are requested.
	 SquidGuard will then go into emergency mode were
	 no blocking occurs. This is not required in this
	 situation.
	</blockquote>
	<blockquote cite="http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091019">
	 Patch 20091019 fixes two bypass problems with URLs
	 which length is close to the limit defined by MAX_BUF
	 (default: 4096) in squidGuard and MAX_URL (default:
	 4096 in squid 2.x and 8192 in squid 3.x) in squid.
	 For this kind of URLs the proxy request exceeds MAX_BUF
	 causing squidGuard to complain about not being able to
	 parse the squid request. Increasing the buffer limit
	 to be higher than the one defined in MAX_URL solves the
	 issue.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3700</cvename>
 <cvename>CVE-2009-3826</cvename>
 <url>http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091015</url>
 <url>http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091019</url>
 </references>
 <dates>
 <discovery>2009-10-15</discovery>
 <entry>2009-10-22</entry>
 <modified>2010-05-06</modified>
 </dates>
 </vuln>

<vuln vid="8581189c-bd5f-11de-8709-0017a4cccfc6">
 <topic>Xpdf -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>xpdf</name>
	<range><lt>3.02_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/archive/1/507261">
	 Some vulnerabilities have been reported in Xpdf, which can be
	 exploited by malicious people to potentially compromise a user's
	 system.
	 1) Multiple integer overflows in "SplashBitmap::SplashBitmap()"
	 can be exploited to cause heap-based buffer overflows.
	 2) An integer overflow error in "ObjectStream::ObjectStream()"
	 can be exploited to cause a heap-based buffer overflow.
	 3) Multiple integer overflows in "Splash::drawImage()" can be
	 exploited to cause heap-based buffer overflows.
	 4) An integer overflow error in "PSOutputDev::doImageL1Sep()"
	 can be exploited to cause a heap-based buffer overflow when
	 converting a PDF document to a PS file.
	 Successful exploitation of the vulnerabilities may allow execution
	 of arbitrary code by tricking a user into opening a specially crafted
	 PDF file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/archive/1/507261</url>
 <url>http://secunia.com/advisories/37053/</url>
 </references>
 <dates>
 <discovery>2009-10-14</discovery>
 <entry>2009-10-20</entry>
 </dates>
 </vuln>

<vuln vid="87917d6f-ba76-11de-bac2-001a4d563a0f">
 <topic>django -- denial-of-service attack</topic>
 <affects>
 <package>
	<name>py23-django</name>
	<name>py24-django</name>
	<name>py25-django</name>
	<name>py26-django</name>
	<name>py30-django</name>
	<name>py31-django</name>
	<range><lt>1.1.1</lt></range>
 </package>
 <package>
	<name>py23-django-devel</name>
	<name>py24-django-devel</name>
	<name>py25-django-devel</name>
	<name>py26-django-devel</name>
	<name>py30-django-devel</name>
	<name>py31-django-devel</name>
	<range><lt>11603,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django project reports:
	<blockquote cite="http://www.djangoproject.com/weblog/2009/oct/09/security/">
	 Django's forms library includes field types which perform
	 regular-expression-based validation of email addresses and
	 URLs. Certain addresses/URLs could trigger a pathological
	 performance case in these regular expression, resulting in
	 the server process/thread becoming unresponsive, and consuming
	 excessive CPU over an extended period of time. If deliberately
	 triggered, this could result in an effectively
	 denial-of-service attack.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3695</cvename>
 <url>http://www.djangoproject.com/weblog/2009/oct/09/security/</url>
 </references>
 <dates>
 <discovery>2009-10-09</discovery>
 <entry>2009-10-16</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="4769914e-b844-11de-b159-0030843d3802">
 <topic>phpmyadmin -- XSS and SQL injection vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>3.2.2.1</lt></range>
 </package>
 <package>
	<name>phpMyAdmin211</name>
	<range><lt>2.11.9.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpMyAdmin Team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php">
	Cross-site scripting (XSS) vulnerability allows remote attackers to
	 inject arbitrary web script or HTML via a crafted MySQL table name.
	SQL injection vulnerability allows remote attackers to inject SQL via
	 various interface parameters of the PDF schema generator feature.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3696</cvename>
 <cvename>CVE-2009-3697</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php</url>
 </references>
 <dates>
 <discovery>2009-10-13</discovery>
 <entry>2009-10-13</entry>
 </dates>
 </vuln>

<vuln vid="437a68cf-b752-11de-b6eb-00e0815b8da8">
 <topic>php5 -- Multiple security issues</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.2.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Vendor reports
	<blockquote cite="http://www.php.net/releases/5_2_11.php">
	 Security Enhancements and Fixes in PHP 5.2.11:
	 Fixed certificate validation inside
	 php_openssl_apply_verification_policy.
	 Fixed sanity check for the color index in imagecolortransparent.
	 Added missing sanity checks around exif processing.
	 Fixed bug 44683 popen crashes when an invalid mode is passed.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.php.net/releases/5_2_11.php</url>
 <cvename>CVE-2009-3291</cvename>
 <cvename>CVE-2009-3292</cvename>
 <cvename>CVE-2009-3293</cvename>
 </references>
 <dates>
 <discovery>2009-09-17</discovery>
 <entry>2009-10-12</entry>
 </dates>
 </vuln>

<vuln vid="ebeed063-b328-11de-b6a5-0030843d3802">
 <topic>virtualbox -- privilege escalation</topic>
 <affects>
 <package>
	<name>virtualbox</name>
	<range><lt>3.0.51.r22902_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sun reports:
	<blockquote cite="http://sunsolve.sun.com/search/document.do?assetkey=1-66-268188-1">
	 A security vulnerability in the VBoxNetAdpCtl configuration tool
	 for certain Sun VirtualBox 3.0 packages may allow local unprivileged
	 users who are authorized to run VirtualBox to execute arbitrary
	 commands with root privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3692</cvename>
 <url>http://sunsolve.sun.com/search/document.do?assetkey=1-66-268188-1</url>
 <url>http://secunia.com/advisories/36929</url>
 </references>
 <dates>
 <discovery>2009-10-07</discovery>
 <entry>2009-10-07</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="50383bde-b25b-11de-8c83-02e0185f8d72">
 <topic>FreeBSD -- Devfs / VFS NULL pointer race condition</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_13</lt></range>
	<range><ge>6.4</ge><lt>6.4_7</lt></range>
	<range><ge>7.1</ge><lt>7.1_8</lt></range>
	<range><ge>7.2</ge><lt>7.2_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Due to the interaction between devfs and VFS, a race condition
	 exists where the kernel might dereference a NULL pointer.
	<h1>Impact:</h1>
	Successful exploitation of the race condition can lead to local
	 kernel privilege escalation, kernel data corruption and/or
	 crash.
	To exploit this vulnerability, an attacker must be able to run
	 code with user privileges on the target system.
	<h1>Workaround:</h1>
	An errata note, FreeBSD-EN-09:05.null has been released
	 simultaneously to this advisory, and contains a kernel patch
	 implementing a workaround for a more broad class of
	 vulnerabilities. However, prior to those changes, no workaround
	 is available.
 </body>
 </description>
 <references>
 <freebsdsa>SA-09:14.devfs</freebsdsa>
 </references>
 <dates>
 <discovery>2009-10-02</discovery>
 <entry>2009-10-06</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="90d2e58f-b25a-11de-8c83-02e0185f8d72">
 <topic>FreeBSD -- kqueue pipe race conditions</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.4_7</lt></range>
	<range><ge>6.4</ge><lt>6.3_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	A race condition exists in the pipe close() code relating
	 to kqueues, causing use-after-free for kernel memory, which
	 may lead to an exploitable NULL pointer vulnerability in the
	 kernel, kernel memory corruption, and other unpredictable
	 results.
	<h1>Impact:</h1>
	Successful exploitation of the race condition can lead to
	 local kernel privilege escalation, kernel data corruption
	 and/or crash.
	To exploit this vulnerability, an attacker must be able to
	 run code on the target system.
	<h1>Workaround</h1>
	An errata notice, FreeBSD-EN-09:05.null has been released
	 simultaneously to this advisory, and contains a kernel patch
	 implementing a workaround for a more broad class of
	 vulnerabilities. However, prior to those changes, no
	 workaround is available.
 </body>
 </description>
 <references>
 <freebsdsa>SA-09:13.pipe</freebsdsa>
 </references>
 <dates>
 <discovery>2009-10-02</discovery>
 <entry>2009-10-06</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="beb6f4a8-add5-11de-8b55-0030843d3802">
 <topic>mybb -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mybb</name>
	<range><lt>1.4.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	mybb team reports:
	<blockquote cite="http://blog.mybboard.net/2009/09/21/mybb-1-4-9-released-security-update/">
	 Input passed via avatar extensions is not properly sanitised before
	 being used in SQL queries. This can be exploited to manipulate SQL
	 queries by uploading specially named avatars.
	 The script allows to sign up with usernames containing zero width
	 space characters, which can be exploited to e.g. conduct spoofing
	 attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>36460</bid>
 <url>http://dev.mybboard.net/issues/464</url>
 <url>http://dev.mybboard.net/issues/418</url>
 <url>http://secunia.com/advisories/36803</url>
 <url>http://blog.mybboard.net/2009/09/21/mybb-1-4-9-released-security-update/</url>
 </references>
 <dates>
 <discovery>2009-09-21</discovery>
 <entry>2009-09-30</entry>
 </dates>
 </vuln>

<vuln vid="bad1b090-a7ca-11de-873f-0030843d3802">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.20</lt></range>
 </package>
 <package>
	<name>drupal6</name>
	<range><lt>6.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Team reports:
	<blockquote cite="http://drupal.org/node/579482">
	 The core OpenID module does not correctly implement Form API for
	 the form that allows one to link user accounts with OpenID
	 identifiers. A malicious user is therefore able to use cross site
	 request forgeries to add attacker controlled OpenID identities to
	 existing accounts. These OpenID identities can then be used to gain
	 access to the affected accounts.
	 The OpenID module is not a compliant implementation of the OpenID
	 Authentication 2.0 specification. An implementation error allows a
	 user to access the account of another user when they share the same
	 OpenID 2.0 provider.
	 File uploads with certain extensions are not correctly processed by
	 the File API. This may lead to the creation of files that are
	 executable by Apache. The .htaccess that is saved into the files
	 directory by Drupal should normally prevent execution. The files are
	 only executable when the server is configured to ignore the directives
	 in the .htaccess file.
	 Drupal doesn't regenerate the session ID when an anonymous user
	 follows the one time login link used to confirm email addresses and
	 reset forgotten passwords. This enables a malicious user to fix and
	 reuse the session id of a victim under certain circumstances.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://drupal.org/node/579482</url>
 <url>http://secunia.com/advisories/36787/</url>
 <url>http://secunia.com/advisories/36786/</url>
 <url>http://secunia.com/advisories/36781/</url>
 <url>http://secunia.com/advisories/36776/</url>
 <url>http://secunia.com/advisories/36785/</url>
 </references>
 <dates>
 <discovery>2009-09-17</discovery>
 <entry>2009-09-22</entry>
 </dates>
 </vuln>

<vuln vid="113cd7e9-a4e2-11de-84af-001195e39404">
 <topic>fwbuilder -- security issue in temporary file handling</topic>
 <affects>
 <package>
	<name>fwbuilder</name>
	<range><lt>3.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Firewall Builder release notes reports:
	<blockquote cite="http://www.fwbuilder.org/docs/firewall_builder_release_notes.html#3.0.7">
	Vadim Kurland (vadim.kurland@fwbuilder.org) reports:
	 Fwbuilder and libfwbuilder 3.0.4 through to 3.0.6 generate
	 iptables scripts with a security issue when also used to
	 generate static routing configurations.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-4664</cvename>
 <url>http://www.fwbuilder.org/docs/firewall_builder_release_notes.html#3.0.7</url>
 </references>
 <dates>
 <discovery>2009-09-18</discovery>
 <entry>2009-09-18</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="b9ec7fe3-a38a-11de-9c6b-003048818f40">
 <topic>bugzilla -- two SQL injections, sensitive data exposure</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><gt>3.3.1</gt><lt>3.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla Security Advisory reports:
	<blockquote cite="http://www.bugzilla.org/security/3.4/">
	 <ul>
	 <li>It is possible to inject raw SQL into the Bugzilla
	 database via the "Bug.create" and "Bug.search" WebService
	 functions.</li>
	 <li>When a user would change his password, his new password would
	 be exposed in the URL field of the browser if he logged in right
	 after changing his password.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3125</cvename>
 <cvename>CVE-2009-3165</cvename>
 <cvename>CVE-2009-3166</cvename>
 <url>http://www.bugzilla.org/security/3.0.8/</url>
 </references>
 <dates>
 <discovery>2009-09-11</discovery>
 <entry>2009-09-17</entry>
 </dates>
 </vuln>

<vuln vid="ee23aa09-a175-11de-96c0-0011098ad87f">
 <topic>horde-base -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>horde-base</name>
	<range><lt>3.3.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Horde team reports:
	<blockquote cite="http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.558&amp;r2=1.515.2.559">
	 An error within the form library when handling image form fields can
	 be exploited to overwrite arbitrary local files.
	 An error exists within the MIME Viewer library when rendering unknown
	 text parts. This can be exploited to execute arbitrary HTML and script
	 code in a user's browser session in context of an affected site if
	 malicious data is viewed.
	 The preferences system does not properly sanitise numeric preference
	 types. This can be exploited to execute arbitrary HTML and script code
	 in a user's browser session in contact of an affected site.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://bugs.horde.org/ticket/?id=8311</url>
 <url>http://bugs.horde.org/ticket/?id=8399</url>
 <url>http://secunia.com/advisories/36665/</url>
 <url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.558&amp;r2=1.515.2.559</url>
 </references>
 <dates>
 <discovery>2009-05-28</discovery>
 <entry>2009-09-14</entry>
 <modified>2009-09-22</modified>
 </dates>
 </vuln>

<vuln vid="152b27f0-a158-11de-990c-e5b1d4c882e0">
 <topic>nginx -- remote denial of service vulnerability</topic>
 <affects>
 <package>
	<name>nginx</name>
	<range><lt>0.7.62</lt></range>
 </package>
 <package>
	<name>nginx-devel</name>
	<range><lt>0.8.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	nginx development team reports:
	<blockquote cite="http://nginx.net/CHANGES">
	 A segmentation fault might occur in worker process while
	 specially crafted request handling.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2629</cvename>
 <url>http://nginx.net/CHANGES</url>
 <mlist msgid="20090914155338.GA2529@ngolde.de">http://lists.debian.org/debian-security-announce/2009/msg00205.html</mlist>
 </references>
 <dates>
 <discovery>2009-09-14</discovery>
 <entry>2009-09-14</entry>
 <modified>2009-09-15</modified>
 </dates>
 </vuln>

<vuln vid="6e8f54af-a07d-11de-a649-000c2955660f">
 <topic>ikiwiki -- insufficient blacklisting in teximg plugin</topic>
 <affects>
 <package>
	<name>ikiwiki</name>
	<range><lt>3.1415926</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The IkiWiki development team reports:
	<blockquote cite="http://ikiwiki.info/security/#index35h2">
	 IkiWikis teximg plugin's blacklisting of insecure TeX commands
	 is insufficient; it can be bypassed and used to read arbitrary
	 files.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2944</cvename>
 <url>http://ikiwiki.info/security/#index35h2</url>
 </references>
 <dates>
 <discovery>2009-08-28</discovery>
 <entry>2009-09-13</entry>
 </dates>
 </vuln>

<vuln vid="b46f3a1e-a052-11de-a649-000c2955660f">
 <topic>xapian-omega -- cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>xapian-omega</name>
	<range><lt>1.0.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Olly Betts reports:
	<blockquote cite="http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html">
	 There's a cross-site scripting issue in Omega - exception
	 messages don't currently get HTML entities escaped, but can
	 contain CGI parameter values in some cases.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2947</cvename>
 <url>http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html</url>
 </references>
 <dates>
 <discovery>2009-09-09</discovery>
 <entry>2009-09-13</entry>
 </dates>
 </vuln>

<vuln vid="922d2398-9e2d-11de-a998-0030843d3802">
 <topic>mozilla firefox -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>3.5.*,1</gt><lt>3.5.3,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.13,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="http://www.mozilla.org/security/announce/">
	 MFSA 2009-51 Chrome privilege escalation with FeedWriter
	 MFSA 2009-50 Location bar spoofing via tall line-height Unicode
	 characters
	 MFSA 2009-49 TreeColumns dangling pointer vulnerability
	 MFSA 2009-48 Insufficient warning for PKCS11 module installation
	 and removal
	 MFSA 2009-47 Crashes with evidence of memory corruption
	 (rv:1.9.1.3/1.9.0.14)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3069</cvename>
 <cvename>CVE-2009-3070</cvename>
 <cvename>CVE-2009-3071</cvename>
 <cvename>CVE-2009-3072</cvename>
 <cvename>CVE-2009-3073</cvename>
 <cvename>CVE-2009-3074</cvename>
 <cvename>CVE-2009-3075</cvename>
 <cvename>CVE-2009-3076</cvename>
 <cvename>CVE-2009-3077</cvename>
 <cvename>CVE-2009-3078</cvename>
 <cvename>CVE-2009-3079</cvename>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-47.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-48.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-49.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-50.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-51.html</url>
 <url>http://secunia.com/advisories/36671/2/</url>
 </references>
 <dates>
 <discovery>2009-09-10</discovery>
 <entry>2009-09-10</entry>
 </dates>
 </vuln>

<vuln vid="012b495c-9d51-11de-8d20-001bd3385381">
 <topic>cyrus-imapd -- Potential buffer overflow in Sieve</topic>
 <affects>
 <package>
	<name>cyrus-imapd</name>
	<range><gt>2.2.0</gt><lt>2.2.13_6</lt></range>
	<range><gt>2.3.0</gt><lt>2.3.14_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Cyrus IMAP Server ChangeLog states:
	<blockquote cite="http://cyrusimap.web.cmu.edu/imapd/changes.html">
	 Fixed CERT VU#336053 - Potential buffer overflow in Sieve.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2632</cvename>
 <bid>36296</bid>
 <url>http://www.kb.cert.org/vuls/id/336053</url>
 <url>http://www.debian.org/security/2009/dsa-1881</url>
 </references>
 <dates>
 <discovery>2009-09-02</discovery>
 <entry>2009-09-09</entry>
 <modified>2009-09-14</modified>
 </dates>
 </vuln>

<vuln vid="24aa9970-9ccd-11de-af10-000c29a67389">
 <topic>silc-toolkit -- Format string vulnerabilities</topic>
 <affects>
 <package>
	<name>silc-toolkit</name>
	<range><lt>1.1.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SILC Changlog reports:
	<blockquote cite="http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.10">
	 An unspecified format string vulnerability exists in
	 silc-toolkit.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3051</cvename>
 <url>http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.10</url>
 <url>http://www.openwall.com/lists/oss-security/2009/09/03/5</url>
 </references>
 <dates>
 <discovery>2009-08-07</discovery>
 <entry>2009-09-08</entry>
 </dates>
 </vuln>

<vuln vid="4582948a-9716-11de-83a5-001999392805">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	 <name>opera</name>
	 <range><lt>10.00.20090830</lt></range>
 </package>
 <package>
	 <name>opera-devel</name>
	 <range><le>10.00.b3_1,1</le></range>
 </package>
 <package>
	 <name>linux-opera</name>
	 <range><lt>10.00</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 Opera Team Reports:
	 <blockquote cite="http://www.opera.com/docs/changelogs/freebsd/1000/">
	 <ul>
	 <li>Issue where sites using revoked intermediate certificates might be shown as secure</li>
	 <li>Issue where the collapsed address bar didn't show the current domain</li>
	 <li>Issue where pages could trick users into uploading files</li>
	 <li>Some IDNA characters not correctly displaying in the address bar</li>
	 <li>Issue where Opera accepts nulls and invalid wild-cards in certificates</li>
	 </ul>
	 </blockquote>
 </body>
 </description>
 <references>
 <url>http://www.opera.com/support/search/view/929/</url>
 <url>http://www.opera.com/support/search/view/930/</url>
 <url>http://www.opera.com/support/search/view/931/</url>
 <url>http://www.opera.com/support/search/view/932/</url>
 <url>http://www.opera.com/support/search/view/934/</url>
 </references>
 <dates>
 <discovery>2009-09-01</discovery>
 <entry>2009-09-04</entry>
 <modified>2009-10-29</modified>
 </dates>
 </vuln>

<vuln vid="80aa98e0-97b4-11de-b946-0030843d3802">
 <topic>dnsmasq -- TFTP server remote code injection vulnerability</topic>
 <affects>
 <package>
	<name>dnsmasq</name>
	<range><lt>2.50</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Kelley reports:
	<blockquote cite="http://www.thekelleys.org.uk/dnsmasq/CHANGELOG">
	 Fix security problem which allowed any host permitted to
	 do TFTP to possibly compromise dnsmasq by remote buffer
	 overflow when TFTP enabled.
	 Fix a problem which allowed a malicious TFTP client to
	 crash dnsmasq.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>36121</bid>
 <bid>36120</bid>
 <cvename>CVE-2009-2957</cvename>
 <cvename>CVE-2009-2958</cvename>
 <url>http://www.coresecurity.com/content/dnsmasq-vulnerabilities</url>
 <url>https://rhn.redhat.com/errata/RHSA-2009-1238.html</url>
 </references>
 <dates>
 <discovery>2009-08-31</discovery>
 <entry>2009-09-02</entry>
 </dates>
 </vuln>

<vuln vid="e15f2356-9139-11de-8f42-001aa0166822">
 <topic>apache22 -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><gt>2.2.0</gt><lt>2.2.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache ChangeLog reports:
	<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.12">
	 CVE-2009-1891: Fix a potential Denial-of-Service attack against mod_deflate or other modules.
	 CVE-2009-1195: Prevent the "Includes" Option from being enabled in an .htaccess file if the AllowOverride restrictions do not permit it.
	 CVE-2009-1890: Fix a potential Denial-of-Service attack against mod_proxy in a reverse proxy configuration.
	 CVE-2009-1191: mod_proxy_ajp: Avoid delivering content from a previous request which failed to send a request body.
	 CVE-2009-0023, CVE-2009-1955, CVE-2009-1956: The bundled copy of the APR-util library has been updated, fixing three different security issues which may affect particular configurations and third-party modules (was already fixed in 2.2.11_5).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-1891</cvename>
 <cvename>CVE-2009-1195</cvename>
 <cvename>CVE-2009-1890</cvename>
 <cvename>CVE-2009-1191</cvename>
 <cvename>CVE-2009-0023</cvename>
 <cvename>CVE-2009-1955</cvename>
 <cvename>CVE-2009-1956</cvename>
 </references>
 <dates>
 <discovery>2009-07-28</discovery>
 <entry>2009-08-25</entry>
 </dates>
 </vuln>

<vuln vid="59e7af2d-8db7-11de-883b-001e3300a30d">
 <topic>pidgin -- MSN overflow parsing SLP messages</topic>
 <affects>
 <package>
	<name>pidgin</name>
	<name>libpurple</name>
	<name>finch</name>
	<range><lt>2.5.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/36384">
	 A vulnerability has been reported in Pidgin, which can be
	 exploited by malicious people to potentially compromise a user's
	 system.
	 The vulnerability is caused due to an error in the
	 "msn_slplink_process_msg()" function when processing MSN SLP
	 messages and can be exploited to corrupt memory.
	 Successful exploitation may allow execution of arbitrary
	 code.
	 The vulnerability is reported in versions 2.5.8 and prior.
	 Other versions may also be affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2694</cvename>
 <url>http://secunia.com/advisories/36384/</url>
 <url>http://www.pidgin.im/news/security/?id=34</url>
 </references>
 <dates>
 <discovery>2009-08-18</discovery>
 <entry>2009-08-20</entry>
 </dates>
 </vuln>

<vuln vid="b31a1088-460f-11de-a11a-0022156e8794">
 <topic>GnuTLS -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>2.6.6</lt></range>
 </package>
 <package>
	<name>gnutls-devel</name>
	<range><lt>2.7.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/34783/discuss">
	 GnuTLS is prone to multiple remote vulnerabilities:
	 <ul>
	 <li>A remote code-execution vulnerability.</li>
	 <li>A denial-of-service vulnerability.</li>
	 <li>A signature-generation vulnerability.</li>
	 <li>A signature-verification vulnerability.</li>
	 </ul>
	 An attacker can exploit these issues to potentially execute
	 arbitrary code, trigger denial-of-service conditions, carry
	 out attacks against data signed with weak signatures, and
	 cause clients to accept expired or invalid certificates from
	 servers.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-1415</cvename>
 <cvename>CVE-2009-1416</cvename>
 <cvename>CVE-2009-1417</cvename>
 <bid>34783</bid>
 <url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3515</url>
 <url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516</url>
 <url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517</url>
 </references>
 <dates>
 <discovery>2009-05-21</discovery>
 <entry>2009-08-17</entry>
 </dates>
 </vuln>

<vuln vid="856a6f84-8b30-11de-8062-00e0815b8da8">
 <topic>GnuTLS -- improper SSL certificate verification</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>2.8.3</lt></range>
 </package>
 <package>
	<name>gnutls-devel</name>
	<range><lt>2.9.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GnuTLS reports:
	<blockquote cite="http://article.gmane.org/gmane.network.gnutls.general/1733">
	 By using a NUL byte in CN/SAN fields, it was possible to fool
	 GnuTLS into 1) not printing the entire CN/SAN field value when
	 printing a certificate and 2) cause incorrect positive matches
	 when matching a hostname against a certificate.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2730</cvename>
 <url>http://article.gmane.org/gmane.network.gnutls.general/1733</url>
 <url>http://secunia.com/advisories/36266</url>
 </references>
 <dates>
 <discovery>2009-08-11</discovery>
 <entry>2009-08-17</entry>
 </dates>
 </vuln>

<vuln vid="86ada694-8b30-11de-b9d0-000c6e274733">
 <topic>memcached -- memcached stats maps Information Disclosure Weakness</topic>
 <affects>
 <package>
	<name>memcached</name>
	<range><lt>1.2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/34915/">
	 A weakness has been reported in memcached, which can be exploited
	 by malicious people to disclose system information.
	 The weakness is caused due to the application disclosing the
	 content of /proc/self/maps if a stats maps command is received.
	 This can be exploited to disclose e.g. the addresses of allocated
	 memory regions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-1255</cvename>
 <url>http://secunia.com/advisories/34915/</url>
 </references>
 <dates>
 <discovery>2009-04-29</discovery>
 <entry>2009-08-17</entry>
 </dates>
 </vuln>

<vuln vid="2430e9c3-8741-11de-938e-003048590f9e">
 <topic>wordpress -- remote admin password reset vulnerability</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>2.8.4,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<range><lt>2.8.4</lt></range>
 </package>
 <package>
	<name>wordpress-mu</name>
	<range><lt>2.8.4a</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	WordPress reports:
	<blockquote cite="http://wordpress.org/development/2009/08/2-8-4-security-release/">
	 A specially crafted URL could be requested that would allow an
	 attacker to bypass a security check to verify a user requested a
	 password reset. As a result, the first account without a key in the
	 database (usually the admin account) would have its password reset and
	 a new password would be emailed to the account owner.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2762</cvename>
 <url>http://wordpress.org/development/2009/08/2-8-4-security-release/</url>
 <url>http://www.milw0rm.com/exploits/9410</url>
 </references>
 <dates>
 <discovery>2009-08-10</discovery>
 <entry>2009-08-12</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="5179d85c-8683-11de-91b9-0022157515b2">
 <topic>fetchmail -- improper SSL certificate subject verification</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><lt>6.3.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2009-01.txt">
	 Moxie Marlinspike demonstrated in July 2009 that some CAs would
	 sign certificates that contain embedded NUL characters in the
	 Common Name or subjectAltName fields of ITU-T X.509
	 certificates.
	 Applications that would treat such X.509 strings as
	 NUL-terminated C strings (rather than strings that contain an
	 explicit length field) would only check the part up to and
	 excluding the NUL character, so that certificate names such as
	 www.good.example\0www.bad.example.com would be mistaken as a
	 certificate name for www.good.example. fetchmail also had this
	 design and implementation flaw.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2666</cvename>
 <url>http://www.fetchmail.info/fetchmail-SA-2009-01.txt</url>
 </references>
 <dates>
 <discovery>2009-08-06</discovery>
 <entry>2009-08-11</entry>
 <modified>2009-08-13</modified>
 </dates>
 </vuln>

<vuln vid="739b94a4-838b-11de-938e-003048590f9e">
 <topic>joomla15 -- com_mailto Timeout Issue</topic>
 <affects>
 <package>
	<name>joomla15</name>
	<range><lt>1.5.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Joomla! Security Center reports:
	<blockquote cite="http://developer.joomla.org/security/news/303-20090723-core-com-mailto-timeout-issue.html">
	 In com_mailto, it was possible to bypass timeout protection against
	 sending automated emails.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://developer.joomla.org/security.html</url>
 <url>http://secunia.com/advisories/36097/</url>
 </references>
 <dates>
 <discovery>2009-07-22</discovery>
 <entry>2009-08-07</entry>
 <modified>2009-08-11</modified>
 </dates>
 </vuln>

<vuln vid="bce1f76d-82d0-11de-88ea-001a4d49522b">
 <topic>subversion -- heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>subversion</name>
	<name>subversion-freebsd</name>
	<name>p5-subversion</name>
	<name>py-subversion</name>
	<range><lt>1.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Subversion Security Advisory reports:
	<blockquote cite="http://subversion.tigris.org/security/CVE-2009-2411-advisory.txt">
	 Subversion clients and servers have multiple heap
	 overflow issues in the parsing of binary deltas. This is
	 related to an allocation vulnerability in the APR library
	 used by Subversion.
	 Clients with commit access to a vulnerable server can
	 cause a remote heap overflow; servers can cause a heap
	 overflow on vulnerable clients that try to do a checkout
	 or update.
	 This can lead to a DoS (an exploit has been tested) and
	 to arbitrary code execution (no exploit tested, but the
	 possibility is clear).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2411</cvename>
 <url>http://subversion.tigris.org/security/CVE-2009-2411-advisory.txt</url>
 </references>
 <dates>
 <discovery>2009-08-06</discovery>
 <entry>2009-08-06</entry>
 <modified>2009-08-07</modified>
 </dates>
 </vuln>

<vuln vid="d67b517d-8214-11de-88ea-001a4d49522b">
 <topic>bugzilla -- product name information leak</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><gt>3.3.4</gt><lt>3.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla Security Advisory reports:
	<blockquote cite="http://www.bugzilla.org/security/3.4/">
	 Normally, users are only supposed to see products that
	 they can file bugs against in the "Product" drop-down on
	 the bug-editing page. Instead, users were being shown all
	 products, even those that they normally could not see. Any
	 user who could edit any bug could see all product
	 names.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.bugzilla.org/security/3.4/</url>
 </references>
 <dates>
 <discovery>2009-07-30</discovery>
 <entry>2009-08-05</entry>
 </dates>
 </vuln>

<vuln vid="49e8f2ee-8147-11de-a994-0030843d3802">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<name>linux-firefox</name>
	<range><lt>3.*,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.13,1</lt></range>
	<range><gt>3.5.*,1</gt><lt>3.5.2,1</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.5.2</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.18</lt></range>
 </package>
 <package>
	<name>linux-seamonkey-devel</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/announce/">
	 MFSA 2009-38: Data corruption with SOCKS5 reply containing DNS name
	 longer than 15 characters
	 MFSA 2009-42: Compromise of SSL-protected communication
	 MFSA 2009-43: Heap overflow in certificate regexp parsing
	 MFSA 2009-44: Location bar and SSL indicator spoofing via window.open()
	 on invalid URL
	 MFSA 2009-45: Crashes with evidence of memory corruption
	 (rv:1.9.1.2/1.9.0.13)
	 MFSA 2009-46: Chrome privilege escalation due to incorrectly cached
	 wrapper
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2404</cvename>
 <cvename>CVE-2009-2408</cvename>
 <cvename>CVE-2009-2454</cvename>
 <cvename>CVE-2009-2470</cvename>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-38.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-42.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-43.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-44.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-45.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-46.html</url>
 </references>
 <dates>
 <discovery>2009-08-03</discovery>
 <entry>2009-08-04</entry>
 <modified>2009-09-04</modified>
 </dates>
 </vuln>

<vuln vid="4e306850-811f-11de-8a67-000c29a67389">
 <topic>silc-client -- Format string vulnerability</topic>
 <affects>
 <package>
	<name>silc-client</name>
	<name>silc-irssi-client</name>
	<range><lt>1.1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SILC changelog reports:
	<blockquote cite="http://silcnet.org/docs/changelog/SILC%20Client%201.1.8">
	 An unspecified format string vulnerability exists in
	 silc-client.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-3051</cvename>
 <url>http://silcnet.org/docs/changelog/SILC%20Client%201.1.8</url>
 </references>
 <dates>
 <discovery>2009-07-31</discovery>
 <entry>2009-08-04</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="0d0237d0-7f68-11de-984d-0011098ad87f">
 <topic>SquirrelMail -- Plug-ins compromise</topic>
 <affects>
 <package>
	<name>squirrelmail-multilogin-plugin</name>
	<range><ge>2.3.4</ge><lt>2.3.4_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	 The SquirrelMail Web Server has been compromised, and three plugins
	 are affected.
	 The port of squirrelmail-sasql-plugin is safe (right MD5), and
	 change_pass is not in the FreeBSD ports tree, but multilogin has a
	 wrong MD5.
 </body>
 </description>
 <references>
 <url>http://sourceforge.net/mailarchive/message.php?msg_name=4A727634.3080008%40squirrelmail.org</url>
 <url>http://squirrelmail.org/index.php</url>
 </references>
 <dates>
 <discovery>2009-07-31</discovery>
 <entry>2009-08-02</entry>
 </dates>
 </vuln>

<vuln vid="83725c91-7c7e-11de-9672-00e0815b8da8">
 <topic>BIND -- Dynamic update message remote DoS</topic>
 <affects>
 <package>
	<name>bind9</name>
	<range><lt>9.3.6.1.1</lt></range>
 </package>
 <package>
	<name>bind9-sdb-postgresql</name>
	<name>bind9-sdb-ldap</name>
	<range><lt>9.4.3.3</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_12</lt></range>
	<range><ge>6.4</ge><lt>6.4_6</lt></range>
	<range><ge>7.1</ge><lt>7.1_7</lt></range>
	<range><ge>7.2</ge><lt>7.2_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	 When named(8) receives a specially crafted dynamic update
	 message an internal assertion check is triggered which causes
	 named(8) to exit.
	 To trigger the problem, the dynamic update message must contains
	 a record of type "ANY" and at least one resource record set (RRset)
	 for this fully qualified domain name (FQDN) must exist on the
	 server.
	<h1>Impact:</h1>
	 An attacker which can send DNS requests to a nameserver can cause
	 it to exit, thus creating a Denial of Service situation.
	<h1>Workaround:</h1>
	 No generally applicable workaround is available, but some firewalls
	 may be able to prevent nsupdate DNS packets from reaching the
	 nameserver.
	 NOTE WELL: Merely configuring named(8) to ignore dynamic updates
	 is NOT sufficient to protect it from this vulnerability.
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0696</cvename>
 <freebsdsa>SA-09:12.bind</freebsdsa>
 <url>http://www.kb.cert.org/vuls/id/725188</url>
 <url>https://www.isc.org/node/474</url>
 </references>
 <dates>
 <discovery>2009-07-28</discovery>
 <entry>2009-08-01</entry>
 <modified>2009-08-04</modified>
 </dates>
 </vuln>

<vuln vid="708c65a5-7c58-11de-a994-0030843d3802">
 <topic>mono -- XML signature HMAC truncation spoofing</topic>
 <affects>
 <package>
	<name>mono</name>
	<range><lt>2.4.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/35852/">
	 A security issue has been reported in Mono, which can be
	 exploited by malicious people to conduct spoofing attacks.
	 The security issue is caused due to an error when processing
	 certain XML signatures.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0217</cvename>
 <url>http://secunia.com/advisories/35852/</url>
 <url>http://www.kb.cert.org/vuls/id/466161</url>
 </references>
 <dates>
 <discovery>2009-07-15</discovery>
 <entry>2009-07-29</entry>
 </dates>
 </vuln>

<vuln vid="e1156e90-7ad6-11de-b26a-0048543d60ce">
 <topic>squid -- several remote denial of service vulnerabilities</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><ge>3.0.1</ge><lt>3.0.17</lt></range>
	<range><ge>3.1.0.1</ge><lt>3.1.0.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid security advisory 2009:2 reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2009_2.txt">
	 Due to incorrect buffer limits and related bound checks Squid
	 is vulnerable to a denial of service attack when processing
	 specially crafted requests or responses.
	 Due to incorrect data validation Squid is vulnerable to a
	 denial of service attack when processing specially crafted
	 responses.
	 These problems allow any trusted client or external server to
	 perform a denial of service attack on the Squid service.
	</blockquote>
	Squid-2.x releases are not affected.
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2621</cvename>
 <cvename>CVE-2009-2622</cvename>
 <url>http://www.squid-cache.org/Advisories/SQUID-2009_2.txt</url>
 </references>
 <dates>
 <discovery>2009-07-27</discovery>
 <entry>2009-07-27</entry>
 <modified>2009-08-06</modified>
 </dates>
 </vuln>

<vuln vid="c1ef9b33-72a6-11de-82ea-0030843d3802">
 <topic>mozilla -- corrupt JIT state after deep return from native function</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><ge>3.5.*,1</ge><lt>3.5.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Project reports:
	<blockquote cite="http://www.mozilla.org/security/announce/2009/mfsa2009-41.html">
	 Firefox user zbyte reported a crash that we determined could result
	 in an exploitable memory corruption problem. In certain cases after a
	 return from a native function, such as escape(), the Just-in-Time
	 (JIT) compiler could get into a corrupt state. This could be exploited
	 by an attacker to run arbitrary code such as installing malware.
	 This vulnerability does not affect earlier versions of Firefox
	 which do not support the JIT feature.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2477</cvename>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-41.html</url>
 <url>http://www.kb.cert.org/vuls/id/443060</url>
 </references>
 <dates>
 <discovery>2009-07-16</discovery>
 <entry>2009-07-17</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="c444c8b7-7169-11de-9ab7-000c29a67389">
 <topic>isc-dhcp-client -- Stack overflow vulnerability</topic>
 <affects>
 <package>
	<name>isc-dhcp31-client</name>
	<range><le>3.1.1</le></range>
 </package>
 <package>
	<name>isc-dhcp30-client</name>
	<range><lt>3.0.7_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US-CERT reports:
	<blockquote cite="http://www.kb.cert.org/vuls/id/410676">
	 The ISC DHCP dhclient application contains a stack buffer
	 overflow, which may allow a remote, unauthenticated attacker to
	 execute arbitrary code with root privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0692</cvename>
 <url>https://www.isc.org/node/468</url>
 <url>http://secunia.com/advisories/35785</url>
 <url>http://www.kb.cert.org/vuls/id/410676</url>
 </references>
 <dates>
 <discovery>2009-07-14</discovery>
 <entry>2009-07-15</entry>
 <modified>2009-07-21</modified>
 </dates>
 </vuln>

<vuln vid="be927298-6f97-11de-b444-001372fd0af2">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.19</lt></range>
 </package>
 <package>
	<name>drupal6</name>
	<range><lt>6.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Security Team reports:
	<blockquote cite="http://drupal.org/node/507572">
	 Cross-site scripting
	 The Forum module does not correctly handle certain arguments
	 obtained from the URL. By enticing a suitably privileged user
	 to visit a specially crafted URL, a malicious user is able to
	 insert arbitrary HTML and script code into forum pages. Such a
	 cross-site scripting attack may lead to the malicious user
	 gaining administrative access. Wikipedia has more information
	 about cross-site scripting (XSS).
	 User signatures have no separate input format, they use the
	 format of the comment with which they are displayed. A user
	 will no longer be able to edit a comment when an administrator
	 changes the comment's input format to a format that is not
	 accessible to the user. However they will still be able to
	 modify their signature, which will then be processed by the new
	 input format.
	 If the new format is very permissive, via their signature, the
	 user may be able to insert arbitrary HTML and script code into
	 pages or, when the PHP filter is enabled for the new format,
	 execute PHP code. This issue affects Drupal 6.x only.
	 When an anonymous user fails to login due to mistyping his
	 username or password, and the page he is on contains a sortable
	 table, the (incorrect) username and password are included in
	 links on the table. If the user visits these links the password
	 may then be leaked to external sites via the HTTP referer.
	 In addition, if the anonymous user is enticed to visit the site
	 via a specially crafted URL while the Drupal page cache is
	 enabled, a malicious user might be able to retrieve the
	 (incorrect) username and password from the page cache.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2372</cvename>
 <cvename>CVE-2009-2374</cvename>
 <cvename>CVE-2009-2373</cvename>
 <url>http://drupal.org/node/507572</url>
 <url>http://secunia.com/advisories/35681</url>
 </references>
 <dates>
 <discovery>2009-07-01</discovery>
 <entry>2009-07-13</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="70372cda-6771-11de-883a-00e0815b8da8">
 <topic>nfsen -- remote command execution</topic>
 <affects>
 <package>
	<name>nfsen</name>
	<range><lt>1.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	nfsen reports:
	<blockquote cite="http://sourceforge.net/forum/forum.php?forum_id=967583">
	 Due to double input checking, a remote command execution security
	 bug exists in all NfSen versions 1.3 and 1.3.1. Users are
	 requested to update to nfsen-1.3.2.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://sourceforge.net/forum/forum.php?forum_id=967583</url>
 </references>
 <dates>
 <discovery>2009-06-18</discovery>
 <entry>2009-07-03</entry>
 </dates>
 </vuln>

<vuln vid="ba73f494-65a8-11de-aef5-001c2514716c">
 <topic>phpmyadmin -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>3.2.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin project reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php">
	 It was possible to conduct an XSS attack via a crafted
	 SQL bookmark.
	 All 3.x releases on which the "bookmarks" feature is
	 active are affected, previous versions are not.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2284</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php</url>
 </references>
 <dates>
 <discovery>2009-06-30</discovery>
 <entry>2009-06-30</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="3ebd4cb5-657f-11de-883a-00e0815b8da8">
 <topic>nagios -- Command Injection Vulnerability</topic>
 <affects>
 <package>
	<name>nagios</name>
	<range><le>3.0.6_1</le></range>
 </package>
 <package>
	<name>nagios2</name>
	<range><le>2.12_3</le></range>
 </package>
 <package>
	<name>nagios-devel</name>
	<range><le>3.1.0_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/35543?">
	 A vulnerability has been reported in Nagios, which can be
	 exploited by malicious users to potentially compromise a
	 vulnerable system.
	 Input passed to the "ping" parameter in statuswml.cgi is not
	 properly sanitised before being used to invoke the ping command.
	 This can be exploited to inject and execute arbitrary shell
	 commands.
	 Successful exploitation requires access to the ping feature
	 of the WAP interface.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-2288</cvename>
 <url>http://secunia.com/advisories/35543</url>
 <url>http://tracker.nagios.org/view.php?id=15</url>
 </references>
 <dates>
 <discovery>2009-05-29</discovery>
 <entry>2009-06-30</entry>
 <modified>2009-07-13</modified>
 </dates>
 </vuln>

<vuln vid="f59dda75-5ff4-11de-a13e-00e0815b8da8">
 <topic>tor-devel -- DNS resolution vulnerability</topic>
 <affects>
 <package>
	<name>tor-devel</name>
	<range><lt>0.2.1.15-rc</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Tor Project reports:
	<blockquote cite="https://git.torproject.org/checkout/tor/master/ChangeLog">
	 A malicious exit relay could convince a controller that the
	 client's DNS question resolves to an internal IP address.
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://git.torproject.org/checkout/tor/master/ChangeLog</url>
 </references>
 <dates>
 <discovery>2009-06-20</discovery>
 <entry>2009-06-23</entry>
 </dates>
 </vuln>

<vuln vid="c14aa48c-5ab7-11de-bc9b-0030843d3802">
 <topic>cscope -- multiple buffer overflows</topic>
 <affects>
 <package>
	<name>cscope</name>
	<range><lt>15.7a</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/34978">
	 Some vulnerabilities have been reported in Cscope, which
	 potentially can be exploited by malicious people to compromise a
	 user's system.
	 The vulnerabilities are caused due to various boundary errors,
	 which can be exploited to cause buffer overflows when parsing
	 specially crafted files or directories.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>34805</bid>
 <cvename>CVE-2009-0148</cvename>
 <url>http://secunia.com/advisories/34978</url>
 </references>
 <dates>
 <discovery>2009-05-31</discovery>
 <entry>2009-06-16</entry>
 </dates>
 </vuln>

<vuln vid="91a2066b-5ab6-11de-bc9b-0030843d3802">
 <topic>cscope -- buffer overflow</topic>
 <affects>
 <package>
	<name>cscope</name>
	<range><lt>15.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/34832">
	 Attackers may leverage this issue to execute arbitrary code
	 in the context of the application. Failed attacks will cause
	 denial-of-service conditions.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>34832</bid>
 <cvename>CVE-2009-1577</cvename>
 <url>http://cscope.cvs.sourceforge.net/viewvc/cscope/cscope/src/find.c?view=log#rev1.19</url>
 </references>
 <dates>
 <discovery>2009-05-31</discovery>
 <entry>2009-06-16</entry>
 </dates>
 </vuln>

<vuln vid="bdccd14b-5aac-11de-a438-003048590f9e">
 <topic>joomla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla15</name>
	<range><lt>1.5.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/35278/">
	 Some vulnerabilities have been reported in Joomla!, which can be
	 exploited by malicious users to conduct script insertion attacks and
	 by malicious people to conduct cross-site scripting attacks.
	 Certain unspecified input is not properly sanitised before being
	 used. This can be exploited to insert arbitrary HTML and script code,
	 which will be executed in a user's browser session in the context of
	 an affected site when the malicious data is displayed.
	 Certain unspecified input passed to the user view of the com_users
	 core component is not properly sanitised before being returned to the
	 user. This can be exploited to execute arbitrary HTML and script code
	 in a user's browser session in context of an affected site.
	 Input passed via certain parameters to the "JA_Purity" template is
	 not properly sanitised before being returned to the user. This can be
	 exploited to execute arbitrary HTML and script code in a user's
	 browser session in context of an affected site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-1938</cvename>
 <cvename>CVE-2009-1939</cvename>
 <cvename>CVE-2009-1940</cvename>
 <url>http://secunia.com/advisories/35278/</url>
 <url>http://www.joomla.org/announcements/release-news/5235-joomla-1511-security-release-now-available.html</url>
 </references>
 <dates>
 <discovery>2009-06-03</discovery>
 <entry>2009-06-16</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="b1ca65e6-5aaf-11de-bc9b-0030843d3802">
 <topic>pidgin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>pidgin</name>
	<name>libpurple</name>
	<name>finch</name>
	<range><lt>2.5.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/35194/">
	 Some vulnerabilities and weaknesses have been reported in Pidgin,
	 which can be exploited by malicious people to cause a DoS or to
	 potentially compromise a user's system.
	 A truncation error in the processing of MSN SLP messages can be
	 exploited to cause a buffer overflow.
	 A boundary error in the XMPP SOCKS5 "bytestream" server when
	 initiating an outgoing file transfer can be exploited to cause a
	 buffer overflow.
	 A boundary error exists in the implementation of the
	 "PurpleCircBuffer" structure. This can be exploited to corrupt memory
	 and cause a crash via specially crafted XMPP or Sametime
	 packets.
	 A boundary error in the "decrypt_out()" function can be exploited
	 to cause a stack-based buffer overflow with 8 bytes and crash the
	 application via a specially crafted QQ packet.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>35067</bid>
 <cvename>CVE-2009-1373</cvename>
 <cvename>CVE-2009-1374</cvename>
 <cvename>CVE-2009-1375</cvename>
 <cvename>CVE-2009-1376</cvename>
 <url>http://secunia.com/advisories/35194/</url>
 <url>http://www.pidgin.im/news/security/?id=29</url>
 <url>http://www.pidgin.im/news/security/?id=30</url>
 <url>http://www.pidgin.im/news/security/?id=32</url>
 </references>
 <dates>
 <discovery>2009-06-03</discovery>
 <entry>2009-06-16</entry>
 </dates>
 </vuln>

<vuln vid="d9b01c08-59b3-11de-828e-00e0815b8da8">
 <topic>git -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>git</name>
	<range><lt>1.6.3.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/35338/discuss">
	 Git is prone to a denial-of-service vulnerability because it
	 fails to properly handle some client requests.
	 Attackers can exploit this issue to cause a daemon process to
	 enter an infinite loop. Repeated exploits may consume excessive
	 system resources, resulting in a denial of service condition.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>35338</bid>
 <cvename>CVE-2009-2108</cvename>
 <url>https://www.redhat.com/archives/fedora-security-list/2009-June/msg00000.html</url>
 <url>http://article.gmane.org/gmane.comp.version-control.git/120724</url>
 </references>
 <dates>
 <discovery>2009-06-04</discovery>
 <entry>2009-06-15</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="62e0fbe5-5798-11de-bb78-001cc0377035">
 <topic>ruby -- BigDecimal denial of service vulnerability</topic>
 <affects>
 <package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.7.160_1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The official ruby site reports:
	<blockquote cite="http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/">
	 A denial of service (DoS) vulnerability was found on the
	 BigDecimal standard library of Ruby. Conversion from BigDecimal
	 objects into Float numbers had a problem which enables attackers
	 to effectively cause segmentation faults.
	 An attacker can cause a denial of service by causing BigDecimal
	 to parse an insanely large number, such as:
	 <code>BigDecimal("9E69999999").to_s("F")</code>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>35278</bid>
 <cvename>CVE-2009-1904</cvename>
 <url>http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/</url>
 </references>
 <dates>
 <discovery>2009-06-09</discovery>
 <entry>2009-06-13</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="da185955-5738-11de-b857-000f20797ede">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>2.0.0.20_8,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.11,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.11</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.22</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/firefox30.html">
	 MFSA 2009-32 JavaScript chrome privilege escalation
	 MFSA 2009-31 XUL scripts bypass content-policy checks
	 MFSA 2009-30 Incorrect principal set for file: resources
	 loaded via location bar
	 MFSA 2009-29 Arbitrary code execution using event listeners
	 attached to an element whose owner document is null
	 MFSA 2009-28 Race condition while accessing the private data
	 of a NPObject JS wrapper class object
	 MFSA 2009-27 SSL tampering via non-200 responses to proxy
	 CONNECT requests
	 MFSA 2009-26 Arbitrary domain cookie access by local file:
	 resources
	 MFSA 2009-25 URL spoofing with invalid unicode characters
	 MFSA 2009-24 Crashes with evidence of memory corruption (rv:1.9.0.11)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-1392</cvename>
 <cvename>CVE-2009-1832</cvename>
 <cvename>CVE-2009-1833</cvename>
 <cvename>CVE-2009-1834</cvename>
 <cvename>CVE-2009-1835</cvename>
 <cvename>CVE-2009-1836</cvename>
 <cvename>CVE-2009-1837</cvename>
 <cvename>CVE-2009-1838</cvename>
 <cvename>CVE-2009-1839</cvename>
 <cvename>CVE-2009-1840</cvename>
 <cvename>CVE-2009-1841</cvename>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-24.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-25.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-26.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-27.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-28.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-29.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-30.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-31.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-32.html</url>
 <url>http://secunia.com/advisories/35331/</url>
 </references>
 <dates>
 <discovery>2009-06-11</discovery>
 <entry>2009-06-12</entry>
 <modified>2009-12-12</modified>
 </dates>
 </vuln>

<vuln vid="eb9212f7-526b-11de-bbf2-001b77d09812">
 <topic>apr -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apr</name>
	<range><lt>1.3.5.1.3.7</lt></range>
 </package>
 <package>
	<name>apache</name>
	<range><ge>2.2.0</ge><lt>2.2.11_5</lt></range>
	<range><ge>2.0.0</ge><lt>2.0.63_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/35284/">
	 Some vulnerabilities have been reported in APR-util, which
	 can be exploited by malicious users and malicious people to
	 cause a DoS (Denial of Service).
	 A vulnerability is caused due to an error in the processing
	 of XML files and can be exploited to exhaust all available
	 memory via a specially crafted XML file containing a
	 predefined entity inside an entity definition.
	 A vulnerability is caused due to an error within the
	 "apr_strmatch_precompile()" function in
	 strmatch/apr_strmatch.c, which can be exploited to crash an
	 application using the library.
	</blockquote>
	RedHat reports:
	<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=3D504390">
	 A single NULL byte buffer overflow flaw was found in
	 apr-util's apr_brigade_vprintf() function.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>35221</bid>
 <cvename>CVE-2009-1955</cvename>
 <cvename>CVE-2009-1956</cvename>
 <cvename>CVE-2009-0023</cvename>
 <url>http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3</url>
 <url>http://secunia.com/advisories/35284/</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=3D504390</url>
 </references>
 <dates>
 <discovery>2009-06-05</discovery>
 <entry>2009-06-08</entry>
 </dates>
 </vuln>

<vuln vid="4f838b74-50a1-11de-b01f-001c2514716c">
 <topic>dokuwiki -- Local File Inclusion with register_globals on</topic>
 <affects>
 <package>
	<name>dokuwiki</name>
	<range><lt>20090214_2</lt></range>
 </package>
 <package>
	<name>dokuwiki-devel</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	DokuWiki reports:
	<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&amp;task_id=1700">
	 A security hole was discovered which allows an attacker
	 to include arbitrary files located on the attacked DokuWiki
	 installation. The included file is executed in the PHP context.
	 This can be escalated by introducing malicious code through
	 uploading file via the media manager or placing PHP code in
	 editable pages.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-1960</cvename>
 <url>http://bugs.splitbrain.org/index.php?do=details&amp;task_id=1700</url>
 </references>
 <dates>
 <discovery>2009-05-26</discovery>
 <entry>2009-06-04</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="82b55df8-4d5a-11de-8811-0030843d3802">
 <topic>openssl -- denial of service in DTLS implementation</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><ge>0.9.8</ge><lt>0.9.8k_1</lt></range>
 </package>
 <package>
	<name>linux-f10-openssl</name>
	<range><ge>0.9.8f</ge><lt>0.9.8m</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/35128/">
	 Some vulnerabilities have been reported in OpenSSL, which can be
	 exploited by malicious people to cause a DoS.
	 The library does not limit the number of buffered DTLS records with
	 a future epoch. This can be exploited to exhaust all available memory
	 via specially crafted DTLS packets.
	 An error when processing DTLS messages can be exploited to exhaust
	 all available memory by sending a large number of out of sequence
	 handshake messages.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-1377</cvename>
 <cvename>CVE-2009-1378</cvename>
 <url>http://secunia.com/advisories/35128/</url>
 </references>
 <dates>
 <discovery>2009-05-18</discovery>
 <entry>2009-05-30</entry>
 <modified>2014-04-10</modified>
 </dates>
 </vuln>

<vuln vid="399f4cd7-4d59-11de-8811-0030843d3802">
 <topic>eggdrop -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>eggdrop</name>
	<range><lt>1.6.19_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/35104/">
	 The vulnerability is caused due to an error in the processing of
	 private messages within the server module
	 (/mod/server.mod/servrmsg.c). This can be exploited to cause a
	 crash by sending a specially crafted message to the bot.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>34985</bid>
 <cvename>CVE-2009-1789</cvename>
 <url>http://www.eggheads.org/news/2009/05/14/35</url>
 <url>http://secunia.com/advisories/35104/</url>
 </references>
 <dates>
 <discovery>2009-05-15</discovery>
 <entry>2009-05-30</entry>
 </dates>
 </vuln>

<vuln vid="a2d4a330-4d54-11de-8811-0030843d3802">
 <topic>wireshark -- PCNFSD Dissector Denial of Service Vulnerability</topic>
 <affects>
 <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<range><lt>1.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/35201/">
	 A vulnerability has been reported in Wireshark, which can be
	 exploited by malicious people to cause a DoS.
	 The vulnerability is caused due to an error in the PCNFSD dissector
	 and can be exploited to cause a crash via a specially crafted PCNFSD
	 packet.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-1829</cvename>
 <url>http://secunia.com/advisories/35201/</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2009-03.html</url>
 </references>
 <dates>
 <discovery>2009-05-21</discovery>
 <entry>2009-05-30</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="6355efdb-4d4d-11de-8811-0030843d3802">
 <topic>libsndfile -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libsndfile</name>
	<range><lt>1.0.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/35076/">
	 Two vulnerabilities have been reported in libsndfile, which can be
	 exploited by malicious people to compromise an application using the
	 library.
	 A boundary error exists within the "voc_read_header()" function in
	 src/voc.c. This can be exploited to cause a heap-based buffer overflow
	 via a specially crafted VOC file.
	 A boundary error exists within the "aiff_read_header()" function in
	 src/aiff.c. This can be exploited to cause a heap-based buffer overflow
	 via a specially crafted AIFF file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-1788</cvename>
 <cvename>CVE-2009-1791</cvename>
 <url>http://secunia.com/advisories/35076/</url>
 <url>http://www.trapkit.de/advisories/TKADV2009-006.txt</url>
 </references>
 <dates>
 <discovery>2009-05-15</discovery>
 <entry>2009-05-30</entry>
 </dates>
 </vuln>

<vuln vid="80f13884-4d4c-11de-8811-0030843d3802">
 <topic>slim -- local disclosure of X authority magic cookie</topic>
 <affects>
 <package>
	<name>slim</name>
	<range><lt>1.3.1_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/35132/">
	 A security issue has been reported in SLiM, which can be
	 exploited by malicious, local users to disclose sensitive
	 information.
	 The security issue is caused due to the application
	 generating the X authority file by passing the X authority
	 cookie via the command line to "xauth". This can be exploited
	 to disclose the X authority cookie by consulting the process
	 list and e.g. gain access the user's display.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>35015</bid>
 <cvename>CVE-2009-1756</cvename>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529306</url>
 </references>
 <dates>
 <discovery>2009-05-20</discovery>
 <entry>2009-05-30</entry>
 </dates>
 </vuln>

<vuln vid="4175c811-f690-4898-87c5-755b3cf1bac6">
 <topic>ntp -- stack-based buffer overflow</topic>
 <affects>
 <package>
	<name>ntp</name>
	<range><lt>4.2.4p7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US-CERT reports:
	<blockquote cite="http://www.kb.cert.org/vuls/id/853097">
	 ntpd contains a stack buffer overflow which may allow a remote
	 unauthenticated attacker to execute arbitrary code on a vulnerable
	 system or create a denial of service.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>35017</bid>
 <cvename>CVE-2009-0159</cvename>
 <cvename>CVE-2009-1252</cvename>
 <url>http://www.kb.cert.org/vuls/id/853097</url>
 </references>
 <dates>
 <discovery>2009-05-06</discovery>
 <entry>2009-05-20</entry>
 </dates>
 </vuln>

<vuln vid="5ed2f96b-33b7-4863-8c6b-540d22344424">
 <topic>imap-uw -- University of Washington IMAP c-client Remote Format String Vulnerability</topic>
 <affects>
 <package>
	<name>imap-uw</name>
	<range><lt>2007e</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/33795">
	 University of Washington IMAP c-client is prone to a remote
	 format-string vulnerability because the software fails to adequately
	 sanitize user-supplied input before passing it as the
	 format-specifier to a formatted-printing function.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>33795</bid>
 </references>
 <dates>
 <discovery>2009-02-17</discovery>
 <entry>2009-05-21</entry>
 <modified>2009-05-22</modified>
 </dates>
 </vuln>

<vuln vid="37a8603d-4494-11de-bea7-000c29a67389">
 <topic>nsd -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>nsd</name>
	<range><lt>3.2.2</lt></range>
 </package>
 <package>
	<name>nsd2</name>
	<range><lt>2.3.7_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NLnet Labs:
	<blockquote cite="http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html">
	 A one-byte buffer overflow has been reported in NSD. The
	 problem affects all versions 2.0.0 to 3.2.1. The bug allows
	 a carefully crafted exploit to bring down your DNS server. It
	 is highly unlikely that this one byte overflow can lead to
	 other (system) exploits.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-1755</cvename>
 <url>http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html</url>
 </references>
 <dates>
 <discovery>2009-05-19</discovery>
 <entry>2009-05-19</entry>
 <modified>2009-05-22</modified>
 </dates>
 </vuln>

<vuln vid="48e14d86-42f1-11de-ad22-000e35248ad7">
 <topic>libxine -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libxine</name>
	<range><lt>1.1.16.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	xine developers report:
	<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=9655&amp;release_id=673233">
	 <ul>
	 <li>Fix another possible int overflow in the 4XM demuxer.
	 (ref. TKADV2009-004, CVE-2009-0385)</li>
	 <li>Fix an integer overflow in the Quicktime demuxer.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0385</cvename>
 <cvename>CVE-2009-1274</cvename>
 <url>http://trapkit.de/advisories/TKADV2009-004.txt</url>
 <url>http://trapkit.de/advisories/TKADV2009-005.txt</url>
 <url>http://sourceforge.net/project/shownotes.php?release_id=660071</url>
 </references>
 <dates>
 <discovery>2009-04-04</discovery>
 <entry>2009-05-17</entry>
 </dates>
 </vuln>

<vuln vid="51d1d428-42f0-11de-ad22-000e35248ad7">
 <topic>libxine -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libxine</name>
	<range><lt>1.1.16.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple vulnerabilities were fixed in libxine 1.1.16.2.
	Tobias Klein reports:
	<blockquote cite="http://trapkit.de/advisories/TKADV2009-004.txt">
	 FFmpeg contains a type conversion vulnerability while
	 parsing malformed 4X movie files. The vulnerability may be
	 exploited by a (remote) attacker to execute arbitrary code in
	 the context of FFmpeg or an application using the FFmpeg
	 library.
	 Note: A similar issue also affects xine-lib &lt; version
	 1.1.16.2.
	</blockquote>
	xine developers report:
	<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=9655&amp;release_id=660071">
	 <ul>
	 <li>Fix broken size checks in various input plugins (ref.
	 CVE-2008-5239).</li>
	 <li>More malloc checking (ref. CVE-2008-5240).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0698</cvename>
 <cvename>CVE-2008-5234</cvename>
 <cvename>CVE-2008-5240</cvename>
 <url>http://trapkit.de/advisories/TKADV2009-004.txt</url>
 <url>http://sourceforge.net/project/shownotes.php?release_id=660071</url>
 </references>
 <dates>
 <discovery>2009-02-15</discovery>
 <entry>2009-05-17</entry>
 </dates>
 </vuln>

<vuln vid="1e8031be-4258-11de-b67a-0030843d3802">
 <topic>php -- ini database truncation inside dba_replace() function</topic>
 <affects>
 <package>
	<name>php4-dba</name>
	<range><lt>4.4.9_1</lt></range>
 </package>
 <package>
	<name>php5-dba</name>
	<range><lt>5.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	securityfocus research reports:
	<blockquote cite="http://www.securityfocus.com/archive/1/498746/30/0/threaded">
	 A bug that leads to the emptying of the INI file contents if
	 the database key was not found exists in PHP dba extension in
	 versions 5.2.6, 4.4.9 and earlier.
	 Function dba_replace() are not filtering strings key and value.
	 There is a possibility for the destruction of the file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-7068</cvename>
 <url>http://www.securityfocus.com/archive/1/498746/30/0/threaded</url>
 <url>http://securityreason.com/achievement_securityalert/58</url>
 </references>
 <dates>
 <discovery>2008-11-28</discovery>
 <entry>2009-05-16</entry>
 <modified>2013-06-16</modified>
 </dates>
 </vuln>

<vuln vid="6a245f31-4254-11de-b67a-0030843d3802">
 <topic>libwmf -- embedded GD library Use-After-Free vulnerability</topic>
 <affects>
 <package>
	<name>libwmf</name>
	<range><lt>0.2.8.4_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/34901">
	 A vulnerability has been reported in libwmf, which can be exploited
	 by malicious people to cause a DoS (Denial of Service) or compromise
	 an application using the library.
	 The vulnerability is caused due to a use-after-free error within the
	 embedded GD library, which can be exploited to cause a crash or
	 potentially to execute arbitrary code via a specially crafted WMF
	 file.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>34792</bid>
 <cvename>CVE-2009-1364</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=496864</url>
 <url>https://rhn.redhat.com/errata/RHSA-2009-0457.html</url>
 <url>http://secunia.com/advisories/34901/</url>
 </references>
 <dates>
 <discovery>2009-05-05</discovery>
 <entry>2009-05-16</entry>
 </dates>
 </vuln>

<vuln vid="48aab1d0-4252-11de-b67a-0030843d3802">
 <topic>libwmf -- integer overflow vulnerability</topic>
 <affects>
 <package>
	<name>libwmf</name>
	<range><lt>0.2.8.4_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/20921">
	 infamous41md has reported a vulnerability in libwmf, which
	 potentially can be exploited by malicious people to compromise an
	 application using the vulnerable library.
	 The vulnerability is caused due to an integer overflow error when
	 allocating memory based on a value taken directly from a WMF file
	 without performing any checks. This can be exploited to cause a
	 heap-based buffer overflow when a specially crafted WMF file is
	 processed.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>18751</bid>
 <cvename>CVE-2006-3376</cvename>
 <url>http://secunia.com/advisories/20921/</url>
 </references>
 <dates>
 <discovery>2006-07-03</discovery>
 <entry>2009-05-16</entry>
 </dates>
 </vuln>

<vuln vid="bfe218a5-4218-11de-b67a-0030843d3802">
 <topic>moinmoin -- cross-site scripting vulnerabilities</topic>
 <affects>
 <package>
	<name>moinmoin</name>
	<range><lt>1.8.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/34821/">
	 Input passed via multiple parameters to action/AttachFile.py is not
	 properly sanitised before being returned to the user. This can be
	 exploited to execute arbitrary HTML and script code in a user's
	 browser session in the context of an affected site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-1482</cvename>
 <url>http://secunia.com/advisories/34821/</url>
 <url>http://moinmo.in/SecurityFixes</url>
 </references>
 <dates>
 <discovery>2009-04-21</discovery>
 <entry>2009-05-16</entry>
 </dates>
 </vuln>

<vuln vid="4a638895-41b7-11de-b1cc-00219b0fc4d8">
 <topic>mod_perl -- cross-site scripting</topic>
 <affects>
 <package>
	<name>mod_perl</name>
	<range><lt>1.31</lt></range>
 </package>
 <package>
	<name>mod_perl2</name>
	<range><lt>2.05</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/3459796">
	 Certain input passed to the "Apache::Status" and "Apache2::Status"
	 modules is not properly sanitised before being returned to the user.
	 This can be exploited to execute arbitrary HTML and script code in a
	 user's browser session in context of an affected website.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0796</cvename>
 <url>http://secunia.com/advisories/34597</url>
 </references>
 <dates>
 <discovery>2009-02-28</discovery>
 <entry>2009-05-16</entry>
 <modified>2009-05-16</modified>
 </dates>
 </vuln>

<vuln vid="a6605f4b-4067-11de-b444-001372fd0af2">
 <topic>drupal -- cross-site scripting</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.18</lt></range>
 </package>
 <package>
	<name>drupal6</name>
	<range><lt>6.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Security Team reports:
	<blockquote cite="http://drupal.org/node/461886">
	 When outputting user-supplied data Drupal strips potentially
	 dangerous HTML attributes and tags or escapes characters which
	 have a special meaning in HTML. This output filtering secures the
	 site against cross site scripting attacks via user input.
	 Certain byte sequences that are valid in the UTF-8 specification
	 are potentially dangerous when interpreted as UTF-7. Internet
	 Explorer 6 and 7 may decode these characters as UTF-7 if they
	 appear before the &lt;meta http-equiv="Content-Type" /&gt; tag that
	 specifies the page content as UTF-8, despite the fact that Drupal
	 also sends a real HTTP header specifying the content as UTF-8.
	 This enables attackers to execute cross site scripting attacks
	 with UTF-7. SA-CORE-2009-005 - Drupal core - Cross site scripting
	 contained an incomplete fix for the issue. HTML exports of books
	 are still vulnerable, which means that anyone with edit
	 permissions for pages in outlines is able to insert arbitrary HTML
	 and script code in these exports.
	 Additionally, the taxonomy module allows users with the
	 'administer taxonomy' permission to inject arbitrary HTML and
	 script code in the help text of any vocabulary.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://drupal.org/node/461886</url>
 <url>http://secunia.com/advisories/35045</url>
 </references>
 <dates>
 <discovery>2009-05-13</discovery>
 <entry>2009-05-14</entry>
 <modified>2009-05-16</modified>
 </dates>
 </vuln>

<vuln vid="14ab174c-40ef-11de-9fd5-001bd3385381">
 <topic>cyrus-sasl -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>cyrus-sasl</name>
	<range><lt>2.1.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US-CERT reports:
	<blockquote cite="http://www.kb.cert.org/vuls/id/238019">
	 The sasl_encode64() function converts a string into
	 base64. The Cyrus SASL library contains buffer overflows
	 that occur because of unsafe use of the sasl_encode64()
	 function.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0688</cvename>
 <url>http://www.kb.cert.org/vuls/id/238019</url>
 </references>
 <dates>
 <discovery>2009-04-08</discovery>
 <entry>2009-05-15</entry>
 </dates>
 </vuln>

<vuln vid="fc4d0ae8-3fa3-11de-a3fd-0030843d3802">
 <topic>moinmoin -- multiple cross site scripting vulnerabilities</topic>
 <affects>
 <package>
	<name>moinmoin</name>
	<range><lt>1.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33593/">
	 Some vulnerabilities have been reported in MoinMoin, which can be
	 exploited by malicious people to conduct cross-site scripting attacks.
	 Input passed to multiple parameters in action/AttachFile.py is not
	 properly sanitised before being returned to the user. This can be
	 exploited to execute arbitrary HTML and script code in a user's
	 browser session in the context of an affected site.
	 Certain input passed to security/antispam.py is not properly
	 sanitised before being returned to the user. This can be exploited to
	 execute arbitrary HTML and script code in a user's browser session in
	 the context of an affected site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0260</cvename>
 <cvename>CVE-2009-0312</cvename>
 <url>http://moinmo.in/SecurityFixes</url>
 <url>http://secunia.com/advisories/33593</url>
 </references>
 <dates>
 <discovery>2009-01-21</discovery>
 <entry>2009-05-13</entry>
 </dates>
 </vuln>

<vuln vid="f0f97b94-3f95-11de-a3fd-0030843d3802">
 <topic>ghostscript -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>ghostscript8</name>
	<name>ghostscript8-nox11</name>
	<range><lt>8.64</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/34340/discuss">
	 Ghostscript is prone to a remote buffer-overflow vulnerability
	 because it fails to properly bounds-check user-supplied input before
	 copying it into a finite-sized buffer.
	 Exploiting this issue allows remote attackers to overwrite a
	 sensitive memory buffer with arbitrary data, potentially allowing them
	 to execute malicious machine code in the context of the affected
	 application. This vulnerability may facilitate the compromise of
	 affected computers.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>34340</bid>
 <cvename>CVE-2008-6679</cvename>
 </references>
 <dates>
 <discovery>2009-02-03</discovery>
 <entry>2009-05-13</entry>
 </dates>
 </vuln>

<vuln vid="4b172278-3f46-11de-becb-001cc0377035">
 <topic>pango -- integer overflow</topic>
 <affects>
 <package>
	<name>pango</name>
	<name>linux-pango</name>
	<name>linux-f8-pango</name>
	<name>linux-f10-pango</name>
	<range><lt>1.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	oCERT reports:
	<blockquote cite="http://www.ocert.org/advisories/ocert-2009-001.html">
	 Pango suffers from a multiplicative integer overflow which
	 may lead to a potentially exploitable, heap overflow depending
	 on the calling conditions.
	 For example, this vulnerability is remotely reachable in Firefox
	 by creating an overly large document.location value but only results
	 in a process-terminating, allocation error (denial of service).
	 The affected function is pango_glyph_string_set_size. An overflow
	 check when doubling the size neglects the overflow possible on the
	 subsequent allocation.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>34870</bid>
 <cvename>CVE-2009-1194</cvename>
 <url>http://secunia.com/advisories/35021/</url>
 </references>
 <dates>
 <discovery>2009-02-22</discovery>
 <entry>2009-05-13</entry>
 <modified>2009-10-01</modified>
 </dates>
 </vuln>

<vuln vid="defce068-39aa-11de-a493-001b77d09812">
 <topic>wireshark -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<range><lt>1.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wireshark team reports:
	<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2009-02.html">
	 Wireshark 1.0.7 fixes the following vulnerabilities:
	 <ul>
	 <li>The PROFINET dissector was vulnerable to a format
	 string overflow. (Bug 3382) Versions affected: 0.99.6 to
	 1.0.6, CVE-2009-1210.</li>
	 <li>The Check Point High-Availability Protocol (CPHAP)
	 dissector could crash. (Bug 3269) Versions affected: 0.9.6
	 to 1.0.6; CVE-2009-1268.</li>
	 <li>Wireshark could crash while loading a Tektronix .rf5
	 file. (Bug 3366) Versions affected: 0.99.6 to 1.0.6,
	 CVE-2009-1269.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>34291</bid>
 <bid>34457</bid>
 <cvename>CVE-2009-1210</cvename>
 <cvename>CVE-2009-1268</cvename>
 <cvename>CVE-2009-1269</cvename>
 <url>http://www.wireshark.org/security/wnpa-sec-2009-02.html</url>
 <url>http://secunia.com/advisories/34542</url>
 </references>
 <dates>
 <discovery>2009-04-06</discovery>
 <entry>2009-05-09</entry>
 <modified>2009-05-13</modified>
 </dates>
 </vuln>

<vuln vid="736e55bc-39bb-11de-a493-001b77d09812">
 <topic>cups -- remote code execution and DNS rebinding</topic>
 <affects>
 <package>
	<name>cups-base</name>
	<range><lt>1.3.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gentoo security team summarizes:
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200904-20.xml">
	 The following issues were reported in CUPS:
	 <ul>
	 <li>iDefense reported an integer overflow in the
	 _cupsImageReadTIFF() function in the "imagetops" filter,
	 leading to a heap-based buffer overflow (CVE-2009-0163).</li>
	 <li>Aaron Siegel of Apple Product Security reported that the
	 CUPS web interface does not verify the content of the "Host"
	 HTTP header properly (CVE-2009-0164).</li>
	 <li>Braden Thomas and Drew Yao of Apple Product Security
	 reported that CUPS is vulnerable to CVE-2009-0146,
	 CVE-2009-0147 and CVE-2009-0166, found earlier in xpdf and
	 poppler.</li>
	 </ul>
	 A remote attacker might send or entice a user to send a
	 specially crafted print job to CUPS, possibly resulting in the
	 execution of arbitrary code with the privileges of the
	 configured CUPS user -- by default this is "lp", or a Denial
	 of Service. Furthermore, the web interface could be used to
	 conduct DNS rebinding attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>34571</bid>
 <bid>34665</bid>
 <bid>34568</bid>
 <cvename>CVE-2009-0163</cvename>
 <cvename>CVE-2009-0164</cvename>
 <cvename>CVE-2009-0146</cvename>
 <cvename>CVE-2009-0147</cvename>
 <cvename>CVE-2009-0166</cvename>
 <url>http://www.cups.org/articles.php?L582</url>
 </references>
 <dates>
 <discovery>2009-05-05</discovery>
 <entry>2009-05-07</entry>
 <modified>2009-05-13</modified>
 </dates>
 </vuln>

<vuln vid="fbc8413f-2f7a-11de-9a3f-001b77d09812">
 <topic>FreeBSD -- remotely exploitable crash in OpenSSL</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_10</lt></range>
	<range><ge>6.4</ge><lt>6.4_4</lt></range>
	<range><ge>7.0</ge><lt>7.0_12</lt></range>
	<range><ge>7.1</ge><lt>7.1_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	 The function ASN1_STRING_print_ex does not properly validate
	 the lengths of BMPString or UniversalString objects before
	 attempting to print them.
	<h1>Impact</h1>
	 An application which attempts to print a BMPString or
	 UniversalString which has an invalid length will crash as a
	 result of OpenSSL accessing invalid memory locations. This
	 could be used by an attacker to crash a remote application.
	<h1>Workaround</h1>
	 No workaround is available, but applications which do not use
	 the ASN1_STRING_print_ex function (either directly or indirectly)
	 are not affected.
 </body>
 </description>
 <references>
 <freebsdsa>SA-09:08.openssl</freebsdsa>
 <cvename>CVE-2009-0590</cvename>
 </references>
 <dates>
 <discovery>2009-03-25</discovery>
 <entry>2009-05-07</entry>
 <modified>2009-05-13</modified>
 </dates>
 </vuln>

<vuln vid="2748fdde-3a3c-11de-bbc5-00e0815b8da8">
 <topic>quagga -- Denial of Service</topic>
 <affects>
 <package>
	<name>quagga</name>
	<range><lt>0.99.11_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian Security Team reports:
	<blockquote cite="http://www.securityfocus.com/archive/1/503220">
	 It was discovered that Quagga, an IP routing daemon, could
	 no longer process the Internet routing table due to broken
	 handling of multiple 4-byte AS numbers in an AS path. If such
	 a prefix is received, the BGP daemon crashes with an assert
	 failure leading to a denial of service.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>34656</bid>
 <mlist msgid="Pine.LNX.4.64.0904301931590.24373@nacho.alt.net">http://lists.quagga.net/pipermail/quagga-dev/2009-April/006541.html</mlist>
 <cvename>CVE-2009-1572</cvename>
 </references>
 <dates>
 <discovery>2009-05-04</discovery>
 <entry>2009-05-06</entry>
 <modified>2009-05-07</modified>
 </dates>
 </vuln>

<vuln vid="e3e30d99-58a8-4a3f-8059-a8b7cd59b881">
 <topic>openfire -- Openfire No Password Changes Security Bypass</topic>
 <affects>
 <package>
	<name>openfire</name>
	<range><lt>3.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/34984/">
	 A vulnerability has been reported in Openfire which can
	 be exploited by malicious users to bypass certain security
	 restrictions. The vulnerability is caused due to Openfire
	 not properly respecting the no password changes setting which
	 can be exploited to change passwords by sending jabber:iq:auth
	 passwd_change requests to the server.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-1596</cvename>
 <url>http://secunia.com/advisories/34984/</url>
 <url>http://www.igniterealtime.org/issues/browse/JM-1532</url>
 <url>http://www.igniterealtime.org/community/message/190288#190288</url>
 </references>
 <dates>
 <discovery>2009-05-04</discovery>
 <entry>2009-05-04</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="7a1ab8d4-35c1-11de-9672-0030843d3802">
 <topic>drupal -- cross site scripting</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.17</lt></range>
 </package>
 <package>
	<name>drupal6</name>
	<range><lt>6.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Security Team reports:
	<blockquote cite="http://drupal.org/node/449078">
	 When outputting user-supplied data Drupal strips potentially
	 dangerous HTML attributes and tags or escapes characters which have a
	 special meaning in HTML. This output filtering secures the site
	 against cross site scripting attacks via user input.
	 Certain byte sequences that are valid in the UTF-8 specification
	 are potentially dangerous when interpreted as UTF-7. Internet Explorer
	 6 and 7 may decode these characters as UTF-7 if they appear before the
	 meta http-equiv="Content-Type" tag that specifies the page content
	 as UTF-8, despite the fact that Drupal also sends a real HTTP header
	 specifying the content as UTF-8. This behaviour enables malicious
	 users to insert and execute Javascript in the context of the website
	 if site visitors are allowed to post content.
	 In addition, Drupal core also has a very limited information
	 disclosure vulnerability under very specific conditions. If a user is
	 tricked into visiting the site via a specially crafted URL and then
	 submits a form (such as the search box) from that page, the
	 information in their form submission may be directed to a third-party
	 site determined by the URL and thus disclosed to the third party. The
	 third party site may then execute a CSRF attack against the submitted
	 form.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-1575</cvename>
 <cvename>CVE-2009-1576</cvename>
 <url>http://drupal.org/node/449078</url>
 </references>
 <dates>
 <discovery>2009-04-30</discovery>
 <entry>2009-04-30</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="3b18e237-2f15-11de-9672-0030843d3802">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>2.0.0.20_7,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.9,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.9</lt></range>
 </package>
 <package>
	<name>linux-seamonkey-devel</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.17</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2009-22: Firefox allows Refresh header to redirect to
	 javascript: URIs
	 MFSA 2009-21: POST data sent to wrong site when saving web page
	 with embedded frame
	 MFSA 2009-20: Malicious search plugins can inject code into
	 arbitrary sites
	 MFSA 2009-19: Same-origin violations in XMLHttpRequest and
	 XPCNativeWrapper.toString
	 MFSA 2009-18: XSS hazard using third-party stylesheets and XBL
	 bindings
	 MFSA 2009-17: Same-origin violations when Adobe Flash loaded via
	 view-source: scheme
	 MFSA 2009-16: jar: scheme ignores the content-disposition: header
	 on the inner URI
	 MFSA 2009-15: URL spoofing with box drawing character
	 MFSA 2009-14 Crashes with evidence of memory corruption
	 (rv:1.9.0.9)
	</blockquote>
 </body>
 </description>
 <references>
 <bid>34656</bid>
 <cvename>CVE-2009-1303</cvename>
 <cvename>CVE-2009-1306</cvename>
 <cvename>CVE-2009-1307</cvename>
 <cvename>CVE-2009-1308</cvename>
 <cvename>CVE-2009-1309</cvename>
 <cvename>CVE-2009-1312</cvename>
 <cvename>CVE-2009-1311</cvename>
 <cvename>CVE-2009-1302</cvename>
 <cvename>CVE-2009-1304</cvename>
 <cvename>CVE-2009-1305</cvename>
 <cvename>CVE-2009-1310</cvename>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-22.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-21.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-20.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-19.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-18.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-17.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-16.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-15.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-14.html</url>
 </references>
 <dates>
 <discovery>2009-04-21</discovery>
 <entry>2009-04-22</entry>
 <modified>2009-12-12</modified>
 </dates>
 </vuln>

<vuln vid="50d233d9-374b-46ce-922d-4e6b3f777bef">
 <topic>poppler -- Poppler Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>poppler</name>
	<range><lt>0.10.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite=" http://secunia.com/advisories/34746/">
	 Some vulnerabilities have been reported in Poppler which can be
	 exploited by malicious people to potentially compromise an
	 application using the library.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/34746/</url>
 </references>
 <dates>
 <discovery>2009-04-17</discovery>
 <entry>2009-04-18</entry>
 </dates>
 </vuln>

<vuln vid="a21037d5-2c38-11de-ab3b-0017a4cccfc6">
 <topic>xpdf -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xpdf</name>
	<range><lt>3.02_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://www.vupen.com/english/advisories/2009/1065">
	 Some vulnerabilities have been reported in Xpdf, which can be
	 exploited by malicious people to potentially compromise a user's
	 system.
	 A boundary error exists when decoding JBIG2 symbol dictionary
	 segments. This can be exploited to cause a heap-based buffer
	 overflow and potentially execute arbitrary code.
	 Multiple integer overflows in the JBIG2 decoder can be
	 exploited to potentially execute arbitrary code.
	 Multiple boundary errors in the JBIG2 decoder can be
	 exploited to cause buffer overflows and potentially execute
	 arbitrary code.
	 Multiple errors in the JBIG2 decoder can be exploited can be
	 exploited to free arbitrary memory and potentially execute arbitrary
	 code.
	 Multiple unspecified input validation errors in the JBIG2 decoder can
	 be exploited to potentially execute arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0146</cvename>
 <cvename>CVE-2009-0147</cvename>
 <cvename>CVE-2009-0166</cvename>
 <cvename>CVE-2009-0799</cvename>
 <cvename>CVE-2009-0800</cvename>
 <cvename>CVE-2009-1179</cvename>
 <cvename>CVE-2009-1180</cvename>
 <cvename>CVE-2009-1181</cvename>
 <cvename>CVE-2009-1182</cvename>
 <cvename>CVE-2009-1183</cvename>
 <url>http://secunia.com/advisories/34291</url>
 <url>http://www.vupen.com/english/advisories/2009/1065</url>
 </references>
 <dates>
 <discovery>2009-04-16</discovery>
 <entry>2009-04-18</entry>
 <modified>2009-04-18</modified>
 </dates>
 </vuln>

<vuln vid="20b4f284-2bfc-11de-bdeb-0030843d3802">
 <topic>freetype2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>freetype2</name>
	<range><lt>2.3.9_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/34723/">
	 Some vulnerabilities have been reported in FreeType, which can be
	 exploited by malicious people to potentially compromise an application
	 using the library.
	 An integer overflow error within the "cff_charset_compute_cids()"
	 function in cff/cffload.c can be exploited to potentially cause a
	 heap-based buffer overflow via a specially crafted font.
	 Multiple integer overflow errors within validation functions in
	 sfnt/ttcmap.c can be exploited to bypass length validations and
	 potentially cause buffer overflows via specially crafted fonts.
	 An integer overflow error within the "ft_smooth_render_generic()"
	 function in smooth/ftsmooth.c can be exploited to potentially cause a
	 heap-based buffer overflow via a specially crafted font.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0946</cvename>
 <url>http://secunia.com/advisories/34723/</url>
 </references>
 <dates>
 <discovery>2009-04-16</discovery>
 <entry>2009-04-18</entry>
 </dates>
 </vuln>

<vuln vid="cf91c1e4-2b6d-11de-931b-00e0815b8da8">
 <topic>ejabberd -- cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>ejabberd</name>
	<range><lt>2.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/34133">
	 The ejabberd application is prone to a cross-site scripting
	 vulnerability.
	 An attacker may leverage this issue to execute arbitrary script code
	 in the browser of an unsuspecting user in the context of the affected
	 site and to steal cookie-based authentication credentials.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>34133</bid>
 <cvename>CVE-2009-0934</cvename>
 </references>
 <dates>
 <discovery>2009-03-16</discovery>
 <entry>2009-04-17</entry>
 </dates>
 </vuln>

<vuln vid="872ae5be-29c0-11de-bdeb-0030843d3802">
 <topic>ziproxy -- multiple vulnerability</topic>
 <affects>
 <package>
	<name>ziproxy</name>
	<range><lt>2.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ziproxy Developers reports:
	<blockquote cite="http://www.kb.cert.org/vuls/id/MAPG-7N9GN8">
	 Multiple HTTP proxy implementations are prone to an
	 information-disclosure vulnerability related to the interpretation of
	 the 'Host' HTTP header. Specifically, this issue occurs when the proxy
	 makes a forwarding decision based on the 'Host' HTTP header instead of
	 the destination IP address.
	 Attackers may exploit this issue to obtain sensitive information
	 such as internal intranet webpages. Additional attacks may also be
	 possible.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>33858</bid>
 <cvename>CVE-2009-0804</cvename>
 <url>http://www.kb.cert.org/vuls/id/MAPG-7N9GN8</url>
 </references>
 <dates>
 <discovery>2009-02-23</discovery>
 <entry>2009-04-15</entry>
 </dates>
 </vuln>

<vuln vid="1a0e4cc6-29bf-11de-bdeb-0030843d3802">
 <topic>phpmyadmin -- insufficient output sanitizing when generating configuration file</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>3.1.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpMyAdmin Team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php">
	 Setup script used to generate configuration can be fooled using a
	 crafted POST request to include arbitrary PHP code in generated
	 configuration file. Combined with ability to save files on server,
	 this can allow unauthenticated users to execute arbitrary PHP code.
	 This issue is on different parameters than PMASA-2009-3 and it was
	 missed out of our radar because it was not existing in 2.11.x
	 branch.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-1285</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php</url>
 </references>
 <dates>
 <discovery>2009-04-14</discovery>
 <entry>2009-04-15</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="03d22656-2690-11de-8226-0030843d3802">
 <topic>drupal6-cck -- cross-site scripting</topic>
 <affects>
 <package>
	<name>drupal6-cck</name>
	<range><lt>2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal CCK plugin developer reports:
	<blockquote cite="http://drupal.org/node/406520">
	 The Node reference and User reference sub-modules, which
	 are part of the Content Construction Kit (CCK) project, lets
	 administrators define node fields that are references to other
	 nodes or to users. When displaying a node edit form, the
	 titles of candidate referenced nodes or names of candidate
	 referenced users are not properly filtered, allowing malicious
	 users to inject arbitrary code on those pages. Such a cross
	 site scripting (XSS) attack may lead to a malicious user
	 gaining full administrative access.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>34172</bid>
 <cvename>CVE-2009-1069</cvename>
 <url>http://drupal.org/node/406520</url>
 </references>
 <dates>
 <discovery>2009-03-23</discovery>
 <entry>2009-04-11</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="0fe73a4a-1b18-11de-8226-0030843d3802">
 <topic>pivot-weblog -- file deletion vulnerability</topic>
 <affects>
 <package>
	<name>pivot-weblog</name>
	<range><lt>1.40.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/34302">
	 A vulnerability has been discovered in Pivot, which can be
	 exploited by malicious people to delete certain files.
	 Input passed to the "refkey" parameter in
	 extensions/bbclone_tools/count.php is not properly sanitised
	 before being used to delete files. This can be exploited to
	 delete files with the permissions of the web server via directory
	 traversal sequences passed within the "refkey" parameter.
	 NOTE: Users with the "Advanced" user level are able to include and
	 execute uploaded PHP code via the "pivot_path" parameter in
	 extensions/bbclone_tools/getkey.php when
	 extensions/bbclone_tools/hr_conf.php can be deleted.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>34160</bid>
 <url>http://secunia.com/advisories/34302/</url>
 </references>
 <dates>
 <discovery>2009-03-18</discovery>
 <entry>2009-03-27</entry>
 </dates>
 </vuln>

<vuln vid="06f9174f-190f-11de-b2f0-001c2514716c">
 <topic>phpmyadmin -- insufficient output sanitizing when generating configuration file</topic>
 <affects>
 <package>
	<name>phpMyAdmin211</name>
	<range><lt>2.11.9.5</lt></range>
 </package>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>3.1.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpMyAdmin reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php">
	 Setup script used to generate configuration can be fooled
	 using a crafted POST request to include arbitrary PHP code
	 in generated configuration file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-1151</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php</url>
 </references>
 <dates>
 <discovery>2009-03-24</discovery>
 <entry>2009-03-25</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="6bb6188c-17b2-11de-ae4d-0030843d3802">
 <topic>amarok -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>amarok</name>
	<range><lt>1.4.10_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33505">
	 Tobias Klein has reported some vulnerabilities in Amarok, which
	 potentially can be exploited by malicious people to compromise a
	 user's system.
	 Two integer overflow errors exist within the
	 "Audible::Tag::readTag()" function in
	 src/metadata/audible/audibletag.cpp. These can be exploited to cause
	 heap-based buffer overflows via specially crafted Audible Audio
	 files.
	 Two errors within the "Audible::Tag::readTag()" function in
	 src/metadata/audible/audibletag.cpp can be exploited to corrupt
	 arbitrary memory via specially crafted Audible Audio files.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>33210</bid>
 <cvename>CVE-2009-0135</cvename>
 <cvename>CVE-2009-0136</cvename>
 <url>http://www.debian.org/security/2009/dsa-1706</url>
 <url>http://secunia.com/advisories/33505</url>
 </references>
 <dates>
 <discovery>2009-01-12</discovery>
 <entry>2009-03-23</entry>
 </dates>
 </vuln>

<vuln vid="f6f19735-9245-4918-8a60-87948ebb4907">
 <topic>wireshark -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<range><lt>1.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Vendor reports:
	<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2009-01.html">
	 On non-Windows systems Wireshark could crash if the HOME
	 environment variable contained sprintf-style string formatting
	 characters. Wireshark could crash while reading a malformed
	 NetScreen snoop file. Wireshark could crash while reading a
	 Tektronix K12 text capture file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0599</cvename>
 <cvename>CVE-2009-0600</cvename>
 <cvename>CVE-2009-0601</cvename>
 <url>http://www.wireshark.org/security/wnpa-sec-2009-01.html</url>
 </references>
 <dates>
 <discovery>2009-02-06</discovery>
 <entry>2009-03-22</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="72cba7b0-13cd-11de-a964-0030843d3802">
 <topic>netatalk -- arbitrary command execution in papd daemon</topic>
 <affects>
 <package>
	<name>netatalk</name>
	<range><lt>2.0.3_5,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33227/">
	 A vulnerability has been reported in Netatalk, which potentially
	 can be exploited by malicious users to compromise a vulnerable system.
	 The vulnerability is caused due to the papd daemon improperly
	 sanitising several received parameters before passing them in a call
	 to popen(). This can be exploited to execute arbitrary commands via
	 a specially crafted printing request.
	 Successful exploitation requires that a printer is configured to
	 pass arbitrary values as parameters to a piped command.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>32925</bid>
 <cvename>CVE-2008-5718</cvename>
 <url>http://secunia.com/advisories/33227/</url>
 <url>http://www.openwall.com/lists/oss-security/2009/01/13/3</url>
 </references>
 <dates>
 <discovery>2008-12-19</discovery>
 <entry>2009-03-18</entry>
 <modified>2009-03-18</modified>
 </dates>
 </vuln>

<vuln vid="37a365ed-1269-11de-a964-0030843d3802">
 <topic>gstreamer-plugins-good -- multiple memory overflows</topic>
 <affects>
 <package>
	<name>gstreamer-plugins-good</name>
	<range><ge>0.10.9,3</ge><lt>0.10.12,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33650/">
	 Tobias Klein has reported some vulnerabilities in GStreamer Good
	 Plug-ins, which can potentially be exploited by malicious people to
	 compromise a vulnerable system.
	 A boundary error occurs within the "qtdemux_parse_samples()"
	 function in gst/gtdemux/qtdemux.c when performing QuickTime "ctts"
	 Atom parsing. This can be exploited to cause a heap-based buffer
	 overflow via a specially crafted QuickTime media file.
	 An array indexing error exists in the "qtdemux_parse_samples()"
	 function in gst/gtdemux/qtdemux.c when performing QuickTime "stss"
	 Atom parsing. This can be exploited to corrupt memory via a specially
	 crafted QuickTime media file.
	 A boundary error occurs within the "qtdemux_parse_samples()"
	 function in gst/gtdemux/qtdemux.c when performing QuickTime "stts"
	 Atom parsing. This can be exploited to cause a heap-based buffer
	 overflow via a specially crafted QuickTime media file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0386</cvename>
 <cvename>CVE-2009-0387</cvename>
 <cvename>CVE-2009-0397</cvename>
 <url>http://secunia.com/advisories/33650/</url>
 <url>http://trapkit.de/advisories/TKADV2009-003.txt</url>
 <url>http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html</url>
 </references>
 <dates>
 <discovery>2009-01-22</discovery>
 <entry>2009-03-16</entry>
 </dates>
 </vuln>

<vuln vid="c5af0747-1262-11de-a964-0030843d3802">
 <topic>libsndfile -- CAF processing integer overflow vulnerability</topic>
 <affects>
 <package>
	<name>libsndfile</name>
	<range><lt>1.0.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33980/">
	 The vulnerability is caused due to an integer overflow error in the
	 processing of CAF description chunks. This can be exploited to cause a
	 heap-based buffer overflow by tricking the user into processing a
	 specially crafted CAF audio file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0186</cvename>
 <url>http://secunia.com/advisories/33980/</url>
 </references>
 <dates>
 <discovery>2009-03-03</discovery>
 <entry>2009-03-16</entry>
 </dates>
 </vuln>

<vuln vid="6733e1bf-125f-11de-a964-0030843d3802">
 <topic>ffmpeg -- 4xm processing memory corruption vulnerability</topic>
 <affects>
 <package>
	<name>ffmpeg</name>
	<range><lt>2008.07.27_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33711/">
	 Tobias Klein has reported a vulnerability in FFmpeg, which
	 potentially can be exploited by malicious people to compromise an
	 application using the library.
	 The vulnerability is caused due to a signedness error within the
	 "fourxm_read_header()" function in libavformat/4xm.c. This can be
	 exploited to corrupt arbitrary memory via a specially crafted 4xm
	 file.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>33502</bid>
 <cvename>CVE-2009-0385</cvename>
 <url>http://secunia.com/advisories/33711/</url>
 <url>http://trapkit.de/advisories/TKADV2009-004.txt</url>
 </references>
 <dates>
 <discovery>2009-01-28</discovery>
 <entry>2009-03-16</entry>
 </dates>
 </vuln>

<vuln vid="35c0b572-125a-11de-a964-0030843d3802">
 <topic>roundcube -- webmail script insertion and php code injection</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><lt>0.2.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33622/">
	 Some vulnerabilities have been reported in RoundCube Webmail, which
	 can be exploited by malicious users to compromise a vulnerable system
	 and by malicious people to conduct script insertion attacks and
	 compromise a vulnerable system.
	 The HTML "background" attribute within e.g. HTML emails is not
	 properly sanitised before being used. This can be exploited to execute
	 arbitrary HTML and script code in a user's browser session in context
	 of an affected site if a malicious email is viewed.
	 Input passed via a vCard is not properly sanitised before being
	 used in a call to "preg_replace()" with the "e" modifier in
	 program/include/rcube_vcard.php. This can be exploited to inject and
	 execute arbitrary PHP code by e.g. tricking a user into importing a
	 malicious vCard file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0413</cvename>
 <url>http://secunia.com/advisories/33622/</url>
 <url>http://sourceforge.net/forum/forum.php?forum_id=927958</url>
 <url>http://trac.roundcube.net/changeset/2245</url>
 <url>http://trac.roundcube.net/ticket/1485689</url>
 </references>
 <dates>
 <discovery>2009-01-21</discovery>
 <entry>2009-03-16</entry>
 <modified>2009-03-26</modified>
 </dates>
 </vuln>

<vuln vid="ca0841ff-1254-11de-a964-0030843d3802">
 <topic>proftpd -- multiple sql injection vulnerabilities</topic>
 <affects>
 <package>
	<name>proftpd</name>
	<name>proftpd-mysql</name>
	<range><lt>1.3.2</lt></range>
 </package>
 <package>
	<name>proftpd-devel</name>
	<range><le>1.3.20080922</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33842/">
	 Some vulnerabilities have been reported in ProFTPD, which can be
	 exploited by malicious people to conduct SQL injection attacks.
	 The application improperly sets the character encoding prior to
	 performing SQL queries. This can be exploited to manipulate SQL
	 queries by injecting arbitrary SQL code in an environment using a
	 multi-byte character encoding.
	 An error exists in the "mod_sql" module when processing e.g. user
	 names containing '%' characters. This can be exploited to bypass input
	 sanitation routines and manipulate SQL queries by injecting arbitrary
	 SQL code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0542</cvename>
 <cvename>CVE-2009-0543</cvename>
 <url>http://secunia.com/advisories/33842/</url>
 <url>http://bugs.proftpd.org/show_bug.cgi?id=3173</url>
 <url>http://bugs.proftpd.org/show_bug.cgi?id=3124</url>
 <url>http://milw0rm.com/exploits/8037</url>
 </references>
 <dates>
 <discovery>2009-02-06</discovery>
 <entry>2009-03-16</entry>
 </dates>
 </vuln>

<vuln vid="03140526-1250-11de-a964-0030843d3802">
 <topic>zabbix -- php frontend multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>zabbix</name>
	<range><lt>1.6.2_1,1</lt></range>
 </package>
 <package>
	<name>zabbix-agent</name>
	<range><lt>1.6.2_1,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/34091/">
	 Some vulnerabilities have been reported in the ZABBIX PHP frontend,
	 which can be exploited by malicious people to conduct cross-site
	 request forgery attacks and malicious users to disclose sensitive
	 information and compromise a vulnerable system.
	 Input appended to and passed via the "extlang" parameter to the
	 "calc_exp2()" function in include/validate.inc.php is not properly
	 sanitised before being used. This can be exploited to inject and
	 execute arbitrary PHP code.
	 The application allows users to perform certain actions via HTTP
	 requests without performing any validity checks to verify the
	 requests. This can be exploited to e.g. create users by enticing a
	 logged in administrator to visit a malicious web page.
	 Input passed to the "srclang" parameter in locales.php (when "next"
	 is set to a non-NULL value) is not properly verified before being used
	 to include files. This can be exploited to include arbitrary files
	 from local resources via directory traversal attacks and URL-encoded
	 NULL bytes.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/34091/</url>
 <url>http://www.ush.it/team/ush/hack-zabbix_162/adv.txt</url>
 </references>
 <dates>
 <discovery>2009-03-04</discovery>
 <entry>2009-03-16</entry>
 <modified>2009-03-23</modified>
 </dates>
 </vuln>

<vuln vid="a2074ac6-124c-11de-a964-0030843d3802">
 <topic>php-mbstring -- php mbstring buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>php4-mbstring</name>
	<range><lt>4.4.9</lt></range>
 </package>
 <package>
	<name>php5-mbstring</name>
	<range><lt>5.2.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/32948">
	 PHP is prone to a buffer-overflow vulnerability because it fails to
	 perform boundary checks before copying user-supplied data to
	 insufficiently sized memory buffers. The issue affects the 'mbstring'
	 extension included in the standard distribution.
	 An attacker can exploit this issue to execute arbitrary machine
	 code in the context of the affected webserver. Failed exploit attempts
	 will likely crash the webserver, denying service to legitimate
	 users.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>32948</bid>
 <cvename>CVE-2008-5557</cvename>
 </references>
 <dates>
 <discovery>2008-12-21</discovery>
 <entry>2009-03-16</entry>
 </dates>
 </vuln>

<vuln vid="4ce3c20b-124b-11de-a964-0030843d3802">
 <topic>phppgadmin -- directory traversal with register_globals enabled</topic>
 <affects>
 <package>
	<name>phppgadmin</name>
	<range><lt>4.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33014">
	 Dun has discovered a vulnerability in phpPgAdmin, which can be
	 exploited by malicious people to disclose sensitive information.
	 Input passed via the "_language" parameter to libraries/lib.inc.php
	 is not properly sanitised before being used to include files. This can
	 be exploited to include arbitrary files from local resources via
	 directory traversal attacks and URL-encoded NULL bytes.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>32670</bid>
 <cvename>CVE-2008-5587</cvename>
 <url>http://secunia.com/advisories/33014</url>
 </references>
 <dates>
 <discovery>2008-12-08</discovery>
 <entry>2009-03-16</entry>
 </dates>
 </vuln>

<vuln vid="8c5205b4-11a0-11de-a964-0030843d3802">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>linux-opera</name>
	<range><lt>9.64</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera Team reports:
	<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/964/">
	 An unspecified error in the processing of JPEG images can be
	 exploited to trigger a memory corruption.
	 An error can be exploited to execute arbitrary script code in a
	 different domain via unspecified plugins.
	 An unspecified error has a "moderately severe" impact. No further
	 information is available.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0914</cvename>
 <cvename>CVE-2009-0915</cvename>
 <url>http://www.opera.com/docs/changelogs/freebsd/964/</url>
 <url>http://secunia.com/advisories/34135/</url>
 </references>
 <dates>
 <discovery>2009-03-15</discovery>
 <entry>2009-03-15</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="e848a92f-0e7d-11de-92de-000bcdc1757a">
 <topic>epiphany -- untrusted search path vulnerability</topic>
 <affects>
 <package>
	<name>epiphany</name>
	<range><lt>2.24.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE Mitre reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5985">
	 Untrusted search path vulnerability in the Python interface in
	 Epiphany 2.22.3, and possibly other versions, allows local users to
	 execute arbitrary code via a Trojan horse Python file in the current
	 working directory, related to a vulnerability in the PySys_SetArgv
	 function (CVE-2008-5983).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5985</cvename>
 <cvename>CVE-2008-5983</cvename>
 </references>
 <dates>
 <discovery>2009-01-26</discovery>
 <entry>2009-03-11</entry>
 </dates>
 </vuln>

<vuln vid="f1892066-0e74-11de-92de-000bcdc1757a">
 <topic>apache -- Cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><gt>2.2.0</gt><lt>2.2.9_2</lt></range>
	<range><gt>2.0.0</gt><lt>2.0.63_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE Mitre reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2939">
	 Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the
	 mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c
	 in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions,
	 allows remote attackers to inject arbitrary web script or HTML via a
	 wildcard in the last directory component in the pathname in an FTP
	 URI.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2939</cvename>
 <url>http://www.rapid7.com/advisories/R7-0033.jsp</url>
 </references>
 <dates>
 <discovery>2008-07-25</discovery>
 <entry>2009-03-11</entry>
 </dates>
 </vuln>

<vuln vid="ea2411a4-08e8-11de-b88a-0022157515b2">
 <topic>pngcrush -- libpng Uninitialised Pointer Arrays Vulnerability</topic>
 <affects>
 <package>
	<name>pngcrush</name>
	<range><lt>1.6.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33976/">
	 A vulnerability has been reported in Pngcrush, which
	 can be exploited by malicious people to potentially
	 compromise a user's system.
	 The vulnerability is caused due to the use of vulnerable
	 libpng code.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>33827</bid>
 <cvename>CVE-2009-0040</cvename>
 <url>http://secunia.com/advisories/33976</url>
 <url>http://xforce.iss.net/xforce/xfdb/48819</url>
 </references>
 <dates>
 <discovery>2009-02-19</discovery>
 <entry>2009-03-04</entry>
 </dates>
 </vuln>

<vuln vid="5d433534-f41c-402e-ade5-e0a2259a7cb6">
 <topic>curl -- cURL/libcURL Location: Redirect URLs Security Bypass</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>5.11</ge><lt>7.19.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/34138/">
	 The security issue is caused due to cURL following HTTP Location:
	 redirects to e.g. scp:// or file:// URLs which can be exploited
	 by a malicious HTTP server to overwrite or disclose the content of
	 arbitrary local files and potentially execute arbitrary commands via
	 specially crafted redirect URLs.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0037</cvename>
 <url>http://secunia.com/advisories/34138/</url>
 </references>
 <dates>
 <discovery>2009-03-03</discovery>
 <entry>2009-03-04</entry>
 </dates>
 </vuln>

<vuln vid="cf495fd4-fdcd-11dd-9a86-0050568452ac">
 <topic>Zend Framework -- Local File Inclusion vulnerability in Zend_View::render()</topic>
 <affects>
 <package>
	<name>ZendFramework</name>
	<range><lt>1.7.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthew Weier O'Phinney reports:
	<blockquote cite="http://weierophinney.net/matthew/archives/206-Zend-Framework-1.7.5-Released-Important-Note-Regarding-Zend_View.html">
	 A potential Local File Inclusion (LFI) vulnerability exists in
	 the Zend_View::render() method. If user input is used to
	 specify the script path, then it is possible to trigger the
	 LFI.
	 Note that Zend Framework applications that never call the
	 Zend_View::render() method with a user-supplied parameter are
	 not affected by this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://framework.zend.com/issues/browse/ZF-5748</url>
 </references>
 <dates>
 <discovery>2009-02-11</discovery>
 <entry>2009-02-18</entry>
 </dates>
 </vuln>

<vuln vid="25eb365c-fd11-11dd-8424-c213de35965d">
 <topic>dia -- remote command execution vulnerability</topic>
 <affects>
 <package>
	<name>dia</name>
	<range><lt>0.96.1_6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Security Focus reports:
	<blockquote cite="http://www.securityfocus.com/bid/33448/">
	 An attacker could exploit this issue by enticing an
	 unsuspecting victim to execute the vulnerable
	 application in a directory containing a malicious
	 Python file. A successful exploit will allow arbitrary
	 Python commands to run within the privileges of the currently
	 logged-in user.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>33448</bid>
 <cvename>CVE-2008-5984</cvename>
 <url>http://secunia.com/advisories/33672</url>
 </references>
 <dates>
 <discovery>2009-01-26</discovery>
 <entry>2009-02-17</entry>
 </dates>
 </vuln>

<vuln vid="5a021595-fba9-11dd-86f3-0030843d3802">
 <topic>pycrypto -- ARC2 module buffer overflow</topic>
 <affects>
 <package>
	<name>py-pycrypto</name>
	<range><lt>2.0.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dwayne C. Litzenberger reports:
	<blockquote cite="http://lists.dlitz.net/pipermail/pycrypto/2009q1/000062.html">
	 pycrypto is exposed to a buffer overflow issue because it fails to
	 adequately verify user-supplied input. This issue resides in the ARC2
	 module. This issue can be triggered with specially crafted ARC2 keys
	 in excess of 128 bytes.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.dlitz.net/pipermail/pycrypto/2009q1/000062.html</url>
 </references>
 <dates>
 <discovery>2009-02-06</discovery>
 <entry>2009-02-15</entry>
 </dates>
 </vuln>

<vuln vid="bcee3989-d106-4f60-948f-835375634710">
 <topic>varnish -- Varnish HTTP Request Parsing Denial of Service</topic>
 <affects>
 <package>
	<name>varnish</name>
	<range><lt>2.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/33712">
	 Varnish is prone to a remote denial-of-service
	 vulnerability because the application fails to handle
	 certain HTTP requests.
	 Successfully exploiting this issue allows remote
	 attackers to crash the affected application denying further
	 service to legitimate users.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>33712</bid>
 <url>http://secunia.com/advisories/33852/</url>
 <url>http://varnish.projects.linpro.no/wiki/WikiStart</url>
 </references>
 <dates>
 <discovery>2008-10-17</discovery>
 <entry>2009-02-14</entry>
 <modified>2009-02-15</modified>
 </dates>
 </vuln>

<vuln vid="78f5606b-f9d1-11dd-b79c-0030843d3802">
 <topic>tor -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>tor</name>
	<range><lt>0.2.0.34</lt></range>
 </package>
 <package>
	<name>tor-devel</name>
	<range><lt>0.2.12-alpha</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33880/">
	 Some vulnerabilities have been reported in Tor, where one has an
	 unknown impact and others can be exploited by malicious people to
	 cause a DoS.
	 An error when running Tor as a directory authority can be exploited
	 to trigger the execution of an infinite loop.
	 An unspecified error exists when running on Windows systems prior
	 to Windows XP. No further information is currently available.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0936</cvename>
 <cvename>CVE-2009-0937</cvename>
 <cvename>CVE-2009-0938</cvename>
 <url>http://secunia.com/advisories/33880/</url>
 <url>http://archives.seul.org/or/announce/Feb-2009/msg00000.html</url>
 </references>
 <dates>
 <discovery>2009-02-10</discovery>
 <entry>2009-02-13</entry>
 <modified>2009-03-20</modified>
 </dates>
 </vuln>

<vuln vid="8b491182-f842-11dd-94d9-0030843d3802">
 <topic>firefox -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>2.0.0.20_3,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.6,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.6</lt></range>
 </package>
 <package>
	<name>linux-seamonkey-devel</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.15</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/firefox30.html">
	 MFSA 2009-06: Directives to not cache pages ignored
	 MFSA 2009-05: XMLHttpRequest allows reading HTTPOnly cookies
	 MFSA 2009-04: Chrome privilege escalation via local .desktop
	 files
	 MFSA 2009-03: Local file stealing with SessionStore
	 MFSA 2009-02: XSS using a chrome XBL method and window.eval
	 MFSA 2009-01: Crashes with evidence of memory corruption (rv:1.9.0.6)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0352</cvename>
 <cvename>CVE-2009-0353</cvename>
 <cvename>CVE-2009-0354</cvename>
 <cvename>CVE-2009-0355</cvename>
 <cvename>CVE-2009-0356</cvename>
 <cvename>CVE-2009-0357</cvename>
 <cvename>CVE-2009-0358</cvename>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-01.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-02.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-03.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-04.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-05.html</url>
 <url>http://www.mozilla.org/security/announce/2009/mfsa2009-06.html</url>
 <url>http://secunia.com/advisories/33799/</url>
 </references>
 <dates>
 <discovery>2009-02-04</discovery>
 <entry>2009-02-11</entry>
 <modified>2009-12-12</modified>
 </dates>
 </vuln>

<vuln vid="83574d5a-f828-11dd-9fdf-0050568452ac">
 <topic>codeigniter -- arbitrary script execution in the new Form Validation class</topic>
 <affects>
 <package>
	<name>codeigniter</name>
	<range><ge>1.7.0</ge><lt>1.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	znirkel reports:
	<blockquote cite="http://secunia.com/advisories/33829/">
	 The eval() function in _reset_post_array crashes when posting
	 certain data. By passing in carefully-crafted input data, the eval()
	 function could also execute malicious PHP code.
	 Note that CodeIgniter applications that either do not use the
	 new Form Validation class or use the old Validation class are not
	 affected by this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://codeigniter.com/bug_tracker/bug/6068/</url>
 </references>
 <dates>
 <discovery>2008-11-28</discovery>
 <entry>2009-02-11</entry>
 </dates>
 </vuln>

<vuln vid="b07f3254-f83a-11dd-85a4-ea653f0746ab">
 <topic>pyblosxom -- atom flavor multiple XML injection vulnerabilities</topic>
 <affects>
 <package>
	<name>pyblosxom</name>
	<range><lt>1.5.r3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Security Focus reports:
	<blockquote cite="http://www.securityfocus.com/bid/33676/">
	 PyBlosxom is prone to multiple XML-injection
	 vulnerabilities because the application fails to
	 properly sanitize user-supplied input before using it
	 in dynamically generated content.
	 Attacker-supplied XML and script code would run in the
	 context of the affected browser, potentially allowing
	 the attacker to steal cookie-based authentication credentials
	 or to control how the site is rendered to the user. Other attacks
	 are also possible.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>33676</bid>
 </references>
 <dates>
 <discovery>2009-02-09</discovery>
 <entry>2009-02-11</entry>
 </dates>
 </vuln>

<vuln vid="cc47fafe-f823-11dd-94d9-0030843d3802">
 <topic>typo3 -- cross-site scripting and information disclosure</topic>
 <affects>
 <package>
	<name>typo3</name>
	<range><lt>4.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33829/">
	 Some vulnerabilities have been reported in Typo3, which can be
	 exploited by malicious people to conduct cross-site scripting attacks
	 and disclose sensitive information.
	 Input passed via unspecified fields to the backend user interface
	 is not properly sanitised before being returned to the user. This can
	 be exploited to execute arbitrary HTML and script code in a user's
	 browser session in context of an affected site.
	 An error in the "jumpUrl" mechanism can be exploited to read
	 arbitrary files from local resources by disclosing a hash secret used
	 to restrict file access.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0815</cvename>
 <cvename>CVE-2009-0816</cvename>
 <url>http://secunia.com/advisories/33829/</url>
 <url>http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/</url>
 </references>
 <dates>
 <discovery>2009-02-10</discovery>
 <entry>2009-02-11</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="a89b76a7-f6bd-11dd-94d9-0030843d3802">
 <topic>amaya -- multiple buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>amaya</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/32848/">
	 A boundary error when processing "div" HTML tags can be exploited
	 to cause a stack-based buffer overflow via an overly long "id"
	 parameter.
	 A boundary error exists when processing overly long links. This can
	 be exploited to cause a stack-based buffer overflow by tricking the
	 user into e.g. editing a malicious link.
	 A boundary error when processing e.g. a "bdo" HTML tag having an
	 overly long "dir" attribute can be exploited to cause a stack-based
	 buffer overflow.
	 A boundary error when processing "input" HTML tags can be
	 exploited to cause a stack-based buffer overflow via an overly long
	 e.g. "type" attribute.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5282</cvename>
 <cvename>CVE-2009-0323</cvename>
 <url>http://secunia.com/advisories/32848/</url>
 <url>http://www.bmgsec.com.au/advisory/41/</url>
 <url>http://www.bmgsec.com.au/advisory/40/</url>
 <url>http://milw0rm.com/exploits/7467</url>
 <url>http://www.coresecurity.com/content/amaya-buffer-overflows</url>
 </references>
 <dates>
 <discovery>2008-11-25</discovery>
 <entry>2009-02-09</entry>
 </dates>
 </vuln>

<vuln vid="71597e3e-f6b8-11dd-94d9-0030843d3802">
 <topic>websvn -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>websvn</name>
	<range><lt>2.1.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/32338/">
	 Some vulnerabilities have been reported in WebSVN, which can be
	 exploited by malicious users to disclose sensitive information, and by
	 malicious people to conduct cross-site scripting attacks and
	 manipulate data.
	 Input passed in the URL to index.php is not properly sanitised
	 before being returned to the user. This can be exploited to execute
	 arbitrary HTML and script code in a user's browser session in context
	 of an affected site.
	 Input passed to the "rev" parameter in rss.php is not properly
	 sanitised before being used. This can be exploited to overwrite
	 arbitrary files via directory traversal attacks.
	 Access to restricted repositories is not properly enforced, which
	 can be exploited to disclose potentially sensitive information by
	 accessing the repository via "listing.php" and using the "compare with
	 previous" and "show changed files" links.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5918</cvename>
 <cvename>CVE-2008-5919</cvename>
 <cvename>CVE-2009-0240</cvename>
 <url>http://secunia.com/advisories/32338/</url>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512191</url>
 <url>http://www.gulftech.org/?node=research&amp;article_id=00132-10202008</url>
 </references>
 <dates>
 <discovery>2008-10-23</discovery>
 <entry>2009-02-09</entry>
 </dates>
 </vuln>

<vuln vid="40774927-f6b4-11dd-94d9-0030843d3802">
 <topic>phplist -- local file inclusion vulnerability</topic>
 <affects>
 <package>
	<name>phplist</name>
	<range><lt>2.10.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33533/">
	 Input passed to the "_SERVER[ConfigFile]" parameter in
	 admin/index.php is not properly verified before being used to include
	 files. This can be exploited to include arbitrary files from local
	 resources.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0422</cvename>
 <url>http://secunia.com/advisories/33533/</url>
 </references>
 <dates>
 <discovery>2009-01-15</discovery>
 <entry>2009-02-09</entry>
 </dates>
 </vuln>

<vuln vid="9c2460a4-f6b1-11dd-94d9-0030843d3802">
 <topic>squid -- remote denial of service vulnerability</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><ge>2.7.1</ge><lt>2.7.6</lt></range>
	<range><ge>3.0.1</ge><lt>3.0.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid security advisory 2009:1 reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2009_1.txt">
	 Due to an internal error Squid is vulnerable to a denial
	 of service attack when processing specially crafted requests.
	 This problem allows any client to perform a denial of service
	 attack on the Squid service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0478</cvename>
 <url>http://www.squid-cache.org/Advisories/SQUID-2009_1.txt</url>
 <url>http://secunia.com/advisories/33731/</url>
 </references>
 <dates>
 <discovery>2009-02-04</discovery>
 <entry>2009-02-09</entry>
 <modified>2009-02-10</modified>
 </dates>
 </vuln>

<vuln vid="653606e9-f6ac-11dd-94d9-0030843d3802">
 <topic>typo3 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>typo3</name>
	<range><lt>4.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33617/">
	 Some vulnerabilities have been reported in Typo3, which can be
	 exploited by malicious people to bypass certain security restrictions,
	 conduct cross-site scripting and session fixation attacks, and
	 compromise a vulnerable system.
	 The "Install tool" system extension uses insufficiently random
	 entropy sources to generate an encryption key, resulting in weak
	 security.
	 The authentication library does not properly invalidate supplied
	 session tokens, which can be exploited to hijack a user's
	 session.
	 Certain unspecified input passed to the "Indexed Search Engine"
	 system extension is not properly sanitised before being used to invoke
	 commands. This can be exploited to inject and execute arbitrary shell
	 commands.
	 Input passed via the name and content of files to the "Indexed Search
	 Engine" system extension is not properly sanitised before being returned
	 to the user. This can be exploited to execute arbitrary HTML and script
	 code in a user's browser session in context of an affected site.
	 Certain unspecified input passed to the Workspace module is not
	 properly sanitised before being returned to the user. This can be
	 exploited to execute arbitrary HTML and script code in a user's
	 browser session in context of an affected site.
	 Note: It is also reported that certain unspecified input passed to
	 test scripts of the "ADOdb" system extension is not properly sanitised
	 before being returned to the user. This can be exploited to execute
	 arbitrary HTML and script code in a user's browser session in context
	 of an affected website.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0255</cvename>
 <cvename>CVE-2009-0256</cvename>
 <cvename>CVE-2009-0257</cvename>
 <cvename>CVE-2009-0258</cvename>
 <url>http://secunia.com/advisories/33617/</url>
 <url>http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/</url>
 </references>
 <dates>
 <discovery>2009-02-07</discovery>
 <entry>2009-02-09</entry>
 <modified>2013-06-19</modified>
 </dates>
 </vuln>

<vuln vid="13d6d997-f455-11dd-8516-001b77d09812">
 <topic>sudo -- certain authorized users could run commands as any user</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><ge>1.6.9</ge><lt>1.6.9.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Todd Miller reports:
	<blockquote cite="http://www.gratisoft.us/pipermail/sudo-announce/2009-February/000085.html">
	 A bug was introduced in Sudo's group matching code in version
	 1.6.9 when support for matching based on the supplemental group
	 vector was added. This bug may allow certain users listed in
	 the sudoers file to run a command as a different user than their
	 access rule specifies.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>33517</bid>
 <cvename>CVE-2009-0034</cvename>
 <mlist msgid="200902041802.n14I2llS024155@core.courtesan.com">http://www.gratisoft.us/pipermail/sudo-announce/2009-February/000085.html</mlist>
 </references>
 <dates>
 <discovery>2009-02-04</discovery>
 <entry>2009-02-06</entry>
 </dates>
 </vuln>

<vuln vid="6d85dc62-f2bd-11dd-9f55-0030843d3802">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.15</lt></range>
 </package>
 <package>
	<name>drupal6</name>
	<range><lt>6.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal Team reports:
	<blockquote cite="http://drupal.org/node/358957">
	 The Content Translation module for Drupal 6.x enables users to make
	 a translation of an existing item of content (a node). In that proces
	 the existing node's content is copied into the new node's submission
	 form.
	 The module contains a flaw that allows a user with the 'translate
	 content' permission to potentially bypass normal viewing access
	 restrictions, for example allowing the user to see the content of
	 unpublished nodes even if they do not have permission to view
	 unpublished nodes.
	 When user profile pictures are enabled, the default user profile
	 validation function will be bypassed, possibly allowing invalid user
	 names or e-mail addresses to be submitted.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://drupal.org/node/358957</url>
 <url>http://secunia.com/advisories/33550/</url>
 <url>http://secunia.com/advisories/33500/</url>
 <url>http://secunia.com/advisories/33542/</url>
 </references>
 <dates>
 <discovery>2009-01-14</discovery>
 <entry>2009-02-04</entry>
 </dates>
 </vuln>

<vuln vid="4a99d61c-f23a-11dd-9f55-0030843d3802">
 <topic>perl -- Directory Permissions Race Condition</topic>
 <affects>
 <package>
	<name>perl</name>
	<range><ge>5.8.0</ge><lt>5.8.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/14531/">
	 Paul Szabo has reported a vulnerability in Perl File::Path::rmtree,
	 which potentially can be exploited by malicious, local users to
	 gain escalated privileges.
	 The vulnerability is caused due to a race condition in the way
	 File::Path::rmtree handles directory permissions when cleaning up
	 directories. This can be exploited by replacing an existing sub
	 directory in the directory tree with a symbolic link to an arbitrary
	 file.
	 Successful exploitation may allow changing permissions of arbitrary
	 files, if root uses an application using the vulnerable code to delete
	 files in a directory having a world-writable sub directory.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0448</cvename>
 <url>http://www.ubuntulinux.org/usn/usn-94-1</url>
 <url>http://secunia.com/advisories/14531/</url>
 </references>
 <dates>
 <discovery>2005-03-09</discovery>
 <entry>2009-02-03</entry>
 </dates>
 </vuln>

<vuln vid="6a523dba-eeab-11dd-ab4f-0030843d3802">
 <topic>moinmoin -- multiple cross site scripting vulnerabilities</topic>
 <affects>
 <package>
	<name>moinmoin</name>
	<range><lt>1.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33593/">
	 Input passed to multiple parameters in action/AttachFile.py is not
	 properly sanitised before being returned to the user. This can be
	 exploited to execute arbitrary HTML and script code in a user's
	 browser session in the context of an affected site.
	 Certain input passed to security/antispam.py is not properly
	 sanitised before being returned to the user. This can be exploited to
	 execute arbitrary HTML and script code in a user's browser session in
	 the context of an affected site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0260</cvename>
 <cvename>CVE-2009-0312</cvename>
 <url>http://secunia.com/advisories/33593/</url>
 <url>http://hg.moinmo.in/moin/1.8/file/c76d50dac855</url>
 <url>http://hg.moinmo.in/moin/1.8/rev/89b91bf87dad</url>
 <url>http://moinmo.in/SecurityFixes#moin1.8.1</url>
 </references>
 <dates>
 <discovery>2009-01-21</discovery>
 <entry>2009-01-30</entry>
 </dates>
 </vuln>

<vuln vid="b9077cc4-6d04-4bcb-a37a-9ceaebfdcc9e">
 <topic>ganglia -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>ganglia-monitor-core</name>
	<name>ganglia-monitor-webfrontend</name>
	<range><lt>3.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	 <blockquote cite="http://secunia.com/advisories/33506">
	 Spike Spiegel has discovered a vulnerability in Ganglia which
	 can be exploited by malicious people to compromise a
	 vulnerable system. The vulnerability is caused due to a
	 boundary error within the process_path function in
	 gmetad/server.c. This can be exploited to cause a stack-based
	 buffer overflow by e.g. sending a specially crafted message to
	 the gmetad service.
	 The vulnerability is confirmed in version 3.1.1. Other
	 versions may also be affected.
	 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0241</cvename>
 <url>http://secunia.com/advisories/33506</url>
 </references>
 <dates>
 <discovery>2009-01-26</discovery>
 <entry>2009-01-30</entry>
 <modified>2009-01-30</modified>
 </dates>
 </vuln>

<vuln vid="100a9ed2-ee56-11dd-ab4f-0030843d3802">
 <topic>tor -- unspecified memory corruption vulnerability</topic>
 <affects>
 <package>
	<name>tor</name>
	<range><lt>0.2.0.33</lt></range>
 </package>
 <package>
	<name>tor-devel</name>
	<range><lt>0.2.1.11-alpha</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33635/">
	 A vulnerability with an unknown impact has been reported in Tor.
	 The vulnerability is caused due to an unspecified error and can be
	 exploited to trigger a heap corruption. No further information is
	 currently available.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2009-0414</cvename>
 <url>http://secunia.com/advisories/33635/</url>
 <url>http://archives.seul.org/or/announce/Jan-2009/msg00000.html</url>
 </references>
 <dates>
 <discovery>2009-01-22</discovery>
 <entry>2009-01-29</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="2ffb1b0d-ecf5-11dd-abae-00219b0fc4d8">
 <topic>glpi -- SQL Injection</topic>
 <affects>
 <package>
	<name>glpi</name>
	<range><lt>0.71.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GLPI project reports:
	<blockquote cite="http://www.glpi-project.org/spip.php?page=annonce&amp;id_breve=161&amp;lang=en">
	 Input passed via unspecified parameters is not properly sanitised
	 before being used in SQL queries. This can be exploited to
	 manipulateSQL queries by injecting arbitrary SQL code.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.glpi-project.org/spip.php?page=annonce&amp;id_breve=161&amp;lang=en</url>
 <url>https://mail.gna.org/public/glpi-news/2009-01/msg00002.html</url>
 <url>https://dev.indepnet.net/glpi/ticket/1224</url>
 <url>http://secunia.com/advisories/33680/</url>
 </references>
 <dates>
 <discovery>2009-01-25</discovery>
 <entry>2009-01-28</entry>
 </dates>
 </vuln>

<vuln vid="c3aba586-ea77-11dd-9d1e-000bcdc1757a">
 <topic>openfire -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openfire</name>
	<range><lt>3.6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Core Security Technologies reports:
	<blockquote cite="http://www.coresecurity.com/content/openfire-multiple-vulnerabilities">
	 Multiple cross-site scripting vulnerabilities have been found
	 which may lead to arbitrary remote code execution on the server
	 running the application due to unauthorized upload of Java plugin
	 code.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>32935</bid>
 <bid>32937</bid>
 <bid>32938</bid>
 <bid>32939</bid>
 <bid>32940</bid>
 <bid>32943</bid>
 <bid>32944</bid>
 <bid>32945</bid>
 <cvename>CVE-2009-0496</cvename>
 <cvename>CVE-2009-0497</cvename>
 <url>http://www.coresecurity.com/content/openfire-multiple-vulnerabilities</url>
 </references>
 <dates>
 <discovery>2009-01-08</discovery>
 <entry>2009-01-25</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="abcacb5a-e7f1-11dd-afcd-00e0815b8da8">
 <topic>ipset-tools -- Denial of Service Vulnerabilities</topic>
 <affects>
 <package>
	<name>ipsec-tools</name>
	<range><lt>0.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/30657/discuss">
	 IPsec-Tools is affected by multiple remote denial-of-service
	 vulnerabilities because the software fails to properly handle
	 certain network packets.
	 A successful attack allows a remote attacker to crash the
	 software, denying further service to legitimate users.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>30657</bid>
 <cvename>CVE-2008-3651</cvename>
 <cvename>CVE-2008-3652</cvename>
 <mlist msgid="20080724084529.GA3768@zen.inc">http://marc.info/?l=ipsec-tools-devel&amp;m=121688914101709&amp;w=2</mlist>
 </references>
 <dates>
 <discovery>2008-07-28</discovery>
 <entry>2009-01-21</entry>
 </dates>
 </vuln>

<vuln vid="4b68d917-e705-11dd-afcd-00e0815b8da8">
 <topic>Teamspeak Server -- Directory Traversal Vulnerability</topic>
 <affects>
 <package>
	<name>teamspeak_server</name>
	<range><le>2.0.23.17</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/33256">
	 TeamSpeak is prone to a directory-traversal vulnerability because
	 it fails to sufficiently sanitize user-supplied input data.
	 Exploiting the issue may allow an attacker to obtain sensitive
	 information that could aid in further attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>33256</bid>
 <url>http://www.securityfocus.com/bid/33256</url>
 </references>
 <dates>
 <discovery>2009-01-14</discovery>
 <entry>2009-01-20</entry>
 </dates>
 </vuln>

<vuln vid="2bc960c4-e665-11dd-afcd-00e0815b8da8">
 <topic>optipng -- arbitrary code execution via crafted BMP image</topic>
 <affects>
 <package>
	<name>optipng</name>
	<range><lt>0.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/32651">
	 A vulnerability has been reported in OptiPNG, which
	 potentially can be exploited by malicious people to compromise
	 a user's system.
	 The vulnerability is caused due to a boundary error in
	 the BMP reader and can be exploited to cause a buffer
	 overflow by tricking a user into processing a specially
	 crafted file.
	 Successful exploitation may allow execution of arbitrary
	 code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5101</cvename>
 <url>http://secunia.com/advisories/32651</url>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505399</url>
 <url>http://optipng.sourceforge.net/</url>
 </references>
 <dates>
 <discovery>2008-11-11</discovery>
 <entry>2009-01-19</entry>
 </dates>
 </vuln>

<vuln vid="ecad44b9-e663-11dd-afcd-00e0815b8da8">
 <topic>git -- gitweb privilege escalation</topic>
 <affects>
 <package>
	<name>git</name>
	<range><lt>1.6.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Git maintainers report:
	<blockquote cite="http://marc.info/?l=git&amp;m=122975564100860&amp;w=2">
	 gitweb has a possible local privilege escalation
	 bug that allows a malicious repository owner to run a command
	 of his choice by specifying diff.external configuration
	 variable in his repository and running a crafted gitweb
	 query.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>32967</bid>
 <mlist msgid="7vhc4z1gys.fsf@gitster.siamese.dyndns.org">http://marc.info/?l=git&amp;m=122975564100860&amp;w=2</mlist>
 <url>http://www.kernel.org/pub/software/scm/git/docs/RelNotes-1.6.0.6.txt</url>
 </references>
 <dates>
 <discovery>2008-12-20</discovery>
 <entry>2009-01-19</entry>
 </dates>
 </vuln>

<vuln vid="0809ce7d-f672-4924-9b3b-7c74bc279b83">
 <topic>gtar -- GNU TAR safer_name_suffix Remote Denial of Service Vulnerability</topic>
 <affects>
 <package>
	<name>gtar</name>
	<range><lt>1.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/26445/">
	 GNUs tar and cpio utilities are prone to a denial-of-service
	 vulnerability because of insecure use of the alloca()
	 function.
	 Successfully exploiting this issue allows attackers
	 to crash the affected utilities and possibly to execute
	 code but this has not been confirmed.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>26445</bid>
 <cvename>CVE-2007-4476</cvename>
 <url>http://www.securityfocus.com/bid/26445/</url>
 </references>
 <dates>
 <discovery>2007-11-14</discovery>
 <entry>2009-01-15</entry>
 </dates>
 </vuln>

<vuln vid="5ccb1c14-e357-11dd-a765-0030843d3802">
 <topic>mplayer -- vulnerability in STR files processor</topic>
 <affects>
 <package>
	<name>mplayer</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.11_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/30994">
	 The vulnerability is caused due to a boundary error within the
	 "str_read_packet()" function in libavformat/psxstr.c. This can be
	 exploited to cause a heap-based buffer overflow via a specially
	 crafted STR file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3162</cvename>
 <bid>30157</bid>
 <url>http://secunia.com/advisories/30994</url>
 <url>https://roundup.mplayerhq.hu/roundup/ffmpeg/issue311</url>
 </references>
 <dates>
 <discovery>2008-07-09</discovery>
 <entry>2009-01-15</entry>
 </dates>
 </vuln>

<vuln vid="bc6a7e79-e111-11dd-afcd-00e0815b8da8">
 <topic>cgiwrap -- XSS Vulnerability</topic>
 <affects>
 <package>
	<name>cgiwrap</name>
	<range><lt>4.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/30765">
	 A vulnerability has been reported in CGIWrap, which can be
	 exploited by malicious people to conduct cross-site scripting
	 attacks.
	 The vulnerability is caused due to the application generating
	 error messages without specifying a charset. This can be exploited
	 to execute arbitrary HTML and script code in a user's browser
	 session in context of an affected site.
	 Successful exploitation may require that the victim uses Internet
	 Explorer or a browser based on Internet Explorer components.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2852</cvename>
 <url>http://secunia.com/advisories/30765</url>
 <url>http://cgiwrap.sourceforge.net/changes.html</url>
 </references>
 <dates>
 <discovery>2008-06-19</discovery>
 <entry>2009-01-13</entry>
 </dates>
 </vuln>

<vuln vid="d4a358d3-e09a-11dd-a765-0030843d3802">
 <topic>nagios -- web interface privilege escalation vulnerability</topic>
 <affects>
 <package>
	<name>nagios</name>
	<range><lt>3.0.5</lt></range>
 </package>
 <package>
	<name>nagios2</name>
	<range><lt>2.12_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	securityfocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/32156/discuss">
	 An attacker with low-level privileges may exploit this issue to
	 bypass authorization and cause arbitrary commands to run within the
	 context of the Nagios server. This may aid in further attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5027</cvename>
 <bid>32156</bid>
 <url>http://secunia.com/advisories/33320</url>
 <url>http://www.ubuntu.com/usn/USN-698-1</url>
 <url>http://www.nagios.org/development/history/nagios-3x.php</url>
 </references>
 <dates>
 <discovery>2008-11-06</discovery>
 <entry>2009-01-12</entry>
 <modified>2009-01-15</modified>
 </dates>
 </vuln>

<vuln vid="a02c9595-e018-11dd-a765-0030843d3802">
 <topic>pdfjam -- insecure temporary files</topic>
 <affects>
 <package>
	<name>pdfjam</name>
	<range><lt>1.20_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/33278">
	 Some security issues have been reported in PDFjam, which can be
	 exploited by malicious, local users to perform certain actions with
	 escalated privileges.
	 The security issues are caused due to the "pdf90", "pdfjoin", and
	 "pdfnup" scripts using temporary files in an insecure manner. This can
	 be exploited to overwrite arbitrary files via symlink attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5743</cvename>
 <url>https://bugzilla.novell.com/show_bug.cgi?id=459031</url>
 <url>http://secunia.com/advisories/33278</url>
 </references>
 <dates>
 <discovery>2008-12-05</discovery>
 <entry>2009-01-11</entry>
 </dates>
 </vuln>

<vuln vid="58997463-e012-11dd-a765-0030843d3802">
 <topic>verlihub -- insecure temporary file usage and arbitrary command execution</topic>
 <affects>
 <package>
	<name>verlihub</name>
	<range><lt>0.9.8.d.r2_2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	securityfocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/32889/discuss">
	 An attacker with local access could potentially exploit this issue
	 to perform symbolic-link attacks, overwriting arbitrary files in the
	 context of the affected application.
	 Successfully mounting a symlink attack may allow the attacker to
	 delete or corrupt sensitive files, which may result in a denial of
	 service. Other attacks may also be possible.
	</blockquote>
	<blockquote cite="http://www.securityfocus.com/bid/32420/discuss">
	 Verlihub is prone to a remote command-execution vulnerability
	 because it fails to sufficiently validate user input.
	 Successfully exploiting this issue would allow an attacker to
	 execute arbitrary commands on an affected computer in the context of
	 the affected application.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5705</cvename>
 <cvename>CVE-2008-5706</cvename>
 <bid>32889</bid>
 <bid>32420</bid>
 <url>http://milw0rm.com/exploits/7183</url>
 </references>
 <dates>
 <discovery>2008-11-22</discovery>
 <entry>2009-01-11</entry>
 </dates>
 </vuln>

<vuln vid="66a770b4-e008-11dd-a765-0030843d3802">
 <topic>mysql -- empty bit-string literal denial of service</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><ge>5.0</ge><lt>5.0.66</lt></range>
	<range><ge>5.1</ge><lt>5.1.26</lt></range>
	<range><ge>6.0</ge><lt>6.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MySQL reports:
	<blockquote cite="http://bugs.mysql.com/bug.php?id=35658">
	 The vulnerability is caused due to an error when processing an
	 empty bit-string literal and can be exploited to crash the server via
	 a specially crafted SQL statement.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3963</cvename>
 <url>http://bugs.mysql.com/bug.php?id=35658</url>
 <url>http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-66.html</url>
 <url>http://dev.mysql.com/doc/refman/5.1/en/news-5-1-26.html</url>
 <url>http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html</url>
 <url>http://secunia.com/advisories/31769</url>
 </references>
 <dates>
 <discovery>2008-09-11</discovery>
 <entry>2009-01-11</entry>
 </dates>
 </vuln>

<vuln vid="8c451386-dff3-11dd-a765-0030843d3802">
 <topic>mysql -- privilege escalation and overwrite of the system table information</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><ge>4.1</ge><lt>4.1.24</lt></range>
	<range><ge>5.0</ge><lt>5.0.51</lt></range>
	<range><ge>5.1</ge><lt>5.1.23</lt></range>
	<range><ge>6.0</ge><lt>6.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MySQL reports:
	<blockquote cite="http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.html">
	 Using RENAME TABLE against a table with explicit DATA
	 DIRECTORY and INDEX DIRECTORY options can be used to overwrite
	 system table information by replacing the symbolic link
	 points. the file to which the symlink points.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-5969</cvename>
 <bid>26765</bid>
 <url>http://bugs.mysql.com/bug.php?id=32111</url>
 </references>
 <dates>
 <discovery>2007-11-14</discovery>
 <entry>2009-01-11</entry>
 </dates>
 </vuln>

<vuln vid="240ac24c-dff3-11dd-a765-0030843d3802">
 <topic>mysql -- remote dos via malformed password packet</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><ge>4.1</ge><lt>4.1.24</lt></range>
	<range><ge>5.0</ge><lt>5.0.44</lt></range>
	<range><ge>5.1</ge><lt>5.1.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MySQL reports:
	<blockquote cite="http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.html">
	 A malformed password packet in the connection protocol
	 could cause the server to crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3780</cvename>
 <bid>25017</bid>
 <url>http://bugs.mysql.com/bug.php?id=28984</url>
 </references>
 <dates>
 <discovery>2007-07-15</discovery>
 <entry>2009-01-11</entry>
 </dates>
 </vuln>

<vuln vid="bb4e9a44-dff2-11dd-a765-0030843d3802">
 <topic>mysql -- renaming of arbitrary tables by authenticated users</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><ge>4.1</ge><lt>4.1.23</lt></range>
	<range><ge>5.0</ge><lt>5.0.42</lt></range>
	<range><ge>5.1</ge><lt>5.1.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MySQL reports:
	<blockquote cite="http://dev.mysql.com/doc/refman/4.1/en/news-4-1-23.html">
	 The requirement of the DROP privilege for RENAME TABLE was not
	 enforced.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-2691</cvename>
 <bid>24016</bid>
 <url>http://bugs.mysql.com/bug.php?id=27515</url>
 </references>
 <dates>
 <discovery>2007-05-14</discovery>
 <entry>2009-01-11</entry>
 </dates>
 </vuln>

<vuln vid="69a20ce4-dfee-11dd-a765-0030843d3802">
 <topic>imap-uw -- imap c-client buffer overflow</topic>
 <affects>
 <package>
	<name>imap-uw</name>
	<range><lt>2007e</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SANS reports:
	<blockquote cite="http://www.washington.edu/imap/documentation/RELNOTES.html">
	 The University of Washington IMAP library is a library implementing
	 the IMAP mail protocol. University of Washington IMAP is exposed to a
	 buffer overflow issue that occurs due to a boundary error within the
	 rfc822_output_char function in the c-client library. The University of
	 Washington IMAP library versions prior to 2007e are affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5514</cvename>
 <url>http://www.washington.edu/imap/documentation/RELNOTES.html</url>
 </references>
 <dates>
 <discovery>2008-12-16</discovery>
 <entry>2009-01-11</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="a6713190-dfea-11dd-a765-0030843d3802">
 <topic>imap-uw -- local buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>imap-uw</name>
	<range><lt>2007d</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SANS reports:
	<blockquote cite="http://www.sans.org/newsletters/risk/display.php?v=7&amp;i=45#08.45.22">
	 University of Washington "tmail" and "dmail" are mail deliver
	 agents. "tmail" and "dmail" are exposed to local buffer overflow
	 issues because they fail to perform adequate boundary checks on
	 user-supplied data.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5514</cvename>
 <url>http://www.washington.edu/imap/documentation/RELNOTES.html</url>
 <url>http://www.sans.org/newsletters/risk/display.php?v=7&amp;i=45#08.45.22</url>
 </references>
 <dates>
 <discovery>2008-10-29</discovery>
 <entry>2009-01-11</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="bd730827-dfe0-11dd-a765-0030843d3802">
 <topic>libcdaudio -- remote buffer overflow and code execution</topic>
 <affects>
 <package>
	<name>libcdaudio</name>
	<range><lt>0.99.12p2_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	securityfocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/32122/discuss">
	 The 'libcdaudio' library is prone to a remote heap code in the
	 context of an application that uses the library. Failed attacks will
	 cause denial-of-service conditions.
	</blockquote>
	<blockquote cite="http://www.securityfocus.com/bid/12770/discuss">
	 A buffer-overflow in Grip occurs when the software processes a
	 response to a CDDB query that has more than 16 matches.
	 To exploit this issue, an attacker must be able to influence the
	 response to a CDDB query, either by controlling a malicious CDDB
	 server or through some other means. Successful exploits will allow
	 arbitrary code to run.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5030</cvename>
 <cvename>CVE-2005-0706</cvename>
 <bid>32122</bid>
 <bid>12770</bid>
 </references>
 <dates>
 <discovery>2008-11-05</discovery>
 <entry>2009-01-11</entry>
 </dates>
 </vuln>

<vuln vid="c702944a-db0f-11dd-aa56-000bcdf0a03b">
 <topic>FreeBSD -- netgraph / bluetooth privilege escalation</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_7</lt></range>
	<range><ge>6.4</ge><lt>6.4_1</lt></range>
	<range><ge>7.0</ge><lt>7.0_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Some function pointers for netgraph and bluetooth sockets are
	 not properly initialized.
	<h1>Impact:</h1>
	A local user can cause the FreeBSD kernel to execute
	 arbitrary code. This could be used by an attacker directly;
	 or it could be used to gain root privilege or to escape from
	 a jail.
	<h1>Workaround:</h1>
	No workaround is available, but systems without local
	 untrusted users are not vulnerable. Furthermore, systems are
	 not vulnerable if they have neither the ng_socket nor
	 ng_bluetooth kernel modules loaded or compiled into the
	 kernel.
	Systems with the security.jail.socket_unixiproute_only
	 sysctl set to 1 (the default) are only vulnerable if they have
	 local untrusted users outside of jails.
	If the command
	<code># kldstat -v | grep ng_</code>
	produces no output, the system is not vulnerable.
 </body>
 </description>
 <references>
 <freebsdsa>SA-08:13.protosw</freebsdsa>
 </references>
 <dates>
 <discovery>2008-12-23</discovery>
 <entry>2009-01-05</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="e9ecaceb-db0d-11dd-aa56-000bcdf0a03b">
 <topic>FreeBSD -- Cross-site request forgery in ftpd(8)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_7</lt></range>
	<range><ge>6.4</ge><lt>6.4_1</lt></range>
	<range><ge>7.0</ge><lt>7.0_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The ftpd(8) server splits long commands into several
	 requests. This may result in the server executing a command
	 which is hidden inside another very long command.
	<h1>Impact:</h1>
	This could, with a specifically crafted command, be used in a
	 cross-site request forgery attack.
	FreeBSD systems running ftpd(8) server could act as a point
	 of privilege escalation in an attack against users using web
	 browser to access trusted FTP sites.
	<h1>Workaround:</h1>
	No workaround is available, but systems not running FTP
	 servers are not vulnerable. Systems not running the FreeBSD
	 ftp(8) server are not affected, but users of other ftp
	 daemons are advised to take care since several other ftp
	 daemons are known to have related bugs.
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4247</cvename>
 <freebsdsa>SA-08:12.ftpd</freebsdsa>
 </references>
 <dates>
 <discovery>2008-12-23</discovery>
 <entry>2009-01-05</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="6b8cadce-db0b-11dd-aa56-000bcdf0a03b">
 <topic>FreeBSD -- IPv6 Neighbor Discovery Protocol routing vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_5</lt></range>
	<range><ge>7.0</ge><lt>7.0_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	IPv6 routers may allow "on-link" IPv6 nodes to create and
	 update the router's neighbor cache and forwarding
	 information. A malicious IPv6 node sharing a common router
	 but on a different physical segment from another node may be
	 able to spoof Neighbor Discovery messages, allowing it to
	 update router information for the victim node.
	<h1>Impact:</h1>
	An attacker on a different physical network connected to the
	 same IPv6 router as another node could redirect IPv6 traffic
	 intended for that node. This could lead to denial of service
	 or improper access to private network traffic.
	<h1>Workaround:</h1>
	Firewall packet filters can be used to filter incoming
	 Neighbor Solicitation messages but may interfere with normal
	 IPv6 operation if not configured carefully.
	Reverse path forwarding checks could be used to make
	 gateways, such as routers or firewalls, drop Neighbor
	 Solicitation messages from nodes with unexpected source
	 addresses on a particular interface.
	IPv6 router administrators are encouraged to read RFC 3756
	 for further discussion of Neighbor Discovery security
	 implications.
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2476</cvename>
 <freebsdsa>SA-08:10.nd6</freebsdsa>
 </references>
 <dates>
 <discovery>2008-10-01</discovery>
 <entry>2009-01-05</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="5796858d-db0b-11dd-aa56-000bcdf0a03b">
 <topic>FreeBSD -- arc4random(9) predictable sequence vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_6</lt></range>
	<range><ge>7.0</ge><lt>7.0_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When the arc4random(9) random number generator is
	 initialized, there may be inadequate entropy to meet the
	 needs of kernel systems which rely on arc4random(9); and it
	 may take up to 5 minutes before arc4random(9) is reseeded
	 with secure entropy from the Yarrow random number generator.
	<h1>Impact:</h1>
	All security-related kernel subsystems that rely on a
	 quality random number generator are subject to a wide range of
	 possible attacks for the 300 seconds after boot or until 64k
	 of random data is consumed. The list includes:
	* GEOM ELI providers with onetime keys. When a provider is
	 configured in a way so that it gets attached at the same time
	 during boot (e.g. it uses the rc subsystem to initialize) it
	 might be possible for an attacker to recover the encrypted
	 data.
	* GEOM shsec providers. The GEOM shsec subsytem is used to
	 split a shared secret between two providers so that it can be
	 recovered when both of them are present. This is done by
	 writing the random sequence to one of providers while
	 appending the result of the random sequence on the other host
	 to the original data. If the provider was created within the
	 first 300 seconds after booting, it might be possible for an
	 attacker to extract the original data with access to only one
	 of the two providers between which the secret data is split.
	* System processes started early after boot may receive
	 predictable IDs.
	* The 802.11 network stack uses arc4random(9) to generate
	 initial vectors (IV) for WEP encryption when operating in
	 client mode and WEP authentication challenges when operating
	 in hostap mode, which may be insecure.
	* The IPv4, IPv6 and TCP/UDP protocol implementations rely
	 on a quality random number generator to produce unpredictable
	 IP packet identifiers, initial TCP sequence numbers and
	 outgoing port numbers. During the first 300 seconds after
	 booting, it may be easier for an attacker to execute IP
	 session hijacking, OS fingerprinting, idle scanning, or in
	 some cases DNS cache poisoning and blind TCP data injection
	 attacks.
	* The kernel RPC code uses arc4random(9) to retrieve
	 transaction identifiers, which might make RPC clients
	 vulnerable to hijacking attacks.
	<h1>Workaround:</h1>
	No workaround is available for affected systems.
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5162</cvename>
 <freebsdsa>SA-08.11.arc4random</freebsdsa>
 </references>
 <dates>
 <discovery>2008-11-24</discovery>
 <entry>2009-01-05</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="d5e1aac8-db0b-11dd-ae30-001cc0377035">
 <topic>xterm -- DECRQSS remote command execution vulnerability</topic>
 <affects>
 <package>
	<name>xterm</name>
	<range><lt>238</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/33060/discuss">
	 The xterm program is prone to a remote command-execution
	 vulnerability because it fails to sufficiently validate user
	 input.
	 Successfully exploiting this issue would allow an attacker
	 to execute arbitrary commands on an affected computer in the
	 context of the affected application.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>33060</bid>
 <cvename>CVE-2008-2383</cvename>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030</url>
 </references>
 <dates>
 <discovery>2008-12-28</discovery>
 <entry>2009-01-05</entry>
 <modified>2009-01-06</modified>
 </dates>
 </vuln>

<vuln vid="58a3c266-db01-11dd-ae30-001cc0377035">
 <topic>php5-gd -- uninitialized memory information disclosure vulnerability</topic>
 <affects>
 <package>
	<name>php5-gd</name>
	<range><le>5.2.8</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	According to CVE-2008-5498 entry:
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5498">
	 Array index error in the "imageRotate" function in PHP 5.2.8 and
	 earlier allows context-dependent attackers to read the contents
	 of arbitrary memory locations via a crafted value of the third
	 argument (aka the "bgd_color" or "clrBack" argument) for an indexed
	 image.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>33002</bid>
 <cvename>CVE-2008-5498</cvename>
 <url>http://www.securiteam.com/unixfocus/6G00Y0ANFU.html</url>
 </references>
 <dates>
 <discovery>2008-12-24</discovery>
 <entry>2009-01-05</entry>
 <modified>2009-02-04</modified>
 </dates>
 </vuln>

<vuln vid="27d78386-d35f-11dd-b800-001b77d09812">
 <topic>awstats -- multiple XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>awstats</name>
	<range><lt>6.9,1</lt></range>
 </package>
 <package>
	<name>awstats-devel</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/31519">
	 Morgan Todd has discovered a vulnerability in AWStats,
	 which can be exploited by malicious people to conduct
	 cross-site scripting attacks.
	 Input passed in the URL to awstats.pl is not properly
	 sanitised before being returned to the user. This can be
	 exploited to execute arbitrary HTML and script code in a
	 user's browser session in context of an affected site.
	 Successful exploitation requires that the application is
	 running as a CGI script.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3714</cvename>
 <cvename>CVE-2008-5080</cvename>
 <url>http://secunia.com/advisories/31519</url>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495432</url>
 </references>
 <dates>
 <discovery>2008-03-12</discovery>
 <entry>2009-01-04</entry>
 </dates>
 </vuln>

<vuln vid="13b0c8c8-bee0-11dd-a708-001fc66e7203">
 <topic>p5-File-Path -- rmtree allows creation of setuid files</topic>
 <affects>
 <package>
	<name>p5-File-Path</name>
	<range><lt>2.07_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jan Lieskovsky reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2008/11/28/1">
	 perl-File-Path rmtree race condition (CVE-2005-0448 was assigned to
	 address this)
	 This vulnerability was fixed in 5.8.4-7 but re-introduced
	 in 5.8.8-1. It's also present in File::Path 2.xx, up to and
	 including 2.07 which has only a partial fix.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0448</cvename>
 <mlist>http://www.openwall.com/lists/oss-security/2008/11/28/1</mlist>
 <mlist>http://www.gossamer-threads.com/lists/perl/porters/233699#233699</mlist>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905</url>
 </references>
 <dates>
 <discovery>2008-11-28</discovery>
 <entry>2009-01-03</entry>
 </dates>
 </vuln>

<vuln vid="0e1e3789-d87f-11dd-8ecd-00163e000016">
 <topic>vim -- multiple vulnerabilities in the netrw module</topic>
 <affects>
 <package>
	<name>vim</name>
	<name>vim-console</name>
	<name>vim-lite</name>
	<name>vim-gtk2</name>
	<name>vim-gnome</name>
	<range><ge>7.0</ge><lt>7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jan Minar reports:
	<blockquote cite="http://www.rdancer.org/vulnerablevim-netrw.v2.html">
	 Applying the ``D'' to a file with a crafted file name,
	 or inside a directory with a crafted directory name, can
	 lead to arbitrary code execution.
	</blockquote>
	<blockquote cite="http://www.rdancer.org/vulnerablevim-netrw.v5.html">
	 Lack of sanitization throughout Netrw can lead to arbitrary
	 code execution upon opening a directory with a crafted
	 name.
	</blockquote>
	<blockquote cite="http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html">
	 The Vim Netrw Plugin shares the FTP user name and password
	 across all FTP sessions. Every time Vim makes a new FTP
	 connection, it sends the user name and password of the
	 previous FTP session to the FTP server.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3076</cvename>
 <mlist>http://www.openwall.com/lists/oss-security/2008/10/16/2</mlist>
 <url>http://www.rdancer.org/vulnerablevim-netrw.html</url>
 <url>http://www.rdancer.org/vulnerablevim-netrw.v2.html</url>
 <url>http://www.rdancer.org/vulnerablevim-netrw.v5.html</url>
 <url>http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html</url>
 </references>
 <dates>
 <discovery>2008-10-16</discovery>
 <entry>2009-01-02</entry>
 </dates>
 </vuln>

<vuln vid="214e8e07-d369-11dd-b800-001b77d09812">
 <topic>vinagre -- format string vulnerability</topic>
 <affects>
 <package>
	<name>vinagre</name>
	<range><lt>0.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CORE Security Technologies reports:
	<blockquote cite="http://www.coresecurity.com/content/vinagre-format-string">
	 A format string error has been found on the
	 vinagre_utils_show_error() function that can be exploited via
	 commands issued from a malicious server containing format
	 string specifiers on the VNC name.
	 In a web based attack scenario, the user would be required
	 to connect to a malicious server. Successful exploitation
	 would then allow the attacker to execute arbitrary code with
	 the privileges of the Vinagre user.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>32682</bid>
 <cvename>CVE-2008-5660</cvename>
 <url>http://www.coresecurity.com/content/vinagre-format-string</url>
 <url>http://ftp.gnome.org/pub/GNOME/sources/vinagre/0.5/vinagre-0.5.2.news</url>
 </references>
 <dates>
 <discovery>2008-12-09</discovery>
 <entry>2008-12-31</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="f98dea27-d687-11dd-abd1-0050568452ac">
 <topic>twiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>twiki</name>
	<range><lt>4.2.4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marc Schoenefeld and Steve Milner of RedHat SRT and Peter Allor of IBM ISS report:
	<blockquote cite="http://twiki.org/cgi-bin/view/Codev/TWikiSecurityAlerts#Security_Alerts_of_TWiki_4_2_x_P">
	 XSS vulnerability with URLPARAM variable
	 SEARCH variable allows arbitrary shell command execution
	</blockquote>
 </body>
 </description>
 <references>
 <bid>32668</bid>
 <bid>32669</bid>
 <cvename>CVE-2008-5304</cvename>
 <cvename>CVE-2008-5305</cvename>
 <url>http://secunia.com/advisories/33040</url>
 <url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5304</url>
 <url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5305</url>
 <url>http://www.securitytracker.com/alerts/2008/Dec/1021351.html</url>
 <url>http://www.securitytracker.com/alerts/2008/Dec/1021352.html</url>
 <url>https://www.it-isac.org/postings/cyber/alertdetail.php?id=4513</url>
 <url>http://xforce.iss.net/xforce/xfdb/45293</url>
 </references>
 <dates>
 <discovery>2008-12-05</discovery>
 <entry>2008-12-30</entry>
 </dates>
 </vuln>

<vuln vid="8f483746-d45d-11dd-84ec-001fc66e7203">
 <topic>roundcube -- remote execution of arbitrary code</topic>
 <affects>
 <package>
	<name>roundcube</name>
	<range><lt>0.2.b2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Entry for CVE-2008-5619 says:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5619">
	 html2text.php in RoundCube Webmail (roundcubemail)
	 0.2-1.alpha and 0.2-3.beta allows remote attackers to execute
	 arbitrary code via crafted input that is processed by the
	 preg_replace function with the eval switch.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5619</cvename>
 <url>http://trac.roundcube.net/ticket/1485618</url>
 </references>
 <dates>
 <discovery>2008-12-12</discovery>
 <entry>2008-12-30</entry>
 </dates>
 </vuln>

<vuln vid="738f8f9e-d661-11dd-a765-0030843d3802">
 <topic>mysql -- MyISAM table privileges security bypass vulnerability for symlinked paths</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><ge>4.1</ge><lt>4.1.25</lt></range>
	<range><ge>5.0</ge><lt>5.0.75</lt></range>
	<range><ge>5.1</ge><lt>5.1.28</lt></range>
	<range><ge>6.0</ge><lt>6.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MySQL Team reports:
	<blockquote cite="http://bugs.mysql.com/bug.php?id=32167">
	 Additional corrections were made for the symlink-related privilege
	 problem originally addressed. The original fix did not correctly
	 handle the data directory pathname if it contained symlinked
	 directories in its path, and the check was made only at
	 table-creation time, not at table-opening time later.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2079</cvename>
 <cvename>CVE-2008-4097</cvename>
 <cvename>CVE-2008-4098</cvename>
 <url>http://bugs.mysql.com/bug.php?id=32167</url>
 <url>http://dev.mysql.com/doc/refman/4.1/en/news-4-1-25.html</url>
 <url>http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0-75.html</url>
 <url>http://dev.mysql.com/doc/refman/5.1/en/news-5-1-28.html</url>
 <url>http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html</url>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25</url>
 </references>
 <dates>
 <discovery>2008-07-03</discovery>
 <entry>2008-12-30</entry>
 </dates>
 </vuln>

<vuln vid="7c5bd5b8-d652-11dd-a765-0030843d3802">
 <topic>mplayer -- twinvq processing buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>mplayer</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.11_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A trapkit reports:
	<blockquote cite="http://trapkit.de/advisories/TKADV2008-014.txt">
	 MPlayer contains a stack buffer overflow vulnerability while
	 parsing malformed TwinVQ media files. The vulnerability may be
	 exploited by a (remote) attacker to execute arbitrary code in
	 the context of MPlayer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5616</cvename>
 <url>http://secunia.com/advisories/33136/</url>
 <url>http://trapkit.de/advisories/TKADV2008-014.txt</url>
 </references>
 <dates>
 <discovery>2008-12-14</discovery>
 <entry>2008-12-30</entry>
 </dates>
 </vuln>

<vuln vid="0ac68e68-d32b-11dd-b540-d1288664c17e">
 <topic>ampache -- insecure temporary file usage</topic>
 <affects>
 <package>
	<name>ampache</name>
	<range><lt>3.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/31657">
	 A security issue has been reported in Ampache, which can be
	 exploited by malicious, local users to perform certain actions
	 with escalated privileges.
	 The security issue is caused due to the "gather-messages.sh"
	 script handling temporary files in an insecure manner.
	 This can be exploited via symlink attacks to overwrite arbitrary
	 files with the privileges of the user running the script.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>30875</bid>
 <cvename>CVE-2008-3929</cvename>
 <url>http://secunia.com/advisories/31657</url>
 </references>
 <dates>
 <discovery>2008-12-24</discovery>
 <entry>2008-12-26</entry>
 </dates>
 </vuln>

<vuln vid="225bc349-ce10-11dd-a721-0030843d3802">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>linux-opera</name>
	<range><lt>9.63</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Opera Team reports:
	<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/963/">
	 Manipulating certain text-area contents can cause a buffer
	 overflow, which may be exploited to execute arbitrary code.
	 Certain HTML constructs can cause the resulting DOM to change
	 unexpectedly, which triggers a crash. To inject code, additional
	 techniques will have to be employed.
	 Exceptionally long host names in file: URLs can cause a buffer
	 overflow, which may be exploited to execute arbitrary code. Remote Web
	 pages cannot refer to file: URLs, so successful exploitation involves
	 tricking users into manually opening the exploit URL, or a local file
	 that refers to it.
	 When Opera is previewing a news feed, some scripted URLs are not
	 correctly blocked. These can execute scripts which are able to
	 subscribe the user to any feed URL that the attacker chooses, and can
	 also view the contents of any feeds that the user is subscribed to.
	 These may contain sensitive information.
	 Built-in XSLT templates incorrectly handle escaped content and can
	 cause it to be treated as markup. If a site accepts content from
	 untrusted users, which it then displays using XSLT as escaped strings,
	 this can allow scripted markup to be injected. The scripts will then
	 be executed in the security context of that site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5178</cvename>
 <url>http://www.opera.com/support/kb/view/920/</url>
 <url>http://www.opera.com/support/kb/view/921/</url>
 <url>http://www.opera.com/support/kb/view/922/</url>
 <url>http://www.opera.com/support/kb/view/923/</url>
 <url>http://www.opera.com/support/kb/view/924/</url>
 <url>http://secunia.com/advisories/32752/</url>
 </references>
 <dates>
 <discovery>2008-11-18</discovery>
 <entry>2008-12-19</entry>
 </dates>
 </vuln>

<vuln vid="61b07d71-ce0e-11dd-a721-0030843d3802">
 <topic>mediawiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mediawiki</name>
	<range><gt>1.6.0</gt><lt>1.6.11</lt></range>
	<range><gt>1.12.0</gt><lt>1.12.3</lt></range>
	<range><gt>1.13.0</gt><lt>1.13.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MediaWiki development team reports:
	<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html">
	 Certain unspecified input is not properly sanitised before being
	 returned to the user. This can be exploited to execute arbitrary HTML
	 and script code in a user's browser session in context of an affected
	 site.
	 Certain unspecified input related to uploads is not properly
	 sanitised before being used. This can be exploited to inject arbitrary
	 HTML and script code, which will be executed in a user's browser
	 session in context of an affected site when a malicious data is
	 opened. Successful exploitation may require that uploads are enabled
	 and the victim uses an Internet Explorer based browser.
	 Certain SVG scripts are not properly sanitised before being used.
	 This can be exploited to inject arbitrary HTML and script code, which
	 will be executed in a user's browser session in context of an affected
	 site when a malicious data is opened. Successful exploitation may require
	 that SVG uploads are enabled and the victim uses a browser supporting SVG
	 scripting.
	 The application allows users to perform certain actions via HTTP
	 requests without performing any validity checks to verify the
	 requests. This can be exploited to perform certain operations when a
	 logged in user visits a malicious site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5249</cvename>
 <cvename>CVE-2008-5250</cvename>
 <cvename>CVE-2008-5252</cvename>
 <url>http://secunia.com/advisories/33133/</url>
 <url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html</url>
 </references>
 <dates>
 <discovery>2008-12-15</discovery>
 <entry>2008-12-19</entry>
 </dates>
 </vuln>

<vuln vid="609c790e-ce0a-11dd-a721-0030843d3802">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.14</lt></range>
 </package>
 <package>
	<name>drupal6</name>
	<range><lt>6.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Project reports:
	<blockquote cite="http://drupal.org/node/345441">
	 The update system is vulnerable to Cross site request forgeries.
	 Malicious users may cause the superuser (user 1) to execute old
	 updates that may damage the database.
	 When an input format is deleted, not all existing content on a site
	 is updated to reflect this deletion. Such content is then displayed
	 unfiltered. This may lead to cross site scripting attacks when harmful
	 tags are no longer stripped from 'malicious' content that was posted
	 earlier.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-6533</cvename>
 <url>http://drupal.org/node/345441</url>
 <url>http://secunia.com/advisories/33112/</url>
 </references>
 <dates>
 <discovery>2008-12-11</discovery>
 <entry>2008-12-19</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="29f5bfc5-ce04-11dd-a721-0030843d3802">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>2.0.0.20,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.5,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>2.0.0.20</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.14</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports:
	<blockquote cite="http://www.mozilla.org/security/announce/">
	 MFSA 2008-69 XSS vulnerabilities in SessionStore
	 MFSA 2008-68 XSS and JavaScript privilege escalation
	 MFSA 2008-67 Escaped null characters ignored by CSS parser
	 MFSA 2008-66 Errors parsing URLs with leading whitespace and
	 control characters
	 MFSA 2008-65 Cross-domain data theft via script redirect error
	 message
	 MFSA 2008-64 XMLHttpRequest 302 response disclosure
	 MFSA 2008-62 Additional XSS attack vectors in feed preview
	 MFSA 2008-61 Information stealing via loadBindingDocument
	 MFSA 2008-60 Crashes with evidence of memory corruption
	 (rv:1.9.0.5/1.8.1.19)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5500</cvename>
 <cvename>CVE-2008-5501</cvename>
 <cvename>CVE-2008-5502</cvename>
 <cvename>CVE-2008-5503</cvename>
 <cvename>CVE-2008-5504</cvename>
 <cvename>CVE-2008-5505</cvename>
 <cvename>CVE-2008-5506</cvename>
 <cvename>CVE-2008-5507</cvename>
 <cvename>CVE-2008-5508</cvename>
 <cvename>CVE-2008-5510</cvename>
 <cvename>CVE-2008-5511</cvename>
 <cvename>CVE-2008-5512</cvename>
 <cvename>CVE-2008-5513</cvename>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-60.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-61.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-62.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-63.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-64.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-65.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-66.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-67.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-68.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-69.html</url>
 </references>
 <dates>
 <discovery>2008-12-17</discovery>
 <entry>2008-12-19</entry>
 </dates>
 </vuln>

<vuln vid="54f72962-c7ba-11dd-a721-0030843d3802">
 <topic>phpmyadmin -- cross-site request forgery vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin211</name>
	<range><lt>2.11.9.4</lt></range>
 </package>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>3.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin Team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php">
	 A logged-in user can be subject of SQL injection through cross
	 site request forgery. Several scripts in phpMyAdmin are
	 vulnerable and the attack can be made through table parameter.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5621</cvename>
 <url>http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php</url>
 <url>http://www.milw0rm.com/exploits/7382</url>
 <url>http://secunia.com/advisories/33076/</url>
 </references>
 <dates>
 <discovery>2008-12-09</discovery>
 <entry>2008-12-11</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="1f9e2376-c52f-11dd-8cbc-00163e000016">
 <topic>php5 -- potential magic_quotes_gpc vulnerability</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP Developers reports:
	<blockquote cite="http://www.php.net/archive/2008.php#id2008-12-07-1">
	 Due to a security bug found in the PHP 5.2.7 release, it has been
	 removed from distribution. The bug affects configurations where
	 magic_quotes_gpc is enabled, because it remains off even when set to
	 on.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5844</cvename>
 <url>http://www.php.net/archive/2008.php#id2008-12-07-1</url>
 </references>
 <dates>
 <discovery>2008-12-07</discovery>
 <entry>2008-12-08</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="baece347-c489-11dd-a721-0030843d3802">
 <topic>wireshark -- SMTP Processing Denial of Service Vulnerability</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><lt>1.0.4_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/32840/">
	 A vulnerability has been reported in Wireshark, which can be
	 exploited by malicious people to cause a DoS.
	 The vulnerability is caused due to an error in the SMTP dissector
	 and can be exploited to trigger the execution of an infinite loop via
	 a large SMTP packet.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5285</cvename>
 <url>http://secunia.com/advisories/32840/</url>
 <url>http://lists.grok.org.uk/pipermail/full-disclosure/2008-November/065840.html</url>
 </references>
 <dates>
 <discovery>2008-11-24</discovery>
 <entry>2008-12-07</entry>
 </dates>
 </vuln>

<vuln vid="27d01223-c457-11dd-a721-0030843d3802">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/32964/">
	 Some vulnerabilities have been reported in PHP, where some have an
	 unknown impact and others can potentially be exploited by malicious
	 people to cause a DoS (Denial of Service) or compromise a vulnerable
	 system.
	 An input validation error exists within the
	 "ZipArchive::extractTo()" function when extracting ZIP archives.
	 This can be exploited to extract files to arbitrary locations
	 outside the specified directory via directory traversal sequences in
	 a specially crafted ZIP archive.
	 An error in the included PCRE library can be exploited to cause a
	 buffer overflow.
	 The problem is that the "BG(page_uid)" and "BG(page_gid)" variables
	 are not initialized. No further information is currently
	 available.
	 The problem is that the "php_value" order is incorrect for Apache
	 configurations. No further information is currently available.
	 An error in the GD library can be exploited to cause a crash via a
	 specially crafted font file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2371</cvename>
 <cvename>CVE-2008-2829</cvename>
 <cvename>CVE-2008-3658</cvename>
 <cvename>CVE-2008-3659</cvename>
 <cvename>CVE-2008-3660</cvename>
 <url>http://www.php.net/ChangeLog-5.php#5.2.7</url>
 <url>http://www.sektioneins.de/advisories/SE-2008-06.txt</url>
 <url>http://secunia.com/advisories/30916/</url>
 <url>http://secunia.com/advisories/31409/</url>
 <url>http://secunia.com/advisories/32964/</url>
 </references>
 <dates>
 <discovery>2008-12-04</discovery>
 <entry>2008-12-07</entry>
 </dates>
 </vuln>

<vuln vid="44ee8160-c453-11dd-a721-0030843d3802">
 <topic>mgetty+sendfax -- symlink attack via insecure temporary files</topic>
 <affects>
 <package>
	<name>mgetty+sendfax</name>
	<range><lt>1.1.35_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian reports:
	<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496403">
	 Faxspool in mgetty 1.1.36 allows local users to overwrite
	 arbitrary files via a symlink attack on a /tmp/faxsp.####
	 temporary file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4936</cvename>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496403</url>
 <url>https://bugs.gentoo.org/show_bug.cgi?id=235806</url>
 </references>
 <dates>
 <discovery>2008-08-24</discovery>
 <entry>2008-12-07</entry>
 </dates>
 </vuln>

<vuln vid="3efc106e-c451-11dd-a721-0030843d3802">
 <topic>dovecot-managesieve -- Script Name Directory Traversal Vulnerability</topic>
 <affects>
 <package>
	<name>dovecot-managesieve</name>
	<range><lt>0.10.4</lt></range>
	<range><ge>0.11.0</ge><lt>0.11.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/Advisories/32768/">
	 The security issue is caused due to an input validation error when
	 processing script names. This can be exploited to read or modify
	 arbitrary files having ".sieve" extensions via directory traversal
	 attacks, with the privileges of the attacker's user id.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5301</cvename>
 <url>http://www.vupen.com/english/advisories/2008/3190</url>
 <url>http://secunia.com/Advisories/32768/</url>
 <url>http://dovecot.org/list/dovecot/2008-November/035259.html</url>
 </references>
 <dates>
 <discovery>2008-11-18</discovery>
 <entry>2008-12-07</entry>
 </dates>
 </vuln>

<vuln vid="578f6322-c450-11dd-a721-0030843d3802">
 <topic>habari -- Cross-Site Scripting Vulnerability</topic>
 <affects>
 <package>
	<name>habari</name>
	<range><lt>0.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/32311/">
	 Input passed via the "habari_username" parameter when logging in is
	 not properly sanitised before being returned to the user. This can
	 be exploited to execute arbitrary HTML and script code in a user's
	 browser session in context of an affected site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4601</cvename>
 <url>http://packetstorm.linuxsecurity.com/0810-exploits/habaricms-xss.txt</url>
 <url>http://secunia.com/advisories/32311/</url>
 </references>
 <dates>
 <discovery>2008-10-17</discovery>
 <entry>2008-12-07</entry>
 </dates>
 </vuln>

<vuln vid="acf80afa-c3ef-11dd-a721-0030843d3802">
 <topic>vlc -- arbitrary code execution in the RealMedia processor</topic>
 <affects>
 <package>
	<name>vlc-devel</name>
	<range><lt>0.9.8a</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tobias Klein from TrapKit reports:
	<blockquote cite="http://www.trapkit.de/advisories/TKADV2008-013.txt">
	 The VLC media player contains an integer overflow vulnerability
	 while parsing malformed RealMedia (.rm) files. The vulnerability
	 leads to a heap overflow that can be exploited by a (remote)
	 attacker to execute arbitrary code in the context of VLC media
	 player.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>32545</bid>
 <cvename>CVE-2008-5276</cvename>
 <url>http://www.trapkit.de/advisories/TKADV2008-013.txt</url>
 <url>http://www.videolan.org/security/sa0811.html</url>
 </references>
 <dates>
 <discovery>2008-11-30</discovery>
 <entry>2008-12-06</entry>
 <modified>2008-12-07</modified>
 </dates>
 </vuln>

<vuln vid="af2745c0-c3e0-11dd-a721-0030843d3802">
 <topic>mantis -- php code execution vulnerability</topic>
 <affects>
 <package>
	<name>mantis</name>
	<range><lt>1.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/32314/">
	 EgiX has discovered a vulnerability in Mantis, which can be
	 exploited by malicious users to compromise a vulnerable system.
	 Input passed to the "sort" parameter in manage_proj_page.php is not
	 properly sanitised before being used in a "create_function()" call.
	 This can be exploited to execute arbitrary PHP code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4687</cvename>
 <url>http://secunia.com/advisories/32314/</url>
 </references>
 <dates>
 <discovery>2008-10-17</discovery>
 <entry>2008-12-06</entry>
 </dates>
 </vuln>

<vuln vid="29255141-c3df-11dd-a721-0030843d3802">
 <topic>mantis -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mantis</name>
	<range><lt>1.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/30270/">
	 Some vulnerabilities have been reported in Mantis, which can be
	 exploited by malicious users to compromise a vulnerable system and
	 malicious people to conduct cross-site scripting and request forgery
	 attacks.
	 Input passed to the "filter_target" parameter in
	 return_dynamic_filters.php is not properly sanitised before being
	 returned to a user. This can be exploited to execute arbitrary HTML
	 and script code in a user's browser session in context of an affected
	 site.
	 A vulnerability is caused due to the application allowing users to
	 perform certain actions via HTTP requests without performing any
	 validity checks to verify the request. This can be exploited to e.g.
	 add a new user with administrative privileges by enticing a logged-in
	 administrator to visit a malicious site.
	 Input passed to the "value" parameter in adm_config_set.php is not
	 properly sanitised before being used in an "eval()" statement. This
	 can be exploited to e.g. execute arbitrary PHP commands via a
	 specially crafted request.
	 Input passed to the "language" parameter in account_prefs_update.php
	 is not properly verified before being used to include files. This
	 can be exploited to include arbitrary files from local
	 resources.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2276</cvename>
 <cvename>CVE-2008-3331</cvename>
 <cvename>CVE-2008-3332</cvename>
 <cvename>CVE-2008-3333</cvename>
 <url>http://secunia.com/advisories/30270/</url>
 </references>
 <dates>
 <discovery>2008-05-15</discovery>
 <entry>2008-12-06</entry>
 </dates>
 </vuln>

<vuln vid="d1ce8a4f-c235-11dd-8cbc-00163e000016">
 <topic>squirrelmail -- Cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>squirrelmail</name>
	<range><lt>1.4.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squirrelmail team reports:
	<blockquote cite="http://sourceforge.net/project/shownotes.php?release_id=644750&amp;group_id=311">
	 An issue was fixed that allowed an attacker to send specially-
	 crafted hyperlinks in a message that could execute cross-site
	 scripting (XSS) when the user viewed the message in SquirrelMail.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2379</cvename>
 <url>http://secunia.com/Advisories/32143/</url>
 <url>http://sourceforge.net/project/shownotes.php?release_id=644750&amp;group_id=311</url>
 </references>
 <dates>
 <discovery>2008-12-03</discovery>
 <entry>2008-12-04</entry>
 </dates>
 </vuln>

<vuln vid="842bafdd-be2f-11dd-a578-0030843d3802">
 <topic>openoffice -- arbitrary code execution vulnerabilities</topic>
 <affects>
 <package>
	<name>openoffice.org-2</name>
	<name>openoffice.org-2-RC</name>
	<name>openoffice.org-2-devel</name>
	<range><ge>2.4</ge><lt>2.4.2</lt></range>
	<range><ge>2.4.20040402</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The OpenOffice Team reports:
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2008-2237.html">
	 A security vulnerability with the way OpenOffice 2.x process WMF
	 files may allow a remote unprivileged user who provides a
	 StarOffice/StarSuite document that is opened by a local user to
	 execute arbitrary commands on the system with the privileges of the
	 user running StarOffice/StarSuite. No working exploit is known right
	 now.
	</blockquote>
	<blockquote cite="http://www.openoffice.org/security/cves/CVE-2008-2238.html">
	 A security vulnerability with the way OpenOffice 2.x process EMF
	 files may allow a remote unprivileged user who provides a
	 StarOffice/StarSuite document that is opened by a local user to
	 execute arbitrary commands on the system with the privileges of the
	 user running StarOffice/StarSuite. No working exploit is known right
	 now.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2237</cvename>
 <cvename>CVE-2008-2238</cvename>
 <url>http://www.openoffice.org/security/cves/CVE-2008-2237.html</url>
 <url>http://www.openoffice.org/security/cves/CVE-2008-2238.html</url>
 </references>
 <dates>
 <discovery>2008-10-29</discovery>
 <entry>2008-11-29</entry>
 </dates>
 </vuln>

<vuln vid="622bc638-be27-11dd-a578-0030843d3802">
 <topic>wordpress -- header rss feed script insertion vulnerability</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>de-wordpress</name>
	<name>wordpress-mu</name>
	<range><lt>2.6.5</lt></range>
 </package>
 <package>
	<name>zh-wordpress</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/32882/">
	 Input passed via the HTTP "Host" header is not properly sanitised
	 before being used. This can be exploited to execute arbitrary HTML and
	 script code in a user's browser session in context of an affected site
	 if malicious data is viewed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5278</cvename>
 <url>http://secunia.com/advisories/32882/</url>
 <url>http://wordpress.org/development/2008/11/wordpress-265/</url>
 </references>
 <dates>
 <discovery>2008-11-26</discovery>
 <entry>2008-11-29</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="1583640d-be20-11dd-a578-0030843d3802">
 <topic>samba -- potential leakage of arbitrary memory contents</topic>
 <affects>
 <package>
	<name>samba</name>
	<name>samba3</name>
	<name>ja-samba</name>
	<range><ge>3.0.29,1</ge><lt>3.0.32_2,1</lt></range>
 </package>
 <package>
	<name>samba32-devel</name>
	<range><lt>3.2.4_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samba Team reports:
	<blockquote cite="http://www.samba.org/samba/security/CVE-2008-4314.html">
	 Samba 3.0.29 and beyond contain a change to deal with gcc 4
	 optimizations. Part of the change modified range checking for
	 client-generated offsets of secondary trans, trans2 and nttrans
	 requests. These requests are used to transfer arbitrary amounts
	 of memory from clients to servers and back using small SMB
	 requests and contain two offsets: One offset (A) pointing into
	 the PDU sent by the client and one (B) to direct the transferred
	 contents into the buffer built on the server side. While the range
	 checking for offset (B) is correct, a cut and paste error lets offset
	 (A) pass completely unchecked against overflow.
	 The buffers passed into trans, trans2 and nttrans undergo higher-level
	 processing like DCE/RPC requests or listing directories. The missing
	 bounds check means that a malicious client can make the server do this
	 higher-level processing on arbitrary memory contents of the smbd process
	 handling the request. It is unknown if that can be abused to pass arbitrary
	 memory contents back to the client, but an important barrier is missing from
	 the affected Samba versions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4314</cvename>
 <url>http://www.samba.org/samba/security/CVE-2008-4314.html</url>
 <url>http://secunia.com/advisories/32813/</url>
 </references>
 <dates>
 <discovery>2008-11-27</discovery>
 <entry>2008-11-29</entry>
 </dates>
 </vuln>

<vuln vid="37940643-be1b-11dd-a578-0030843d3802">
 <topic>hplip -- hpssd Denial of Service</topic>
 <affects>
 <package>
	<name>hplip</name>
	<range><lt>2.8.2_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/31470">
	 A security issue has been reported in hplip, which can be
	 exploited by malicious, local users to cause a DoS.
	 The security issue is caused due to an error within hpssd.py when
	 parsing certain requests. This can be exploited to crash the service
	 by sending specially crafted requests to the default port 2207/TCP.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2940</cvename>
 <cvename>CVE-2008-2941</cvename>
 <bid>30683</bid>
 <url>https://rhn.redhat.com/errata/RHSA-2008-0818.html</url>
 <url>http://secunia.com/advisories/31470</url>
 </references>
 <dates>
 <discovery>2008-08-14</discovery>
 <entry>2008-11-29</entry>
 </dates>
 </vuln>

<vuln vid="87106b67-be13-11dd-a578-0030843d3802">
 <topic>cups -- potential buffer overflow in PNG reading code</topic>
 <affects>
 <package>
	<name>cups-base</name>
	<range><lt>1.3.9_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CUPS reports:
	<blockquote cite="http://svn.easysw.com/public/cups/trunk/CHANGES-1.3.txt">
	 The PNG image reading code did not validate the
	 image size properly, leading to a potential buffer overflow
	 (STR #2974)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5286</cvename>
 <url>http://www.cups.org/str.php?L2974</url>
 <url>http://svn.easysw.com/public/cups/trunk/CHANGES-1.3.txt</url>
 <url>http://www.openwall.com/lists/oss-security/2008/11/25/2</url>
 </references>
 <dates>
 <discovery>2008-10-17</discovery>
 <entry>2008-11-29</entry>
 <modified>2008-12-25</modified>
 </dates>
 </vuln>

<vuln vid="910486d5-ba4d-11dd-8f23-0019666436c2">
 <topic>imlib2 -- XPM processing buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>imlib2</name>
	<name>imlib2-nox11</name>
	<range><lt>1.4.1.000_1,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/Advisories/32796/">
	 A vulnerability has been discovered in imlib2, which can
	 be exploited by malicious people to potentially compromise
	 an application using the library.
	 The vulnerability is caused due to a pointer arithmetic
	 error within the "load()" function provided by the XPM
	 loader. This can be exploited to cause a heap-based buffer
	 overflow via a specially crafted XPM file.
	 Successful exploitation may allow execution of arbitrary
	 code.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>32371</bid>
 <cvename>CVE-2008-5187</cvename>
 <url>http://secunia.com/Advisories/32796/</url>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505714#15</url>
 <url>http://bugzilla.enlightenment.org/show_bug.cgi?id=547</url>
 </references>
 <dates>
 <discovery>2008-11-20</discovery>
 <entry>2008-11-24</entry>
 </dates>
 </vuln>

<vuln vid="4d4caee0-b939-11dd-a578-0030843d3802">
 <topic>streamripper -- multiple buffer overflows</topic>
 <affects>
 <package>
	<name>streamripper</name>
	<range><lt>1.64.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/secunia_research/2008-50/">
	 A boundary error exists within http_parse_sc_header() in lib/http.c
	 when parsing an overly long HTTP header starting with "Zwitterion v".
	 A boundary error exists within http_get_pls() in lib/http.c when
	 parsing a specially crafted pls playlist containing an overly long
	 entry.
	 A boundary error exists within http_get_m3u() in lib/http.c when
	 parsing a specially crafted m3u playlist containing an overly long
	 "File" entry.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4829</cvename>
 <url>http://secunia.com/secunia_research/2008-50/</url>
 <url>http://streamripper.cvs.sourceforge.net/viewvc/streamripper/sripper_1x/CHANGES?revision=1.196</url>
 </references>
 <dates>
 <discovery>2008-11-05</discovery>
 <entry>2008-11-23</entry>
 </dates>
 </vuln>

<vuln vid="00d6040a-b8e0-11dd-a578-0030843d3802">
 <topic>mantis -- session hijacking vulnerability</topic>
 <affects>
 <package>
	<name>mantis</name>
	<range><lt>1.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The mantis Team reports:
	<blockquote cite="http://www.mantisbt.org/bugs/changelog_page.php?version_id=97">
	 When configuring a web application to use only ssl (e. g. by
	 forwarding all http-requests to https), a user would expect that
	 sniffing and hijacking the session is impossible.
	 Though, for this to be secure, one needs to set the session cookie to
	 have the secure flag. Else the cookie will be transferred through http
	 if the victim's browser does a single http-request on the same domain.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3102</cvename>
 <url>http://www.mantisbt.org/bugs/view.php?id=9524</url>
 <url>http://www.mantisbt.org/bugs/view.php?id=9533</url>
 <url>http://enablesecurity.com/2008/08/11/surf-jack-https-will-not-save-you/</url>
 <url>http://int21.de/cve/CVE-2008-3102-mantis.html</url>
 </references>
 <dates>
 <discovery>2008-10-14</discovery>
 <entry>2008-11-22</entry>
 </dates>
 </vuln>

<vuln vid="75c24c1d-b688-11dd-88fd-001c2514716c">
 <topic>dovecot -- ACL plugin bypass vulnerabilities</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><lt>1.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Timo Sirainen reports in dovecot 1.1.4 release notes:
	<blockquote cite="http://www.dovecot.org/list/dovecot-news/2008-October/000085.html">
	 ACL plugin fixes: Negative rights were actually treated
	 as positive rights. 'k' right didn't prevent creating
	 parent/child/child mailbox. ACL groups weren't working.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>31587</bid>
 <cvename>CVE-2008-4577</cvename>
 <cvename>CVE-2008-4578</cvename>
 </references>
 <dates>
 <discovery>2008-10-05</discovery>
 <entry>2008-11-19</entry>
 </dates>
 </vuln>

<vuln vid="f1e0164e-b67b-11dd-a55e-00163e000016">
 <topic>libxml2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.6.32_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/Advisories/32773/">
	 Two vulnerabilities have been reported in Libxml2, which can be
	 exploited by malicious people to cause a DoS (Denial of Service) or
	 to potentially compromise an application using the library.
	 1) An integer overflow error in the "xmlSAX2Characters()" function
	 can be exploited to trigger a memory corruption via a specially
	 Successful exploitation may allow execution of arbitrary code, but
	 requires e.g. that the user is tricked into processing an overly
	 large XML file (2GB or more).
	 2) An integer overflow error in the "xmlBufferResize()" function
	 can be exploited to trigger the execution of an infinite loop.
	 The vulnerabilities are reported in version 2.7.2.
	 Other versions may also be affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4225</cvename>
 <cvename>CVE-2008-4226</cvename>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=470466</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=470480</url>
 <url>http://secunia.com/Advisories/32773/</url>
 </references>
 <dates>
 <discovery>2008-11-18</discovery>
 <entry>2008-11-19</entry>
 </dates>
 </vuln>

<vuln vid="937adf01-b64a-11dd-a55e-00163e000016">
 <topic>openfire -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>openfire</name>
	<range><lt>3.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Andreas Kurtz reports:
	<blockquote cite="http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt">
	 The jabber server Openfire (&lt;= version 3.6.0a) contains several
	 serious vulnerabilities. Depending on the particular runtime
	 environment these issues can potentially even be used by an
	 attacker to execute code on operating system level.
	 <ol>
	 <li>Authentication bypass - This vulnerability provides an attacker
	 full access to all functions in the admin webinterface without
	 providing any user credentials. The Tomcat filter which is
	 responsible for authentication could be completely
	 circumvented.</li>
	 <li>SQL injection - It is possible to pass SQL statements to the
	 backend database through a SQL injection vulnerability. Depending
	 on the particular runtime environment and database permissions it
	 is even possible to write files to disk and execute code on
	 operating system level.</li>
	 <li>Multiple Cross-Site Scripting - Permits arbitrary insertion
	 of HTML- and JavaScript code in login.jsp. An attacker could
	 also manipulate a parameter to specify a destination to which a
	 user will be forwarded to after successful authentication.</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-6510</cvename>
 <cvename>CVE-2008-6511</cvename>
 <cvename>CVE-2008-6508</cvename>
 <cvename>CVE-2009-1595</cvename>
 <cvename>CVE-2008-1728</cvename>
 <cvename>CVE-2008-6509</cvename>
 <url>http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt</url>
 <url>http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html</url>
 <url>http://secunia.com/Advisories/32478/</url>
 </references>
 <dates>
 <discovery>2008-11-07</discovery>
 <entry>2008-11-19</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="75f2382e-b586-11dd-95f9-00e0815b8da8">
 <topic>syslog-ng2 -- startup directory leakage in the chroot environment</topic>
 <affects>
 <package>
	<name>syslog-ng2</name>
	<range><lt>2.0.9_2</lt></range>
 </package>
 <package>
	<name>syslog-ng</name>
	<range><le>1.6.12_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Florian Grandel reports:
	<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791">
	 I have not had the time to analyze all of syslog-ng code.
	 But by reading the code section near the chroot call and looking
	 at strace results I believe that syslog-ng does not chdir to the
	 chroot jail's location before chrooting into it.
	 This opens up ways to work around the chroot jail.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5110</cvename>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791</url>
 <url>http://www.openwall.com/lists/oss-security/2008/11/17/3</url>
 </references>
 <dates>
 <discovery>2008-11-15</discovery>
 <entry>2008-11-18</entry>
 <modified>2009-07-01</modified>
 </dates>
 </vuln>

<vuln vid="a1126054-b57c-11dd-8892-0017319806e7">
 <topic>enscript -- arbitrary code execution vulnerability</topic>
 <affects>
 <package>
	<name>enscript-a4</name>
	<name>enscript-letter</name>
	<name>enscript-letterdj</name>
	<range><lt>1.6.4_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ulf Harnhammar of Secunia Research reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3863">
	 Stack-based buffer overflow in the read_special_escape function
	 in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e
	 (aka special escapes processing) option is enabled, allows
	 user-assisted remote attackers to execute arbitrary code via a
	 crafted ASCII file, related to the setfilename command.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3863</cvename>
 <cvename>CVE-2008-4306</cvename>
 <url>http://secunia.com/secunia_research/2008-41/</url>
 </references>
 <dates>
 <discovery>2008-10-22</discovery>
 <entry>2008-11-18</entry>
 </dates>
 </vuln>

<vuln vid="45298931-b3bf-11dd-80f8-001cc0377035">
 <topic>gnutls -- X.509 certificate chain validation vulnerability</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>2.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/32232/discuss">
	 GnuTLS is prone to a security-bypass vulnerability because the
	 application fails to properly validate chained X.509 certificates.
	 Successfully exploiting this issue allows attackers to perform
	 man-in-the-middle attacks by impersonating trusted servers.
	 Unsuspecting users may be under a false sense of security that can
	 aid attackers in launching further attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>32232</bid>
 <cvename>CVE-2008-4989</cvename>
 <url>http://www.gnu.org/software/gnutls/security.html</url>
 <mlist msgid="4918143A.3050103@gmx.net">http://lists.gnu.org/archive/html/gnutls-devel/2008-11/msg00017.html</mlist>
 </references>
 <dates>
 <discovery>2008-11-10</discovery>
 <entry>2008-11-16</entry>
 </dates>
 </vuln>

<vuln vid="daf045d7-b211-11dd-a987-000c29ca8953">
 <topic>net-snmp -- DoS for SNMP agent via crafted GETBULK request</topic>
 <affects>
 <package>
	<name>net-snmp</name>
	<range><gt>5.4</gt><lt>5.4.2.1</lt></range>
	<range><gt>5.3</gt><lt>5.3.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wes Hardaker reports through sourceforge.net forum:
	<blockquote cite="http://sourceforge.net/forum/forum.php?forum_id=882903">
	 SECURITY ISSUE: A bug in the getbulk handling code could
	 let anyone with even minimal access crash the agent. If you
	 have open access to your snmp agents (bad bad bad; stop doing
	 that!) or if you don't trust everyone that does have access to
	 your agents you should updated immediately to prevent
	 potential denial of service attacks.
	</blockquote>
	Description at cve.mitre.org additionally clarifies:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4309">
	 Integer overflow in the netsnmp_create_subtree_cache
	 function in agent/snmp_agent.c in net-snmp 5.4 before
	 5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows
	 remote attackers to cause a denial of service (crash) via
	 a crafted SNMP GETBULK request, which triggers a heap-based
	 buffer overflow, related to the number of responses or
	 repeats.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4309</cvename>
 <url>http://sourceforge.net/forum/forum.php?forum_id=882903</url>
 <url>http://www.openwall.com/lists/oss-security/2008/10/31/1</url>
 <url>http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/tags/Ext-5-2-5-1/net-snmp/agent/snmp_agent.c?r1=17271&amp;r2=17272&amp;pathrev=17272</url>
 </references>
 <dates>
 <discovery>2008-10-12</discovery>
 <entry>2008-11-14</entry>
 <modified>2009-03-23</modified>
 </dates>
 </vuln>

<vuln vid="f29fea8f-b19f-11dd-a55e-00163e000016">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>2.0.0.18,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.4,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>2.0.0.18</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.13</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports:
	<blockquote cite="http://www.mozilla.org/security/announce/">
	 MFSA 2008-58 Parsing error in E4X default namespace
	 MFSA 2008-57 -moz-binding property bypasses security checks on
	 codebase principals
	 MFSA 2008-56 nsXMLHttpRequest::NotifyEventListeners() same-origin
	 violation
	 MFSA 2008-55 Crash and remote code execution in
	 nsFrameManager
	 MFSA 2008-54 Buffer overflow in http-index-format parser
	 MFSA 2008-53 XSS and JavaScript privilege escalation via session
	 restore
	 MFSA 2008-52 Crashes with evidence of memory corruption
	 (rv:1.9.0.4/1.8.1.18)
	 MFSA 2008-51 file: URIs inherit chrome privileges when opened
	 from chrome
	 MFSA 2008-50 Crash and remote code execution via __proto__
	 tampering
	 MFSA 2008-49 Arbitrary code execution via Flash Player dynamic
	 module unloading
	 MFSA 2008-48 Image stealing via canvas and HTTP redirect
	 MFSA 2008-47 Information stealing via local shortcut files
	 MFSA 2008-46 Heap overflow when canceling newsgroup message
	 MFSA 2008-44 resource: traversal vulnerabilities
	 MFSA 2008-43 BOM characters stripped from JavaScript before
	 execution
	 MFSA 2008-42 Crashes with evidence of memory corruption
	 (rv:1.9.0.2/1.8.1.17)
	 MFSA 2008-41 Privilege escalation via XPCnativeWrapper
	 pollution
	 MFSA 2008-38 nsXMLDocument::OnChannelRedirect() same-origin
	 violation
	 MFSA 2008-37 UTF-8 URL stack buffer overflow
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0017</cvename>
 <cvename>CVE-2008-4582</cvename>
 <cvename>CVE-2008-5012</cvename>
 <cvename>CVE-2008-5013</cvename>
 <cvename>CVE-2008-5014</cvename>
 <cvename>CVE-2008-5015</cvename>
 <cvename>CVE-2008-5016</cvename>
 <cvename>CVE-2008-5017</cvename>
 <cvename>CVE-2008-5018</cvename>
 <cvename>CVE-2008-5019</cvename>
 <cvename>CVE-2008-5021</cvename>
 <cvename>CVE-2008-5022</cvename>
 <cvename>CVE-2008-5023</cvename>
 <cvename>CVE-2008-5024</cvename>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-47.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-48.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-49.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-50.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-51.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-52.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-53.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-54.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-55.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-56.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-57.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-58.html</url>
 </references>
 <dates>
 <discovery>2008-11-13</discovery>
 <entry>2008-11-13</entry>
 <modified>2008-11-23</modified>
 </dates>
 </vuln>

<vuln vid="445ed958-b0d9-11dd-a55e-00163e000016">
 <topic>faad2 -- heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>faad2</name>
	<range><lt>2.6.1_1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4201">
	 Heap-based buffer overflow in the decodeMP4file function
	 (frontend/main.c) in FAAD2 2.6.1 and earlier allows remote
	 attackers to cause a denial of service (crash) and possibly
	 execute arbitrary code via a crafted MPEG-4 (MP4) file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4201</cvename>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499899</url>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200811-03.xml</url>
 </references>
 <dates>
 <discovery>2008-09-16</discovery>
 <entry>2008-11-12</entry>
 <modified>2008-11-13</modified>
 </dates>
 </vuln>

<vuln vid="66657bd5-ac92-11dd-b541-001f3b19d541">
 <topic>emacs -- run-python vulnerability</topic>
 <affects>
 <package>
	<name>emacs</name>
	<range><ge>22</ge><le>22.2_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Emacs developers report:
	<blockquote cite="http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html">
	 The Emacs command `run-python' launches an interactive
	 Python interpreter. After the Python process starts up,
	 Emacs automatically sends it the line:
	 import emacs
	 which normally imports a script named emacs.py which is
	 distributed with Emacs. This script, which is typically
	 located in a write-protected installation directory with
	 other Emacs program files, defines various functions to help
	 the Python process communicate with Emacs.
	 The vulnerability arises because Python, by default,
	 prepends '' to the module search path, so modules are looked
	 for in the current directory. If the current directory is
	 world-writable, an attacker may insert malicious code by
	 adding a fake Python module named emacs.py into that
	 directory.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3949</cvename>
 <url>http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html</url>
 </references>
 <dates>
 <discovery>2008-09-05</discovery>
 <entry>2008-11-07</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="24b64fb0-af1d-11dd-8a16-001b1116b350">
 <topic>clamav -- off-by-one heap overflow in VBA project parser</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.94.1</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><lt>20081105</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Advisory from Moritz Jodeit, November 8th, 2008:
	<blockquote cite="http://www.securityfocus.com/archive/1/498169/30/0/threaded">
	 ClamAV contains an off-by-one heap overflow vulnerability
	 in the code responsible for parsing VBA project files.
	 Successful exploitation could allow an attacker to execute
	 arbitrary code with the privileges of the `clamd' process by
	 sending an email with a prepared attachment.
	 A VBA project file embedded inside an OLE2 office document
	 send as an attachment can trigger the off-by-one.
	</blockquote>
	Entry from Thu Oct 30 13:52:42 CET 2008 (acab) in ChangeLog:
	<blockquote cite="http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog">
	 libclamav/vba_extract.c: get_unicode_name off-by-one,
	 bb#1239 reported by Moritz Jodeit &gt;moritz*jodeit.org&lt;
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.securityfocus.com/archive/1/498169/30/0/threaded</url>
 <url>http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog</url>
 <cvename>CVE-2008-5050</cvename>
 </references>
 <dates>
 <discovery>2008-11-08</discovery>
 <entry>2008-11-10</entry>
 </dates>
 </vuln>

<vuln vid="c89a3ebb-ae07-11dd-b4b2-001f3c8eabeb">
 <topic>trac -- potential DOS vulnerability</topic>
 <affects>
 <package>
	<name>trac</name>
	<range><lt>0.11.2</lt></range>
 </package>
 <package>
	<name>ja-trac</name>
	<range><lt>0.11.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Trac development team reports:
	<blockquote cite="http://groups.google.com/group/trac-announce/browse_thread/thread/67f7a22ec818d97d">
	 0.11.2 is a new stable maintenance release. It contains
	 several security fixes and everyone is recommended to
	 upgrade their installations.
	 Bug fixes:
	 Fixes potential DOS vulnerability with certain wiki markup.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://groups.google.com/group/trac-announce/browse_thread/thread/67f7a22ec818d97d</url>
 </references>
 <dates>
 <discovery>2008-11-08</discovery>
 <entry>2008-11-09</entry>
 </dates>
 </vuln>

<vuln vid="4b09378e-addb-11dd-a578-0030843d3802">
 <topic>vlc -- cue processing stack overflow</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><lt>0.8.6.i_2,2</lt></range>
 </package>
 <package>
	<name>vlc-devel</name>
	<range><lt>0.9.6,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The VLC Team reports:
	<blockquote cite="http://www.videolan.org/security/sa0810.html">
	 The VLC media player contains a stack overflow vulnerability
	 while parsing malformed cue files. The vulnerability may be
	 exploited by a (remote) attacker to execute arbitrary code in
	 the context of VLC media player.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-5032</cvename>
 <cvename>CVE-2008-5036</cvename>
 <url>http://www.videolan.org/security/sa0810.html</url>
 <url>http://www.trapkit.de/advisories/TKADV2008-012.txt</url>
 </references>
 <dates>
 <discovery>2008-11-05</discovery>
 <entry>2008-11-08</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="0e30e802-a9db-11dd-93a2-000bcdf0a03b">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>linux-opera</name>
	<range><lt>9.62</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera reports:
	<blockquote cite="http://www.opera.com/support/search/view/906/">
	 When certain parameters are passed to Opera's History
	 Search, they can cause content not to be correctly
	 sanitized. This can allow scripts to be injected into the
	 History Search results page. Such scripts can then run with
	 elevated privileges and interact with Opera's configuration,
	 allowing them to execute arbitrary code.
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/907/">
	 The links panel shows links in all frames on the current
	 page, including links with JavaScript URLs. When a page is
	 held in a frame, the script is incorrectly executed on the
	 outermost page, not the page where the URL was located.
	 This can be used to execute scripts in the context of an
	 unrelated frame, which allows cross-site scripting.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4794</cvename>
 <url>http://www.opera.com/support/search/view/906/</url>
 <url>http://www.opera.com/support/search/view/907/</url>
 </references>
 <dates>
 <discovery>2008-11-03</discovery>
 <entry>2008-11-03</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="07bb3bd2-a920-11dd-8503-0211060005df">
 <topic>qemu -- Heap overflow in Cirrus emulation</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>0.9.1_10</lt></range>
	<range><ge>0.9.1s.20080101*</ge><lt>0.9.1s.20080620_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Aurelien Jarno reports:
	<blockquote cite="http://lists.gnu.org/archive/html/qemu-devel/2008-10/msg01363.html">
	 CVE-2008-4539: fix a heap overflow in Cirrus emulation
	 The code in hw/cirrus_vga.c has changed a lot between
	 CVE-2007-1320 has been announced and the patch has been applied.
	 As a consequence it has wrongly applied and QEMU is still
	 vulnerable to this bug if using VNC.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4539</cvename>
 <mlist msgid="E1Kw4kF-0001Mx-KA@cvs.savannah.gnu.org">http://lists.gnu.org/archive/html/qemu-devel/2008-10/msg01363.html</mlist>
 </references>
 <dates>
 <discovery>2008-11-01</discovery>
 <entry>2008-11-02</entry>
 </dates>
 </vuln>

<vuln vid="85b0bbc8-a7a5-11dd-8283-001c2514716c">
 <topic>phpmyadmin -- Cross-Site Scripting Vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><gt>3.0</gt><lt>3.0.1.1</lt></range>
	<range><lt>2.11.9.3</lt></range>
 </package>
 <package>
	<name>phpMyAdmin211</name>
	<range><lt>2.11.9.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/31928">
	 phpMyAdmin is prone to a cross-site scripting vulnerability
	 because it fails to sufficiently sanitize user-supplied data.
	 An attacker may leverage this issue to execute arbitrary
	 script code in the browser of an unsuspecting user in the
	 context of the affected site. This may allow the attacker
	 to steal cookie-based authentication credentials and to
	 launch other attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>31928</bid>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-9</url>
 </references>
 <dates>
 <discovery>2008-10-30</discovery>
 <entry>2008-10-31</entry>
 <modified>2008-10-31</modified>
 </dates>
 </vuln>

<vuln vid="f5c4d7f7-9f4b-11dd-bab1-001999392805">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>linux-opera</name>
	<range><lt>9.61</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera reports:
	<blockquote cite="http://www.opera.com/support/search/view/903/">
	 Certain constructs are not escaped correctly by Opera's
	 History Search results. These can be used to inject scripts
	 into the page, which can then be used to look through the user's
	 browsing history, including the contents of the pages they have
	 visited. These may contain sensitive information.
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/904/">
	 If a link that uses a JavaScript URL triggers Opera's Fast
	 Forward feature, when the user activates Fast Forward, the
	 script should run on the current page. When a page is held in a
	 frame, the script is incorrectly executed on the outermost page,
	 not the page where the URL was located. This can be used to
	 execute scripts in the context of an unrelated frame, which
	 allows cross-site scripting.
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/905/">
	 When Opera is previewing a news feed, some scripts are not
	 correctly blocked. These scripts are able to subscribe the user
	 to any feed URL that the attacker chooses, and can also view
	 the contents of any feeds that the user is subscribed to.
	 These may contain sensitive information.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4697</cvename>
 <cvename>CVE-2008-4698</cvename>
 <cvename>CVE-2008-4725</cvename>
 <url>http://www.opera.com/support/search/view/903/</url>
 <url>http://www.opera.com/support/search/view/904/</url>
 <url>http://www.opera.com/support/search/view/905/</url>
 </references>
 <dates>
 <discovery>2008-10-17</discovery>
 <entry>2008-10-28</entry>
 <modified>2010-05-02</modified>
 </dates>
 </vuln>

<vuln vid="2ddbfd29-a455-11dd-a55e-00163e000016">
 <topic>libspf2 -- Buffer overflow</topic>
 <affects>
 <package>
	<name>libspf2</name>
	<range><lt>1.2.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2469">
	 Heap-based buffer overflow in the SPF_dns_resolv_lookup function
	 in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers
	 to execute arbitrary code via a long DNS TXT record with a modified
	 length field.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>31881</bid>
 <cvename>CVE-2008-2469</cvename>
 </references>
 <dates>
 <discovery>2008-10-21</discovery>
 <entry>2008-10-27</entry>
 </dates>
 </vuln>

<vuln vid="55616fda-a2d0-11dd-a9f9-0030843d3802">
 <topic>openx -- sql injection vulnerability</topic>
 <affects>
 <package>
	<name>openx</name>
	<range><lt>2.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/32114/">
	 OpenX can be exploited by malicious people to conduct SQL injection
	 attacks.
	 Input passed to the "bannerid" parameter in www/delivery/ac.php is
	 not properly sanitised before being used in SQL queries. This can be
	 exploited to manipulate SQL queries by injecting arbitrary SQL
	 code.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/32114/</url>
 <url>http://blog.openx.org/10/openx-security-update/</url>
 </references>
 <dates>
 <discovery>2008-10-03</discovery>
 <entry>2008-10-25</entry>
 </dates>
 </vuln>

<vuln vid="9d3020e4-a2c4-11dd-a9f9-0030843d3802">
 <topic>flyspray -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>flyspray</name>
	<range><lt>0.9.9.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Flyspray Project reports:
	<blockquote cite="http://www.flyspray.org/fsa:2">
	 Flyspray is affected by a Cross Site scripting Vulnerability
	 due to an error escaping PHP's $_SERVER['QUERY_STRING']
	 superglobal, that can be maliciously used to inject
	 arbitrary code into the savesearch() javascript function.
	 There is an XSS problem in the history tab, the application
	 fails to sanitize the "details" parameter correctly, leading
	 to the possibility of arbitrary code injection into the
	 getHistory() javascript function.
	</blockquote>
	<blockquote cite="http://www.flyspray.org/fsa:3">
	 Flyspray is affected by a Cross Site scripting Vulnerability
	 due missing escaping of SQL error messages. By including HTML
	 code in a query and at the same time causing it to fail by
	 submitting invalid data, an XSS hole can be exploited.
	 There is an XSS problem in the task history attached to
	 comments, since the application fails to sanitize the
	 old_value and new_value database fields for changed task
	 summaries.
	</blockquote>
	<blockquote cite="http://secunia.com/advisories/29215">
	 Input passed via the "item_summary" parameter to
	 "index.php?do=details" is not properly sanitised before being
	 returned to the user. This can be exploited to execute arbitrary
	 HTML and script code in a user's browser session in context of
	 an affected site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6461</cvename>
 <cvename>CVE-2008-1165</cvename>
 <cvename>CVE-2008-1166</cvename>
 <url>http://secunia.com/advisories/29215</url>
 </references>
 <dates>
 <discovery>2008-02-24</discovery>
 <entry>2008-10-25</entry>
 </dates>
 </vuln>

<vuln vid="3a4a3e9c-a1fe-11dd-81be-001c2514716c">
 <topic>wordpress -- snoopy "_httpsrequest()" shell command execution vulnerability</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>de-wordpress</name>
	<name>wordpress-mu</name>
	<range><lt>2.6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Wordpress development team reports:
	<blockquote cite="http://wordpress.org/development/2008/10/wordpress-263/">
	 A <a href="http://secunia.com/Advisories/32361/">vulnerability</a>
	 in the <a href="http://sourceforge.net/projects/snoopy/">Snoopy</a>
	 library was announced today. WordPress uses Snoopy to fetch the feeds
	 shown in the Dashboard. Although this seems to be a low risk
	 vulnerability for WordPress users, we wanted to get an update out
	 immediately.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>31887</bid>
 <url>http://secunia.com/Advisories/32361/</url>
 <url>http://wordpress.org/development/2008/10/wordpress-263/</url>
 </references>
 <dates>
 <discovery>2008-10-23</discovery>
 <entry>2008-10-24</entry>
 </dates>
 </vuln>

<vuln vid="706c9eef-a077-11dd-b413-001372fd0af2">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.12</lt></range>
 </package>
 <package>
	<name>drupal6</name>
	<range><lt>6.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Project reports:
	<blockquote cite="http://drupal.org/node/324824">
	 On a server configured for IP-based virtual hosts, Drupal may be
	 caused to include and execute specifically named files outside
	 of its root directory. This bug affects both Drupal 5 and
	 Drupal 6.
	 The title of book pages is not always properly escaped, enabling
	 users with the "create book content" permission or the
	 permission to edit any node in the book hierarchy to insert
	 arbitrary HTML and script code into pages. Such a Cross site
	 scripting attack may lead to the attacker gaining administrator
	 access. This bug affects Drupal 6.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-6170</cvename>
 <url>http://drupal.org/node/324824</url>
 </references>
 <dates>
 <discovery>2008-10-22</discovery>
 <entry>2008-10-22</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="06eac338-9ddf-11dd-813f-000e35248ad7">
 <topic>libxine -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>libxine</name>
	<range><lt>1.1.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	xine team reports:
	<blockquote cite="http://www.xinehq.de/index.php/news">
	 A new xine-lib version is now available. This release contains
	 some security fixes, notably a DoS via corrupted Ogg files
	 (CVE-2008-3231), some related fixes, and fixes for a few possible
	 buffer overflows.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3231</cvename>
 <url>http://www.xinehq.de/index.php/news</url>
 <url>http://xforce.iss.net/xforce/xfdb/44040</url>
 </references>
 <dates>
 <discovery>2008-07-13</discovery>
 <entry>2008-10-19</entry>
 </dates>
 </vuln>

<vuln vid="78f456fd-9c87-11dd-a55e-00163e000016">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><le>9.0r124_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb08-18.html">
	 Potential vulnerabilities have been identified in Adobe Flash
	 Player 9.0.124.0 and earlier that could allow an attacker who
	 successfully exploits these potential vulnerabilities to bypass
	 Flash Player security controls. Adobe recommends users update
	 to the most current version of Flash Player available for their
	 platform.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6243</cvename>
 <cvename>CVE-2008-3873</cvename>
 <cvename>CVE-2007-4324</cvename>
 <cvename>CVE-2008-4401</cvename>
 <cvename>CVE-2008-4503</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb08-18.html</url>
 </references>
 <dates>
 <discovery>2008-10-15</discovery>
 <entry>2008-10-17</entry>
 </dates>
 </vuln>

<vuln vid="d71da236-9a94-11dd-8f42-001c2514716c">
 <topic>libxml2 -- two vulnerabilities</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.6.32_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/31558/">
	 Two vulnerabilities have been reported in Libxml2, which can be
	 exploited by malicious people to cause a DoS (Denial of Service)
	 or potentially compromise an application using the library.
	 1) A recursion error exists when processing certain XML content.
	 This can be exploited to e.g. exhaust all available memory and CPU
	 resources by tricking an application using Libxml2 into processing
	 specially crafted XML documents.
	 2) A boundary error in the processing of long XML entity names
	 in parser.c can be exploited to cause a heap-based buffer overflow
	 when specially crafted XML content is parsed.
	 Successful exploitation may allow execution of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3281</cvename>
 <cvename>CVE-2008-3529</cvename>
 </references>
 <dates>
 <discovery>2008-08-22</discovery>
 <entry>2008-10-15</entry>
 <modified>2008-10-20</modified>
 </dates>
 </vuln>

<vuln vid="12efc567-9879-11dd-a5e7-0030843d3802">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.11</lt></range>
 </package>
 <package>
	<name>drupal6</name>
	<range><lt>6.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Project reports:
	<blockquote cite="http://drupal.org/node/318706">
	 A logic error in the core upload module validation allowed
	 unprivileged users to attach files to content. Users can view files
	 attached to content which they do not otherwise have access to.
	 If the core upload module is not enabled, your site will not be
	 affected.
	 A deficiency in the user module allowed users who had been blocked
	 by access rules to continue logging into the site under certain
	 conditions. If you do not use the 'access rules' functionality in core,
	 your site will not be affected.
	 The BlogAPI module does not implement correct validation for
	 certain content fields, allowing for values to be set for fields which
	 would otherwise be inaccessible on an internal Drupal form. We have
	 hardened these checks in BlogAPI module for this release, but the
	 security team would like to re-iterate that the 'Administer content
	 with BlogAPI' permission should only be given to trusted users.
	 If the core BlogAPI module is not enabled, your site will not be
	 affected.
	 A weakness in the node module API allowed for node validation to be
	 bypassed in certain circumstances for contributed modules implementing
	 the API. Additional checks have been added to ensure that validation
	 is performed in all cases. This vulnerability only affects sites using
	 one of a very small number of contributed modules, all of which will
	 continue to work correctly with the improved API. None of them were
	 found vulnerable, so our correction is a preventative measure.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4791</cvename>
 <cvename>CVE-2008-4792</cvename>
 <cvename>CVE-2008-4793</cvename>
 <url>http://drupal.org/node/318706</url>
 <url>http://secunia.com/advisories/32200/</url>
 <url>http://secunia.com/advisories/32201/</url>
 <url>http://secunia.com/advisories/32198/</url>
 </references>
 <dates>
 <discovery>2008-10-08</discovery>
 <entry>2008-10-12</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="ce29ce1d-971a-11dd-ab7e-001c2514716c">
 <topic>cups -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cups-base</name>
	<range><lt>1.3.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The release note of cups 1.3.9 reports:
	<blockquote cite="http://cups.org/articles.php?L575">
	 It contains the following fixes:
	 <ul>
	 <li>SECURITY: The HP-GL/2 filter did not range check
	 pen numbers (STR #2911)</li>
	 <li>SECURITY: The SGI image file reader did not range
	 check 16-bit run lengths (STR #2918)</li>
	 <li>SECURITY: The text filter did not range check cpi,
	 lpi, or column values (STR #2919)</li>
	 </ul>
	</blockquote>
	Exploitation of this vulnerability results in the execution
	 of arbitrary code with the privileges of the affected service.
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3639</cvename>
 <cvename>CVE-2008-3640</cvename>
 <cvename>CVE-2008-3641</cvename>
 </references>
 <dates>
 <discovery>2008-10-09</discovery>
 <entry>2008-10-10</entry>
 </dates>
 </vuln>

<vuln vid="fb84d5dd-9528-11dd-9a00-001999392805">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>linux-opera</name>
	<range><lt>9.60</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera reports:
	<blockquote cite="http://www.opera.com/support/search/view/901/">
	 If a malicious page redirects Opera to a specially crafted
	 address (URL), it can cause Opera to crash. Given sufficient
	 address content, the crash could cause execution of code
	 controlled by the attacking page.
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/902/">
	 Once a Java applet has been cached, if a page can predict the
	 cache path for that applet, it can load the applet from the
	 cache, causing it to run in the context of the local machine.
	 This allows it to read other cache files on the computer or
	 perform other normally more restrictive actions. These files
	 could contain sensitive information, which could then be sent
	 to the attacker.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4695</cvename>
 <cvename>CVE-2008-4694</cvename>
 <url>http://www.opera.com/support/search/view/901/</url>
 <url>http://www.opera.com/support/search/view/902/</url>
 </references>
 <dates>
 <discovery>2008-10-04</discovery>
 <entry>2008-10-10</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="4775c807-8f30-11dd-821f-001cc0377035">
 <topic>mysql -- command line client input validation vulnerability</topic>
 <affects>
 <package>
	<name>mysql-client</name>
	<range><gt>5.1</gt><lt>5.1.28_1</lt></range>
	<range><gt>5.0</gt><lt>5.0.67_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Thomas Henlich reports:
	<blockquote cite="http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability/">
	 The mysql command-line client does not quote HTML special
	 characters like &lt; in its output. This allows an attacker who
	 is able to write data into a table to hide or modify records in
	 the output, and to inject potentially dangerous code, e. g.
	 Javascript to perform cross-site scripting or cross-site request
	 forgery attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>31486</bid>
 <url>http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability/</url>
 </references>
 <dates>
 <discovery>2007-04-17</discovery>
 <entry>2008-10-01</entry>
 <modified>2008-10-10</modified>
 </dates>
 </vuln>

<vuln vid="724e6f93-8f2a-11dd-821f-001cc0377035">
 <topic>mplayer -- multiple integer overflows</topic>
 <affects>
 <package>
	<name>mplayer</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.11_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The oCERT team reports:
	<blockquote cite="http://www.ocert.org/advisories/ocert-2008-013.html">
	 The MPlayer multimedia player suffers from a vulnerability which
	 could result in arbitrary code execution and at the least, in
	 unexpected process termination. Three integer underflows located
	 in the Real demuxer code can be used to exploit a heap overflow,
	 a specific video file can be crafted in order to make the
	 stream_read function reading or writing arbitrary amounts of
	 memory.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3827</cvename>
 <url>http://www.ocert.org/advisories/ocert-2008-013.html</url>
 </references>
 <dates>
 <discovery>2008-09-30</discovery>
 <entry>2008-10-01</entry>
 <modified>2008-10-02</modified>
 </dates>
 </vuln>

<vuln vid="fb911e31-8ceb-11dd-bb29-000c6e274733">
 <topic>lighttpd -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>lighttpd</name>
	<range><lt>1.4.19_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Lighttpd seurity annoucement:
	<blockquote cite="http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt">
	 lighttpd 1.4.19, and possibly other versions before 1.5.0, does
	 not decode the url before matching against rewrite and redirect
	 patterns, which allows attackers to bypass rewrites rules. this
	 can be a security problem in certain configurations if these rules
	 are used to hide certain urls.
	</blockquote>
	<blockquote cite="http://www.lighttpd.net/security/lighttpd_sa_2008_06.txt">
	 lighttpd 1.4.19, and possibly other versions before 1.5.0, does
	 not lowercase the filename after generating it from the url in
	 mod_userdir on case insensitive (file)systems.
	 As other modules are case sensitive, this may lead to information
	 disclosure; for example if one configured php to handle files
	 ending on ".php", an attacker will get the php source with
	 http://example.com/~user/file.PHP
	</blockquote>
	<blockquote cite="http://www.lighttpd.net/security/lighttpd_sa_2008_07.txt">
	 lighttpd 1.4.19 does not always release a header if it triggered
	 a 400 (Bad Request) due to a duplicate header.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>31434</bid>
 <cvename>CVE-2008-4298</cvename>
 <cvename>CVE-2008-4359</cvename>
 <cvename>CVE-2008-4360</cvename>
 <url>http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt</url>
 <url>http://www.lighttpd.net/security/lighttpd_sa_2008_06.txt</url>
 <url>http://www.lighttpd.net/security/lighttpd_sa_2008_07.txt</url>
 </references>
 <dates>
 <discovery>2008-09-26</discovery>
 <entry>2008-09-27</entry>
 <modified>2009-02-22</modified>
 </dates>
 </vuln>

<vuln vid="24ec781b-8c11-11dd-9923-0016d325a0ed">
 <topic>bitlbee -- account recreation security issues</topic>
 <affects>
 <package>
	<name>bitlbee</name>
	<range><lt>1.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/31633/">
	 Some security issues have been reported in BitlBee, which can
	 be exploited by malicious people to bypass certain security
	 restrictions and hijack accounts.
	 The security issues are caused due to unspecified errors, which
	 can be exploited to overwrite existing accounts.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3920</cvename>
 <cvename>CVE-2008-3969</cvename>
 <url>http://secunia.com/advisories/31633/</url>
 </references>
 <dates>
 <discovery>2008-08-27</discovery>
 <entry>2008-09-26</entry>
 <modified>2008-10-03</modified>
 </dates>
 </vuln>

<vuln vid="2273879e-8a2f-11dd-a6fe-0030843d3802">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>2.0.0.17,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.2,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<name>linux-firefox-devel</name>
	<range><lt>2.0.0.17</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.12</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.17</lt></range>
 </package>
 <package>
	<name>flock</name>
	<name>linux-flock</name>
	<range><lt>2.0</lt></range>
 </package>
 <package>
	<name>linux-seamonkey-devel</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports:
	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
	 MFSA 2008-37 UTF-8 URL stack buffer overflow
	 MFSA 2008-38 nsXMLDocument::OnChannelRedirect() same-origin
	 violation
	 MFSA 2008-39 Privilege escalation using feed preview page and
	 XSS flaw
	 MFSA 2008-40 Forced mouse drag
	 MFSA 2008-41 Privilege escalation via XPCnativeWrapper
	 pollution
	 MFSA 2008-42 Crashes with evidence of memory corruption
	 (rv:1.9.0.2/1.8.1.17)
	 MFSA 2008-43 BOM characters stripped from JavaScript before
	 execution
	 MFSA 2008-44 resource: traversal vulnerabilities
	 MFSA 2008-45 XBM image uninitialized memory reading
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0016</cvename>
 <cvename>CVE-2008-3835</cvename>
 <cvename>CVE-2008-3836</cvename>
 <cvename>CVE-2008-3837</cvename>
 <cvename>CVE-2008-4058</cvename>
 <cvename>CVE-2008-4059</cvename>
 <cvename>CVE-2008-4060</cvename>
 <cvename>CVE-2008-4061</cvename>
 <cvename>CVE-2008-4062</cvename>
 <cvename>CVE-2008-4063</cvename>
 <cvename>CVE-2008-4064</cvename>
 <cvename>CVE-2008-4065</cvename>
 <cvename>CVE-2008-4067</cvename>
 <cvename>CVE-2008-4068</cvename>
 <cvename>CVE-2008-4069</cvename>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-37.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-38.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-39.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-40.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-41.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-42.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-43.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-44.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-45.html</url>
 </references>
 <dates>
 <discovery>2008-09-24</discovery>
 <entry>2008-09-24</entry>
 <modified>2009-12-12</modified>
 </dates>
 </vuln>

<vuln vid="a0afb4b9-89a1-11dd-a65b-00163e000016">
 <topic>squirrelmail -- Session hijacking vulnerability</topic>
 <affects>
 <package>
	<name>squirrelmail</name>
	<range><le>1.4.15_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hanno Boeck reports:
	<blockquote cite="http://seclists.org/bugtraq/2008/Sep/0239.html">
	 When configuring a web application to use only ssl (e.g. by
	 forwarding all http-requests to https), a user would expect that
	 sniffing and hijacking the session is impossible.
	 Though, for this to be secure, one needs to set the session
	 cookie to have the secure flag. Otherwise the cookie will be
	 transferred through HTTP if the victim's browser does a single
	 HTTP request on the same domain.
	 Squirrelmail does not set that flag. It is fixed in the 1.5
	 test versions, but current 1.4.15 is vulnerable.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>31321</bid>
 <cvename>CVE-2008-3663</cvename>
 <mlist>http://seclists.org/bugtraq/2008/Sep/0239.html</mlist>
 </references>
 <dates>
 <discovery>2008-08-12</discovery>
 <entry>2008-09-23</entry>
 </dates>
 </vuln>

<vuln vid="0f51f2c9-8956-11dd-a6fe-0030843d3802">
 <topic>proftpd -- Long Command Processing Vulnerability</topic>
 <affects>
 <package>
	<name>proftpd</name>
	<name>proftpd-mysql</name>
	<range><lt>1.3.2rc2</lt></range>
 </package>
 <package>
	<name>proftpd-devel</name>
	<range><lt>1.3.20080922</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/31930/">
	 The vulnerability is caused due to the application truncating an
	 overly long FTP command, and improperly interpreting the remainder
	 string as a new FTP command. This can be exploited to execute
	 arbitrary FTP commands with the privileges of another user by e.g.
	 tricking the user into following malicious link.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4242</cvename>
 <cvename>CVE-2008-4247</cvename>
 <url>http://secunia.com/advisories/31930/</url>
 <url>http://bugs.proftpd.org/show_bug.cgi?id=3115</url>
 </references>
 <dates>
 <discovery>2008-09-22</discovery>
 <entry>2008-09-23</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="150e4548-8950-11dd-a6fe-0030843d3802">
 <topic>phpmyadmin -- Cross-Site Scripting Vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/Advisories/31974/">
	 An error exists in the "PMA_escapeJsString()" function in
	 libraries/js_escape.lib.php, which can be exploited to bypass
	 certain filters and execute arbitrary HTML and script code in a
	 user's browser session in context of an affected site when e.g.
	 Microsoft Internet Explorer is used.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/Advisories/31974/</url>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-8</url>
 </references>
 <dates>
 <discovery>2008-09-23</discovery>
 <entry>2008-09-23</entry>
 <modified>2008-10-03</modified>
 </dates>
 </vuln>

<vuln vid="fc9e73b2-8685-11dd-bb64-0030843d3802">
 <topic>gallery -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gallery</name>
	<range><lt>1.5.9</lt></range>
 </package>
 <package>
	<name>gallery2</name>
	<range><lt>2.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/31912/">
	 An error in the handing of ZIP archives with symbolic links can be
	 exploited to disclose the contents of arbitrary files.
	</blockquote>
	<blockquote cite="http://secunia.com/advisories/31858/">
	 Input from uploaded Flash animations is not properly sanitised
	 before being used. This can be exploited to insert arbitrary HTML and
	 script code, which is executed in a user's browser session in context
	 of an affected site when the malicious data is viewed.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/31912/</url>
 <url>http://secunia.com/advisories/31858/</url>
 </references>
 <dates>
 <discovery>2008-09-18</discovery>
 <entry>2008-09-19</entry>
 <modified>2008-10-03</modified>
 </dates>
 </vuln>

<vuln vid="74bf1594-8493-11dd-bb64-0030843d3802">
 <topic>phpmyadmin -- Code execution vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.9.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A phpMyAdmin security announcement:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7">
	 The server_databases.php script was vulnerable to an attack coming
	 from a user who is already logged-on to phpMyAdmin, where he can
	 execute shell code (if the PHP configuration permits commands like
	 exec).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4096</cvename>
 <url>http://secunia.com/Advisories/31884/</url>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7</url>
 </references>
 <dates>
 <discovery>2008-09-15</discovery>
 <entry>2008-09-17</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="9227dcaf-827f-11dd-9cd7-0050568452ac">
 <topic>twiki -- Arbitrary code execution in session files</topic>
 <affects>
 <package>
	<name>twiki</name>
	<range><lt>4.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Th1nk3r reports:
	<blockquote cite="http://www.milw0rm.com/exploits/6269">
	 The version of TWiki installed on the remote host allows access to
	 the 'configure' script and fails to sanitize the 'image' parameter
	 of that script of directory traversal sequences before returning the
	 file contents when the 'action' parameter is set to 'image'. An
	 unauthenticated attacker can leverage this issue to view arbitrary
	 files on the remote host subject to the privileges of the web server
	 user id. .
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3195</cvename>
 <url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-3195</url>
 <url>http://www.kb.cert.org/vuls/id/362012</url>
 <url>https://inspectit.accessitgroup.com/threats/details.cgi?id=34031</url>
 <url>http://www.nessus.org/plugins/index.php?view=single&amp;id=34031</url>
 </references>
 <dates>
 <discovery>2008-08-05</discovery>
 <entry>2008-09-14</entry>
 </dates>
 </vuln>

<vuln vid="755fa519-80a9-11dd-8de5-0030843d3802">
 <topic>neon -- NULL pointer dereference in Digest domain support</topic>
 <affects>
 <package>
	<name>neon28</name>
	<range><lt>0.28.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Joe Orton reports:
	<blockquote cite="http://www.openwall.com/lists/oss-security/2008/08/15/4">
	 A NULL pointer deference in the Digest authentication support in
	 neon versions 0.28.0 through 0.28.2 inclusive allows a malicious
	 server to crash a client application, resulting in possible denial
	 of service.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>30710</bid>
 <cvename>CVE-2008-3746</cvename>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476571</url>
 <url>http://lists.manyfish.co.uk/pipermail/neon/2008-August/000040.html</url>
 </references>
 <dates>
 <discovery>2008-08-15</discovery>
 <entry>2008-09-12</entry>
 </dates>
 </vuln>

<vuln vid="da5c4072-8082-11dd-9c8c-001c2514716c">
 <topic>clamav -- CHM Processing Denial of Service</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.94</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><lt>20080902</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hanno Boeck reports:
	<blockquote cite="http://int21.de/cve/CVE-2008-1389-clamav-chd.html">
	 A fuzzing test showed weakness in the chm parser of
	 clamav, which can possibly be exploited. The clamav
	 team has disabled the chm module in older versions
	 though freshclam updates and has released 0.94 with
	 a fixed parser.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1389</cvename>
 <url>https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1089</url>
 </references>
 <dates>
 <discovery>2008-07-09</discovery>
 <entry>2008-09-12</entry>
 </dates>
 </vuln>

<vuln vid="7d239578-7ff2-11dd-8de5-0030843d3802">
 <topic>horde -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>horde-base</name>
	<range><lt>3.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/31842/">
	 Some vulnerabilities have been reported in various Horde products,
	 which can be exploited by malicious people to conduct script insertion
	 attacks
	 Input via MIME attachment linking is not properly sanitised in the
	 MIME library before being used. This can be exploited to execute
	 arbitrary HTML and script code in a user's browser session if e.g. a
	 malicious email is viewed.
	 Certain unspecified input in HTML messages is not properly
	 sanitised before being used. This can be exploited to execute
	 arbitrary HTML and script in a user's browser session if e.g. a
	 malicious HTML email is viewed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3823</cvename>
 <cvename>CVE-2008-3824</cvename>
 <mlist>http://lists.horde.org/archives/announce/2008/000429.html</mlist>
 <url>http://secunia.com/advisories/31842/</url>
 </references>
 <dates>
 <discovery>2008-09-10</discovery>
 <entry>2008-09-11</entry>
 <modified>2008-10-03</modified>
 </dates>
 </vuln>

<vuln vid="0dccaa28-7f3c-11dd-8de5-0030843d3802">
 <topic>python -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>python24</name>
	<range><lt>2.4.5_2</lt></range>
 </package>
 <package>
	<name>python25</name>
	<range><lt>2.5.2_3</lt></range>
 </package>
 <package>
	<name>python23</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/31305">
	 Some vulnerabilities have been reported in Python, where some have
	 unknown impact and others can potentially be exploited by malicious
	 people to cause a DoS (Denial of Service) or to compromise a
	 vulnerable system.
	 Various integer overflow errors exist in core modules e.g.
	 stringobject, unicodeobject, bufferobject, longobject, tupleobject,
	 stropmodule, gcmodule, mmapmodule.
	 An integer overflow in the hashlib module can lead to an unreliable
	 cryptographic digest results.
	 Integer overflow errors in the processing of unicode strings can be
	 exploited to cause buffer overflows on 32-bit systems.
	 An integer overflow exists in the PyOS_vsnprintf() function on
	 architectures that do not have a "vsnprintf()" function.
	 An integer underflow error in the PyOS_vsnprintf() function when
	 passing zero-length strings can lead to memory corruption.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2315</cvename>
 <cvename>CVE-2008-2316</cvename>
 <cvename>CVE-2008-3142</cvename>
 <cvename>CVE-2008-3144</cvename>
 <url>http://bugs.python.org/issue2620</url>
 <url>http://bugs.python.org/issue2588</url>
 <url>http://bugs.python.org/issue2589</url>
 <url>http://secunia.com/advisories/31305</url>
 <mlist>http://mail.python.org/pipermail/python-checkins/2008-July/072276.html</mlist>
 <mlist>http://mail.python.org/pipermail/python-checkins/2008-July/072174.html</mlist>
 <mlist>http://mail.python.org/pipermail/python-checkins/2008-June/070481.html</mlist>
 </references>
 <dates>
 <discovery>2008-08-04</discovery>
 <entry>2008-09-10</entry>
 </dates>
 </vuln>

<vuln vid="388d9ee4-7f22-11dd-a66a-0019666436c2">
 <topic>mysql -- MyISAM table privileges security bypass vulnerability</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><ge>6.0</ge><lt>6.0.5</lt></range>
	<range><ge>5.1</ge><lt>5.1.24</lt></range>
	<range><ge>5.0</ge><lt>5.0.67</lt></range>
	<range><ge>4.1</ge><lt>4.1.22_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/29106/discuss">
	 MySQL is prone to a security-bypass vulnerability.
	 An attacker can exploit this issue to overwrite existing
	 table files in the MySQL data directory, bypassing certain
	 security restrictions.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>29106</bid>
 <cvename>CVE-2008-2079</cvename>
 </references>
 <dates>
 <discovery>2008-05-05</discovery>
 <entry>2008-09-10</entry>
 <modified>2008-10-10</modified>
 </dates>
 </vuln>

<vuln vid="8e8b8b94-7f1d-11dd-a66a-0019666436c2">
 <topic>rubygem-rails -- SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-rails</name>
	<range><lt>2.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jonathan Weiss reports, that it is possible
	 to perform an SQL injection in Rails applications
	 via not correctly sanitized :limit and :offset
	 parameters. It is possible to change arbitrary
	 values in affected tables or gain access to the
	 sensitive data.
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4094</cvename>
 <url>http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1</url>
 </references>
 <dates>
 <discovery>2008-09-08</discovery>
 <entry>2008-09-10</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="884fced7-7f1c-11dd-a66a-0019666436c2">
 <topic>wordpress -- remote privilege escalation</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>de-wordpress</name>
	<name>wordpress-mu</name>
	<range><lt>2.6.2</lt></range>
 </package>
 <package>
	<name>zh-wordpress</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Wordpress development team reports:
	<blockquote cite="http://wordpress.org/development/2008/09/wordpress-262/">
	 With open registration enabled, it is possible in WordPress
	 versions 2.6.1 and earlier to craft a username such that it
	 will allow resetting another users password to a randomly
	 generated password. The randomly generated password is not
	 disclosed to the attacker, so this problem by itself is annoying
	 but not a security exploit. However, this attack coupled with a
	 weakness in the random number seeding in mt_rand() could be used
	 to predict the randomly generated password.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>31068</bid>
 <cvename>CVE-2008-4107</cvename>
 <url>http://wordpress.org/development/2008/09/wordpress-262/</url>
 </references>
 <dates>
 <discovery>2008-09-08</discovery>
 <entry>2008-10-22</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="2f794295-7b69-11dd-80ba-000bcdf0a03b">
 <topic>FreeBSD -- Remote kernel panics on IPv6 connections</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_4</lt></range>
	<range><ge>7.0</ge><lt>7.0_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	In case of an incoming ICMPv6 'Packet Too Big Message', there
	 is an insufficient check on the proposed new MTU for a path to
	 the destination.
	<h1>Impact:</h1>
	When the kernel is configured to process IPv6 packets and has
	 active IPv6 TCP sockets, a specifically crafted ICMPv6 'Packet
	 Too Big Message' could cause the TCP stack of the kernel to
	 panic.
	<h1>Workaround:</h1>
	Systems without INET6 / IPv6 support are not vulnerable and
	 neither are systems which do not listen on any IPv6 TCP sockets
	 and have no active IPv6 connections.
	Filter ICMPv6 'Packet Too Big Messages' using a firewall, but
	 this will at the same time break PMTU support for IPv6
	 connections.
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3530</cvename>
 <freebsdsa>SA-08:09.icmp6</freebsdsa>
 </references>
 <dates>
 <discovery>2008-09-03</discovery>
 <entry>2008-09-05</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="7dbb7197-7b68-11dd-80ba-000bcdf0a03b">
 <topic>FreeBSD -- nmount(2) local arbitrary code execution</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_4</lt></range>
	<range><ge>7.0</ge><lt>7.0_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Various user defined input such as mount points, devices, and
	 mount options are prepared and passed as arguments to
	 nmount(2) into the kernel. Under certain error conditions,
	 user defined data will be copied into a stack allocated buffer
	 stored in the kernel without sufficient bounds checking.
	<h1>Impact:</h1>
	If the system is configured to allow unprivileged users to
	 mount file systems, it is possible for a local adversary to
	 exploit this vulnerability and execute code in the context of
	 the kernel.
	<h1>Workaround:</h1>
	It is possible to work around this issue by allowing only
	 privileged users to mount file systems by running the
	 following sysctl(8) command:
	<pre># sysctl vfs.usermount=0</pre>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3531</cvename>
 <freebsdsa>SA-08:08.nmount</freebsdsa>
 </references>
 <dates>
 <discovery>2008-09-03</discovery>
 <entry>2008-09-05</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="6d4e4759-7b67-11dd-80ba-000bcdf0a03b">
 <topic>FreeBSD -- amd64 swapgs local privilege escalation</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_4</lt></range>
	<range><ge>7.0</ge><lt>7.0_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	If a General Protection Fault happens on a FreeBSD/amd64
	 system while it is returning from an interrupt, trap or
	 system call, the swapgs CPU instruction may be called one
	 extra time when it should not resulting in userland and
	 kernel state being mixed.
	<h1>Impact:</h1>
	A local attacker can by causing a General Protection Fault
	 while the kernel is returning from an interrupt, trap or
	 system call while manipulating stack frames and, run
	 arbitrary code with kernel privileges.
	The vulnerability can be used to gain kernel / supervisor
	 privilege. This can for example be used by normal users to
	 gain root privileges, to break out of jails, or bypass
	 Mandatory Access Control (MAC) restrictions.
	<h1>Workaround:</h1>
	No workaround is available, but only systems running the 64
	 bit FreeBSD/amd64 kernels are vulnerable.
	Systems with 64 bit capable CPUs, but running the 32 bit
	 FreeBSD/i386 kernel are not vulnerable.
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3890</cvename>
 <freebsdsa>SA-08:07.amd64</freebsdsa>
 </references>
 <dates>
 <discovery>2008-09-03</discovery>
 <entry>2008-09-05</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="73ec1008-72f0-11dd-874b-0030843d3802">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>linux-opera</name>
	<range><lt>9.52</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Opera Team reports:
	<blockquote cite="http://www.opera.com/support/search/view/893/">
	 Scripts are able to change the addresses of framed pages that
	 come from the same site. Due to a flaw in the way that Opera checks
	 what frames can be changed, a site can change the address of frames
	 on other sites inside any window that it has opened. This allows
	 sites to open pages from other sites, and display misleading
	 information on them.
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/894/">
	 Custom shortcut and menu commands can be used to activate external
	 applications. In some cases, the parameters passed to these
	 applications are not prepared correctly, and may be created from
	 uninitialized memory. These may be misinterpreted as additional
	 parameters, and depending on the application, this could allow
	 execution of arbitrary code.
	 Successful exploitation requires convincing the user to modify
	 their shortcuts or menu files appropriately, pointing to an
	 appropriate target application, then to activate that shortcut at
	 an appropriate time. To inject code, additional means will have to
	 be employed.
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/895/">
	 When insecure pages load content from secure sites into a frame,
	 they can cause Opera to incorrectly report the insecure site as
	 being secure. The padlock icon will incorrectly be shown, and the
	 security information dialog will state that the connection is
	 secure, but without any certificate information.
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/896/">
	 As a security precaution, Opera does not allow Web pages to
	 link to files on the user's local disk. However, a flaw exists
	 that allows Web pages to link to feed source files on the
	 user's computer. Suitable detection of JavaScript events and
	 appropriate manipulation can unreliably allow a script to
	 detect the difference between successful and unsuccessful
	 subscriptions to these files, to allow it to discover if the
	 file exists or not. In most cases the attempt will fail.
	 </blockquote>
	 <blockquote cite="http://www.opera.com/support/search/view/897/">
	 It has been reported that when a user subscribes to a news
	 feed using the feed subscription button, the page address
	 can be changed. This causes the address field not to update
	 correctly. Although this can mean that misleading
	 information can be displayed in the address field, it can
	 only leave the attacking page's address in the address bar,
	 not a trusted third party address.
	 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4195</cvename>
 <cvename>CVE-2008-4197</cvename>
 <cvename>CVE-2008-4198</cvename>
 <cvename>CVE-2008-4200</cvename>
 <url>http://www.opera.com/support/search/view/893/</url>
 <url>http://www.opera.com/support/search/view/894/</url>
 <url>http://www.opera.com/support/search/view/895/</url>
 <url>http://www.opera.com/support/search/view/896/</url>
 <url>http://www.opera.com/support/search/view/897/</url>
 </references>
 <dates>
 <discovery>2008-08-20</discovery>
 <entry>2008-08-25</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="d864a0a7-6f27-11dd-acfe-00104b9e1a4a">
 <topic>gnutls -- "gnutls_handshake()" Denial of Service</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><ge>2.3.5</ge><lt>2.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/31505/">
	 A vulnerability has been reported in GnuTLS, which can
	 potentially be exploited by malicious people to cause a DoS
	 (Denial of Service).
	 The vulnerability is caused due to a use-after-free error when an
	 application calls "gnutls_handshake()" for an already valid session
	 and can potentially be exploited, e.g. during re-handshakes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2377</cvename>
 <url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2947</url>
 <url>http://secunia.com/advisories/31505/</url>
 </references>
 <dates>
 <discovery>2008-08-15</discovery>
 <entry>2008-08-21</entry>
 </dates>
 </vuln>

<vuln vid="8514b6e7-6f0f-11dd-b3db-001c2514716c">
 <topic>joomla -- flaw in the reset token validation</topic>
 <affects>
 <package>
	<name>joomla15</name>
	<range><lt>1.5.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Joomla project reports:
	<blockquote cite="http://developer.joomla.org/security/news/241-20080801-core-password-remind-functionality.html">
	 A flaw in the reset token validation mechanism allows
	 for non-validating tokens to be forged. This will allow
	 an unauthenticated, unauthorized user to reset the password
	 of the first enabled user (lowest id). Typically, this is
	 an administrator user. Note, that changing the first users
	 username may lessen the impact of this exploit (since the
	 person who changed the password does not know the login
	 associated with the new password). However, the only way
	 to completely rectify the issue is to upgrade to 1.5.6
	 (or patch the /components/com_user/models/reset.php file).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3681</cvename>
 </references>
 <dates>
 <discovery>2008-08-14</discovery>
 <entry>2008-08-20</entry>
 <modified>2008-08-20</modified>
 </dates>
 </vuln>

<vuln vid="c4f31e16-6e33-11dd-8eb7-0011098ad87f">
 <topic>cdf3 -- Buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>cdf3</name>
	<range><lt>3.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	NASA Goddard Space Flight Center reports:
	<blockquote cite="http://cdf.gsfc.nasa.gov/CDF32_buffer_overflow.html">
	 The libraries for the scientific data file format, Common Data
	 Format (CDF) version 3.2 and earlier, have the potential for a
	 buffer overflow vulnerability when reading specially-crafted
	 (invalid) CDF files. If successful, this could trigger execution
	 of arbitrary code within the context of the CDF-reading program
	 that could be exploited to compromise a system, or otherwise
	 crash the program. While it's unlikely that you would open CDFs
	 from untrusted sources, we recommend everyone upgrade to the
	 latest CDF libraries on their systems, including the IDL and
	 Matlab plugins. Most worrisome is any service that enables the
	 general public to submit CDF files for processing.
	 The vulnerability is in the CDF library routines not properly
	 checking the length tags on a CDF file before copying data to a
	 stack buffer. Exploitation requires the user to explicitly open
	 a specially-crafted file. CDF users should not open files from
	 untrusted third parties until the patch is applied (and continue
	 then to exercise normal caution for files from untrusted third
	 parties).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2080</cvename>
 <url>http://cdf.gsfc.nasa.gov/CDF32_buffer_overflow.html</url>
 </references>
 <dates>
 <discovery>2008-05-15</discovery>
 <entry>2008-08-19</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="070b5b22-6d74-11dd-aa18-0030843d3802">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.10</lt></range>
 </package>
 <package>
 <name>drupal6</name>
 <range><lt>6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Project reports:
	<blockquote cite="http://drupal.org/node/295053">
	 A bug in the output filter employed by Drupal makes it possible
	 for malicious users to insert script code into pages (cross site
	 scripting or XSS). A bug in the private filesystem trusts the MIME
	 type sent by the browser, enabling malicious users with the ability
	 to upload files to execute cross site scripting attacks.
	 The BlogAPI module does not validate the extension of uploaded
	 files, enabling users with the "administer content with blog api"
	 permission to upload harmful files. This bug affects both Drupal
	 5.x and 6.x.
	 Drupal forms contain a token to protect against cross site
	 request forgeries (CSRF). The token may not be validated properly
	 for cached forms and forms containing AHAH elements. This bug
	 affects Drupal 6.x.
	 User access rules can be added or deleted upon accessing a
	 properly formatted URL, making such modifications vulnerable to
	 cross site request forgeries (CSRF). This may lead to unintended
	 addition or deletion of an access rule when a sufficiently
	 privileged user visits a page or site created by a malicious
	 person. This bug affects both Drupal 5.x and 6.x.
	 The Upload module in Drupal 6 contains privilege escalation
	 vulnerabilities for users with the "upload files" permission. This
	 can lead to users being able to edit nodes which they are normally
	 not allowed to, delete any file to which the webserver has
	 sufficient rights, and download attachments of nodes to which they
	 have no access. Harmful files may also be uploaded via cross site
	 request forgeries (CSRF). These bugs affect Drupal 6.x.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3740</cvename>
 <cvename>CVE-2008-3741</cvename>
 <cvename>CVE-2008-3742</cvename>
 <cvename>CVE-2008-3743</cvename>
 <cvename>CVE-2008-3744</cvename>
 <cvename>CVE-2008-3745</cvename>
 <url>http://secunia.com/advisories/31462/</url>
 </references>
 <dates>
 <discovery>2008-08-13</discovery>
 <entry>2008-08-18</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="c329712a-6b5b-11dd-9d79-001fc61c2a55">
 <topic>ruby -- multiple vulnerabilities in safe level</topic>
 <affects>
 <package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.6.287,1</lt></range>
	<range><ge>1.9.*,1</ge><lt>1.9.1.0,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The official ruby site reports:
	<blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/">
	 Several vulnerabilities in safe level have been discovereds:.
	 <ul>
	 <li>untrace_var is permitted at safe level 4;</li>
	 <li>$PROGRAM_NAME may be modified at safe level 4;</li>
	 <li>insecure methods may be called at safe level 1-3;</li>
	 <li>syslog operations are permitted at safe level 4;</li>
	 <li>dl doesn't check taintness, so it could allow attackers
	 to call dangerous functions.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3655</cvename>
 <cvename>CVE-2008-3656</cvename>
 <cvename>CVE-2008-3905</cvename>
 <url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url>
 </references>
 <dates>
 <discovery>2008-08-08</discovery>
 <entry>2008-08-16</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="f7ba20aa-6b5a-11dd-9d79-001fc61c2a55">
 <topic>ruby -- DoS vulnerability in WEBrick</topic>
 <affects>
 <package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.6.111_5,1</lt></range>
	<range><ge>1.9.*,1</ge><lt>1.9.1.0,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The official ruby site reports:
	<blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/">
	 WEBrick::HTTP::DefaultFileHandler is faulty of exponential time
	 taking requests due to a backtracking regular expression in
	 WEBrick::HTTPUtils.split_header_value.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3655</cvename>
 <cvename>CVE-2008-3656</cvename>
 <cvename>CVE-2008-3905</cvename>
 <url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url>
 </references>
 <dates>
 <discovery>2008-08-08</discovery>
 <entry>2008-08-16</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="959d384d-6b59-11dd-9d79-001fc61c2a55">
 <topic>ruby -- DNS spoofing vulnerability</topic>
 <affects>
 <package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.6.111_5,1</lt></range>
	<range><ge>1.9.*,1</ge><lt>1.9.1.0,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The official ruby site reports:
	<blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/">
	 resolv.rb allow remote attackers to spoof DNS answers. This risk
	 can be reduced by randomness of DNS transaction IDs and source
	 ports.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1447</cvename>
 <url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url>
 </references>
 <dates>
 <discovery>2008-08-08</discovery>
 <entry>2008-08-16</entry>
 <modified>2009-02-09</modified>
 </dates>
 </vuln>

<vuln vid="1d96305d-6ae6-11dd-91d5-000c29d47fd7">
 <topic>Bugzilla -- Directory Traversal in importxml.pl</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<name>ja-bugzilla</name>
	<range><ge>2.22.1</ge><lt>2.22.4</lt></range>
	<range><ge>3.*</ge><lt>3.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla Security Advisory reports:
	<blockquote cite="http://www.bugzilla.org/security/2.22.4/">
	 When importing bugs using importxml.pl, the --attach_path
	 option can be specified, pointing to the directory where
	 attachments to import are stored. If the XML file being
	 read by importxml.pl contains a malicious
	 <pre>../relative_path/to/local_file</pre>
	 node, the script follows this relative path and attaches the
	 local file pointed by it to the bug, making the file public.
	 The security fix makes sure the relative path is always
	 ignored.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-4437</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=437169</url>
 </references>
 <dates>
 <discovery>2008-06-03</discovery>
 <entry>2008-08-15</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="c61ca9cb-64c3-11dd-954d-006097bcc5f4">
 <topic>openvpn-devel -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>openvpn-devel</name>
	<range><ge>2.1.b14</ge><lt>2.1.r9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	James Yonan reports:
	<blockquote cite="http://openvpn.net/index.php/documentation/change-log/changelog-21.html">
	 Security Fix - affects non-Windows OpenVPN clients running
	 OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT
	 vulnerable nor are any versions of the OpenVPN server
	 vulnerable).
	 An OpenVPN client connecting to a malicious or compromised server
	 could potentially receive an "lladdr" or "iproute" configuration
	 directive from the server which could cause arbitrary code execution
	 on the client. A successful attack requires that (a) the client has
	 agreed to allow the server to push configuration directives to it by
	 including "pull" or the macro "client" in its configuration file,
	 (b) the client succesfully authenticates the server, (c) the server
	 is malicious or has been compromised and is under the control of the
	 attacker, and (d) the client is running a non-Windows OS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3459</cvename>
 <url>http://openvpn.net/index.php/documentation/change-log/changelog-21.html</url>
 </references>
 <dates>
 <discovery>2008-07-31</discovery>
 <entry>2008-08-07</entry>
 </dates>
 </vuln>

<vuln vid="35e54755-54e4-11dd-ad8b-0030843d3802">
 <topic>phpmyadmin -- cross site request forgery vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A phpMyAdmin security announcement:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5">
	 A logged-in user, if abused into clicking a crafted link or loading
	 an attack page, would create a database he did not intend to, or would
	 change his connection character set.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5</url>
 <url>http://secunia.com/advisories/31115/</url>
 </references>
 <dates>
 <discovery>2008-07-15</discovery>
 <entry>2008-07-18</entry>
 <modified>2008-09-17</modified>
 </dates>
 </vuln>

<vuln vid="ecedde1c-5128-11dd-a4e1-0030843d3802">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.8</lt></range>
 </package>
 <package>
	<name>drupal6</name>
	<range><lt>6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Project reports:
	<blockquote cite="http://drupal.org/node/280571">
	 Free tagging taxonomy terms can be used to insert arbitrary script
	 and HTML code (cross site scripting or XSS) on node preview pages. A
	 successful exploit requires that the victim selects a term containing
	 script code and chooses to preview the node. This issue affects Drupal
	 6.x only. Some values from OpenID providers are output without being
	 properly escaped, allowing malicious providers to insert arbitrary script
	 and HTML code (XSS) into user pages. This issue affects Drupal 6.x only.
	 filter_xss_admin() has been hardened to prevent use of the object HTML
	 tag in administrator input.
	 Translated strings (5.x, 6.x) and OpenID identities (6.x) are
	 immediately deleted upon accessing a properly formatted URL, making
	 such deletion vulnerable to cross site request forgeries (CSRF). This
	 may lead to unintended deletion of translated strings or OpenID
	 identities when a sufficiently privileged user visits a page or site
	 created by a malicious person.
	 When contributed modules such as Workflow NG terminate the current
	 request during a login event, user module is not able to regenerate
	 the user's session. This may lead to a session fixation attack, when a
	 malicious user is able to control another users' initial session ID.
	 As the session is not regenerated, the malicious user may use the
	 'fixed' session ID after the victim authenticates and will have the
	 same access. This issue affects both Drupal 5 and Drupal 6.
	 Schema API uses an inappropriate placeholder for 'numeric' fields
	 enabling SQL injection when user-supplied data is used for such
	 fields.This issue affects Drupal 6 only.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-3218</cvename>
 <cvename>CVE-2008-3221</cvename>
 <url>http://drupal.org/node/280571</url>
 <url>http://secunia.com/advisories/31028/</url>
 </references>
 <dates>
 <discovery>2008-07-09</discovery>
 <entry>2008-07-13</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="655ee1ec-511b-11dd-80ba-000bcdf0a03b">
 <topic>FreeBSD -- DNS cache poisoning</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.3</ge><lt>6.3_3</lt></range>
	<range><ge>7.0</ge><lt>7.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	The BIND DNS implementation does not randomize the UDP source
	 port when doing remote queries, and the query id alone does
	 not provide adequate randomization.
	<h1>Impact:</h1>
	The lack of source port randomization reduces the amount of
	 data the attacker needs to guess in order to successfully
	 execute a DNS cache poisoning attack. This allows the
	 attacker to influence or control the results of DNS queries
	 being returned to users from target systems.
	<h1>Workaround:</h1>
	Limiting the group of machines that can do recursive queries
	 on the DNS server will make it more difficult, but not
	 impossible, for this vulnerability to be exploited.
	To limit the machines able to perform recursive queries, add an ACL in
	 named.conf and limit recursion like the following:
	<pre>acl example-acl {</pre>
	<pre> 192.0.2.0/24;</pre>
	<pre>};</pre>
	<pre>options {</pre>
	<pre>	recursion yes;</pre>
	<pre>	allow-recursion { example-acl; };</pre>
	<pre>};</pre>
 </body>
 </description>
 <references>
 <certvu>800113</certvu>
 <cvename>CVE-2008-1447</cvename>
 <freebsdsa>SA-08:06.bind</freebsdsa>
 </references>
 <dates>
 <discovery>2008-07-08</discovery>
 <entry>2008-07-13</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="bc20510f-4dd4-11dd-93e7-0211d880e350">
 <topic>poppler -- uninitialized pointer</topic>
 <affects>
 <package>
	<name>poppler</name>
	<range><lt>0.8.4_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Felipe Andres Manzano reports:
	<blockquote cite="http://milw0rm.com/exploits/6032">
	 The libpoppler pdf rendering library, can free
	 uninitialized pointers, leading to arbitrary code
	 execution. This vulnerability results from memory
	 management bugs in the Page class constructor/destructor.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2950</cvename>
 <url>http://milw0rm.com/exploits/6032</url>
 </references>
 <dates>
 <discovery>2008-07-07</discovery>
 <entry>2008-07-09</entry>
 </dates>
 </vuln>

<vuln vid="f5c58fc1-49c0-11dd-b0ba-00163e000016">
 <topic>py-pylons -- Path traversal bug</topic>
 <affects>
 <package>
	<name>py24-pylons</name>
	<range><lt>0.9.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pylons team reports:
	<blockquote cite="http://wiki.pylonshq.com/display/pylonsdocs/0.9.6.2">
	 The error.py controller uses paste.fileapp to serve the static
	 resources to the browser. The default error.py controller uses
	 os.path.join to combine the id from Routes with the media path.
	 Routes prior to 1.8 double unquoted the PATH_INFO, resulting in
	 FileApp returning files from the filesystem that can be outside
	 of the intended media path directory.
	 An attacker can craft URL's which utilize the double escaping
	 to pass in a name to the error.py controller which contains a
	 leading slash thus escaping the intended media path and serving
	 files from any location on the filesystem that the Pylons
	 application has access to.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://wiki.pylonshq.com/display/pylonsdocs/0.9.6.2</url>
 </references>
 <dates>
 <discovery>2008-05-28</discovery>
 <entry>2008-07-04</entry>
 </dates>
 </vuln>

<vuln vid="4fb43b2f-46a9-11dd-9d38-00163e000016">
 <topic>FreeType 2 -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>freetype2</name>
	<range><lt>2.3.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/30600">
	 <ul>
	 <li>An integer overflow error exists in the processing of PFB font
	 files. This can be exploited to cause a heap-based buffer overflow
	 via a PFB file containing a specially crafted "Private" dictionary
	 table.</li>
	 <li>An error in the processing of PFB font files can be exploited
	 to trigger the "free()" of memory areas that are not allocated on
	 the heap.</li>
	 <li>An off-by-one error exists in the processing of PFB font files.
	 This can be exploited to cause a one-byte heap-based buffer
	 overflow via a specially crafted PFB file.</li>
	 <li>An off-by-one error exists in the implementation of the "SHC"
	 instruction while processing TTF files. This can be exploited to
	 cause a one-byte heap-based buffer overflow via a specially crafted
	 TTF file.</li>
	 </ul>
	 Successful exploitation of the vulnerabilities may allow execution
	 of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>29637</bid>
 <bid>29639</bid>
 <bid>29640</bid>
 <bid>29641</bid>
 <cvename>CVE-2008-1806</cvename>
 <cvename>CVE-2008-1807</cvename>
 <cvename>CVE-2008-1808</cvename>
 <url>http://secunia.com/advisories/30600</url>
 <url>http://sourceforge.net/project/shownotes.php?release_id=605780</url>
 </references>
 <dates>
 <discovery>2008-06-10</discovery>
 <entry>2008-07-03</entry>
 </dates>
 </vuln>

<vuln vid="1e8e63c0-478a-11dd-a88d-000ea69a5213">
 <topic>fetchmail -- potential crash in -v -v verbose mode (revised patch)</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><lt>6.3.8_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2008-01.txt">
	 2008-06-24 1.2 also fixed issue in report_complete (reported by
	 Petr Uzel)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2711</cvename>
 <url>http://www.fetchmail.info/fetchmail-SA-2008-01.txt</url>
 </references>
 <dates>
 <discovery>2008-06-24</discovery>
 <entry>2008-07-01</entry>
 </dates>
 </vuln>

<vuln vid="e285a1f4-4568-11dd-ae96-0030843d3802">
 <topic>phpmyadmin -- Cross Site Scripting Vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia report:
	<blockquote cite="http://secunia.com/advisories/30813/">
	 Some vulnerabilities have been reported in phpMyAdmin, which can be
	 exploited by malicious people to conduct cross-site scripting
	 attacks.
	 Input passed via unspecified parameters to files in /libraries is not
	 properly sanitised before being returned to the user. This can be
	 exploited to execute arbitrary HTML and script code in a user's
	 browser session in context of an affected site.
	 Successful exploitation requires that "register_globals" is enabled
	 and support for ".htaccess" files is disabled.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2960</cvename>
 <url>http://secunia.com/advisories/30813/</url>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-4</url>
 </references>
 <dates>
 <discovery>2008-06-23</discovery>
 <entry>2008-06-28</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="c84dc9ad-41f7-11dd-a4f9-00163e000016">
 <topic>apache -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><gt>2.2.0</gt><lt>2.2.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache HTTP server project reports:
	<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.2.html">
	 The following potential security flaws are addressed:
	 <ul>
	 <li>CVE-2008-2364: mod_proxy_http: Better handling of excessive
	 interim responses from origin server to prevent potential denial of
	 service and high memory usage. Reported by Ryujiro Shibuya.</li>
	 <li>CVE-2007-6420: mod_proxy_balancer: Prevent CSRF attacks against
	 the balancer-manager interface</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6420</cvename>
 <cvename>CVE-2008-2364</cvename>
 <url>http://www.apache.org/dist/httpd/Announcement2.2.html</url>
 </references>
 <dates>
 <discovery>2008-06-14</discovery>
 <entry>2008-06-24</entry>
 </dates>
 </vuln>

<vuln vid="ee6fa2bd-406a-11dd-936a-0015af872849">
 <topic>php -- input validation error in safe_mode</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.2.6_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	According to Maksymilian Arciemowicz research,
	 it is possible to bypass security restrictions
	 of <code>safe_mode</code> in various
	 functions via directory traversal vulnerability. The attacker
	 can use this attack to gain access to sensitive
	 information. Functions utilizing
	 <code>expand_filepath()</code> may be affected.
	It should be noted that this vulnerability is not
	 considered to be serious by the FreeBSD Security Team,
	 since <code>safe_mode</code> and <code>open_basedir</code>
	 are insecure by design and should not be relied upon.
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2665</cvename>
 <cvename>CVE-2008-2666</cvename>
 <bid>29797</bid>
 <url>http://securityreason.com/achievement_securityalert/54</url>
 </references>
 <dates>
 <discovery>2008-06-17</discovery>
 <entry>2008-06-22</entry>
 <modified>2008-09-04</modified>
 </dates>
 </vuln>

<vuln vid="30866e6c-3c6d-11dd-98c9-00163e000016">
 <topic>vim -- Vim Shell Command Injection Vulnerabilities</topic>
 <affects>
 <package>
	<name>vim</name>
	<name>vim-console</name>
	<name>vim-lite</name>
	<name>vim-ruby</name>
	<name>vim6</name>
	<name>vim6-ruby</name>
	<range><gt>6</gt><le>6.4.10</le></range>
	<range><gt>7</gt><lt>7.1.315</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Rdancer.org reports:
	<blockquote cite="http://www.rdancer.org/vulnerablevim.html">
	 Improper quoting in some parts of Vim written in the Vim Script
	 can lead to arbitrary code execution upon opening a crafted
	 file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2712</cvename>
 <url>http://www.rdancer.org/vulnerablevim.html</url>
 </references>
 <dates>
 <discovery>2008-06-16</discovery>
 <entry>2008-06-21</entry>
 </dates>
 </vuln>

<vuln vid="53802164-3f7e-11dd-90ea-0019666436c2">
 <topic>ruby -- multiple integer and buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.6.111_3,1</lt></range>
 </package>
 <package>
	<name>ruby_static</name>
	<range><ge>1.8.*,1</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The official ruby site reports:
	<blockquote cite="http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/">
	 Multiple vulnerabilities in Ruby may lead to a denial of service
	 (DoS) condition or allow execution of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2726</cvename>
 <url>http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/</url>
 </references>
 <dates>
 <discovery>2008-06-19</discovery>
 <entry>2008-06-21</entry>
 </dates>
 </vuln>

<vuln vid="168190df-3e9a-11dd-87bc-000ea69a5213">
 <topic>fetchmail -- potential crash in -v -v verbose mode</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><lt>6.3.8_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2008-01.txt">
	 Gunter Nau reported fetchmail crashing on some messages; further
	 debugging by Petr Uzel and Petr Cerny at Novell/SUSE Czech Republic
	 dug up that this happened when fetchmail was trying to print, in
	 -v -v verbose level, headers exceeding 2048 bytes. In this
	 situation, fetchmail would resize the buffer and fill in further
	 parts of the message, but forget to reinitialize its va_list
	 typed source pointer, thus reading data from a garbage address found
	 on the stack at addresses above the function arguments the caller
	 passed in; usually that would be the caller's stack frame.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2711</cvename>
 <url>http://www.fetchmail.info/fetchmail-SA-2008-01.txt</url>
 </references>
 <dates>
 <discovery>2008-06-13</discovery>
 <entry>2008-06-20</entry>
 </dates>
 </vuln>

<vuln vid="800e8bd5-3acb-11dd-8842-001302a18722">
 <topic>xorg -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<range><lt>1.4.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthieu Herrb of X.Org reports:
	<blockquote cite="http://lists.freedesktop.org/archives/xorg/2008-June/036026.html">
	 Several vulnerabilities have been found in the server-side code
	 of some extensions in the X Window System. Improper validation of
	 client-provided data can cause data corruption.
	 Exploiting these overflows will crash the X server or,
	 under certain circumstances allow the execution of arbitray machine
	 code.
	 When the X server is running with root privileges (which is the case
	 for the Xorg server and for most kdrive based servers), these
	 vulnerabilities can thus also be used to raise privileges.
	 All these vulnerabilities, to be exploited successfully, require either
	 an already established connection to a running X server (and normally
	 running X servers are only accepting authenticated connections), or a
	 shell access with a valid user on the machine where the vulnerable
	 server is installed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1377</cvename>
 <cvename>CVE-2008-1379</cvename>
 <cvename>CVE-2008-2360</cvename>
 <cvename>CVE-2008-2361</cvename>
 <cvename>CVE-2008-2362</cvename>
 <url>http://lists.freedesktop.org/archives/xorg/2008-June/036026.html</url>
 <url>http://secunia.com/advisories/30627/</url>
 </references>
 <dates>
 <discovery>2008-06-11</discovery>
 <entry>2008-06-15</entry>
 </dates>
 </vuln>

<vuln vid="c4ba95b2-39ce-11dd-98c9-00163e000016">
 <topic>moinmoin -- superuser privilege escalation</topic>
 <affects>
 <package>
	<name>moinmoin</name>
	<range><lt>1.6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MoinMoin team reports:
	<blockquote cite="http://hg.moinmo.in/moin/1.6/rev/f405012e67af">
	 A check in the userform processing was not working as expected and
	 could be abused for ACL and superuser privilege escalation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1937</cvename>
 <url>http://hg.moinmo.in/moin/1.6/rev/f405012e67af</url>
 </references>
 <dates>
 <discovery>2008-04-20</discovery>
 <entry>2008-06-14</entry>
 <modified>2008-06-15</modified>
 </dates>
 </vuln>

<vuln vid="022baf71-38e6-11dd-8d34-00e0815b8da8">
 <topic>Courier Authentication Library -- SQL Injection</topic>
 <affects>
 <package>
	<name>courier-authlib</name>
	<range><lt>0.60.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/30591/">
	 A vulnerability has been reported in the Courier Authentication
	 Library, which can be exploited by malicious people to conduct SQL
	 injection attacks.
	 Input passed via e.g. the username to the library is not properly
	 sanitised before being used in SQL queries. This can be exploited to
	 manipulate SQL queries by injecting arbitrary SQL code and e.g.
	 potentially bypass authentication.
	 Successful exploitation requires that a MySQL database is used for
	 authentication and that a Non-Latin character set is selected.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/30591/</url>
 </references>
 <dates>
 <discovery>2008-06-10</discovery>
 <entry>2008-06-13</entry>
 </dates>
 </vuln>

<vuln vid="90db9983-2f53-11dd-a0d8-0016d325a0ed">
 <topic>ikiwiki -- cleartext passwords</topic>
 <affects>
 <package>
	<name>ikiwiki</name>
	<range><lt>2.48</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The ikiwiki development team reports:
	<blockquote cite="http://ikiwiki.info/security/#index32h2">
	 Until version 2.48, ikiwiki stored passwords in cleartext in
	 the userdb. That risks exposing all users' passwords if the file
	 is somehow exposed. To pre-emtively guard against that, current
	 versions of ikiwiki store password hashes (using Eksblowfish).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://ikiwiki.info/security/#index32h2</url>
 </references>
 <dates>
 <discovery>2008-05-30</discovery>
 <entry>2008-06-01</entry>
 </dates>
 </vuln>

<vuln vid="09066828-2ef1-11dd-a0d8-0016d325a0ed">
 <topic>ikiwiki -- empty password security hole</topic>
 <affects>
 <package>
	<name>ikiwiki</name>
	<range><ge>1.34</ge><lt>2.47_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The ikiwiki development team reports:
	<blockquote cite="http://ikiwiki.info/security/#index33h2">
	 This hole allowed ikiwiki to accept logins using empty
	 passwords to openid accounts that didn't use a password.
	 Upgrading to a non-vulnerable ikiwiki version immediatly is
	 recommended if your wiki allows both password and openid
	 logins.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0169</cvename>
 <url>http://ikiwiki.info/security/#index33h2</url>
 </references>
 <dates>
 <discovery>2008-05-30</discovery>
 <entry>2008-05-31</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="04c6187d-2d8f-11dd-98c9-00163e000016">
 <topic>linux-flashplugin -- unspecified remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><lt>9.0r124</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Product Security Incident Response Team reports:
	<blockquote cite="http://blogs.adobe.com/psirt/">
	 An exploit appears to be taking advantage of a known
	 vulnerability, reported by Mark Dowd of the ISS X-Force and wushi
	 of team509, that was resolved in Flash Player 9.0.124.0
	 (CVE-2007-0071). This exploit does NOT appear to include a new,
	 unpatched vulnerability as has been reported elsewhere - customers
	 with Flash Player 9.0.124.0 should not be vulnerable to this
	 exploit.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>29386</bid>
 <cvename>CVE-2007-0071</cvename>
 <url>http://blogs.adobe.com/psirt/</url>
 </references>
 <dates>
 <discovery>2008-05-27</discovery>
 <entry>2008-05-30</entry>
 </dates>
 </vuln>

<vuln vid="fbd7aa81-2cc1-11dd-8cfb-00e0815b8da8">
 <topic>Nagios -- Cross Site Scripting Vulnerability</topic>
 <affects>
 <package>
	<name>nagios</name>
	<range><lt>2.12</lt></range>
	<range><gt>3.*</gt><lt>3.0.2</lt></range>
 </package>
 <package>
	<name>nagios-devel</name>
	<range><lt>3.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/30283">
	 A vulnerability has been reported in Nagios, which can be
	 exploited by malicious people to conduct cross-site scripting
	 attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>29140</bid>
 <cvename>CVE-2007-5803</cvename>
 <url>http://secunia.com/advisories/30283</url>
 </references>
 <dates>
 <discovery>2008-05-20</discovery>
 <entry>2008-05-28</entry>
 <modified>2008-09-08</modified>
 </dates>
 </vuln>

<vuln vid="555ac165-2bee-11dd-bbdc-00e0815b8da8">
 <topic>spamdyke -- open relay</topic>
 <affects>
 <package>
	<name>spamdyke</name>
	<range><lt>3.1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Spamdyke Team reports:
	<blockquote cite="http://www.spamdyke.org/documentation/Changelog.txt">
	 Fixed smtp_filter() to reject the DATA command if no valid
	 recipients have been specified. Otherwise, a specific scenario could
	 result in every spamdyke installation being used as an open relay.
	 If the remote server connects and gives one or more recipients that
	 are rejected (for relaying or blacklisting), then gives the DATA
	 command, spamdyke will ignore all other commands, assuming that
	 message data is being transmitted. However, because all of the
	 recipients were rejected, qmail will reject the DATA command. From
	 that point on, the remote server can give as many recipients as it
	 likes and spamdyke will ignore them all -- they will not be filtered
	 at all. After that, the remote server can give the DATA command and
	 send the actual message data. Because spamdyke is controlling
	 relaying, the RELAYCLIENT environment variable is set and qmail won't
	 check for relaying either. Thanks to Mirko Buffoni for reporting
	 this one.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2784</cvename>
 <url>http://www.spamdyke.org/documentation/Changelog.txt</url>
 </references>
 <dates>
 <discovery>2008-05-21</discovery>
 <entry>2008-05-27</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="402ae710-26a2-11dd-ae05-825f4c35000a">
 <topic>peercast -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>peercast</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	 Nico Golde discovered that PeerCast, a P2P audio and
	 video streaming server, is vulnerable to a buffer overflow
	 in the HTTP Basic Authentication code, allowing a remote
	 attacker to crash PeerCast or execure arbitrary code.
	</body>
 </description>
 <references>
 <bid>28986</bid>
 <cvename>CVE-2008-2040</cvename>
 <url>http://secunia.com/advisories/30020</url>
 </references>
 <dates>
 <discovery>2008-05-20</discovery>
 <entry>2008-05-21</entry>
 </dates>
 </vuln>

<vuln vid="f5a76faf-244c-11dd-b143-0211d880e350">
 <topic>libvorbis -- various security issues</topic>
 <affects>
 <package>
	<name>libvorbis</name>
	<range><lt>1.2.0_2,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Red Hat reports:
	<blockquote cite="https://rhn.redhat.com/errata/RHSA-2008-0270.html">
	 Will Drewry of the Google Security Team reported several
	 flaws in the way libvorbis processed audio data. An
	 attacker could create a carefully crafted [Vorbis] audio file
	 in such a way that it could cause an application linked
	 with libvorbis to crash, or execute arbitrary code when
	 it was opened.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1419</cvename>
 <cvename>CVE-2008-1420</cvename>
 <cvename>CVE-2008-1423</cvename>
 <url>https://rhn.redhat.com/errata/RHSA-2008-0270.html</url>
 </references>
 <dates>
 <discovery>2008-05-14</discovery>
 <entry>2008-05-17</entry>
 </dates>
 </vuln>

<vuln vid="f49ba347-2190-11dd-907c-001c2514716c">
 <topic>django -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>py23-django</name>
	<name>py24-django</name>
	<name>py25-django</name>
	<range><lt>0.96.2</lt></range>
 </package>
 <package>
	<name>py23-django-devel</name>
	<name>py24-django-devel</name>
	<name>py25-django-devel</name>
	<range><lt>20080511</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django project reports:
	<blockquote cite="http://www.djangoproject.com/weblog/2008/may/14/security/">
	 The Django administration application will, when accessed by
	 a user who is not sufficiently authenticated, display a login
	 form and ask the user to provide the necessary credentials
	 before displaying the requested page. This form will be submitted
	 to the URL the user attempted to access, by supplying the current
	 request path as the value of the form's "action" attribute.
	 The value of the request path was not being escaped, creating an
	 opportunity for a cross-site scripting (XSS) attack by leading a
	 user to a URL which contained URL-encoded HTML and/or JavaScript
	 in the request path.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2302</cvename>
 <url>http://www.djangoproject.com/weblog/2008/may/14/security/</url>
 </references>
 <dates>
 <discovery>2008-05-10</discovery>
 <entry>2008-05-14</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="633716fa-1f8f-11dd-b143-0211d880e350">
 <topic>vorbis-tools -- Speex header processing vulnerability</topic>
 <affects>
 <package>
	<name>vorbis-tools</name>
	<range><lt>1.2.0_2,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/29882/">
	 A vulnerability has been reported in vorbis-tools,
	 which can potentially be exploited by malicious people
	 to compromise a user's system.
	 The vulnerability is caused due to an input validation
	 error when processing Speex headers, which can be
	 exploited via a specially crafted Speex stream containing
	 a negative "modeID" field in the header.
	 Successful exploitation may allow execution of arbitrary
	 code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1686</cvename>
 <url>http://secunia.com/advisories/29882/</url>
 </references>
 <dates>
 <discovery>2008-04-18</discovery>
 <entry>2008-05-11</entry>
 </dates>
 </vuln>

<vuln vid="8950ac62-1d30-11dd-9388-0211060005df">
 <topic>qemu -- "drive_init()" Disk Format Security Bypass</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>0.9.1_6</lt></range>
	<range><ge>0.9.1s.20070101*</ge><lt>0.9.1s.20080302_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/30111/">
	 A vulnerability has been reported in QEMU, which can be exploited
	 by malicious, local users to bypass certain security
	 restrictions.
	 The vulnerability is caused due to the "drive_init()" function
	 in vl.c determining the format of a disk from data contained in
	 the disk's header. This can be exploited by a malicious user in
	 a guest system to e.g. read arbitrary files on the host by
	 writing a fake header to a raw formatted disk image.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-2004</cvename>
 <url>http://secunia.com/advisories/30111/</url>
 <mlist>http://lists.gnu.org/archive/html/qemu-devel/2008-04/msg00675.html</mlist>
 </references>
 <dates>
 <discovery>2008-04-28</discovery>
 <entry>2008-05-08</entry>
 </dates>
 </vuln>

<vuln vid="5ef12755-1c6c-11dd-851d-0016d325a0ed">
 <topic>swfdec -- exposure of sensitive information</topic>
 <affects>
 <package>
	<name>swfdec</name>
	<range><lt>0.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/29915">
	 A vulnerability has been reported in swfdec, which can be
	 exploited by malicious people to disclose sensitive
	 information.
	 The vulnerability is caused due to swfdec not properly
	 restricting untrusted sandboxes from reading local files,
	 which can be exploited to disclose the content of arbitrary
	 local files by e.g. tricking a user into visiting a malicious
	 website.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1834</cvename>
 <url>http://secunia.com/advisories/29915</url>
 </references>
 <dates>
 <discovery>2008-04-09</discovery>
 <entry>2008-05-07</entry>
 </dates>
 </vuln>

<vuln vid="86a4d810-1884-11dd-a914-0016179b2dd5">
 <topic>mt-daapd -- integer overflow</topic>
 <affects>
 <package>
	<name>mt-daapd</name>
	<range><lt>0.2.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	FrSIRT reports:
	<blockquote cite="http://www.frsirt.com/english/advisories/2008/1303">
	 A vulnerability has been identified in mt-daapd which could be exploited
	 by remote attackers to cause a denial of service or compromise an
	 affected system. This issue is caused by a buffer overflow error in the
	 ws_getpostvars() function when processing a negative Content-Length:
	 header value, which could be exploited by remote unauthenticated
	 attackers to crash an affected application or execute arbitrary
	 code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1771</cvename>
 <url>http://secunia.com/advisories/29917</url>
 <url>http://www.frsirt.com/english/advisories/2008/1303</url>
 </references>
 <dates>
 <discovery>2008-04-21</discovery>
 <entry>2008-05-02</entry>
 </dates>
 </vuln>

<vuln vid="b1bcab7d-1880-11dd-a914-0016179b2dd5">
 <topic>sdl_image -- buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>sdl_image</name>
	<range><lt>1.2.6_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/28640">
	 Two vulnerabilities have been reported in SDL_image, which can be
	 exploited by malicious people to cause a Denial of Service or potentially
	 compromise an application using the library.
	 A boundary error within the LWZReadByte() function in IMG_gif.c can
	 be exploited to trigger the overflow of a static buffer via a
	 specially crafted GIF file.
	 A boundary error within the "IMG_LoadLBM_RW()" function in IMG_lbm.c
	 can be exploited to cause a heap-based buffer overflow via a specially
	 crafted IFF ILBM file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6697</cvename>
 <cvename>CVE-2008-0544</cvename>
 <url>http://secunia.com/advisories/28640</url>
 </references>
 <dates>
 <discovery>2008-01-24</discovery>
 <entry>2008-05-02</entry>
 </dates>
 </vuln>

<vuln vid="30394651-13e1-11dd-bab7-0016179b2dd5">
 <topic>gnupg -- memory corruption vulnerability</topic>
 <affects>
 <package>
	<name>gnupg</name>
	<range><ge>1.0.0</ge><lt>1.4.9</lt></range>
	<range><ge>2.0.0</ge><lt>2.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/29568">
	 A vulnerability has been reported in GnuPG, which can potentially
	 be exploited to compromise a vulnerable system.
	 The vulnerability is caused due to an error when importing keys
	 with duplicated IDs. This can be exploited to cause a memory
	 corruption when importing keys via --refresh-keys or --import.
	 Successful exploitation potentially allows execution of arbitrary
	 code, but has not been proven yet.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>28487</bid>
 <cvename>CVE-2008-1530</cvename>
 <url>http://www.ocert.org/advisories/ocert-2008-1.html</url>
 <url>http://secunia.com/advisories/29568</url>
 <url>https://bugs.g10code.com/gnupg/issue894</url>
 </references>
 <dates>
 <discovery>2008-03-19</discovery>
 <entry>2008-04-26</entry>
 <modified>2008-04-29</modified>
 </dates>
 </vuln>

<vuln vid="44c8694a-12f9-11dd-9b26-001c2514716c">
 <topic>extman -- password bypass vulnerability</topic>
 <affects>
 <package>
	<name>extman</name>
	<range><ge>0.2.4</ge><lt>0.2.4_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Extmail team reports:
	<blockquote cite="http://www.extmail.org/forum/thread-7260-1-1.html">
	 Emergency update #4 fixes a serious security vulnerability.
	</blockquote>
	Successful exploit of this vulnerability would allow attacker to
	 change user's password without knowing it by using specifically
	 crafted HTTP request.
 </body>
 </description>
 <references>
 <url>http://www.extmail.org/forum/thread-7260-1-1.html</url>
 </references>
 <dates>
 <discovery>2008-04-01</discovery>
 <entry>2008-04-25</entry>
 </dates>
 </vuln>

<vuln vid="f47f2746-12c5-11dd-bab7-0016179b2dd5">
 <topic>mailman -- script insertion vulnerability</topic>
 <affects>
 <package>
	<name>ja-mailman</name>
	<name>mailman</name>
	<name>mailman-with-htdig</name>
	<range><lt>2.1.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/28794">
	 A vulnerability has been reported in Mailman, which can be
	 exploited by malicious users to conduct script insertion
	 attacks.
	 Certain input when editing the list templates and the list info
	 attribute is not properly sanitised before being stored. This can be
	 exploited to insert arbitrary HTML and script code, which is
	 executed in a user's browser session in context of an affected site
	 when the malicious website is accessed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0564</cvename>
 <bid>27630</bid>
 <url>http://www.ubuntu.com/usn/usn-586-1</url>
 <url>http://secunia.com/advisories/28794</url>
 <url>http://sourceforge.net/project/shownotes.php?release_id=593924</url>
 </references>
 <dates>
 <discovery>2008-02-05</discovery>
 <entry>2008-04-25</entry>
 </dates>
 </vuln>

<vuln vid="86c05550-12c1-11dd-bab7-0016179b2dd5">
 <topic>mksh -- TTY attachment privilege escalation</topic>
 <affects>
 <package>
	<name>mksh</name>
	<range><lt>R33d</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/29803/">
	 The vulnerability is caused due to an error when attaching to a TTY
	 via the -T command line switch. This can be exploited to execute
	 arbitrary commands with the privileges of the user running mksh via
	 characters previously written to the attached virtual console.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1845</cvename>
 <url>http://secunia.com/advisories/29803/</url>
 <url>http://www.mirbsd.org/mksh.htm#clog</url>
 </references>
 <dates>
 <discovery>2008-04-14</discovery>
 <entry>2008-04-25</entry>
 </dates>
 </vuln>

<vuln vid="9c133aa0-12bd-11dd-bab7-0016179b2dd5">
 <topic>serendipity -- multiple cross site scripting vulnerabilities</topic>
 <affects>
 <package>
	<name>serendipity</name>
	<range><lt>1.3.1</lt></range>
 </package>
 <package>
	<name>serendipity-devel</name>
	<range><lt>200804242342</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hanno Boeck reports:
	<blockquote cite="http://int21.de/cve/CVE-2008-1386-s9y.html">
	 The installer of serendipity 1.3 has various Cross Site Scripting
	 issues. This is considered low priority, as attack scenarios are
	 very unlikely.
	 Various path fields are not escaped properly, thus filling them
	 with javascript code will lead to XSS. MySQL error messages are not
	 escaped, thus the database host field can also be filled with
	 javascript.
	</blockquote>
	<blockquote cite="http://int21.de/cve/CVE-2008-1385-s9y.html">
	 In the referrer plugin of the blog application serendipity,
	 the referrer string is not escaped, thus leading to a permanent
	 XSS.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>28885</bid>
 <cvename>CVE-2008-1385</cvename>
 <cvename>CVE-2008-1386</cvename>
 <url>http://int21.de/cve/CVE-2008-1385-s9y.html</url>
 <url>http://int21.de/cve/CVE-2008-1386-s9y.html</url>
 <url>http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html</url>
 </references>
 <dates>
 <discovery>2008-04-22</discovery>
 <entry>2008-04-25</entry>
 </dates>
 </vuln>

<vuln vid="67bd39ba-12b5-11dd-bab7-0016179b2dd5">
 <topic>firefox -- javascript garbage collector vulnerability</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>2.0.0.14,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<name>linux-firefox-devel</name>
	<range><lt>2.0.0.14</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.10</lt></range>
 </package>
 <package>
	<name>flock</name>
	<name>linux-flock</name>
	<range><lt>1.1.2</lt></range>
 </package>
 <package>
	<name>linux-seamonkey-devel</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="http://www.mozilla.org/security/announce/2008/mfsa2008-20.html">
	 Fixes for security problems in the JavaScript engine described in
	 MFSA 2008-15 introduced a stability problem, where some users
	 experienced crashes during JavaScript garbage collection. This is
	 being fixed primarily to address stability concerns. We have no
	 demonstration that this particular crash is exploitable but are
	 issuing this advisory because some crashes of this type have been
	 shown to be exploitable in the past.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1237</cvename>
 <cvename>CVE-2008-1380</cvename>
 <bid>28818</bid>
 <url>http://secunia.com/advisories/29787</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-20.html</url>
 </references>
 <dates>
 <discovery>2008-04-16</discovery>
 <entry>2008-04-25</entry>
 <modified>2009-12-12</modified>
 </dates>
 </vuln>

<vuln vid="57c705d6-12ae-11dd-bab7-0016179b2dd5">
 <topic>png -- unknown chunk processing uninitialized memory access</topic>
 <affects>
 <package>
	<name>png</name>
	<range><lt>1.2.27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://.com/advisories/29792">
	 Tavis Ormandy has reported a vulnerability in libpng, which can be
	 exploited by malicious people to cause a Denial of Service, disclose
	 potentially sensitive information, or potentially compromise an
	 application using the library.
	 The vulnerability is caused due to the improper handling of PNG
	 chunks unknown to the library. This can be exploited to trigger the
	 use of uninitialized memory in e.g. a free() call via unknown PNG
	 chunks having a length of zero.
	 Successful exploitation may allow execution of arbitrary code, but
	 requires that the application calls the png_set_read_user_chunk_fn()
	 function or the png_set_keep_unknown_chunks() function under
	 specific conditions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1382</cvename>
 <bid>28770</bid>
 <url>http://secunia.com/advisories/29792</url>
 <url>http://libpng.sourceforge.net/Advisory-1.2.26.txt</url>
 </references>
 <dates>
 <discovery>2008-04-12</discovery>
 <entry>2008-04-25</entry>
 <modified>2008-04-29</modified>
 </dates>
 </vuln>

<vuln vid="b84a992a-12ab-11dd-bab7-0016179b2dd5">
 <topic>openfire -- unspecified denial of service</topic>
 <affects>
 <package>
	<name>openfire</name>
	<range><lt>3.5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/29751">
	 A vulnerability has been reported in Openfire, which can be
	 exploited by malicious people to cause a Denial of Service.
	 The vulnerability is caused due to an unspecified error and can be
	 exploited to cause a Denial of Service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1728</cvename>
 <bid>28722</bid>
 <url>http://secunia.com/advisories/29751</url>
 <url>http://www.igniterealtime.org/issues/browse/JM-1289</url>
 </references>
 <dates>
 <discovery>2008-04-10</discovery>
 <entry>2008-04-25</entry>
 </dates>
 </vuln>

<vuln vid="f6377f08-12a7-11dd-bab7-0016179b2dd5">
 <topic>php -- integer overflow vulnerability</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE reports:
	<blockquote cite="http://www.securityfocus.com/bid/28392/discuss">
	 Integer overflow in PHP 5.2.5 and earlier allows context-dependent
	 attackers to cause a denial of service and possibly have unspecified
	 other impact via a printf format parameter with a large width
	 specifier, related to the php_sprintf_appendstring function in
	 formatted_print.c and probably other functions for formatted strings
	 (aka *printf functions).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1384</cvename>
 <bid>28392</bid>
 <url>http://securityreason.com/achievement_securityalert/52</url>
 </references>
 <dates>
 <discovery>2008-03-21</discovery>
 <entry>2008-04-25</entry>
 <modified>2008-05-02</modified>
 </dates>
 </vuln>

<vuln vid="ec41c3e2-129c-11dd-bab7-0016179b2dd5">
 <topic>python -- Integer Signedness Error in zlib Module</topic>
 <affects>
 <package>
	<name>python23</name>
	<range><lt>2.3.6_1</lt></range>
 </package>
 <package>
	<name>python24</name>
	<range><lt>2.4.5_1</lt></range>
 </package>
 <package>
	<name>python25</name>
	<range><lt>2.5.2_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Justin Ferguson reports:
	<blockquote cite="http://bugs.python.org/issue2586">
	 Integer signedness error in the zlib extension module in Python
	 2.5.2 and earlier allows remote attackers to execute arbitrary code
	 via a negative signed integer, which triggers insufficient memory
	 allocation and a buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1721</cvename>
 <bid>28715</bid>
 <url>http://securityreason.com/securityalert/3802</url>
 <url>http://bugs.python.org/issue2586</url>
 </references>
 <dates>
 <discovery>2008-04-10</discovery>
 <entry>2008-04-25</entry>
 <modified>2008-04-28</modified>
 </dates>
 </vuln>

<vuln vid="51436b4c-1250-11dd-bab7-0016179b2dd5">
 <topic>postgresql -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql</name>
	<name>postgresql-server</name>
	<range><ge>7.3</ge><lt>7.3.21</lt></range>
	<range><ge>7.4</ge><lt>7.4.19</lt></range>
	<range><ge>8.0</ge><lt>8.0.15</lt></range>
	<range><ge>8.1</ge><lt>8.1.11</lt></range>
	<range><ge>8.2</ge><lt>8.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL developers report:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6600">
	 PostgreSQL allows users to create indexes on the results of
	 user-defined functions, known as "expression indexes". This provided
	 two vulnerabilities to privilege escalation: (1) index functions
	 were executed as the superuser and not the table owner during VACUUM
	 and ANALYZE, and (2) that SET ROLE and SET SESSION AUTHORIZATION
	 were permitted within index functions. Both of these holes have now
	 been closed.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4772">
	 PostgreSQL allowed malicious users to initiate a denial-of-service
	 by passing certain regular expressions in SQL queries. First, users
	 could create infinite loops using some specific regular expressions.
	 Second, certain complex regular expressions could consume excessive
	 amounts of memory. Third, out-of-range backref numbers could be used
	 to crash the backend.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=">
	 DBLink functions combined with local trust or ident authentication
	 could be used by a malicious user to gain superuser privileges. This
	 issue has been fixed, and does not affect users who have not
	 installed DBLink (an optional module), or who are using password
	 authentication for local access. This same problem was addressed in
	 the previous release cycle, but that patch failed to close all forms
	 of the loophole.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6600</cvename>
 <cvename>CVE-2007-4772</cvename>
 <cvename>CVE-2007-6067</cvename>
 <cvename>CVE-2007-4769</cvename>
 <cvename>CVE-2007-6601</cvename>
 <bid>27163</bid>
 <url>http://www.postgresql.org/about/news.905</url>
 </references>
 <dates>
 <discovery>2008-01-06</discovery>
 <entry>2008-04-24</entry>
 </dates>
 </vuln>

<vuln vid="fe971a0f-1246-11dd-bab7-0016179b2dd5">
 <topic>phpmyadmin -- Shared Host Information Disclosure</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A phpMyAdmin security announcement report:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3">
	 It is possible to read the contents of any file that the web
	 server's user can access. The exact mechanism to achieve this won't
	 be disclosed. If a user can upload on the same host where
	 phpMyAdmin is running a PHP script that can read files with the
	 rights of the web server's user, the current advisory does not
	 describe an additional threat.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1924</cvename>
 <url>http://secunia.com/advisories/29944/</url>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3</url>
 </references>
 <dates>
 <discovery>2008-04-23</discovery>
 <entry>2008-04-24</entry>
 <modified>2008-09-17</modified>
 </dates>
 </vuln>

<vuln vid="6eb1dc51-1244-11dd-bab7-0016179b2dd5">
 <topic>phpmyadmin -- Username/Password Session File Information Disclosure</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A phpMyAdmin security announcement report:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-2">
	 phpMyAdmin saves sensitive information like the MySQL username and
	 password and the Blowfish secret key in session data, which might be
	 unprotected on a shared host.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1567</cvename>
 <url>http://secunia.com/advisories/29613/</url>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3</url>
 </references>
 <dates>
 <discovery>2008-03-31</discovery>
 <entry>2008-04-24</entry>
 <modified>2008-09-17</modified>
 </dates>
 </vuln>

<vuln vid="7a7c5853-10a3-11dd-8eb8-00163e000016">
 <topic>libxine -- array index vulnerability</topic>
 <affects>
 <package>
	<name>libxine</name>
	<range><lt>1.1.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	xine Team reports:
	<blockquote cite="http://www.xinehq.de/index.php/news">
	 A new xine-lib version is now available. This release contains a
	 security fix (an unchecked array index that could allows remote
	 attackers to execute arbitrary code via a header structure
	 containing a negative offset, which is used to dereference a
	 function pointer.)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1686</cvename>
 <url>http://www.xinehq.de/index.php/news</url>
 </references>
 <dates>
 <discovery>2008-04-06</discovery>
 <entry>2008-04-24</entry>
 </dates>
 </vuln>

<vuln vid="589d8053-0b03-11dd-b4ef-00e07dc4ec84">
 <topic>clamav -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.93</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><lt>20080415</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/29000">
	 Some vulnerabilities have been reported in ClamAV, which can be
	 exploited by malicious people to cause a DoS (Denial of Service)
	 or to compromise a vulnerable system.
	 1) A boundary error exists within the "cli_scanpe()" function in
	 libclamav/pe.c. This can be exploited to cause a heap-based buffer
	 overflow via a specially crafted "Upack" executable.
	 Successful exploitation allows execution of arbitrary code.
	 2) A boundary error within the processing of PeSpin packed
	 executables in libclamav/spin.c can be exploited to cause a
	 heap-based buffer overflow.
	 Successful exploitation may allow execution of arbitrary code.
	 3) An unspecified error in the processing of ARJ files can be
	 exploited to hang ClamAV.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1100</cvename>
 <cvename>CVE-2008-1387</cvename>
 <url>http://secunia.com/advisories/29000</url>
 </references>
 <dates>
 <discovery>2008-04-15</discovery>
 <entry>2008-04-15</entry>
 </dates>
 </vuln>

<vuln vid="1ac77649-0908-11dd-974d-000fea2763ce">
 <topic>lighttpd -- OpenSSL Error Queue Denial of Service Vulnerability</topic>
 <affects>
 <package>
	<name>lighttpd</name>
	<range><lt>1.4.19_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/29649">
	 A vulnerability has been reported in lighttpd, which can be
	 exploited by malicious people to cause a DoS (Denial of
	 Service).
	 The vulnerability is caused due to lighttpd not properly clearing
	 the OpenSSL error queue. This can be exploited to close concurrent
	 SSL connections of lighttpd by terminating one SSL connection.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>28489</bid>
 <cvename>CVE-2008-1531</cvename>
 <url>http://secunia.com/advisories/29649</url>
 <url>http://trac.lighttpd.net/trac/ticket/285</url>
 </references>
 <dates>
 <discovery>2008-04-02</discovery>
 <entry>2008-04-13</entry>
 </dates>
 </vuln>

<vuln vid="8d2c0ce1-08b6-11dd-94b4-0016d325a0ed">
 <topic>ikiwiki -- cross site request forging</topic>
 <affects>
 <package>
	<name>ikiwiki</name>
	<range><lt>2.42</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The ikiwiki development team reports:
	<blockquote cite="http://ikiwiki.info/security/#index31h2">
	 Cross Site Request Forging could be used to construct a link
	 that would change a logged-in user's password or other preferences
	 if they clicked on the link. It could also be used to construct a
	 link that would cause a wiki page to be modified by a logged-in
	 user.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0165</cvename>
 <url>http://ikiwiki.info/security/#index31h2</url>
 </references>
 <dates>
 <discovery>2008-04-10</discovery>
 <entry>2008-04-13</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="072a53e0-0397-11dd-bd06-0017319806e7">
 <topic>postfix-policyd-weight -- working directory symlink vulnerability</topic>
 <affects>
 <package>
	<name>postfix-policyd-weight</name>
	<range><lt>0.1.14.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	postfix-policyd-weight does not check for symlink for its working
	 directory. If the working directory is not already setup by the
	 super root, an unprivileged user can link it to another directories
	 in the system. This results in ownership/permission changes on the
	 target directory.
 </body>
 </description>
 <references>
 <bid>28480</bid>
 <mlist>http://article.gmane.org/gmane.mail.postfix.policyd-weight/815</mlist>
 <mlist>http://article.gmane.org/gmane.mail.postfix.policyd-weight/823</mlist>
 </references>
 <dates>
 <discovery>2008-03-24</discovery>
 <entry>2008-04-06</entry>
 </dates>
 </vuln>

<vuln vid="b21790a5-02fb-11dd-bd06-0017319806e7">
 <topic>powerdns-recursor -- DNS cache poisoning</topic>
 <affects>
 <package>
	<name>powerdns-recursor</name>
	<range><lt>3.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	If the system random number generator can be predicted by its
	 past output, then an attacker may spoof Recursor to accept mallicious
	 data. This leads to DNS cache poisoning and client redirection.
 </body>
 </description>
 <references>
 <url>http://doc.powerdns.com/security-policy.html</url>
 </references>
 <dates>
 <discovery>2008-03-31</discovery>
 <entry>2008-04-05</entry>
 </dates>
 </vuln>

<vuln vid="fb672330-02db-11dd-bd06-0017319806e7">
 <topic>suphp -- multiple local privilege escalation vulnerabilities</topic>
 <affects>
 <package>
	<name>suphp</name>
	<range><lt>0.6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple local privilege escalation are found in the symlink
	 verification code. An attacker may use it to run a PHP script with
	 the victim's privilege. This attack is a little harder when suphp
	 operates in paranoid mode. For suphp that runs in owner mode
	 which is the default in ports, immediate upgrade to latest
	 version is advised.
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1614</cvename>
 <bid>28568</bid>
 <url>http://lists.marsching.biz/pipermail/suphp/2008-March/001750.html</url>
 </references>
 <dates>
 <discovery>2008-03-30</discovery>
 <entry>2008-04-05</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="ad4a00fa-0157-11dd-8bd3-001372ae3ab9">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<range><lt>9.27.20080331</lt></range>
 </package>
 <package>
	<name>linux-opera</name>
	<range><lt>9.27.20080331</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera Software reports of multiple security issues in Opera.
	 All of them can lead to arbitrary code execution. Details are
	 as the following:
	<ul>
	 <li><a href="http://www.opera.com/support/search/view/881/">Newsfeed
	 prompt can cause Opera to execute arbitrary code</a></li>
	 <li><a href="http://www.opera.com/support/search/view/882/">Resized
	 canvas patterns can cause Opera to execute arbitrary code</a></li>
	</ul>
 </body>
 </description>
 <references>
 <bid>28585</bid>
 <cvename>CVE-2008-1761</cvename>
 <cvename>CVE-2008-1762</cvename>
 <url>http://www.opera.com/support/search/view/881/</url>
 <url>http://www.opera.com/support/search/view/882/</url>
 </references>
 <dates>
 <discovery>2008-04-03</discovery>
 <entry>2008-04-05</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="12b336c6-fe36-11dc-b09c-001c2514716c">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>2.0.0.13,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<name>linux-firefox-devel</name>
	<range><lt>2.0.0.13</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.9</lt></range>
 </package>
 <package>
	<name>flock</name>
	<name>linux-flock</name>
	<range><lt>1.1.1</lt></range>
 </package>
 <package>
	<name>linux-seamonkey-devel</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<range><lt>2.0.0.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports of multiple security issues
	 in Firefox, Seamonkey, and Thunderbird. Several of these
	 issues can probably be used to run arbitrary code with the
	 privilege of the user running the program.
	<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
	 <ul>
	 <li><a href="/security/announce/2008/mfsa2008-19.html">MFSA 2008-19</a>
	 XUL popup spoofing variant (cross-tab popups)</li>
	 <li><a href="/security/announce/2008/mfsa2008-18.html">MFSA 2008-18</a>
	 Java socket connection to any local port via LiveConnect</li>
	 <li><a href="/security/announce/2008/mfsa2008-17.html">MFSA 2008-17</a>
	 Privacy issue with SSL Client Authentication</li>
	 <li><a href="/security/announce/2008/mfsa2008-16.html">MFSA 2008-16</a>
	 HTTP Referrer spoofing with malformed URLs</li>
	 <li><a href="/security/announce/2008/mfsa2008-15.html">MFSA 2008-15</a>
	 Crashes with evidence of memory corruption (rv:1.8.1.13)</li>
	 <li><a href="/security/announce/2008/mfsa2008-14.html">MFSA 2008-14</a>
	 JavaScript privilege escalation and arbitrary code execution</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>28448</bid>
 <cvename>CVE-2008-1241</cvename>
 <cvename>CVE-2008-1240</cvename>
 <cvename>CVE-2007-4879</cvename>
 <cvename>CVE-2008-1238</cvename>
 <cvename>CVE-2008-1236</cvename>
 <cvename>CVE-2008-1237</cvename>
 <cvename>CVE-2008-1233</cvename>
 <cvename>CVE-2008-1234</cvename>
 <cvename>CVE-2008-1235</cvename>
 </references>
 <dates>
 <discovery>2008-03-26</discovery>
 <entry>2008-03-30</entry>
 <modified>2009-12-12</modified>
 </dates>
 </vuln>

<vuln vid="ff304c35-fb5b-11dc-91c1-00e0815b8da8">
 <topic>silc -- pkcs_decode buffer overflow</topic>
 <affects>
 <package>
	<name>silc-irssi-client</name>
	<name>silc-client</name>
	<range><lt>1.1.4</lt></range>
 </package>
 <package>
	<name>silc-server</name>
	<range><lt>1.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Core Security Technologies reports:
	<blockquote cite="http://www.coresecurity.com/?action=item&amp;id=2206">
	 A remote buffer overflow vulnerability found in a library
	 used by both the SILC server and client to process
	 packets containing cryptographic material may allow an
	 un-authenticated client to executearbitrary code on the
	 server with the privileges of the user account running the
	 server, or a malicious SILC server to compromise client
	 systems and execute arbitrary code with the privileges of
	 the user account running the SILC client program.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>28373</bid>
 <url>http://www.coresecurity.com/?action=item&amp;id=2206</url>
 </references>
 <dates>
 <discovery>2008-03-25</discovery>
 <entry>2008-03-26</entry>
 </dates>
 </vuln>

<vuln vid="063399fc-f6d6-11dc-bcee-001c2514716c">
 <topic>bzip2 -- crash with certain malformed archive files</topic>
 <affects>
 <package>
	<name>bzip2</name>
	<range><lt>1.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/28286/">
	 The 'bzip2' application is prone to a remote file-handling
	 vulnerability because the application fails to properly
	 handle malformed files.
	 Exploit attempts likely result in application crashes.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>28286</bid>
 <cvename>CVE-2008-1372</cvename>
 <url>https://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html</url>
 <url>http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/</url>
 </references>
 <dates>
 <discovery>2008-03-18</discovery>
 <entry>2008-03-20</entry>
 </dates>
 </vuln>

<vuln vid="9cfbca7f-efb7-11dc-be01-0211060005df">
 <topic>qemu -- unchecked block read/write vulnerability</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>0.9.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ian Jackson reports on the debian-security mailinglist:
	<blockquote cite="http://lists.debian.org/debian-security/2008/02/msg00064.html">
	 When a block device read or write request is made by the guest,
	 nothing checks that the request is within the range supported by
	 the backend, but the code in the backend typically assumes that
	 the request is sensible.
	 Depending on the backend, this can allow the guest to read
	 and write arbitrary memory locations in qemu, and possibly gain
	 control over the qemu process, escaping from the
	 emulation/virtualisation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0928</cvename>
 <url>http://secunia.com/advisories/29172</url>
 <url>http://secunia.com/advisories/29081</url>
 <mlist msgid="18362.62578.44273.779731@mariner.uk.xensource.com">http://lists.debian.org/debian-security/2008/02/msg00064.html</mlist>
 </references>
 <dates>
 <discovery>2008-02-19</discovery>
 <entry>2008-03-11</entry>
 </dates>
 </vuln>

<vuln vid="b39bdc06-ee42-11dc-8678-00a0cce0781e">
 <topic>dovecot -- security hole in blocking passdbs</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><lt>1.0.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dovecot reports:
	<blockquote cite="http://dovecot.org/list/dovecot-news/2008-March/000065.html">
	 Security hole in blocking passdbs (MySQL always. PAM, passwd
	 and shadow if blocking=yes) where user could specify extra
	 fields in the password. The main problem here is when specifying
	 "skip_password_check" introduced in v1.0.11 for fixing master user
	 logins, allowing the user to log in as anyone without a valid
	 password.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://dovecot.org/list/dovecot-news/2008-March/000065.html</url>
 <url>http://secunia.com/advisories/29295/</url>
 </references>
 <dates>
 <discovery>2008-03-09</discovery>
 <entry>2008-03-10</entry>
 </dates>
 </vuln>

<vuln vid="de4d4110-ebce-11dc-ae14-0016179b2dd5">
 <topic>mplayer -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mplayer</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.11_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mplayer team reports:
	<blockquote cite="http://www.mplayerhq.hu/design7/news.html">
	 A buffer overflow was found in the code used to extract album
	 titles from CDDB server answers. When parsing answers from the
	 CDDB server, the album title is copied into a fixed-size buffer
	 with insufficient size checks, which may cause a buffer overflow.
	 A malicious database entry could trigger a buffer overflow in the
	 program. That can lead to arbitrary code execution with the UID of
	 the user running MPlayer.
	 A buffer overflow was found in the code used to escape URL
	 strings. The code used to skip over IPv6 addresses can be tricked
	 into leaving a pointer to a temporary buffer with a non-NULL value;
	 this causes the unescape code to reuse the buffer, and may lead to
	 a buffer overflow if the old buffer is smaller than required.
	 A malicious URL string may be used to trigger a buffer overflow in
	 the program, that can lead to arbitrary code execution with the UID
	 of the user running MPlayer.
	 A buffer overflow was found in the code used to parse MOV file
	 headers. The code read some values from the file and used them as
	 indexes into as array allocated on the heap without performing any
	 boundary check. A malicious file may be used to trigger a buffer
	 overflow in the program. That can lead to arbitrary code execution
	 with the UID of the user running MPlayer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0485</cvename>
 <cvename>CVE-2008-0486</cvename>
 <cvename>CVE-2008-0629</cvename>
 <cvename>CVE-2008-0630</cvename>
 <url>http://secunia.com/advisories/28779</url>
 </references>
 <dates>
 <discovery>2008-02-05</discovery>
 <entry>2008-03-06</entry>
 </dates>
 </vuln>

<vuln vid="ca8e56d5-e856-11dc-b5af-0017319806e7">
 <topic>ghostscript -- zseticcspace() function buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>ghostscript-gpl</name>
	<name>ghostscript-gpl-nox11</name>
	<range><lt>8.61_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chris Evans from the Google Security Team reports:
	<blockquote cite="http://scary.beasts.org/security/CESA-2008-001.html">
	 Severity: parsing of evil PostScript file will result in
	 arbitrary code execution.
	 A stack-based buffer overflow in the zseticcspace() function
	 in zicc.c allows remote arbitrary code execution via a
	 malicious PostScript file (.ps) that contains a long Range
	 array.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>28017</bid>
 <cvename>CVE-2008-0411</cvename>
 <url>http://scary.beasts.org/security/CESA-2008-001.html</url>
 </references>
 <dates>
 <discovery>2008-02-28</discovery>
 <entry>2008-03-05</entry>
 </dates>
 </vuln>

<vuln vid="ce2f2ade-e7df-11dc-a701-000bcdc1757a">
 <topic>phpmyadmin -- SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A phpMyAdmin security announcement report:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1">
	 phpMyAdmin used the $_REQUEST superglobal as a source for
	 its parameters, instead of $_GET and $_POST. This means that
	 on most servers, a cookie with the same name as one of
	 phpMyAdmin's parameters can interfere.
	 Another application could set a cookie for the root path
	 "/" with a "sql_query" name, therefore overriding the
	 user-submitted sql_query because by default, the $_REQUEST
	 superglobal imports first GET, then POST then COOKIE data.
	 <h3>Mitigation factor</h3>
	 An attacker must trick the victim into visiting a page on
	 the same web server where he has placed code that creates
	 a malicious cookie.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>28068</bid>
 <cvename>CVE-2008-1149</cvename>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1</url>
 </references>
 <dates>
 <discovery>2008-03-01</discovery>
 <entry>2008-03-04</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="f9e96930-e6df-11dc-8c6a-00304881ac9a">
 <topic>pcre -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>pcre</name>
	<range><lt>7.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PCRE developers report:
	<blockquote cite="http://pcre.org/changelog.txt">
	 A character class containing a very large number of characters with
	 codepoints greater than 255 (in UTF-8 mode, of course) caused a
	 buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>27786</bid>
 <cvename>CVE-2008-0674</cvename>
 <url>http://pcre.org/changelog.txt</url>
 </references>
 <dates>
 <discovery>2008-01-28</discovery>
 <entry>2008-02-29</entry>
 </dates>
 </vuln>

<vuln vid="e8a6a16d-e498-11dc-bb89-000bcdc1757a">
 <topic>libxine -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>libxine</name>
	<range><lt>1.1.10.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	xine Team reports:
	<blockquote cite="http://www.xinehq.de/index.php/news">
	 A new xine-lib version is now available. This release
	 contains a security fix (array index vulnerability which
	 may lead to a stack buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0486</cvename>
 <url>http://www.xinehq.de/index.php/news</url>
 </references>
 <dates>
 <discovery>2007-02-08</discovery>
 <entry>2008-02-26</entry>
 </dates>
 </vuln>

<vuln vid="9f581778-e3d4-11dc-bb89-000bcdc1757a">
 <topic>coppermine -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>coppermine</name>
	<range><lt>1.4.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Coppermine Security advisory
	<blockquote cite="http://coppermine-gallery.net/forum/index.php?topic=48106.0">
	 The development team is releasing a security update for
	 Coppermine in order to counter a recently discovered
	 cross-site-scripting vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0504</cvename>
 <cvename>CVE-2008-0505</cvename>
 <cvename>CVE-2008-0506</cvename>
 <url>http://coppermine-gallery.net/forum/index.php?topic=48106.0</url>
 <url>http://coppermine-gallery.net/forum/index.php?topic=50103.0</url>
 <url>http://secunia.com/advisories/28682/</url>
 </references>
 <dates>
 <discovery>2007-11-06</discovery>
 <entry>2008-02-25</entry>
 </dates>
 </vuln>

<vuln vid="f113bbeb-e3ac-11dc-bb89-000bcdc1757a">
 <topic>moinmoin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>moinmoin</name>
	<range><lt>1.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MoinMoin Security advisory
	<blockquote cite="http://moinmo.in/SecurityFixes">
	 XSS issue in login action
	 XSS issue in AttachFile action
	 XSS issue in RenamePage/DeletePage action
	 XSS issue in gui editor
	</blockquote>
 </body>
 </description>
 <references>
 <bid>27404</bid>
 <cvename>CVE-2007-0857</cvename>
 <cvename>CVE-2007-0901</cvename>
 <cvename>CVE-2007-0902</cvename>
 <cvename>CVE-2007-2423</cvename>
 <cvename>CVE-2007-2673</cvename>
 <cvename>CVE-2008-0780</cvename>
 <cvename>CVE-2008-0781</cvename>
 <cvename>CVE-2008-0782</cvename>
 <url>http://moinmo.in/SecurityFixes</url>
 <url>http://secunia.com/advisories/29010/</url>
 </references>
 <dates>
 <discovery>2007-02-08</discovery>
 <entry>2008-02-25</entry>
 <modified>2008-02-26</modified>
 </dates>
 </vuln>

<vuln vid="30c560ff-e0df-11dc-891a-02061b08fc24">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>9.26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera Software ASA reports about multiple security
	 fixes:
	<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/925/">
	 <ul>
	 <li>Fixed an issue where simulated text inputs could trick
	 users into uploading arbitrary files, as reported by
	 Mozilla.</li>
	 <li>Image properties can no longer be used to execute
	 scripts, as reported by Max Leonov.</li>
	 <li>Fixed an issue where the representation of DOM
	 attribute values could allow cross site scripting, as
	 reported by Arnaud.lb.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-1080</cvename>
 <cvename>CVE-2008-1081</cvename>
 <url>http://www.opera.com/docs/changelogs/freebsd/926/</url>
 <url>http://www.opera.com/support/search/view/877/</url>
 <url>http://www.opera.com/support/search/view/879/</url>
 <url>http://www.opera.com/support/search/view/880/</url>
 </references>
 <dates>
 <discovery>2008-02-20</discovery>
 <entry>2008-02-22</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="810a5197-e0d9-11dc-891a-02061b08fc24">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>2.0.0.12,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<name>linux-firefox-devel</name>
	<range><lt>2.0.0.12</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.8</lt></range>
 </package>
 <package>
	<name>flock</name>
	<name>linux-flock</name>
	<range><lt>1.0.9</lt></range>
 </package>
 <package>
	<name>linux-seamonkey-devel</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports of multiple security issues
	 in Firefox, Seamonkey, and Thunderbird. Several of these
	 issues can probably be used to run arbitrary code with the
	 privilege of the user running the program.
	<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
	 <ul>
	 <li>Web forgery overwrite with div overlay</li>
	 <li>URL token stealing via stylesheet redirect</li>
	 <li>Mishandling of locally-saved plain text files</li>
	 <li>File action dialog tampering</li>
	 <li>Possible information disclosure in BMP decoder</li>
	 <li>Web browsing history and forward navigation stealing</li>
	 <li>Directory traversal via chrome: URI</li>
	 <li>Stored password corruption</li>
	 <li>Privilege escalation, XSS, Remote Code Execution</li>
	 <li>Multiple file input focus stealing vulnerabilities</li>
	 <li>Crashes with evidence of memory corruption (rv:1.8.1.12)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0412</cvename>
 <cvename>CVE-2008-0413</cvename>
 <cvename>CVE-2008-0414</cvename>
 <cvename>CVE-2008-0415</cvename>
 <cvename>CVE-2008-0417</cvename>
 <cvename>CVE-2008-0418</cvename>
 <cvename>CVE-2008-0419</cvename>
 <cvename>CVE-2008-0420</cvename>
 <cvename>CVE-2008-0591</cvename>
 <cvename>CVE-2008-0592</cvename>
 <cvename>CVE-2008-0593</cvename>
 <cvename>CVE-2008-0594</cvename>
 <url>http://www.mozilla.org/projects/security/known-vulnerabilities.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-01.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-02.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-03.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-04.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-05.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-06.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-07.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-08.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-09.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-10.html</url>
 <url>http://www.mozilla.org/security/announce/2008/mfsa2008-11.html</url>
 </references>
 <dates>
 <discovery>2008-02-07</discovery>
 <entry>2008-02-22</entry>
 <modified>2009-12-12</modified>
 </dates>
 </vuln>

<vuln vid="e5d29309-e0db-11dc-97b2-001c2514716c">
 <topic>openldap -- modrdn Denial of Service vulnerability</topic>
 <affects>
 <package>
	<name>openldap-server</name>
	<range><lt>2.3.41</lt></range>
	<range><gt>2.4.0</gt><lt>2.4.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/28926/">
	 A vulnerability has been reported in OpenLDAP, which can
	 be exploited by malicious users to cause a DoS (Denial of
	 Service).
	</blockquote>
 </body>
 </description>
 <references>
 <bid>27778</bid>
 <cvename>CVE-2008-0658</cvename>
 </references>
 <dates>
 <discovery>2008-02-13</discovery>
 <entry>2008-02-22</entry>
 </dates>
 </vuln>

<vuln vid="be4b0529-dbaf-11dc-9791-000ea6702141">
 <topic>clamav -- ClamAV libclamav PE File Integer Overflow Vulnerability</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><ge>0.92</ge><lt>0.92.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	iDefense Security Advisory 02.12.08:
	<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=658">
	 Remote exploitation of an integer overflow vulnerability
	 in Clam AntiVirus' ClamAV, as included in various vendors'
	 operating system distributions, allows attackers to execute
	 arbitrary code with the privileges of the affected process.
	 The vulnerability exists within the code responsible
	 for parsing and scanning PE files. While iterating through
	 all sections contained in the PE file, several attacker
	 controlled values are extracted from the file. On each iteration,
	 arithmetic operations are performed without taking into
	 consideration 32-bit integer wrap.
	 Since insufficient integer overflow checks are present,
	 an attacker can cause a heap overflow by causing a specially
	 crafted Petite packed PE binary to be scanned. This results
	 in an exploitable memory corruption condition.
	 Exploitation of this vulnerability results in the
	 execution of arbitrary code with the privileges of the process
	 using libclamav. In the case of the clamd program, this will
	 result in code execution with the privileges of the clamav user.
	 Unsuccessful exploitation results in the clamd process crashing.
	</blockquote>
	<h1>Workaround</h1>
	Disabling the scanning of PE files will prevent exploitation.
	If using clamscan, this can be done by running clamscan with the
	 '--no-pe' option.
	If using clamdscan, set the 'ScanPE' option in the clamd.conf
	 file to 'no'.
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0318</cvename>
 <url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=658</url>
 <url>http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog</url>
 </references>
 <dates>
 <discovery>2008-01-07</discovery>
 <entry>2008-02-15</entry>
 </dates>
 </vuln>

<vuln vid="dea7df85-d96c-11dc-9bfc-000e0c092e7a">
 <topic>cacti -- Multiple security vulnerabilities have been discovered</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>0.8.7b</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The cacti development team reports:
	<blockquote cite="http://forums.cacti.net/about25749.html">
	 Multiple security vulnerabilities have been discovered in
	 Cacti's web interface:
	 <ul>
	 <li>XSS vulnerabilities</li>
	 <li>Path disclosure vulnerabilities</li>
	 <li>SQL injection vulnerabilities</li>
	 <li>HTTP response splitting vulnerabilities</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://forums.cacti.net/about25749.html</url>
 </references>
 <dates>
 <discovery>2008-02-12</discovery>
 <entry>2008-02-12</entry>
 </dates>
 </vuln>

<vuln vid="739329c8-d8f0-11dc-ac2f-0016d325a0ed">
 <topic>ikiwiki -- javascript insertion via uris</topic>
 <affects>
 <package>
	<name>ikiwiki</name>
	<range><lt>2.32.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The ikiwiki development team reports:
	<blockquote cite="http://ikiwiki.info/security/#index30h2">
	 The htmlscrubber did not block javascript in uris. This was
	 fixed by adding a whitelist of valid uri types, which does not
	 include javascript. Some urls specifyable by the meta plugin
	 could also theoretically have been used to inject javascript; this
	 was also blocked.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0808</cvename>
 <url>http://ikiwiki.info/security/#index30h2</url>
 </references>
 <dates>
 <discovery>2008-02-10</discovery>
 <entry>2008-02-11</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="1a818749-d646-11dc-8959-000bcdc1757a">
 <topic>zenphoto -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>zenphoto</name>
	<range><lt>1.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	zenphoto project reports:
	<blockquote cite="http://www.zenphoto.org/2008/02/">
	 A new zenphoto version is now available. This release contains
	 security fixes for HTML, XSS, and SQL injection vulnerabilities.
	 
	</blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2007-6666</cvename>
	<url>http://www.securityfocus.com/bid/27084</url>
	<url>http://secunia.com/advisories/28281</url>
 </references>
 <dates>
 <discovery>2008-01-03</discovery>
 <entry>2008-02-09</entry>
 </dates>
 </vuln>

<vuln vid="0832ee18-cf77-11dc-8c6a-00304881ac9a">
 <topic>jetty -- multiple vulnerability</topic>
 <affects>
 <package>
	<name>jetty</name>
	<range><lt>6.1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Greg Wilkins reports:
	<blockquote cite="http://jira.codehaus.org/browse/JETTY-386#action_117699">
	 jetty allows remote attackers to bypass protection mechanisms and
	 read the source of files via multiple '/' characters in the URI.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>27117</bid>
 <cvename>CVE-2007-6672</cvename>
 <url>http://jira.codehaus.org/browse/JETTY-386#action_117699</url>
 </references>
 <dates>
 <discovery>2007-12-22</discovery>
 <entry>2008-02-04</entry>
 </dates>
 </vuln>

<vuln vid="6ecd0b42-ce77-11dc-89b1-000e35248ad7">
 <topic>libxine -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>libxine</name>
	<range><lt>1.1.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	xine project reports:
	<blockquote cite="http://xinehq.de/index.php/news">
	 A new xine-lib version is now available. This release contains
	 a security fix (remotely-expoitable buffer overflow, CVE-2006-1664).
	 (This is not the first time that that bug has been fixed...)
	 It also fixes a few more recent bugs, such as the audio output
	 problems in 1.1.9.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1664</cvename>
 <url>http://secunia.com/advisories/19853/</url>
 </references>
 <dates>
 <discovery>2008-01-23</discovery>
 <entry>2008-01-29</entry>
 </dates>
 </vuln>

<vuln vid="fe2b6597-c9a4-11dc-8da8-0008a18a9961">
 <topic>xorg -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<range><lt>1.4_4,1</lt></range>
 </package>
 <package>
	<name>libXfont</name>
	<range><lt>1.3.1_2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthieu Herrb of X.Org reports:
	<blockquote cite="http://lists.freedesktop.org/archives/xorg/2008-January/031918.html">
	 Several vulnerabilities have been identified in server code
	 of the X window system caused by lack of proper input validation
	 on user controlled data in various parts of the software,
	 causing various kinds of overflows.
	 Exploiting these overflows will crash the X server or,
	 under certain circumstances allow the execution of arbitray
	 machine code.
	 When the X server is running with root privileges (which is the
	 case for the Xorg server and for most kdrive based servers),
	 these vulnerabilities can thus also be used to raise
	 privileges.
	 All these vulnerabilities, to be exploited succesfully, require
	 either an already established connection to a running X server
	 (and normally running X servers are only accepting authenticated
	 connections), or a shell access with a valid user on the machine
	 where the vulnerable server is installed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-5760</cvename>
 <cvename>CVE-2007-5958</cvename>
 <cvename>CVE-2007-6427</cvename>
 <cvename>CVE-2007-6428</cvename>
 <cvename>CVE-2007-6429</cvename>
 <cvename>CVE-2008-0006</cvename>
 <url>http://lists.freedesktop.org/archives/xorg/2008-January/031918.html</url>
 <url>http://lists.freedesktop.org/archives/xorg/2008-January/032099.html</url>
 <url>http://secunia.com/advisories/28532/</url>
 </references>
 <dates>
 <discovery>2008-01-18</discovery>
 <entry>2008-01-23</entry>
 </dates>
 </vuln>

<vuln vid="024edd06-c933-11dc-810c-0016179b2dd5">
 <topic>xfce -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xfce4-panel</name>
	<name>libxfce4gui</name>
	<range><lt>4.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gentoo reports:
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200801-06.xml">
	 A remote attacker could entice a user to install a specially
	 crafted "rc" file to execute arbitrary code via long strings
	 in the "Name" and "Comment" fields or via unspecified vectors
	 involving the second vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6531</cvename>
 <cvename>CVE-2007-6532</cvename>
 <url>http://www.xfce.org/documentation/changelogs/4.4.2</url>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200801-06.xml</url>
 </references>
 <dates>
 <discovery>2008-01-09</discovery>
 <entry>2008-01-22</entry>
 <modified>2008-02-13</modified>
 </dates>
 </vuln>

<vuln vid="a59afa47-c930-11dc-810c-0016179b2dd5">
 <topic>claws-mail -- insecure temporary file creation</topic>
 <affects>
 <package>
	<name>claws-mail</name>
	<range><lt>3.1.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nico Golde reports:
	<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=454089">
	 A local attacker could exploit this vulnerability to conduct
	 symlink attacks to overwrite files with the privileges of the user
	 running Claws Mail.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>26676</bid>
 <cvename>CVE-2007-6208</cvename>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200801-03.xml</url>
 <url>http://security.gentoo.org/glsa/glsa-200801-03.xml</url>
 <url>http://secunia.com/advisories/27897</url>
 </references>
 <dates>
 <discovery>2007-12-03</discovery>
 <entry>2008-01-22</entry>
 <modified>2008-02-12</modified>
 </dates>
 </vuln>

<vuln vid="e5a9de5f-c6bc-11dc-b9f1-00a0cce0781e">
 <topic>IRC Services-- Denial of Service Vulnerability</topic>
 <affects>
 <package>
	<name>ircservices</name>
	<range><lt>5.0.63</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/27761">
	 A vulnerability has been reported in IRC Services,
	 which can be exploited by malicious people to cause
	 a Denial of Service. The vulnerability is caused due
	 to the improper handling of overly long passwords within
	 the "default_encrypt()" function in encrypt.c and can be
	 exploited to crash an affected server.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6122</cvename>
 <url>http://secunia.com/advisories/27761</url>
 <url>http://ircservices.za.net/Changes.txt</url>
 </references>
 <dates>
 <discovery>2007-11-21</discovery>
 <entry>2008-01-19</entry>
 </dates>
 </vuln>

<vuln vid="02eedd3c-c6b5-11dc-93b6-000e35248ad7">
 <topic>libxine -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>libxine</name>
	<range><lt>1.1.9.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	xine project reports:
	<blockquote cite="http://xinehq.de/index.php/news">
	 A new xine-lib version is now available. This release contains
	 a security fix (remotely-expoitable buffer overflow, CVE-2008-0225).
	 It also contains a read-past-end fix for an internal library
	 function which is only used if the OS does not supply it and a
	 rendering fix for Darwin/PPC.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0225</cvename>
 <url>http://aluigi.altervista.org/adv/xinermffhof-adv.txt</url>
 <url>http://secunia.com/advisories/28384</url>
 </references>
 <dates>
 <discovery>2008-01-08</discovery>
 <entry>2008-01-19</entry>
 </dates>
 </vuln>

<vuln vid="60e1792b-c380-11dc-821a-000bcdc1757a">
 <topic>geeklog xss vulnerability</topic>
 <affects>
 <package>
	<name>geeklog</name>
	<range><lt>1.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Geeklog reports:
	<blockquote cite="http://www.geeklog.net/article.php/geeklog-1.4.0sr6">
	 MustLive pointed out a possible XSS in the form to email an
	 article to a friend that we're fixing with this release.
	 Please note that this problem only exists in Geeklog 1.4.0
	 - neither Geeklog 1.4.1 nor any older versions (1.3.x series)
	 have that problem.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-3756</cvename>
 <url>http://www.geeklog.net/article.php/geeklog-1.4.0sr6</url>
 </references>
 <dates>
 <discovery>2008-01-08</discovery>
 <entry>2008-01-15</entry>
 </dates>
 </vuln>

<vuln vid="4451a4c9-c05e-11dc-982e-001372fd0af2">
 <topic>drupal -- cross site request forgery</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.6</lt></range>
 </package>
 <package>
	<name>drupal4</name>
	<range><lt>4.7.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Project reports:
	<blockquote cite="http://drupal.org/node/208562">
	 The aggregator module fetches items from RSS feeds and makes
	 them available on the site. The module provides an option to
	 remove items from a particular feed. This has been implemented
	 as a simple GET request and is therefore vulnerable to cross
	 site request forgeries. For example: Should a privileged user
	 view a page containing an &lt;img&gt; tag with a specially
	 constructed src pointing to a remove items URL, the items would
	 be removed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0272</cvename>
 <url>http://drupal.org/node/208562</url>
 <url>http://secunia.com/advisories/28422/</url>
 </references>
 <dates>
 <discovery>2008-01-10</discovery>
 <entry>2008-01-11</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="6f736456-c060-11dc-982e-001372fd0af2">
 <topic>drupal -- cross site scripting (utf8)</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.6</lt></range>
 </package>
 <package>
	<name>drupal4</name>
	<range><lt>4.7.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Project reports:
	<blockquote cite="http://drupal.org/node/208564">
	 When outputting plaintext Drupal strips potentially dangerous
	 HTML tags and attributes from HTML, and escapes characters which
	 have a special meaning in HTML. This output filtering secures
	 the site against cross site scripting attacks via user input.
	 Certain byte sequences that are invalid in the UTF8
	 specification are not handled properly by Internet Explorer 6
	 and may lead it to see a multibyte start character where none is
	 present. Internet Explorer 6 then consumes a number of
	 subsequent UTF-8 characters. This may lead to unsafe attributes
	 that were outside a tag for the filter to appear inside a tag
	 for Internet Explorer 6. This behaviour can then be used to
	 insert and execute javascript in the context of the website.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0273</cvename>
 <url>http://drupal.org/node/208564</url>
 <url>http://secunia.com/advisories/28422/</url>
 </references>
 <dates>
 <discovery>2008-01-10</discovery>
 <entry>2008-01-11</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="f0fa19dd-c060-11dc-982e-001372fd0af2">
 <topic>drupal -- cross site scripting (register_globals)</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.6</lt></range>
 </package>
 <package>
	<name>drupal4</name>
	<range><lt>4.7.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Project reports:
	<blockquote cite="http://drupal.org/node/208565">
	 When theme .tpl.php files are accessible via the web and the PHP
	 setting register_globals is set to enabled, anonymous users are
	 able to execute cross site scripting attacks via specially
	 crafted links.
	 Drupal's .htaccess attempts to set register_globals to disabled
	 and also prevents access to .tpl.php files. Only when both these
	 measures are not effective and your PHP interpreter is
	 configured with register_globals set to enabled, will this issue
	 affect you.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0274</cvename>
 <url>http://drupal.org/node/208565</url>
 <url>http://secunia.com/advisories/28422/</url>
 </references>
 <dates>
 <discovery>2008-01-10</discovery>
 <entry>2008-01-11</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="f358de71-bf64-11dc-928b-0016179b2dd5">
 <topic>maradns -- CNAME record resource rotation denial of service</topic>
 <affects>
 <package>
	<name>maradns</name>
	<range><lt>1.2.12.08</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/28329">
	 A vulnerability has been reported in MaraDNS, which can be
	 exploited by malicious people to cause a Denial of Service.
	 The vulnerability is caused due to an error within the handling of
	 certain DNS packets. This can be exploited to cause a resource
	 rotation by sending specially crafted DNS packets, which cause an
	 authoritative CNAME record to not resolve, resulting in a Denial of
	 Sevices.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2008-0061</cvename>
 <url>http://maradns.blogspot.com/2007/08/maradns-update-all-versions.html</url>
 <url>http://secunia.com/advisories/28329</url>
 </references>
 <dates>
 <discovery>2008-01-04</discovery>
 <entry>2008-01-10</entry>
 </dates>
 </vuln>

<vuln vid="f762ccbb-baed-11dc-a302-000102cc8983">
 <topic>linux-realplayer -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-realplayer</name>
	<range><ge>10.0.5</ge><lt>10.0.9.809.20070726</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/27361">
	 Multiple vulnerabilities have been reported in
	 RealPlayer/RealOne/HelixPlayer, which can be exploited by malicious
	 people to compromise a user's system.
	 An input validation error when processing .RA/.RAM files can be
	 exploited to cause a heap corruption via a specially crafted
	 .RA/.RAM file with an overly large size field in the header.
	 An error in the processing of .PLS files can be exploited to cause
	 a memory corruption and execute arbitrary code via a specially
	 crafted .PLS file.
	 An input validation error when parsing .SWF files can be exploited
	 to cause a buffer overflow via a specially crafted .SWF file with
	 malformed record headers.
	 A boundary error when processing rm files can be exploited to
	 cause a buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-5081</cvename>
 <cvename>CVE-2007-3410</cvename>
 <cvename>CVE-2007-2263</cvename>
 <cvename>CVE-2007-2264</cvename>
 <url>http://secunia.com/advisories/27361</url>
 <url>http://service.real.com/realplayer/security/10252007_player/en/</url>
 <url>http://www.zerodayinitiative.com/advisories/ZDI-07-063.html</url>
 <url>http://www.zerodayinitiative.com/advisories/ZDI-07-062.html</url>
 <url>http://www.zerodayinitiative.com/advisories/ZDI-07-061.html</url>
 <url>http://secunia.com/advisories/25819/</url>
 <certvu>759385</certvu>
 </references>
 <dates>
 <discovery>2007-10-25</discovery>
 <entry>2008-01-04</entry>
 </dates>
 </vuln>

<vuln vid="562cf6c4-b9f1-11dc-a302-000102cc8983">
 <topic>linux-flashplugin -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><ge>9.0</ge><lt>9.0r115</lt></range>
	<range><ge>7.0</ge><lt>7.0r73</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe Security bulletin:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb07-20.html">
	 Critical vulnerabilities have been identified in Adobe Flash
	 Player that could allow an attacker who successfully exploits these
	 potential vulnerabilities to take control of the affected system. A
	 malicious SWF must be loaded in Flash Player by the user for an
	 attacker to exploit these potential vulnerabilities. Users are
	 recommended to update to the most current version of Flash Player
	 available for their platform.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6242</cvename>
 <cvename>CVE-2007-4768</cvename>
 <cvename>CVE-2007-5275</cvename>
 <cvename>CVE-2007-6243</cvename>
 <cvename>CVE-2007-6244</cvename>
 <cvename>CVE-2007-6245</cvename>
 <cvename>CVE-2007-4324</cvename>
 <cvename>CVE-2007-6246</cvename>
 <cvename>CVE-2007-5476</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb07-20.html</url>
 <url>http://secunia.com/advisories/28161/</url>
 </references>
 <dates>
 <discovery>2007-12-18</discovery>
 <entry>2008-01-03</entry>
 </dates>
 </vuln>

<vuln vid="cf484358-b5d6-11dc-8de0-001c2514716c">
 <topic>dovecot -- Specific LDAP + auth cache configuration may mix up user logins</topic>
 <affects>
 <package>
	<name>dovecot</name>
	<range><lt>1.0.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dovecot reports:
	<blockquote cite="http://www.dovecot.org/list/dovecot-news/2007-December/000057.html">
	 If two users with the same password and same pass_filter
	 variables log in within auth_cache_ttl seconds (1h by default),
	 the second user may get logged in with the first user's cached
	 pass_attrs. For example if pass_attrs contained the user's
	 home/mail directory, this would mean that the second user will
	 be accessing the first user's mails.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.dovecot.org/list/dovecot-news/2007-December/000057.html</url>
 </references>
 <dates>
 <discovery>2007-12-21</discovery>
 <entry>2007-12-29</entry>
 </dates>
 </vuln>

<vuln vid="4aab7bcd-b294-11dc-a6f0-00a0cce0781e">
 <topic>gallery2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gallery2</name>
	<range><lt>2.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gallery team reports:
	<blockquote cite="http://gallery.menalto.com/gallery_2.2.4_released">
	 Gallery 2.2.4 addresses the following security
	 vulnerabilities:
	 <ul>
	 <li>Publish XP module - Fixed unauthorized album creation
	 and file uploads.</li>
	 <li>URL rewrite module - Fixed local file inclusion
	 vulnerability in unsecured admin controller and
	 information disclosure in hotlink protection.</li>
	 <li>Core / add-item modules - Fixed Cross Site Scripting
	 (XSS) vulnerabilities through malicious file names.</li>
	 <li>Installation (Gallery application) - Update
	 web-accessibility protection of the storage folder for
	 Apache 2.2.</li>
	 <li>Core (Gallery application) / MIME module - Fixed
	 vulnerability in checks for disallowed file extensions
	 in file uploads.</li>
	 <li>Gallery Remote module - Added missing permissions
	 checks for some GR commands.</li>
	 <li>WebDAV module - Fixed Cross Site Scripting (XSS)
	 vulnerability through HTTP PROPPATCH.</li>
	 <li>WebDAV module - Fixed information (item data)
	 disclosure in a WebDAV view.</li>
	 <li>Comment module - Fixed information (item data)
	 disclosure in comment views.</li>
	 <li>Core module (Gallery application) - Improved
	 resilience against item information disclosure
	 attacks.</li>
	 <li>Slideshow module - Fixed information (item data)
	 disclosure in the slideshow.</li>
	 <li>Print modules - Fixed information (item data)
	 disclosure in several print modules.</li>
	 <li>Core / print modules - Fixed arbitrary URL redirection
	 (phishing attacks) in the core module and several print
	 modules.</li>
	 <li>WebCam module - Fixed proxied request weakness.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6685</cvename>
 <cvename>CVE-2007-6686</cvename>
 <cvename>CVE-2007-6687</cvename>
 <cvename>CVE-2007-6689</cvename>
 <cvename>CVE-2007-6690</cvename>
 <cvename>CVE-2007-6692</cvename>
 <url>http://gallery.menalto.com/gallery_2.2.4_released</url>
 </references>
 <dates>
 <discovery>2007-12-24</discovery>
 <entry>2007-12-25</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="299e3f81-aee7-11dc-b781-0016179b2dd5">
 <topic>e2fsprogs -- heap buffer overflow</topic>
 <affects>
 <package>
	<name>e2fsprogs</name>
	<range><lt>1.40.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Theodore Y. Ts'o reports:
	<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=2406&amp;release_id=560230">
	 Fix a potential security vulnerability where an untrusted
	 filesystem can be corrupted in such a way that a program using
	 libext2fs will allocate a buffer which is far too small. This
	 can lead to either a crash or potentially a heap-based buffer
	 overflow crash. No known exploits exist, but main concern is
	 where an untrusted user who possesses privileged access in a
	 guest Xen environment could corrupt a filesystem which is then
	 accessed by thus allowing the untrusted user to gain privileged
	 access in the host OS. Thanks to the McAfee AVERT Research group
	 for reporting this issue.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>26772</bid>
 <cvename>CVE-2007-5497</cvename>
 <url>http://secunia.com/advisories/27889/</url>
 <url>http://sourceforge.net/project/shownotes.php?group_id=2406&amp;release_id=560230</url>
 </references>
 <dates>
 <discovery>2007-12-07</discovery>
 <entry>2007-12-20</entry>
 </dates>
 </vuln>

<vuln vid="8a835235-ae84-11dc-a5f9-001a4d49522b">
 <topic>wireshark -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.8.16</ge><lt>0.99.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Wireshark team reports of multiple vulnerabilities:
	<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2007-03.html">
	 <ul>
	 <li>Wireshark could crash when reading an MP3 file.</li>
	 <li>Beyond Security discovered that Wireshark could loop
	 excessively while reading a malformed DNP packet.</li>
	 <li>Stefan Esser discovered a buffer overflow in the SSL
	 dissector.</li>
	 <li>The ANSI MAP dissector could be susceptible to a
	 buffer overflow on some platforms.</li>
	 <li>The Firebird/Interbase dissector could go into an
	 infinite loop or crash.</li>
	 <li>The NCP dissector could cause a crash.</li>
	 <li>The HTTP dissector could crash on some systems while
	 decoding chunked messages.</li>
	 <li>The MEGACO dissector could enter a large loop and
	 consume system resources.</li>
	 <li>The DCP ETSI dissector could enter a large loop and
	 consume system resources.</li>
	 <li>Fabiodds discovered a buffer overflow in the iSeries
	 (OS/400) Communication trace file parser.</li>
	 <li>The PPP dissector could overflow a buffer.</li>
	 <li>The Bluetooth SDP dissector could go into an infinite
	 loop.</li>
	 <li>A malformed RPC Portmap packet could cause a
	 crash.</li>
	 <li>The IPv6 dissector could loop excessively.</li>
	 <li>The USB dissector could loop excessively or crash.</li>
	 <li>The SMB dissector could crash.</li>
	 <li>The RPL dissector could go into an infinite loop.</li>
	 <li>The WiMAX dissector could crash due to unaligned
	 access on some platforms.</li>
	 <li>The CIP dissector could attempt to allocate a huge
	 amount of memory and crash.</li>
	 </ul>

<h2>Impact</h2>

It may be possible to make Wireshark or Ethereal crash or
	 use up available memory by injecting a purposefully
	 malformed packet onto the wire or by convincing someone to
	 read a malformed packet trace file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6112</cvename>
 <cvename>CVE-2007-6113</cvename>
 <cvename>CVE-2007-6114</cvename>
 <cvename>CVE-2007-6115</cvename>
 <cvename>CVE-2007-6117</cvename>
 <cvename>CVE-2007-6118</cvename>
 <cvename>CVE-2007-6120</cvename>
 <cvename>CVE-2007-6121</cvename>
 <cvename>CVE-2007-6438</cvename>
 <cvename>CVE-2007-6439</cvename>
 <cvename>CVE-2007-6441</cvename>
 <cvename>CVE-2007-6450</cvename>
 <cvename>CVE-2007-6451</cvename>
 <url>http://www.wireshark.org/security/wnpa-sec-2007-03.html</url>
 </references>
 <dates>
 <discovery>2007-12-19</discovery>
 <entry>2007-12-19</entry>
 <modified>2007-12-22</modified>
 </dates>
 </vuln>

<vuln vid="31b045e7-ae75-11dc-a5f9-001a4d49522b">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>9.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera Software ASA reports about multiple security
	 fixes:
	<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/925/">
	 <ul>
	 <li>Fixed an issue where plug-ins could be used to allow
	 cross domain scripting, as reported by David
	 Bloom. Details will be disclosed at a later date.</li>
	 <li>Fixed an issue with TLS certificates that could be
	 used to execute arbitrary code, as reported by Alexander
	 Klink (Cynops GmbH). Details will be disclosed at a
	 later date.</li>
	 <li>Rich text editing can no longer be used to allow cross
	 domain scripting, as reported by David Bloom. See our
	 advisory.</li>
	 <li>Prevented bitmaps from revealing random data from
	 memory, as reported by Gynvael Coldwind. Details will be
	 disclosed at a later date.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6520</cvename>
 <cvename>CVE-2007-6521</cvename>
 <cvename>CVE-2007-6522</cvename>
 <cvename>CVE-2007-6524</cvename>
 <url>http://www.opera.com/docs/changelogs/freebsd/925/</url>
 <url>http://www.opera.com/support/search/view/875/</url>
 </references>
 <dates>
 <discovery>2007-12-19</discovery>
 <entry>2007-12-19</entry>
 <modified>2007-12-29</modified>
 </dates>
 </vuln>

<vuln vid="31435fbc-ae73-11dc-a5f9-001a4d49522b">
 <topic>peercast -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>peercast</name>
	<range><lt>0.1218</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Luigi Auriemma reports that peercast is vulnerable to a
	 buffer overflow which could lead to a DoS or potentially
	 remote code execution:
	<blockquote cite="http://aluigi.altervista.org/adv/peercasthof-adv.txt">
	 The handshakeHTTP function which handles all the requests
	 received by the other clients is vulnerable to a heap
	 overflow which allows an attacker to fill the
	 loginPassword and loginMount buffers located in the
	 Servent class with how much data he wants.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6454</cvename>
 <url>http://aluigi.altervista.org/adv/peercasthof-adv.txt</url>
 <url>http://secunia.com/advisories/28120/</url>
 </references>
 <dates>
 <discovery>2007-12-17</discovery>
 <entry>2007-12-19</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="fee7e059-acec-11dc-807f-001b246e4fdf">
 <topic>ganglia-webfrontend -- XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>ganglia-webfrontend</name>
	<range><lt>3.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Ganglia project reports:
	<blockquote cite="http://ganglia.info/?p=60">
	 The Ganglia development team is pleased to release Ganglia
	 3.0.6 (Foss) which is available[...]. This release includes a
	 security fix for web frontend cross-scripting vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://sourceforge.net/mailarchive/message.php?msg_name=d4c731da0712101044l7245cba9l34974008879f47a3%40mail.gmail.com</url>
 <url>http://sourceforge.net/mailarchive/forum.php?thread_name=d4c731da0712101044l7245cba9l34974008879f47a3%40mail.gmail.com&amp;forum_name=ganglia-developers</url>
 </references>
 <dates>
 <discovery>2007-12-10</discovery>
 <entry>2007-12-17</entry>
 <modified>2007-12-18</modified>
 </dates>
 </vuln>

<vuln vid="30f5ca1d-a90b-11dc-bf13-0211060005df">
 <topic>qemu -- Translation Block Local Denial of Service Vulnerability</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>0.9.0_4</lt></range>
	<range><ge>0.9.0s.20070101*</ge><lt>0.9.0s.20070802_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/26666/discuss">
	 QEMU is prone to a local denial-of-service vulnerability
	 because it fails to perform adequate boundary checks when
	 handling user-supplied input.
	 Attackers can exploit this issue to cause denial-of-service
	 conditions. Given the nature of the issue, attackers may also be
	 able to execute arbitrary code, but this has not been confirmed.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>26666</bid>
 <cvename>CVE-2007-6227</cvename>
 <url>http://www.securityfocus.com/archive/1/484429</url>
 </references>
 <dates>
 <discovery>2007-11-30</discovery>
 <entry>2007-12-12</entry>
 <modified>2007-12-14</modified>
 </dates>
 </vuln>

<vuln vid="fa708908-a8c7-11dc-b41d-000fb5066b20">
 <topic>drupal -- SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.4</lt></range>
 </package>
 <package>
	<name>drupal4</name>
	<range><lt>4.7.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Project reports:
	<blockquote cite="http://drupal.org/node/198162">
	 The function taxonomy_select_nodes() directly injects variables
	 into SQL queries instead of using placeholders. While taxonomy
	 module itself validates the input passed to
	 taxonomy_select_nodes(), this is a weakness in Drupal core.
	 Several contributed modules, such as taxonomy_menu, ajaxLoader,
	 and ubrowser, directly pass user input to taxonomy_select_nodes(),
	 enabling SQL injection attacks by anonymous users.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6299</cvename>
 <url>http://drupal.org/node/198162</url>
 <url>http://secunia.com/advisories/27932/</url>
 </references>
 <dates>
 <discovery>2007-12-05</discovery>
 <entry>2007-12-12</entry>
 </dates>
 </vuln>

<vuln vid="ffcbd42d-a8c5-11dc-bec2-02e0185f8d72">
 <topic>samba -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>samba</name>
	<name>samba3</name>
	<name>ja-samba</name>
	<range><lt>3.0.28</lt></range>
	<range><gt>*,1</gt><lt>3.0.28,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secuna Research reports:
	<blockquote cite="http://secunia.com/advisories/27760/">
	 Secunia Research has discovered a vulnerability in Samba, which
	 can be exploited by malicious people to compromise a vulnerable
	 system. The vulnerability is caused due to a boundary error within
	 the "send_mailslot()" function. This can be exploited to cause a
	 stack-based buffer overflow with zero bytes via a specially crafted
	 "SAMLOGON" domain logon packet containing a username string placed
	 at an odd offset followed by an overly long GETDC string.
	 Successful exploitation allows execution of arbitrary code, but
	 requires that the "domain logons" option is enabled.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6015</cvename>
 <url>http://secunia.com/advisories/27760/</url>
 </references>
 <dates>
 <discovery>2007-12-10</discovery>
 <entry>2007-12-12</entry>
 <modified>2008-09-26</modified>
 </dates>
 </vuln>

<vuln vid="b2571f88-a867-11dc-a6f0-00a0cce0781e">
 <topic>smbftpd -- format string vulnerability</topic>
 <affects>
 <package>
	<name>smbftpd</name>
	<range><lt>0.96</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/27014/">
	 Format string vulnerability in the SMBDirList function in dirlist.c
	 in SmbFTPD 0.96 allows remote attackers to execute arbitrary code
	 via format string specifiers in a directory name.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-5184</cvename>
 <url>http://secunia.com/advisories/27014/</url>
 <url>http://sourceforge.net/project/shownotes.php?release_id=543077</url>
 </references>
 <dates>
 <discovery>2007-10-01</discovery>
 <entry>2007-12-12</entry>
 </dates>
 </vuln>

<vuln vid="6ae7cef2-a6ae-11dc-95e6-000c29c5647f">
 <topic>jetty -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>jetty</name>
	<range><lt>6.1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5613">
	 Cross-site scripting (XSS) vulnerability in Dump Servlet in
	 Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject
	 arbitrary web script or HTML via unspecified parameters and
	 cookies.
	</blockquote>
	<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5614">
	 Mortbay Jetty before 6.1.6rc1 does not properly handle "certain
	 quote sequences" in HTML cookie parameters, which allows remote
	 attackers to hijack browser sessions via unspecified vectors.
	</blockquote>
	<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5615">
	 CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0
	 allows remote attackers to inject arbitrary HTTP headers and
	 conduct HTTP response splitting attacks via unspecified vectors.
	 
	</blockquote>
 </body>
 </description>
 <references>
 <certvu>237888</certvu>
 <certvu>212984</certvu>
 <certvu>438616</certvu>
 <cvename>CVE-2007-5613</cvename>
 <cvename>CVE-2007-5614</cvename>
 <cvename>CVE-2007-5615</cvename>
 <url>http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt</url>
 </references>
 <dates>
 <discovery>2007-12-05</discovery>
 <entry>2007-12-10</entry>
 </dates>
 </vuln>

<vuln vid="821afaa2-9e9a-11dc-a7e3-0016360406fa">
 <topic>liveMedia -- DoS vulnerability</topic>
 <affects>
 <package>
	<name>liveMedia</name>
	<range><lt>2007.11.18,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The live555 development team reports:
	<blockquote cite="http://www.live555.com/liveMedia/public/changelog.txt">
	 Fixed a bounds-checking error in "parseRTSPRequestString()"
	 caused by an int vs. unsigned problem.
	</blockquote>
	<blockquote cite="http://aluigi.altervista.org/adv/live555x-adv.txt">
	 The function which handles the incoming queries from the
	 clients is affected by a vulnerability which allows an attacker
	 to crash the server remotely using the smallest RTSP query
	 possible to use.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6036</cvename>
 <url>http://aluigi.altervista.org/adv/live555x-adv.txt</url>
 <url>http://www.live555.com/liveMedia/public/changelog.txt</url>
 </references>
 <dates>
 <discovery>2007-11-20</discovery>
 <entry>2007-12-08</entry>
 <modified>2007-12-09</modified>
 </dates>
 </vuln>

<vuln vid="610bc692-a2ad-11dc-900c-000bcdc1757a">
 <topic>GNU finger vulnerability</topic>
 <affects>
 <package>
	<name>gnu-finger</name>
	<range><le>1.37_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GNU security announcement:
	<blockquote cite="http://www.gnu.org/software/finger/">
	 GNU Finger unfortunately has not been updated in
	 many years, and has known security vulnerabilities.
	 Please do not use it in production environments.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-1999-1165</cvename>
 <url>http://www.gnu.org/software/finger/</url>
 </references>
 <dates>
 <discovery>1999-07-21</discovery>
 <entry>2007-12-05</entry>
 </dates>
 </vuln>

<vuln vid="6eb580d7-a29c-11dc-8919-001c2514716c">
 <topic>Squid -- Denial of Service Vulnerability</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><ge>2.0</ge><lt>2.6.16_1</lt></range>
	<range><ge>3.*</ge><lt>3.0.r1.20071001_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid secuirty advisory reports:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2007_2.txt">
	 Due to incorrect bounds checking Squid is vulnerable
	 to a denial of service check during some cache update
	 reply processing.
	 This problem allows any client trusted to use the
	 service to perform a denial of service attack on the
	 Squid service.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>26687</bid>
 <cvename>CVE-2007-6239</cvename>
 </references>
 <dates>
 <discovery>2007-11-28</discovery>
 <entry>2007-12-04</entry>
 <modified>2007-12-07</modified>
 </dates>
 </vuln>

<vuln vid="30acb8ae-9d46-11dc-9114-001c2514716c">
 <topic>rubygem-rails -- session-fixation vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-rails</name>
	<range><lt>1.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Rails core team reports:
	<blockquote cite="http://weblog.rubyonrails.com/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release">
	 The rails core team has released ruby on rails 1.2.6 to
	 address a bug in the fix for session fixation attacks
	 (CVE-2007-5380). The CVE Identifier for this new issue
	 is CVE-2007-6077.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6077</cvename>
 </references>
 <dates>
 <discovery>2007-11-24</discovery>
 <entry>2007-11-27</entry>
 </dates>
 </vuln>

<vuln vid="44fb0302-9d38-11dc-9114-001c2514716c">
 <topic>rubygem-rails -- JSON XSS vulnerability</topic>
 <affects>
 <package>
	<name>rubygem-rails</name>
	<range><lt>1.2.5</lt></range>
 </package>
 <package>
	<name>rubygem-activesupport</name>
	<range><lt>1.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Rails core team reports:
	<blockquote cite="http://weblog.rubyonrails.org/2007/10/12/rails-1-2-5-maintenance-release">
	 All users of Rails 1.2.4 or earlier are advised to upgrade
	 to 1.2.5, though it isn't strictly necessary if you
	 aren't working with JSON. For more information the JSON
	 vulnerability, see CVE-2007-3227.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3227</cvename>
 </references>
 <dates>
 <discovery>2007-10-12</discovery>
 <entry>2007-11-28</entry>
 <modified>2007-12-01</modified>
 </dates>
 </vuln>

<vuln vid="31d9fbb4-9d09-11dc-a29d-0016d325a0ed">
 <topic>ikiwiki -- improper symlink verification vulnerability</topic>
 <affects>
 <package>
	<name>ikiwiki</name>
	<range><lt>2.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The ikiwiki development team reports:
	<blockquote cite="http://ikiwiki.info/security/#index29h2">
	 Ikiwiki did not check if path to the srcdir to contained a
	 symlink. If an attacker had commit access to the directories in
	 the path, they could change it to a symlink, causing ikiwiki to
	 read and publish files that were not intended to be
	 published. (But not write to them due to other checks.)
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://ikiwiki.info/security/#index29h2</url>
 </references>
 <dates>
 <discovery>2007-11-26</discovery>
 <entry>2007-11-27</entry>
 </dates>
 </vuln>

<vuln vid="f1f6f6da-9d2f-11dc-9114-001c2514716c">
 <topic>firefox -- multiple remote unspecified memory corruption vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>2.0.0.10,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>2.0.0.10</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.7</lt></range>
 </package>
 <package>
	<name>flock</name>
	<name>linux-flock</name>
	<range><lt>1.0.2</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.a2007.12.12</lt></range>
 </package>
 <package>
	<name>linux-seamonkey-devel</name>
	<range><lt>2.0.a2007.12.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla Foundation reports:
	<blockquote cite="http://www.mozilla.org/security/announce/2007/mfsa2007-38.html">
	 The Firefox 2.0.0.10 update contains fixes for three bugs that
	 improve the stability of the product. These crashes showed some
	 evidence of memory corruption under certain circumstances and we
	 presume that with enough effort at least some of these could be
	 exploited to run arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>26593</bid>
 <cvename>CVE-2007-5959</cvename>
 </references>
 <dates>
 <discovery>2007-11-26</discovery>
 <entry>2007-11-27</entry>
 <modified>2007-12-14</modified>
 </dates>
 </vuln>

<vuln vid="15485ae8-9848-11dc-9e48-0016179b2dd5">
 <topic>phpmyadmin -- Cross Site Scripting</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<range><lt>2.11.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpMyAdmin security announcement:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8">
	 The login page auth_type cookie was vulnerable to XSS via
	 the convcharset parameter. An attacker could use this to
	 execute malicious code on the visitors computer
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-6100</cvename>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8</url>
 <url>http://www.nth-dimension.org.uk/downloads.php?id=38</url>
 </references>
 <dates>
 <discovery>2007-11-20</discovery>
 <entry>2007-11-21</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="a63b15f9-97ff-11dc-9e48-0016179b2dd5">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba</name>
	<name>samba3</name>
	<name>ja-samba</name>
	<range><lt>3.0.26a</lt></range>
	<range><gt>*,1</gt><lt>3.0.26a_2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="http://us1.samba.org/samba/security/CVE-2007-5398.html">
	 Secunia Research reported a vulnerability that allows for
	 the execution of arbitrary code in nmbd. This defect may
	 only be exploited when the "wins support" parameter has
	 been enabled in smb.conf.
	</blockquote>
	<blockquote cite="http://us1.samba.org/samba/security/CVE-2007-4572.html">
	 Samba developers have discovered what is believed to be
	 a non-exploitable buffer over in nmbd during the processing
	 of GETDC logon server requests. This code is only used
	 when the Samba server is configured as a Primary or Backup
	 Domain Controller.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>26454</bid>
 <cvename>CVE-2007-4572</cvename>
 <cvename>CVE-2007-5398</cvename>
 <url>http://secunia.com/advisories/27450/</url>
 <url>http://us1.samba.org/samba/security/CVE-2007-4572.html</url>
 <url>http://us1.samba.org/samba/security/CVE-2007-5398.html</url>
 </references>
 <dates>
 <discovery>2007-11-15</discovery>
 <entry>2007-11-21</entry>
 <modified>2008-09-26</modified>
 </dates>
 </vuln>

<vuln vid="392b5b1d-9471-11dc-9db7-001c2514716c">
 <topic>php -- multiple security vulnerabilities</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.2.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PHP project reports:
	<blockquote cite="http://www.php.net/releases/5_2_5.php">
	 Security Enhancements and Fixes in PHP 5.2.5:
	 <ul>
	 <li>Fixed dl() to only accept filenames. Reported by Laurent
	 Gaffie.</li>
	 <li>Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
	 Reported by Laurent Gaffie.</li>
	 <li>Fixed htmlentities/htmlspecialchars not to accept partial
	 multibyte sequences. Reported by Rasmus Lerdorf</li>
	 <li>Fixed possible triggering of buffer overflows inside glibc
	 implementations of the fnmatch(), setlocale() and glob()
	 functions. Reported by Laurent Gaffie.</li>
	 <li>Fixed "mail.force_extra_parameters" php.ini directive not to be
	 modifiable in .htaccess due to the security implications. Reported
	 by SecurityReason.</li>
	 <li>Fixed bug #42869 (automatic session id insertion adds sessions
	 id to non-local forms).</li>
	 <li>Fixed bug #41561 (Values set with php_admin_* in httpd.conf can
	 be overwritten with ini_set()).</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>26403</bid>
 <cvename>CVE-2007-4887</cvename>
 </references>
 <dates>
 <discovery>2007-11-08</discovery>
 <entry>2007-11-16</entry>
 </dates>
 </vuln>

<vuln vid="a7080c30-91a2-11dc-b2eb-00b0d07e6c7e">
 <topic>mt-daapd -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>mt-daapd</name>
	<range><lt>0.2.4.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	US-CERT reports:
	<blockquote cite="http://www.us-cert.gov/cas/bulletins/SB07-316.html">
	 webserver.c in mt-dappd in Firefly Media Server 0.2.4 and
	 earlier allows remote attackers to cause a denial of service
	 (NULL dereference and daemon crash) via a stats method action
	 to /xml-rpc with (1) an empty Authorization header line, which
	 triggers a crash in the ws_decodepassword function; or (2) a
	 header line without a ':' character, which triggers a crash
	 in the ws_getheaders function.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-5824</cvename>
 </references>
 <dates>
 <discovery>2007-11-05</discovery>
 <entry>2007-11-12</entry>
 </dates>
 </vuln>

<vuln vid="92f86b93-923f-11dc-a2bf-02e081235dab">
 <topic>net-snmp -- denial of service via GETBULK request</topic>
 <affects>
 <package>
	<name>net-snmp</name>
	<range><lt>5.3.1_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5846">
	 The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1
	 allows remote attackers to cause a denial of service (CPU
	 and memory consumption) via a GETBULK request with a large
	 max-repeaters value.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-5846</cvename>
 </references>
 <dates>
 <discovery>2007-11-06</discovery>
 <entry>2007-11-13</entry>
 <modified>2007-11-14</modified>
 </dates>
 </vuln>

<vuln vid="ff65eecb-91e4-11dc-bd6c-0016179b2dd5">
 <topic>flac -- media file processing integer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>flac</name>
	<range><lt>1.1.2_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	iDefense Laps reports:
	<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608">
	 Remote exploitation of multiple integer overflow vulnerabilities
	 in libFLAC, as included with various vendor's software
	 distributions, allows attackers to execute arbitrary code
	 in the context of the currently logged in user.
	 These vulnerabilities specifically exist in the handling of
	 malformed FLAC media files. In each case, an integer overflow can
	 occur while calculating the amount of memory to allocate. As such,
	 insufficient memory is allocated for the data that is subsequently
	 read in from the file, and a heap based buffer overflow occurs.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-4619</cvename>
 <url>http://secunia.com/advisories/27210/</url>
 <url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608</url>
 </references>
 <dates>
 <discovery>2007-10-11</discovery>
 <entry>2007-11-13</entry>
 </dates>
 </vuln>

<vuln vid="2747fc39-915b-11dc-9239-001c2514716c">
 <topic>xpdf -- multiple remote Stream.CC vulnerabilities</topic>
 <affects>
 <package>
	<name>cups-base</name>
	<range><lt>1.3.3_2</lt></range>
 </package>
 <package>
	<name>gpdf</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>kdegraphics</name>
	<range><lt>3.5.8_1</lt></range>
 </package>
 <package>
	<name>koffice</name>
	<range><lt>1.6.3_3,2</lt></range>
 </package>
 <package>
	<name>poppler</name>
	<range><lt>0.6</lt></range>
 </package>
 <package>
	<name>xpdf</name>
	<range><lt>3.02_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia Research reports:
	<blockquote cite="http://www.securityfocus.com/archive/1/483372">
	 Secunia Research has discovered some vulnerabilities in Xpdf,
	 which can be exploited by malicious people to compromise a user's
	 system.
	 <ul>
	 <li>An array indexing error within the
	 "DCTStream::readProgressiveDataUnit()" method in xpdf/Stream.cc
	 can be exploited to corrupt memory via a specially crafted PDF
	 file.</li>
	 <li>An integer overflow error within the "DCTStream::reset()"
	 method in xpdf/Stream.cc can be exploited to cause a heap-based
	 buffer overflow via a specially crafted PDF file.</li>
	 <li>A boundary error within the "CCITTFaxStream::lookChar()" method
	 in xpdf/Stream.cc can be exploited to cause a heap-based buffer
	 overflow by tricking a user into opening a PDF file containing a
	 specially crafted "CCITTFaxDecode" filter.</li>
	 </ul>
	 Successful exploitation may allow execution of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>26367</bid>
 <cvename>CVE-2007-4352</cvename>
 <cvename>CVE-2007-5392</cvename>
 <cvename>CVE-2007-5393</cvename>
 </references>
 <dates>
 <discovery>2007-11-07</discovery>
 <entry>2007-11-12</entry>
 <modified>2007-11-14</modified>
 </dates>
 </vuln>

<vuln vid="ffba6ab0-90b5-11dc-9835-003048705d5a">
 <topic>plone -- unsafe data interpreted as pickles</topic>
 <affects>
 <package>
	<name>plone</name>
	<range><ge>2.5</ge><lt>2.5.5</lt></range>
	<range><ge>3.0</ge><lt>3.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Plone projectreports:
	<blockquote cite="http://plone.org/about/security/advisories/cve-2007-5741">
	 This hotfix corrects a vulnerability in the statusmessages
	 and linkintegrity modules, where unsafe network data was
	 interpreted as python pickles. This allows an attacker to
	 run arbitrary python code within the Zope/Plone process.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>26354</bid>
 <cvename>CVE-2007-5741</cvename>
 </references>
 <dates>
 <discovery>2007-11-06</discovery>
 <entry>2007-11-12</entry>
 </dates>
 </vuln>

<vuln vid="2d2dcbb4-906c-11dc-a951-0016179b2dd5">
 <topic>phpmyadmin -- cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The DigiTrust Group reports:
	<blockquote cite="http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html">
	 When creating a new database, a malicious user can use a
	 client-side Web proxy to place malicious code in the db parameter of
	 the POST request. Since db_create.php does not properly sanitize
	 user-supplied input, an administrator could face a persistent XSS
	 attack when the database names are displayed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-5976</cvename>
 <cvename>CVE-2007-5977</cvename>
 <url>http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html</url>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7</url>
 </references>
 <dates>
 <discovery>2007-11-11</discovery>
 <entry>2007-11-11</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="9b718b82-8ef5-11dc-8e42-001c2514716c">
 <topic>gallery2 -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gallery2</name>
	<range><lt>2.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gallery project reports:
	<blockquote cite="http://gallery.menalto.com/gallery_2.2.3_released">
	 Gallery 2.2.3 addresses the following security vulnerabilities:
	 <ul>
	 <li>Unauthorized renaming of items possible with WebDAV (reported
	 by Merrick Manalastas)</li>
	 <li>Unauthorized modification and retrieval of item properties
	 possible with WebDAV</li>
	 <li>Unauthorized locking and replacing of items possible with
	 WebDAV</li>
	 <li>Unauthorized editing of data file possible via linked items with
	 Reupload and WebDAV (reported by Nicklous Roberts)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-4650</cvename>
 <bid>25580</bid>
 </references>
 <dates>
 <discovery>2007-08-29</discovery>
 <entry>2007-11-09</entry>
 </dates>
 </vuln>

<vuln vid="20a4eb11-8ea3-11dc-a396-0016179b2dd5">
 <topic>tikiwiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>tikiwik</name>
	<range><lt>1.9.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/26618/">
	 Some vulnerabilities have been reported in TikiWiki, which
	 can be exploited by malicious people to conduct cross-site
	 scripting and script insertion attacks and disclose potentially
	 sensitive information.
	 Input passed to the username parameter in tiki-remind_password.php
	 (when remind is set to send me my password) is not properly
	 sanitised before being returned to the user. This can be exploited
	 to execute arbitrary HTML and script code (for example with meta
	 refreshes to a javascript: URL) in a user's browser session in
	 context of an affected site.
	 Input passed to the local_php and error_handler parameters in
	 tiki-index.php is not properly verified before being used to include
	 files. This can be exploited to include arbitrary files from local
	 resources.
	 Input passed to the imp_language parameter in
	 tiki-imexport_languages.php is not properly verified before being
	 used to include files. This can be exploited to include arbitrary
	 files from local resources.
	 Certain img src elements are not properly santised before being
	 used. This can be exploited to insert arbitrary HTML and script
	 code, which is executed in a user's browser session in context of an
	 affected site when the malicious data is viewed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-4554</cvename>
 <cvename>CVE-2007-5683</cvename>
 <cvename>CVE-2007-5684</cvename>
 <url>http://secunia.com/advisories/26618/</url>
 <url>http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?view=markup&amp;pathrev=REL-1-9-8-2</url>
 </references>
 <dates>
 <discovery>2007-08-27</discovery>
 <entry>2007-11-09</entry>
 <modified>2008-10-03</modified>
 </dates>
 </vuln>

<vuln vid="8dd9722c-8e97-11dc-b8f6-001c2514716c">
 <topic>cups -- off-by-one buffer overflow</topic>
 <affects>
 <package>
	<name>cups-base</name>
	<range><lt>1.3.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/27233">
	 Secunia Research has discovered a vulnerability in CUPS, which can
	 be exploited by malicious people to compromise a vulnerable
	 system.
	 The vulnerability is caused due to a boundary error within the
	 "ippReadIO()" function in cups/ipp.c when processing IPP (Internet
	 Printing Protocol) tags. This can be exploited to overwrite one
	 byte on the stack with a zero by sending an IPP request containing
	 specially crafted "textWithLanguage" or "nameWithLanguage" tags.
	 Successful exploitation allows execution of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-4351</cvename>
 <url>http://secunia.com/secunia_research/2007-76/</url>
 </references>
 <dates>
 <discovery>2007-11-06</discovery>
 <entry>2007-11-09</entry>
 <modified>2007-11-12</modified>
 </dates>
 </vuln>

<vuln vid="5b47c279-8cb5-11dc-8878-0016179b2dd5">
 <topic>perl -- regular expressions unicode data buffer overflow</topic>
 <affects>
 <package>
	<name>perl</name>
	<name>perl-threaded</name>
	<range><gt>5.8.*</gt><lt>5.8.8_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Red Hat reports:
	<blockquote cite="https://rhn.redhat.com/errata/RHSA-2007-0966.html">
	 A flaw was found in Perl's regular expression engine. Specially
	 crafted input to a regular expression can cause Perl to improperly
	 allocate memory, possibly resulting in arbitrary code running with
	 the permissions of the user running Perl.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-5116</cvename>
 <url>http://secunia.com/advisories/27546/</url>
 </references>
 <dates>
 <discovery>2007-11-05</discovery>
 <entry>2007-11-06</entry>
 <modified>2007-11-07</modified>
 </dates>
 </vuln>

<vuln vid="bfd6eef4-8c94-11dc-8c55-001c2514716c">
 <topic>pcre -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>pcre</name>
	<name>pcre-utf8</name>
	<range><lt>7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian project reports:
	<blockquote cite="http://www.debian.org/security/2007/dsa-1399">
	 Tavis Ormandy of the Google Security Team has discovered
	 several security issues in PCRE, the Perl-Compatible Regular
	 Expression library, which potentially allow attackers to
	 execute arbitrary code by compiling specially crafted regular
	 expressions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1659</cvename>
 <cvename>CVE-2007-1660</cvename>
 <cvename>CVE-2007-1661</cvename>
 <cvename>CVE-2007-1662</cvename>
 <cvename>CVE-2007-4766</cvename>
 <cvename>CVE-2007-4767</cvename>
 <cvename>CVE-2007-4768</cvename>
 <url>http://www.pcre.org/changelog.txt</url>
 </references>
 <dates>
 <discovery>2007-11-05</discovery>
 <entry>2007-11-06</entry>
 </dates>
 </vuln>

<vuln vid="617a4021-8bf0-11dc-bffa-0016179b2dd5">
 <topic>perdition -- str_vwrite format string vulnerability</topic>
 <affects>
 <package>
	<name>perdition</name>
	<range><lt>1.17.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SEC-Consult reports:
	<blockquote cite="http://www.sec-consult.com/300.html">
	 Perdition IMAP is affected by a format string bug in one of its
	 IMAP output-string formatting functions. The bug allows the
	 execution of arbitrary code on the affected server.
	 A successful exploit does not require prior authentication.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>26270</bid>
 <cvename>CVE-2007-5740</cvename>
 <url>http://www.sec-consult.com/300.html</url>
 <url>http://secunia.com/advisories/27458</url>
 </references>
 <dates>
 <discovery>2007-10-31</discovery>
 <entry>2007-11-05</entry>
 </dates>
 </vuln>

<vuln vid="f8b0f83c-8bb3-11dc-bffa-0016179b2dd5">
 <topic>gftp -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gftp</name>
	<range><lt>2.0.18_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gentoo reports:
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200711-01.xml">
	 Kalle Olavi Niemitalo discovered two boundary errors in fsplib code
	 included in gFTP when processing overly long directory or file
	 names.
	 A remote attacker could trigger these vulnerabilities by enticing
	 a user to download a file with a specially crafted directory or file
	 name, possibly resulting in the execution of arbitrary code or a
	 Denial of Service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3961</cvename>
 <cvename>CVE-2007-3962</cvename>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200711-01.xml</url>
 </references>
 <dates>
 <discovery>2007-11-01</discovery>
 <entry>2007-11-05</entry>
 <modified>2007-11-11</modified>
 </dates>
 </vuln>

<vuln vid="a1ef3fc0-8ad0-11dc-9490-0016179b2dd5">
 <topic>dircproxy -- remote denial of service</topic>
 <affects>
 <package>
	<name>dircproxy</name>
	<range><lt>1.0.5_1</lt></range>
 </package>
 <package>
	<name>dircproxy-devel</name>
	<range><lt>1.2.0.b2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Securiweb reports:
	<blockquote cite="http://dircproxy.securiweb.net/ticket/89">
	 dircproxy allows remote attackers to cause a denial of
	 service (segmentation fault) via an ACTION command without a
	 parameter, which triggers a NULL pointer dereference, as
	 demonstrated using a blank /me message from irssi.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-5226</cvename>
 <url>http://dircproxy.securiweb.net/ticket/89</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=319301</url>
 </references>
 <dates>
 <discovery>2006-09-06</discovery>
 <entry>2007-11-04</entry>
 <modified>2008-01-31</modified>
 </dates>
 </vuln>

<vuln vid="a467d0f9-8875-11dc-b3ba-0016179b2dd5">
 <topic>wordpress -- cross-site scripting</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>de-wordpress</name>
	<range><lt>2.3.1</lt></range>
 </package>
 <package>
	<name>zh-wordpress</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory report:
	<blockquote cite="http://secunia.com/advisories/27407">
	 Input passed to the "posts_columns" parameter in
	 wp-admin/edit-post-rows.php is not properly sanitised before
	 being returned to the user. This can be exploited to execute
	 arbitrary HTML and script code in a user's browser session in
	 context of an affected site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-5710</cvename>
 <url>http://secunia.com/advisories/27407</url>
 <url>http://wordpress.org/development/2007/10/wordpress-231/</url>
 </references>
 <dates>
 <discovery>2007-10-29</discovery>
 <entry>2007-11-01</entry>
 </dates>
 </vuln>

<vuln vid="db449245-870d-11dc-a3ec-001921ab2fa4">
 <topic>openldap -- multiple remote denial of service vulnerabilities</topic>
 <affects>
 <package>
	<name>openldap-server</name>
	<range><lt>2.3.39</lt></range>
	<range><gt>2.4.0</gt><lt>2.4.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	BugTraq reports:
	<blockquote cite="http://www.securityfocus.com/bid/26245/">
	 OpenLDAP is prone to multiple remote denial-of-service
	 vulnerabilities because of an incorrect NULL-termination
	 issue and a double-free issue.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>26245</bid>
 <cvename>CVE-2007-5707</cvename>
 <cvename>CVE-2007-5708</cvename>
 </references>
 <dates>
 <discovery>2007-10-29</discovery>
 <entry>2007-10-30</entry>
 <modified>2007-10-31</modified>
 </dates>
 </vuln>

<vuln vid="d2c2952d-85a1-11dc-bfff-003048705d5a">
 <topic>py-django -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>py23-django</name>
	<name>py24-django</name>
	<name>py25-django</name>
	<range><lt>0.96.1</lt></range>
 </package>
 <package>
	<name>py23-django-devel</name>
	<name>py24-django-devel</name>
	<name>py25-django-devel</name>
	<range><lt>20071026</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Django project reports:
	<blockquote cite="http://www.djangoproject.com/weblog/2007/oct/26/security-fix/">
	 A per-process cache used by Django's internationalization
	 ("i18n") system to store the results of translation lookups
	 for particular values of the HTTP Accept-Language header
	 used the full value of that header as a key. An attacker
	 could take advantage of this by sending repeated requests
	 with extremely large strings in the Accept-Language header,
	 potentially causing a denial of service by filling available
	 memory.
	 Due to limitations imposed by Web server software on the
	 size of HTTP header fields, combined with reasonable limits
	 on the number of requests which may be handled by a single
	 server process over its lifetime, this vulnerability may be
	 difficult to exploit. Additionally, it is only present when
	 the "USE_I18N" setting in Django is "True" and the i18n
	 middleware component is enabled*. Nonetheless, all users of
	 affected versions of Django are encouraged to update.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.djangoproject.com/weblog/2007/oct/26/security-fix/</url>
 </references>
 <dates>
 <discovery>2007-10-26</discovery>
 <entry>2007-10-27</entry>
 </dates>
 </vuln>

<vuln vid="44224e08-8306-11dc-9283-0016179b2dd5">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>9.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An advisory from Opera reports:
	<blockquote cite="http://www.opera.com/support/search/view/866/">
	 If a user has configured Opera to use an external newsgroup
	 client or e-mail application, specially crafted Web pages can
	 cause Opera to run that application incorrectly. In some cases
	 this can lead to execution of arbitrary code.
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/867/">
	 When accesing frames from different Web sites, specially crafted
	 scripts can bypass the same-origin policy, and overwrite functions
	 from those frames. If scripts on the page then run those functions,
	 this can cause the script of the attacker's choice to run in the
	 context of the target Web site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-5540</cvename>
 <cvename>CVE-2007-5541</cvename>
 <url>http://www.opera.com/support/search/view/866/</url>
 <url>http://www.opera.com/support/search/view/867/</url>
 <url>http://secunia.com/advisories/27277/</url>
 </references>
 <dates>
 <discovery>2007-10-17</discovery>
 <entry>2007-10-25</entry>
 </dates>
 </vuln>

<vuln vid="9c00d446-8208-11dc-9283-0016179b2dd5">
 <topic>drupal --- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal4</name>
	<range><lt>4.7.8</lt></range>
 </package>
 <package>
	<name>drupal5</name>
	<range><lt>5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Project reports:
	<blockquote cite="http://drupal.org/node/184315">
	 In some circumstances Drupal allows user-supplied data to
	 become part of response headers. As this user-supplied data
	 is not always properly escaped, this can be exploited by
	 malicious users to execute HTTP response splitting attacks
	 which may lead to a variety of issues, among them cache
	 poisoning, cross-user defacement and injection of arbitrary
	 code.
	</blockquote>
	<blockquote cite="http://drupal.org/node/184316">
	 The Drupal installer allows any visitor to provide credentials
	 for a database when the site's own database is not reachable. This
	 allows attackers to run arbitrary code on the site's server.
	 An immediate workaround is the removal of the file install.php
	 in the Drupal root directory.
	</blockquote>
	<blockquote cite="http://drupal.org/node/184320">
	 The allowed extension list of the core Upload module contains
	 the extension HTML by default. Such files can be used to execute
	 arbitrary script code in the context of the affected site when a
	 user views the file. Revoking upload permissions or removing the
	 .html extension from the allowed extension list will stop uploads
	 of malicious files. but will do nothing to protect your site
	 againstfiles that are already present. Carefully inspect the file
	 system path for any HTML files. We recommend you remove any HTML
	 file you did not update yourself. You should look for , CSS
	 includes, Javascript includes, and onerror="" attributes if
	 you need to review files individually.
	</blockquote>
	<blockquote cite="http://drupal.org/node/184348">
	 The Drupal Forms API protects against cross site request
	 forgeries (CSRF), where a malicious site can cause a user
	 to unintentionally submit a form to a site where he is
	 authenticated. The user deletion form does not follow the
	 standard Forms API submission model and is therefore not
	 protected against this type of attack. A CSRF attack may
	 result in the deletion of users.
	</blockquote>
	<blockquote cite="http://drupal.org/node/184354">
	 The publication status of comments is not passed during the
	 hook_comments API operation, causing various modules that rely
	 on the publication status (such as Organic groups, or Subscriptions)
	 to mail out unpublished comments.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-5597</cvename>
 <cvename>CVE-2007-5596</cvename>
 <cvename>CVE-2007-5595</cvename>
 <cvename>CVE-2007-5594</cvename>
 <cvename>CVE-2007-5593</cvename>
 <url>http://drupal.org/node/184315</url>
 <url>http://drupal.org/node/184316</url>
 <url>http://drupal.org/node/184348</url>
 <url>http://drupal.org/node/184354</url>
 <url>http://drupal.org/node/184320</url>
 <url>http://secunia.com/advisories/27292</url>
 <url>http://secunia.com/advisories/27292</url>
 <url>http://secunia.com/advisories/27292</url>
 <url>http://secunia.com/advisories/27290</url>
 <url>http://secunia.com/advisories/27290</url>
 </references>
 <dates>
 <discovery>2007-10-17</discovery>
 <entry>2007-10-24</entry>
 </dates>
 </vuln>

<vuln vid="3a81017a-8154-11dc-9283-0016179b2dd5">
 <topic>ldapscripts -- Command Line User Credentials Disclosure</topic>
 <affects>
 <package>
	<name>ldapscripts</name>
	<range><lt>1.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ganael Laplanche reports:
	<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=156483&amp;release_id=546600">
	 Up to now, each ldap* command was called with the -w parameter,
	 which allows to specify the bind password on the command line.
	 Unfortunately, this could make the password appear to anybody
	 performing a `ps` during the call. This is now avoided by using
	 the -y parameter and a password file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://sourceforge.net/project/shownotes.php?group_id=156483&amp;release_id=546600</url>
 <url>http://secunia.com/advisories/27111</url>
 <cvename>CVE-2007-5373</cvename>
 </references>
 <dates>
 <discovery>2007-10-09</discovery>
 <entry>2007-10-23</entry>
 </dates>
 </vuln>

<vuln vid="e24797af-803d-11dc-b787-003048705d5a">
 <topic>firefox -- OnUnload Javascript browser entrapment vulnerability</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>2.0.0.8,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>2.0.0.8</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RedHat reports:
	<blockquote cite="https://rhn.redhat.com/errata/RHSA-2007-0979.html">
	 Several flaws were found in the way in which Firefox
	 displayed malformed web content. A web page containing
	 specially-crafted content could potentially trick a user
	 into surrendering sensitive information. (CVE-2007-1095,
	 CVE-2007-3844, CVE-2007-3511, CVE-2007-5334)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1095</cvename>
 </references>
 <dates>
 <discovery>2007-10-19</discovery>
 <entry>2007-10-22</entry>
 <modified>2007-10-23</modified>
 </dates>
 </vuln>

<vuln vid="498a8731-7cfc-11dc-96e6-0012f06707f0">
 <topic>phpmyadmin -- cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The DigiTrust Group discovered serious XSS vulnerability in
	 the phpMyAdmin server_status.php script. According to their
	 report
	<blockquote cite="http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html">
	 vulnerability can be exploited to execute arbitrary HTML and
	 script code in a user's browser session in context of an affected
	 site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-5589</cvename>
 <url>http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html</url>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6</url>
 </references>
 <dates>
 <discovery>2007-10-17</discovery>
 <entry>2007-10-17</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="51b51d4a-7c0f-11dc-9e47-0011d861d5e2">
 <topic>phpmyadmin -- cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.11.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/26020/discuss">
	 phpMyAdmin is prone to a cross-site scripting vulnerability
	 because it fails to properly sanitize user-supplied input.
	 An attacker may leverage this issue to execute arbitrary script
	 code in the browser of an unsuspecting user in the context of the
	 affected site. This may help the attacker steal potentially
	 sensitive information and launch other attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-5386</cvename>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5</url>
 <url>http://www.digitrustgroup.com/advisories/TDG-advisory071009a</url>
 <url>http://secunia.com/advisories/27173</url>
 <bid>26020</bid>
 </references>
 <dates>
 <discovery>2007-10-12</discovery>
 <entry>2007-10-16</entry>
 <modified>2007-10-20</modified>
 </dates>
 </vuln>

<vuln vid="7453c85d-7830-11dc-b4c8-0016179b2dd5">
 <topic>nagios-plugins -- Long Location Header Buffer Overflow Vulnerability</topic>
 <affects>
 <package>
	<name>nagios-plugins</name>
	<range><lt>1.4.10,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/27124/">
	 The vulnerability is caused due to a boundary error within the
	 redir() function in check_http.c when processing HTTP Location:
	 header information. This can be exploited to cause a buffer overflow
	 by returning an overly long string in the "Location:" header to a
	 vulnerable system.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://sourceforge.net/forum/forum.php?forum_id=740172</url>
 <url>http://secunia.com/advisories/27124/</url>
 <cvename>CVE-2007-5198</cvename>
 </references>
 <dates>
 <discovery>2007-09-28</discovery>
 <entry>2007-10-11</entry>
 </dates>
 </vuln>

<vuln vid="172acf78-780c-11dc-b3f4-0016179b2dd5">
 <topic>png -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>png</name>
	<range><lt>1.2.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/27093/">
	 Some vulnerabilities have been reported in libpng, which can be
	 exploited by malicious people to cause a DoS (Denial of
	 Service).
	 Certain errors within libpng, including a logical NOT instead of a
	 bitwise NOT in pngtrtran.c, an error in the 16bit cheap transparency
	 extension, and an incorrect use of sizeof() may be exploited to
	 crash an application using the library.
	 Various out-of-bounds read errors exist within the functions
	 png_handle_pCAL(), png_handle_sCAL(), png_push_read_tEXt(),
	 png_handle_iTXt(), and png_handle_ztXt(), which may be exploited by
	 exploited to crash an application using the library.
	</blockquote>
	<blockquote cite="http://secunia.com/advisories/27130/">
	 The vulnerability is caused due to an off-by-one error within
	 the ICC profile chunk handling, which potentially can be
	 exploited to crash an application using the library.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/27093/</url>
 <url>http://secunia.com/advisories/27130/</url>
 <cvename>CVE-2007-5267</cvename>
 <cvename>CVE-2007-5266</cvename>
 <cvename>CVE-2007-5268</cvename>
 <cvename>CVE-2007-5269</cvename>
 </references>
 <dates>
 <discovery>2007-10-08</discovery>
 <entry>2007-10-11</entry>
 </dates>
 </vuln>

<vuln vid="f5b29ec0-71f9-11dc-8c6a-00304881ac9a">
 <topic>ImageMagick -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.3.5.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple vulnerabilities have been discovered in ImageMagick.
	<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4985">
	 ImageMagick before 6.3.5-9 allows context-dependent attackers
	 to cause a denial of service via a crafted image file that
	 triggers (1) an infinite loop in the ReadDCMImage function,
	 related to ReadBlobByte function calls; or (2) an infinite
	 loop in the ReadXCFImage function, related to ReadBlobMSBLong
	 function calls.
	</blockquote>
	<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4986">
	 Multiple integer overflows in ImageMagick before 6.3.5-9
	 allow context-dependent attackers to execute arbitrary code
	 via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5)
	 .xwd image file, which triggers a heap-based buffer overflow.
	</blockquote>
	<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4987">
	 Off-by-one error in the ReadBlobString function in blob.c in
	 ImageMagick before 6.3.5-9 allows context-dependent attackers
	 to execute arbitrary code via a crafted image file, which
	 triggers the writing of a '\0' character to an out-of-bounds
	 address.
	</blockquote>
	<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4988">
	 Sign extension error in the ReadDIBImage function in
	 ImageMagick before 6.3.5-9 allows context-dependent attackers
	 to execute arbitrary code via a crafted width value in an
	 image file, which triggers an integer overflow and a
	 heap-based buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-4985</cvename>
 <cvename>CVE-2007-4986</cvename>
 <cvename>CVE-2007-4987</cvename>
 <cvename>CVE-2007-4988</cvename>
 <url>http://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html</url>
 </references>
 <dates>
 <discovery>2007-09-19</discovery>
 <entry>2007-10-10</entry>
 </dates>
 </vuln>

<vuln vid="c93e4d41-75c5-11dc-b903-0016179b2dd5">
 <topic>jdk/jre -- Applet Caching May Allow Network Access Restrictions to be Circumvented</topic>
 <affects>
 <package>
	<name>jdk</name>
	<range><ge>1.3.0</ge><lt>1.6.0.3p3</lt></range>
	<range><ge>1.5.0,1</ge><lt>1.5.0.13p7,1</lt></range>
 </package>
 <package>
	<name>linux-blackdown-jdk</name>
	<range><ge>1.3.0</ge></range>
 </package>
 <package>
	<name>linux-sun-jdk</name>
	<range><ge>1.3.0</ge><lt>1.3.1.20</lt></range>
	<range><ge>1.4.0</ge><lt>1.4.2.16</lt></range>
	<range><eq>1.5.0.b1</eq></range>
	<range><eq>1.5.0.b1,1</eq></range>
	<range><ge>1.5.0,2</ge><lt>1.5.0.13,2</lt></range>
	<range><ge>1.6.0</ge><lt>1.6.0.03</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SUN reports:
	<blockquote cite="http://sunsolve.sun.com/search/document.do?assetkey=1-26-103079-1">
	 A vulnerability in the Java Runtime Environment (JRE) with applet
	 caching may allow an untrusted applet that is downloaded from a
	 malicious website to make network connections to network services
	 on machines other than the one that the applet was downloaded from.
	 This may allow network resources (such as web pages) and
	 vulnerabilities (that exist on these network services) which are not
	 otherwise normally accessible to be accessed or exploited.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://sunsolve.sun.com/search/document.do?assetkey=1-26-103079-1</url>
 <cvename>CVE-2007-5232</cvename>
 </references>
 <dates>
 <discovery>2007-10-03</discovery>
 <entry>2007-10-08</entry>
 <modified>2007-11-16</modified>
 </dates>
 </vuln>

<vuln vid="a5f667db-7596-11dc-8b7a-0019b944b34e">
 <topic>xfs -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>xfs</name>
	<range><lt>1.0.5,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthieu Herrb reports:
	<blockquote cite="http://lists.freedesktop.org/archives/xorg/2007-October/028899.html">
	 <h1>Problem Description:</h1>
	 Several vulnerabilities have been identified in xfs, the X font
	 server. The QueryXBitmaps and QueryXExtents protocol requests
	 suffer from lack of validation of their 'length' parameters.
	 <h1>Impact:</h1>
	 On most modern systems, the font server is accessible only for
	 local clients and runs with reduced privileges, but on some
	 systems it may still be accessible from remote clients and
	 possibly running with root privileges, creating an opportunity
	 for remote privilege escalation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-4568</cvename>
 <url>http://lists.freedesktop.org/archives/xorg/2007-October/028899.html</url>
 </references>
 <dates>
 <discovery>2007-10-02</discovery>
 <entry>2007-10-08</entry>
 </dates>
 </vuln>

<vuln vid="a058d6fa-7325-11dc-ae10-0016179b2dd5">
 <topic>tcl/tk -- buffer overflow in ReadImage function</topic>
 <affects>
 <package>
	<name>tk</name>
	<name>tk-threads</name>
	<range><gt>8.2.*</gt><lt>8.2.3_11</lt></range>
	<range><gt>8.3.*</gt><lt>8.3.5_10</lt></range>
	<range><gt>8.4.*,2</gt><lt>8.4.16,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Buffer overflow in the ReadImage function in generic/tkImgGIF.c
	 in Tcl/Tk, allows remote attackers to execute arbitrary code via
	 multi-frame interlaced GIF files in which later frames are smaller
	 than the first.
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/26942</url>
 <url>http://sourceforge.net/project/shownotes.php?release_id=541207</url>
 <cvename>CVE-2007-5137</cvename>
 </references>
 <dates>
 <discovery>2007-09-27</discovery>
 <entry>2007-10-05</entry>
 <modified>2011-09-04</modified>
 </dates>
 </vuln>

<vuln vid="91ed69f9-72c7-11dc-981a-001921ab2fa4">
 <topic>firebird -- multiple remote buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>firebird-server</name>
	<range><ge>1.*</ge><lt>1.5.5</lt></range>
	<range><ge>2.0.*</ge><lt>2.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RISE Security reports:
	<blockquote cite="http://risesecurity.org/advisory/RISE-2007003/">
	 There exists multiple vulnerabilities within functions
	 of Firebird Relational Database, which when properly
	 exploited can lead to remote compromise of the vulnerable
	 system.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>25925</bid>
 </references>
 <dates>
 <discovery>2007-10-03</discovery>
 <entry>2007-10-04</entry>
 </dates>
 </vuln>

<vuln vid="15ec9123-7061-11dc-b372-001921ab2fa4">
 <topic>id3lib -- insecure temporary file creation</topic>
 <affects>
 <package>
	<name>id3lib</name>
	<range><lt>3.8.3_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian Bug report log reports:
	<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=438540">
	 When tagging file $foo, a temporary copy of the file is
	 created, and for some reason, libid3 doesn't use mkstemp
	 but just creates $foo.XXXXXX literally, without any checking.
	 This would silently truncate and overwrite an existing
	 $foo.XXXXXX.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>25372</bid>
 <cvename>CVE-2007-4460</cvename>
 </references>
 <dates>
 <discovery>2007-08-20</discovery>
 <entry>2007-10-01</entry>
 <modified>2007-10-01</modified>
 </dates>
 </vuln>

<vuln vid="c9c14242-6843-11dc-82b6-02e0185f8d72">
 <topic>mediawiki -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>mediawiki</name>
	<range><gt>1.10.0</gt><lt>1.10.2</lt></range>
	<range><gt>1.9.0</gt><lt>1.9.4</lt></range>
	<range><gt>1.8.0</gt><lt>1.8.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The MediaWiki development team reports:
	<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html">
	 A possible HTML/XSS injection vector in the API
	 pretty-printing mode has been found and fixed.
	 The vulnerability may be worked around in an unfixed version
	 by simply disabling the API interface if it is not in use, by
	 adding this to LocalSettings.php:
	 $wgEnableAPI = false;
	 (This is the default setting in 1.8.x.)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-4828</cvename>
 <url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html</url>
 </references>
 <dates>
 <discovery>2007-09-10</discovery>
 <entry>2007-09-21</entry>
 <modified>2007-10-10</modified>
 </dates>
 </vuln>

<vuln vid="63347ee7-6841-11dc-82b6-02e0185f8d72">
 <topic>wordpress -- remote sql injection vulnerability</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>2.2.3,1</lt></range>
 </package>
 <package>
	<name>de-wordpress</name>
	<name>zh-wordpress</name>
	<range><lt>2.2.3</lt></range>
 </package>
 <package>
	<name>wordpress-mu</name>
	<range><lt>1.2.4,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Alexander Concha reports:
	<blockquote cite="http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html">
	 While testing WordPress, it has been discovered a SQL
	 Injection vulnerability that allows an attacker to retrieve
	 remotely any user credentials from a vulnerable site, this
	 bug is caused because of early database escaping and the
	 lack of validation in query string like parameters.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-4894</cvename>
 <url>http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html</url>
 </references>
 <dates>
 <discovery>2007-09-10</discovery>
 <entry>2007-09-21</entry>
 </dates>
 </vuln>

<vuln vid="2bc96f18-683f-11dc-82b6-02e0185f8d72">
 <topic>samba -- nss_info plugin privilege escalation vulnerability</topic>
 <affects>
 <package>
	<name>samba</name>
	<range><lt>3.0.26a</lt></range>
	<range><gt>*,1</gt><lt>3.0.26a,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba development team reports:
	<blockquote cite="http://www.samba.org/samba/security/CVE-2007-4138.html">
	 The idmap_ad.so library provides an nss_info extension to
	 Winbind for retrieving a user's home directory path, login
	 shell and primary group id from an Active Directory domain
	 controller. This functionality is enabled by defining the
	 "winbind nss info" smb.conf option to either "sfu" or
	 "rfc2307".
	 Both the Windows "Identity Management for Unix" and
	 "Services for Unix" MMC plug-ins allow a user to be assigned
	 a primary group for Unix clients that differs from the user's
	 Windows primary group. When the rfc2307 or sfu nss_info plugin
	 has been enabled, in the absence of either the RFC2307 or SFU
	 primary group attribute, Winbind will assign a primary group ID
	 of 0 to the domain user queried using the getpwnam() C library
	 call.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-4138</cvename>
 <url>http://www.samba.org/samba/security/CVE-2007-4138.html</url>
 </references>
 <dates>
 <discovery>2007-09-11</discovery>
 <entry>2007-09-21</entry>
 <modified>2008-09-26</modified>
 </dates>
 </vuln>

<vuln vid="75231c63-f6a2-499d-8e27-787773bda284">
 <topic>bugzilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<name>ja-bugzilla</name>
	<range><ge>2.20.*</ge><lt>2.22.3</lt></range>
	<range><ge>3.*</ge><lt>3.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla Security Advisory reports:
	<blockquote cite="http://www.bugzilla.org/security/2.20.4/">
	 This advisory covers three security issues that have recently been
	 fixed in the Bugzilla code:
	 <ul>
	 <li>A possible cross-site scripting (XSS) vulnerability when filing
	 bugs using the guided form.</li>
	 <li>When using email_in.pl, insufficiently escaped data may be
	 passed to sendmail.</li>
	 <li>Users using the WebService interface may access Bugzilla's
	 time-tracking fields even if they normally cannot see them.</li>
	 </ul>
	 We strongly advise that 2.20.x and 2.22.x users should upgrade to
	 2.20.5 and 2.22.3 respectively. 3.0 users, and users of 2.18.x or
	 below, should upgrade to 3.0.1.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>25425</bid>
 <cvename>CVE-2007-4538</cvename>
 <cvename>CVE-2007-4539</cvename>
 <cvename>CVE-2007-4543</cvename>
 <url>http://www.bugzilla.org/security/2.20.4/</url>
 </references>
 <dates>
 <discovery>2007-08-23</discovery>
 <entry>2007-09-21</entry>
 </dates>
 </vuln>

<vuln vid="b6f6da57-680a-11dc-b350-001921ab2fa4">
 <topic>clamav -- multiple remote Denial of Service vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.91.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	BugTraq reports:
	<blockquote cite="http://www.securityfocus.com/bid/25398">
	 ClamAV is prone to multiple denial-of-service vulnerabilities.
	 A successful attack may allow an attacker to crash the
	 application and deny service to users.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>25398</bid>
 <cvename>CVE-2007-4510</cvename>
 </references>
 <dates>
 <discovery>2007-08-21</discovery>
 <entry>2007-09-21</entry>
 </dates>
 </vuln>

<vuln vid="12488805-6773-11dc-8be8-02e0185f8d72">
 <topic>coppermine -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>coppermine</name>
	<range><lt>1.4.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The coppermine development team reports two vulnerabilities
	 with the coppermine application. These vulnerabilities are
	 caused by improper checking of the log variable in "viewlog.php"
	 and improper checking of the referer variable in "mode.php".
	 This could allow local file inclusion, potentially disclosing
	 valuable information and could lead to an attacker conducting
	 a cross site scripting attack against the targeted site.
 </body>
 </description>
 <references>
 <cvename>CVE-2007-4976</cvename>
 <cvename>CVE-2007-4977</cvename>
 <url>http://coppermine-gallery.net/forum/index.php?topic=46847.0</url>
 </references>
 <dates>
 <discovery>2007-09-14</discovery>
 <entry>2007-09-20</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="e595e170-6771-11dc-8be8-02e0185f8d72">
 <topic>openoffice -- arbitrary command execution vulnerability</topic>
 <affects>
 <package>
	<name>openoffice</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	iDefense reports:
	<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=593">
	 Remote exploitation of multiple integer overflow
	 vulnerabilities within OpenOffice, as included in various
	 vendors' operating system distributions, allows attackers to
	 execute arbitrary code.
	 These vulnerabilities exist within the TIFF parsing code of
	 the OpenOffice suite. When parsing the TIFF directory entries
	 for certain tags, the parser uses untrusted values from the
	 file to calculate the amount of memory to allocate. By
	 providing specially crafted values, an integer overflow occurs
	 in this calculation. This results in the allocation of a
	 buffer of insufficient size, which in turn leads to a heap
	 overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-2834</cvename>
 <url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=593</url>
 </references>
 <dates>
 <discovery>2007-09-19</discovery>
 <entry>2007-09-20</entry>
 </dates>
 </vuln>

<vuln vid="f8d3689e-6770-11dc-8be8-02e0185f8d72">
 <topic>bugzilla -- "createmailregexp" security bypass vulnerability</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<range><ge>3.*</ge><lt>3.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Bugzilla development team reports:
	<blockquote cite="http://www.bugzilla.org/security/3.0.1/">
	 Bugzilla::WebService::User::offer_account_by_email does
	 not check the "createemailregexp" parameter, and thus
	 allows users to create accounts who would normally be
	 denied account creation. The "emailregexp" parameter is
	 still checked. If you do not have the SOAP::Lite Perl
	 module installed on your Bugzilla system, your system is
	 not vulnerable (because the Bugzilla WebService will not
	 be enabled).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-5038</cvename>
 <url>http://www.bugzilla.org/security/3.0.1/</url>
 </references>
 <dates>
 <discovery>2007-09-18</discovery>
 <entry>2007-09-20</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="14ad2a28-66d2-11dc-b25f-02e0185f8d72">
 <topic>konquerer -- address bar spoofing</topic>
 <affects>
 <package>
	<name>kdebase</name>
	<range><lt>3.5.7_3</lt></range>
 </package>
 <package>
	<name>kdelibs</name>
	<range><lt>3.5.7_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The KDE development team reports:
	<blockquote cite="http://www.kde.org/info/security/advisory-20070914-1.txt">
	 The Konqueror address bar is vulnerable to spoofing attacks
	 that are based on embedding white spaces in the url. In addition
	 the address bar could be tricked to show an URL which it is
	 intending to visit for a short amount of time instead of the
	 current URL.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3820</cvename>
 <cvename>CVE-2007-4224</cvename>
 <cvename>CVE-2007-4225</cvename>
 <url>http://www.kde.org/info/security/advisory-20070914-1.txt</url>
 </references>
 <dates>
 <discovery>2007-09-14</discovery>
 <entry>2007-09-19</entry>
 </dates>
 </vuln>

<vuln vid="79b616d0-66d1-11dc-b25f-02e0185f8d72">
 <topic>kdm -- passwordless login vulnerability</topic>
 <affects>
 <package>
	<name>kdebase3</name>
	<range><lt>3.5.7_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The KDE development team reports:
	<blockquote cite="http://www.kde.org/info/security/advisory-20070919-1.txt">
	 KDM can be tricked into performing a password-less login
	 even for accounts with a password set under certain
	 circumstances, namely autologin to be configured and
	 "shutdown with password" enabled.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-4569</cvename>
 <url>http://www.kde.org/info/security/advisory-20070919-1.txt</url>
 </references>
 <dates>
 <discovery>2007-09-19</discovery>
 <entry>2007-09-19</entry>
 </dates>
 </vuln>

<vuln vid="209f0d75-4b5c-11dc-a6cd-000fb5066b20">
 <topic>flyspray -- authentication bypass</topic>
 <affects>
 <package>
	<name>flyspray</name>
	<range><lt>0.9.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Flyspray Project reports:
	<blockquote cite="http://www.flyspray.org/fsa:1">
	 Flyspray authentication system can be bypassed by sending a
	 carefully crafted post request.
	 To be vulnerable, PHP configuration directive output_buffering
	 has to be disabled or set to a low value.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1788</cvename>
 <url>http://www.flyspray.org/fsa:1</url>
 </references>
 <dates>
 <discovery>2007-03-13</discovery>
 <entry>2007-09-19</entry>
 </dates>
 </vuln>

<vuln vid="3ce8c7e2-66cf-11dc-b25f-02e0185f8d72">
 <topic>mozilla -- code execution via Quicktime media-link files</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>2.0.0.7,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>2.0.0.7</lt></range>
 </package>
 
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.5</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.a2007.12.12</lt></range>
 </package>
 <package>
	<name>linux-seamonkey-devel</name>
	<range><lt>2.0.a2007.12.12</lt></range>
 </package>
 
 <package>
	<name>firefox-ja</name>
	<name>linux-mozilla-devel</name>
	<name>linux-mozilla</name>
	<name>mozilla</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports a vulnerability within the
	 mozilla browser. This vulnerability also affects various
	 other browsers like firefox and seamonkey. The vulnerability
	 is caused by QuickTime Media-Link files that contain a qtnext
	 attribute. This could allow an attacker to start the browser
	 with arbitrary command-line options.	This could allow the
	 attacker to install malware, steal local data and possibly
	 execute and/or do other arbitrary things within the users
	 context.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4965</cvename>
 <url>http://www.mozilla.org/security/announce/2007/mfsa2007-28.html</url>
 </references>
 <dates>
 <discovery>2007-09-18</discovery>
 <entry>2007-09-19</entry>
 <modified>2007-12-14</modified>
 </dates>
 </vuln>

<vuln vid="71d903fc-602d-11dc-898c-001921ab2fa4">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.2.4</lt></range>
 </package>
 <package>
	<name>php4</name>
	<range><lt>4.4.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP development team reports:
	<blockquote cite="http://www.php.net/releases/5_2_4.php">
	 Security Enhancements and Fixes in PHP 5.2.4:
	 <ul>
	 <li>Fixed a floating point exception inside wordwrap() (Reported
	 by Mattias Bengtsson)</li>
	 <li>Fixed several integer overflows inside the GD extension
	 (Reported by Mattias Bengtsson)</li>
	 <li>Fixed size calculation in chunk_split() (Reported by Gerhard
	 Wagner)</li>
	 <li>Fixed integer overflow in str[c]spn(). (Reported by Mattias
	 Bengtsson)</li>
	 <li>Fixed money_format() not to accept multiple %i or %n tokens.
	 (Reported by Stanislav Malyshev)</li>
	 <li>Fixed zend_alter_ini_entry() memory_limit interruption
	 vulnerability. (Reported by Stefan Esser)</li>
	 <li>Fixed INFILE LOCAL option handling with MySQL extensions not
	 to be allowed when open_basedir or safe_mode is active. (Reported
	 by Mattias Bengtsson)</li>
	 <li>Fixed session.save_path and error_log values to be checked
	 against open_basedir and safe_mode (CVE-2007-3378) (Reported by
	 Maksymilian Arciemowicz)</li>
	 <li>Fixed a possible invalid read in glob() win32 implementation
	 (CVE-2007-3806) (Reported by shinnai)</li>
	 <li>Fixed a possible buffer overflow in php_openssl_make_REQ
	 (Reported by zatanzlatan at hotbrev dot com)</li>
	 <li>Fixed an open_basedir bypass inside glob() function (Reported
	 by dr at peytz dot dk)</li>
	 <li>Fixed a possible open_basedir bypass inside session extension
	 when the session file is a symlink (Reported by c dot i dot morris
	 at durham dot ac dot uk)</li>
	 <li>Improved fix for MOPB-03-2007.</li>
	 <li>Corrected fix for CVE-2007-2872.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-2872</cvename>
 <cvename>CVE-2007-3378</cvename>
 <cvename>CVE-2007-3806</cvename>
 <cvename>CVE-2007-3996</cvename>
 <cvename>CVE-2007-3997</cvename>
 <cvename>CVE-2007-3998</cvename>
 <cvename>CVE-2007-4652</cvename>
 <cvename>CVE-2007-4657</cvename>
 <cvename>CVE-2007-4658</cvename>
 <cvename>CVE-2007-4659</cvename>
 <cvename>CVE-2007-4660</cvename>
 <cvename>CVE-2007-4661</cvename>
 <cvename>CVE-2007-4662</cvename>
 <cvename>CVE-2007-4663</cvename>
 <cvename>CVE-2007-4670</cvename>
 <url>http://www.php.net/releases/4_4_8.php</url>
 <url>http://www.php.net/releases/5_2_4.php</url>
 <url>http://secunia.com/advisories/26642</url>
 </references>
 <dates>
 <discovery>2007-08-30</discovery>
 <entry>2007-09-11</entry>
 <modified>2008-01-14</modified>
 </dates>
 </vuln>

<vuln vid="c115271d-602b-11dc-898c-001921ab2fa4">
 <topic>apache -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><gt>2.2.0</gt><lt>2.2.6</lt></range>
	<range><gt>2.0.0</gt><lt>2.0.61</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache HTTP server project reports:
	<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.2.html">
	 The following potential security flaws are addressed:
	 <ul>
	 <li>CVE-2007-3847: mod_proxy: Prevent reading past the end of a
	 buffer when parsing date-related headers.</li>
	 <li>CVE-2007-1863: mod_cache: Prevent a segmentation fault if
	 attributes are listed in a Cache-Control header without any
	 value.</li>
	 <li>CVE-2007-3304: prefork, worker, event MPMs: Ensure that the
	 parent process cannot be forced to kill processes outside its
	 process group.</li>
	 <li>CVE-2006-5752: mod_status: Fix a possible XSS attack against
	 a site with a public server-status page and ExtendedStatus
	 enabled, for browsers which perform charset "detection".
	 Reported by Stefan Esser.</li>
	 <li>CVE-2006-1862: mod_mem_cache: Copy headers into longer lived
	 storage; header names and values could previously point to
	 cleaned up storage.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3847</cvename>
 <cvename>CVE-2007-1863</cvename>
 <cvename>CVE-2006-5752</cvename>
 <cvename>CVE-2007-3304</cvename>
 </references>
 <dates>
 <discovery>2007-09-07</discovery>
 <entry>2007-09-11</entry>
 </dates>
 </vuln>

<vuln vid="4b673ae7-5f9a-11dc-84dd-000102cc8983">
 <topic>lighttpd -- FastCGI header overrun in mod_fastcgi</topic>
 <affects>
 <package>
	<name>lighttpd</name>
	<range><lt>1.4.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	lighttpd maintainer reports:
	<blockquote cite="http://www.lighttpd.net/assets/2007/9/9/lighttpd_sa_2007_12.txt">
	 Lighttpd is prone to a header overflow when using the mod_fastcgi
	 extension, this can lead to arbitrary code execution in the fastcgi
	 application. For a detailed description of the bug see the external
	 reference.
	 This bug was found by Mattias Bengtsson and Philip Olausson
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.lighttpd.net/assets/2007/9/9/lighttpd_sa_2007_12.txt</url>
 <url>http://secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability/</url>
 <cvename>CVE-2007-4727</cvename>
 </references>
 <dates>
 <discovery>2007-09-09</discovery>
 <entry>2007-09-10</entry>
 </dates>
 </vuln>

<vuln vid="f14ad681-5b88-11dc-812d-0011098b2f36">
 <topic>rkhunter -- insecure temporary file creation</topic>
 <affects>
 <package>
	<name>rkhunter</name>
	<range><lt>1.2.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gentoo reports:
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200504-25.xml">
	 Sune Kloppenborg Jeppesen and Tavis Ormandy of the Gentoo Linux
	 Security Team have reported that the check_update.sh script and
	 the main rkhunter script insecurely creates several temporary
	 files with predictable filenames.
	 A local attacker could create symbolic links in the temporary
	 files directory, pointing to a valid file somewhere on the
	 filesystem. When rkhunter or the check_update.sh script runs,
	 this would result in the file being overwritten with the rights of
	 the user running the utility, which could be the root user.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13399</bid>
 <cvename>CVE-2005-1270</cvename>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200504-25.xml</url>
 </references>
 <dates>
 <discovery>2005-04-26</discovery>
 <entry>2007-09-05</entry>
 </dates>
 </vuln>

<vuln vid="72cdf2ab-5b87-11dc-812d-0011098b2f36">
 <topic>lsh -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>lsh</name>
	<range><lt>2.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/14609">
	 A vulnerability has been reported in LSH, which potentially
	 can be exploited by malicious people to cause a DoS (Denial
	 of Service).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0826</cvename>
 <cvename>CVE-2005-0814</cvename>
 <url>http://secunia.com/advisories/14609</url>
 </references>
 <dates>
 <discovery>2005-03-17</discovery>
 <entry>2007-09-05</entry>
 <modified>2008-01-07</modified>
 </dates>
 </vuln>

<vuln vid="45500f74-5947-11dc-87c1-000e2e5785ad">
 <topic>fetchmail -- denial of service on reject of local warning message</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><ge>4.6.8</ge><lt>6.3.8_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2007-02.txt">
	 fetchmail will generate warning messages in certain
	 circumstances (for instance, when leaving oversized messages
	 on the server or login to the upstream fails) and send them
	 to the local postmaster or the user running it.
	 If this warning message is then refused by the SMTP listener
	 that fetchmail is forwarding the message to, fetchmail
	 crashes and does not collect further messages until it is
	 restarted.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-4565</cvename>
 <url>http://www.fetchmail.info/fetchmail-SA-2007-02.txt</url>
 </references>
 <dates>
 <discovery>2007-07-29</discovery>
 <entry>2007-09-02</entry>
 </dates>
 </vuln>

<vuln vid="d944719e-42f4-4864-89ed-f045b541919f">
 <topic>gtar -- Directory traversal vulnerability</topic>
 <affects>
 <package>
	<name>gtar</name>
	<range><lt>1.18_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Red Hat reports:
	<blockquote cite="http://rhn.redhat.com/errata/RHSA-2007-0860.html">
	 A path traversal flaw was discovered in the way GNU
	 tar extracted archives. A malicious user could create a
	 tar archive that could write to arbitrary files to which
	 the user running GNU tar had write access.
	</blockquote>
	Red Hat credits Dmitry V. Levin for reporting the issue.
 </body>
 </description>
 <references>
 <bid>25417</bid>
 <cvename>CVE-2007-4131</cvename>
 <url>http://rhn.redhat.com/errata/RHSA-2007-0860.html</url>
 <url>https://bugzilla.redhat.com/show_bug.cgi?id=251921</url>
 </references>
 <dates>
 <discovery>2007-08-23</discovery>
 <entry>2007-09-01</entry>
 </dates>
 </vuln>

<vuln vid="d9867f50-54d0-11dc-b80b-0016179b2dd5">
 <topic>claws-mail -- POP3 Format String Vulnerability</topic>
 <affects>
 <package>
	<name>claws-mail</name>
	<name>sylpheed-claws</name>
	<range><lt>2.10.0_3</lt></range>
 </package>
 <package>
	<name>sylpheed2</name>
	<range><lt>2.4.4_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/26550/">
	 A format string error in the "inc_put_error()" function in
	 src/inc.c when displaying a POP3 server's error response can
	 be exploited via specially crafted POP3 server replies containing
	 format specifiers.
	 Successful exploitation may allow execution of arbitrary code,
	 but requires that the user is tricked into connecting to a malicious
	 POP3 server.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-2958</cvename>
 <url>http://secunia.com/advisories/26550/</url>
 <url>http://secunia.com/secunia_research/2007-70/advisory/</url>
 </references>
 <dates>
 <discovery>2007-08-24</discovery>
 <entry>2007-08-27</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="af8e3a0c-5009-11dc-8a43-003048705d5a">
 <topic>rsync -- off by one stack overflow</topic>
 <affects>
 <package>
	<name>rsync</name>
	<range><lt>2.6.9_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	BugTraq reports:
	<blockquote cite="http://www.securityfocus.com/bid/25336/discuss">
	 The rsync utility is prone to an off-by-one buffer-overflow
	 vulnerability. This issue is due to a failure of the application
	 to properly bounds-check user-supplied input.
	 Successfully exploiting this issue may allow arbitrary
	 code-execution in the context of the affected utility.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>25336</bid>
 <cvename>CVE-2007-4091</cvename>
 </references>
 <dates>
 <discovery>2007-08-15</discovery>
 <entry>2007-08-21</entry>
 <modified>2007-08-23</modified>
 </dates>
 </vuln>

<vuln vid="df4a7d21-4b17-11dc-9fc2-001372ae3ab9">
 <topic>opera -- Vulnerability in javascript handling</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>9.23.20070809</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An advisory from Opera reports:
	<blockquote cite="http://www.opera.com/support/search/view/865/">
	 A specially crafted JavaScript can make Opera execute
	 arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.opera.com/support/search/view/865/</url>
 </references>
 <dates>
 <discovery>2007-08-03</discovery>
 <entry>2007-08-15</entry>
 <modified>2007-08-25</modified>
 </dates>
 </vuln>

<vuln vid="4a338d17-412d-11dc-bdb0-0016179b2dd5">
 <topic>fsplib -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>fsplib</name>
	<range><lt>0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/26184/">
	 fsplib can be exploited to compromise an application using
	 the library.
	 A boundary error exists in the processing of file names in
	 fsp_readdir_native, which can be exploited to cause a stack-based
	 buffer overflow if the defined MAXNAMLEN is bigger than 256.
	 A boundary error exists in the processing of directory entries in
	 fsp_readdir, which can be exploited to cause a stack-based buffer
	 overflow on systems with an insufficient size allocated for the
	 d_name field of directory entries.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3961</cvename>
 <cvename>CVE-2007-3962</cvename>
 <url>http://secunia.com/advisories/26184/</url>
 </references>
 <dates>
 <discovery>2007-07-24</discovery>
 <entry>2007-08-02</entry>
 </dates>
 </vuln>

<vuln vid="4872d9a7-4128-11dc-bdb0-0016179b2dd5">
 <topic>joomla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla</name>
	<range><lt>1.0.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	 joomla can be exploited to conduct session fixation
	 attacks, cross-site scripting attacks or HTTP response
	 splitting attacks.
	 Certain unspecified input passed in com_search, com_content and
	 mod_login is not properly sanitised before being returned to a
	 user. This can be exploited to execute arbitrary HTML and script
	 code in a user's browser session in context of an affected
	 site.
	 Input passed to the url parameter is not properly sanitised
	 before being returned to the user.	This can be exploited to insert
	 arbitrary HTTP headers, which will be included in a response sent
	 to the user, allowing for execution of arbitrary HTML and script
	 code in a user's browser session in context of an affected
	 site.
	 An error exists in the handling of sessions and can be exploited
	 to hijack another user's session by tricking the user into logging
	 in after following a specially crafted link.
 </body>
 </description>
 <references>
 <cvename>CVE-2007-4188</cvename>
 <cvename>CVE-2007-4189</cvename>
 <cvename>CVE-2007-4190</cvename>
 <cvename>CVE-2007-5577</cvename>
 <url>http://www.joomla.org/content/view/3677/1/</url>
 <url>http://secunia.com/advisories/26239/</url>
 </references>
 <dates>
 <discovery>2007-07-30</discovery>
 <entry>2007-08-02</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="2dc764fa-40c0-11dc-aeac-02e0185f8d72">
 <topic>FreeBSD -- Buffer overflow in tcpdump(1)</topic>
 <affects>
 <package>
	<name>tcpdump</name>
	<range><lt>3.9.6</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.2</ge><lt>6.2_7</lt></range>
	<range><ge>6.1</ge><lt>6.1_19</lt></range>
	<range><ge>5.5</ge><lt>5.5_15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	An un-checked return value in the BGP dissector code can
	 result in an integer overflow. This value is used in
	 subsequent buffer management operations, resulting in a stack
	 based buffer overflow under certain circumstances.
	<h1>Impact:</h1>
	By crafting malicious BGP packets, an attacker could exploit
	 this vulnerability to execute code or crash the tcpdump
	 process on the target system. This code would be executed in
	 the context of the user running tcpdump(1). It should be
	 noted that tcpdump(1) requires privileges in order to open live
	 network interfaces.
	<h1>Workaround:</h1>
	No workaround is available.
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3798</cvename>
 <freebsdsa>SA-07:06.tcpdump</freebsdsa>
 </references>
 <dates>
 <discovery>2007-08-01</discovery>
 <entry>2007-08-02</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="3de342fb-40be-11dc-aeac-02e0185f8d72">
 <topic>FreeBSD -- Predictable query ids in named(8)</topic>
 <affects>
 <package>
	<name>named</name>
	<range><ge>9.4</ge><lt>9.4.1.1</lt></range>
	<range><ge>9.3</ge><lt>9.3.4.1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.2</ge><lt>6.2_7</lt></range>
	<range><ge>6.1</ge><lt>6.1_19</lt></range>
	<range><ge>5.5</ge><lt>5.5_15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When named(8) is operating as a recursive DNS server or
	 sending NOTIFY requests to slave DNS servers, named(8)
	 uses a predictable query id.
	<h1>Impact:</h1>
	An attacker who can see the query id for some request(s)
	 sent by named(8) is likely to be able to perform DNS cache
	 poisoning by predicting the query id for other request(s).
	<h1>Workaround:</h1>
	No workaround is available.
 </body>
 </description>
 <references>
 <cvename>CVE-2007-2926</cvename>
 <freebsdsa>SA-07:07.bind</freebsdsa>
 </references>
 <dates>
 <discovery>2007-07-24</discovery>
 <entry>2007-08-02</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="0e43a14d-3f3f-11dc-a79a-0016179b2dd5">
 <topic>xpdf -- stack based buffer overflow</topic>
 <affects>
 <package>
	<name>xpdf</name>
	<range><lt>3.02_2</lt></range>
 </package>
 <package>
	<name>kdegraphics</name>
	<range><lt>3.5.7_1</lt></range>
 </package>
 <package>
	<name>cups-base</name>
	<range><lt>1.2.11_3</lt></range>
 </package>
 <package>
	<name>gpdf</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>pdftohtml</name>
	<range><lt>0.39_3</lt></range>
 </package>
 <package>
	<name>poppler</name>
	<range><lt>0.5.9_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The KDE Team reports:
	<blockquote cite="http://www.kde.org/info/security/advisory-20070730-1.txt">
	 kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains
	 a vulnerability that can cause a stack based buffer overflow
	 via a PDF file that exploits an integer overflow in
	 StreamPredictor::StreamPredictor(). Remotely supplied
	 pdf files can be used to disrupt the kpdf viewer on
	 the client machine and possibly execute arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>25124</bid>
 <cvename>CVE-2007-3387</cvename>
 <url>http://www.kde.org/info/security/advisory-20070730-1.txt</url>
 </references>
 <dates>
 <discovery>2007-07-30</discovery>
 <entry>2007-07-31</entry>
 <modified>2009-04-29</modified>
 </dates>
 </vuln>

<vuln vid="863f95d3-3df1-11dc-b3d3-0016179b2dd5">
 <topic>mutt -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>mutt</name>
	<name>mutt-lite</name>
	<name>ja-mutt</name>
	<name>zh-mutt</name>
	<range><lt>1.4.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Securityfocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/24192/">
	 Mutt is prone to a local buffer-overflow vulnerability
	 because it fails to properly bounds-check user-supplied
	 input before using it in a memory copy operation.
	 An attacker can exploit this issue to execute arbitrary
	 code with the with the privileges of the victim. Failed
	 exploit attempts will result in a denial of service.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>24192</bid>
 <cvename>CVE-2007-2683</cvename>
 <url>http://www.redhat.com/support/errata/RHSA-2007-0386.html</url>
 </references>
 <dates>
 <discovery>2007-05-28</discovery>
 <entry>2007-07-29</entry>
 </dates>
 </vuln>

<vuln vid="d2b8a963-3d59-11dc-b3d3-0016179b2dd5">
 <topic>p5-Net-DNS -- multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>p5-Net-DNS</name>
	<range><lt>0.60</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/25829/">
	 An error exists in the handling of DNS queries where IDs are
	 incremented with a fixed value and are additionally used for
	 child processes in a forking server. This can be exploited to
	 poison the DNS cache of an application using the module if a
	 valid ID is guessed.
	 An error in the PP implementation within the "dn_expand()"
	 function can be exploited to cause a stack overflow due to an
	 endless loop via a specially crafted DNS packet.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3377</cvename>
 <cvename>CVE-2007-3409</cvename>
 <url>http://secunia.com/advisories/25829/</url>
 </references>
 <dates>
 <discovery>2007-06-27</discovery>
 <entry>2007-07-28</entry>
 </dates>
 </vuln>

<vuln vid="88260dfe-3d21-11dc-b3d3-0016179b2dd5">
 <topic>phpsysinfo -- url Cross-Site Scripting</topic>
 <affects>
 <package>
	<name>phpSysInfo</name>
	<range><lt>2.5.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Doz reports:
	<blockquote cite="http://secunia.com/advisories/26248/">
	 A Input passed in the URL to index.php is not properly
	 sanitised before being returned to the user. This can be
	 exploited to execute arbitrary HTML and script code in a
	 user's browser session in context of an affected site.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/26248/</url>
 </references>
 <dates>
 <discovery>2007-07-27</discovery>
 <entry>2007-07-28</entry>
 <modified>2007-08-01</modified>
 </dates>
 </vuln>

<vuln vid="98dd7788-3d13-11dc-b3d3-0016179b2dd5">
 <topic>drupal -- Cross site request forgeries</topic>
 <affects>
 <package>
	<name>drupal5</name>
	<range><lt>5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Project reports:
	<blockquote cite="http://drupal.org/node/162360">
	 Several parts in Drupal core are not protected against cross
	 site request forgeries due to inproper use of the Forms API,
	 or by taking action solely on GET requests. Malicious users are
	 able to delete comments and content revisions and disable menu
	 items by enticing a privileged users to visit certain URLs while
	 the victim is logged-in to the targeted site.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://drupal.org/node/162360</url>
 <url>http://secunia.com/advisories/26224/</url>
 </references>
 <dates>
 <discovery>2007-07-26</discovery>
 <entry>2007-07-28</entry>
 </dates>
 </vuln>

<vuln vid="1f5b711b-3d0e-11dc-b3d3-0016179b2dd5">
 <topic>drupal -- Multiple cross-site scripting vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal4</name>
	<range><lt>4.7.7</lt></range>
 </package>
 <package>
	<name>drupal5</name>
	<range><lt>5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Project reports:
	<blockquote cite="http://drupal.org/node/162361">
	 Some server variables are not escaped consistently. When
	 a malicious user is able to entice a victim to visit a specially
	 crafted link or webpage, arbitrary HTML and script code can be
	 injected and executed in the context of the victim's session on
	 the targeted website.
	 Custom content type names are not escaped consistently. A
	 malicious user with the 'administer content types' permission
	 would be able to inject and execute arbitrary HTML and script
	 code on the website. Revoking the 'administer content types'
	 permission provides an immediate workaround.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://drupal.org/node/162361</url>
 <url>http://secunia.com/advisories/26224/</url>
 </references>
 <dates>
 <discovery>2007-07-26</discovery>
 <entry>2007-07-28</entry>
 </dates>
 </vuln>

<vuln vid="1ed03222-3c65-11dc-b3d3-0016179b2dd5">
 <topic>vim -- Command Format String Vulnerability</topic>
 <affects>
 <package>
	<name>vim</name>
	<name>vim-console</name>
	<name>vim-lite</name>
	<name>vim-ruby</name>
	<name>vim6</name>
	<name>vim6-ruby</name>
	<range><lt>7.1.39</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/25941/">
	 A format string error in the "helptags_one()" function in
	 src/ex_cmds.c when running the "helptags" command can be exploited
	 to execute arbitrary code via specially crafted help files.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-2953</cvename>
 <url>http://secunia.com/advisories/25941/</url>
 </references>
 <dates>
 <discovery>2007-07-27</discovery>
 <entry>2007-07-27</entry>
 </dates>
 </vuln>

<vuln vid="b73335a5-3bbe-11dc-8e83-0016179b2dd5">
 <topic>libvorbis -- Multiple memory corruption flaws</topic>
 <affects>
 <package>
	<name>libvorbis</name>
	<range><lt>1.2.0,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	isecpartners reports:
	<blockquote cite="http://www.isecpartners.com/advisories/2007-003-libvorbis.txt">
	 libvorbis contains several vulnerabilities
	 allowing heap overwrite, read violations and a function
	 pointer overwrite. These bugs cause a at least a denial
	 of service, and potentially code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.isecpartners.com/advisories/2007-003-libvorbis.txt</url>
 <cvename>CVE-2007-3106</cvename>
 </references>
 <dates>
 <discovery>2007-06-05</discovery>
 <entry>2007-07-26</entry>
 </dates>
 </vuln>

<vuln vid="ab2575d6-39f0-11dc-b8cc-000fea449b8a">
 <topic>tomcat -- XSS vulnerability in sample applications</topic>
 <affects>
 <package>
	<name>apache-tomcat</name>
	<range><gt>6.0.0</gt><lt>6.0.11</lt></range>
 </package>
 <package>
	<name>tomcat</name>
	<range><gt>5.0.0</gt><lt>5.5.24</lt></range>
 </package>
 <package>
	<name>jakarta-tomcat</name>
	<range><gt>5.0.0</gt><lt>5.5.24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Project reports:
	<blockquote cite="http://tomcat.apache.org/security-5.html">
	 The JSP and Servlet included in the sample application within
	 the Tomcat documentation webapp did not escape user provided
	 data before including it in the output. This enabled a XSS
	 attack. These pages have been simplified not to use any user
	 provided data in the output.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1355</cvename>
 <bid>24058</bid>
 </references>
 <dates>
 <discovery>2007-05-19</discovery>
 <entry>2007-07-24</entry>
 </dates>
 </vuln>

<vuln vid="872623af-39ec-11dc-b8cc-000fea449b8a">
 <topic>tomcat -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>apache-tomcat</name>
	<range><ge>4.1.0</ge><lt>4.1.36</lt></range>
	<range><gt>6.0.0</gt><lt>6.0.11</lt></range>
 </package>
 <package>
	<name>tomcat</name>
	<range><gt>5.0.0</gt><lt>5.5.23</lt></range>
 </package>
 <package>
	<name>jakarta-tomcat</name>
	<range><ge>4.0.0</ge><lt>4.1.0</lt></range>
	<range><gt>5.0.0</gt><lt>5.5.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache Project reports:
	<blockquote cite="http://www.mail-archive.com/dev@tomcat.apache.org/msg16385.html">
	 The Apache Tomcat team is proud to announce the immediate
	 availability of Tomcat 4.1.36 stable. This build contains
	 numerous library updates, A small number of bug fixes and
	 two important security fixes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2090</cvename>
 <cvename>CVE-2007-0450</cvename>
 <cvename>CVE-2007-1358</cvename>
 </references>
 <dates>
 <discovery>2007-04-27</discovery>
 <entry>2007-07-24</entry>
 </dates>
 </vuln>

<vuln vid="cddde37a-39b5-11dc-b3da-001921ab2fa4">
 <topic>dokuwiki -- XSS vulnerability in spellchecker backend</topic>
 <affects>
 <package>
	<name>dokuwiki</name>
	<range><lt>20070626_1</lt></range>
 </package>
 <package>
	<name>dokuwiki-devel</name>
	<range><lt>20070524_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	DokuWiki reports:
	<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&amp;task_id=1195">
	 The spellchecker tests the UTF-8 capabilities of the used browser
	 by sending an UTF-8 string to the backend, which will send it back
	 unfiltered. By comparing string length the spellchecker can work
	 around broken implementations. An attacker could construct a form to
	 let users send JavaScript to the spellchecker backend, resulting in
	 malicious JavaScript being executed in their browser.
	 Affected are all versions up to and including 2007-06-26 even when
	 the spell checker is disabled.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://xforce.iss.net/xforce/xfdb/35501</url>
 <cvename>CVE-2007-3930</cvename>
 </references>
 <dates>
 <discovery>2007-06-26</discovery>
 <entry>2007-07-24</entry>
 </dates>
 </vuln>

<vuln vid="fc9c217e-3791-11dc-bb1a-000fea449b8a">
 <topic>lighttpd -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>lighttpd</name>
	<range><lt>1.4.15_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/26130/">
	 Some vulnerabilities have been reported in lighttpd,
	 which can be exploited by malicious people to bypass
	 certain security restrictions or cause a DoS (Denial
	 of Service).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3947</cvename>
 <cvename>CVE-2007-3948</cvename>
 <cvename>CVE-2007-3949</cvename>
 <cvename>CVE-2007-3950</cvename>
 <url>http://trac.lighttpd.net/trac/ticket/1216</url>
 <url>http://trac.lighttpd.net/trac/ticket/1232</url>
 <url>http://trac.lighttpd.net/trac/ticket/1230</url>
 <url>http://trac.lighttpd.net/trac/ticket/1263</url>
 </references>
 <dates>
 <discovery>2007-07-20</discovery>
 <entry>2007-07-21</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="12d266b6-363f-11dc-b6c9-000c6ec775d9">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>9.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera Software ASA reports of multiple security fixes in
	 Opera, including an arbitrary code execute
	 vulnerability:
	<blockquote cite="http://www.opera.com/support/search/view/861/">
	 Opera for Linux, FreeBSD, and Solaris has a flaw in the
	 createPattern function that leaves old data that was in
	 the memory before Opera allocated it in the new
	 pattern. The pattern can be read and analyzed by
	 JavaScript, so an attacker can get random samples of the
	 user's memory, which may contain data.
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/862/">
	 Removing a specially crafted torrent from the download
	 manager can crash Opera. The crash is caused by an
	 erroneous memory access.
	 An attacker needs to entice the user to accept the
	 malicious BitTorrent download, and later remove it from
	 Opera's download manager. To inject code, additional means
	 will have to be employed.
	 Users clicking a BitTorrent link and rejecting the
	 download are not affected.
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/863/">
	 data: URLs embed data inside them, instead of linking to
	 an external resource. Opera can mistakenly display the end
	 of a data URL instead of the beginning. This allows an
	 attacker to spoof the URL of a trusted site.
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/view/864/">
	 Opera's HTTP authentication dialog is displayed when the
	 user enters a Web page that requires a login name and a
	 password. To inform the user which server it was that
	 asked for login credentials, the dialog displays the
	 server name.
	 The user has to see the entire server name. A truncated
	 name can be misleading. Opera's authentication dialog cuts
	 off the long server names at the right hand side, adding
	 an ellipsis (...) to indicate that it has been cut off.
	 The dialog has a predictable size, allowing an attacker
	 to create a server name which will look almost like a
	 trusted site, because the real domain name has been cut
	 off. The three dots at the end will not be obvious to all
	 users.
	 This flaw can be exploited by phishers who can set up
	 custom sub-domains, for example by hosting their own
	 public DNS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3929</cvename>
 <cvename>CVE-2007-4944</cvename>
 <url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=564</url>
 <url>http://www.opera.com/support/search/view/861/</url>
 <url>http://www.opera.com/support/search/view/862/</url>
 <url>http://www.opera.com/support/search/view/863/</url>
 <url>http://www.opera.com/support/search/view/864/</url>
 <url>http://www.opera.com/docs/changelogs/freebsd/922/</url>
 </references>
 <dates>
 <discovery>2007-07-19</discovery>
 <entry>2007-07-19</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="e190ca65-3636-11dc-a697-000c6ec775d9">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>2.0.0.5,1</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.a2_3,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<name>linux-thunderbird</name>
	<name>mozilla-thunderbird</name>
	<name>thunderbird</name>
	<range><lt>2.0.0.5</lt></range>
 </package>
 
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.1.3</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.a2007.12.12</lt></range>
 </package>
 <package>
	<name>linux-seamonkey-devel</name>
	<range><lt>2.0.a2007.12.12</lt></range>
 </package>
 
 <package>
	<name>firefox-ja</name>
	<name>linux-mozilla-devel</name>
	<name>linux-mozilla</name>
	<name>mozilla</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports of multiple security issues
	 in Firefox, Seamonkey, and Thunderbird. Several of these
	 issues can probably be used to run arbitrary code with the
	 privilege of the user running the program.
	<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.5">
	 <ul>
	 <li>MFSA 2007-25 XPCNativeWrapper pollution</li>
	 <li>MFSA 2007-24 Unauthorized access to wyciwyg:// documents</li>
	 <li>MFSA 2007-21 Privilege escalation using an event
	 handler attached to an element not in the document</li>
	 <li>MFSA 2007-20 Frame spoofing while window is loading</li>
	 <li>MFSA 2007-19 XSS using addEventListener and setTimeout</li>
	 <li>MFSA 2007-18 Crashes with evidence of memory corruption</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3089</cvename>
 <cvename>CVE-2007-3734</cvename>
 <cvename>CVE-2007-3735</cvename>
 <cvename>CVE-2007-3737</cvename>
 <cvename>CVE-2007-3738</cvename>
 <url>http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.5</url>
 <url>http://www.mozilla.org/security/announce/2007/mfsa2007-18.html</url>
 <url>http://www.mozilla.org/security/announce/2007/mfsa2007-19.html</url>
 <url>http://www.mozilla.org/security/announce/2007/mfsa2007-20.html</url>
 <url>http://www.mozilla.org/security/announce/2007/mfsa2007-21.html</url>
 <url>http://www.mozilla.org/security/announce/2007/mfsa2007-24.html</url>
 <url>http://www.mozilla.org/security/announce/2007/mfsa2007-25.html</url>
 <uscertta>TA07-199A</uscertta>
 </references>
 <dates>
 <discovery>2007-07-17</discovery>
 <entry>2007-07-19</entry>
 <modified>2008-06-21</modified>
 </dates>
 </vuln>

<vuln vid="b42e8c32-34f6-11dc-9bc9-001921ab2fa4">
 <topic>linux-flashplugin -- critical vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><gt>9.0</gt><le>9.0r45</le></range>
	<range><gt>8.0</gt><le>8.0r34</le></range>
	<range><le>7.0r69</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb07-12.html">
	 Critical vulnerabilities have been identified in
	 Adobe Flash Player that could allow an attacker who
	 successfully exploits these potential vulnerabilities
	 to take control of the affected system. A malicious
	 SWF must be loaded in Flash Player by the user for
	 an attacker to exploit these potential vulnerabilities.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-2022</cvename>
 <cvename>CVE-2007-3456</cvename>
 <cvename>CVE-2007-3457</cvename>
 </references>
 <dates>
 <discovery>2007-07-10</discovery>
 <entry>2007-07-18</entry>
 </dates>
 </vuln>

<vuln vid="7fadc049-2ba0-11dc-9377-0016179b2dd5">
 <topic>wireshark -- Multiple problems</topic>
 <affects>
 <package>
	<name>wireshark</name>
	<name>wireshark-lite</name>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.8.20</ge><lt>0.99.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wireshark Team reports:
	<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2007-02.html">
	 It may be possible to make Wireshark or Ethereal crash or use up
	 available memory by injecting a purposefully malformed packet onto
	 the wire or by convincing someone to read a malformed packet trace
	 file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3389</cvename>
 <cvename>CVE-2007-3390</cvename>
 <cvename>CVE-2007-3391</cvename>
 <cvename>CVE-2007-3392</cvename>
 <cvename>CVE-2007-3393</cvename>
 <url>http://secunia.com/advisories/25833/</url>
 <url>http://www.wireshark.org/security/wnpa-sec-2007-02.html</url>
 </references>
 <dates>
 <discovery>2007-06-29</discovery>
 <entry>2007-07-06</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="2c4f4688-298b-11dc-a197-0011098b2f36">
 <topic>typespeed -- arbitrary code execution</topic>
 <affects>
 <package>
	<name>typespeed</name>
	<range><le>0.4.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian reports:
	<blockquote cite="http://www.debian.org/security/2005/dsa-684">
	 Ulf Härnhammar from the Debian Security Audit Project
	 discovered a problem in typespeed, a touch-typist trainer
	 disguised as game.	This could lead to a local attacker
	 executing arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0105</cvename>
 <url>http://www.debian.org/security/2005/dsa-684</url>
 </references>
 <dates>
 <discovery>2005-02-16</discovery>
 <entry>2007-07-03</entry>
 <modified>2007-07-09</modified>
 </dates>
 </vuln>

<vuln vid="7128fb45-2633-11dc-94da-0016179b2dd5">
 <topic>vlc -- format string vulnerability and integer overflow</topic>
 <affects>
 <package>
	<name>vlc</name>
	<range><lt>0.8.6c</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	isecpartners reports:
	<blockquote cite="http://www.isecpartners.com/advisories/2007-001-vlc.txt">
	 VLC is vulnerable to a format string attack in the parsing
	 of Vorbis comments in Ogg Vorbis and Ogg Theora files, CDDA
	 data or SAP/SDP service discovery messages. Additionally,
	 there are two errors in the handling of wav files, one a
	 denial of service due to an uninitialized variable, and one
	 integer overflow in sampling frequency calculations.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3316</cvename>
 <cvename>CVE-2007-3468</cvename>
 <cvename>CVE-2007-3467</cvename>
 <url>http://www.isecpartners.com/advisories/2007-001-vlc.txt</url>
 </references>
 <dates>
 <discovery>2007-06-05</discovery>
 <entry>2007-06-18</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="32d38cbb-2632-11dc-94da-0016179b2dd5">
 <topic>flac123 -- stack overflow in comment parsing</topic>
 <affects>
 <package>
	<name>flac123</name>
	<range><lt>0.0.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	isecpartners reports:
	<blockquote cite="http://www.isecpartners.com/advisories/2007-002-flactools.txt">
	 flac123, also known as flac-tools, is vulnerable
	 to a buffer overflow in vorbis comment parsing.
	 This allows for the execution of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3507</cvename>
 <url>http://sourceforge.net/forum/forum.php?forum_id=710314</url>
 <url>http://www.isecpartners.com/advisories/2007-002-flactools.txt</url>
 </references>
 <dates>
 <discovery>2007-06-05</discovery>
 <entry>2007-06-28</entry>
 <modified>2007-08-10</modified>
 </dates>
 </vuln>

<vuln vid="6e099997-25d8-11dc-878b-000c29c5647f">
 <topic>gd -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gd</name>
	<range><lt>2.0.35,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	gd had been reported vulnerable to several
	 vulnerabilities:
	<ul>
	 <li>CVE-2007-3472: Integer overflow in gdImageCreateTrueColor
	 function in the GD Graphics Library (libgd) before 2.0.35
	 allows user-assisted remote attackers has unspecified attack
	 vectors and impact.</li>
	 <li>CVE-2007-3473: The gdImageCreateXbm function in the GD
	 Graphics Library (libgd) before 2.0.35 allows user-assisted
	 remote attackers to cause a denial of service (crash) via
	 unspecified vectors involving a gdImageCreate failure.</li>
	 <li>CVE-2007-3474: Multiple unspecified vulnerabilities in the GIF
	 reader in the GD Graphics Library (libgd) before 2.0.35 allow
	 user-assisted remote attackers to have unspecified attack vectors
	 and impact.</li>
	 <li>CVE-2007-3475: The GD Graphics Library (libgd) before 2.0.35
	 allows user-assisted remote attackers to cause a denial of service
	 (crash) via a GIF image that has no global color map.</li>
	 <li>CVE-2007-3476: Array index error in gd_gif_in.c in the GD Graphics
	 Library (libgd) before 2.0.35 allows user-assisted remote attackers
	 to cause a denial of service (crash and heap corruption) via large
	 color index values in crafted image data, which results in a
	 segmentation fault.</li>
	 <li>CVE-2007-3477: The (a) imagearc and (b) imagefilledarc functions
	 in GD Graphics Library (libgd) before 2.0.35 allows attackers to
	 cause a denial of service (CPU consumption) via a large (1) start or
	 (2) end angle degree value.</li>
	 <li>CVE-2007-3478: Race condition in gdImageStringFTEx
	 (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd)
	 before 2.0.35 allows user-assisted remote attackers to cause a
	 denial of service (crash) via unspecified vectors, possibly
	 involving truetype font (TTF) support.</li>
	</ul>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3472</cvename>
 <cvename>CVE-2007-3473</cvename>
 <cvename>CVE-2007-3474</cvename>
 <cvename>CVE-2007-3475</cvename>
 <cvename>CVE-2007-3476</cvename>
 <cvename>CVE-2007-3477</cvename>
 <cvename>CVE-2007-3478</cvename>
 <url>http://www.libgd.org/ReleaseNote020035</url>
 <url>http://www.frsirt.com/english/advisories/2007/2336</url>
 <url>http://bugs.libgd.org/?do=details&amp;task_id=89</url>
 <url>http://bugs.libgd.org/?do=details&amp;task_id=94</url>
 <url>http://bugs.libgd.org/?do=details&amp;task_id=70</url>
 <url>http://bugs.libgd.org/?do=details&amp;task_id=87</url>
 <url>http://bugs.libgd.org/?do=details&amp;task_id=92</url>
 <url>http://bugs.libgd.org/?do=details&amp;task_id=74</url>
 <url>http://bugs.libgd.org/?do=details&amp;task_id=48</url>
 <url>http://bugs.php.net/bug.php?id=40578</url>
 </references>
 <dates>
 <discovery>2007-06-21</discovery>
 <entry>2007-06-29</entry>
 </dates>
 </vuln>

<vuln vid="b1b5c125-2308-11dc-b91a-001921ab2fa4">
 <topic>evolution-data-server -- remote execution of arbitrary code vulnerability</topic>
 <affects>
 <package>
	<name>evolution-data-server</name>
	<range><lt>1.10.2_1</lt></range>
	<range><gt>1.11.*</gt><lt>1.11.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian project reports:
	<blockquote cite="http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00082.html">
	 It was discovered that the IMAP code in the Evolution
	 Data Server performs insufficient sanitising of a value
	 later used an array index, which can lead to the execution
	 of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3257</cvename>
 <url>http://secunia.com/advisories/25766/</url>
 <url>http://bugzilla.gnome.org/show_bug.cgi?id=447414</url>
 </references>
 <dates>
 <discovery>2007-06-23</discovery>
 <entry>2007-06-25</entry>
 <modified>2007-06-28</modified>
 </dates>
 </vuln>

<vuln vid="d337b206-200f-11dc-a197-0011098b2f36">
 <topic>xpcd -- buffer overflow</topic>
 <affects>
 <package>
	<name>xpcd</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian Project reports:
	<blockquote cite="http://www.debian.org/security/2005/dsa-676">
	 Erik Sjolund discovered a buffer overflow in pcdsvgaview,
	 an SVGA PhotoCD viewer. xpcd-svga is part of xpcd and uses
	 svgalib to display graphics on the Linux console for which
	 root permissions are required. A malicious user could
	 overflow a fixed-size buffer and may cause the program to
	 execute arbitrary code with elevated privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12523</bid>
 <cvename>CVE-2005-0074</cvename>
 <url>http://www.debian.org/security/2005/dsa-676</url>
 </references>
 <dates>
 <discovery>2005-02-11</discovery>
 <entry>2007-06-21</entry>
 </dates>
 </vuln>

<vuln vid="903654bd-1927-11dc-b8a0-02e0185f8d72">
 <topic>clamav -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.90.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Clamav had been found vulnerable to multiple vulnerabilities:
	<ul>
	 <li>Improper checking for the end of an buffer causing an
	 unspecified attack vector.</li>
	 <li>Insecure temporary file handling, which could be exploited
	 to read sensitive information.</li>
	 <li>A flaw in the parser engine which could allow a remote
	 attacker to bypass the scanning of RAR files.</li>
	 <li>A flaw in libclamav/unrar.c which could cause a remote
	 Denial of Service (DoS) by sending a specially crafted
	 RAR file with a modified vm_codesize.</li>
	 <li>A flaw in the OLE2 parser which could cause a remote
	 Denial of Service (DoS).</li>
	</ul>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-2650</cvename>
 <cvename>CVE-2007-3023</cvename>
 <cvename>CVE-2007-3024</cvename>
 <cvename>CVE-2007-3122</cvename>
 <cvename>CVE-2007-3123</cvename>
 <url>http://news.gmane.org/gmane.comp.security.virus.clamav.devel/cutoff=2853</url>
 </references>
 <dates>
 <discovery>2007-04-18</discovery>
 <entry>2007-06-19</entry>
 </dates>
 </vuln>

<vuln vid="8092b820-1d6f-11dc-a0b2-001921ab2fa4">
 <topic>p5-Mail-SpamAssassin -- local user symlink-attack DoS vulnerability</topic>
 <affects>
 <package>
	<name>p5-Mail-SpamAssassin</name>
	<range><lt>3.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SpamAssassin website reports:
	<blockquote cite="http://spamassassin.apache.org/advisories/cve-2007-2873.txt">
	 A local user symlink-attack DoS vulnerability in
	 SpamAssassin has been found, affecting versions 3.1.x,
	 3.2.0, and SVN trunk.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://spamassassin.apache.org/advisories/cve-2007-2873.txt</url>
 <cvename>CVE-2007-2873</cvename>
 </references>
 <dates>
 <discovery>2007-06-11</discovery>
 <entry>2007-06-18</entry>
 </dates>
 </vuln>

<vuln vid="39988ee8-1918-11dc-b6bd-0016179b2dd5">
 <topic>cups -- Incomplete SSL Negotiation Denial of Service</topic>
 <affects>
 <package>
	<name>cups-base</name>
	<range><lt>1.2.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/24517/">
	 CUPS is not using multiple workers to handle connections.
	 This can be exploited to stop CUPS from accepting new connections
	 by starting but never completing an SSL negotiation.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/24517/</url>
 <url>http://security.gentoo.org/glsa/glsa-200703-28.xml</url>
 <cvename>CVE-2007-0720</cvename>
 </references>
 <dates>
 <discovery>2007-05-05</discovery>
 <entry>2007-06-12</entry>
 </dates>
 </vuln>

<vuln vid="70ae62b0-16b0-11dc-b803-0016179b2dd5">
 <topic>c-ares -- DNS Cache Poisoning Vulnerability</topic>
 <affects>
 <package>
	<name>c-ares</name>
	<range><lt>1.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/25579/">
	 The vulnerability is caused due to predictable
	 DNS "Transaction ID" field in DNS queries and can
	 be exploited to poison the DNS cache of an application
	 using the library if a valid ID is guessed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-3152</cvename>
 <cvename>CVE-2007-3153</cvename>
 <url>http://secunia.com/advisories/25579/</url>
 <url>http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&amp;content-type=text/vnd.viewcvs-markup</url>
 </references>
 <dates>
 <discovery>2007-06-08</discovery>
 <entry>2007-06-09</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="0838733d-1698-11dc-a197-0011098b2f36">
 <topic>wordpress -- XMLRPC SQL Injection</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>de-wordpress</name>
	<name>zh-wordpress</name>
	<range><lt>2.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/25552/">
	 Slappter has discovered a vulnerability in WordPress, which can
	 be exploited by malicious users to conduct SQL injection
	 attacks.
	 Input passed to the "wp.suggestCategories" method in xmlrpc.php
	 is not properly sanitised before being used in SQL queries. This
	 can be exploited to manipulate SQL queries by injecting arbitrary
	 SQL code.
	 Successful exploitation allows e.g. retrieving usernames and
	 password hashes, but requires valid user credentials and knowledge
	 of the database table prefix.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>24344</bid>
 <url>http://secunia.com/advisories/25552/</url>
 </references>
 <dates>
 <discovery>2007-06-06</discovery>
 <entry>2007-06-09</entry>
 <modified>2007-06-24</modified>
 </dates>
 </vuln>

<vuln vid="6a31cbe3-1695-11dc-a197-0011098b2f36">
 <topic>wordpress -- unmoderated comments disclosure</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<name>de-wordpress</name>
	<name>zh-wordpress</name>
	<range><lt>2.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Blogsecurity reports:
	<blockquote cite="http://blogsecurity.net/news/news-310507/">
	 An attacker can read comments on posts that have not been
	 moderated.	This can be a real security risk if blog admins
	 are using unmoderated comments (comments that have not been
	 made public) to hide sensitive notes regarding posts, future
	 work, passwords etc. So please be careful if you are one of
	 these blog admins.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://blogsecurity.net/news/news-310507/</url>
 </references>
 <dates>
 <discovery>2007-06-01</discovery>
 <entry>2007-06-09</entry>
 <modified>2007-08-16</modified>
 </dates>
 </vuln>

<vuln vid="12b7286f-16a2-11dc-b803-0016179b2dd5">
 <topic>webmin -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>webmin</name>
	<range><lt>1.350</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/25580/">
	 Input passed to unspecified parameters in pam_login.cgi
	 is not properly sanitised before being returned to the
	 user. This can be exploited to execute arbitrary HTML and
	 script code in a user's browser session in context of an
	 affected site.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>24381</bid>
 <cvename>CVE-2007-3156</cvename>
 <url>http://secunia.com/advisories/25580/</url>
 <url>http://www.webmin.com/changes-1.350.html</url>
 </references>
 <dates>
 <discovery>2007-06-01</discovery>
 <entry>2007-06-09</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="3ac80dd2-14df-11dc-bcfc-0016179b2dd5">
 <topic>mplayer -- cddb stack overflow</topic>
 <affects>
 <package>
	<name>mplayer</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.10_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mplayer Team reports:
	<blockquote cite="http://www.mplayerhq.hu/design7/news.html">
	 A stack overflow was found in the code used to handle
	 cddb queries. When copying the album title and category,
	 no checking was performed on the size of the strings
	 before storing them in a fixed-size array.	A malicious
	 entry in the database could trigger a stack overflow in
	 the program, leading to arbitrary code execution with the
	 uid of the user running MPlayer.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>24302</bid>
 <cvename>CVE-2007-2948</cvename>
 </references>
 <dates>
 <discovery>2007-06-06</discovery>
 <entry>2007-06-07</entry>
 </dates>
 </vuln>

<vuln vid="d9405748-1342-11dc-a35c-001485ab073e">
 <topic>mod_jk -- information disclosure</topic>
 <affects>
 <package>
	<name>mod_jk</name>
	<range><lt>1.2.23,1</lt></range>
 </package>
 <package>
	<name>mod_jk-ap2</name>
	<range><lt>1.2.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kazu Nambo reports:
	<blockquote cite="http://tomcat.apache.org/security-jk.html">
	 URL decoding the the Apache webserver prior to
	 decoding in the Tomcat server could pypass access
	 control rules and give access to pages on a different
	 AJP by sending a crafted URL.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1860</cvename>
 <url>http://secunia.com/advisories/25383/</url>
 <url>http://tomcat.apache.org/connectors-doc/news/20070301.html#20070518.1</url>
 <url>http://tomcat.apache.org/security-jk.html</url>
 </references>
 <dates>
 <discovery>2007-05-18</discovery>
 <entry>2007-06-05</entry>
 <modified>2007-10-31</modified>
 </dates>
 </vuln>

<vuln vid="62b8f253-12d9-11dc-a35c-001485ab073e">
 <topic>typo3 -- email header injection</topic>
 <affects>
 <package>
	<name>typo3</name>
	<range><gt>3.0</gt><lt>4.0.5</lt></range>
	<range><gt>4.1</gt><lt>4.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Olivier Dobberkau, Andreas Otto, and Thorsten Kahler report:
	<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-20070221-1/">
	 An unspecified error in the internal form engine can be used for
	 sending arbitrary mail headers, using it for purposes which it
	 is not meant for, e.g. sending spam messages.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1081</cvename>
 <url>http://secunia.com/advisories/24207/</url>
 <url>http://typo3.org/teams/security/security-bulletins/typo3-20070221-1/</url>
 </references>
 <dates>
 <discovery>2007-02-21</discovery>
 <entry>2007-06-04</entry>
 </dates>
 </vuln>

<vuln vid="3d0e724e-129b-11dc-9f79-0016179b2dd5">
 <topic>phppgadmin -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>phppgadmin</name>
	<range><lt>4.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports about phppgadmin:
	<blockquote cite="http://www.securityfocus.com/bid/24115/info">
	 Exploiting this vulnerability may allow an attacker to perform
	 cross-site scripting attacks on unsuspecting users in the context
	 of the affected website. As a result, the attacker may be able to
	 steal cookie-based authentication credentials and to launch other
	 attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>24115</bid>
 <cvename>CVE-2007-5728</cvename>
 <url>http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063617.html</url>
 <url>http://secunia.com/advisories/25446/</url>
 </references>
 <dates>
 <discovery>2007-05-27</discovery>
 <entry>2007-06-04</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="7ca2a709-103b-11dc-8e82-00001cd613f9">
 <topic>findutils -- GNU locate heap buffer overrun</topic>
 <affects>
 <package>
	<name>findutils</name>
	<range><lt>4.2.31</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	James Youngman reports:
	<blockquote cite="http://lists.gnu.org/archive/html/bug-findutils/2007-06/msg00000.html">
	 When GNU locate reads filenames from an old-format locate database,
	 they are read into a fixed-length buffer allocated on the heap.
	 Filenames longer than the 1026-byte buffer can cause a buffer
	 overrun. The overrunning data can be chosen by any person able to
	 control the names of filenames created on the local system. This
	 will normally include all local users, but in many cases also remote
	 users (for example in the case of FTP servers allowing uploads).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-2452</cvename>
 <mlist>http://lists.gnu.org/archive/html/bug-findutils/2007-06/msg00000.html</mlist>
 </references>
 <dates>
 <discovery>2007-05-30</discovery>
 <entry>2007-06-01</entry>
 </dates>
 </vuln>

<vuln vid="de2fab2d-0a37-11dc-aae2-00304881ac9a">
 <topic>FreeType 2 -- Heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>freetype2</name>
	<range><lt>2.2.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 <blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2754">
 Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and
 earlier might allow remote attackers to execute arbitrary code via a
 crafted TTF image with a negative n_points value, which leads to an
 integer overflow and heap-based buffer overflow.
 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-2754</cvename>
 <mlist>http://lists.gnu.org/archive/html/freetype-devel/2007-04/msg00041.html</mlist>
 <url>http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2754</url>
 <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=240200</url>
 <freebsdpr>ports/112769</freebsdpr>
 </references>
 <dates>
 <discovery>2007-04-27</discovery>
 <entry>2007-05-24</entry>
 </dates>
 </vuln>

<vuln vid="8e01ab5b-0949-11dc-8163-000e0c2e438a">
 <topic>FreeBSD -- heap overflow in file(1)</topic>
 <affects>
 <package>
	<name>file</name>
	<range><lt>4.21</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.2</ge><lt>6.2_5</lt></range>
	<range><ge>6.1</ge><lt>6.1_17</lt></range>
	<range><ge>5.5</ge><lt>5.5_13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	When writing data into a buffer in the file_printf function,
	 the length of the unused portion of the buffer is not
	 correctly tracked, resulting in a buffer overflow when
	 processing certain files.
	<h1>Impact:</h1>
	An attacker who can cause file(1) to be run on a maliciously
	 constructed input can cause file(1) to crash. It may be
	 possible for such an attacker to execute arbitrary code with
	 the privileges of the user running file(1).
	The above also applies to any other applications using the
	 libmagic(3) library.
	<h1>Workaround:</h1>
	No workaround is available, but systems where file(1) and
	 other libmagic(3)-using applications are never run on
	 untrusted input are not vulnerable.
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1536</cvename>
 <freebsdsa>SA-07:04.file</freebsdsa>
 </references>
 <dates>
 <discovery>2007-05-23</discovery>
 <entry>2007-05-23</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="0e575ed3-0764-11dc-a80b-0016179b2dd5">
 <topic>squirrelmail -- Cross site scripting in HTML filter</topic>
 <affects>
 <package>
	<name>squirrelmail</name>
	<range><ge>1.4.0</ge><lt>1.4.9a</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The SquirrelMail developers report:
	<blockquote cite="http://www.squirrelmail.org/security/issue/2007-05-09">
	 Multiple cross-site scripting (XSS) vulnerabilities in the HTML
	 filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers
	 to inject arbitrary web script or HTML via the (1) data: URI in an
	 HTML e-mail attachment or (2) various non-ASCII character sets that
	 are not properly filtered when viewed with Microsoft Internet
	 Explorer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1262</cvename>
 <url>http://www.squirrelmail.org/security/issue/2007-05-09</url>
 </references>
 <dates>
 <discovery>2007-05-09</discovery>
 <entry>2007-05-21</entry>
 </dates>
 </vuln>

<vuln vid="4cb9c513-03ef-11dc-a51d-0019b95d4f14">
 <topic>png -- DoS crash vulnerability</topic>
 <affects>
 <package>
	<name>png</name>
	<range><lt>1.2.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Libpng Security Advisory reports:
	<blockquote cite="http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/l/li/libpng/libpng-1.2.17-ADVISORY.txt">
	 A grayscale PNG image with a malformed (bad CRC) tRNS
	 chunk will crash some libpng applications.
	 This vulnerability could be used to crash a browser when
	 a user tries to view such a malformed PNG file. It is not
	 known whether the vulnerability could be exploited
	 otherwise.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-2445</cvename>
 <certvu>684664</certvu>
 <url>http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/l/li/libpng/libpng-1.2.17-ADVISORY.txt</url>
 </references>
 <dates>
 <discovery>2007-05-15</discovery>
 <entry>2007-05-16</entry>
 </dates>
 </vuln>

<vuln vid="3546a833-03ea-11dc-a51d-0019b95d4f14">
 <topic>samba -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>samba</name>
	<name>ja-samba</name>
	<range><gt>3.*</gt><lt>3.0.25</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.25,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="http://de5.samba.org/samba/security/CVE-2007-2444.html">
	 A bug in the local SID/Name translation routines may
	 potentially result in a user being able to issue SMB/CIFS
	 protocol operations as root.
	 When translating SIDs to/from names using Samba local
	 list of user and group accounts, a logic error in the smbd
	 daemon's internal security stack may result in a
	 transition to the root user id rather than the non-root
	 user. The user is then able to temporarily issue SMB/CIFS
	 protocol operations as the root user. This window of
	 opportunity may allow the attacker to establish additional
	 means of gaining root access to the server.
	</blockquote>
	<blockquote cite="http://de5.samba.org/samba/security/CVE-2007-2446.html">
	 Various bugs in Samba's NDR parsing can allow a user to
	 send specially crafted MS-RPC requests that will overwrite
	 the heap space with user defined data.
	</blockquote>
	<blockquote cite="http://de5.samba.org/samba/security/CVE-2007-2447.html">
	 Unescaped user input parameters are passed as arguments
	 to /bin/sh allowing for remote command execution.
	 This bug was originally reported against the anonymous
	 calls to the SamrChangePassword() MS-RPC function in
	 combination with the "username map script" smb.conf option
	 (which is not enabled by default).
	 After further investigation by Samba developers, it was
	 determined that the problem was much broader and impacts
	 remote printer and file share management as well. The
	 root cause is passing unfiltered user input provided via
	 MS-RPC calls to /bin/sh when invoking externals scripts
	 defined in smb.conf. However, unlike the "username map
	 script" vulnerability, the remote file and printer
	 management scripts require an authenticated user
	 session.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-2444</cvename>
 <cvename>CVE-2007-2446</cvename>
 <cvename>CVE-2007-2447</cvename>
 <url>http://de5.samba.org/samba/security/CVE-2007-2444.html</url>
 <url>http://de5.samba.org/samba/security/CVE-2007-2446.html</url>
 <url>http://de5.samba.org/samba/security/CVE-2007-2447.html</url>
 </references>
 <dates>
 <discovery>2007-05-14</discovery>
 <entry>2007-05-16</entry>
 <modified>2008-09-26</modified>
 </dates>
 </vuln>

<vuln vid="f5e52bf5-fc77-11db-8163-000e0c2e438a">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5-imap</name>
	<name>php5-odbc</name>
	<name>php5-session</name>
	<name>php5-shmop</name>
	<name>php5-sqlite</name>
	<name>php5-wddx</name>
	<name>php5</name>
	<range><lt>5.2.2</lt></range>
 </package>
 <package>
	<name>php4-odbc</name>
	<name>php4-session</name>
	<name>php4-shmop</name>
	<name>php4-wddx</name>
	<name>php4</name>
	<range><lt>4.4.7</lt></range>
 </package>
 <package>
	<name>mod_php4-twig</name>
	<name>mod_php4</name>
	<name>mod_php5</name>
	<name>mod_php</name>
	<name>php4-cgi</name>
	<name>php4-cli</name>
	<name>php4-dtc</name>
	<name>php4-horde</name>
	<name>php4-nms</name>
	<name>php5-cgi</name>
	<name>php5-cli</name>
	<name>php5-dtc</name>
	<name>php5-horde</name>
	<name>php5-nms</name>
	<range><ge>4</ge><lt>4.4.7</lt></range>
	<range><ge>5</ge><lt>5.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP development team reports:
	<blockquote cite="http://www.php.net/releases/5_2_2.php">
	 Security Enhancements and Fixes in PHP 5.2.2 and PHP
	 4.4.7:
	 <ul>
	 <li>Fixed CVE-2007-1001, GD wbmp used with invalid image
	 size</li>
	 <li>Fixed asciiz byte truncation inside mail()</li>
	 <li>Fixed a bug in mb_parse_str() that can be used to
	 activate register_globals</li>
	 <li>Fixed unallocated memory access/double free in in
	 array_user_key_compare()</li>
	 <li>Fixed a double free inside session_regenerate_id()</li>
	 <li>Added missing open_basedir &amp; safe_mode checks to zip://
	 and bzip:// wrappers.</li>
	 <li>Limit nesting level of input variables with
	 max_input_nesting_level as fix for.</li>
	 <li>Fixed CRLF injection inside ftp_putcmd().</li>
	 <li>Fixed a possible super-global overwrite inside
	 import_request_variables().</li>
	 <li>Fixed a remotely trigger-able buffer overflow inside
	 bundled libxmlrpc library.</li>
	 </ul>
	 Security Enhancements and Fixes in PHP 5.2.2 only:
	 <ul>
	 <li>Fixed a header injection via Subject and To parameters
	 to the mail() function</li>
	 <li>Fixed wrong length calculation in unserialize S
	 type.</li>
	 <li>Fixed substr_compare and substr_count information
	 leak.</li>
	 <li>Fixed a remotely trigger-able buffer overflow inside
	 make_http_soap_request().</li>
	 <li>Fixed a buffer overflow inside
	 user_filter_factory_create().</li>
	 </ul>
	 Security Enhancements and Fixes in PHP 4.4.7 only:
	 <ul>
	 <li>XSS in phpinfo()</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1001</cvename>
 <url>http://www.php.net/releases/4_4_7.php</url>
 <url>http://www.php.net/releases/5_2_2.php</url>
 </references>
 <dates>
 <discovery>2007-05-03</discovery>
 <entry>2007-05-07</entry>
 <modified>2014-04-01</modified>
 </dates>
 </vuln>

<vuln vid="0ac89b39-f829-11db-b55c-000e0c6d38a9">
 <topic>qemu -- several vulnerabilities</topic>
 <affects>
 <package>
	<name>qemu</name>
	<name>qemu-devel</name>
	<range><lt>0.9.0_1</lt></range>
	<range><ge>0.9.0s.20070101*</ge><lt>0.9.0s.20070405_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Debian Security Team reports:
	<blockquote cite="http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00040.html">
	 Several vulnerabilities have been discovered in the QEMU processor
	 emulator, which may lead to the execution of arbitrary code or
	 denial of service. The Common Vulnerabilities and Exposures project
	 identifies the following problems:
	 CVE-2007-1320 Tavis Ormandy discovered that a memory management
	 routine of the Cirrus video driver performs insufficient bounds
	 checking, which might allow the execution of arbitrary code through
	 a heap overflow.
	 CVE-2007-1321 Tavis Ormandy discovered that the NE2000 network
	 driver and the socket code perform insufficient input validation,
	 which might allow the execution of arbitrary code through a heap
	 overflow.
	 CVE-2007-1322 Tavis Ormandy discovered that the "icebp"
	 instruction can be abused to terminate the emulation, resulting in
	 denial of service.
	 CVE-2007-1323 Tavis Ormandy discovered that the NE2000 network
	 driver and the socket code perform insufficient input validation,
	 which might allow the execution of arbitrary code through a heap
	 overflow.
	 CVE-2007-1366 Tavis Ormandy discovered that the "aam"
	 instruction can be abused to crash qemu through a division by zero,
	 resulting in denial of service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1320</cvename>
 <cvename>CVE-2007-1321</cvename>
 <cvename>CVE-2007-1322</cvename>
 <cvename>CVE-2007-1323</cvename>
 <cvename>CVE-2007-1366</cvename>
 <mlist msgid="20070501100313.GA4074@galadriel.inutil.org">http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00040.html</mlist>
 </references>
 <dates>
 <discovery>2007-05-01</discovery>
 <entry>2007-05-01</entry>
 <modified>2007-05-02</modified>
 </dates>
 </vuln>

<vuln vid="632c98be-aad2-4af2-849f-41a6862afd6a">
 <topic>p5-Imager -- possibly exploitable buffer overflow</topic>
 <affects>
 <package>
	<name>p5-Imager</name>
	<range><lt>0.57</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Imager 0.56 and all earlier versions with BMP support have
	 a security issue when reading compressed 8-bit per pixel BMP
	 files where either a compressed run of data or a literal run
	 of data overflows the scan-line.
	Such an overflow causes a buffer overflow in a malloc()
	 allocated memory buffer, possibly corrupting the memory arena
	 headers.
	The effect depends on your system memory allocator, with glibc
	 this typically results in an abort, but with other memory
	 allocators it may be possible to cause local code execution.
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1942</cvename>
 <cvename>CVE-2007-1943</cvename>
 <cvename>CVE-2007-1946</cvename>
 <cvename>CVE-2007-1948</cvename>
 <url>https://rt.cpan.org/Public/Bug/Display.html?id=26811</url>
 <url>http://ifsec.blogspot.com/2007/04/several-windows-image-viewers.html</url>
 </references>
 <dates>
 <discovery>2007-04-04</discovery>
 <entry>2007-04-30</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="275b845e-f56c-11db-8163-000e0c2e438a">
 <topic>FreeBSD -- IPv6 Routing Header 0 is dangerous</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.2</ge><lt>6.2_4</lt></range>
	<range><ge>6.1</ge><lt>6.1_16</lt></range>
	<range><ge>5.5</ge><lt>5.5_12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	There is no mechanism for preventing IPv6 routing headers
	 from being used to route packets over the same link(s) many
	 times.
	<h1>Impact</h1>
	An attacker can "amplify" a denial of service attack against
	 a link between two vulnerable hosts; that is, by sending a
	 small volume of traffic the attacker can consume a much larger
	 amount of bandwidth between the two vulnerable hosts.
	An attacker can use vulnerable hosts to "concentrate" a
	 denial of service attack against a victim host or network;
	 that is, a set of packets sent over a period of 30 seconds
	 or more could be constructed such that they all arrive at
	 the victim within a period of 1 second or less over a
	 period of 30 seconds or more could be constructed such that
	 they all arrive at the victim within a period of 1 second or
	 less.
	Other attacks may also be possible.
	<h1>Workaround</h1>
	No workaround is available.
 </body>
 </description>
 <references>
 <cvename>CVE-2007-2242</cvename>
 <freebsdsa>SA-07:03.ipv6</freebsdsa>
 </references>
 <dates>
 <discovery>2007-04-26</discovery>
 <entry>2007-04-28</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="ef2ffb03-f2b0-11db-ad25-0010b5a0a860">
 <topic>mod_perl -- remote DoS in PATH_INFO parsing</topic>
 <affects>
 <package>
	<name>mod_perl</name>
	<range><lt>1.30</lt></range>
 </package>
 <package>
	<name>mod_perl2</name>
	<range><lt>2.0.3_2,3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mandriva reports:
	<blockquote cite="http://www.mandriva.com/security/advisories?name=MDKSA-2007:083">
	 PerlRun.pm in Apache mod_perl 1.29 and earlier, and
	 RegistryCooker.pm in mod_perl 2.x, does not properly escape
	 PATH_INFO before use in a regular expression, which allows remote
	 attackers to cause a denial of service (resource consumption) via a
	 crafted URI.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1349</cvename>
 <url>http://www.mandriva.com/security/advisories?name=MDKSA-2007:083</url>
 <url>http://secunia.com/advisories/24839</url>
 </references>
 <dates>
 <discovery>2007-03-29</discovery>
 <entry>2007-04-24</entry>
 <modified>2007-06-27</modified>
 </dates>
 </vuln>

<vuln vid="c389d06d-ee57-11db-bd51-0016179b2dd5">
 <topic>claws-mail -- APOP vulnerability</topic>
 <affects>
 <package>
	<name>claws-mail</name>
	<range><lt>2.9.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1558">
	 The APOP protocol allows remote attackers to guess the first 3
	 characters of a password via man-in-the-middle (MITM) attacks
	 that use crafted message IDs and MD5 collisions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1558</cvename>
 <url>http://www.claws-mail.org/news.php</url>
 </references>
 <dates>
 <discovery>2007-04-02</discovery>
 <entry>2007-04-19</entry>
 </dates>
 </vuln>

<vuln vid="5678da43-ea99-11db-a802-000fea2763ce">
 <topic>lighttpd -- DOS when access files with mtime 0</topic>
 <affects>
 <package>
	<name>lighttpd</name>
	<range><lt>1.4.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Lighttpd SA:
	<blockquote cite="http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt">
	 Lighttpd caches the rendered string for mtime. The cache key has
	 as a default value 0. At that point the pointer to the string are
	 still NULL. If a file with an mtime of 0 is requested it tries to
	 access the pointer and crashes.
	 The bug requires that a malicious user can either upload files or
	 manipulate the mtime of the files.
	 The bug was reported by cubiq and fixed by Marcus Rueckert.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1870</cvename>
 <url>http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt</url>
 </references>
 <dates>
 <discovery>2007-01-14</discovery>
 <entry>2007-04-14</entry>
 </dates>
 </vuln>

<vuln vid="d2b48d30-ea97-11db-a802-000fea2763ce">
 <topic>lighttpd -- Remote DOS in CRLF parsing</topic>
 <affects>
 <package>
	<name>lighttpd</name>
	<range><gt>1.4.11</gt><lt>1.4.13_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Lighttpd SA:
	<blockquote cite="http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt">
	 If the connection aborts during parsing "\r\n\r\n" the server
	 might get into a infinite loop and use 100% of the CPU time.
	 lighttpd still responses to other requests. This can be repeated
	 until either the server limit for concurrent connections or file
	 descriptors is reached.
	 The bug was reported and fixed by Robert Jakabosky.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1869</cvename>
 <url>http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt</url>
 </references>
 <dates>
 <discovery>2006-12-15</discovery>
 <entry>2007-04-14</entry>
 </dates>
 </vuln>

<vuln vid="c110eda2-e995-11db-a944-0012f06707f0">
 <topic>freeradius -- EAP-TTLS Tunnel Memory Leak Remote DOS Vulnerability</topic>
 <affects>
 <package>
	<name>freeradius</name>
	<name>freeradius-mysql</name>
	<range><le>1.1.5</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The freeradius development team reports:
	<blockquote cite="http://www.freeradius.org/security.html">
	 A malicious 802.1x supplicant could send malformed Diameter format
	 attributes inside of an EAP-TTLS tunnel. The server would reject
	 the authentication request, but would leak one VALUE_PAIR data
	 structure, of approximately 300 bytes. If an attacker performed
	 the attack many times (e.g. thousands or more over a period of
	 minutes to hours), the server could leak megabytes of memory,
	 potentially leading to an "out of memory" condition, and early
	 process exit.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>23466</bid>
 <cvename>CVE-2005-1455</cvename>
 <cvename>CVE-2005-1454</cvename>
 <cvename>CVE-2007-2028</cvename>
 <cvename>CVE-2005-4745</cvename>
 <url>http://www.freeradius.org/security.html</url>
 </references>
 <dates>
 <discovery>2007-04-10</discovery>
 <entry>2007-04-13</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="f1c4d133-e6d3-11db-99ea-0060084a00e5">
 <topic>fetchmail -- insecure APOP authentication</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><lt>6.3.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2007-01.txt">
	 The POP3 standard, currently RFC-1939, has specified an optional,
	 MD5-based authentication scheme called "APOP" which no longer
	 should be considered secure.
	 Additionally, fetchmail's POP3 client implementation has been
	 validating the APOP challenge too lightly and accepted random
	 garbage as a POP3 server's APOP challenge. This made it easier
	 than necessary for man-in-the-middle attackers to retrieve by
	 several probing and guessing the first three characters of the
	 APOP secret, bringing brute forcing the remaining characters well
	 within reach.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1558</cvename>
 <url>http://www.fetchmail.info/fetchmail-SA-2007-01.txt</url>
 </references>
 <dates>
 <discovery>2007-04-06</discovery>
 <entry>2007-04-09</entry>
 </dates>
 </vuln>

<vuln vid="84d3fbb2-e607-11db-8a32-000c76189c4c">
 <topic>mcweject -- exploitable buffer overflow</topic>
 <affects>
 <package>
	<name>mcweject</name>
	<range><le>0.9</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1719">
	 Buffer overflow in eject.c in Jason W. Bacon mcweject 0.9 on
	 FreeBSD, and possibly other versions, allows local users to execute
	 arbitrary code via a long command line argument, possibly involving
	 the device name.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1719</cvename>
 <freebsdpr>ports/111365</freebsdpr>
 <url>http://www.milw0rm.com/exploits/3578</url>
 </references>
 <dates>
 <discovery>2007-03-27</discovery>
 <entry>2007-04-08</entry>
 </dates>
 </vuln>

<vuln vid="72999d57-d6f6-11db-961b-005056847b26">
 <topic>WebCalendar -- "noSet" variable overwrite vulnerability</topic>
 <affects>
 <package>
	<name>WebCalendar</name>
	<range><lt>1.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/24403/">
	 A vulnerability has been discovered in WebCalendar,
	 which can be exploited by malicious people to compromise
	 a vulnerable system.
	 Input passed to unspecified parameters is not properly
	 verified before being used with the "noSet" parameter set.
	 This can be exploited to overwrite certain variables, and
	 allows e.g. the inclusion of arbitrary PHP files from internal
	 or external resources.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1343</cvename>
 <bid>22834</bid>
 <url>http://sourceforge.net/project/shownotes.php?release_id=491130</url>
 <url>http://xforce.iss.net/xforce/xfdb/32832</url>
 </references>
 <dates>
 <discovery>2007-03-04</discovery>
 <entry>2007-04-08</entry>
 </dates>
 </vuln>

<vuln vid="34414a1e-e377-11db-b8ab-000c76189c4c">
 <topic>zope -- cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>zope</name>
	<range><lt>2.7.9_2</lt></range>
	<range><ge>2.8.0</ge><le>2.8.8</le></range>
	<range><ge>2.9.0</ge><le>2.9.6</le></range>
	<range><ge>2.10.0</ge><le>2.10.2</le></range>
 </package>
 <package>
	<name>plone</name>
	<range><lt>2.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Zope Team reports:
	<blockquote cite="http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view">
	 A vulnerability has been discovered in Zope, where by certain types
	 of misuse of HTTP GET, an attacker could gain elevated privileges.
	 All Zope versions up to and including 2.10.2 are affected.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>23084</bid>
 <cvename>CVE-2007-0240</cvename>
 <freebsdpr>ports/111119</freebsdpr>
 <url>http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view</url>
 <url>http://plone.org/products/plone/releases/2.5.3</url>
 </references>
 <dates>
 <discovery>2007-01-16</discovery>
 <entry>2007-04-05</entry>
 <modified>2009-03-22</modified>
 </dates>
 </vuln>

<vuln vid="c27bc173-d7aa-11db-b141-0016179b2dd5">
 <topic>Squid -- TRACE method handling denial of service</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><ge>2.6.*</ge><lt>2.6.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Squid advisory 2007:1 notes:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2007_1.txt">
	 Due to an internal error Squid-2.6 is vulnerable to a denial of
	 service attack when processing the TRACE request method.
	 Workarounds:
	 To work around the problem deny access to using the TRACE method by
	 inserting the following two lines before your first http_access
	 rule.
	 acl TRACE method TRACE
	 http_access deny TRACE
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1560</cvename>
 <url>http://www.squid-cache.org/Advisories/SQUID-2007_1.txt</url>
 </references>
 <dates>
 <discovery>2007-03-20</discovery>
 <entry>2007-03-21</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="8e02441d-d39c-11db-a6da-0003476f14d3">
 <topic>sql-ledger -- security bypass vulnerability</topic>
 <affects>
 <package>
	<name>sql-ledger</name>
	<range><lt>2.6.26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chris Travers reports:
	<blockquote cite="http://www.securityfocus.com/archive/1/462375">
	 George Theall of Tenable Security notified the LedgerSMB
	 core team today of an authentication bypass vulnerability
	 allowing full access to the administrator interface of
	 LedgerSMB 1.1 and SQL-Ledger 2.x. The problem is caused
	 by the password checking routine failing to enforce a
	 password check under certain circumstances. The user
	 can then create accounts or effect denial of service
	 attacks.
	 This is not related to any previous CVE.
	 We have coordinated with the SQL-Ledger vendor and
	 today both of us released security patches correcting
	 the problem. SQL-Ledger users who can upgrade to 2.6.26
	 should do so, and LedgerSMB 1.1 or 1.0 users should
	 upgrade to 1.1.9. Users who cannot upgrade should
	 configure their web servers to use http authentication
	 for the admin.pl script in the main root directory.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/110350</freebsdpr>
 <url>http://www.securityfocus.com/archive/1/462375</url>
 </references>
 <dates>
 <discovery>2007-03-09</discovery>
 <entry>2007-03-16</entry>
 </dates>
 </vuln>

<vuln vid="f235fe7a-b9ca-11db-bf0f-0013720b182d">
 <topic>samba -- potential Denial of Service bug in smbd</topic>
 <affects>
 <package>
	<name>samba</name>
	<name>ja-samba</name>
	<range><ge>3.0.6,1</ge><lt>3.0.24,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="http://www.samba.org/samba/security/CVE-2007-0452.html">
	 Internally Samba's file server daemon, smbd, implements
	 support for deferred file open calls in an attempt to serve
	 client requests that would otherwise fail due to a share mode
	 violation.	When renaming a file under certain circumstances
	 it is possible that the request is never removed from the deferred
	 open queue. smbd will then become stuck is a loop trying to
	 service the open request.
	 This bug may allow an authenticated user to exhaust resources
	 such as memory and CPU on the server by opening multiple CIFS
	 sessions, each of which will normally spawn a new smbd process,
	 and sending each connection into an infinite loop.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-0452</cvename>
 <url>http://www.samba.org/samba/security/CVE-2007-0452.html</url>
 </references>
 <dates>
 <discovery>2007-02-05</discovery>
 <entry>2007-03-16</entry>
 </dates>
 </vuln>

<vuln vid="57ae52f7-b9cc-11db-bf0f-0013720b182d">
 <topic>samba -- format string bug in afsacl.so VFS plugin</topic>
 <affects>
 <package>
	<name>samba</name>
	<name>ja-samba</name>
	<range><ge>3.0.6,1</ge><lt>3.0.24,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="http://www.samba.org/samba/security/CVE-2007-0454.html">
	 NOTE: This security advisory only impacts Samba servers
	 that share AFS file systems to CIFS clients and which have
	 been explicitly instructed in smb.conf to load the afsacl.so
	 VFS module.
	 The source defect results in the name of a file stored on
	 disk being used as the format string in a call to snprintf().
	 This bug becomes exploitable only when a user is able
	 to write to a share which utilizes Samba's afsacl.so library
	 for setting Windows NT access control lists on files residing
	 on an AFS file system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-0454</cvename>
 <url>http://www.samba.org/samba/security/CVE-2007-0454.html</url>
 </references>
 <dates>
 <discovery>2007-02-05</discovery>
 <entry>2007-03-16</entry>
 </dates>
 </vuln>

<vuln vid="73f53712-d028-11db-8c07-0211d85f11fb">
 <topic>ktorrent -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ktorrent</name>
	<range><lt>2.1.2</lt></range>
 </package>
 <package>
	<name>ktorrent-devel</name>
	<range><lt>20070311</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Two problems have been found in KTorrent:
	<ul>
	 <li>KTorrent does not properly sanitize file names to filter
	 out ".." components, so it's possible for an attacker to create
	 a malicious torrent in order to overwrite arbitrary files within
	 the filesystem.</li>
	 <li>Messages with invalid chunk indexes aren't rejected.</li>
	</ul>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-1384</cvename>
 <cvename>CVE-2007-1385</cvename>
 <url>http://ktorrent.org/forum/viewtopic.php?t=1401</url>
 </references>
 <dates>
 <discovery>2007-03-09</discovery>
 <entry>2007-03-11</entry>
 <modified>2007-03-14</modified>
 </dates>
 </vuln>

<vuln vid="abeb9b64-ce50-11db-bc24-0016179b2dd5">
 <topic>mplayer -- DMO File Parsing Buffer Overflow Vulnerability</topic>
 <affects>
 <package>
	<name>mplayer</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.10_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	"Moritz Jodeit reports:
	<blockquote cite="http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052738.html">
	 There's an exploitable buffer overflow in the current version
	 of MPlayer (v1.0rc1) which can be exploited with a maliciously
	 crafted video file. It is hidden in the DMO_VideoDecoder()
	 function of `loader/dmo/DMO_VideoDecoder.c' file.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>22771</bid>
 <cvename>CVE-2007-1246</cvename>
 </references>
 <dates>
 <discovery>2007-02-11</discovery>
 <entry>2007-03-09</entry>
 </dates>
 </vuln>

<vuln vid="e546c7ce-ce46-11db-bc24-0016179b2dd5">
 <topic>trac -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>trac</name>
	<range><lt>0.10.3</lt></range>
 </package>
 <package>
	<name>ja-trac</name>
	<range><lt>0.10.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/24470/">
	 The vulnerability is caused due to an error within the
	 "download wiki page as text" function, which can be exploited
	 to execute arbitrary HTML and script code in a user's browser
	 session in context of an affected site.
	 Successful exploitation may require that the victim uses IE.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/24470</url>
 <url>http://trac.edgewall.org/wiki/ChangeLog#a0.10.3.1</url>
 </references>
 <dates>
 <discovery>2007-03-09</discovery>
 <entry>2007-03-09</entry>
 </dates>
 </vuln>

<vuln vid="cf86c644-cb6c-11db-8e9d-000c6ec775d9">
 <topic>mod_jk -- long URL stack overflow vulnerability</topic>
 <affects>
 <package>
	<name>mod_jk-ap2</name>
	<name>mod_jk</name>
	<range><ge>1.2.19</ge><lt>1.2.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	TippingPoint and The Zero Day Initiative reports:
	<blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-07-008.html">
	 This vulnerability allows remote attackers to execute
	 arbitrary code on vulnerable installations of Apache
	 Tomcat JK Web Server Connector. Authentication is not
	 required to exploit this vulnerability.
	 The specific flaw exists in the URI handler for the
	 mod_jk.so library, map_uri_to_worker(), defined in
	 native/common/jk_uri_worker_map.c. When parsing a long URL
	 request, the URI worker map routine performs an unsafe
	 memory copy. This results in a stack overflow condition
	 which can be leveraged to execute arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-0774</cvename>
 <url>http://tomcat.apache.org/security-jk.html</url>
 <url>http://www.zerodayinitiative.com/advisories/ZDI-07-008.html</url>
 </references>
 <dates>
 <discovery>2007-03-02</discovery>
 <entry>2007-03-05</entry>
 <modified>2007-03-06</modified>
 </dates>
 </vuln>

<vuln vid="3cb6f059-c69d-11db-9f82-000e0c2e438a">
 <topic>bind -- Multiple Denial of Service vulnerabilities</topic>
 <affects>
 <package>
	<name>named</name>
	<range><lt>9.3.4</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.2</ge><lt>6.2_1</lt></range>
	<range><ge>6.1</ge><lt>6.1_13</lt></range>
	<range><ge>5.5</ge><lt>5.5_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	A type * (ANY) query response containing multiple RRsets can
	 trigger an assertion failure.
	Certain recursive queries can cause the nameserver to crash
	 by using memory which has already been freed.
	<h1>Impact:</h1>
	A remote attacker sending a type * (ANY) query to an
	 authoritative DNS server for a DNSSEC signed zone can cause
	 the named(8) daemon to exit, resulting in a Denial of
	 Service.
	A remote attacker sending recursive queries can cause the
	 nameserver to crash, resulting in a Denial of Service.
	<h1>Workaround:</h1>
	There is no workaround available, but systems which are not
	 authoritative servers for DNSSEC signed zones are not
	 affected by the first issue; and systems which do not permit
	 untrusted users to perform recursive DNS resolution are not
	 affected by the second issue. Note that the default
	 configuration for named(8) in FreeBSD allows local access
	 only (which on many systems is equivalent to refusing access
	 to untrusted users).
 </body>
 </description>
 <references>
 <cvename>CVE-2007-0493</cvename>
 <cvename>CVE-2007-0494</cvename>
 <freebsdsa>SA-07:02.bind</freebsdsa>
 </references>
 <dates>
 <discovery>2007-02-09</discovery>
 <entry>2007-02-27</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="46b922a8-c69c-11db-9f82-000e0c2e438a">
 <topic>FreeBSD -- Jail rc.d script privilege escalation</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.1</ge><lt>6.1_12</lt></range>
	<range><ge>6.0</ge><lt>6.0_17</lt></range>
	<range><ge>5.5</ge><lt>5.5_15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	In multiple situations the host's jail rc.d(8) script does
	 not check if a path inside the jail file system structure is
	 a symbolic link before using the path. In particular this is
	 the case when writing the output from the jail start-up to
	 /var/log/console.log and when mounting and unmounting file
	 systems inside the jail directory structure.
	<h1>Impact:</h1>
	Due to the lack of handling of potential symbolic links the
	 host's jail rc.d(8) script is vulnerable to "symlink
	 attacks". By replacing /var/log/console.log inside the jail
	 with a symbolic link it is possible for the superuser (root)
	 inside the jail to overwrite files on the host system outside
	 the jail with arbitrary content. This in turn can be used to
	 execute arbitrary commands with non-jailed superuser
	 privileges.
	Similarly, by changing directory mount points inside the
	 jail file system structure into symbolic links, it may be
	 possible for a jailed attacker to mount file systems which
	 were meant to be mounted inside the jail at arbitrary points
	 in the host file system structure, or to unmount arbitrary
	 file systems on the host system.
	NOTE WELL: The above vulnerabilities occur only when a jail
	 is being started or stopped using the host's jail rc.d(8)
	 script; once started (and until stopped), running jails
	 cannot exploit this.
	<h1>Workaround:</h1>
	If the sysctl(8) variable security.jail.chflags_allowed is
	 set to 0 (the default), setting the "sunlnk" system flag on
	 /var, /var/log, /var/log/console.log, and all file system
	 mount points and their parent directories inside the jail(s)
	 will ensure that the console log file and mount points are
	 not replaced by symbolic links. If this is done while jails
	 are running, the administrator must check that an attacker
	 has not replaced any directories with symlinks after setting
	 the "sunlnk" flag.
 </body>
 </description>
 <references>
 <cvename>CVE-2007-0166</cvename>
 <freebsdsa>SA-07:01.jail</freebsdsa>
 </references>
 <dates>
 <discovery>2007-01-11</discovery>
 <entry>2007-02-27</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="44449bf7-c69b-11db-9f82-000e0c2e438a">
 <topic>gtar -- name mangling symlink vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.5</ge><lt>5.5_9</lt></range>
	<range><ge>4.11</ge><lt>4.11_26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Symlinks created using the "GNUTYPE_NAMES" tar extension can
	 be absolute due to lack of proper sanity checks.
	<h1>Impact:</h1>
	If an attacker can get a user to extract a specially crafted
	 tar archive the attacker can overwrite arbitrary files with
	 the permissions of the user running gtar. If file system
	 permissions allow it, this may allow the attacker to overwrite
	 important system file (if gtar is being run as root), or
	 important user configuration files such as .tcshrc or .bashrc,
	 which would allow the attacker to run arbitrary commands.
	<h1>Workaround:</h1>
	Use "bsdtar", which is the default tar implementation in
	 FreeBSD 5.3 and higher. For FreeBSD 4.x, bsdtar is available
	 in the FreeBSD Ports Collection as
	 ports/archivers/libarchive.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-6097</cvename>
 <freebsdsa>SA-06:26.gtar</freebsdsa>
 </references>
 <dates>
 <discovery>2006-12-06</discovery>
 <entry>2007-02-27</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="5c554c0f-c69a-11db-9f82-000e0c2e438a">
 <topic>FreeBSD -- Kernel memory disclosure in firewire(4)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.1</ge><lt>6.1_11</lt></range>
	<range><ge>6.0</ge><lt>6.2_16</lt></range>
	<range><ge>5.5</ge><lt>5.5_9</lt></range>
	<range><ge>4.11</ge><lt>4.11_26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	In the FW_GCROM ioctl, a signed integer comparison is used
	 instead of an unsigned integer comparison when computing the
	 length of a buffer to be copied from the kernel into the
	 calling application.
	<h1>Impact:</h1>
	A user in the "operator" group can read the contents of
	 kernel memory. Such memory might contain sensitive
	 information, such as portions of the file cache or terminal
	 buffers. This information might be directly useful, or it
	 might be leveraged to obtain elevated privileges in some way;
	 for example, a terminal buffer might include a user-entered
	 password.
	<h1>Workaround:</h1>
	No workaround is available, but systems without IEEE 1394
	 ("FireWire") interfaces are not vulnerable. (Note that
	 systems with IEEE 1394 interfaces are affected regardless of
	 whether any devices are attached.)
	Note also that FreeBSD does not have any non-root users in
	 the "operator" group by default; systems on which no users
	 have been added to this group are therefore also not
	 vulnerable.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-6013</cvename>
 <freebsdsa>SA-06:25.kmem</freebsdsa>
 </references>
 <dates>
 <discovery>2006-12-06</discovery>
 <entry>2007-02-27</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="792bc222-c5d7-11db-9f82-000e0c2e438a">
 <topic>libarchive -- Infinite loop in corrupt archives handling in libarchive</topic>
 <affects>
 <package>
	<name>libarchive</name>
	<range><lt>1.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	If the end of an archive is reached while attempting to
	 "skip" past a region of an archive, libarchive will enter an
	 infinite loop wherein it repeatedly attempts (and fails) to
	 read further data.
	<h1>Impact:</h1>
	An attacker able to cause a system to extract (via "tar -x"
	 or another application which uses libarchive) or list the
	 contents (via "tar -t" or another libarchive-using
	 application) of an archive provided by the attacker can cause
	 libarchive to enter an infinite loop and use all available
	 CPU time.
	<h1>Workaround:</h1>
	No workaround is available.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-5680</cvename>
 <freebsdsa>SA-06:24.libarchive</freebsdsa>
 </references>
 <dates>
 <discovery>2006-11-08</discovery>
 <entry>2007-02-26</entry>
 </dates>
 </vuln>

<vuln vid="0f37d765-c5d4-11db-9f82-000e0c2e438a">
 <topic>OpenSSL -- Multiple problems in crypto(3)</topic>
 <affects>
 <package>
	<name>openssl</name>
	<range><lt>0.9.7l_0</lt></range>
	<range><ge>0.9.8</ge><lt>0.9.8d_0</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.1</ge><lt>6.1_9</lt></range>
	<range><ge>6.0</ge><lt>6.0_14</lt></range>
	<range><ge>5.5</ge><lt>5.5_7</lt></range>
	<range><ge>5.4</ge><lt>5.4_21</lt></range>
	<range><ge>5.3</ge><lt>5.3_36</lt></range>
	<range><ge>4.11</ge><lt>4.11_24</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	Several problems have been found in OpenSSL:
	<ul>
	 <li>During the parsing of certain invalid ASN1 structures an
	 error condition is mishandled, possibly resulting in an
	 infinite loop.</li>
	 <li>A buffer overflow exists in the SSL_get_shared_ciphers
	 function.</li>
	 <li>A NULL pointer may be dereferenced in the SSL version 2
	 client code.</li>
	</ul>
	In addition, many applications using OpenSSL do not perform
	 any validation of the lengths of public keys being used.
	<h1>Impact:</h1>
	Servers which parse ASN1 data from untrusted sources may be
	 vulnerable to a denial of service attack.
	An attacker accessing a server which uses SSL version 2 may
	 be able to execute arbitrary code with the privileges of that
	 server.
	A malicious SSL server can cause clients connecting using
	 SSL version 2 to crash.
	Applications which perform public key operations using
	 untrusted keys may be vulnerable to a denial of service
	 attack.
	<h1>Workaround:</h1>
	No workaround is available, but not all of the
	 vulnerabilities mentioned affect all applications.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-2937</cvename>
 <cvename>CVE-2006-2938</cvename>
 <cvename>CVE-2006-2940</cvename>
 <cvename>CVE-2006-3738</cvename>
 <cvename>CVE-2006-4343</cvename>
 <freebsdsa>SA-06:23.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2006-09-28</discovery>
 <entry>2007-02-26</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="12bd6ecf-c430-11db-95c5-000c6ec775d9">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.5.0.10,1</lt></range>
	<range><gt>2.*,1</gt><lt>2.0.0.2,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.5.0.10</lt></range>
 </package>
 <package>
	<name>lightning</name>
	<range><lt>0.3.1</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.0.8</lt></range>
	<range><ge>1.1</ge><lt>1.1.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<name>mozilla-thunderbird</name>
	<range><lt>1.5.0.10</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.a2007.04.18</lt></range>
 </package>
 <package>
	<name>linux-seamonkey-devel</name>
	<range><lt>1.5.a2007.04.18</lt></range>
 </package>
 <package>
	<name>firefox-ja</name>
	<name>linux-mozilla-devel</name>
	<name>linux-mozilla</name>
	<name>mozilla</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports of multiple security issues
	 in Firefox, Seamonkey, and Thunderbird. Several of these
	 issues can probably be used to run arbitrary code with the
	 privilege of the user running the program.
	<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.2">
	 <ul>
	 <li>MFSA 2007-08 onUnload + document.write() memory corruption</li>
	 <li>MFSA 2007-07 Embedded nulls in location.hostname confuse same-domain checks</li>
	 <li>MFSA 2007-06 Mozilla Network Security Services (NSS) SSLv2 buffer overflow</li>
	 <li>MFSA 2007-05 XSS and local file access by opening blocked popups</li>
	 <li>MFSA 2007-04 Spoofing using custom cursor and CSS3 hotspot</li>
	 <li>MFSA 2007-03 Information disclosure through cache collisions</li>
	 <li>MFSA 2007-02 Improvements to help protect against Cross-Site Scripting attacks</li>
	 <li>MFSA 2007-01 Crashes with evidence of memory corruption (rv:1.8.0.10/1.8.1.2)</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-6077</cvename>
 <cvename>CVE-2007-0008</cvename>
 <cvename>CVE-2007-0009</cvename>
 <cvename>CVE-2007-0775</cvename>
 <cvename>CVE-2007-0776</cvename>
 <cvename>CVE-2007-0777</cvename>
 <cvename>CVE-2007-0778</cvename>
 <cvename>CVE-2007-0779</cvename>
 <cvename>CVE-2007-0780</cvename>
 <cvename>CVE-2007-0800</cvename>
 <cvename>CVE-2007-0981</cvename>
 <cvename>CVE-2007-0995</cvename>
 <cvename>CVE-2007-1092</cvename>
 <url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=482</url>
 <url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=483</url>
 <url>http://www.mozilla.org/security/announce/2007/mfsa2007-01.html</url>
 <url>http://www.mozilla.org/security/announce/2007/mfsa2007-02.html</url>
 <url>http://www.mozilla.org/security/announce/2007/mfsa2007-03.html</url>
 <url>http://www.mozilla.org/security/announce/2007/mfsa2007-04.html</url>
 <url>http://www.mozilla.org/security/announce/2007/mfsa2007-05.html</url>
 <url>http://www.mozilla.org/security/announce/2007/mfsa2007-06.html</url>
 <url>http://www.mozilla.org/security/announce/2007/mfsa2007-07.html</url>
 <url>http://www.mozilla.org/security/announce/2007/mfsa2007-08.html</url>
 </references>
 <dates>
 <discovery>2007-02-23</discovery>
 <entry>2007-02-24</entry>
 <modified>2007-04-19</modified>
 </dates>
 </vuln>

<vuln vid="afdf500f-c1f6-11db-95c5-000c6ec775d9">
 <topic>snort -- DCE/RPC preprocessor vulnerability</topic>
 <affects>
 <package>
	<name>snort</name>
	<range><ge>2.6.1</ge><lt>2.6.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A IBM Internet Security Systems Protection Advisory
	 reports:
	<blockquote cite="http://iss.net/threats/257.html">
	 Snort is vulnerable to a stack-based buffer overflow as a
	 result of DCE/RPC reassembly. This vulnerability is in a
	 dynamic-preprocessor enabled in the default configuration,
	 and the configuration for this preprocessor allows for
	 auto-recognition of SMB traffic to perform reassembly
	 on. No checks are performed to see if the traffic is part
	 of a valid TCP session, and multiple Write AndX requests
	 can be chained in the same TCP segment. As a result, an
	 attacker can exploit this overflow with a single TCP PDU
	 sent across a network monitored by Snort or Sourcefire.
	 Snort users who cannot upgrade immediately are advised to
	 disable the DCE/RPC preprocessor by removing the DCE/RPC
	 preprocessor directives from snort.conf and restarting
	 Snort. However, be advised that disabling the DCE/RPC
	 preprocessor reduces detection capabilities for attacks in
	 DCE/RPC traffic. After upgrading, customers should
	 re-enable the DCE/RPC preprocessor.
	</blockquote>
 </body>
 </description>
 <references>
 <certvu>196240</certvu>
 <cvename>CVE-2006-5276</cvename>
 <url>http://xforce.iss.net/xforce/xfdb/31275</url>
 <url>http://www.snort.org/docs/advisory-2007-02-19.html</url>
 </references>
 <dates>
 <discovery>2007-02-19</discovery>
 <entry>2007-02-21</entry>
 </dates>
 </vuln>

<vuln vid="94234e00-be8a-11db-b2ec-000c6ec775d9">
 <topic>rar -- password prompt buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>rar</name>
	<range><lt>3.70.b1,1</lt></range>
 </package>
 <package>
	<name>unrar</name>
	<name>zh-unrar</name>
	<range><lt>3.70.b1,4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	iDefense reports:
	<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=472">
	 Remote exploitation of a stack based buffer overflow
	 vulnerability in RARLabs Unrar may allow an attacker to
	 execute arbitrary code with the privileges of the user
	 opening the archive.
	 Unrar is prone to a stack based buffer overflow when
	 processing specially crafted password protected
	 archives.
	 If users are using the vulnerable command line based
	 unrar, they still need to interact with the program in
	 order to trigger the vulnerability. They must respond to
	 the prompt asking for the password, after which the
	 vulnerability will be triggered. They do not need to enter
	 a correct password, but they must at least push the enter
	 key.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>22447</bid>
 <cvename>CVE-2007-0855</cvename>
 <url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=472</url>
 <url>http://www.rarsoft.com/rarnew.htm</url>
 </references>
 <dates>
 <discovery>2007-02-07</discovery>
 <entry>2007-02-17</entry>
 </dates>
 </vuln>

<vuln vid="7fcf1727-be71-11db-b2ec-000c6ec775d9">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php5-imap</name>
	<name>php5-odbc</name>
	<name>php5-session</name>
	<name>php5-shmop</name>
	<name>php5-sqlite</name>
	<name>php5-wddx</name>
	<name>php5</name>
	<range><lt>5.2.1_2</lt></range>
 </package>
 <package>
	<name>php4-odbc</name>
	<name>php4-session</name>
	<name>php4-shmop</name>
	<name>php4-wddx</name>
	<name>php4</name>
	<range><lt>4.4.5</lt></range>
 </package>
 <package>
	<name>mod_php4-twig</name>
	<name>mod_php4</name>
	<name>mod_php5</name>
	<name>mod_php</name>
	<name>php4-cgi</name>
	<name>php4-cli</name>
	<name>php4-dtc</name>
	<name>php4-horde</name>
	<name>php4-nms</name>
	<name>php5-cgi</name>
	<name>php5-cli</name>
	<name>php5-dtc</name>
	<name>php5-horde</name>
	<name>php5-nms</name>
	<range><ge>4</ge><lt>4.4.5</lt></range>
	<range><ge>5</ge><lt>5.2.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple vulnerabilities have been found in PHP, including:
	 buffer overflows, stack overflows, format string, and
	 information disclosure vulnerabilities.
	The session extension contained <code>safe_mode</code> and
	 <code>open_basedir</code> bypasses, but the FreeBSD Security
	 Officer does not consider these real security
	 vulnerabilities, since <code>safe_mode</code> and
	 <code>open_basedir</code> are insecure by design and should
	 not be relied upon.
 </body>
 </description>
 <references>
 <cvename>CVE-2007-0905</cvename>
 <cvename>CVE-2007-0906</cvename>
 <cvename>CVE-2007-0907</cvename>
 <cvename>CVE-2007-0908</cvename>
 <cvename>CVE-2007-0909</cvename>
 <cvename>CVE-2007-0910</cvename>
 <cvename>CVE-2007-0988</cvename>
 <url>http://secunia.com/advisories/24089/</url>
 <url>http://www.php.net/releases/4_4_5.php</url>
 <url>http://www.php.net/releases/5_2_1.php</url>
 </references>
 <dates>
 <discovery>2007-02-09</discovery>
 <entry>2007-02-17</entry>
 <modified>2013-04-01</modified>
 </dates>
 </vuln>

<vuln vid="7bb127c1-a5aa-11db-9ddc-0011098b2f36">
 <topic>joomla -- multiple remote vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla</name>
	<range><lt>1.0.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/23563/">
	 Some vulnerabilities have been reported in Joomla!, where some
	 have unknown impacts and one can be exploited by malicious people
	 to conduct cross-site scripting attacks.
	 <ol>
	 <li>Input passed to an unspecified parameter is not properly
	 sanitised before being returned to the user. This can be
	 exploited to execute arbitrary HTML and script code in a
	 user's browser session in context of an affected site.</li>
	 <li>The vulnerabilities are caused due to unspecified errors
	 in Joomla!. The vendor describes them as "several low level
	 security issues". No further information is currently
	 available.</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>21810</bid>
 <cvename>CVE-2006-6832</cvename>
 <cvename>CVE-2006-6833</cvename>
 <cvename>CVE-2006-6834</cvename>
 <url>http://secunia.com/advisories/23563/</url>
 </references>
 <dates>
 <discovery>2006-12-29</discovery>
 <entry>2007-01-17</entry>
 </dates>
 </vuln>

<vuln vid="1374b96c-a1c2-11db-9ddc-0011098b2f36">
 <topic>sircd -- remote reverse DNS buffer overflow</topic>
 <affects>
 <package>
 <name>sircd</name>
 <range><le>0.4.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/8153/">
	 A vulnerability in sircd can be exploited by a malicious person
	 to compromise a vulnerable system. The vulnerability is caused
	 by a boundary error in the code handling reverse DNS lookups,
	 when a user connects to the service. If the FQDN (Fully Qualified
	 Domain Name) returned is excessively long, the allocated buffer
	 is overflowed making it possible to execute arbitrary code on the
	 system with the privileges of the sircd daemon.
 </blockquote>
 </body>
 </description>
 <references>
 <bid>6924</bid>
 <url>http://secunia.com/advisories/8153</url>
 </references>
 <dates>
 <discovery>2003-02-24</discovery>
 <entry>2007-01-15</entry>
 </dates>
 </vuln>

<vuln vid="e92d8f6b-a1c0-11db-9ddc-0011098b2f36">
 <topic>sircd -- remote operator privilege escalation vulnerability</topic>
 <affects>
 <package>
 <name>sircd</name>
 <range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/10274/">
	 A vulnerability has been reported in sircd, which can be
	 exploited by malicious users to gain operator privileges.
	 The problem is that any user reportedly can set their usermode
	 to operator. The vulnerability has been reported in
	 versions 0.5.2 and 0.5.3. Other versions may also be affected.
 </blockquote>
 </body>
 </description>
 <references>
 <bid>9097</bid>
 <url>http://secunia.com/advisories/10274/</url>
 </references>
 <dates>
 <discovery>2003-11-20</discovery>
 <entry>2007-01-15</entry>
 </dates>
 </vuln>

<vuln vid="41da2ba4-a24e-11db-bd24-000f3dcc6a5d">
 <topic>cacti -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>0.8.6i.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/23528/">
	 rgod has discovered four vulnerabilities in Cacti,
	 which can be exploited by malicious people to bypass
	 certain security restrictions, manipulate data
	 and compromise vulnerable systems.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/23528/</url>
 <url>http://forums.cacti.net/about18846-0-asc-0.html</url>
 </references>
 <dates>
 <discovery>2006-12-28</discovery>
 <entry>2007-01-12</entry>
 </dates>
 </vuln>

<vuln vid="b2ff68b2-9f29-11db-a4e4-0211d87675b7">
 <topic>mplayer -- buffer overflow in the code for RealMedia RTSP streams.</topic>
 <affects>
 <package>
	<name>mplayer</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.10_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.mplayerhq.hu/design7/news.html">
	A potential buffer overflow was found in the code used to handle
	RealMedia RTSP streams. When checking for matching asm rules, the code
	stores the results in a fixed-size array, but no boundary checks are
	performed. This may lead to a buffer overflow if the user is tricked
	into connecting to a malicious server. Since the attacker cannot write
	arbitrary data into the buffer, creating an exploit is very hard; but a
	DoS attack is easily made.
	A fix for this problem was committed to SVN on Sun Dec 31 13:27:53 2006
	UTC as r21799. The fix involves three files: stream/realrtsp/asmrp.c,
	stream/realrtsp/asmrp.h and stream/realrtsp/real.c.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/107217</freebsdpr>
 <cvename>CVE-2006-6172</cvename>
 <url>http://www.mplayerhq.hu/design7/news.html</url>
 </references>
 <dates>
 <discovery>2006-12-31</discovery>
 <entry>2007-01-08</entry>
 </dates>
 </vuln>

<vuln vid="37e30313-9d8c-11db-858b-0060084a00e5">
 <topic>fetchmail -- crashes when refusing a message bound for an MDA</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><ge>6.3.5</ge><lt>6.3.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2006-03.txt">
	 When delivering messages to a message delivery agent by means
	 of the "mda" option, fetchmail can crash (by passing
	 a NULL pointer to ferror() and fflush()) when refusing a message.
	 SMTP and LMTP delivery modes aren't affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-5974</cvename>
 <url>http://www.fetchmail.info/fetchmail-SA-2006-03.txt</url>
 </references>
 <dates>
 <discovery>2007-01-04</discovery>
 <entry>2007-01-06</entry>
 </dates>
 </vuln>

<vuln vid="5238ac45-9d8c-11db-858b-0060084a00e5">
 <topic>fetchmail -- TLS enforcement problem/MITM attack/password exposure</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><lt>6.3.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2006-02.txt">
	 Fetchmail has had several longstanding password disclosure
	 vulnerabilities.
	 <ul>
	 <li>sslcertck/sslfingerprint options should have implied
	 "sslproto tls1" in order to enforce TLS negotiation,
	 but did not.</li>
	 <li>Even with "sslproto tls1" in the config, fetches
	 would go ahead in plain text if STLS/STARTTLS wasn't available
	 (not advertised, or advertised but rejected).</li>
	 <li>POP3 fetches could completely ignore all TLS options
	 whether available or not because it didn't reliably issue
	 CAPA before checking for STLS support - but CAPA is a
	 requisite for STLS. Whether or not CAPAbilities were probed,
	 depended on the "auth" option. (Fetchmail only
	 tried CAPA if the auth option was not set at all, was set
	 to gssapi, kerberos, kerberos_v4, otp, or cram-md5.)</li>
	 <li>POP3 could fall back to using plain text passwords, even
	 if strong authentication had been configured.</li>
	 <li>POP2 would not complain if strong authentication or TLS
	 had been requested.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-5867</cvename>
 <url>http://www.fetchmail.info/fetchmail-SA-2006-02.txt</url>
 </references>
 <dates>
 <discovery>2007-01-04</discovery>
 <entry>2007-01-06</entry>
 </dates>
 </vuln>

<vuln vid="78ad2525-9d0c-11db-a5f6-000c6ec775d9">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>9.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	iDefense reports:
	<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457">
	 The vulnerability specifically exists due to Opera
	 improperly processing a JPEG DHT marker. The DHT marker is
	 used to define a Huffman Table which is used for decoding
	 the image data. An invalid number of index bytes in the
	 DHT marker will trigger a heap overflow with partially
	 user controlled data.
	 Exploitation of this vulnerability would allow an
	 attacker to execute arbitrary code on the affected
	 host. The attacker would first need to construct a website
	 containing the malicious image and trick the vulnerable
	 user into visiting the site. This would trigger the
	 vulnerability and allow the code to execute with the
	 privileges of the local user.
	</blockquote>
	<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=458">
	 A flaw exists within Opera's Javascript SVG
	 implementation. When processing a
	 createSVGTransformFromMatrix request Opera does not
	 properly validate the type of object passed to the
	 function. Passing an incorrect object to this function can
	 result in it using a pointer that is user controlled when
	 it attempts to make the virtual function call.
	 Exploitation of this vulnerability would allow an
	 attacker to execute arbitrary code on the affected
	 host. The attacker would first need to construct a website
	 containing the malicious JavaScript and trick the
	 vulnerable user into visiting the site. This would trigger
	 the vulnerability and allow the code to execute with the
	 privileges of the local user.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-0126</cvename>
 <cvename>CVE-2007-0127</cvename>
 <url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457</url>
 <url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=458</url>
 <url>http://www.opera.com/support/search/supsearch.dml?index=851</url>
 <url>http://www.opera.com/support/search/supsearch.dml?index=852</url>
 </references>
 <dates>
 <discovery>2007-01-05</discovery>
 <entry>2007-01-05</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="3d8d3548-9d02-11db-a541-000ae42e9b93">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal</name>
	<range><gt>4.7</gt><lt>4.7.5</lt></range>
	<range><lt>4.6.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal security team reports:
	<blockquote cite="http://drupal.org/files/sa-2007-001/advisory.txt">
	 A few arguments passed via URLs are not properly sanitized
	 before display. When an attacker is able to entice an
	 administrator to follow a specially crafted link, arbitrary
	 HTML and script code can be injected and executed in the
	 victim's session. Such an attack may lead to administrator
	 access if certain conditions are met.
	</blockquote>
	<blockquote cite="http://drupal.org/files/sa-2007-002/advisory.txt">
	 The way page caching was implemented allows a denial of
	 service attack. An attacker has to have the ability to post
	 content on the site. He or she would then be able to poison
	 the page cache, so that it returns cached 404 page not found
	 errors for existing pages.
	 If the page cache is not enabled, your site is not vulnerable.
	 The vulnerability only affects sites running on top of MySQL.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2007-0136</cvename>
 <url>http://drupal.org/files/sa-2007-001/advisory.txt</url>
 <url>http://drupal.org/files/sa-2007-002/advisory.txt</url>
 </references>
 <dates>
 <discovery>2007-01-05</discovery>
 <entry>2007-01-05</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="9347d82d-9a66-11db-b271-000e35248ad7">
 <topic>w3m -- format string vulnerability</topic>
 <affects>
 <package>
	<name>w3m</name>
	<name>w3m-img</name>
	<name>w3m-m17n</name>
	<name>w3m-m17n-img</name>
	<name>ja-w3m</name>
	<name>ja-w3m-img</name>
	<range><lt>0.5.1_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An anonymous person reports:
	<blockquote cite="http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1612792&amp;group_id=39518&amp;atid=425439">
	 w3m-0.5.1 crashes when using the -dump or -backend options to
	 open a HTTPS URL with a SSL certificate where the CN contains
	 "%n%n%n%n%n%n".
	</blockquote>
 </body>
 </description>
 <references>
 <bid>21735</bid>
 <cvename>CVE-2006-6772</cvename>
 <url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1612792&amp;group_id=39518&amp;atid=425439</url>
 <url>http://secunia.com/advisories/23492/</url>
 </references>
 <dates>
 <discovery>2006-12-10</discovery>
 <entry>2007-01-03</entry>
 </dates>
 </vuln>

<vuln vid="f4ff7434-9505-11db-9ddc-0011098b2f36">
 <topic>plone -- user can masquerade as a group</topic>
 <affects>
 <package>
	<name>plone</name>
	<range><gt>2.5</gt><lt>2.5.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Plone.org reports:
	<blockquote cite="http://plone.org/products/plone-hotfix/releases/20061031">
	 PlonePAS-using Plone releases (Plone 2.5 and Plone 2.5.1) has a
	 potential vulnerability that allows a user to masquerade as a group.
	 Please update your sites.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>21460</bid>
 <cvename>CVE-2006-4249</cvename>
 <url>http://plone.org/products/plone-hotfix/releases/20061031</url>
 </references>
 <dates>
 <discovery>2006-11-02</discovery>
 <entry>2006-12-27</entry>
 </dates>
 </vuln>

<vuln vid="3f851b22-89fb-11db-a937-003048116330">
 <topic>proftpd -- remote code execution vulnerabilities</topic>
 <affects>
 <package>
	<name>proftpd</name>
	<name>proftpd-mysql</name>
	<range><lt>1.3.0_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The proftpd development team reports that several
	 remote buffer overflows had been found in the
	 proftpd server.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-5815</cvename>
 <cvename>CVE-2006-6170</cvename>
 </references>
 <dates>
 <discovery>2006-11-10</discovery>
 <entry>2006-12-21</entry>
 </dates>
 </vuln>

<vuln vid="11a84092-8f9f-11db-ab33-000e0c2e438a">
 <topic>gzip -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.1</ge><lt>6.1_7</lt></range>
	<range><ge>6.0</ge><lt>6.0_12</lt></range>
	<range><ge>5.5</ge><lt>5.5_5</lt></range>
	<range><ge>5.4</ge><lt>5.4_19</lt></range>
	<range><ge>5.3</ge><lt>5.3_34</lt></range>
	<range><lt>4.11_22</lt></range>
 </package>
 <package>
	<name>gzip</name>
	<range><lt>1.3.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	Multiple programming errors have been found in gzip which
	 can be triggered when gzip is decompressing files. These
	 errors include insufficient bounds checks in buffer use, a
	 NULL pointer dereference, and a potential infinite loop.
	<h1>Impact</h1>
	The insufficient bounds checks in buffer use can cause gzip
	 to crash, and may permit the execution of arbitrary code.
	 The NULL pointer deference can cause gzip to crash. The
	 infinite loop can cause a Denial-of-Service situation where
	 gzip uses all available CPU time.
	<h1>Workaround</h1>
	No workaround is available.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4334</cvename>
 <cvename>CVE-2006-4335</cvename>
 <cvename>CVE-2006-4336</cvename>
 <cvename>CVE-2006-4337</cvename>
 <cvename>CVE-2006-4338</cvename>
 <freebsdsa>SA-06:21.gzip</freebsdsa>
 </references>
 <dates>
 <discovery>2006-09-19</discovery>
 <entry>2006-12-19</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="ef3306fc-8f9b-11db-ab33-000e0c2e438a">
 <topic>bind9 -- Denial of Service in named(8)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.1</ge><lt>6.1_6</lt></range>
	<range><ge>6.0</ge><lt>6.0_11</lt></range>
	<range><ge>5.5</ge><lt>5.5_4</lt></range>
	<range><ge>5.4</ge><lt>5.4_18</lt></range>
	<range><ge>5.0</ge><lt>5.3_33</lt></range>
 </package>
 <package>
	<name>bind9</name>
	<range><ge>9.0</ge><lt>9.3.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	For a recursive DNS server, a remote attacker sending enough
	 recursive queries for the replies to arrive after all the
	 interested clients have left the recursion queue will trigger
	 an INSIST failure in the named(8) daemon. Also for a
	 recursive DNS server, an assertion failure can occur when
	 processing a query whose reply will contain more than one
	 SIG(covered) RRset.
	For an authoritative DNS server serving a RFC 2535 DNSSEC
	 zone which is queried for the SIG records where there are
	 multiple SIG(covered) RRsets (e.g. a zone apex), named(8)
	 will trigger an assertion failure when it tries to construct
	 the response.
	<h1>Impact</h1>
	An attacker who can perform recursive lookups on a DNS server
	 and is able to send a sufficiently large number of recursive
	 queries, or is able to get the DNS server to return more than
	 one SIG(covered) RRsets can stop the functionality of the DNS
	 service.
	An attacker querying an authoritative DNS server serving a
	 RFC 2535 DNSSEC zone may be able to crash the DNS server.
	<h1>Workaround</h1>
	A possible workaround is to only allow trusted clients to
	 perform recursive queries.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4095</cvename>
 <cvename>CVE-2006-4096</cvename>
 <freebsdsa>SA-06:20.bind</freebsdsa>
 </references>
 <dates>
 <discovery>2006-09-06</discovery>
 <entry>2006-12-19</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="077c2dca-8f9a-11db-ab33-000e0c2e438a">
 <topic>openssl -- Incorrect PKCS#1 v1.5 padding validation in crypto(3)</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.1</ge><lt>6.1_6</lt></range>
	<range><ge>6.0</ge><lt>6.0_11</lt></range>
	<range><ge>5.5</ge><lt>5.5_4</lt></range>
	<range><ge>5.4</ge><lt>5.4_18</lt></range>
	<range><ge>5.3</ge><lt>5.3_33</lt></range>
	<range><lt>4.11_21</lt></range>
 </package>
 <package>
	<name>openssl</name>
	<range><gt>0.9.8</gt><lt>0.9.8c_9</lt></range>
	<range><lt>0.9.7k_0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	When verifying a PKCS#1 v1.5 signature, OpenSSL ignores any
	 bytes which follow the cryptographic hash being signed. In
	 a valid signature there will be no such bytes.
	<h1>Impact</h1>
	OpenSSL will incorrectly report some invalid signatures as
	 valid. When an RSA public exponent of 3 is used, or more
	 generally when a small public exponent is used with a
	 relatively large modulus (e.g., a public exponent of 17 with
	 a 4096-bit modulus), an attacker can construct a signature
	 which OpenSSL will accept as a valid PKCS#1 v1.5 signature.
	<h1>Workaround</h1>
	No workaround is available.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4339</cvename>
 <freebsdsa>SA-06:19.openssl</freebsdsa>
 </references>
 <dates>
 <discovery>2006-09-06</discovery>
 <entry>2006-12-19</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="0679deeb-8eaf-11db-abc9-0003476f14d3">
 <topic>sql-ledger -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>sql-ledger</name>
	<range><lt>2.6.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Debian security Team reports:
	<blockquote cite="http://www.us.debian.org/security/2006/dsa-1239">
	 Several remote vulnerabilities have been discovered in SQL
	 Ledger, a web based double-entry accounting program, which may
	 lead to the execution of arbitrary code. The Common
	 Vulnerabilities and Exposures project identifies the following
	 problems:
	 Chris Travers discovered that the session management can be
	 tricked into hijacking existing sessions.
	 Chris Travers discovered that directory traversal
	 vulnerabilities can be exploited to execute arbitrary Perl
	 code.
	 It was discovered that missing input sanitising allows
	 execution of arbitrary Perl code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4244</cvename>
 <cvename>CVE-2006-4731</cvename>
 <cvename>CVE-2006-5872</cvename>
 <url>http://www.us.debian.org/security/2006/dsa-1239</url>
 </references>
 <dates>
 <discovery>2006-12-17</discovery>
 <entry>2006-12-18</entry>
 </dates>
 </vuln>

<vuln vid="5b47b70d-8ba9-11db-81d5-00123ffe8333">
 <topic>dbus -- match_rule_equal() Weakness</topic>
 <affects>
 <package>
	<name>dbus</name>
	<range><lt>1.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/23373/">
	 D-Bus have a weakness, which can be exploited by malicious, local
	 users to cause a DoS (Denial of Service).
	 An error within the "match_rule_equal()" function can be
	 exploited to disable the ability of other processes to receive
	 messages by removing their matches from D-Bus.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-6107</cvename>
 <url>http://www.freedesktop.org/wiki/Software/dbus</url>
 <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218055</url>
 <url>http://secunia.com/advisories/23373/</url>
 </references>
 <dates>
 <discovery>2006-12-12</discovery>
 <entry>2006-12-14</entry>
 </dates>
 </vuln>

<vuln vid="779a2d55-8ba8-11db-81d5-00123ffe8333">
 <topic>evince -- Buffer Overflow Vulnerability</topic>
 <affects>
 <package>
	<name>evince</name>
	<range><lt>0.6.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/23111/">
	 A vulnerability has been discovered in Evince, which can be
	 exploited by malicious people to compromise a user's system.
	 The vulnerability is caused due to a boundary error within the
	 "get_next_text()" function in ps/ps.c. This can be exploited to
	 cause a buffer overflow by e.g. tricking a user into opening a
	 specially crafted PostScript file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-5864</cvename>
 <url>http://secunia.com/advisories/23111/</url>
 </references>
 <dates>
 <discovery>2006-11-27</discovery>
 <entry>2006-12-14</entry>
 </dates>
 </vuln>

<vuln vid="fefd93d8-8af5-11db-9d01-0016179b2dd5">
 <topic>tdiary -- injection vulnerability</topic>
 <affects>
 <package>
	<name>ja-tdiary</name>
	<name>tdiary</name>
	<range><le>2.0.3</le></range>
 </package>
 <package>
	<name>ja-tdiary-devel</name>
	<name>tdiary-devel</name>
	<range><gt>2.1</gt><lt>2.1.4_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An undisclosed eRuby injection vulnerability had been discovered in
	 tDiary.
 </body>
 </description>
 <references>
 <url>http://sourceforge.net/forum/forum.php?forum_id=642685</url>
 </references>
 <dates>
 <discovery>2006-12-10</discovery>
 <entry>2006-12-13</entry>
 <modified>2007-03-16</modified>
 </dates>
 </vuln>

<vuln vid="d29dc506-8aa6-11db-bd0d-00123ffe8333">
 <topic>wv -- Multiple Integer Overflow Vulnerabilities</topic>
 <affects>
 <package>
	<name>wv</name>
	<range><lt>1.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/22595/">
	 Some vulnerabilities have been reported in wvWare, which can be
	 exploited by malicious people to cause a DoS (Denial of Service)
	 and potentially compromise an application using the library.
	 The vulnerabilities are caused due to integer overflows within
	 the "wvGetLFO_records()" and "wvGetLFO_PLF()" functions. These can
	 be exploited to cause heap-based buffer overflows by e.g. tricking
	 a user to open a specially crafted Microsoft Word document with an
	 application using the library.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4513</cvename>
 <url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=433</url>
 <url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=434</url>
 <url>http://secunia.com/advisories/22595/</url>
 </references>
 <dates>
 <discovery>2006-10-26</discovery>
 <entry>2006-12-13</entry>
 </dates>
 </vuln>

<vuln vid="b9044cc2-8aa5-11db-bd0d-00123ffe8333">
 <topic>wv2 -- Integer Overflow Vulnerability</topic>
 <affects>
 <package>
	<name>wv2</name>
	<range><lt>0.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/20665/">
	 A vulnerability has been reported in wvWare wv2 Library, which
	 potentially can be exploited by malicious people to compromise an
	 application using the library.
	 The vulnerability is caused due to an integer overflow error in
	 "word_helper.h" when handling a Word document. This can be
	 exploited to cause a buffer overflow and may allow arbitrary code
	 execution via a specially crafted Word document.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-2197</cvename>
 <url>http://secunia.com/advisories/20665/</url>
 </references>
 <dates>
 <discovery>2006-06-12</discovery>
 <entry>2006-12-13</entry>
 </dates>
 </vuln>

<vuln vid="e969e6cb-8911-11db-9d01-0016179b2dd5">
 <topic>tnftpd -- Remote root Exploit</topic>
 <affects>
 <package>
	<name>tnftpd</name>
	<range><lt>20040810</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The tnftpd port suffer from a remote stack overrun,
	 which can lead to a root compromise.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-6652</cvename>
 <url>http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051009.html</url>
 </references>
 <dates>
 <discovery>2006-12-01</discovery>
 <entry>2006-12-11</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="eb5124a4-8a20-11db-b033-00123ffe8333">
 <topic>clamav -- Multipart Nestings Denial of Service</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.88.7</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><le>20061029</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/23347/">
	 Clam AntiVirus have a vulnerability, which can be exploited by
	 malicious people to cause a DoS (Denial of Service).
	 The vulnerability is caused due to a stack overflow when scanning
	 messages with deeply nested multipart content. This can be
	 exploited to crash the service by sending specially crafted emails
	 to a vulnerable system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-6481</cvename>
 <url>http://secunia.com/advisories/23347/</url>
 <url>http://www.quantenblog.net/security/virus-scanner-bypass</url>
 </references>
 <dates>
 <discovery>2006-12-06</discovery>
 <entry>2006-12-12</entry>
 <modified>2013-06-19</modified>
 </dates>
 </vuln>

<vuln vid="1b043693-8617-11db-93b2-000e35248ad7">
 <topic>libxine -- multiple buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>libxine</name>
	<range><lt>1.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The libxine development team reports that several
	 vulnerabilities had been found in the libxine library. The
	 first vulnerability is caused by improper checking of the
	 src/input/libreal/real.c "real_parse_sdp()" function.
	 A remote attacker could exploit this by tricking an user to
	 connect to a preparated server potentially causing a buffer
	 overflow. Another buffer overflow had been found in the
	 libmms library, potentially allowing a remote attacker to
	 cause a denial of service vulnerability, and possible remote
	 code execution through the following functions: send_command,
	 string_utf16, get_data and get_media_packets. Other functions
	 might be affected as well.
 </body>
 </description>
 <references>
 <bid>18608</bid>
 <bid>21435</bid>
 <cvename>CVE-2006-2200</cvename>
 <cvename>CVE-2006-6172</cvename>
 <url>http://sourceforge.net/project/shownotes.php?release_id=468432</url>
 </references>
 <dates>
 <discovery>2006-05-04</discovery>
 <entry>2006-12-07</entry>
 <modified>2006-12-09</modified>
 </dates>
 </vuln>

<vuln vid="4db1669c-8589-11db-ac4f-02e081235dab">
 <topic>gnupg -- remotely controllable function pointer</topic>
 <affects>
 <package>
	<name>gnupg</name>
	<range><lt>1.4.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Werner Koch reports:
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000491.html">
	 GnuPG uses data structures called filters to process
	 OpenPGP messages. These filters are used in a similar
	 way as a pipelines in the shell. For communication
	 between these filters context structures are used.	These
	 are usually allocated on the stack and passed to the
	 filter functions. At most places the OpenPGP data stream
	 fed into these filters is closed before the context
	 structure gets deallocated. While decrypting encrypted
	 packets, this may not happen in all cases and the filter
	 may use a void contest structure filled with garbage. An
	 attacker may control this garbage.	The filter context
	 includes another context used by the low-level decryption
	 to access the decryption algorithm. This is done using a
	 function pointer. By carefully crafting an OpenPGP
	 message, an attacker may control this function pointer and
	 call an arbitrary function of the process.	Obviously an
	 exploit needs to prepared for a specific version,
	 compiler, libc, etc to be successful - but it is
	 definitely doable.
	 Fixing this is obvious: We need to allocate the context on
	 the heap and use a reference count to keep it valid as
	 long as either the controlling code or the filter code
	 needs it.
	 We have checked all other usages of such a stack based
	 filter contexts but fortunately found no other vulnerable
	 places. This allows to release a relatively small patch.
	 However, for reasons of code cleanness and easier audits
	 we will soon start to change all these stack based filter
	 contexts to heap based ones.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-6235</cvename>
 <url>http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000246.html</url>
 <url>http://secunia.com/advisories/23245/</url>
 </references>
 <dates>
 <discovery>2006-12-04</discovery>
 <entry>2006-12-07</entry>
 <modified>2006-12-15</modified>
 </dates>
 </vuln>

<vuln vid="a8674c14-83d7-11db-88d5-0012f06707f0">
 <topic>ruby -- cgi.rb library Denial of Service</topic>
 <affects>
 <package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.5_5,1</lt></range>
 </package>
 <package>
	<name>ruby_static</name>
	<range><ge>1.8.*,1</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The official ruby site reports:
	<blockquote cite="http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/">
	 Another vulnerability has been discovered in the CGI library
	 (cgi.rb) that ships with Ruby which could be used by a malicious
	 user to create a denial of service attack (DoS).
	 A specific HTTP request for any web application using cgi.rb
	 causes CPU consumption on the machine on which the web application
	 is running. Many such requests result in a denial of service.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-6303</cvename>
 <url>http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/</url>
 </references>
 <dates>
 <discovery>2006-12-04</discovery>
 <entry>2006-12-04</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="ed124f8c-82a2-11db-b46b-0012f06707f0">
 <topic>libmusicbrainz -- multiple buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>libmusicbrainz</name>
	<range><lt>2.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports about libmusicbrainz:
	<blockquote cite="http://www.securityfocus.com/bid/19508/discuss">
	 The libmusicbrainz library is prone to multiple buffer-overflow
	 vulnerabilities because the application fails to check the size of
	 the data before copying it into a finite-sized internal memory
	 buffer.
	 An attacker can exploit these issues to execute arbitrary code
	 within the context of the application or to cause a
	 denial-of-service condition.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>19508</bid>
 <cvename>CVE-2006-4197</cvename>
 <url>http://www.securityfocus.com/bid/21185/discuss</url>
 </references>
 <dates>
 <discovery>2006-08-17</discovery>
 <entry>2006-12-02</entry>
 </dates>
 </vuln>

<vuln vid="666b8c9e-8212-11db-851e-0016179b2dd5">
 <topic>tdiary -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>ja-tdiary</name>
	<name>tdiary</name>
	<range><le>2.0.2</le></range>
 </package>
 <package>
	<name>ja-tdiary-devel</name>
	<name>tdiary-devel</name>
	<range><gt>2.1</gt><lt>2.1.4_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	tDiary was vulnerable to an unspecified Cross-Site
	 Scripting vulnerability
 </body>
 </description>
 <references>
 <cvename>CVE-2006-6174</cvename>
 <url>http://sourceforge.net/forum/forum.php?forum_id=638868</url>
 </references>
 <dates>
 <discovery>2006-11-26</discovery>
 <entry>2006-12-02</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="18e3a5be-81f9-11db-95a2-0012f06707f0">
 <topic>ImageMagick -- SGI Image File heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><ge>6.0.0</ge><lt>6.2.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports about ImageMagick:
	<blockquote cite="http://www.securityfocus.com/bid/21185/info">
	 ImageMagick is prone to a remote heap-based buffer-overflow
	 vulnerability because the application fails to properly
	 bounds-check user-supplied input before copying it to an
	 insufficiently sized memory buffer.
	 Exploiting this issue allows attackers to execute arbitrary
	 machine code in the context of applications that use the
	 ImageMagick library.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>21185</bid>
 <cvename>CVE-2006-5868</cvename>
 <url>http://www.securityfocus.com/bid/21185/discuss</url>
 </references>
 <dates>
 <discovery>2006-11-14</discovery>
 <entry>2006-12-02</entry>
 </dates>
 </vuln>

<vuln vid="3dd7eb58-80ae-11db-b4ec-000854d03344">
 <topic>gtar -- GNUTYPE_NAMES directory traversal vulnerability</topic>
 <affects>
 <package>
	<name>gtar</name>
	<range><lt>1.16_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Teemu Salmela reports:
	<blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0344.html">
	 There is a tar record type, called GNUTYPE_NAMES (an
	 obsolete GNU extension), that allows the creation of
	 symbolic links pointing to arbitrary locations in the
	 filesystem, which makes it possible to create/overwrite
	 arbitrary files.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>21235</bid>
 <cvename>CVE-2006-6097</cvename>
 <url>http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0344.html</url>
 </references>
 <dates>
 <discovery>2006-11-21</discovery>
 <entry>2006-11-30</entry>
 </dates>
 </vuln>

<vuln vid="a8af7d70-8007-11db-b280-0008743bf21a">
 <topic>kronolith -- arbitrary local file inclusion vulnerability</topic>
 <affects>
 <package>
	<name>kronolith</name>
	<range><lt>2.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	iDefense Labs reports:
	<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=445">
	 Remote exploitation of a design error in Horde's Kronolith
	 could allow an authenticated web mail user to execute
	 arbitrary PHP code under the security context of the running
	 web server.
	 The vulnerability specifically exists due to a design error in the
	 way it includes certain files. Specifically, the 'lib/FBView.php'
	 file contains a function 'Kronolith_FreeBusy_View::factory' which
	 will include local files that are supplied via the 'view' HTTP GET
	 request parameter.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.horde.org/archives/announce/2006/000307.html</url>
 </references>
 <dates>
 <discovery>2006-11-29</discovery>
 <entry>2006-11-30</entry>
 </dates>
 </vuln>

<vuln vid="34c93ae8-7e6f-11db-bf00-02e081235dab">
 <topic>gnupg -- buffer overflow</topic>
 <affects>
 <package>
	<name>gnupg</name>
	<range><lt>1.4.5_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Werner Koch reports:
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html">
	 When running GnuPG interactively, special crafted
	 messages may be used to crash gpg or gpg2.	Running gpg in
	 batch mode, as done by all software using gpg as a backend
	 (e.g. mailers), is not affected by this bug.
	 Exploiting this overflow seems to be possible.
	 gpg-agent, gpgsm, gpgv or other tools from the GnuPG
	 suite are not affected.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html</url>
 </references>
 <dates>
 <discovery>2006-11-27</discovery>
 <entry>2006-11-27</entry>
 </dates>
 </vuln>

<vuln vid="cca97f5f-7435-11db-91de-0008743bf21a">
 <topic>proftpd -- Remote Code Execution Vulnerability</topic>
 <affects>
 <package>
	<name>proftpd</name>
	<name>proftpd-mysql</name>
	<range><le>1.3.0_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	FrSIRT reports:
	<blockquote cite="http://www.frsirt.com/english/advisories/2006/4451">
	 A vulnerability has been identified in ProFTPD, which could be
	 exploited by attackers to cause a denial of service or execute
	 arbitrary commands. This flaw is due to a buffer overflow error
	 in the "main.c" file where the "cmd_buf_size" size of the buffer
	 used to handle FTP commands sent by clients is not properly set
	 to the size configured via the "CommandBufferSize" directive,
	 which could be exploited by attackers to compromise a vulnerable
	 server via a specially crafted FTP command.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.frsirt.com/english/advisories/2006/4451</url>
 </references>
 <dates>
 <discovery>2006-11-10</discovery>
 <entry>2006-11-14</entry>
 <modified>2006-11-15</modified>
 </dates>
 </vuln>

<vuln vid="5a945904-73b1-11db-91d2-0002a5c2f4ef">
 <topic>unzoo -- Directory Traversal Vulnerability</topic>
 <affects>
 <package>
	<name>unzoo</name>
	<range><lt>4.4_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/12857/">
	 Doubles has discovered a vulnerability in Unzoo, which
	 potentially can be exploited by malicious people to
	 compromise a user's system.
	 The vulnerability is caused due to an input validation error
	 when unpacking archives. This can be exploited via a
	 directory traversal attack to overwrite files outside the
	 directory, where the files are extracted to, if a user is
	 tricked into extracting a malicious archive using Unzoo.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>11417</bid>
 <url>http://secunia.com/advisories/12857/</url>
 <url>http://securitytracker.com/alerts/2004/Oct/1011673.html</url>
 </references>
 <dates>
 <discovery>2004-10-18</discovery>
 <entry>2006-11-14</entry>
 <modified>2006-12-15</modified>
 </dates>
 </vuln>

<vuln vid="6d68618a-7199-11db-a2ad-000c6ec775d9">
 <topic>bugzilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<name>ja-bugzilla</name>
	<range><gt>2.*</gt><lt>2.22.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla Security Advisory reports:
	<blockquote cite="http://www.bugzilla.org/security/2.18.5/">
	 <ul>
	 <li>Sometimes the information put into the &lt;h1&gt; and
	 &lt;h2&gt; tags in Bugzilla was not properly escaped,
	 leading to a possible XSS vulnerability.</li>
	 <li>Bugzilla administrators were allowed to put raw,
	 unfiltered HTML into many fields in Bugzilla, leading to
	 a possible XSS vulnerability. Now, the HTML allowed in
	 those fields is limited.</li>
	 <li>attachment.cgi could leak the names of private
	 attachments</li>
	 <li>The "deadline" field was visible in the XML format of
	 a bug, even to users who were not a member of the
	 "timetrackinggroup."</li>
	 <li>A malicious user could pass a URL to an admin, and
	 make the admin delete or change something that he had
	 not intended to delete or change.</li>
	 <li>It is possible to inject arbitrary HTML into the
	 showdependencygraph.cgi page, allowing for a cross-site
	 scripting attack.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-5453</cvename>
 <cvename>CVE-2006-5454</cvename>
 <cvename>CVE-2006-5455</cvename>
 <url>http://www.bugzilla.org/security/2.18.5/</url>
 </references>
 <dates>
 <discovery>2006-10-15</discovery>
 <entry>2006-11-11</entry>
 </dates>
 </vuln>

<vuln vid="92442c4b-6f4a-11db-bd28-0012f06707f0">
 <topic>Imlib2 -- multiple image file processing vulnerabilities</topic>
 <affects>
 <package>
	<name>imlib2</name>
	<range><lt>20060926_1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/22732/">
	 Some vulnerabilities have been reported in imlib2, which can be
	 exploited by malicious people to cause a DoS (Denial of Service)
	 or potentially compromise an application using the library.
	 The vulnerabilities are caused due to unspecified errors within
	 the processing of JPG, ARGB, PNG, LBM, PNM, TIFF, and TGA images.
	 This may be exploited to execute arbitrary code by e.g. tricking a
	 user into opening a specially crafted image file with an
	 application using imlib2.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>20903</bid>
 <cvename>CVE-2006-4806</cvename>
 <cvename>CVE-2006-4807</cvename>
 <cvename>CVE-2006-4808</cvename>
 <cvename>CVE-2006-4809</cvename>
 </references>
 <dates>
 <discovery>2006-11-03</discovery>
 <entry>2006-11-08</entry>
 </dates>
 </vuln>

<vuln vid="ab8dbe98-6be4-11db-ae91-0012f06707f0">
 <topic>ruby -- cgi.rb library Denial of Service</topic>
 <affects>
 <package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.5_4,1</lt></range>
 </package>
 <package>
	<name>ruby_static</name>
	<range><ge>1.8.*,1</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Official ruby site reports:
	<blockquote cite="http://www.ruby-lang.org/en/news/2006/11/03/CVE-2006-5467/">
	 A vulnerability has been discovered in the CGI library (cgi.rb)
	 that ships with Ruby which could be used by a malicious user to
	 create a denial of service attack (DoS). The problem is triggered
	 by sending the library an HTTP request that uses multipart MIME
	 encoding and as an invalid boundary specifier that begins with
	 "-" instead of "--". Once triggered it will
	 exhaust all available memory resources effectively creating a DoS
	 condition.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>20777</bid>
 <cvename>CVE-2006-5467</cvename>
 <url>http://rubyforge.org/pipermail/mongrel-users/2006-October/001946.html</url>
 </references>
 <dates>
 <discovery>2006-10-25</discovery>
 <entry>2006-11-04</entry>
 <modified>2006-12-15</modified>
 </dates>
 </vuln>

<vuln vid="b318dc8c-6756-11db-83c3-000c6ec775d9">
 <topic>screen -- combined UTF-8 characters vulnerability</topic>
 <affects>
 <package>
	<name>screen</name>
	<range><lt>4.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A vulnerability in the handling of combined UTF-8
	 characters in screen may allow an user-assisted attacker to
	 crash screen or potentially allow code execution as the user
	 running screen. To exploit this issue the user running
	 scren must in some way interact with the attacker.
 </body>
 </description>
 <references>
 <bid>20727</bid>
 <cvename>CVE-2006-4573</cvename>
 <mlist>http://lists.gnu.org/archive/html/screen-users/2006-10/msg00028.html</mlist>
 <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212056</url>
 </references>
 <dates>
 <discovery>2006-10-23</discovery>
 <entry>2006-10-29</entry>
 </dates>
 </vuln>

<vuln vid="a9c51caf-6603-11db-ab90-000e35fd8194">
 <topic>mysql -- database suid privilege escalation</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><ge>5.1</ge><lt>5.1.12</lt></range>
	<range><ge>5.0</ge><lt>5.0.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dmitri Lenev reports a privilege escalation in
	 MySQL. MySQL evaluates arguments of suid routines in the
	 security context of the routine's definer instead of the
	 routine's caller, which allows remote and local
	 authenticated users to gain privileges through a routine
	 that has been made available using GRANT EXECUTE.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4227</cvename>
 <url>http://bugs.mysql.com/bug.php?id=18630</url>
 </references>
 <dates>
 <discovery>2006-03-29</discovery>
 <entry>2006-10-29</entry>
 <modified>2006-10-30</modified>
 </dates>
 </vuln>

<vuln vid="a0e92718-6603-11db-ab90-000e35fd8194">
 <topic>mysql -- database "case-sensitive" privilege escalation</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><ge>5.1</ge><lt>5.1.12</lt></range>
	<range><ge>5.0</ge><lt>5.0.25</lt></range>
	<range><lt>4.1.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michal Prokopiuk reports a privilege escalation in MySQL.
	 The vulnerability causes MySQL, when run on case-sensitive
	 filesystems, to allow remote and local authenticated users
	 to create or access a database when the database name
	 differs only in case from a database for which they have
	 permissions.
 </body>
 </description>
 <references>
 <bid>19559</bid>
 <cvename>CVE-2006-4226</cvename>
 <url>http://bugs.mysql.com/bug.php?id=17647</url>
 </references>
 <dates>
 <discovery>2006-08-09</discovery>
 <entry>2006-10-29</entry>
 </dates>
 </vuln>

<vuln vid="96ed277b-60e0-11db-ad2d-0016179b2dd5">
 <topic>Serendipity -- XSS Vulnerabilities</topic>
 <affects>
 <package>
	<name>serendipity</name>
	<range><lt>1.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Serendipity Team reports:
	<blockquote cite="http://blog.s9y.org/archives/147-Serendipity-1.0.2-and-1.1-beta5-released.html">
	 Serendipity failed to correctly sanitize user input on the
	 media manager administration page. The content of GET variables
	 were written into JavaScript strings. By using standard string
	 evasion techniques it was possible to execute arbitrary
	 JavaScript.
	 Additionally Serendipity dynamically created a HTML form on
	 the media manager administration page that contained all
	 variables found in the URL as hidden fields. While the variable
	 values were correctly escaped it was possible to break out
	 by specifying strange variable names.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.hardened-php.net/advisory_112006.136.htmlSerendipity</url>
 <url>http://secunia.com/advisories/22501/</url>
 </references>
 <dates>
 <discovery>2006-10-19</discovery>
 <entry>2006-10-21</entry>
 </dates>
 </vuln>

<vuln vid="d8fbf13a-6215-11db-a59e-0211d85f11fb">
 <topic>kdelibs -- integer overflow in khtml</topic>
 <affects>
 <package>
	<name>kdelibs</name>
	<name>kdelibs-nocups</name>
	<range><lt>3.5.4_4</lt></range>
 </package>
 <package>
	<name>qt</name>
	<name>qt-copy</name>
	<range><lt>3.3.6_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Red Hat reports:
	<blockquote cite="http://rhn.redhat.com/errata/RHSA-2006-0720.html">
	 An integer overflow flaw was found in the way Qt handled pixmap
	 images. The KDE khtml library uses Qt in such a way that untrusted
	 parameters could be passed to Qt, triggering the overflow.
	 An attacker could for example create a malicious web page that when
	 viewed by a victim in the Konqueror browser would cause Konqueror
	 to crash or possibly execute arbitrary code with the privileges of
	 the victim.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4811</cvename>
 <url>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=210742</url>
 <url>http://rhn.redhat.com/errata/RHSA-2006-0720.html</url>
 </references>
 <dates>
 <discovery>2006-10-14</discovery>
 <entry>2006-10-22</entry>
 </dates>
 </vuln>

<vuln vid="4867ae85-608d-11db-8faf-000c6ec775d9">
 <topic>opera -- URL parsing heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><gt>9.*</gt><lt>9.02</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	iDefense Labs reports:
	<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=424">
	 Remote exploitation of a heap overflow vulnerability
	 within version 9 of Opera Software's Opera Web browser
	 could allow an attacker to execute arbitrary code on the
	 affected host.
	 A flaw exists within Opera when parsing a tag that
	 contains a URL. A heap buffer with a constant size of 256
	 bytes is allocated to store the URL, and the tag's URL is
	 copied into this buffer without sufficient bounds checking
	 of its length.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4819</cvename>
 <url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=424</url>
 <url>http://secunia.com/advisories/22218/</url>
 <url>http://www.opera.com/support/search/supsearch.dml?index=848</url>
 </references>
 <dates>
 <discovery>2006-10-17</discovery>
 <entry>2006-10-20</entry>
 </dates>
 </vuln>

<vuln vid="1c0def84-5fb1-11db-b2e9-0008c79fa3d2">
 <topic>asterisk -- remote heap overwrite vulnerability</topic>
 <affects>
 <package>
	<name>asterisk</name>
	<name>asterisk-bristuff</name>
	<range><lt>1.2.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adam Boileau of Security-Assessment.com reports:
	<blockquote cite="http://www.security-assessment.com/files/advisories/Asterisk_remote_heap_overflow.pdf">
	 The Asterisk Skinny channel driver for Cisco SCCP phones
	 (chan_skinny.so) incorrectly validates a length value in
	 the packet header.	An integer wrap-around leads to heap
	 overwrite, and arbitrary remote code execution as root.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.security-assessment.com/files/advisories/Asterisk_remote_heap_overflow.pdf</url>
 <mlist msgid="4536A2F2.2020902@security-assessment.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=116121567530170</mlist>
 </references>
 <dates>
 <discovery>2006-10-17</discovery>
 <entry>2006-10-20</entry>
 </dates>
 </vuln>

<vuln vid="b6c18956-5fa3-11db-ad2d-0016179b2dd5">
 <topic>plone -- unprotected MembershipTool methods</topic>
 <affects>
 <package>
	<name>plone</name>
	<range><lt>2.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Plone Team reports:
	<blockquote cite="http://dev.plone.org/plone/ticket/5432">
	 Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict
	 access to the:
	 <ul>
	 <li>changeMemberPortrait</li>
	 <li>deletePersonalPortrait</li>
	 <li>testCurrentPassword</li>
	 </ul>
	 methods, which allows remote attackers to modify portraits.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1711</cvename>
 <url>http://plone.org/products/plone/releases/2.1.4</url>
 <url>https://svn.plone.org/svn/plone/PloneHotfix20060410/trunk/README.txt</url>
 </references>
 <dates>
 <discovery>2006-10-19</discovery>
 <entry>2006-10-19</entry>
 <modified>2006-10-20</modified>
 </dates>
 </vuln>

<vuln vid="19207592-5f17-11db-ae08-0008743bf21a">
 <topic>drupal -- HTML attribute injection</topic>
 <affects>
 <package>
	<name>drupal</name>
	<range><lt>4.6.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Team reports:
	<blockquote cite="http://drupal.org/files/sa-2006-026/advisory.txt">
	 A malicious user may entice users to visit a specially
	 crafted URL that may result in the redirection of Drupal
	 form submission to a third-party site. A user visiting the
	 user registration page via such a url, for example, will
	 submit all data, such as his/her e-mail address, but also
	 possible private profile data, to a third-party site.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://drupal.org/files/sa-2006-026/advisory.txt</url>
 <url>http://drupal.org/drupal-4.7.4</url>
 </references>
 <dates>
 <discovery>2006-10-18</discovery>
 <entry>2006-10-18</entry>
 </dates>
 </vuln>

<vuln vid="937d5911-5f16-11db-ae08-0008743bf21a">
 <topic>drupal -- cross site request forgeries</topic>
 <affects>
 <package>
	<name>drupal</name>
	<range><lt>4.6.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Team reports:
	<blockquote cite="http://drupal.org/files/sa-2006-025/advisory.txt">
	 Visiting a specially crafted page, anywhere on the web, may
	 allow that page to post forms to a Drupal site in the
	 context of the visitor's session. To illustrate; suppose
	 one has an active user 1 session, the most powerful
	 administrator account for a site, to a Drupal site while
	 visiting a website created by an attacker. This website
	 will now be able to submit any form to the Drupal site with
	 the privileges of user 1, either by enticing the user to
	 submit a form or by automated means.
	 An attacker can exploit this vulnerability by changing
	 passwords, posting PHP code or creating new users, for
	 example. The attack is only limited by the privileges of
	 the session it executes in.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://drupal.org/files/sa-2006-025/advisory.txt</url>
 <url>http://drupal.org/drupal-4.7.4</url>
 </references>
 <dates>
 <discovery>2006-10-18</discovery>
 <entry>2006-10-18</entry>
 </dates>
 </vuln>

<vuln vid="b2383758-5f15-11db-ae08-0008743bf21a">
 <topic>drupal -- multiple XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal</name>
	<range><lt>4.6.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Team reports:
	<blockquote cite="http://drupal.org/files/sa-2006-024/advisory.txt">
	 A bug in input validation and lack of output validation
	 allows HTML and script insertion on several pages.
	 Drupal's XML parser passes unescaped data to watchdog
	 under certain circumstances. A malicious user may execute
	 an XSS attack via a specially crafted RSS feed. This
	 vulnerability exists on systems that do not use PHP's
	 mb_string extension (to check if mb_string is being used,
	 navigate to admin/settings and look under "String
	 handling"). Disabling the aggregator module provides an
	 immediate workaround.
	 The aggregator module, profile module, and forum module do
	 not properly escape output of certain fields.
	 Note: XSS attacks may lead to administrator access if
	 certain conditions are met.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://drupal.org/files/sa-2006-024/advisory.txt</url>
 <url>http://drupal.org/drupal-4.7.4</url>
 </references>
 <dates>
 <discovery>2006-10-18</discovery>
 <entry>2006-10-18</entry>
 </dates>
 </vuln>

<vuln vid="18a14baa-5ee5-11db-ae08-0008743bf21a">
 <topic>ingo -- local arbitrary shell command execution</topic>
 <affects>
 <package>
	<name>ingo</name>
	<range><lt>1.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Horde team reports a vulnerability within Ingo, the
	 filter management suite. The vulnerability is caused due to
	 inadequete escaping, possibly allowing a local user to execute
	 arbitrary shell commands via procmail.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-5449</cvename>
 <url>http://bugs.horde.org/ticket/?id=4513</url>
 <url>http://cvs.horde.org/diff.php/ingo/docs/CHANGES?r1=1.55.2.49&amp;r2=1.55.2.59&amp;ty=h</url>
 <url>http://lists.horde.org/archives/announce/2006/000296.html</url>
 </references>
 <dates>
 <discovery>2006-10-18</discovery>
 <entry>2006-10-18</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="a6d9da4a-5d5e-11db-8faf-000c6ec775d9">
 <topic>NVIDIA UNIX driver -- arbitrary root code execution vulnerability</topic>
 <affects>
 <package>
	<name>nvidia-driver</name>
	<range><ge>1.0.8762</ge><lt>1.0.8776</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Rapid7 reports:
	<blockquote cite="http://www.rapid7.com/advisories/R7-0025.jsp">
	 The NVIDIA Binary Graphics Driver for Linux is vulnerable
	 to a buffer overflow that allows an attacker to run
	 arbitrary code as root. This bug can be exploited both
	 locally or remotely (via a remote X client or an X client
	 which visits a malicious web page). A working
	 proof-of-concept root exploit is included with this
	 advisory.
	 The NVIDIA drivers for Solaris and FreeBSD are also
	 likely to be vulnerable.
	</blockquote>
	Disabling Render acceleration in the "nvidia" driver, via
	 the "RenderAccel" X configuration option, can be used as a
	 workaround for this issue.
 </body>
 </description>
 <references>
 <certvu>147252</certvu>
 <cvename>CVE-2006-5379</cvename>
 <url>http://nvidia.custhelp.com/cgi-bin/nvidia.cfg/php/enduser/std_adp.php?p_faqid=1971</url>
 <url>http://secunia.com/advisories/22419/</url>
 <url>http://www.rapid7.com/advisories/R7-0025.jsp</url>
 </references>
 <dates>
 <discovery>2006-10-16</discovery>
 <entry>2006-10-16</entry>
 <modified>2006-10-21</modified>
 </dates>
 </vuln>

<vuln vid="8012a79d-5d21-11db-bb8d-00123ffe8333">
 <topic>clamav -- CHM unpacker and PE rebuilding vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.88.5</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><le>20060922</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/22370/">
	 Two vulnerabilities have been reported in Clam AntiVirus, which
	 potentially can be exploited by malicious people to cause a DoS
	 (Denial of Service) or compromise a vulnerable system.
	 1) An unspecified error in the CHM unpacker in chmunpack.c can be
	 exploited to cause a DoS.
	 2) An unspecified error in rebuildpe.c when rebuilding PE files
	 after unpacking can be exploited to cause a heap-based buffer
	 overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/22370/</url>
 <url>http://lurker.clamav.net/message/20061016.015114.dc6a8930.en.html</url>
 <url>http://sourceforge.net/project/shownotes.php?release_id=455799</url>
 </references>
 <dates>
 <discovery>2006-10-15</discovery>
 <entry>2006-10-16</entry>
 </dates>
 </vuln>

<vuln vid="93ba13f8-5c41-11db-a5ae-00508d6a62df">
 <topic>tkdiff -- temporary file symlink privilege escalation</topic>
 <affects>
 <package>
	<name>tkdiff</name>
	<range><lt>4.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Javier Fernández-Sanguino Peña reports a vulnerability in
	 tkdiff which allows local users to gain priveleges of the
	 user running tkdiff due to insecure temporary file creation.
 </body>
 </description>
 <references>
 <url>http://www.debian.org/security/2005/dsa-927</url>
 <cvename>CVE-2005-3343</cvename>
 <bid>16064</bid>
 <url>http://secunia.com/advisories/18083</url>
 </references>
 <dates>
 <discovery>2005-12-20</discovery>
 <entry>2006-10-15</entry>
 </dates>
 </vuln>

<vuln vid="2c8a84d9-5bee-11db-a5ae-00508d6a62df">
 <topic>vtiger -- multiple remote file inclusion vulnerabilities</topic>
 <affects>
 <package>
	<name>vtiger</name>
	<range><lt>5.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dedi Dwianto a.k.a the_day reports:
	<blockquote cite="http://www.milw0rm.com/exploits/2508">
	 Input passed to the "$calpath" parameter in update.php is
	 not properly verified before being used. This can be
	 exploited to execute arbitrary PHP code by including files
	 from local or external resources.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-5289</cvename>
 <bid>20435</bid>
 <mlist msgid="20061009094328.15530.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=116049557032343</mlist>
 <url>http://advisories.echo.or.id/adv/adv54-theday-2006.txt</url>
 </references>
 <dates>
 <discovery>2006-10-09</discovery>
 <entry>2006-10-15</entry>
 </dates>
 </vuln>

<vuln vid="5c9a2769-5ade-11db-a5ae-00508d6a62df">
 <topic>google-earth -- heap overflow in the KML engine</topic>
 <affects>
 <package>
	<name>google-earth</name>
	<range><lt>4.0.2414</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	JAAScois reports:
	While processing KML/KMZ data Google Earth fails to verify
	 its size prior to copying it into a fixed-sized buffer.
	 This can be exploited as a buffer-overflow vulnerability to
	 cause the application to crash and/or to execute arbitrary
	 code.
 </body>
 </description>
 <references>
 <bid>20464</bid>
 <url>http://www.jaascois.com/exploits/18602024/</url>
 </references>
 <dates>
 <discovery>2006-10-10</discovery>
 <entry>2006-10-14</entry>
 <modified>2007-04-13</modified>
 </dates>
 </vuln>

<vuln vid="72f21372-55e4-11db-a5ae-00508d6a62df">
 <topic>torrentflux -- User-Agent XSS Vulnerability</topic>
 <affects>
 <package>
	<name>torrentflux</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.stevenroddis.com.au/2006/10/06/torrentflux-user-agent-xss-vulnerability/">
	 Steven Roddis reports that User-Agent string is not
	 properly escaped when handled by torrentflux. This allows
	 for arbitrary code insertion.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>20371</bid>
 <cvename>CVE-2006-5227</cvename>
 <url>http://www.stevenroddis.com.au/2006/10/06/torrentflux-user-agent-xss-vulnerability/</url>
 <url>http://secunia.com/advisories/22293/</url>
 </references>
 <dates>
 <discovery>2006-09-30</discovery>
 <entry>2006-10-07</entry>
 <modified>2006-10-15</modified>
 </dates>
 </vuln>

<vuln vid="fe83eb5b-55e1-11db-a5ae-00508d6a62df">
 <topic>python -- buffer overrun in repr() for unicode strings</topic>
 <affects>
 <package>
	<name>python+ipv6</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>python</name>
	<range><lt>2.4.3_1</lt></range>
	<range><gt>2.5.*</gt><lt>2.5.c2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Benjamin C. Wiley Sittler reports:
	<blockquote cite="https://launchpad.net/distros/ubuntu/+source/python2.4/+bug/56633">
	 I discovered a [buffer overrun in repr() for unicode
	 strings]. This causes an unpatched non-debug wide
	 (UTF-32/UCS-4) build of python to abort.
	</blockquote>
	Ubuntu security team reports:
	<blockquote cite="http://www.ubuntu.com/usn/usn-359-1">
	 If an application uses repr() on arbitrary untrusted data,
	 this [bug] could be exploited to execute arbitrary code
	 with the privileges of the python application.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4980</cvename>
 <url>https://launchpad.net/distros/ubuntu/+source/python2.4/+bug/56633</url>
 <url>http://www.ubuntu.com/usn/usn-359-1</url>
 <url>http://secunia.com/advisories/22276/</url>
 </references>
 <dates>
 <discovery>2006-08-15</discovery>
 <entry>2006-10-07</entry>
 <modified>2006-10-08</modified>
 </dates>
 </vuln>

<vuln vid="e329550b-54f7-11db-a5ae-00508d6a62df">
 <topic>php -- _ecalloc Integer Overflow Vulnerability</topic>
 <affects>
 <package>
	<name>php5</name>
	<range><lt>5.1.6_1</lt></range>
 </package>
 <package>
	<name>php5-cli</name>
	<name>php5-cgi</name>
	<name>php5-dtc</name>
	<name>php5-horde</name>
	<name>php5-nms</name>
	<name>mod_php5</name>
	<range><ge>5</ge><lt>5.1.6_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Esser reports:
	<blockquote cite="http://www.hardened-php.net/advisory_092006.133.html">
	 The PHP 5 branch of the PHP source code lacks the
	 protection against possible integer overflows inside
	 ecalloc() that is present in the PHP 4 branch and also for
	 several years part of our Hardening-Patch and our new
	 Suhosin-Patch.
	 It was discovered that such an integer overflow can be
	 triggered when user input is passed to the unserialize()
	 function. Earlier vulnerabilities in PHP's unserialize()
	 that were also discovered by one of our audits in December
	 2004 are unrelated to the newly discovered flaw, but they
	 have shown, that the unserialize() function is exposed to
	 user-input in many popular PHP applications. Examples for
	 applications that use the content of COOKIE variables with
	 unserialize() are phpBB and Serendipity.
	 The successful exploitation of this integer overflow will
	 result in arbitrary code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4812</cvename>
 <url>http://www.hardened-php.net/advisory_092006.133.html</url>
 <url>http://secunia.com/advisories/22280/</url>
 </references>
 <dates>
 <discovery>2006-09-30</discovery>
 <entry>2006-10-06</entry>
 <modified>2013-04-01</modified>
 </dates>
 </vuln>

<vuln vid="8a5770b4-54b5-11db-a5ae-00508d6a62df">
 <topic>mambo -- multiple SQL injection vulnerabilities</topic>
 <affects>
 <package>
	<name>mambo</name>
	<range><lt>4.6.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	James Bercegay reports:
	<blockquote cite="http://www.gulftech.org/?node=research&amp;article_id=00116-10042006">
	 Mambo is vulnerable to an Authentication Bypass issue that
	 is due to an SQL Injection in the login function. The SQL
	 Injection is possible because the $passwd variable is only
	 sanitized when it is not passed as an argument to the
	 function.
	</blockquote>
	Omid reports:
	<blockquote cite="http://seclists.org/bugtraq/2006/Aug/0491.html">
	 There are several sql injections in Mambo 4.6 RC2 &amp;
	 Joomla 1.0.10 (and maybe other versions):
	 <ul>
	 <li>When a user edits a content, the "id" parameter is not
	 checked properly in /components/com_content/content.php,
	 which can cause 2 sql injections.</li>
	 <li>The "limit" parameter in the administration section is
	 not checked. This affects many pages of administration
	 section</li>
	 <li>In the administration section, while editing/creating a
	 user, the "gid" parameter is not checked properly.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>19719</bid>
 <bid>19734</bid>
 <url>http://www.gulftech.org/?node=research&amp;article_id=00116-10042006</url>
 <url>http://seclists.org/bugtraq/2006/Aug/0491.html</url>
 <url>http://www.frsirt.com/english/advisories/2006/3918</url>
 <url>http://mamboxchange.com/forum/forum.php?forum_id=7704</url>
 <url>http://secunia.com/advisories/21644/</url>
 <url>http://secunia.com/advisories/22221/</url>
 </references>
 <dates>
 <discovery>2006-08-26</discovery>
 <entry>2006-10-05</entry>
 <modified>2011-06-27</modified>
 </dates>
 </vuln>

<vuln vid="19a92df1-548d-11db-8f1a-000a48049292">
 <topic>tin -- buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>tin</name>
	<name>zh-tin</name>
	<range><lt>1.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="ftp://ftp.tin.org/pub/news/clients/tin/stable/CHANGES">
	 Urs Janssen and Aleksey Salow report possible buffer
	 overflows in tin versions 1.8.0 and 1.8.1.
	</blockquote>
	<blockquote cite="http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.005-tin.html">
	 OpenPKG project elaborates there is an allocation
	 off-by-one bug in version 1.8.0 which can lead to a buffer
	 overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <url>ftp://ftp.tin.org/pub/news/clients/tin/stable/CHANGES</url>
 <url>http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.005-tin.html</url>
 </references>
 <dates>
 <discovery>2006-02-15</discovery>
 <entry>2006-10-05</entry>
 </dates>
 </vuln>

<vuln vid="ae7124ff-547c-11db-8f1a-000a48049292">
 <topic>openldap -- slapd acl selfwrite Security Issue</topic>
 <affects>
 <package>
	<name>openldap-server</name>
	<name>openldap-sasl-server</name>
	<range><lt>2.3.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Howard Chu reports:
	<blockquote cite="http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587">
	 An ACL of the form 'access to dn.subtree="ou=groups,
	 dc=example,dc=com" attr=member by * selfwrite' is intended
	 to only allow users to add/delete their own DN to the
	 target attribute. Currently it allows any DNs to be
	 modified.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>19832</bid>
 <cvename>CVE-2006-4600</cvename>
 <url>http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587</url>
 <url>http://www.openldap.org/lists/openldap-announce/200608/msg00000.html</url>
 <url>http://secunia.com/advisories/21721</url>
 <url>http://securitytracker.com/alerts/2006/Sep/1016783.html</url>
 </references>
 <dates>
 <discovery>2006-06-14</discovery>
 <entry>2006-10-05</entry>
 </dates>
 </vuln>

<vuln vid="5a39a22e-5478-11db-8f1a-000a48049292">
 <topic>mono -- "System.CodeDom.Compiler" Insecure Temporary Creation</topic>
 <affects>
 <package>
	<name>mono</name>
	<range><lt>1.1.13.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sebastian Krahmer reports:
	<blockquote cite="http://www.ubuntu.com/usn/usn-357-1">
	 Sebastian Krahmer of the SuSE security team discovered
	 that the System.CodeDom.Compiler classes used temporary
	 files in an insecure way. This could allow a symbolic link
	 attack to create or overwrite arbitrary files with the
	 privileges of the user invoking the program. Under some
	 circumstances, a local attacker could also exploit this to
	 inject arbitrary code into running Mono processes.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-5072</cvename>
 <url>http://www.ubuntu.com/usn/usn-357-1</url>
 <url>http://secunia.com/advisories/22237/</url>
 </references>
 <dates>
 <discovery>2006-10-04</discovery>
 <entry>2006-10-05</entry>
 </dates>
 </vuln>

<vuln vid="edabe438-542f-11db-a5ae-00508d6a62df">
 <topic>php -- open_basedir Race Condition Vulnerability</topic>
 <affects>
 <package>
	<name>php4</name>
	<name>php5</name>
	<range><lt>4.4.4_1</lt></range>
	<range><ge>5</ge><lt>5.1.6_2</lt></range>
 </package>
 <package>
	<name>php-suhosin</name>
	<range><lt>0.9.6</lt></range>
 </package>
 <package>
	<name>php4-cli</name>
	<name>php5-cli</name>
	<name>php4-cgi</name>
	<name>php5-cgi</name>
	<name>php4-dtc</name>
	<name>php5-dtc</name>
	<name>php4-horde</name>
	<name>php5-horde</name>
	<name>php4-nms</name>
	<name>php5-nms</name>
	<name>mod_php4</name>
	<name>mod_php5</name>
	<range><ge>4</ge><lt>4.4.4_1</lt></range>
	<range><ge>5</ge><lt>5.1.6_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Esser reports:
	<blockquote cite="http://www.hardened-php.net/advisory_082006.132.html">
	 PHP's open_basedir feature is meant to disallow scripts to
	 access files outside a set of configured base directories.
	 The checks for this are placed within PHP functions dealing
	 with files before the actual open call is performed.
	 Obviously there is a little span of time between the check
	 and the actual open call. During this time span the checked
	 path could have been altered and point to a file that is
	 forbidden to be accessed due to open_basedir restrictions.
	 Because the open_basedir restrictions often not call PHP
	 functions but 3rd party library functions to actually open
	 the file it is impossible to close this time span in a
	 general way. It would only be possible to close it when PHP
	 handles the actual opening on it's own.
	 While it seems hard to change the path during this little
	 time span it is very simple with the use of the symlink()
	 function combined with a little trick. PHP's symlink()
	 function ensures that source and target of the symlink
	 operation are allowed by open_basedir restrictions (and
	 safe_mode). However it is possible to point a symlink to
	 any file by the use of mkdir(), unlink() and at least two
	 symlinks.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>20326</bid>
 <cvename>CVE-2006-5178</cvename>
 <url>http://www.hardened-php.net/advisory_082006.132.html</url>
 <url>http://secunia.com/advisories/22235/</url>
 </references>
 <dates>
 <discovery>2006-10-02</discovery>
 <entry>2006-10-05</entry>
 <modified>2013-04-01</modified>
 </dates>
 </vuln>

<vuln vid="86526ba4-53c8-11db-8f1a-000a48049292">
 <topic>phpbb -- NULL byte injection vulnerability</topic>
 <affects>
 <package>
	<name>phpbb</name>
	<name>zh-phpbb-tw</name>
	<range><lt>2.0.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/22188/">
	 ShAnKaR has discovered a vulnerability in phpBB, which can
	 be exploited by malicious users to compromise a vulnerable
	 system.
	 Input passed to the "avatar_path" parameter in
	 admin/admin_board.php is not properly sanitised before
	 being used as a configuration variable to store avatar
	 images. This can be exploited to upload and execute
	 arbitrary PHP code by changing "avatar_path" to a file with
	 a trailing NULL byte.
	 Successful exploitation requires privileges to the
	 administration section.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>20347</bid>
 <cvename>CVE-2006-4758</cvename>
 <url>http://secunia.com/advisories/22188/</url>
 <url>http://xforce.iss.net/xforce/xfdb/28884</url>
 <url>http://www.security.nnov.ru/Odocument221.html</url>
 </references>
 <dates>
 <discovery>2006-09-12</discovery>
 <entry>2006-10-04</entry>
 <modified>2006-12-24</modified>
 </dates>
 </vuln>

<vuln vid="35f2679f-52d7-11db-8f1a-000a48049292">
 <topic>postnuke -- admin section SQL injection</topic>
 <affects>
 <package>
	<name>postnuke</name>
	<range><lt>0.763</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISS X-Force reports:
	<blockquote cite="http://xforce.iss.net/xforce/xfdb/29271">
	 PostNuke is vulnerable to SQL injection. A remote attacker
	 could send specially-crafted SQL statements to the admin
	 section using the hits parameter, which could allow the
	 attacker to view, add, modify or delete information in the
	 back-end database.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>20317</bid>
 <cvename>CVE-2006-5121</cvename>
 <url>http://xforce.iss.net/xforce/xfdb/29271</url>
 <url>http://www.securityfocus.com/archive/1/archive/1/447361/100/0/threaded</url>
 <url>http://secunia.com/advisories/22197/</url>
 </references>
 <dates>
 <discovery>2006-09-29</discovery>
 <entry>2006-10-03</entry>
 <modified>2007-11-17</modified>
 </dates>
 </vuln>

<vuln vid="b975763f-5210-11db-8f1a-000a48049292">
 <topic>freetype -- LWFN Files Buffer Overflow Vulnerability</topic>
 <affects>
 <package>
	<name>freetype2</name>
	<range><lt>2.1.10_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityTracker reports:
	<blockquote cite="http://securitytracker.com/alerts/2006/Jul/1016522.html">
	 A vulnerability was reported in FreeType. A remote user
	 can cause arbitrary code to be executed on the target
	 user's system.
	 A remote user can create a specially crafted font file
	 that, when loaded by the target user's system, will trigger
	 an integer underflow or integer overflow and crash the
	 application or execute arbitrary code on the target system.
	 Chris Evans reported these vulnerabilities.
	 Impact: A remote user can create a file that, when loaded
	 by the target user, will execute arbitrary code on the
	 target user's system.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>18034</bid>
 <cvename>CVE-2006-0747</cvename>
 <cvename>CVE-2006-1861</cvename>
 <cvename>CVE-2006-3467</cvename>
 <url>http://securitytracker.com/alerts/2006/Jul/1016522.html</url>
 </references>
 <dates>
 <discovery>2006-07-10</discovery>
 <entry>2006-10-02</entry>
 </dates>
 </vuln>

<vuln vid="74ff10f6-520f-11db-8f1a-000a48049292">
 <topic>cscope -- Buffer Overflow Vulnerabilities</topic>
 <affects>
 <package>
	<name>cscope</name>
	<range><lt>15.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/21601">
	 Will Drewry has reported some vulnerabilities in Cscope,
	 which potentially can be exploited by malicious people to
	 compromise a vulnerable system.
	 Various boundary errors within the parsing of file lists
	 or the expansion of environment variables can be exploited
	 to cause stack-based buffer overflows when parsing
	 specially crafted "cscope.lists" files or directories.
	 A boundary error within the parsing of command line
	 arguments can be exploited to cause a stack-based buffer
	 overflow when supplying an overly long "reffile" argument.
	 Successful exploitation may allow execution of arbitrary
	 code.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>19686</bid>
 <bid>19687</bid>
 <cvename>CVE-2006-4262</cvename>
 <url>http://secunia.com/advisories/21601</url>
 <url>http://sourceforge.net/mailarchive/forum.php?thread_id=30266760&amp;forum_id=33500</url>
 <url>http://sourceforge.net/mailarchive/forum.php?thread_id=30266761&amp;forum_id=33500</url>
 </references>
 <dates>
 <discovery>2006-08-20</discovery>
 <entry>2006-10-02</entry>
 <modified>2006-10-11</modified>
 </dates>
 </vuln>

<vuln vid="64bf6234-520d-11db-8f1a-000a48049292">
 <topic>gnutls -- RSA Signature Forgery Vulnerability</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<name>gnutls-devel</name>
	<range><lt>1.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/21937">
	 A vulnerability has been reported in GnuTLS, which can be
	 exploited by malicious people to bypass certain security
	 restrictions.
	 The vulnerability is caused due to an error in the
	 verification of certain signatures. If a RSA key with
	 exponent 3 is used, it may be possible to forge PKCS #1
	 v1.5 signatures signed with that key.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>20027</bid>
 <cvename>CVE-2006-4790</cvename>
 <url>http://secunia.com/advisories/21937</url>
 <url>http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001205.html</url>
 </references>
 <dates>
 <discovery>2006-09-08</discovery>
 <entry>2006-10-02</entry>
 </dates>
 </vuln>

<vuln vid="350a5bd9-520b-11db-8f1a-000a48049292">
 <topic>MT -- Search Unspecified XSS</topic>
 <affects>
 <package>
	<name>MT</name>
	<range><ge>3.3</ge><lt>3.33</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/22109">
	 Arai has reported a vulnerability in Movable Type and
	 Movable Type Enterprise, which can be exploited by
	 malicious people to conduct cross-site scripting attacks.
	 Some unspecified input passed via the search functionality
	 isn't properly sanitised before being returned to the user.
	 This can be exploited to execute arbitrary HTML and script
	 code in a user's browser session in context of an affected
	 site.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>20228</bid>
 <cvename>CVE-2006-5080</cvename>
 <url>http://secunia.com/advisories/22109</url>
 <url>http://www.sixapart.com/movabletype/news/2006/09/mt_333-mte_103_updates.html</url>
 </references>
 <dates>
 <discovery>2006-09-26</discovery>
 <entry>2006-10-02</entry>
 <modified>2006-10-15</modified>
 </dates>
 </vuln>

<vuln vid="19b17ab4-51e0-11db-a5ae-00508d6a62df">
 <topic>phpmyadmin -- XSRF vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.9.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpMyAdmin team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5">
	 We received a security advisory from Stefan Esser
	 (sesser@hardened-php.net) and we wish to thank him for his
	 work.
	 It was possible to inject arbitrary SQL commands by
	 forcing an authenticated user to follow a crafted link.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-5116</cvename>
 <cvename>CVE-2006-5117</cvename>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5</url>
 <url>http://secunia.com/advisories/22126/</url>
 <bid>20253</bid>
 </references>
 <dates>
 <discovery>2006-09-28</discovery>
 <entry>2006-10-02</entry>
 <modified>2006-10-03</modified>
 </dates>
 </vuln>

<vuln vid="32db37a5-50c3-11db-acf3-000c6ec775d9">
 <topic>openssh -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.1</ge><lt>6.1_10</lt></range>
	<range><ge>6.0</ge><lt>6.0_15</lt></range>
	<range><ge>5.5</ge><lt>5.5_8</lt></range>
	<range><ge>5.4</ge><lt>5.4_22</lt></range>
	<range><ge>5.0</ge><lt>5.3_37</lt></range>
	<range><lt>4.11_25</lt></range>
 </package>
 <package>
	<name>openssh</name>
	<range><lt>4.4,1</lt></range>
 </package>
 <package>
	<name>openssh-portable</name>
	<range><lt>4.4.p1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	The CRC compensation attack detector in the sshd(8) daemon,
	 upon receipt of duplicate blocks, uses CPU time cubic in the
	 number of duplicate blocks received.	[CVE-2006-4924]
	A race condition exists in a signal handler used by the
	 sshd(8) daemon to handle the LoginGraceTime option, which
	 can potentially cause some cleanup routines to be executed
	 multiple times. [CVE-2006-5051]
	<h1>Impact</h1>
	An attacker sending specially crafted packets to sshd(8)
	 can cause a Denial of Service by using 100% of CPU time
	 until a connection timeout occurs. Since this attack can be
	 performed over multiple connections simultaneously, it is
	 possible to cause up to MaxStartups (10 by default) sshd
	 processes to use all the CPU time they can obtain.
	 [CVE-2006-4924]
	The OpenSSH project believe that the race condition can
	 lead to a Denial of Service or potentially remote code
	 execution, but the FreeBSD Security Team has been unable to
	 verify the exact impact. [CVE-2006-5051]
	<h1>Workaround</h1>
	The attack against the CRC compensation attack detector can
	 be avoided by disabling SSH Protocol version 1 support in
	 sshd_config(5).
	There is no workaround for the second issue.
 </body>
 </description>
 <references>
 <bid>20216</bid>
 <cvename>CVE-2006-4924</cvename>
 <cvename>CVE-2006-5051</cvename>
 <freebsdsa>SA-06:22.openssh</freebsdsa>
 <url>http://www.openssh.com/txt/release-4.4</url>
 </references>
 <dates>
 <discovery>2006-09-25</discovery>
 <entry>2006-09-30</entry>
 </dates>
 </vuln>

<vuln vid="fcba5764-506a-11db-a5ae-00508d6a62df">
 <topic>dokuwiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dokuwiki</name>
	<range><lt>20060309c</lt></range>
 </package>
 <package>
	<name>dokuwiki-devel</name>
	<range><lt>20060909</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/21819/">
	 rgod has discovered a vulnerability in DokuWiki, which can
	 be exploited by malicious people to compromise a vulnerable
	 system.
	 Input passed to the "TARGET_FN" parameter in
	 bin/dwpage.php is not properly sanitised before being used
	 to copy files. This can be exploited via directory
	 traversal attacks in combination with DokuWiki's file
	 upload feature to execute arbitrary PHP code.
	</blockquote>
	CVE Mitre reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4674">
	 Direct static code injection vulnerability in doku.php in
	 DokuWiki before 2006-03-09c allows remote attackers to
	 execute arbitrary PHP code via the X-FORWARDED-FOR HTTP
	 header, which is stored in config.php.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4675">
	 Unrestricted file upload vulnerability in
	 lib/exe/media.php in DokuWiki before 2006-03-09c allows
	 remote attackers to upload executable files into the
	 data/media folder via unspecified vectors.
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4679">
	 DokuWiki before 2006-03-09c enables the debug feature by
	 default, which allows remote attackers to obtain sensitive
	 information by calling doku.php with the X-DOKUWIKI-DO HTTP
	 header set to "debug".
	</blockquote>
 </body>
 </description>
 <references>
 <bid>19911</bid>
 <cvename>CVE-2006-4674</cvename>
 <cvename>CVE-2006-4675</cvename>
 <cvename>CVE-2006-4679</cvename>
 <url>http://secunia.com/advisories/21819/</url>
 <url>http://bugs.splitbrain.org/index.php?do=details&amp;id=906</url>
 </references>
 <dates>
 <discovery>2006-09-08</discovery>
 <entry>2006-09-30</entry>
 <modified>2006-10-02</modified>
 </dates>
 </vuln>

<vuln vid="450b76ee-5068-11db-a5ae-00508d6a62df">
 <topic>dokuwiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dokuwiki</name>
	<range><lt>20060309_5</lt></range>
 </package>
 <package>
	<name>dokuwiki-devel</name>
	<range><lt>20060609_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/22192/">
	 Some vulnerabilities have been reported in DokuWiki, which
	 can be exploited by malicious people to cause a DoS (Denial
	 of Service) or potentially compromise a vulnerable system.
	 Input passed to the "w" and "h" parameters in
	 lib/exec/fetch.php is not properly sanitised before being
	 passed as resize parameters to the "convert" application.
	 This can be exploited to cause a DoS due to excessive CPU
	 and memory consumption by passing very large numbers, or to
	 inject arbitrary shell commands by passing specially
	 crafted strings to the "w" and "h" parameter.
	 Successful exploitation requires that the
	 "$conf[imconvert]" option is set.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-5098</cvename>
 <cvename>CVE-2006-5099</cvename>
 <url>http://secunia.com/advisories/22192/</url>
 <url>http://secunia.com/advisories/22199/</url>
 <url>http://bugs.splitbrain.org/?do=details&amp;id=924</url>
 <url>http://bugs.splitbrain.org/?do=details&amp;id=926</url>
 </references>
 <dates>
 <discovery>2006-09-26</discovery>
 <entry>2006-09-30</entry>
 <modified>2006-10-02</modified>
 </dates>
 </vuln>

<vuln vid="e4c62abd-5065-11db-a5ae-00508d6a62df">
 <topic>tikiwiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>tikiwiki</name>
	<range><lt>1.9.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/21536/">
	 Thomas Pollet has discovered a vulnerability in TikiWiki,
	 which can be exploited by malicious people to conduct
	 cross-site scripting attacks.
	 Input passed to the "highlight" parameter in
	 tiki-searchindex.php is not properly sanitised before being
	 returned to the user. This can be exploited to execute
	 arbitrary HTML and script code in a user's browser session
	 in context of an affected site.
	</blockquote>
	<blockquote cite="http://secunia.com/advisories/21733/">
	 rgod has discovered a vulnerability in TikiWiki, which can
	 be exploited by malicious people to compromise a vulnerable
	 system.
	 The vulnerability is caused due to the "jhot.php" script
	 not correctly verifying uploaded files. This can e.g. be
	 exploited to execute arbitrary PHP code by uploading a
	 malicious PHP script to the "img/wiki" directory.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>19654</bid>
 <bid>19819</bid>
 <cvename>CVE-2006-4299</cvename>
 <cvename>CVE-2006-4602</cvename>
 <url>http://secunia.com/advisories/21536/</url>
 <url>http://secunia.com/advisories/21733/</url>
 </references>
 <dates>
 <discovery>2006-08-21</discovery>
 <entry>2006-09-30</entry>
 </dates>
 </vuln>

<vuln vid="e79876e4-5061-11db-a5ae-00508d6a62df">
 <topic>punbb -- NULL byte injection vulnerability</topic>
 <affects>
 <package>
	<name>punbb</name>
	<range><lt>1.2.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	CVE Mitre reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-4759">
	 PunBB 1.2.12 does not properly handle an avatar directory
	 pathname ending in %00, which allows remote authenticated
	 administrative users to upload arbitrary files and execute
	 code, as demonstrated by a query to admin_options.php with
	 an avatars_dir parameter ending in %00. NOTE: this issue
	 was originally disputed by the vendor, but the dispute was
	 withdrawn on 20060926.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4759</cvename>
 <url>http://forums.punbb.org/viewtopic.php?id=13255</url>
 </references>
 <dates>
 <discovery>2006-09-13</discovery>
 <entry>2006-09-30</entry>
 </dates>
 </vuln>

<vuln vid="2d9ad236-4d26-11db-b48d-00508d6a62df">
 <topic>freeciv -- Denial of Service Vulnerabilities</topic>
 <affects>
 <package>
	<name>freeciv</name>
	<name>freeciv-gtk</name>
	<name>freeciv-gtk2</name>
	<name>freeciv-nox11</name>
	<range><lt>2.0.8_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/21171/">
	 Luigi Auriemma has reported a vulnerability in Freeciv,
	 which can be exploited by malicious people to cause a DoS
	 (Denial of Service).
	 An error in the "generic_handle_player_attribute_chunk()"
	 function in common/packets.c can be exploited to crash the
	 service via a specially crafted
	 PACKET_PLAYER_ATTRIBUTE_CHUNK packet sent to the server.
	 An error in the "handle_unit_orders()" function in
	 server/unithand.c can be exploited to crash the service
	 via a specially crafted packet.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-3913</cvename>
 <bid>19117</bid>
 <url>http://secunia.com/advisories/21171/</url>
 <url>http://aluigi.altervista.org/adv/freecivx-adv.txt</url>
 </references>
 <dates>
 <discovery>2006-07-23</discovery>
 <entry>2006-09-26</entry>
 </dates>
 </vuln>

<vuln vid="339fbbc1-4d23-11db-b48d-00508d6a62df">
 <topic>freeciv -- Packet Parsing Denial of Service Vulnerability</topic>
 <affects>
 <package>
	<name>freeciv</name>
	<name>freeciv-gtk</name>
	<name>freeciv-gtk2</name>
	<name>freeciv-nox11</name>
	<range><lt>2.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19120/">
	 Luigi Auriemma has reported a vulnerability in Freeciv, which
	 can be exploited by malicious people to cause a DoS (Denial of
	 Service).
	 The vulnerability is caused due to an error within the
	 handling of the packet length in "common/packets.c". This can
	 be exploited to crash the Freeciv server via a specially-
	 crafted packet with the size set to "0xffff".
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0047</cvename>
 <bid>16975</bid>
 <url>http://secunia.com/advisories/19120/</url>
 <url>http://aluigi.altervista.org/adv/freecivdos-adv.txt</url>
 </references>
 <dates>
 <discovery>2006-03-06</discovery>
 <entry>2006-09-26</entry>
 </dates>
 </vuln>

<vuln vid="1709084d-4d21-11db-b48d-00508d6a62df">
 <topic>plans -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>plans</name>
	<range><lt>6.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/15854/">
	 A vulnerability has been reported in Plans, which can be
	 exploited by malicious people to conduct SQL injection
	 attacks.
	 Input passed to the "evt_id" parameter in "plans.cgi"
	 isn't properly sanitised before being used in a SQL query.
	 This can be exploited to manipulate SQL queries by
	 injecting arbitrary SQL code.
	 Successful exploitation requires that SQL database
	 support has been enabled in "plans_config.pl" (the default
	 setting is flat files).
	</blockquote>
	<blockquote cite="http://secunia.com/advisories/15167/">
	 Some vulnerabilities have been reported in Plans, which
	 can be exploited by malicious people to conduct cross-site
	 scripting attacks or gain knowledge of sensitive
	 information.
	 Input passed to various unspecified parameters is not
	 properly sanitised before being returned to users. This
	 can be exploited to execute arbitrary HTML and script code
	 in a user's browser session in context of a vulnerable
	 site.
	 An unspecified error can be exploited to gain knowledge
	 of the MySQL password.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>14069</bid>
 <url>http://secunia.com/advisories/15167/</url>
 <url>http://secunia.com/advisories/15854/</url>
 <url>http://planscalendar.com/forum/viewtopic.php?t=660</url>
 </references>
 <dates>
 <discovery>2005-04-28</discovery>
 <entry>2006-09-26</entry>
 <modified>2006-10-15</modified>
 </dates>
 </vuln>

<vuln vid="d3527663-4ccb-11db-b48d-00508d6a62df">
 <topic>eyeOS -- multiple XSS security bugs</topic>
 <affects>
 <package>
	<name>eyeOS</name>
	<range><lt>0.9.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	eyeOS team reports:
	<blockquote cite="http://eyeos.blogspot.com/2006/09/eyeos-091-released.html">
	 [EyeOS 0.9.1] release fixes two XSS security bugs, so we
	 recommend all users to upgrade to this new version in order
	 to have the best security. These two bugs were discovered by
	 Jose Carlos Norte, who is a new eyeOS developer.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>20213</bid>
 <cvename>CVE-2006-5071</cvename>
 <url>http://eyeos.blogspot.com/2006/09/eyeos-091-released.html</url>
 </references>
 <dates>
 <discovery>2006-09-25</discovery>
 <entry>2006-09-25</entry>
 <modified>2006-10-15</modified>
 </dates>
 </vuln>

<vuln vid="65a8f773-4a37-11db-a4cc-000a48049292">
 <topic>zope -- restructuredText "csv_table" Information Disclosure</topic>
 <affects>
 <package>
	<name>zope</name>
	<range><ge>2.7.0</ge><lt>2.7.9_1</lt></range>
	<range><ge>2.8.0</ge><lt>2.8.8_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/21947/">
	 A vulnerability has been reported in Zope, which can be
	 exploited by malicious people to disclose potentially
	 sensitive information.
	 The vulnerability is caused due to an error in the use of
	 the docutils module to parse and render "restructured"
	 text. This can be exploited to disclose certain information
	 via the "csv_table" reStructuredText directive.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>20022</bid>
 <cvename>CVE-2006-4684</cvename>
 <url>http://secunia.com/advisories/21947/</url>
 <url>http://www.zope.org/Products/Zope/Hotfix-2006-08-21/Hotfix-20060821/README.txt</url>
 </references>
 <dates>
 <discovery>2006-08-21</discovery>
 <entry>2006-09-22</entry>
 <modified>2006-12-27</modified>
 </dates>
 </vuln>

<vuln vid="f6bff909-4a26-11db-a4cc-000a48049292">
 <topic>libmms -- stack-based buffer overflow</topic>
 <affects>
 <package>
	<name>libmms</name>
	<range><lt>0.3</lt></range>
 </package>
 <package>
	<name>libxine</name>
	<range><lt>1.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre CVE reports:
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2200">
	 Stack-based buffer overflow in libmms, as used by (a)
	 MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier, allows
	 remote attackers to cause a denial of service (application
	 crash) and possibly execute arbitrary code via the (1)
	 send_command, (2) string_utf16, (3) get_data, and (4)
	 get_media_packet functions, and possibly other functions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-2200</cvename>
 <bid>18608</bid>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=374577</url>
 </references>
 <dates>
 <discovery>2006-05-04</discovery>
 <entry>2006-09-22</entry>
 </dates>
 </vuln>

<vuln vid="1fe734bf-4a06-11db-b48d-00508d6a62df">
 <topic>opera -- RSA Signature Forgery</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>9.02</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera reports:
	<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=845">
	 A specially crafted digital certificate can bypass Opera's
	 certificate signature verification. Forged certificates can
	 contain any false information the forger chooses, and Opera
	 will still present it as valid. Opera will not present any
	 warning dialogs in this case, and the security status will
	 be the highest possible (3). This defeats the protection
	 against "man in the middle", the attacks that SSL was
	 designed to prevent.
	 There is a flaw in OpenSSL's RSA signature verification
	 that affects digital certificates using 3 as the public
	 exponent. Some of the certificate issuers that are on
	 Opera's list of trusted signers have root certificates with
	 3 as the public exponent. The forged certificate can appear
	 to be signed by one of these.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4339</cvename>
 <url>http://secunia.com/advisories/21982/</url>
 <url>http://secunia.com/advisories/21709/</url>
 <url>http://www.cdc.informatik.tu-darmstadt.de/securebrowser/</url>
 <url>http://www.openssl.org/news/secadv_20060905.txt</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-60.html</url>
 </references>
 <dates>
 <discovery>2006-09-18</discovery>
 <entry>2006-09-22</entry>
 </dates>
 </vuln>

<vuln vid="e6296105-449b-11db-ba89-000c6ec775d9">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.5.0.7,1</lt></range>
	<range><gt>2.*,1</gt><lt>2.0_1,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.5.0.7</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.0.5</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<name>mozilla-thunderbird</name>
	<range><lt>1.5.0.7</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.a2006.09.21</lt></range>
 </package>
 <package>
	<name>linux-seamonkey-devel</name>
	<range><lt>1.5.a2006.09.21</lt></range>
 </package>
 <package>
	<name>linux-mozilla-devel</name>
	<name>linux-mozilla</name>
	<name>mozilla</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports of multiple security issues
	 in Firefox, Seamonkey, and Thunderbird. Several of these
	 issues can probably be used to run arbitrary code with the
	 privilege of the user running the program.
	<blockquote cite="http://www.mozilla.org/security/announce/">
	 <ul>
	 <li>MFSA 2006-64 Crashes with evidence of memory
	 corruption (rv:1.8.0.7)</li>
	 <li>MFSA 2006-63 JavaScript execution in mail via XBL</li>
	 <li>MFSA 2006-62 Popup-blocker cross-site scripting (XSS)</li>
	 <li>MFSA 2006-61 Frame spoofing using document.open()</li>
	 <li>MFSA 2006-60 RSA Signature Forgery</li>
	 <li>MFSA 2006-59 Concurrency-related vulnerability</li>
	 <li>MFSA 2006-58 Auto-Update compromise through DNS and
	 SSL spoofing</li>
	 <li>MFSA 2006-57 JavaScript Regular Expression Heap
	 Corruption</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>20042</bid>
 <cvename>CVE-2006-4253</cvename>
 <cvename>CVE-2006-4340</cvename>
 <cvename>CVE-2006-4565</cvename>
 <cvename>CVE-2006-4566</cvename>
 <cvename>CVE-2006-4567</cvename>
 <cvename>CVE-2006-4568</cvename>
 <cvename>CVE-2006-4569</cvename>
 <cvename>CVE-2006-4570</cvename>
 <cvename>CVE-2006-4571</cvename>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-57.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-58.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-59.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-60.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-61.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-62.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-63.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-64.html</url>
 </references>
 <dates>
 <discovery>2006-09-14</discovery>
 <entry>2006-09-15</entry>
 <modified>2006-11-02</modified>
 </dates>
 </vuln>

<vuln vid="24f6b1eb-43d5-11db-81e1-000e0c2e438a">
 <topic>win32-codecs -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>win32-codecs</name>
	<range><lt>3.1.0.p8_1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apple Security Team reports that there are multiple
	 vulnerabilities within QuickTime (one of the plugins for
	 win32-codecs). A remote attacker capable of creating a
	 malicious SGI image, FlashPix, FLC movie, or a QuickTime
	 movie can possibly lead to execution of arbitrary code or
	 cause a Denial of Service (application crash).
	Users who have QuickTime (/win32-codecs) as a browser plugin
	 may be vulnerable to remote code execution by visiting a
	 website containing a malicious SGI image, FlashPix, FLC movie
	 or a QuickTime movie.
 </body>
 </description>
 <references>
 <bid>20138</bid>
 <cvename>CVE-2006-4381</cvename>
 <cvename>CVE-2006-4382</cvename>
 <cvename>CVE-2006-4384</cvename>
 <cvename>CVE-2006-4385</cvename>
 <cvename>CVE-2006-4386</cvename>
 <cvename>CVE-2006-4388</cvename>
 <cvename>CVE-2006-4389</cvename>
 <url>http://docs.info.apple.com/article.html?artnum=304357</url>
 </references>
 <dates>
 <discovery>2006-09-08</discovery>
 <entry>2006-09-14</entry>
 <modified>2006-10-17</modified>
 </dates>
 </vuln>

<vuln vid="ea09c5df-4362-11db-81e1-000e0c2e438a">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>php4</name>
	<name>php5</name>
	<range><lt>4.4.4</lt></range>
	<range><ge>5</ge><lt>5.1.5</lt></range>
 </package>
 <package>
	<name>php4-cli</name>
	<name>php5-cli</name>
	<name>php4-cgi</name>
	<name>php5-cgi</name>
	<name>php4-dtc</name>
	<name>php5-dtc</name>
	<name>php4-horde</name>
	<name>php5-horde</name>
	<name>php4-nms</name>
	<name>php5-nms</name>
	<name>mod_php4</name>
	<name>mod_php5</name>
	<range><lt>4.4.4</lt></range>
	<range><ge>5</ge><lt>5.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PHP development team reports:
	<blockquote cite="http://www.php.net/release_5_1_5.php">
	 <ul>
	 <li>Added missing safe_mode/open_basedir checks inside the
	 error_log(), file_exists(), imap_open() and imap_reopen()
	 functions.</li>
	 <li>Fixed overflows inside str_repeat() and wordwrap()
	 functions on 64bit systems.</li>
	 <li>Fixed possible open_basedir/safe_mode bypass in cURL
	 extension and with realpath cache.</li>
	 <li>Fixed overflow in GD extension on invalid GIF
	 images.</li>
	 <li>Fixed a buffer overflow inside sscanf() function.</li>
	 <li>Fixed an out of bounds read inside stripos()
	 function.</li>
	 <li>Fixed memory_limit restriction on 64 bit system.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4481</cvename>
 <cvename>CVE-2006-4482</cvename>
 <cvename>CVE-2006-4483</cvename>
 <cvename>CVE-2006-4484</cvename>
 <cvename>CVE-2006-4485</cvename>
 <cvename>CVE-2006-4486</cvename>
 <url>http://www.php.net/release_4_4_4.php</url>
 <url>http://www.php.net/release_5_1_5.php</url>
 </references>
 <dates>
 <discovery>2006-08-18</discovery>
 <entry>2006-09-13</entry>
 <modified>2014-03-28</modified>
 </dates>
 </vuln>

<vuln vid="c0fd7890-4346-11db-89cc-000ae42e9b93">
 <topic>drupal-pubcookie -- authentication may be bypassed</topic>
 <affects>
 <package>
	<name>drupal-pubcookie</name>
	<range><le>4.6.0_20060210</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal Project reports:
	<blockquote cite="http://drupal.org/node/83064">
	 It is possible for a malicious user to spoof a user's
	 identity by bypassing the login redirection mechanism in the
	 pubcookie module. The malicious user may gain the privileges
	 of the user they are spoofing, including the administrative
	 user.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4717</cvename>
 <url>http://drupal.org/node/83064</url>
 </references>
 <dates>
 <discovery>2006-09-08</discovery>
 <entry>2006-09-13</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="7c75d48c-429b-11db-afae-000c6ec775d9">
 <topic>linux-flashplugin7 -- arbitrary code execution vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><lt>7.0r68</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb06-11.html">
	 Multiple input validation errors have been identified in
	 Flash Player 8.0.24.0 and earlier versions that could lead
	 to the potential execution of arbitrary code. These
	 vulnerabilities could be accessed through content
	 delivered from a remote location via the user?s web
	 browser, email client, or other applications that include
	 or reference the Flash Player. (CVE-2006-3311,
	 CVE-2006-3587, CVE-2006-3588)
	 These updates include changes to prevent circumvention of
	 the "allowScriptAccess" option. (CVE-2006-4640)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-3311</cvename>
 <cvename>CVE-2006-3587</cvename>
 <cvename>CVE-2006-3588</cvename>
 <cvename>CVE-2006-4640</cvename>
 <url>http://www.adobe.com/support/security/bulletins/apsb06-11.html</url>
 </references>
 <dates>
 <discovery>2006-09-12</discovery>
 <entry>2006-09-12</entry>
 </dates>
 </vuln>

<vuln vid="fffa9257-3c17-11db-86ab-00123ffe8333">
 <topic>mailman -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>mailman</name>
	<name>ja-mailman</name>
	<name>mailman-with-htdig</name>
	<range><lt>2.1.9.r1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/21732/">
	 Mailman can be exploited by malicious people to conduct cross-site
	 scripting and phishing attacks, and cause a DoS (Denial of
	 Service).
	 1) An error in the logging functionality can be exploited to
	 inject a spoofed log message into the error log via a specially
	 crafted URL.
	 Successful exploitation may trick an administrator into visiting
	 a malicious web site.
	 2) An error in the processing of malformed headers which does not
	 follow the RFC 2231 standard can be exploited to cause a DoS
	 (Denial of Service).
	 3) Some unspecified input isn't properly sanitised before being
	 returned to the user. This can be exploited to execute arbitrary
	 HTML and script code in a user's browser session in context of an
	 affected site.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>19831</bid>
 <cvename>CVE-2006-2191</cvename>
 <cvename>CVE-2006-2941</cvename>
 <cvename>CVE-2006-3636</cvename>
 <cvename>CVE-2006-4624</cvename>
 <url>http://secunia.com/advisories/21732/</url>
 <url>http://sourceforge.net/project/shownotes.php?group_id=103&amp;release_id=444295</url>
 </references>
 <dates>
 <discovery>2006-06-09</discovery>
 <entry>2006-09-04</entry>
 <modified>2006-10-04</modified>
 </dates>
 </vuln>

<vuln vid="09639ccc-3abb-11db-81e1-000e0c2e438a">
 <topic>hlstats -- multiple cross site scripting vulnerabilities</topic>
 <affects>
 <package>
	<name>hlstats</name>
	<range><le>1.35</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kefka reports multiple cross site scripting vulnerabilities
	 within hlstats. The vulnerabilities are caused due to
	 improper checking of variables, allowing an attacker to
	 perform cross site scripting.
 </body>
 </description>
 <references>
 <bid>19745</bid>
 <cvename>CVE-2006-4454</cvename>
 <cvename>CVE-2006-6780</cvename>
 <cvename>CVE-2006-6781</cvename>
 <cvename>CVE-2007-2812</cvename>
 </references>
 <dates>
 <discovery>2006-08-29</discovery>
 <entry>2006-09-02</entry>
 <modified>2011-09-03</modified>
 </dates>
 </vuln>

<vuln vid="0b79743b-3ab7-11db-81e1-000e0c2e438a">
 <topic>gtetrinet -- remote code execution</topic>
 <affects>
 <package>
	<name>gtetrinet</name>
	<range><lt>0.7.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Debian Security Team reports:
	<blockquote cite="http://www.debian.org/security/2006/dsa-1163">
	 Michael Gehring discovered several potential out-of-bounds
	 index accesses in gtetrinet, a multiplayer Tetris-like game,
	 which may allow a remote server to execute arbitrary
	 code
	</blockquote>
 </body>
 </description>
 <references>
 <bid>19766</bid>
 <cvename>CVE-2006-3125</cvename>
 <url>http://www.debian.org/security/2006/dsa-1163</url>
 </references>
 <dates>
 <discovery>2006-08-30</discovery>
 <entry>2006-09-02</entry>
 <modified>2006-10-01</modified>
 </dates>
 </vuln>

<vuln vid="0ab423e7-3822-11db-81e1-000e0c2e438a">
 <topic>joomla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla</name>
	<range><lt>1.0.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Joomla development team reports multiple vulnerabilities
	 within the joomla application. Joomla is vulnerable to the
	 following vulnerabilities:
	<ul>
	 <li>Improper validation of the mosMail function</li>
	 <li>Improper validation of the JosIsValidEmail function.</li>
	 <li>Remote code execution in PEAR.php</li>
	 <li>Zend Hash del key or index vulnerability</li>
	</ul>
 </body>
 </description>
 <references>
 <url>http://www.joomla.org/content/view/1841/78/</url>
 </references>
 <dates>
 <discovery>2006-08-28</discovery>
 <entry>2006-08-30</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="c9d2e361-32fb-11db-a6e2-000e0c2e438a">
 <topic>sppp -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><lt>4.11_20</lt></range>
	<range><ge>5.3</ge><lt>5.3_32</lt></range>
	<range><ge>5.4</ge><lt>5.4_17</lt></range>
	<range><ge>5.5</ge><lt>5.5_3</lt></range>
	<range><ge>6.0</ge><lt>6.0_10</lt></range>
	<range><ge>6.1</ge><lt>6.1_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	While processing Link Control Protocol (LCP) configuration
	 options received from the remote host, sppp(4) fails to
	 correctly validate option lengths. This may result in data
	 being read or written beyond the allocated kernel memory
	 buffer.
	<h1>Impact</h1>
	An attacker able to send LCP packets, including the remote
	 end of a sppp(4) connection, can cause the FreeBSD kernel to
	 panic. Such an attacker may also be able to obtain
	 sensitive information or gain elevated privileges.
	<h1>Workaround</h1>
	No workaround is available, but systems which do not use sppp(4) are
	 not vulnerable.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4304</cvename>
 <freebsdsa>SA-06:18.ppp</freebsdsa>
 </references>
 <dates>
 <discovery>2006-08-23</discovery>
 <entry>2006-08-23</entry>
 <modified>2006-08-30</modified>
 </dates>
 </vuln>

<vuln vid="e2e8d374-2e40-11db-b683-0008743bf21a">
 <topic>horde -- Phishing and Cross-Site Scripting Vulnerabilities</topic>
 <affects>
 <package>
	<name>horde</name>
	<range><le>3.1.2</le></range>
 </package>
 <package>
	<name>imp</name>
	<range><le>4.1.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/21500/">
	 Some vulnerabilities have been reported in Horde, which
	 can be exploited by malicious people to conduct phishing
	 and cross-site scripting attacks.
	 <ol>
	 <li>Input passed to the "url" parameter in index.php isn't
	 properly verified before it is being used to include an
	 arbitrary web site in a frameset. This can e.g. be
	 exploited to trick a user into believing certain
	 malicious content is served from a trusted web site.</li>
	 <li>Some unspecified input passed in index.php isn't
	 properly sanitised before being returned to the user.
	 This can be exploited to execute arbitrary HTML and
	 script code in a user's browser session in context of an
	 affected site.</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>19557</bid>
 <bid>19544</bid>
 <url>http://secunia.com/advisories/21500/</url>
 <url>http://lists.horde.org/archives/announce/2006/000292.html</url>
 </references>
 <dates>
 <discovery>2006-08-17</discovery>
 <entry>2006-08-17</entry>
 </dates>
 </vuln>

<vuln vid="5039ae61-2c9f-11db-8401-000ae42e9b93">
 <topic>globus -- Multiple tmpfile races</topic>
 <affects>
 <package>
	<name>globus</name>
	<range><lt>4.0.2_20060706</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Globus Alliance reports:
	<blockquote cite="http://www.globus.org/mail_archive/security-announce/2006/08/msg00000.html">
	 The proxy generation tool (grid-proxy-init) creates the
	 file, secures the file to provide access only to owner and
	 writes proxy to the file. A race condition exists between
	 the opening of the proxy credentials file, and making sure
	 it is safe file to write to. The checks to ensure this
	 file is accessible only to the owner take place using the
	 filename after the file is opened for writing, but before
	 any data is written.
	</blockquote>
	<blockquote cite="http://www.globus.org/mail_archive/security-announce/2006/08/msg00001.html">
	 Various components of the toolkit use files in shared
	 directories to store information, some being sensitive
	 information. For example, the tool to create proxy
	 certificates, stores the generated proxy certificate by
	 default in /tmp. Specific vulnerabilities in handling such
	 files were reported in myproxy-admin-adduser, grid-ca-sign
	 and grid-security-config.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4232</cvename>
 <cvename>CVE-2006-4233</cvename>
 <url>http://www.globus.org/mail_archive/security-announce/2006/08/msg00000.html</url>
 <url>http://www.globus.org/mail_archive/security-announce/2006/08/msg00001.html</url>
 </references>
 <dates>
 <discovery>2006-08-08</discovery>
 <entry>2006-08-15</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="9dda3ff1-2b02-11db-a6e2-000e0c2e438a">
 <topic>x11vnc -- authentication bypass vulnerability</topic>
 <affects>
 <package>
	<name>x11vnc</name>
	<range><lt>0.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ludwig Nussel reports that x11vnc is vulnerable to an
	 authentication bypass vulnerability.	The vulnerability is
	 caused by an error in auth.c. This could allow a remote
	 attacker to gain unauthorized and unauthenticated access
	 to the system.
 </body>
 </description>
 <references>
 <bid>18977</bid>
 <cvename>CVE-2006-2450</cvename>
 <url>http://bugs.debian.org/376824</url>
 </references>
 <dates>
 <discovery>2006-08-08</discovery>
 <entry>2006-08-13</entry>
 </dates>
 </vuln>

<vuln vid="9855ac8e-2aec-11db-a6e2-000e0c2e438a">
 <topic>alsaplayer -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>alsaplayer</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Luigi Auriemma reports three vulnerabilities within
	 alsaplayer:
	<blockquote cite="http://aluigi.altervista.org/adv/alsapbof-adv.txt">
	 <ul>
	 <li>The function which handles the HTTP connections is
	 vulnerable to a buffer-overflow that happens when it uses
	 sscanf for copying the URL in the Location's field
	 received from the server into the redirect buffer of only
	 1024 bytes declared in http_open.</li>
	 <li>A buffer-overflow exists in the functions which add items
	 to the playlist when the GTK interface is used (so the other
	 interfaces are not affected by this problem): new_list_item
	 and CbUpdated in interface/gtk/PlaylistWindow.cpp.</li>
	 <li>AlsaPlayer automatically queries the CDDB server
	 specified in its configuration (by default
	 freedb.freedb.org) when the user choices the CDDA function
	 for playing audio CDs. The function which queries the
	 server uses a buffer of 20 bytes and one of 9 for storing
	 the category and ID strings received from the server while
	 the buffer which contains this server's response is 32768
	 bytes long. Naturally for exploiting this bug the attacker
	 must have control of the freedb server specified in the
	 AlsaPlayer's configuration.</li>
	 </ul>
	</blockquote>
	These vulnerabilities could allow a remote attacker to
	 execute arbitrary code, possibly gaining access to the
	 system.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4089</cvename>
 <bid>19450</bid>
 <url>http://aluigi.altervista.org/adv/alsapbof-adv.txt</url>
 </references>
 <dates>
 <discovery>2006-08-09</discovery>
 <entry>2006-08-13</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="17f53c1d-2ae9-11db-a6e2-000e0c2e438a">
 <topic>postgresql -- encoding based SQL injection</topic>
 <affects>
 <package>
	<name>postgresql</name>
	<name>postgresql-server</name>
	<name>ja-postgresql</name>
	<range><ge>7.3</ge><lt>7.3.15</lt></range>
	<range><ge>7.4</ge><lt>7.4.13</lt></range>
	<range><ge>8.0.0</ge><lt>8.0.8</lt></range>
	<range><ge>8.1.0</ge><lt>8.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL development team reports:
	<blockquote cite="http://www.postgresql.org/docs/techdocs.50">
	 An attacker able to submit crafted strings to an
	 application that will embed those strings in SQL commands
	 can use invalidly-encoded multibyte characters to bypass
	 standard string-escaping methods, resulting in possible
	 injection of hostile SQL commands into the database. The
	 attacks covered here work in any multibyte encoding.
	 The widely-used practice of escaping ASCII single quote
	 "'" by turning it into "\'" is unsafe when operating in
	 multibyte encodings that allow 0x5c (ASCII code for
	 backslash) as the trailing byte of a multibyte character;
	 this includes at least SJIS, BIG5, GBK, GB18030, and UHC.
	 An application that uses this conversion while embedding
	 untrusted strings in SQL commands is vulnerable to
	 SQL-injection attacks if it communicates with the server in
	 one of these encodings. While the standard client libraries
	 used with PostgreSQL have escaped "'" in the safe,
	 SQL-standard way of "''" for some time, the older practice
	 remains common.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>18092</bid>
 <cvename>CVE-2006-2313</cvename>
 <cvename>CVE-2006-2314</cvename>
 <url>http://www.postgresql.org/docs/techdocs.50</url>
 </references>
 <dates>
 <discovery>2006-05-11</discovery>
 <entry>2006-08-13</entry>
 </dates>
 </vuln>

<vuln vid="65c8ecf9-2adb-11db-a6e2-000e0c2e438a">
 <topic>postgresql -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql</name>
	<name>postgresql-server</name>
	<name>ja-postgresql</name>
	<range><ge>7.2</ge><lt>7.2.7</lt></range>
	<range><ge>7.3</ge><lt>7.3.9</lt></range>
	<range><ge>7.4</ge><lt>7.4.7</lt></range>
	<range><ge>8.0.0</ge><lt>8.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple vulnerabilities had been reported in various
	 versions of PostgreSQL:
	<ul>
	 <li>The EXECUTE restrictions can be bypassed by using the
	 AGGREGATE function, which is missing a permissions check.</li>
	 <li>A buffer overflow exists in gram.y which could allow an
	 attacker to execute arbitrary code by sending a large
	 number of arguments to a refcursor function, found in
	 gram.y</li>
	 <li>The intagg contributed module allows an attacker to crash
	 the server (Denial of Service) by constructing a malicious
	 crafted array.</li>
	</ul>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0244</cvename>
 <cvename>CVE-2005-0245</cvename>
 <cvename>CVE-2005-0246</cvename>
 <url>http://secunia.com/advisories/12948</url>
 </references>
 <dates>
 <discovery>2005-02-01</discovery>
 <entry>2006-08-13</entry>
 </dates>
 </vuln>

<vuln vid="fcb90eb0-2ace-11db-a6e2-000e0c2e438a">
 <topic>mysql -- format string vulnerability</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><ge>5.1</ge><lt>5.1.6</lt></range>
	<range><ge>5.0</ge><lt>5.0.19</lt></range>
	<range><ge>4.1</ge><lt>4.1.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jean-David Maillefer reports a Denial of Service vulnerability
	 within MySQL. The vulnerability is caused by improper checking
	 of the data_format routine, which cause the MySQL server to
	 crash. The crash is triggered by the following code: 
	 <code>"SELECT date_format('%d%s', 1);</code>
 </body>
 </description>
 <references>
 <bid>19032</bid>
 <cvename>CVE-2006-3469</cvename>
 <url>http://bugs.mysql.com/bug.php?id=20729</url>
 </references>
 <dates>
 <discovery>2006-06-27</discovery>
 <entry>2006-08-13</entry>
 </dates>
 </vuln>

<vuln vid="21b7c550-2a22-11db-a6e2-000e0c2e438a">
 <topic>squirrelmail -- random variable overwrite vulnerability</topic>
 <affects>
 <package>
	<name>ja-squirrelmail</name>
	<range><ge>1.4.0</ge><lt>1.4.8,2</lt></range>
 </package>
 <package>
	<name>squirrelmail</name>
	<range><ge>1.4.0</ge><lt>1.4.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The SquirrelMail developers report:
	<blockquote cite="http://www.squirrelmail.org/security/issue/2006-08-11">
	 A logged in user could overwrite random variables in
	 compose.php, which might make it possible to read/write
	 other users' preferences or attachments.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4019</cvename>
 <url>http://www.squirrelmail.org/security/issue/2006-08-11</url>
 </references>
 <dates>
 <discovery>2006-08-11</discovery>
 <entry>2006-08-12</entry>
 </dates>
 </vuln>

<vuln vid="90064567-28b1-11db-844d-000c6ec775d9">
 <topic>rubygem-rails -- evaluation of ruby code</topic>
 <affects>
 <package>
	<name>rubygem-rails</name>
	<range><ge>1.1.0</ge><lt>1.1.3</lt></range>
	<range><ge>1.1.4</ge><lt>1.1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Ruby on Rails blog reports:
	<blockquote cite="http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure">
	 With Rails 1.1.0 through 1.1.5 (minus the short-lived 1.1.3),
	 you can trigger the evaluation of Ruby code through the URL
	 because of a bug in the routing code of Rails. This means that
	 you can essentially take down a Rails process by starting
	 something like /script/profiler, as the code will run for a
	 long time and that process will be hung while it happens.
	 Other URLs can even cause data loss.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure</url>
 </references>
 <dates>
 <discovery>2006-08-09</discovery>
 <entry>2006-08-10</entry>
 </dates>
 </vuln>

<vuln vid="342d2e48-26db-11db-9275-000475abc56f">
 <topic>clamav -- heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><ge>0.88.1</ge><lt>0.88.4</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><lt>20060808</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Clamav team reports:
	<blockquote cite="http://www.clamav.net/security/0.88.4.html">
	 A heap overflow vulnerability was discovered in libclamav
	 which could cause a denial of service or allow the
	 execution of arbitrary code.
	 The problem is specifically located in the PE file rebuild
	 function used by the UPX unpacker.
	 Relevant code from libclamav/upx.c:
	 
	 memcpy(dst, newbuf, foffset);
	 *dsize = foffset;
	 free(newbuf);

cli_dbgmsg("UPX: PE structure rebuilt from compressed file\n");
	 return 1;
	 Due to improper validation it is possible to overflow the above
	 memcpy() beyond the allocated memory block.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-4018</cvename>
 <url>http://www.clamav.net/security/0.88.4.html</url>
 </references>
 <dates>
 <discovery>2006-08-07</discovery>
 <entry>2006-08-08</entry>
 </dates>
 </vuln>

<vuln vid="c905298c-2274-11db-896e-000ae42e9b93">
 <topic>drupal -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>drupal</name>
	<range><lt>4.6.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal project reports:
	<blockquote cite="http://drupal.org/files/sa-2006-011/advisory.txt">
	 A malicious user can execute a cross site scripting attack
	 by enticing someone to visit a Drupal site via a specially
	 crafted link.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://drupal.org/files/sa-2006-011/advisory.txt</url>
 </references>
 <dates>
 <discovery>2006-08-02</discovery>
 <entry>2006-08-02</entry>
 <modified>2006-08-08</modified>
 </dates>
 </vuln>

<vuln vid="ed529baa-21c6-11db-b625-02e081235dab">
 <topic>gnupg -- 2 more possible memory allocation attacks</topic>
 <affects>
 <package>
	<name>gnupg</name>
	<range><lt>1.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Author reports:
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q3/000229.html">
	 Fixed 2 more possible memory allocation attacks. They are
	 similar to the problem we fixed with 1.4.4. This bug can easily
	 be exploted for a DoS; remote code execution is not entirely
	 impossible.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.gnupg.org/pipermail/gnupg-announce/2006q3/000229.html</url>
 </references>
 <dates>
 <discovery>2006-08-01</discovery>
 <entry>2006-08-02</entry>
 </dates>
 </vuln>

<vuln vid="76562594-1f19-11db-b7d4-0008743bf21a">
 <topic>ruby -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ruby</name>
	<name>ruby_static</name>
	<range><gt>1.6.*</gt><lt>1.8.*</lt></range>
	<range><gt>1.8.*</gt><lt>1.8.4_9,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/21009/">
	 Two vulnerabilities have been reported in Ruby, which can
	 be exploited by malicious people to bypass certain security
	 restrictions.
	 <ol>
	 <li>An error in the handling of the "alias" functionality
	 can be exploited to bypass the safe level protection and
	 replace methods called in the trusted level.</li>
	 <li>An error caused due to directory operations not being
	 properly checked can be exploited to bypass the safe
	 level protection and close untainted directory streams.</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>18944</bid>
 <cvename>CVE-2006-3694</cvename>
 <url>http://secunia.com/advisories/21009/</url>
 <url>http://jvn.jp/jp/JVN%2383768862/index.html</url>
 <url>http://jvn.jp/jp/JVN%2313947696/index.html</url>
 </references>
 <dates>
 <discovery>2006-07-12</discovery>
 <entry>2006-07-29</entry>
 <modified>2006-07-30</modified>
 </dates>
 </vuln>

<vuln vid="dc8c08c7-1e7c-11db-88cf-000c6ec775d9">
 <topic>apache -- mod_rewrite buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><ge>1.3.28</ge><lt>1.3.36_1</lt></range>
	<range><ge>2.0.46</ge><lt>2.0.58_2</lt></range>
	<range><ge>2.2.0</ge><lt>2.2.2_1</lt></range>
 </package>
 <package>
	<name>apache+mod_perl</name>
	<range><ge>1.3.28</ge><lt>1.3.36_1</lt></range>
 </package>
 <package>
	<name>apache+ipv6</name>
	<range><ge>1.3.28</ge><lt>1.3.37</lt></range>
 </package>
 <package>
	<name>apache_fp</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>ru-apache</name>
	<range><ge>1.3.28</ge><lt>1.3.37+30.23</lt></range>
 </package>
 <package>
	<name>ru-apache+mod_ssl</name>
	<range><ge>1.3.28</ge><lt>1.3.34.1.57_2</lt></range>
 </package>
 <package>
	<name>apache+ssl</name>
	<range><ge>1.3.28</ge><lt>1.3.34.1.57_2</lt></range>
 </package>
 <package>
	<name>apache+mod_ssl</name>
	<name>apache+mod_ssl+ipv6</name>
	<name>apache+mod_ssl+mod_accel</name>
	<name>apache+mod_ssl+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_deflate</name>
	<name>apache+mod_ssl+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
	<range><ge>1.3.28</ge><lt>1.3.36+2.8.27_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation and The Apache HTTP Server
	 Project reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=apache-httpd-announce&amp;m=115409818602955">
	 An off-by-one flaw exists in the Rewrite module,
	 mod_rewrite, as shipped with Apache 1.3 since 1.3.28, 2.0
	 since 2.0.46, and 2.2 since 2.2.0.
	 Depending on the manner in which Apache HTTP Server was
	 compiled, this software defect may result in a
	 vulnerability which, in combination with certain types of
	 Rewrite rules in the web server configuration files, could
	 be triggered remotely. For vulnerable builds, the nature
	 of the vulnerability can be denial of service (crashing of
	 web server processes) or potentially allow arbitrary code
	 execution. This issue has been rated as having important
	 security impact by the Apache HTTP Server Security Team.
	 This flaw does not affect a default installation of
	 Apache HTTP Server. Users who do not use, or have not
	 enabled, the Rewrite module mod_rewrite are not affected
	 by this issue. This issue only affects installations using
	 a Rewrite rule with the following characteristics:
	 <ul>
	 <li>The RewriteRule allows the attacker to control the
	 initial part of the rewritten URL (for example if the
	 substitution URL starts with $1)</li>
	 <li>The RewriteRule flags do NOT include any of the
	 following flags: Forbidden (F), Gone (G), or NoEscape
	 (NE).</li>
	 </ul>
	 Please note that ability to exploit this issue is
	 dependent on the stack layout for a particular compiled
	 version of mod_rewrite. If the compiler used to compile
	 Apache HTTP Server has added padding to the stack
	 immediately after the buffer being overwritten, it will
	 not be possible to exploit this issue, and Apache HTTP
	 Server will continue operating normally.
	 The Apache HTTP Server project thanks Mark Dowd of McAfee
	 Avert Labs for the responsible reporting of this
	 vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <certvu>395412</certvu>
 <cvename>CVE-2006-3747</cvename>
 <mlist msgid="44CA22D9.6020200@apache.org">http://marc.theaimsgroup.com/?l=apache-httpd-announce&amp;m=115409818602955</mlist>
 </references>
 <dates>
 <discovery>2006-07-27</discovery>
 <entry>2006-07-28</entry>
 <modified>2006-11-01</modified>
 </dates>
 </vuln>

<vuln vid="e2a92664-1d60-11db-88cf-000c6ec775d9">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.5.0.5,1</lt></range>
	<range><gt>2.*,1</gt><lt>2.0_1,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.5.0.5</lt></range>
 </package>
 <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.a2006.07.26</lt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.0.3</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<name>mozilla-thunderbird</name>
	<range><lt>1.5.0.5</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory reports of multiple
	 issues. Several of which can be used to run arbitrary code
	 with the privilege of the user running the program.
	<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html#seamonkey1.0.3">
	 <ul>
	 <li>MFSA 2006-56 chrome: scheme loading remote content</li>
	 <li>MFSA 2006-55 Crashes with evidence of memory corruption
	 (rv:1.8.0.5)</li>
	 <li>MFSA 2006-54 XSS with
	 XPCNativeWrapper(window).Function(...)</li>
	 <li>MFSA 2006-53 UniversalBrowserRead privilege escalation</li>
	 <li>MFSA 2006-52 PAC privilege escalation using
	 Function.prototype.call</li>
	 <li>MFSA 2006-51 Privilege escalation using named-functions
	 and redefined "new Object()"</li>
	 <li>MFSA 2006-50 JavaScript engine vulnerabilities</li>
	 <li>MFSA 2006-49 Heap buffer overwrite on malformed VCard</li>
	 <li>MFSA 2006-48 JavaScript new Function race condition</li>
	 <li>MFSA 2006-47 Native DOM methods can be hijacked across
	 domains</li>
	 <li>MFSA 2006-46 Memory corruption with simultaneous events</li>
	 <li>MFSA 2006-45 Javascript navigator Object Vulnerability</li>
	 <li>MFSA 2006-44 Code execution through deleted frame
	 reference</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-3113</cvename>
 <cvename>CVE-2006-3677</cvename>
 <cvename>CVE-2006-3801</cvename>
 <cvename>CVE-2006-3802</cvename>
 <cvename>CVE-2006-3803</cvename>
 <cvename>CVE-2006-3804</cvename>
 <cvename>CVE-2006-3805</cvename>
 <cvename>CVE-2006-3806</cvename>
 <cvename>CVE-2006-3807</cvename>
 <cvename>CVE-2006-3808</cvename>
 <cvename>CVE-2006-3809</cvename>
 <cvename>CVE-2006-3810</cvename>
 <cvename>CVE-2006-3811</cvename>
 <cvename>CVE-2006-3812</cvename>
 <url>http://www.mozilla.org/projects/security/known-vulnerabilities.html#seamonkey1.0.3</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-44.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-45.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-46.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-47.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-48.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-49.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-50.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-51.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-52.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-53.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-54.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-55.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-56.html</url>
 </references>
 <dates>
 <discovery>2006-07-25</discovery>
 <entry>2006-07-27</entry>
 <modified>2006-11-02</modified>
 </dates>
 </vuln>

<vuln vid="5f2a0c40-1322-11db-bd23-000475abc56f">
 <topic>zope -- information disclosure vulnerability</topic>
 <affects>
 <package>
	<name>zope</name>
	<range><ge>2.7.0</ge><lt>2.7.9</lt></range>
	<range><ge>2.8.0</ge><lt>2.8.7</lt></range>
	<range><ge>2.9.0</ge><lt>2.9.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Zope team reports:
	<blockquote cite="http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-2006-07-05/view">
	 Unspecified vulnerability in (Zope2) allows local users
	 to obtain sensitive information via unknown attack vectors
	 related to the docutils module and "restructured text".
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-3458</cvename>
 <url>http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-2006-07-05/view</url>
 </references>
 <dates>
 <discovery>2006-07-05</discovery>
 <entry>2006-07-14</entry>
 </dates>
 </vuln>

<vuln vid="6da7344b-128a-11db-b25f-00e00c69a70d">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal</name>
	<range><lt>4.6.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal team reports:
	<blockquote cite="http://drupal.org/node/66767">
	 Vulnerability: XSS Vulnerability in taxonomy module
	 It is possible for a malicious user to insert and execute
	 XSS into terms, due to lack of validation on output of the
	 page title. The fix wraps the display of terms in
	 check_plain().
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-2833</cvename>
 <url>http://drupal.org/node/66767</url>
 </references>
 <dates>
 <discovery>2006-05-18</discovery>
 <entry>2006-07-13</entry>
 <modified>2006-07-14</modified>
 </dates>
 </vuln>

<vuln vid="67dbe99f-0f09-11db-94f8-00e029485e38">
 <topic>shoutcast -- cross-site scripting, information exposure</topic>
 <affects>
 <package>
	<name>shoutcast</name>
	<name>linux-shoutcast</name>
	<range><lt>1.9.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Goober's advisory reports reports that shoutcast is vulnerable to an
	 arbitrary file reading vulnerability:
	<blockquote cite="http://people.ksp.sk/~goober/advisory/001-shoutcast.html">
	Impact of the vulnerability depends on the way the product was
	 installed. In general, the vulnerability allows the attacker to read
	 any file which can be read by the Shoutcast server process.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-3007</cvename>
 <url>http://secunia.com/advisories/20524/</url>
 <url>http://people.ksp.sk/~goober/advisory/001-shoutcast.html</url>
 </references>
 <dates>
 <discovery>2006-06-09</discovery>
 <entry>2006-07-11</entry>
 </dates>
 </vuln>

<vuln vid="b168ddea-105a-11db-ac96-000c6ec775d9">
 <topic>samba -- memory exhaustion DoS in smbd</topic>
 <affects>
 <package>
	<name>samba</name>
	<name>ja-samba</name>
	<range><ge>3.0.1,1</ge><lt>3.0.23,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Samba Team reports:
	<blockquote cite="http://www.samba.org/samba/security/CAN-2006-3403.html">
	 The smbd daemon maintains internal data structures used
	 track active connections to file and printer shares. In
	 certain circumstances an attacker may be able to
	 continually increase the memory usage of an smbd process
	 by issuing a large number of share connection requests.
	 This defect affects all Samba configurations.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-3403</cvename>
 <url>http://www.samba.org/samba/security/CAN-2006-3403.html</url>
 </references>
 <dates>
 <discovery>2006-07-10</discovery>
 <entry>2006-07-10</entry>
 </dates>
 </vuln>

<vuln vid="a876df84-0fef-11db-ac96-000c6ec775d9">
 <topic>twiki -- multiple file extensions file upload vulnerability</topic>
 <affects>
 <package>
	<name>twiki</name>
	<range><lt>4.0.4,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A TWiki Security Alert reports:
	<blockquote cite="http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads">
	 The TWiki upload filter already prevents executable
	 scripts such as .php, .php1, .phps, .pl from potentially
	 getting executed by appending a .txt suffix to the
	 uploaded filename. However, PHP and some other types
	 allows additional file suffixes, such as .php.en, .php.1,
	 and .php.2. TWiki does not check for these suffixes,
	 e.g. it is possible to upload php scripts with such
	 suffixes without the .txt filename padding.
	</blockquote>
	This issue can also be worked around with a restrictive web
	 server configuration. See the
	 <a href="http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads">
	 TWiki Security Alert</a> for more information about how to do
	 this.
 </body>
 </description>
 <references>
 <bid>18854</bid>
 <cvename>CVE-2006-3336</cvename>
 <url>http://secunia.com/advisories/20992/</url>
 <url>http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads</url>
 </references>
 <dates>
 <discovery>2006-07-05</discovery>
 <entry>2006-07-10</entry>
 </dates>
 </vuln>

<vuln vid="b0d61f73-0e11-11db-a47b-000c2957fdf1">
 <topic>trac -- reStructuredText breach of privacy and denial of service vulnerability</topic>
 <affects>
 <package>
	<name>trac</name>
	<name>ja-trac</name>
	<range><lt>0.9.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Trac 0.9.6 Release Notes reports:
	<blockquote cite="http://lists.edgewall.com/archive/trac-announce/2006-July/000013.html">
	 Fixed reStructuredText breach of privacy and denial of
	 service vulnerability found by Felix Wiemann.
	 The discovered vulnerability requires docutils to be
	 installed and enabled. Systems that do not have docutils
	 installed or enabled are not vulnerable. As of this
	 version version 0.3.9 or greater of docutils is required
	 for using reStructuredText markup in Trac.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-3980</cvename>
 <cvename>CVE-2005-4305</cvename>
 <cvename>CVE-2005-4065</cvename>
 <url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
 <mlist>http://lists.edgewall.com/archive/trac-announce/2006-July/000013.html</mlist>
 </references>
 <dates>
 <discovery>2006-07-06</discovery>
 <entry>2006-07-07</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="e94cb43d-0c4a-11db-9016-0050bf27ba24">
 <topic>horde -- various problems in dereferrer</topic>
 <affects>
 <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><lt>3.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Horde 3.1.2 release announcement:
	<blockquote cite="http://lists.horde.org/archives/announce/2006/000288.html">
	 Security Fixes:
	 <ul>
	 <li>Closed XSS problems in dereferrer (IE only), help viewer
	 and problem reporting screen.</li>
	 <li>Removed unused image proxy code from dereferrer.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-3548</cvename>
 <url>http://lists.horde.org/archives/announce/2006/000288.html</url>
 </references>
 <dates>
 <discovery>2006-06-28</discovery>
 <entry>2006-07-05</entry>
 <modified>2010-05-12</modified>
 </dates>
 </vuln>

<vuln vid="f70d09cb-0c46-11db-aac7-000c6ec775d9">
 <topic>mambo -- SQL injection vulnerabilities</topic>
 <affects>
 <package>
	<name>mambo</name>
	<range><lt>4.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Team Mambo reports that two SQL injection
	 vulnerabilities have been found in Mambo. The
	 vulnerabilities exists due to missing sanitation of the
	 <code>title</code> and <code>catid</code> parameters in the
	 <code>weblinks.php</code> page and can lead to execution of
	 arbitrary SQL code.
 </body>
 </description>
 <references>
 <bid>16775</bid>
 <cvename>CVE-2006-0871</cvename>
 <cvename>CVE-2006-1794</cvename>
 <cvename>CVE-2006-3262</cvename>
 <cvename>CVE-2006-3263</cvename>
 <mlist msgid="20060617123242.1684.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=115056811230529</mlist>
 <url>http://secunia.com/advisories/18935/</url>
 <url>http://secunia.com/advisories/20745/</url>
 <url>http://www.mamboserver.com/?option=com_content&amp;task=view&amp;id=207</url>
 <url>http://www.gulftech.org/?node=research&amp;article_id=00104-02242006</url>
 </references>
 <dates>
 <discovery>2006-06-19</discovery>
 <entry>2006-07-05</entry>
 <modified>2006-10-05</modified>
 </dates>
 </vuln>

<vuln vid="229577a8-0936-11db-bf72-00046151137e">
 <topic>phpmyadmin -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.8.2</lt></range>
	</package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpmyadmin Site reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4">
	 It was possible to craft a request that contains XSS by attacking
	 the "table" parameter.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4</url>
 <url>http://securitynews.ir/advisories/phpmyadmin281.txt</url>
 </references>
 <dates>
 <discovery>2006-06-30</discovery>
 <entry>2006-07-03</entry>
 <modified>2007-10-16</modified>
 </dates>
 </vuln>

<vuln vid="227475c2-09cb-11db-9156-000e0c2e438a">
 <topic>webmin, usermin -- arbitrary file disclosure vulnerability</topic>
 <affects>
 <package>
	<name>webmin</name>
	<range><lt>1.290</lt></range>
 </package>
 <package>
	<name>usermin</name>
	<range><lt>1.220</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The webmin development team reports:
	<blockquote cite="http://www.webmin.com/security.html">
	 An attacker without a login to Webmin can read the
	 contents of any file on the server using a specially
	 crafted URL. All users should upgrade to version
	 1.290 as soon as possible, or setup IP access control
	 in Webmin.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>18744</bid>
 <url>http://www.webmin.com/security.html</url>
 </references>
 <dates>
 <discovery>2006-06-30</discovery>
 <entry>2006-07-02</entry>
 </dates>
 </vuln>

<vuln vid="d2a43243-087b-11db-bc36-0008743bf21a">
 <topic>mutt -- Remote Buffer Overflow Vulnerability</topic>
 <affects>
 <package>
	<name>mutt</name>
	<name>mutt-lite</name>
	<range><le>1.4.2.1_2</le></range>
 </package>
 <package>
	<name>mutt-devel</name>
	<name>mutt-devel-lite</name>
	<range><le>1.5.11_2</le></range>
 </package>
 <package>
	<name>ja-mutt</name>
	<range><le>1.4.2.1.j1</le></range>
 </package>
 <package>
	<name>zh-mutt-devel</name>
	<range><le>1.5.11_20040617</le></range>
 </package>
 <package>
	<name>ja-mutt-devel</name>
	<range><le>1.5.6.j1_2</le></range>
 </package>
 <package>
	<name>mutt-ng</name>
	<range><le>20060501</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/18642">
	 Mutt is prone to a remote buffer-overflow vulnerability.
	 This issue is due to the application's failure to properly
	 bounds-check user-supplied input before copying it to an
	 insufficiently sized memory buffer.
	 This issue may allow remote attackers to execute arbitrary
	 machine code in the context of the affected application.
	 Failed exploit attempts will likely crash the application,
	 denying further service to legitimate users.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>18642</bid>
 <url>http://dev.mutt.org/cgi-bin/gitweb.cgi?p=mutt/.git;a=commit;h=dc0272b749f0e2b102973b7ac43dbd3908507540</url>
 </references>
 <dates>
 <discovery>2006-06-26</discovery>
 <entry>2006-06-30</entry>
 </dates>
 </vuln>

<vuln vid="1f935f61-075d-11db-822b-728b50d539a3">
 <topic>Joomla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>joomla</name>
	<range><lt>1.0.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Joomla Site reports:
	<blockquote cite="http://www.joomla.org/content/view/1510/74/">
	 <ul>
	 <li>Secured "Remember Me" functionality against SQL injection
	 attacks</li>
	 <li>Secured "Related Items" module against SQL injection
	 attacks</li>
	 <li>Secured "Weblinks" submission against SQL injection
	 attacks</li>
	 <li>Secured SEF from XSS vulnerability</li>
	 <li>Hardened frontend submission forms against spoofing</li>
	 <li>Secured mosmsg from misuse</li>
	 <li>Hardened mosgetparam by setting variable type to integer if
	 default value is detected as numeric</li>
	 <li>Secured com_messages from XSS vulnerability</li>
	 <li>Secured getUserStateFromRequest() from XSS vulnerability</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/20746/</url>
 <url>http://www.joomla.org/content/view/1510/74/</url>
 </references>
 <dates>
 <discovery>2006-06-26</discovery>
 <entry>2006-06-30</entry>
 </dates>
 </vuln>

<vuln vid="2be7c122-0614-11db-9156-000e0c2e438a">
 <topic>hashcash -- heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>hashcash</name>
	<range><lt>1.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Andreas Seltenreich reports that hashcash is prone to a heap
	 overflow vulnerability. This vulnerability is caused by
	 improper checking of memory allocations within the
	 "array_push()" function. An attacker could trigger this
	 vulnerability by passing a lot of "-r" or "-j" flags from
	 the command line, this only applies when the application is
	 configured to allow command line options, or by passing a lot
	 of resource names when the application was started with the
	 "-m" flag set. This could lead to a Denial or Service or
	 could allow remote access to the targeted system.
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/20800/</url>
 <url>http://www.hashcash.org/source/CHANGELOG</url>
 </references>
 <dates>
 <discovery>2006-06-27</discovery>
 <entry>2006-06-27</entry>
 </dates>
 </vuln>

<vuln vid="f900bda8-0472-11db-bbf7-000c6ec775d9">
 <topic>gnupg -- user id integer overflow vulnerability</topic>
 <affects>
 <package>
	<name>gnupg</name>
	<range><lt>1.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	If GnuPG processes a userid with a very long packet length,
	 GnuPG can crash due to insufficient bounds check. This can
	 result in a denial-of-service condition or potentially
	 execution of arbitrary code with the privileges of the user
	 running GnuPG.
 </body>
 </description>
 <references>
 <bid>18554</bid>
 <cvename>CVE-2006-3082</cvename>
 <mlist msgid="87psgxic5e.fsf@wheatstone.g10code.de">http://marc.theaimsgroup.com/?l=gnupg-users&amp;m=115124706210430</mlist>
 <mlist msgid="20060531115548.A2E4923E4B6@dzeta.agava.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=114907659313360</mlist>
 <url>http://cvs.gnupg.org/cgi-bin/viewcvs.cgi/trunk/g10/parse-packet.c?rev=4157&amp;r1=4141&amp;r2=4157</url>
 </references>
 <dates>
 <discovery>2006-05-31</discovery>
 <entry>2006-06-25</entry>
 </dates>
 </vuln>

<vuln vid="09429f7c-fd6e-11da-b1cd-0050bf27ba24">
 <topic>horde -- multiple parameter cross site scripting vulnerabilities</topic>
 <affects>
 <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><le>3.1.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	FrSIRT advisory ADV-2006-2356 reports:
	<blockquote cite="http://www.frsirt.com/english/advisories/2006/2356">
	 Multiple vulnerabilities have been identified in Horde
	 Application Framework, which may be exploited by attackers
	 to execute arbitrary scripting code. These flaws are due
	 to input validation errors in the "test.php" and
	 "templates/problem/problem.inc" scripts that do not
	 validate the "url", "name", "email", "subject" and
	 "message" parameters, which could be exploited by
	 attackers to cause arbitrary scripting code to be executed
	 by the user's browser in the security context of an
	 affected Web site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-2195</cvename>
 <url>http://www.frsirt.com/english/advisories/2006/2356</url>
 <url>http://cvs.horde.org/diff.php?f=horde%2Ftest.php&amp;r1=1.145&amp;r2=1.146</url>
 <url>http://cvs.horde.org/diff.php?f=horde%2Ftemplates%2Fproblem%2Fproblem.inc&amp;r1=2.25&amp;r2=2.26</url>
 </references>
 <dates>
 <discovery>2006-06-10</discovery>
 <entry>2006-06-17</entry>
 </dates>
 </vuln>

<vuln vid="09c92f3a-fd49-11da-995c-605724cdf281">
 <topic>WebCalendar -- information disclosure vulnerability</topic>
 <affects>
 <package>
	<name>WebCalendar</name>
	<range><lt>1.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/20367/">
	 socsam has discovered a vulnerability in WebCalendar,
	 which can be exploited by malicious people to bypass
	 certain security restrictions and disclose sensitive
	 information.
	 Input passed to the "includedir" parameter isn't properly
	 verified, before it is used in an "fopen()" call. This can
	 be exploited to load an arbitrary setting file from an
	 external web site.
	 This can further be exploited to disclose the content of
	 arbitrary files by defining the "user_inc" variable in a
	 malicious setting file.
	 Successful exploitation requires that "register_globals"
	 is enabled.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>18175</bid>
 <cvename>CVE-2006-2762</cvename>
 <url>http://www.securityfocus.com/archive/1/435379</url>
 <url>http://www.securityfocus.com/archive/1/436263</url>
 </references>
 <dates>
 <discovery>2006-05-30</discovery>
 <entry>2006-06-16</entry>
 <modified>2006-06-17</modified>
 </dates>
 </vuln>

<vuln vid="c611be81-fbc2-11da-9156-000e0c2e438a">
 <topic>sendmail -- Incorrect multipart message handling</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>4.11</ge><lt>4.11_19</lt></range>
	<range><ge>5.3</ge><lt>5.3_31</lt></range>
	<range><ge>5.4</ge><lt>5.4_16</lt></range>
	<range><ge>5.5</ge><lt>5.5_2</lt></range>
	<range><ge>6.0</ge><lt>6.0_9</lt></range>
	<range><ge>6.1</ge><lt>6.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	A suitably malformed multipart MIME message can cause
	 sendmail to exceed predefined limits on its stack usage.
	<h1>Impact</h1>
	An attacker able to send mail to, or via, a server can cause
	 queued messages on the system to not be delivered, by causing
	 the sendmail process which handles queued messages to crash.
	 Note that this will not stop new messages from entering the
	 queue (either from local processes, or incoming via SMTP).
	<h1>Workaround</h1>
	No workaround is available, but systems which do not receive
	 email from untrusted sources are not vulnerable.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1173</cvename>
 <freebsdsa>SA-06:17.sendmail</freebsdsa>
 </references>
 <dates>
 <discovery>2006-06-14</discovery>
 <entry>2006-06-14</entry>
 </dates>
 </vuln>

<vuln vid="23573650-f99a-11da-994e-00142a5f241c">
 <topic>dokuwiki -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>dokuwiki</name>
	<range><lt>20060309_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple vulnerabilities have been reported within dokuwiki.
	 dokuwiki is proven vulnerable to:
	<ul>
	 <li>arbitrary PHP code insertion via spellcheck module,</li>
	 <li>XSS attack via "Update your account profile,"</li>
	 <li>bypassing of ACL controls when enabled.</li>
	</ul>
 </body>
 </description>
 <references>
 <url>http://bugs.splitbrain.org/index.php?do=details&amp;id=820</url>
 <url>http://bugs.splitbrain.org/index.php?do=details&amp;id=823</url>
 <url>http://bugs.splitbrain.org/index.php?do=details&amp;id=825</url>
 </references>
 <dates>
 <discovery>2006-05-31</discovery>
 <entry>2006-06-11</entry>
 <modified>2006-06-12</modified>
 </dates>
</vuln>

<vuln vid="107e2ee5-f941-11da-b1fa-020039488e34">
 <topic>libxine -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>libxine</name>
	<range><lt>1.1.1_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/20369">
	 Federico L. Bossi Bonin has discovered a weakness in xine-lib,
	 which can be exploited by malicious people to crash certain
	 applications on a user's system.
	 The weakness is cause due to a heap corruption within the
	 "xineplug_inp_http.so" plugin when handling an overly large
	 reply from the HTTP server. This can be exploited to crash
	 an application that uses the plugin (e.g. gxine).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/20369</url>
 <cvename>CVE-2006-2802</cvename>
 <bid>18187</bid>
 </references>
 <dates>
 <discovery>2006-05-31</discovery>
 <entry>2006-06-11</entry>
 </dates>
 </vuln>

<vuln vid="cf3b9a96-f7bb-11da-9156-000e0c2e438a">
 <topic>smbfs -- chroot escape</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>4.10</ge><lt>4.10_24</lt></range>
	<range><ge>4.11</ge><lt>4.11_18</lt></range>
	<range><ge>5.3</ge><lt>5.3_30</lt></range>
	<range><ge>5.4</ge><lt>5.4_15</lt></range>
	<range><ge>5.5</ge><lt>5.5_1</lt></range>
	<range><ge>6.0</ge><lt>6.0_8</lt></range>
	<range><ge>6.1</ge><lt>6.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	smbfs does not properly sanitize paths containing a backslash
	 character; in particular the directory name '..\' is
	 interpreted as the parent directory by the SMB/CIFS server,
	 but smbfs handles it in the same manner as any other
	 directory.
	<h1>Impact</h1>
	When inside a chroot environment which resides on a smbfs
	 mounted file-system it is possible for an attacker to escape
	 out of this chroot to any other directory on the smbfs
	 mounted file-system.
	<h1>Workaround</h1>
	Mount the smbfs file-systems which need to be used with
	 chroot on top, in a way so the chroot directory is exactly on
	 the mount point and not a sub directory
 </body>
 </description>
 <references>
 <cvename>CVE-2006-2654</cvename>
 <freebsdsa>SA-06:16.smbfs</freebsdsa>
 </references>
 <dates>
 <discovery>2006-05-31</discovery>
 <entry>2006-06-09</entry>
 </dates>
 </vuln>

<vuln vid="0ac1aace-f7b9-11da-9156-000e0c2e438a">
 <topic>ypserv -- Inoperative access controls in ypserv</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.3</ge><lt>5.3_30</lt></range>
	<range><ge>5.4</ge><lt>5.4_15</lt></range>
	<range><ge>5.5</ge><lt>5.5_1</lt></range>
	<range><ge>6.0</ge><lt>6.0_8</lt></range>
	<range><ge>6.1</ge><lt>6.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	There are two documented methods of restricting access to
	 NIS maps through ypserv(8): through the use of the
	 /var/yp/securenets file, and through the /etc/hosts.allow file.
	 While both mechanisms are implemented in the server, a change
	 in the build process caused the "securenets" access restrictions
	 to be inadvertantly disabled.
	<h1>Impact</h1>
	ypserv(8) will not load or process any of the networks or
	 hosts specified in the /var/yp/securenets file, rendering
	 those access controls ineffective.
	<h1>Workaround</h1>
	One possible workaround is to use /etc/hosts.allow for access
	 control, as shown by examples in that file.
	Another workaround is to use a firewall (e.g., ipfw(4),
	 ipf(4), or pf(4)) to limit access to RPC functions from
	 untrusted systems or networks, but due to the complexities of
	 RPC, it might be difficult to create a set of firewall rules
	 which accomplish this without blocking all access to the
	 machine in question.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-2655</cvename>
 <freebsdsa>SA-06:15.ypserv</freebsdsa>
 </references>
 <dates>
 <discovery>2006-05-31</discovery>
 <entry>2006-06-09</entry>
 </dates>
 </vuln>

<vuln vid="ec2f2ff5-f710-11da-9156-000e0c2e438a">
 <topic>freeradius -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>freeradius</name>
	<range><ge>1.0.0</ge><le>1.0.4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The freeradious development team reports:
	<blockquote cite="http://www.freeradius.org/security.html">
	 Multiple issues exist with version 1.0.4, and all prior
	 versions of the server. Externally exploitable
	 vulnerabilities exist only for sites that use the
	 rlm_sqlcounter module. Those sites may be vulnerable to
	 SQL injection attacks, similar to the issues noted below.
	 All sites that have not deployed the rlm_sqlcounter module
	 are not vulnerable to external exploits.
	 The issues are: 
	 SQL Injection attack in the rlm_sqlcounter module. 
	 Buffer overflow in the rlm_sqlcounter module, that may cause
	 a server crash. 
	 Buffer overflow while expanding %t, that may cause a server
	 crash.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>17171</bid>
 <cvename>CVE-2005-4744</cvename>
 </references>
 <dates>
 <discovery>2005-09-09</discovery>
 <entry>2006-06-08</entry>
 </dates>
 </vuln>

<vuln vid="1a216dfd-f710-11da-9156-000e0c2e438a">
 <topic>freeradius -- authentication bypass vulnerability</topic>
 <affects>
 <package>
	<name>freeradius</name>
	<range><gt>1.0.0</gt><le>1.1.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The freeradius development team reports:
	<blockquote cite="http://www.freeradius.org/security.html">
	 A validation issue exists with the EAP-MSCHAPv2 module
	 in all versions from 1.0.0 (where the module first
	 appeared) to 1.1.0. Insufficient input validation was being
	 done in the EAP-MSCHAPv2 state machine. A malicious
	 attacker could manipulate their EAP-MSCHAPv2 client state
	 machine to potentially convince the server to bypass
	 authentication checks. This bypassing could also result
	 in the server crashing
	</blockquote>
 </body>
 </description>
 <references>
 <bid>17293</bid>
 <cvename>CVE-2006-1354</cvename>
 </references>
 <dates>
 <discovery>2006-06-03</discovery>
 <entry>2006-06-08</entry>
 </dates>
 </vuln>

<vuln vid="00784d6e-f4ce-11da-87a1-000c6ec775d9">
 <topic>squirrelmail -- plugin.php local file inclusion vulnerability</topic>
 <affects>
 <package>
	<name>squirrelmail</name>
	<range><lt>1.4.6_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The SquirrelMail Project Team reports:
	<blockquote cite="http://www.squirrelmail.org/security/issue/2006-06-01">
	 A security issue has been uncovered in
	 functions/plugin.php that could allow a remote user to
	 access local files on the server without requiring
	 login. This issue manifests itself if register_globals is
	 enabled, and magic_quotes_gpc is disabled.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.squirrelmail.org/security/issue/2006-06-01</url>
 <url>http://secunia.com/advisories/20406/</url>
 </references>
 <dates>
 <discovery>2006-06-01</discovery>
 <entry>2006-06-05</entry>
 <modified>2006-06-06</modified>
 </dates>
 </vuln>

<vuln vid="af8dba15-f4cc-11da-87a1-000c6ec775d9">
 <topic>dokuwiki -- spellchecker remote PHP code execution</topic>
 <affects>
 <package>
	<name>dokuwiki</name>
	<range><lt>20060309_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Esser reports:
	<blockquote cite="http://www.hardened-php.net/advisory_042006.119.html">
	 During the evaluation of DokuWiki for a german/korean
	 wiki of mine a flaw in DokuWiki's spellchecker was
	 discovered, that allows injecting arbitrary PHP commands,
	 by requesting a spellcheck on PHP commands in 'complex
	 curly syntax'.
	 Because the spellchecker is written as part of the AJAX
	 functionality of DokuWiki, it can be directly called by
	 any website visitor, without the need for a wiki
	 account.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.hardened-php.net/advisory_042006.119.html</url>
 <url>http://bugs.splitbrain.org/index.php?do=details&amp;id=823</url>
 <url>http://secunia.com/advisories/20429/</url>
 </references>
 <dates>
 <discovery>2006-06-05</discovery>
 <entry>2006-06-05</entry>
 </dates>
 </vuln>

<vuln vid="40a0185f-ec32-11da-be02-000c6ec775d9">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal</name>
	<range><lt>4.6.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Drupal team reports:
	<blockquote cite="http://drupal.org/node/65357">
	 Vulnerability: SQL injection
	 A security vulnerability in the database layer allowed
	 certain queries to be submitted to the database without
	 going through Drupal's query sanitizer.
	</blockquote>
	<blockquote cite="http://drupal.org/node/65409">
	 Vulnerability: Execution of arbitrary files
	 Certain -- alas, typical -- configurations of Apache
	 allows execution of carefully named arbitrary scripts in
	 the files directory. Drupal now will attempt to
	 automatically create a .htaccess file in your "files"
	 directory to protect you.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-2742</cvename>
 <cvename>CVE-2006-2743</cvename>
 <url>http://drupal.org/node/65357</url>
 <url>http://drupal.org/node/65409</url>
 </references>
 <dates>
 <discovery>2006-05-18</discovery>
 <entry>2006-06-05</entry>
 </dates>
 </vuln>

<vuln vid="7f8cecea-f199-11da-8422-00123ffe8333">
 <topic>MySQL -- SQL-injection security vulnerability</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><ge>5.1</ge><le>5.1.9</le></range>
	<range><ge>5.0</ge><lt>5.0.22</lt></range>
	<range><ge>4.1</ge><lt>4.1.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	MySQL reports:
	<blockquote cite="http://lists.mysql.com/announce/364">
	 An SQL-injection security hole has been found in multibyte
	 encoding processing. An SQL-injection security hole can include a
	 situation whereby when inserting user supplied data into a
	 database, the user might inject his own SQL statements that the
	 server will execute. With regards to this vulnerability discovered,
	 when character set unaware escaping is used (e.g., addslashes() in
	 PHP), it is possible to bypass it in some multibyte character sets
	 (e.g., SJIS, BIG5 and GBK). As a result, a function like
	 addslashes() is not able to prevent SQL injection attacks. It is
	 impossible to fix this on the server side. The best solution is for
	 applications to use character set aware escaping offered in a
	 function like mysql_real_escape().
	 Workarounds:
	 One can use NO_BACKSLASH_ESCAPES mode as a workaround for a bug
	 in mysql_real_escape_string(), if you cannot upgrade your server
	 for some reason. It will enable SQL standard compatibility mode,
	 where backslash is not considered a special character.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.mysql.com/announce/364</url>
 <url>http://lists.mysql.com/announce/365</url>
 </references>
 <dates>
 <discovery>2006-05-31</discovery>
 <entry>2006-06-01</entry>
 </dates>
 </vuln>

<vuln vid="4913886c-e875-11da-b9f4-00123ffe8333">
 <topic>MySQL -- Information Disclosure and Buffer Overflow Vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><gt>4.0</gt><lt>4.0.27</lt></range>
	<range><gt>4.1</gt><lt>4.1.19</lt></range>
	<range><gt>5.1</gt><le>5.1.9</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19929/">
	 MySQL have some vulnerabilities, which can be exploited by
	 malicious users to disclose potentially sensitive information
	 and compromise a vulnerable system.
	 1) An error within the code that generates an error response
	 to an invalid COM_TABLE_DUMP packet can be exploited by an
	 authenticated client to disclosure certain memory content of the
	 server process.
	 2) A boundary error within the handling of specially crafted
	 invalid COM_TABLE_DUMP packets can be exploited by an authenticated
	 client to cause a buffer overflow and allows arbitrary code
	 execution.
	 3) An error within the handling of malformed login packets can be
	 exploited to disclosure certain memory content of the server
	 process in the error messages.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1516</cvename>
 <cvename>CVE-2006-1517</cvename>
 <cvename>CVE-2006-1518</cvename>
 <certvu>602457</certvu>
 <url>http://www.wisec.it/vulns.php?page=7</url>
 <url>http://www.wisec.it/vulns.php?page=8</url>
 <url>http://dev.mysql.com/doc/refman/4.1/en/news-4-0-27.html</url>
 <url>http://dev.mysql.com/doc/refman/4.1/en/news-4-1-19.html</url>
 <url>http://dev.mysql.com/doc/refman/5.1/en/news-5-1-10.html</url>
 <url>http://secunia.com/advisories/19929/</url>
 <url>http://www.vuxml.org/freebsd/a8d8713e-dc83-11da-a22b-000c6ec775d9.html</url>
 </references>
 <dates>
 <discovery>2006-05-02</discovery>
 <entry>2006-06-01</entry>
 </dates>
 </vuln>

<vuln vid="c0171f59-ea8a-11da-be02-000c6ec775d9">
 <topic>frontpage -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>frontpage</name>
	<name>mod_frontpage13</name>
	<name>mod_frontpage20</name>
	<name>mod_frontpage21</name>
	<name>mod_frontpage22</name>
	<range><lt>5.0.2.4803</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Esteban Martinez Fayo reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=114487846329000">
	 The FrontPage Server Extensions 2002 (included in Windows
	 Sever 2003 IIS 6.0 and available as a separate download
	 for Windows 2000 and XP) has a web page
	 /_vti_bin/_vti_adm/fpadmdll.dll that is used for
	 administrative purposes. This web page is vulnerable to
	 cross site scripting attacks allowing an attacker to run
	 client-side script on behalf of an FPSE user. If the
	 victim is an administrator, the attacker could take
	 complete control of a Front Page Server Extensions 2002
	 server.
	 To exploit the vulnerability an attacker can send a
	 specially crafted e-mail message to a FPSE user and then
	 persuade the user to click a link in the e-mail
	 message.
	 In addition, this vulnerability can be exploited if an
	 attacker hosts a malicious website and persuade the user
	 to visit it.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0015</cvename>
 <mlist msgid="0e3f01c65e78$93c00800$de00a8c0@rigel">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=114487846329000</mlist>
 <url>http://www.microsoft.com/technet/security/bulletin/MS06-017.mspx</url>
 <url>http://www.rtr.com/fpsupport/fpse_release_may_2_2006.htm</url>
 </references>
 <dates>
 <discovery>2006-04-12</discovery>
 <entry>2006-05-23</entry>
 </dates>
 </vuln>

<vuln vid="72d8df84-ea6d-11da-8a53-00123ffe8333">
 <topic>cscope -- buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>cscope</name>
	<range><lt>15.5_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jason Duell reports:
	<blockquote cite="http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1064875&amp;group_id=4664&amp;atid=104664">
	 Cscope contains an alarming number of buffer overflow
	 vulnerabilities. By a rough count, there are at least 48 places
	 where we blindly sprintf() a file name into a fixed-length buffer
	 of size PATHLEN without checking to see if the file's name
	 is &lt;= PATHLEN. We do similar things with environment variable
	 values.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-2541</cvename>
 <url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1064875&amp;group_id=4664&amp;atid=104664</url>
 <url>http://secunia.com/advisories/13237</url>
 </references>
 <dates>
 <discovery>2004-11-11</discovery>
 <entry>2006-05-23</entry>
 </dates>
 </vuln>

<vuln vid="0b628470-e9a6-11da-b9f4-00123ffe8333">
 <topic>coppermine -- Multiple File Extensions Vulnerability</topic>
 <affects>
 <package>
	<name>coppermine</name>
	<range><lt>1.4.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/20211/">
	 Coppermine Photo Gallery have a vulnerability, which can be
	 exploited by malicious users to compromise a vulnerable system.
	 The vulnerability is caused due to an error in the handling of
	 file uploads where a filename has multiple file extensions. This
	 can be exploited to upload malicious script files inside the web
	 root (e.g. a PHP script).
	 Successful exploitation may allow execution of script code
	 depending on the HTTP server configuration (it requires e.g. an
	 Apache server with the "mod_mime" module installed).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://sourceforge.net/project/shownotes.php?group_id=89658&amp;release_id=418266</url>
 <url>http://secunia.com/advisories/20211/</url>
 </references>
 <dates>
 <discovery>2006-05-22</discovery>
 <entry>2006-05-22</entry>
 </dates>
 </vuln>

<vuln vid="6738977b-e9a5-11da-b9f4-00123ffe8333">
 <topic>coppermine -- "file" Local File Inclusion Vulnerability</topic>
 <affects>
 <package>
	<name>coppermine</name>
	<range><lt>1.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19665/">
	 Coppermine Photo Gallery have a vulnerability, which can be
	 exploited by malicious people to disclose sensitive
	 information.
	 Input passed to the "file" parameter in "index.php" isn't properly
	 verified, before it is used to include files. This can be exploited
	 to include arbitrary files from local resources.
	 Example:
	 http://[host]/index.php?file=.//././/././/././/./[file]%00
	 Successful exploitation requires that "magic_quotes_gpc" is
	 disabled.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1909</cvename>
 <url>http://coppermine-gallery.net/forum/index.php?topic=30655.0</url>
 <url>http://myimei.com/security/2006-04-14/copperminephotogallery144-plugininclusionsystemindexphp-remotefileinclusion-attack.html</url>
 <url>http://secunia.com/advisories/19665/</url>
 </references>
 <dates>
 <discovery>2006-04-19</discovery>
 <entry>2006-05-22</entry>
 </dates>
 </vuln>

<vuln vid="77cceaef-e9a4-11da-b9f4-00123ffe8333">
 <topic>coppermine -- File Inclusion Vulnerabilities</topic>
 <affects>
 <package>
	<name>coppermine</name>
	<range><lt>1.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/18941/">
	 Coppermine Photo Gallery have a vulnerability, which can be
	 exploited by malicious people and by malicious users to compromise
	 a vulnerable system.
	 1) Input passed to the "lang" parameter in include/init.inc.php
	 isn't properly verified, before it is used to include files. This
	 can be exploited to include arbitrary files from local resources.
	 The vulnerability can be further exploited by users who are allowed
	 to upload image files to execute arbitrary PHP code.
	 2) Input passed to the "f" parameter in docs/showdoc.php isn't
	 properly verified, before it is used to include files. This can be
	 exploited to include arbitrary files from local resources on the
	 Windows platform, and remote files from Windows shared folders.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0872</cvename>
 <cvename>CVE-2006-0873</cvename>
 <url>http://retrogod.altervista.org/cpg_143_adv.html</url>
 <url>http://secunia.com/advisories/18941/</url>
 </references>
 <dates>
 <discovery>2006-02-20</discovery>
 <entry>2006-05-22</entry>
 </dates>
 </vuln>

<vuln vid="2ecd02e2-e864-11da-b9f4-00123ffe8333">
 <topic>phpmyadmin -- XSRF vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpMyAdmin security team reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-3">
	 It was possible to inject arbitrary SQL commands by forcing an
	 authenticated user to follow a crafted link.
	 Such issue is quite common in many PHP applications and users
	 should take care what links they follow. We consider these
	 vulnerabilities to be quite dangerous.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1804</cvename>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-3</url>
 <url>http://secunia.com/advisories/19659</url>
 </references>
 <dates>
 <discovery>2006-05-20</discovery>
 <entry>2006-05-21</entry>
 </dates>
 </vuln>

<vuln vid="4645b98c-e46e-11da-9ae7-00123fcc6e5c">
 <topic>vnc -- authentication bypass vulnerability</topic>
 <affects>
 <package>
	<name>vnc</name>
	<range><eq>4.1.1</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	RealVNC is susceptible to an authentication-bypass vulnerability.
	 A malicious VNC client can cause a VNC server to allow it to connect
	 without any authentication regardless of the authentication settings
	 configured in the server. Exploiting this issue allows attackers to
	 gain unauthenticated, remote access to the VNC servers.
 </body>
 </description>
 <references>
 <bid>17978</bid>
 <mlist>http://www.securityfocus.com/archive/1/433994/30/0/threaded</mlist>
 </references>
 <dates>
 <discovery>2006-05-15</discovery>
 <entry>2006-05-18</entry>
 </dates>
 </vuln>

<vuln vid="6d78202e-e2f9-11da-8674-00123ffe8333">
 <topic>phpldapadmin -- Cross-Site Scripting and Script Insertion vulnerabilities</topic>
 <affects>
 <package>
	<name>phpldapadmin098</name>
	<range><lt>0.9.8.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19747/">
	 phpLDAPadmin have some vulnerabilities, which can be exploited by
	 malicious users to conduct script insertion attacks and by
	 malicious people to conduct cross-site scripting attacks.
	 1) Some input isn't properly sanitised before being returned to
	 the user. This can be exploited to execute arbitrary HTML and
	 script code in a user's browser session in context of an affected
	 site.
	 2) Input passed to the "Container DN", "Machine Name", and "UID
	 Number" parameters in "template_engine.php" isn't properly
	 sanitised before being used. This can be exploited to inject
	 arbitrary HTML and script code, which will be executed in a user's
	 browser session in context of an affected site when the malicious
	 user data is viewed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-2016</cvename>
 <url>http://pridels.blogspot.com/2006/04/phpldapadmin-multiple-vuln.html</url>
 <url>http://www.frsirt.com/english/advisories/2006/1450</url>
 <url>http://secunia.com/advisories/19747/</url>
 </references>
 <dates>
 <discovery>2006-04-21</discovery>
 <entry>2006-05-14</entry>
 </dates>
 </vuln>

<vuln vid="a86f30e7-dce7-11da-bf3f-02e081235dab">
 <topic>fswiki -- XSS vulnerability</topic>
 <affects>
 <package>
	<name>fswiki</name>
	<range><lt>3.5.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	JVN reports:
	<blockquote cite="http://jvn.jp/jp/JVN%2335274905/">
	 FreeStyleWiki has XSS vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://jvn.jp/jp/JVN%2335274905/</url>
 </references>
 <dates>
 <discovery>2006-04-18</discovery>
 <entry>2006-05-06</entry>
 </dates>
 </vuln>

<vuln vid="a8d8713e-dc83-11da-a22b-000c6ec775d9">
 <topic>mysql50-server -- COM_TABLE_DUMP arbitrary code execution</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><gt>5.0</gt><lt>5.0.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefano Di Paola reports:
	<blockquote cite="http://www.wisec.it/vulns.php?page=8">
	 An authenticated user could remotely execute arbitrary
	 commands by taking advantage of a stack overflow.
	 To take advantage of these flaws an attacker should have
	 direct access to MySQL server communication layer (port
	 3306 or unix socket). But if used in conjuction with some
	 web application flaws (i.e. php code injection) an
	 attacker could use socket programming (i.e. php sockets)
	 to gain access to that layer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1518</cvename>
 <url>http://www.wisec.it/vulns.php?page=8</url>
 <mlist msgid="1146577257.5679.217.camel@first">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=114659633220473</mlist>
 <url>http://dev.mysql.com/doc/refman/5.0/en/news-5-0-21.html</url>
 </references>
 <dates>
 <discovery>2006-05-02</discovery>
 <entry>2006-05-06</entry>
 </dates>
 </vuln>

<vuln vid="2df297a2-dc74-11da-a22b-000c6ec775d9">
 <topic>awstats -- arbitrary command execution vulnerability</topic>
 <affects>
 <package>
	<name>awstats</name>
	<range><lt>6.5_2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OS Reviews reports:
	<blockquote cite="http://www.osreviews.net/reviews/comm/awstats">
	 If the update of the stats via web front-end is allowed,
	 a remote attacker can execute arbitrary code on the server
	 using a specially crafted request involving the migrate
	 parameter. Input starting with a pipe character ("|")
	 leads to an insecure call to Perl's open function and the
	 rest of the input being executed in a shell. The code is
	 run in the context of the process running the AWStats
	 CGI.
	 Arbitrary code can be executed by uploading a specially
	 crafted configuration file if an attacker can put a file
	 on the server with chosen file name and content (e.g. by
	 using an FTP account on a shared hosting server). In this
	 configuration file, the LogFile directive can be used to
	 execute shell code following a pipe character. As above,
	 an open call on unsanitized input is the source of this
	 vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://awstats.sourceforge.net/awstats_security_news.php</url>
 <url>http://secunia.com/advisories/19969/</url>
 <url>http://www.osreviews.net/reviews/comm/awstats</url>
 </references>
 <dates>
 <discovery>2006-05-03</discovery>
 <entry>2006-05-05</entry>
 <modified>2006-11-15</modified>
 </dates>
 </vuln>

<vuln vid="d9dc2697-dadf-11da-912f-00123ffe8333">
 <topic>phpwebftp -- "language" Local File Inclusion</topic>
 <affects>
 <package>
	<name>phpwebftp</name>
	<range><lt>3.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19706/">
	 phpWebFTP have a vulnerability, which can be exploited by
	 malicious people to disclose sensitive information.
	 Input passed to the "language" parameter in index.php isn't
	 properly verified, before it is used to include files. This can be
	 exploited to include arbitrary files from local resources.
	 Successful exploitation requires that "magic_quotes_gpc" is
	 disabled.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1812</cvename>
 <cvename>CVE-2006-1813</cvename>
 <url>https://sourceforge.net/forum/forum.php?forum_id=566199</url>
 <url>http://secunia.com/advisories/19706/</url>
 </references>
 <dates>
 <discovery>2006-04-18</discovery>
 <entry>2006-05-03</entry>
 </dates>
 </vuln>

<vuln vid="e2476979-da74-11da-a67b-0013d4a4a40e">
 <topic>firefox -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><gt>1.5.*,1</gt><lt>1.5.0.3,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.5.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory reports for
	 deleted object reference when designMode="on"
	<blockquote cite="http://www.mozilla.org/security/announce/2006/mfsa2006-30.html">
	 Martijn Wargers and Nick Mott each described crashes that
	 were discovered to ultimately stem from the same root cause:
	 attempting to use a deleted controller context when designMode
	 was turned on. This generally results in crashing the browser,
	 but in theory references to deleted objects can be abused to
	 run malicious code.
	 "splices" reported the same crash at the fan site MozillaZine and
	 on Bugtraq, incorrectly describing it as a buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1993</cvename>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-30.html</url>
 </references>
 <dates>
 <discovery>2006-05-02</discovery>
 <entry>2006-05-03</entry>
 <modified>2006-05-05</modified>
 </dates>
 </vuln>

<vuln vid="400d9d22-d6c5-11da-a14b-00123ffe8333">
 <topic>trac -- Wiki Macro Script Insertion Vulnerability</topic>
 <affects>
 <package>
	<name>trac</name>
	<name>ja-trac</name>
	<range><lt>0.9.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19870/">
	 A vulnerability has been reported, which can be exploited by
	 malicious people to conduct script insertion attacks.
	 Input passed using the wiki macro isn't properly sanitised before
	 being used. This can be exploited to inject arbitrary HTML and
	 script code, which will be executed in a user's browser session in
	 context of an affected site when the malicious user data is
	 viewed.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
 <url>http://jvn.jp/jp/JVN%2384091359/index.html</url>
 <url>http://secunia.com/advisories/19870/</url>
 </references>
 <dates>
 <discovery>2006-04-28</discovery>
 <entry>2006-05-02</entry>
 </dates>
 </vuln>

<vuln vid="b088bf48-da3b-11da-93e0-00123ffe8333">
 <topic>clamav -- Freshclam HTTP Header Buffer Overflow Vulnerability</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><ge>0.80</ge><lt>0.88.2</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><ge>20040826</ge><lt>20060502</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19880/">
	 A vulnerability has been reported in ClamAV, which can be
	 exploited by malicious people to cause a DoS (Denial of Service)
	 and potentially to compromise a vulnerable system.
	 The vulnerability is caused due to a boundary error within the
	 HTTP client in the Freshclam command line utility. This can be
	 exploited to cause a stack-based buffer overflow when the HTTP
	 headers received from a web server exceeds 8KB.
	 Successful exploitation requires that Freshclam is used to
	 download virus signature updates from a malicious mirror web
	 server e.g. via DNS poisoning.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1989</cvename>
 <url>http://www.clamav.net/security/0.88.2.html</url>
 <url>http://secunia.com/advisories/19880/</url>
 </references>
 <dates>
 <discovery>2006-05-01</discovery>
 <entry>2006-05-03</entry>
 </dates>
 </vuln>

<vuln vid="f4af098d-d921-11da-ad4a-00123ffe8333">
 <topic>jabberd -- SASL Negotiation Denial of Service Vulnerability</topic>
 <affects>
 <package>
	<name>jabberd</name>
	<range><lt>2.0.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19281/">
	 A vulnerability has been reported in jabberd, which can be
	 exploited by malicious people to cause a DoS (Denial of
	 Service).
	 The vulnerability is caused due to an error within the handling
	 of SASL negotiation. This can be exploited to cause a crash by
	 sending a "response" stanza before an "auth" stanza.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1329</cvename>
 <url>http://article.gmane.org/gmane.network.jabber.admin/27372</url>
 <url>http://jabberstudio.org/projects/jabberd2/releases/view.php?id=826</url>
 <url>http://secunia.com/advisories/19281/</url>
 </references>
 <dates>
 <discovery>2006-03-20</discovery>
 <entry>2006-05-01</entry>
 </dates>
 </vuln>

<vuln vid="79c1154d-d5a5-11da-8098-00123ffe8333">
 <topic>cacti -- ADOdb "server.php" Insecure Test Script Security Issue</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>0.8.6h</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/18276/">
	 Cacti have a security issue, which can be exploited by malicious
	 people to execute arbitrary SQL code and potentially compromise a
	 vulnerable system.
	 The problem is caused due to the presence of the insecure
	 "server.php" test script.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/18276/</url>
 <url>http://secunia.com/advisories/17418/</url>
 </references>
 <dates>
 <discovery>2006-01-09</discovery>
 <entry>2006-04-27</entry>
 </dates>
 </vuln>

<vuln vid="dc930435-d59f-11da-8098-00123ffe8333">
 <topic>amaya -- Attribute Value Buffer Overflow Vulnerabilities</topic>
 <affects>
 <package>
	<name>amaya</name>
	<range><lt>9.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19670/">
	 Amaya have two vulnerabilities, which can be exploited by
	 malicious people to compromise a user's system.
	 The vulnerabilities are caused due to boundary errors within the
	 parsing of various attribute values. This can be exploited to cause
	 stack-based buffer overflows when a user opens a specially crafted
	 HTML document containing certain tags with overly long attribute
	 values.
	 Successful exploitation allows execution of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1900</cvename>
 <url>http://morph3us.org/advisories/20060412-amaya-94.txt</url>
 <url>http://morph3us.org/advisories/20060412-amaya-94-2.txt</url>
 <url>http://secunia.com/advisories/19670/</url>
 </references>
 <dates>
 <discovery>2006-04-14</discovery>
 <entry>2006-04-27</entry>
 </dates>
 </vuln>

<vuln vid="116b0820-d59c-11da-8098-00123ffe8333">
 <topic>lifetype -- ADOdb "server.php" Insecure Test Script Security Issue</topic>
 <affects>
 <package>
	<name>lifetype</name>
	<range><lt>1.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19699/">
	 A security issue has been discovered in LifeType, which can be
	 exploited by malicious people to execute arbitrary SQL code and
	 potentially compromise a vulnerable system.
	 The problem is caused due to the presence of the insecure
	 "server.php" test script.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0146</cvename>
 <url>http://secunia.com/advisories/19699/</url>
 <url>http://secunia.com/advisories/17418/</url>
 </references>
 <dates>
 <discovery>2006-04-19</discovery>
 <entry>2006-04-27</entry>
 </dates>
 </vuln>

<vuln vid="21c223f2-d596-11da-8098-00123ffe8333">
 <topic>ethereal -- Multiple Protocol Dissector Vulnerabilities</topic>
 <affects>
 <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.8.5</ge><lt>0.99.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19769/">
	 Multiple vulnerabilities have been reported in Ethereal, which
	 can be exploited by malicious people to cause a DoS (Denial of
	 Service) or compromise a vulnerable system.
	 The vulnerabilities are caused due to various types of errors
	 including boundary errors, an off-by-one error, an infinite loop
	 error, and several unspecified errors in a multitude of protocol
	 dissectors.
	 Successful exploitation causes Ethereal to stop responding,
	 consume a large amount of system resources, crash, or execute
	 arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1932</cvename>
 <cvename>CVE-2006-1933</cvename>
 <cvename>CVE-2006-1934</cvename>
 <cvename>CVE-2006-1935</cvename>
 <cvename>CVE-2006-1936</cvename>
 <cvename>CVE-2006-1937</cvename>
 <cvename>CVE-2006-1938</cvename>
 <cvename>CVE-2006-1939</cvename>
 <cvename>CVE-2006-1940</cvename>
 <url>http://www.ethereal.com/appnotes/enpa-sa-00023.html</url>
 <url>http://secunia.com/advisories/19769/</url>
 </references>
 <dates>
 <discovery>2006-04-25</discovery>
 <entry>2006-04-27</entry>
 </dates>
 </vuln>

<vuln vid="8b683bea-d49c-11da-a672-000e0c2e438a">
 <topic>asterisk -- denial of service vulnerability, local system access</topic>
 <affects>
 <package>
	<name>asterisk</name>
	<range><lt>1.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Emmanouel Kellenis reports a denial of service vulnerability
	 within asterisk. The vulnerability is caused by a buffer
	 overflow in "format_jpeg.c".	A large JPEG image could
	 trigger this bug, potentially allowing a local attacker to
	 execute arbitrary code.
 </body>
 </description>
 <references>
 <bid>17561</bid>
 <cvename>CVE-2006-1827</cvename>
 <url>http://www.cipher.org.uk/index.php?p=advisories/Asterisk_Codec_Integer_Overflow_07-04-2006.advisory</url>
 </references>
 <dates>
 <discovery>2006-04-07</discovery>
 <entry>2006-04-25</entry>
 </dates>
 </vuln>

<vuln vid="a813a219-d2d4-11da-a672-000e0c2e438a">
 <topic>zgv, xzgv -- heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>zgv</name>
	<range><lt>5.9_1</lt></range>
 </package>
 <package>
	<name>xzgv</name>
	<range><lt>0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gentoo reports:
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200604-10.xml">
	 Andrea Barisani of Gentoo Linux discovered xzgv and zgv
	 allocate insufficient memory when rendering images with
	 more than 3 output components, such as images using the
	 YCCK or CMYK colour space.	When xzgv or zgv attempt to
	 render the image, data from the image overruns a heap
	 allocated buffer.
	 An attacker may be able to construct a malicious image that
	 executes arbitrary code with the permissions of the xzgv or
	 zgv user when attempting to render the image.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>17409</bid>
 <cvename>CVE-2006-1060</cvename>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200604-10.xml</url>
 </references>
 <dates>
 <discovery>2006-04-21</discovery>
 <entry>2006-04-23</entry>
 <modified>2010-03-22</modified>
 </dates>
 </vuln>

<vuln vid="86cc5c6f-d2b4-11da-a672-000e0c2e438a">
 <topic>crossfire-server -- denial of service and remote code execution vulnerability</topic>
 <affects>
 <package>
	<name>crossfire-server</name>
	<range><lt>1.9.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	FRSIRT reports:
	<blockquote cite="http://www.frsirt.com/english/advisories/2006/0760">
	 A vulnerability has been identified in CrossFire, which
	 could be exploited by remote attackers to execute arbitrary
	 commands or cause a denial of service. This flaw is due to
	 a buffer overflow error in the "oldsocketmode" module that
	 fails to properly handle overly large requests, which could
	 be exploited by a malicious client to crash or compromise a
	 vulnerable system.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>16883</bid>
 <cvename>CVE-2006-1010</cvename>
 <url>http://www.frsirt.com/english/advisories/2006/0760</url>
 </references>
 <dates>
 <discovery>2006-02-28</discovery>
 <entry>2006-04-23</entry>
 </dates>
 </vuln>

<vuln vid="8cfb6f42-d2b0-11da-a672-000e0c2e438a">
 <topic>p5-DBI -- insecure temporary file creation vulnerability</topic>
 <affects>
 <package>
	<name>p5-DBI-137</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>p5-DBI</name>
	<range><lt>1.37_1</lt></range>
	<range><ge>1.38</ge><lt>1.48</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Javier Fernández-Sanguino Peña reports:
	<blockquote cite="http://www.debian.org/security/2005/dsa-658">
	 The DBI library, the Perl5 database interface, creates a
	 temporary PID file in an insecure manner. This can be
	 exploited by a malicious user to overwrite arbitrary files
	 owned by the person executing the parts of the library.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12360</bid>
 <cvename>CAN-2005-0077</cvename>
 <url>http://www.debian.org/security/2005/dsa-658</url>
 </references>
 <dates>
 <discovery>2005-01-25</discovery>
 <entry>2006-04-23</entry>
 <modified>2006-05-11</modified>
 </dates>
 </vuln>

<vuln vid="e0b342a1-d2ae-11da-a672-000e0c2e438a">
 <topic>wordpress -- full path disclosure</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>1.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dedi Dwianto reports:
	<blockquote cite="http://echo.or.id/adv/adv24-theday-2005.txt">
	 A remote user can access the file directly to cause the
	 system to display an error message that indicates the
	 installation path.	The resulting error message will
	 disclose potentially sensitive installation path
	 information to the remote attacker.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-4463</cvename>
 <url>http://echo.or.id/adv/adv24-theday-2005.txt</url>
 </references>
 <dates>
 <discovery>2005-12-20</discovery>
 <entry>2006-04-23</entry>
 </dates>
 </vuln>

<vuln vid="8d4ae57d-d2ab-11da-a672-000e0c2e438a">
 <topic>xine -- multiple remote string vulnerabilities</topic>
 <affects>
 <package>
	<name>xine</name>
	<range><lt>0.99.4_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	c0ntexb reports:
	<blockquote cite="http://www.open-security.org/advisories/16">
	 There are 2 format string bugs in the latest version of
	 Xine that could be exploited by a malicious person to
	 execute code on the system of a remote user running the
	 media player against a malicious playlist file. By passing
	 a format specifier in the path of a file that is embedded
	 in a remote playlist, it is possible to trigger this bug.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>17579</bid>
 <cvename>CVE-2006-1905</cvename>
 <url>http://www.open-security.org/advisories/16</url>
 </references>
 <dates>
 <discovery>2006-04-18</discovery>
 <entry>2006-04-23</entry>
 </dates>
 </vuln>

<vuln vid="408f6ebf-d152-11da-962f-000b972eb521">
 <topic>cyrus-sasl -- DIGEST-MD5 Pre-Authentication Denial of Service</topic>
 <affects>
 <package>
	<name>cyrus-sasl</name>
	<range><ge>2.*</ge><lt>2.1.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Unspecified vulnerability in the CMU Cyrus Simple
	Authentication and Security Layer (SASL) library, has unknown
	impact and remote unauthenticated attack vectors, related to
	DIGEST-MD5 negotiation.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1721</cvename>
 </references>
 <dates>
 <discovery>2006-04-11</discovery>
 <entry>2006-04-22</entry>
 </dates>
 </vuln>

<vuln vid="1fa4c9f1-cfca-11da-a672-000e0c2e438a">
 <topic>FreeBSD -- FPU information disclosure</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_7</lt></range>
	<range><ge>5.4</ge><lt>5.4_14</lt></range>
	<range><ge>5.3</ge><lt>5.3_29</lt></range>
	<range><ge>5</ge><lt>5.3</lt></range>
	<range><ge>4.11</ge><lt>4.11_17</lt></range>
	<range><ge>4.10</ge><lt>4.10_23</lt></range>
	<range><lt>4.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	On "7th generation" and "8th generation" processors
	 manufactured by AMD, including the AMD Athlon, Duron, Athlon
	 MP, Athlon XP, Athlon64, Athlon64 FX, Opteron, Turion, and
	 Sempron, the fxsave and fxrstor instructions do not save and
	 restore the FOP, FIP, and FDP registers unless the exception
	 summary bit (ES) in the x87 status word is set to 1,
	 indicating that an unmasked x87 exception has occurred.
	This behaviour is consistent with documentation provided by
	 AMD, but is different from processors from other vendors,
	 which save and restore the FOP, FIP, and FDP registers
	 regardless of the value of the ES bit. As a result of this
	 discrepancy remaining unnoticed until now, the FreeBSD kernel
	 does not restore the contents of the FOP, FIP, and FDP
	 registers between context switches.
	<h1>Impact</h1>
	On affected processors, a local attacker can monitor the
	 execution path of a process which uses floating-point
	 operations. This may allow an attacker to steal
	 cryptographic keys or other sensitive information.
	<h1>Workaround</h1>
	No workaround is available, but systems which do not use AMD
	 Athlon, Duron, Athlon MP, Athlon XP, Athlon64, Athlon64 FX,
	 Opteron, Turion, or Sempron processors are not vulnerable.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1056</cvename>
 <freebsdsa>SA-06:14.fpu</freebsdsa>
 </references>
 <dates>
 <discovery>2006-04-19</discovery>
 <entry>2006-04-19</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="22c6b826-cee0-11da-8578-00123ffe8333">
 <topic>plone -- "member_id" Parameter Portrait Manipulation Vulnerability</topic>
 <affects>
 <package>
	<name>plone</name>
	<range><lt>2.1.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19633/">
	 The vulnerability is caused due to missing security declarations
	 in "changeMemberPortrait" and "deletePersonalPortrait". This can
	 be exploited to manipulate or delete another user's portrait via
	 the "member_id" parameter.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1711</cvename>
 <url>http://dev.plone.org/plone/ticket/5432</url>
 <url>http://www.debian.org/security/2006/dsa-1032</url>
 <url>http://secunia.com/advisories/19633/</url>
 </references>
 <dates>
 <discovery>2006-04-13</discovery>
 <entry>2006-04-18</entry>
 </dates>
 </vuln>

<vuln vid="84630f4a-cd8c-11da-b7b9-000c6ec775d9">
 <topic>mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.8,1</lt></range>
	<range><gt>1.5.*,1</gt><lt>1.5.0.2,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.5.0.2</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.13,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<range><lt>1.7.13</lt></range>
 </package>
 <package>
	<name>linux-mozilla-devel</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.0.1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>mozilla-thunderbird</name>
	<range><lt>1.5.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory reports of multiple
	 issues. Several of which can be used to run arbitrary code
	 with the privilege of the user running the program.
	<blockquote cite="http://www.mozilla.org/security/announce/">
	 <ul>
	 <li>MFSA 2006-29 Spoofing with translucent windows</li>
	 <li>MFSA 2006-28 Security check of js_ValueToFunctionObject() can be circumvented</li>
	 <li>MFSA 2006-26 Mail Multiple Information Disclosure</li>
	 <li>MFSA 2006-25 Privilege escalation through Print Preview</li>
	 <li>MFSA 2006-24 Privilege escalation using crypto.generateCRMFRequest</li>
	 <li>MFSA 2006-23 File stealing by changing input type</li>
	 <li>MFSA 2006-22 CSS Letter-Spacing Heap Overflow Vulnerability</li>
	 <li>MFSA 2006-20 Crashes with evidence of memory corruption (rv:1.8.0.2)</li>
	 <li>MFSA 2006-19 Cross-site scripting using .valueOf.call()</li>
	 <li>MFSA 2006-18 Mozilla Firefox Tag Order Vulnerability</li>
	 <li>MFSA 2006-17 cross-site scripting through window.controllers</li>
	 <li>MFSA 2006-16 Accessing XBL compilation scope via valueOf.call()</li>
	 <li>MFSA 2006-15 Privilege escalation using a JavaScript function's cloned parent</li>
	 <li>MFSA 2006-14 Privilege escalation via XBL.method.eval</li>
	 <li>MFSA 2006-13 Downloading executables with "Save Image As..."</li>
	 <li>MFSA 2006-12 Secure-site spoof (requires security warning dialog)</li>
	 <li>MFSA 2006-11 Crashes with evidence of memory corruption (rv:1.8)</li>
	 <li>MFSA 2006-10 JavaScript garbage-collection hazard audit</li>
	 <li>MFSA 2006-09 Cross-site JavaScript injection using event handlers</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <certvu>179014</certvu>
 <certvu>252324</certvu>
 <certvu>329500</certvu>
 <certvu>350262</certvu>
 <certvu>488774</certvu>
 <certvu>736934</certvu>
 <certvu>813230</certvu>
 <certvu>842094</certvu>
 <certvu>932734</certvu>
 <certvu>935556</certvu>
 <certvu>968814</certvu>
 <cvename>CVE-2006-0749</cvename>
 <cvename>CVE-2006-1045</cvename>
 <cvename>CVE-2006-1529</cvename>
 <cvename>CVE-2006-1530</cvename>
 <cvename>CVE-2006-1531</cvename>
 <cvename>CVE-2006-1723</cvename>
 <cvename>CVE-2006-1724</cvename>
 <cvename>CVE-2006-1725</cvename>
 <cvename>CVE-2006-1726</cvename>
 <cvename>CVE-2006-1727</cvename>
 <cvename>CVE-2006-1728</cvename>
 <cvename>CVE-2006-1729</cvename>
 <cvename>CVE-2006-1730</cvename>
 <cvename>CVE-2006-1731</cvename>
 <cvename>CVE-2006-1732</cvename>
 <cvename>CVE-2006-1733</cvename>
 <cvename>CVE-2006-1734</cvename>
 <cvename>CVE-2006-1735</cvename>
 <cvename>CVE-2006-1736</cvename>
 <cvename>CVE-2006-1737</cvename>
 <cvename>CVE-2006-1738</cvename>
 <cvename>CVE-2006-1739</cvename>
 <cvename>CVE-2006-1740</cvename>
 <cvename>CVE-2006-1741</cvename>
 <cvename>CVE-2006-1742</cvename>
 <cvename>CVE-2006-1790</cvename>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-09.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-10.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-11.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-12.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-13.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-14.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-15.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-16.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-17.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-18.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-19.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-20.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-22.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-23.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-25.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-26.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-28.html</url>
 <url>http://www.mozilla.org/security/announce/2006/mfsa2006-29.html</url>
 <url>http://www.zerodayinitiative.com/advisories/ZDI-06-010.html</url>
 <uscertta>TA06-107A</uscertta>
 </references>
 <dates>
 <discovery>2006-04-13</discovery>
 <entry>2006-04-16</entry>
 <modified>2006-04-27</modified>
 </dates>
 </vuln>

<vuln vid="8be2e304-cce6-11da-a3b1-00123ffe8333">
 <topic>mailman -- Private Archive Script Cross-Site Scripting</topic>
 <affects>
 <package>
	<name>mailman</name>
	<name>ja-mailman</name>
	<name>mailman-with-htdig</name>
	<range><lt>2.1.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19558/">
	 A vulnerability has been reported in Mailman, which can be
	 exploited by malicious people to conduct cross-site scripting
	 attacks.
	 Unspecified input passed to the private archive script is not
	 properly sanitised before being returned to users. This can be
	 exploited to execute arbitrary HTML and script code in a user's
	 browser session in context of a vulnerable site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1712</cvename>
 <mlist>http://mail.python.org/pipermail/mailman-announce/2006-April/000084.html</mlist>
 <url>http://secunia.com/advisories/19558/</url>
 </references>
 <dates>
 <discovery>2006-04-07</discovery>
 <entry>2006-04-16</entry>
 </dates>
 </vuln>

<vuln vid="43cb40b3-c8c2-11da-a672-000e0c2e438a">
 <topic>f2c -- insecure temporary files</topic>
 <affects>
 <package>
	<name>f2c</name>
	<range><lt>20060506</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Javier Fernández-Sanguino Peña reports two temporary file
	 vulnerability within f2c. The vulnerabilities are caused
	 due to weak temporary file handling.	An attacker could
	 create an symbolic link, causing a local user running f2c
	 to overwrite the symlinked file. This could give the
	 attacker elevated privileges.
 </body>
 </description>
 <references>
 <bid>1280</bid>
 <cvename>CAN-2005-0017</cvename>
 </references>
 <dates>
 <discovery>2005-01-27</discovery>
 <entry>2006-04-10</entry>
 <modified>2006-08-15</modified>
 </dates>
 </vuln>

<vuln vid="c7526a14-c4dc-11da-9699-00123ffe8333">
 <topic>mplayer -- Multiple integer overflows</topic>
 <affects>
 <package>
	<name>mplayer</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.7_12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19418/">
	 The vulnerabilities are caused due to integer overflow errors
	 in "libmpdemux/asfheader.c" within the handling of an ASF file,
	 and in "libmpdemux/aviheader.c" when parsing the "indx" chunk in
	 an AVI file. This can be exploited to cause heap-based buffer
	 overflows via a malicious ASF file, or via a AVI file with
	 specially-crafted "wLongsPerEntry" and "nEntriesInUse" values in
	 the "indx" chunk.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1502</cvename>
 <url>http://www.xfocus.org/advisories/200603/11.html</url>
 <url>http://secunia.com/advisories/19418/</url>
 </references>
 <dates>
 <discovery>2006-03-29</discovery>
 <entry>2006-04-07</entry>
 </dates>
 </vuln>

<vuln vid="4bfcd857-c628-11da-b2fb-000e0c2e438a">
 <topic>kaffeine -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>kaffeine</name>
	<range><ge>0.4.2</ge><lt>0.8.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The KDE team reports:
	<blockquote cite="http://www.kde.org/info/security/advisory-20060404-1.txt">
	 Kaffeine can produce a buffer overflow in http_peek() while
	 creating HTTP request headers for fetching remote playlists,
	 which under certain circumstances could be used to crash the
	 application and/or execute arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>17372</bid>
 <cvename>CVE-2006-0051</cvename>
 <url>http://www.kde.org/info/security/advisory-20060404-1.txt</url>
 </references>
 <dates>
 <discovery>2006-04-04</discovery>
 <entry>2006-04-07</entry>
 </dates>
 </vuln>

<vuln vid="61349f77-c620-11da-b2fb-000e0c2e438a">
 <topic>thunderbird -- javascript execution</topic>
 <affects>
 <package>
	<name>thunderbird</name>
	<name>mozilla-thunderbird</name>
	<range><le>1.0.7</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Renaud Lifchitz reports a vulnerability within thunderbird.
	 The vulnerability is caused by improper checking of javascript
	 scripts. This could lead to javascript code execution which
	 can lead to information disclosure or a denial of service
	 (application crash).	This vulnerability is present even if
	 javascript had been disabled in the preferences.
 </body>
 </description>
 <references>
 <bid>16770</bid>
 <cvename>CAN-2006-0884</cvename>
 </references>
 <dates>
 <discovery>2006-02-22</discovery>
 <entry>2006-04-07</entry>
 </dates>
 </vuln>

<vuln vid="fba75b43-c588-11da-9110-00123ffe8333">
 <topic>phpmyadmin -- XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.8.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpMyAdmin security announcement:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1">
	 It was possible to conduct an XSS attack with a direct call
	 to some scripts under the themes directory.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1</url>
 <url>http://secunia.com/advisories/19556/</url>
 </references>
 <dates>
 <discovery>2006-04-06</discovery>
 <entry>2006-04-06</entry>
 <modified>2006-04-07</modified>
 </dates>
 </vuln>

<vuln vid="7b55f5c2-c58b-11da-9110-00123ffe8333">
 <topic>phpmyadmin -- 'set_theme' Cross-Site Scripting</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.8.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19277">
	 A vulnerability has been reported in phpMyAdmin, which can be
	 exploited by malicious people to conduct cross-site scripting
	 attacks.
	 Input passed to the "set_theme" parameter isn't properly
	 sanitised before being returned to the user. This can be exploited
	 to execute arbitrary HTML and script code in a user's browser
	 session in context of an affected site.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1258</cvename>
 <url>http://secunia.com/advisories/19277</url>
 </references>
 <dates>
 <discovery>2006-03-17</discovery>
 <entry>2006-04-06</entry>
 </dates>
 </vuln>

<vuln vid="6a5174bd-c580-11da-9110-00123ffe8333">
 <topic>clamav -- Multiple Vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.88.1</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><le>20051104_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19534/">
	 Some vulnerabilities have been reported in ClamAV, which
	 potentially can be exploited by malicious people to cause a
	 DoS (Denial of Service) and compromise a vulnerable system.
	 An unspecified integer overflow error exists in the PE header
	 parser in "libclamav/pe.c". Successful exploitation requires that
	 the ArchiveMaxFileSize option is disabled.
	 Some format string errors in the logging handling in
	 "shared/output.c" may be exploited to execute arbitrary code.
	 An out-of-bounds memory access error in the "cli_bitset_test()"
	 function in "ibclamav/others.c" may be exploited to cause a
	 crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1614</cvename>
 <cvename>CVE-2006-1615</cvename>
 <cvename>CVE-2006-1630</cvename>
 <url>http://secunia.com/advisories/19534/</url>
 <url>http://www.us.debian.org/security/2006/dsa-1024</url>
 </references>
 <dates>
 <discovery>2006-04-06</discovery>
 <entry>2006-04-06</entry>
 </dates>
 </vuln>

<vuln vid="99015cf5-c4dd-11da-b2fb-000e0c2e438a">
 <topic>mediawiki -- hardcoded placeholder string security bypass vulnerability</topic>
 <affects>
 <package>
	<name>mediawiki</name>
	<range><lt>1.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The mediawiki development team reports a vulnerability
	 within the mediawiki application. The vulnerability is
	 caused by improper checking of inline style attributes. This
	 could result in the execution of arbitrary javascript code in
	 Microsoft Internet Explorer. It appears that other browsers
	 are not affected by this vulnerability.
 </body>
 </description>
 <references>
 <bid>16032</bid>
 <cvename>CAN-2005-4501</cvename>
 <url>http://sourceforge.net/project/shownotes.php?release_id=379951</url>
 </references>
 <dates>
 <discovery>2005-12-22</discovery>
 <entry>2006-04-05</entry>
 </dates>
 </vuln>

<vuln vid="ae9fb0d7-c4dc-11da-b2fb-000e0c2e438a">
 <topic>netpbm -- buffer overflow in pnmtopng</topic>
 <affects>
 <package>
	<name>netpbm</name>
	<range><lt>10.26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ubuntu reports:
	<blockquote cite="http://www.ubuntulinux.org/support/documentation/usn/usn-210-1">
	 A buffer overflow was found in the "pnmtopng" conversion
	 program. By tricking an user (or automated system) to
	 process a specially crafted PNM image with pnmtopng, this
	 could be exploited to execute arbitrary code with the
	 privileges of the user running pnmtopng.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>15128</bid>
 <cvename>CAN-2005-2978</cvename>
 <url>http://www.ubuntulinux.org/support/documentation/usn/usn-210-1</url>
 </references>
 <dates>
 <discovery>2005-10-18</discovery>
 <entry>2006-04-05</entry>
 </dates>
 </vuln>

<vuln vid="d9307a41-c4d7-11da-b2fb-000e0c2e438a">
 <topic>zoo -- stack based buffer overflow</topic>
 <affects>
 <package>
	<name>zoo</name>
	<range><lt>2.10.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jean-Sébastien Guay-Leroux report a vulnerability
	 within the zoo archiver. The vulnerability which is present
	 in the fullpath() function (from the misc.c file) is caused by
	 improper checking of user supplied data. The data returned
	 to the buffer can be up to 512 bytes, while the buffer is
	 created to hold 256 bytes. This could result in a buffer
	 overflow which could allow remote code execution.
 </body>
 </description>
 <references>
 <bid>16790</bid>
 <cvename>CVE-2006-0855</cvename>
 <url>http://www.guay-leroux.com/projects/zoo-advisory.txt</url>
 </references>
 <dates>
 <discovery>2006-02-22</discovery>
 <entry>2006-04-05</entry>
 <modified>2006-04-06</modified>
 </dates>
 </vuln>

<vuln vid="74b7403c-c4d5-11da-b2fb-000e0c2e438a">
 <topic>mediawiki -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>mediawiki</name>
	<range><ge>1.4</ge><lt>1.4.14</lt></range>
	<range><ge>1.5</ge><lt>1.5.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The mediawiki development team reports that there is an
	 site scripting vulnerability within mediawiki. The
	 vulnerability is caused by improper checking of encoded
	 links which could allow the injection of html in the output
	 generated by mediawiki. This could lead to cross site
	 scripting attacks against mediawiki installations.
 </body>
 </description>
 <references>
 <bid>17269</bid>
 <cvename>CVE-2006-1498</cvename>
 <url>http://mail.wikipedia.org/pipermail/mediawiki-announce/2006-March/000040.html</url>
 </references>
 <dates>
 <discovery>2006-03-27</discovery>
 <entry>2006-04-05</entry>
 </dates>
 </vuln>

<vuln vid="b5fc63ad-c4c3-11da-9699-00123ffe8333">
 <topic>dia -- XFig Import Plugin Buffer Overflow</topic>
 <affects>
 <package>
	<name>dia</name>
	<name>dia-gnome</name>
	<range><gt>0.86_1</gt><lt>0.94_6,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/19469/">
	 Some vulnerabilities have been reported in Dia, which
	 potentially can be exploited by malicious people to
	 compromise a user's system.
	 The vulnerabilities are caused due to boundary errors
	 within the XFig import plugin. This can be exploited to
	 cause buffer overflows and may allow arbitrary code
	 execution when a specially-crafted FIG file is imported.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1550</cvename>
 <url>http://secunia.com/advisories/19469/</url>
 <mlist msgid="1143662924.6460.60.camel@linux.site">http://mail.gnome.org/archives/dia-list/2006-March/msg00149.html</mlist>
 </references>
 <dates>
 <discovery>2006-03-31</discovery>
 <entry>2006-04-05</entry>
 </dates>
 </vuln>

<vuln vid="be4ccb7b-c48b-11da-ae12-0002b3b60e4c">
 <topic>openvpn -- LD_PRELOAD code execution on client through malicious or compromised server</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><ge>2.0</ge><lt>2.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hendrik Weimer reports:
	<blockquote cite="http://www.osreviews.net/reviews/security/openvpn-print">
	 OpenVPN clients are a bit too generous when accepting
	 configuration options from a server. It is possible to transmit
	 environment variables to client-side shell scripts. There are some
	 filters in place to prevent obvious nonsense, however they don't
	 catch the good old LD_PRELOAD trick. All we need is to put a file
	 onto the client under a known location (e.g. by returning a
	 specially crafted document upon web access) and we have a remote
	 root exploit. But since the attack may only come from authenticated
	 servers, this threat is greatly reduced.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1629</cvename>
 <url>http://www.osreviews.net/reviews/security/openvpn-print</url>
 <url>http://openvpn.net/changelog.html</url>
 <mlist msgid="4431F7C4.4030804@yonan.net">http://sourceforge.net/mailarchive/message.php?msg_id=15298074</mlist>
 </references>
 <dates>
 <discovery>2006-04-03</discovery>
 <entry>2006-04-05</entry>
 <modified>2006-04-06</modified>
 </dates>
 </vuln>

<vuln vid="92fd40eb-c458-11da-9c79-00123ffe8333">
 <topic>samba -- Exposure of machine account credentials in winbind log files</topic>
 <affects>
 <package>
	<name>samba</name>
	<range><ge>3.0.21a,1</ge><lt>3.0.22,1</lt></range>
 </package>
 <package>
	<name>ja-samba</name>
	<range><ge>3.0.21a,1</ge><lt>3.0.22,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Samba Security Advisory:
	<blockquote cite="http://us1.samba.org/samba/security/CAN-2006-1059.html">
	 The machine trust account password is the secret
	 shared between a domain controller and a specific
	 member server. Access to the member server machine
	 credentials allows an attacker to impersonate the
	 server in the domain and gain access to additional
	 information regarding domain users and groups.
	 The winbindd daemon writes the clear text of server's
	 machine credentials to its log file at level 5.
	 The winbindd log files are world readable by default
	 and often log files are requested on open mailing
	 lists as tools used to debug server misconfigurations.
	 This affects servers configured to use domain or
	 ads security and possibly Samba domain controllers
	 as well (if configured to use winbindd).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1059</cvename>
 <url>http://us1.samba.org/samba/security/CAN-2006-1059.html</url>
 <url>http://secunia.com/advisories/19455/</url>
 </references>
 <dates>
 <discovery>2006-03-30</discovery>
 <entry>2006-04-05</entry>
 </dates>
 </vuln>

<vuln vid="91afa94c-c452-11da-8bff-000ae42e9b93">
 <topic>mod_pubcookie -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>mod_pubcookie</name>
	<range><lt>3.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nathan Dors of the Pubcookie Project reports:
	<blockquote cite="http://www.pubcookie.org/news/20060306-apps-secadv.html">
	 Non-persistent XSS vulnerabilities were found in the
	 Pubcookie Apache module (mod_pubcookie) and ISAPI
	 filter. These components mishandle untrusted data when
	 printing responses to the browser. This makes them
	 vulnerable to carefully crafted requests containing script
	 or HTML. If an attacker can lure an unsuspecting user to
	 visit carefully staged content, the attacker can use it to
	 redirect the user to a vulnerable Pubcookie application
	 server and attempt to exploit the XSS vulnerabilities.
	 These vulnerabilities are classified as *high* due to the
	 nature and purpose of Pubcookie application servers for user
	 authentication and Web Single Sign-on (SSO). An attacker
	 who injects malicious script through the vulnerabilities
	 might steal private Pubcookie data including a user's
	 authentication assertion ("granting") cookies and
	 application session cookies.
	</blockquote>
 </body>
 </description>
 <references>
 <certvu>314540</certvu>
 </references>
 <dates>
 <discovery>2006-03-06</discovery>
 <entry>2006-04-05</entry>
 </dates>
 </vuln>

<vuln vid="855cd9fa-c452-11da-8bff-000ae42e9b93">
 <topic>pubcookie-login-server -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>pubcookie-login-server</name>
	<range><lt>3.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nathan Dors of the Pubcookie Project reports:
	<blockquote cite="">
	 Multiple non-persistent XSS vulnerabilities were found
	 in the Pubcookie login server's compiled binary "index.cgi"
	 CGI program. The CGI program mishandles untrusted data when
	 printing responses to the browser. This makes the program
	 vulnerable to carefully crafted requests containing script
	 or HTML. If an attacker can lure an unsuspecting user to
	 visit carefully staged content, the attacker can use it to
	 redirect the user to his or her local Pubcookie login page
	 and attempt to exploit the XSS vulnerabilities.
	 These vulnerabilities are classified as *critical* due
	 to the nature and purpose of the Pubcookie login server for
	 user authentication and Web Single Sign-on (SSO). Specific
	 threats include:
	 <ul>
	 <li>An attacker who injects malicious script through the
	 vulnerabilities might steal senstive user data including
	 a user's authentication credentials (usernames and
	 passwords);</li>
	 <li>An attacker who injects malicious script through the
	 vulnerabilities might steal private Pubcookie data
	 including a user's authentication assertion ("granting")
	 cookies and SSO ("login") session cookies;</li>
	 <li>An attacker who injects HTML tags through the
	 vulnerabilities might deface a site's Pubcookie login page
	 for a single visit by a single user (i.e. a non-persistent
	 defacement).</li>
	 </ul>
	 At the heart of these threats lies a violation of the
	 user's trust in the Pubcookie login server.
	</blockquote>
 </body>
 </description>
 <references>
 <certvu>337585</certvu>
 </references>
 <dates>
 <discovery>2006-03-06</discovery>
 <entry>2006-04-05</entry>
 </dates>
 </vuln>

<vuln vid="37a5c10f-bf56-11da-b0e9-00123ffe8333">
 <topic>freeradius -- EAP-MSCHAPv2 Authentication Bypass</topic>
 <affects>
 <package>
	<name>freeradius</name>
	<range><ge>1.0.0</ge><lt>1.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Freeradius Security Contact reports:
	<blockquote cite="http://www.freeradius.org/security.html#1.1.0">
	 Insufficient input validation was being done in the
	 EAP-MSCHAPv2 state machine. A malicious attacker could
	 manipulate their EAP-MSCHAPv2 client state machine to
	 potentially convince the server to bypass authentication
	 checks. This bypassing could also result in the server
	 crashing.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1354</cvename>
 <url>http://www.freeradius.org/security.html#1.1.0</url>
 <url>http://secunia.com/advisories/19300/</url>
 </references>
 <dates>
 <discovery>2006-03-21</discovery>
 <entry>2006-03-29</entry>
 </dates>
 </vuln>

<vuln vid="2db97aa6-be81-11da-9b82-0050bf27ba24">
 <topic>horde -- remote code execution vulnerability in the help viewer</topic>
 <affects>
 <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><lt>3.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Horde 3.1.1 release announcement:
	<blockquote cite="http://lists.horde.org/archives/announce/2006/000271.html">
	 Major changes compared to Horde 3.1 are:
	 <ul>
	 <li>Fix for remote code execution vulnerability in the
	 help viewer, discovered by Jan Schneider from the Horde
	 team.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>17292</bid>
 <cvename>CVE-2006-1491</cvename>
 <url>http://lists.horde.org/archives/announce/2006/000271.html</url>
 </references>
 <dates>
 <discovery>2006-03-28</discovery>
 <entry>2006-03-28</entry>
 <modified>2006-03-30</modified>
 </dates>
 </vuln>

<vuln vid="25858c37-bdab-11da-b7d4-00123ffe8333">
 <topic>linux-realplayer -- buffer overrun</topic>
 <affects>
 <package>
	<name>linux-realplayer</name>
	<range><ge>10.0.1</ge><lt>10.0.7.785.20060201</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia Advisories Reports:
	<blockquote cite="http://secunia.com/advisories/19358/">
	 A boundary error when processing SWF files can be exploited to
	 cause a buffer overflow. This may allow execution of arbitrary
	 code on the user's system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0323</cvename>
 <url>http://service.real.com/realplayer/security/03162006_player/en/</url>
 <url>http://secunia.com/advisories/19358/</url>
 </references>
 <dates>
 <discovery>2006-03-23</discovery>
 <entry>2006-03-27</entry>
 </dates>
 </vuln>

<vuln vid="fe4c84fc-bdb5-11da-b7d4-00123ffe8333">
 <topic>linux-realplayer -- heap overflow</topic>
 <affects>
 <package>
	<name>linux-realplayer</name>
	<range><ge>10.0.1</ge><lt>10.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	iDefense Reports:
	<blockquote cite="http://www.idefense.com/intelligence/vulnerabilities/display.php?id=404">
	 Remote exploitation of a heap-based buffer overflow in
	 RealNetwork Inc's RealPlayer could allow the execution of
	 arbitrary code in the context of the currently logged in
	 user.
	 In order to exploit this vulnerability, an attacker would
	 need to entice a user to follow a link to a malicious server.
	 Once the user visits a website under the control of an
	 attacker, it is possible in a default install of RealPlayer
	 to force a web-browser to use RealPlayer to connect to an
	 arbitrary server, even when it is not the default application
	 for handling those types, by the use of embedded object tags
	 in a webpage. This may allow automated exploitation when the
	 page is viewed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2922</cvename>
 <url>http://service.real.com/realplayer/security/03162006_player/en/</url>
 <url>http://www.idefense.com/intelligence/vulnerabilities/display.php?id=404</url>
 <url>http://secunia.com/advisories/19358/</url>
 </references>
 <dates>
 <discovery>2006-03-23</discovery>
 <entry>2006-03-27</entry>
 </dates>
 </vuln>

<vuln vid="08ac7b8b-bb30-11da-b2fb-000e0c2e438a">
 <topic>sendmail -- race condition vulnerability</topic>
 <affects>
 <package>
	<name>sendmail</name>
	<range><gt>8.13</gt><lt>8.13.6</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_6</lt></range>
	<range><ge>5.4</ge><lt>5.4_13</lt></range>
	<range><ge>5.3</ge><lt>5.3_28</lt></range>
	<range><ge>4.11</ge><lt>4.11_16</lt></range>
	<range><ge>4.10</ge><lt>4.10_22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	A race condition has been reported to exist in the handling
	 by sendmail of asynchronous signals.
	<h1>Impact</h1>
	A remote attacker may be able to execute arbitrary code with
	 the privileges of the user running sendmail, typically
	 root.
	<h1>Workaround</h1>
	There is no known workaround other than disabling
	 sendmail.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0058</cvename>
 <freebsdsa>SA-06:13.sendmail</freebsdsa>
 </references>
 <dates>
 <discovery>2006-03-22</discovery>
 <entry>2006-03-24</entry>
 <modified>2006-06-09</modified>
 </dates>
 </vuln>

<vuln vid="e93bc5b0-bb2e-11da-b2fb-000e0c2e438a">
 <topic>OPIE -- arbitrary password change</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_6</lt></range>
	<range><ge>5.4</ge><lt>5.4_13</lt></range>
	<range><ge>5.3</ge><lt>5.3_28</lt></range>
	<range><ge>4.11</ge><lt>4.11_16</lt></range>
	<range><ge>4.10</ge><lt>4.10_22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	The opiepasswd(1) program uses getlogin(2) to identify the
	 user calling opiepasswd(1). In some circumstances
	 getlogin(2) will return "root" even when running as an
	 unprivileged user. This causes opiepasswd(1) to allow an
	 unpriviled user to configure OPIE authentication for the root
	 user.
	<h1>Impact</h1>
	In certain cases an attacker able to run commands as a non
	 privileged users which have not explicitly logged in, for
	 example CGI scripts run by a web server, is able to configure
	 OPIE access for the root user. If the attacker is able to
	 authenticate as root using OPIE authentication, for example if
	 "PermitRootLogin" is set to "yes" in sshd_config or the
	 attacker has access to a local user in the "wheel" group, the
	 attacker can gain root privileges.
	<h1>Workaround</h1>
	Disable OPIE authentication in PAM:
	<pre># sed -i "" -e /opie/s/^/#/ /etc/pam.d/*</pre>
	or
	Remove the setuid bit from opiepasswd:
	<pre># chflags noschg /usr/bin/opiepasswd</pre>
	<pre># chmod 555 /usr/bin/opiepasswd</pre>
	<pre># chflags schg /usr/bin/opiepasswd</pre>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1283</cvename>
 <freebsdsa>SA-06:12.opie</freebsdsa>
 </references>
 <dates>
 <discovery>2006-03-22</discovery>
 <entry>2006-03-24</entry>
 <modified>2006-06-09</modified>
 </dates>
 </vuln>

<vuln vid="e50a7476-bb2d-11da-b2fb-000e0c2e438a">
 <topic>ipsec -- reply attack vulnerability</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_6</lt></range>
	<range><ge>5.4</ge><lt>5.4_13</lt></range>
	<range><ge>5.3</ge><lt>5.3_28</lt></range>
	<range><ge>4.11</ge><lt>4.11_16</lt></range>
	<range><ge>4.10</ge><lt>4.10_22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	IPsec provides an anti-replay service which when enabled
	 prevents an attacker from successfully executing a replay
	 attack. This is done through the verification of sequence
	 numbers. A programming error in the fast_ipsec(4)
	 implementation results in the sequence number associated with
	 a Security Association not being updated, allowing packets to
	 unconditionally pass sequence number verification checks.
	<h1>Impact</h1>
	An attacker able to intercept IPSec packets can replay
	 them. If higher level protocols which do not provide any
	 protection against packet replays (e.g., UDP) are used, this
	 may have a variety of effects.
	<h1>Workaround</h1>
	No workaround is available.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0905</cvename>
 <freebsdsa>SA-06:11.ipsec</freebsdsa>
 </references>
 <dates>
 <discovery>2006-03-22</discovery>
 <entry>2006-03-24</entry>
 <modified>2006-06-09</modified>
 </dates>
 </vuln>

<vuln vid="61534682-b8f4-11da-8e62-000e0c33c2dc">
 <topic>xorg-server -- privilege escalation</topic>
 <affects>
 <package>
	<name>xorg-server</name>
	<range><eq>6.9.0</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Daniel Stone of X.Org reports:
	<blockquote cite="http://lists.freedesktop.org/archives/xorg/2006-March/013992.html">
	 During the analysis of results from the Coverity code review
	 of X.Org, we discovered a flaw in the server that allows local
	 users to execute arbitrary code with root privileges, or cause
	 a denial of service by overwriting files on the system, again
	 with root privileges.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0745</cvename>
 <url>https://bugs.freedesktop.org/show_bug.cgi?id=6213</url>
 </references>
 <dates>
 <discovery>2006-03-20</discovery>
 <entry>2006-03-21</entry>
 </dates>
 </vuln>

<vuln vid="b62c80c2-b81a-11da-bec5-00123ffe8333">
 <topic>heimdal -- Multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>heimdal</name>
	<range><lt>0.6.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Project heimdal Security Advisory reports:
	<blockquote cite="http://www.pdc.kth.se/heimdal/advisory/2005-04-20/">
	 The telnet client program in Heimdal has buffer overflows
	 in the functions slc_add_reply() and env_opt_add(), which
	 may lead to remote code execution.
	</blockquote>
	<blockquote cite="http://www.pdc.kth.se/heimdal/advisory/2005-06-20/">
	 The telnetd server program in Heimdal has buffer overflows
	 in the function getterminaltype, which may lead to remote code
	 execution.
	</blockquote>
	<blockquote cite="http://www.pdc.kth.se/heimdal/advisory/2006-02-06/">
	 The rshd server in Heimdal has a privilege escalation bug
	 when storing forwarded credentials. The code allowes a user
	 to overwrite a file with its credential cache, and get ownership
	 of the file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0469</cvename>
 <cvename>CVE-2005-2040</cvename>
 <cvename>CVE-2006-0582</cvename>
 <cvename>CVE-2006-0677</cvename>
 <url>http://www.pdc.kth.se/heimdal/advisory/2005-04-20</url>
 <url>http://www.pdc.kth.se/heimdal/advisory/2005-06-20</url>
 <url>http://www.pdc.kth.se/heimdal/advisory/2006-02-06</url>
 </references>
 <dates>
 <discovery>2006-02-06</discovery>
 <entry>2006-03-20</entry>
 </dates>
 </vuln>

<vuln vid="b8e361b8-b7ff-11da-8414-0013d4a4a40e">
 <topic>curl -- TFTP packet buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>curl</name>
	<name>linux-curl</name>
	<range><gt>7.14.1</gt><lt>7.15.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Project cURL Security Advisory reports:
	<blockquote cite="http://curl.haxx.se/docs/adv_20060320.html">
	 libcurl uses the given file part of a TFTP URL in a manner that
	 allows a malicious user to overflow a heap-based memory buffer due
	 to the lack of boundary check.
	 This overflow happens if you pass in a URL with a TFTP
	 protocol prefix ("tftp://"), using a valid host and a path
	 part that is longer than 512 bytes.
	 The affected flaw can be triggered by a redirect, if
	 curl/libcurl is told to follow redirects and an HTTP
	 server points the client to a tftp URL with the
	 characteristics described above.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-1061</cvename>
 <url>http://curl.haxx.se/docs/adv_20060320.html</url>
 </references>
 <dates>
 <discovery>2006-03-20</discovery>
 <entry>2006-03-20</entry>
 <modified>2006-10-05</modified>
 </dates>
 </vuln>

<vuln vid="6779e82f-b60b-11da-913d-000ae42e9b93">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal</name>
	<range><lt>3.6.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Drupal reports:
	<blockquote cite="http://drupal.org/node/53806">
	 Mail header injection vulnerability.
	 Linefeeds and carriage returns were not being stripped from
	 email headers, raising the possibility of bogus headers
	 being inserted into outgoing email.
	 This could lead to Drupal sites being used to send unwanted
	 email.
	</blockquote>
	<blockquote cite="http://drupal.org/node/53805">
	 Session fixation vulnerability.
	 If someone creates a clever enough URL and convinces you to
	 click on it, and you later log in but you do not log off
	 then the attacker may be able to impersonate you.
	</blockquote>
	<blockquote cite="http://drupal.org/node/53803">
	 XSS vulnerabilities.
	 Some user input sanity checking was missing. This could
	 lead to possible cross-site scripting (XSS) attacks.
	 XSS can lead to user tracking and theft of accounts and
	 services.
	</blockquote>
	<blockquote cite="http://drupal.org/node/53796">
	 Security bypass in menu.module.
	 If you use menu.module to create a menu item, the page you
	 point to will be accessible to all, even if it is an admin
	 page.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://drupal.org/node/53806</url>
 <url>http://drupal.org/node/53805</url>
 <url>http://drupal.org/node/53803</url>
 <url>http://drupal.org/node/53796</url>
 </references>
 <dates>
 <discovery>2006-03-13</discovery>
 <entry>2006-03-17</entry>
 </dates>
 </vuln>

<vuln vid="c7c09579-b466-11da-82d0-0050bf27ba24">
 <topic>horde -- "url" disclosure of sensitive information vulnerability</topic>
 <affects>
 <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><lt>3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 Secunia advisory SA19246:
	<blockquote cite="http://secunia.com/advisories/19246/">
	 Paul Craig has discovered a vulnerability in Horde, which
	 can be exploited by malicious people to disclose sensitive
	 information.
	 Input passed to the "url" parameter in "services/go.php"
	 isn't properly verified, before it is used in a
	 "readfile()" call. This can be exploited to disclose the
	 content of arbitrary files via e.g. the "php://" protocol
	 wrapper.
	 The vulnerability has been confirmed in version 3.0.9 and
	 has also been reported in prior versions.
	 Provided and/or discovered by:
	 Paul Craig, Security-Assessment.com.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/19246/</url>
 </references>
 <dates>
 <discovery>2006-03-15</discovery>
 <entry>2006-03-15</entry>
 </dates>
 </vuln>

<vuln vid="83421018-b3ef-11da-a32d-000c6ec775d9">
 <topic>linux-flashplugin -- arbitrary code execution vulnerability</topic>
 <affects>
 <package>
	<name>linux-flashplugin</name>
	<range><lt>7.0r63</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Adobe reports:
	<blockquote cite="http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html">
	 Critical vulnerabilities have been identified in Flash
	 Player that could allow an attacker who successfully
	 exploits these vulnerabilities to take control of the
	 affected system. A malicious SWF must be loaded in Flash
	 Player by the user for an attacker to exploit these
	 vulnerabilities.
	 Flash Player 8 update (8.0.24.0), and Flash Player 7
	 update (7.0.63.0) address security vulnerabilities in
	 previous versions of Flash Player, which could lead to the
	 potential execution of arbitrary code. These
	 vulnerabilities could be accessed through content
	 delivered from a remote location via the users web
	 browser, email client, or other applications that include
	 or reference the Flash Player.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0024</cvename>
 <url>http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html</url>
 </references>
 <dates>
 <discovery>2006-03-14</discovery>
 <entry>2006-03-15</entry>
 </dates>
 </vuln>

<vuln vid="6111ecb8-b20d-11da-b2fb-000e0c2e438a">
 <topic>nfs -- remote denial of service</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_5</lt></range>
	<range><ge>5.4</ge><lt>5.4_12</lt></range>
	<range><ge>5.3</ge><lt>5.3_27</lt></range>
	<range><ge>4.11</ge><lt>4.11_15</lt></range>
	<range><ge>4.10</ge><lt>4.10_21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem description:</h1>
	A part of the NFS server code charged with handling incoming
	 RPC messages via TCP had an error which, when the server
	 received a message with a zero-length payload, would cause a
	 NULL pointer dereference which results in a kernel panic. The
	 kernel will only process the RPC messages if a userland nfsd
	 daemon is running.
	<h1>Impact:</h1>
	The NULL pointer deference allows a remote attacker capable
	 of sending RPC messages to an affected FreeBSD system to crash
	 the FreeBSD system.
	<h1>Workaround:</h1>
	<ol>
	 <li>
	 Disable the NFS server: set the nfs_server_enable
	 variable to "NO" in /etc/rc.conf, and reboot.
	 Alternatively, if there are no active NFS clients (as
	 listed by the showmount(8) utility), simply killing the
	 mountd and nfsd processes should suffice.
	 </li>
	 <li>
	 Add firewall rules to block RPC traffic to the NFS server
	 from untrusted hosts.
	 </li>
	</ol>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0900</cvename>
 <freebsdsa>SA-06:10.nfs</freebsdsa>
 </references>
 <dates>
 <discovery>2006-03-01</discovery>
 <entry>2006-03-12</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="6a308e8e-b1b4-11da-b2fb-000e0c2e438a">
 <topic>openssh -- remote denial of service</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_12</lt></range>
	<range><ge>5.3</ge><lt>5.3_27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem description:</h1>
	Because OpenSSH and OpenPAM have conflicting designs (one is event-
	 driven while the other is callback-driven), it is necessary for
	 OpenSSH to fork a child process to handle calls to the PAM framework.
	 However, if the unprivileged child terminates while PAM authentication
	 is under way, the parent process incorrectly believes that the PAM
	 child also terminated. The parent process then terminates, and the
	 PAM child is left behind.
	Due to the way OpenSSH performs internal accounting, these orphaned
	 PAM children are counted as pending connections by the master OpenSSH
	 server process. Once a certain number of orphans has accumulated, the
	 master decides that it is overloaded and stops accepting client
	 connections.
	<h1>Impact:</h1>
	By repeatedly connecting to a vulnerable server, waiting for
	 a password prompt, and closing the connection, an attacker can
	 cause OpenSSH to stop accepting client connections until the
	 system restarts or an administrator manually kills the orphaned
	 PAM processes.
	<h1>Workaround:</h1>
	The following command will show a list of orphaned PAM
	 processes:
	<pre># pgrep -lf 'sshd.*\[pam\]'</pre>
	The following command will kill orphaned PAM processes:
	<pre># pkill -f 'sshd.*\[pam\]'</pre>
	To prevent OpenSSH from leaving orphaned PAM processes behind,
	 perform one of the following:
	<ol>
	 <li>
	 Disable PAM authentication in OpenSSH. Users will still
	 be able to log in using their Unix password, OPIE or SSH
	 keys.
	 To do this, execute the following commands as root:
	 <pre># echo 'UsePAM no' &gt;&gt;/etc/ssh/sshd_config</pre>
	 <pre># echo 'PasswordAuthentication yes' &gt;&gt;/etc/ssh/sshd_config</pre>
	 <pre># /etc/rc.d/sshd restart</pre>
	 </li>
	 <li>
	 If disabling PAM is not an option - if, for instance, you use
	 RADIUS authentication, or store user passwords in an SQL database
	 - you may instead disable privilege separation. However, this may
	 leave OpenSSH vulnerable to hitherto unknown bugs, and should be
	 considered a last resort.
	 To do this, execute the following commands as root:
	 <pre># echo 'UsePrivilegeSeparation no' &gt;&gt;/etc/ssh/sshd_config</pre>
	 <pre># /etc/rc.d/sshd restart</pre>
	 </li>
	</ol>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0883</cvename>
 <freebsdsa>SA-06:09.openssh</freebsdsa>
 </references>
 <dates>
 <discovery>2006-03-01</discovery>
 <entry>2006-03-12</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="948921ad-afbc-11da-bad9-02e081235dab">
 <topic>GnuPG does not detect injection of unsigned data</topic>
 <affects>
 <package>
	<name>gnupg</name>
	<range><lt>1.4.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Werner Koch reports:
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html">
	 In the aftermath of the false positive signature
	 verfication bug (announced 2006-02-15) more thorough testing
	 of the fix has been done and another vulnerability has been
	 detected. This new problem affects the use of *gpg* for
	 verification of signatures which are _not_ detached
	 signatures. The problem also affects verification of
	 signatures embedded in encrypted messages; i.e. standard use
	 of gpg for mails.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0049</cvename>
 <mlist msgid="87d5gvh2kr.fsf@wheatstone.g10code.de">http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html</mlist>
 </references>
 <dates>
 <discovery>2006-03-09</discovery>
 <entry>2006-03-10</entry>
 <modified>2006-03-11</modified>
 </dates>
 </vuln>

<vuln vid="104beb63-af4d-11da-8414-0013d4a4a40e">
 <topic>mplayer -- heap overflow in the ASF demuxer</topic>
 <affects>
 <package>
	<name>mplayer</name>
	<name>mplayer-gtk</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk-esound</name>
	<range><lt>0.99.7_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mplayer team reports:
	<blockquote cite="http://www.mplayerhq.hu/design7/news.html#vuln13">
	 A potential buffer overflow was found in the ASF demuxer.
	 Arbitrary remote code execution is possible (under the user ID
	 running the player) when streaming an ASF file from a malicious
	 server or local code execution (under the user ID running the
	 player) if a malicious ASF file is played locally.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0579</cvename>
 <url>http://www.mplayerhq.hu/design7/news.html#vuln13</url>
 <url>http://secunia.com/advisories/18718</url>
 <url>http://bugs.gentoo.org/show_bug.cgi?id=122029</url>
 </references>
 <dates>
 <discovery>2006-02-15</discovery>
 <entry>2006-03-09</entry>
 </dates>
 </vuln>

<vuln vid="594ad3c5-a39b-11da-926c-0800209adf0e">
 <topic>SSH.COM SFTP server -- format string vulnerability</topic>
 <affects>
 <package>
	<name>ssh2</name>
	<name>ssh2-nox11</name>
	<range><lt>3.2.9.1_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SSH Communications Security Corp reports a format string
	 vulnerability in their SFTP server. This vulnerability could
	 cause a user with SCP/SFTP access only to get permission to
	 execute also other commands. It could also allow user A to
	 create a special file that when accessed by user B allows
	 user A to execute commands as user B.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0705</cvename>
 <bid>16640</bid>
 <url>http://www.ssh.com/company/newsroom/article/715/</url>
 <url>http://www.frsirt.com/english/advisories/2006/0554</url>
 <url>http://securitytracker.com/id?1015619</url>
 <url>http://secunia.com/advisories/18828</url>
 <url>http://xforce.iss.net/xforce/xfdb/24651</url>
 </references>
 <dates>
 <discovery>2006-02-13</discovery>
 <entry>2006-03-04</entry>
 <modified>2006-03-06</modified>
 </dates>
 </vuln>

<vuln vid="6107efb9-aae3-11da-aea1-000854d03344">
 <topic>gtar -- invalid headers buffer overflow</topic>
 <affects>
 <package>
	<name>gtar</name>
	<range><lt>1.15.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GNU tar is vulnerable to a buffer overflow, caused by
	 improper bounds checking of the PAX extended headers. By
	 tricking an user into processing a specially crafted tar
	 archive, this could be exploited to execute arbitrary
	 code with the privileges of the user.
 </body>
 </description>
 <references>
 <bid>16764</bid>
 <cvename>CVE-2006-0300</cvename>
 </references>
 <dates>
 <discovery>2006-02-22</discovery>
 <entry>2006-03-03</entry>
 </dates>
 </vuln>

<vuln vid="46f7b598-a781-11da-906a-fde5cdde365e">
 <topic>bugzilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<name>ja-bugzilla</name>
	<range><ge>2.17.1</ge><lt>2.20.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Some vulnerabilities have been reported in Bugzilla,
	 which can be exploited by malicious users to conduct SQL injection
	 attacks, and by malicious people to disclose sensitive information
	 and conduct script insertion attacks.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-2420</cvename>
 <cvename>CVE-2006-0916</cvename>
 <cvename>CVE-2006-0915</cvename>
 <cvename>CVE-2006-0914</cvename>
 <cvename>CVE-2006-0913</cvename>
 <url>http://www.bugzilla.org/security/2.18.4/</url>
 </references>
 <dates>
 <discovery>2006-02-20</discovery>
 <entry>2006-02-27</entry>
 <modified>2006-11-11</modified>
 </dates>
 </vuln>

<vuln vid="af9018b6-a4f5-11da-bb41-0011433a9404">
 <topic>squirrelmail -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>squirrelmail</name>
	<range><lt>1.4.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple vulnerabilities has been discovered since 1.4.5,
	 including IMAP injection as well as some XSS issues.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0377</cvename>
 <cvename>CVE-2006-0195</cvename>
 <cvename>CVE-2006-0188</cvename>
 </references>
 <dates>
 <discovery>2006-02-23</discovery>
 <entry>2006-02-24</entry>
 </dates>
 </vuln>

<vuln vid="e319da0b-a228-11da-b410-000e0c2e438a">
 <topic>gedit -- format string vulnerability</topic>
 <affects>
 <package>
	<name>gedit</name>
	<range><lt>2.10.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Yan Feng reports a format string vulnerability in gedit.
	 This vulnerability could cause a denial of service with a
	 binary file that contains format string characters within
	 the filename. It had been reported that web browsers
	 and email clients can be configured to provide a filename as
	 an argument to gedit.:
 </body>
 </description>
 <references>
 <cvename>CAN-2005-1686</cvename>
 <mlist msgid="20050520202628.12260.qmail@www.securityfocus.com">:http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111661117701398</mlist>
 </references>
 <dates>
 <discovery>2005-05-20</discovery>
 <entry>2006-02-20</entry>
 </dates>
 </vuln>

<vuln vid="07ead557-a220-11da-b410-000e0c2e438a">
 <topic>WebCalendar -- unauthorized access vulnerability</topic>
 <affects>
 <package>
	<name>WebCalendar</name>
	<range><lt>1.0.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports that WebCalendar is affected by
	 an unauthorized access vulnerability.	The vulnerability
	 is caused by improper checking of the authentication
	 mechanism before access is being permitted to the
	 "assistant_edit.php" file.
 </body>
 </description>
 <references>
 <bid>14072</bid>
 <cvename>CAN-2005-2320</cvename>
 </references>
 <dates>
 <discovery>2005-06-27</discovery>
 <entry>2006-02-20</entry>
 </dates>
 </vuln>

<vuln vid="9cd52bc6-a213-11da-b410-000e0c2e438a">
 <topic>abiword, koffice -- stack based buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>koffice</name>
	<range><gt>1.2.0</gt><lt>1.4.1_1,1</lt></range>
 </package>
 <package>
	<name>abiword</name>
	<range><lt>2.2.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chris Evans reports that AbiWord is vulnerable to multiple
	 stack-based buffer overflow vulnerabilities.	This
	 is caused by improper checking of the user-supplied data
	 before it is being copied to an too small buffer. The
	 vulnerability is triggered when someone is importing RTF
	 files.
 </body>
 </description>
 <references>
 <bid>15096</bid>
 <cvename>CAN-2005-2972</cvename>
 <url>http://scary.beasts.org/security/CESA-2005-006.txt</url>
 <url>http://www.abisource.com/changelogs/2.2.11.phtml</url>
 <url>http://www.kde.org/info/security/advisory-20051011-1.txt</url>
 </references>
 <dates>
 <discovery>2005-10-14</discovery>
 <entry>2006-02-20</entry>
 <modified>2006-02-20</modified>
 </dates>
 </vuln>

<vuln vid="0b2b4b4d-a07c-11da-be0a-000c6ec775d9">
 <topic>postgresql81-server -- SET ROLE privilege escalation</topic>
 <affects>
 <package>
	<name>postgresql-server</name>
	<range><ge>8.1.0</ge><lt>8.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PostgreSQL team reports:
	<blockquote cite="http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3">
	 Due to inadequate validity checking, a user could exploit
	 the special case that SET ROLE normally uses to restore
	 the previous role setting after an error. This allowed
	 ordinary users to acquire superuser status, for
	 example.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0553</cvename>
 <url>http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3</url>
 </references>
 <dates>
 <discovery>2006-02-14</discovery>
 <entry>2006-02-18</entry>
 <modified>2006-08-13</modified>
 </dates>
 </vuln>

<vuln vid="63fe4189-9f97-11da-ac32-0001020eed82">
 <topic>gnupg -- false positive signature verification</topic>
 <affects>
 <package>
	<name>gnupg</name>
	<range><lt>1.4.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Werner Koch reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=gnupg-devel&amp;m=113999098729114">
	 The Gentoo project identified a security related bug in
	 GnuPG. When using any current version of GnuPG for
	 unattended signature verification (e.g. by scripts and
	 mail programs), false positive signature verification of
	 detached signatures may occur.
	 This problem affects the tool *gpgv*, as well as using
	 "gpg --verify" to imitate gpgv, if only the exit code of
	 the process is used to decide whether a detached signature
	 is valid. This is a plausible mode of operation for
	 gpgv.
	 If, as suggested, the --status-fd generated output is
	 used to decide whether a signature is valid, no problem
	 exists. In particular applications making use of the
	 GPGME library[2] are not affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0455</cvename>
 <mlist msgid="87u0b1xdru.fsf@wheatstone.g10code.de">http://marc.theaimsgroup.com/?l=gnupg-devel&amp;m=113999098729114</mlist>
 </references>
 <dates>
 <discovery>2006-02-15</discovery>
 <entry>2006-02-17</entry>
 </dates>
 </vuln>

<vuln vid="e34d0c2e-9efb-11da-b410-000e0c2e438a">
 <topic>rssh -- privilege escalation vulnerability</topic>
 <affects>
 <package>
	<name>rssh</name>
	<range><lt>2.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pizzashack reports:
	<blockquote cite="http://www.pizzashack.org/rssh/security.shtml">
	 Max Vozeler has reported a problem whereby rssh can
	 allow users who have shell access to systems where rssh
	 is installed (and rssh_chroot_helper is installed SUID)
	 to gain root access to the system, due to the ability to
	 chroot to arbitrary locations. There are a lot of
	 potentially mitigating factors, but to be safe you should
	 upgrade immediately.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>16050</bid>
 <cvename>CVE-2005-3345</cvename>
 <url>http://www.pizzashack.org/rssh/security.shtml</url>
 </references>
 <dates>
 <discovery>2005-12-18</discovery>
 <entry>2006-02-16</entry>
 </dates>
 </vuln>

<vuln vid="d38e1810-9ef7-11da-b410-000e0c2e438a">
 <topic>tor -- malicious tor server can locate a hidden service</topic>
 <affects>
 <package>
	<name>tor</name>
	<range><lt>0.1.0.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Roger Dingledine reports:
	<blockquote cite="http://archives.seul.org/or/announce/Jan-2006/msg00001.html">
	 If you offer a Tor hidden service, an adversary who can
	 run a fast Tor server and who knows some basic statistics
	 can find the location of your hidden service in a matter of
	 minutes to hours.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0414</cvename>
 <url>http://archives.seul.org/or/announce/Jan-2006/msg00001.html</url>
 </references>
 <dates>
 <discovery>2006-01-12</discovery>
 <entry>2006-02-16</entry>
 </dates>
 </vuln>

<vuln vid="1b725079-9ef6-11da-b410-000e0c2e438a">
 <topic>sudo -- arbitrary command execution</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><lt>1.6.8.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tavis Ormandy reports:
	<blockquote cite="http://www.courtesan.com/sudo/alerts/bash_env.html">
	 The bash shell uses the value of the PS4 environment
	 variable (after expansion) as a prefix for commands run
	 in execution trace mode. Execution trace mode (xtrace) is
	 normally set via bash's -x command line option or
	 interactively by running "set -o xtrace". However, it may
	 also be enabled by placing the string "xtrace" in the
	 SHELLOPTS environment variable before bash is started.
	 A malicious user with sudo access to a shell script that
	 uses bash can use this feature to run arbitrary commands
	 for each line of the script.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>15191</bid>
 <cvename>CVE-2005-2959</cvename>
 <url>http://www.courtesan.com/sudo/alerts/bash_env.html</url>
 </references>
 <dates>
 <discovery>2005-10-25</discovery>
 <entry>2006-02-16</entry>
 </dates>
 </vuln>

<vuln vid="a78299e7-9ef3-11da-b410-000e0c2e438a">
 <topic>libtomcrypt -- weak signature scheme with ECC keys</topic>
 <affects>
 <package>
	<name>libtomcrypt</name>
	<range><le>1.02</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Secure Science Corporation reports that libtomcrypt is
	 vulnerable to a weak signature scheme. This allows an
	 attacker to create a valid random signature and use that to
	 sign arbitrary messages without requiring the private key.
 </body>
 </description>
 <references>
 <mlist msgid="4276CC31.9000307@securescience.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111540819703204</mlist>
 </references>
 <dates>
 <discovery>2005-05-01</discovery>
 <entry>2006-02-16</entry>
 </dates>
 </vuln>

<vuln vid="592815da-9eed-11da-b410-000e0c2e438a">
 <topic>mantis -- "view_filters_page.php" cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>mantis</name>
	<range><lt>1.0.0a4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	r0t reports:
	<blockquote cite="http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html">
	 Mantis contains a flaw that allows a remote cross site
	 scripting attack. This flaw exists because input passed to
	 "target_field" parameter in "view_filters_page.php" is not
	 properly sanitised before being returned to the user. This
	 could allow a user to create a specially crafted URL that
	 would execute arbitrary code in a user's browser within the
	 trust relationship between the browser and the server,
	 leading to a loss of integrity.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CAN-2005-4238</cvename>
 <url>http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html</url>
 </references>
 <dates>
 <discovery>2005-12-13</discovery>
 <entry>2006-02-16</entry>
 </dates>
 </vuln>

<vuln vid="28c9243a-72ed-11da-8c1d-000e0c2e438a">
 <topic>phpbb -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpbb</name>
	<name>zh-phpbb-tw</name>
	<range><lt>2.0.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple vulnerabilities have been reported within phpbb.
	 phpbb is proven vulnerable to:
	<ul>
	 <li>script insertion,</li>
	 <li>bypassing of protetion mechanisms,</li>
	 <li>multiple cross site scripting vulnerabilities,</li>
	 <li>SQL injection,</li>
	 <li>arbitrary code execution</li>
	</ul>
 </body>
 </description>
 <references>
 <bid>15170</bid>
 <bid>15243</bid>
 <cvename>CVE-2005-3310</cvename>
 <cvename>CVE-2005-3415</cvename>
 <cvename>CVE-2005-3416</cvename>
 <cvename>CVE-2005-3417</cvename>
 <cvename>CVE-2005-3418</cvename>
 <cvename>CVE-2005-3419</cvename>
 <cvename>CVE-2005-3420</cvename>
 <cvename>CVE-2005-3536</cvename>
 <cvename>CVE-2005-3537</cvename>
 <mlist msgid="20051022132217.10390.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=113017003617987</mlist>
 <url>http://www.hardened-php.net/advisory_172005.75.html</url>
 </references>
 <dates>
 <discovery>2005-10-24</discovery>
 <entry>2006-02-16</entry>
 </dates>
 </vuln>

<vuln vid="486aff57-9ecd-11da-b410-000e0c2e438a">
 <topic>postgresql -- character conversion and tsearch2 vulnerabilities</topic>
 <affects>
 <package>
	<name>postgresql</name>
	<range><ge>7.2.0</ge><lt>7.2.8</lt></range>
	<range><ge>7.3.0</ge><lt>7.3.10</lt></range>
	<range><ge>7.4.0</ge><lt>7.4.8</lt></range>
	<range><ge>8.0.0</ge><lt>8.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The postgresql development team reports:
	 <blockquote cite="http://www.postgresql.org/about/news.315">
	 The more severe of the two errors is that the functions
	 that support client-to-server character set conversion
	 can be called from SQL commands by unprivileged users,
	 but these functions are not designed to be safe against
	 malicious choices of argument values. This problem exists
	 in PostgreSQL 7.3.* through 8.0.*. The recommended fix is
	 to disable public EXECUTE access for these functions. This
	 does not affect normal usage of the functions for character
	 set conversion, but it will prevent misuse.
	 The other error is that the contrib/tsearch2 module
	 misdeclares several functions as returning type "internal"
	 when they do not have any "internal" argument. This breaks
	 the type safety of "internal" by allowing users to
	 construct SQL commands that invoke other functions accepting
	 "internal" arguments. The consequences of this have not been
	 investigated in detail, but it is certainly at least possible
	 to crash the backend.
	 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CAN-2005-1409</cvename>
 <cvename>CAN-2005-1410</cvename>
 <url>http://www.postgresql.org/about/news.315</url>
 </references>
 <dates>
 <discovery>2005-05-02</discovery>
 <entry>2006-02-16</entry>
 </dates>
 </vuln>

<vuln vid="f6447303-9ec9-11da-b410-000e0c2e438a">
 <topic>heartbeat -- insecure temporary file creation vulnerability</topic>
 <affects>
 <package>
	<name>heartbeat</name>
	<range><lt>1.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Eric Romang reports a temporary file creation vulnerability
	 within heartbeat. The vulnerability is caused by hardcoded
	 temporary file usage. This can cause an attacker to create
	 an arbitrary symlink causing the application to overwrite the
	 symlinked file with the permissions of the user executing the
	 application.
 </body>
 </description>
 <references>
 <cvename>CAN-2005-2231</cvename>
 <url>http://www.zataz.net/adviso/heartbeat-06272005.txt</url>
 </references>
 <dates>
 <discovery>2005-07-12</discovery>
 <entry>2006-02-16</entry>
 <modified>2006-04-16</modified>
 </dates>
 </vuln>

<vuln vid="432bf98d-9e25-11da-b410-000e0c2e438a">
 <topic>kpdf -- heap based buffer overflow</topic>
 <affects>
 <package>
	<name>kdegraphics</name>
	<range><lt>3.5.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The KDE team reports:
	<blockquote cite="http://www.kde.org/info/security/advisory-20060202-1.txt">
	 kpdf, the KDE pdf viewer, shares code with xpdf. xpdf
	 contains a heap based buffer overflow in the splash
	 rasterizer engine that can crash kpdf or even execute
	 arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0301</cvename>
 <url>http://www.kde.org/info/security/advisory-20060202-1.txt</url>
 </references>
 <dates>
 <discovery>2006-02-02</discovery>
 <entry>2006-02-15</entry>
 </dates>
 </vuln>

<vuln vid="bb33981a-7ac6-11da-bf72-00123f589060">
 <topic>perl, webmin, usermin -- perl format string integer wrap vulnerability</topic>
 <affects>
 <package>
	<name>perl</name>
	<range><ge>5.6.0</ge><lt>5.6.2</lt></range>
	<range><ge>5.8.0</ge><lt>5.8.7_1</lt></range>
 </package>
 <package>
	<name>webmin</name>
	<range><lt>1.250</lt></range>
 </package>
 <package>
	<name>usermin</name>
	<range><lt>1.180</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Perl Development page reports:
	<blockquote cite="http://dev.perl.org/perl5/news/2005/perl_patches_fix_sprintf_buffer.html">
	 Dyad Security recently released a security advisory explaining how
	 in certain cases, a carefully crafted format string passed to
	 sprintf can cause a buffer overflow. This buffer overflow can then
	 be used by an attacker to execute code on the machine. This was
	 discovered in the context of a design problem with the Webmin
	 administration package that allowed a malicious user to pass
	 unchecked data into sprintf.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>15629</bid>
 <cvename>CVE-2005-3912</cvename>
 <cvename>CVE-2005-3962</cvename>
 <url>http://dev.perl.org/perl5/news/2005/perl_patches_fix_sprintf_buffer.html</url>
 <url>http://www.dyadsecurity.com/perl-0002.html</url>
 <url>http://www.dyadsecurity.com/webmin-0001.html</url>
 <url>http://www.webmin.com/security.html</url>
 </references>
 <dates>
 <discovery>2005-09-23</discovery>
 <entry>2006-02-15</entry>
 </dates>
 </vuln>

<vuln vid="12f9d9e9-9e1e-11da-b410-000e0c2e438a">
 <topic>phpicalendar -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>phpicalendar</name>
	<range><lt>2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Francesco Ongaro reports that phpicalendar is vulnerable for
	 a cross site scripting attack. The vulnerability is caused by
	 improper validation of the index.php file allowing attackers
	 to include an arbitrary file with the .php extension
 </body>
 </description>
 <references>
 <bid>15193</bid>
 <cvename>CVE-2005-3366</cvename>
 <url>http://www.ush.it/2005/10/25/php-icalendar-css/</url>
 </references>
 <dates>
 <discovery>2005-10-25</discovery>
 <entry>2006-02-15</entry>
 </dates>
 </vuln>

<vuln vid="f1f163ce-9e09-11da-b410-000e0c2e438a">
 <topic>phpicalendar -- file disclosure vulnerability</topic>
 <affects>
 <package>
	<name>phpicalendar</name>
	<range><lt>2.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpicalendar team reports that there is an
	 unspecified vulnerability within phpicalendar. This
	 seems to be a file disclosure vulnerability caused by
	 improper checking of the template parsing function.
	 This would allow an attacker to disclose any file
	 readable by the user under which the webserver runs.
 </body>
 </description>
 <references>
 <url>http://phpicalendar.net/forums/viewtopic.php?t=396</url>
 </references>
 <dates>
 <discovery>2006-02-08</discovery>
 <entry>2006-02-15</entry>
 </dates>
 </vuln>

<vuln vid="dfb71c00-9d44-11da-8c1d-000e0c2e438a">
 <topic>FreeBSD -- Infinite loop in SACK handling</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_11</lt></range>
	<range><ge>5.3</ge><lt>5.3_26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	When insufficient memory is available to handle an
	 incoming selective acknowledgement, the TCP/IP stack may
	 enter an infinite loop.
	Impact:
	By opening a TCP connection and sending a carefully crafted
	 series of packets, an attacker may be able to cause a denial
	 of service.
	Workaround:
	On FreeBSD 5.4, the net.inet.tcp.sack.enable sysctl can be used to
	 disable the use of SACK:
	# sysctl net.inet.tcp.sack.enable=0
	No workaround is available for FreeBSD 5.3.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0433</cvename>
 <freebsdsa>SA-06:08.sack</freebsdsa>
 </references>
 <dates>
 <discovery>2006-02-01</discovery>
 <entry>2006-02-14</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="52ba7713-9d42-11da-8c1d-000e0c2e438a">
 <topic>pf -- IP fragment handling panic</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_4</lt></range>
	<range><ge>5.4</ge><lt>5.4_10</lt></range>
	<range><ge>5.3</ge><lt>5.3_25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	A logic bug in pf's IP fragment cache may result in a packet
	 fragment being inserted twice, violating a kernel
	 invariant.
	Impact:
	By sending carefully crafted sequence of IP packet fragments,
	 a remote attacker can cause a system running pf with a ruleset
	 containing a 'scrub fragment crop' or 'scrub fragment
	 drop-ovl' rule to crash.
	Workaround:
	Do not use 'scrub fragment crop' or 'scrub fragment drop-ovl'
	 rules on systems running pf.	In most cases, such rules can be
	 replaced by 'scrub fragment reassemble' rules; see the
	 pf.conf(5) manual page for more details.

Systems which do not use pf, or use pf but do not use the
	 aforementioned rules, are not affected by this issue.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0381</cvename>
 <freebsdsa>SA-06:07.pf</freebsdsa>
 </references>
 <dates>
 <discovery>2006-01-25</discovery>
 <entry>2006-02-14</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="7a4f2aca-9d40-11da-8c1d-000e0c2e438a">
 <topic>FreeBSD -- Local kernel memory disclosure</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	A buffer allocated from the kernel stack may not be completely
	 initialized before being copied to userland. [CVE-2006-0379]
	A logic error in computing a buffer length may allow too much
	 data to be copied into userland. [CVE-2006-0380]
	Impact:
	Portions of kernel memory may be disclosed to local users.
	 Such memory might contain sensitive information, such as
	 portions of the file cache or terminal buffers. This
	 information might be directly useful, or it might be
	 leveraged to obtain elevated privileges in some way.	For
	 example, a terminal buffer might include a user-entered
	 password.
	Workaround:
	No workaround is available.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0379</cvename>
 <cvename>CVE-2006-0380</cvename>
 <freebsdsa>SA-06:06.kmem</freebsdsa>
 </references>
 <dates>
 <discovery>2006-01-25</discovery>
 <entry>2006-02-14</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="dade3316-9d31-11da-8c1d-000e0c2e438a">
 <topic>IEEE 802.11 -- buffer overflow</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	An integer overflow in the handling of corrupt IEEE 802.11
	 beacon or probe response frames when scanning for existing
	 wireless networks can result in the frame overflowing a
	 buffer.
	Impact:
	An attacker able broadcast a carefully crafted beacon or
	 probe response frame may be able to execute arbitrary code
	 within the context of the FreeBSD kernel on any system
	 scanning for wireless networks.
	Workaround:
	No workaround is available, but systems without IEEE 802.11
	 hardware or drivers loaded are not vulnerable.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0226</cvename>
 <freebsdsa>SA-06:05.80211</freebsdsa>
 </references>
 <dates>
 <discovery>2006-01-18</discovery>
 <entry>2006-02-14</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="d7c1d00d-9d2e-11da-8c1d-000e0c2e438a">
 <topic>ipfw -- IP fragment denial of service</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	The firewall maintains a pointer to layer 4 header
	 information in the event that it needs to send a TCP reset
	 or ICMP error message to discard packets. Due to incorrect
	 handling of IP fragments, this pointer fails to get
	 initialized.
	Impact:
	An attacker can cause the firewall to crash by sending ICMP
	 IP fragments to or through firewalls which match any reset,
	 reject or unreach actions.
	Workaround:
	Change any reset, reject or unreach actions to deny. It
	 should be noted that this will result in packets being
	 silently discarded.
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0054</cvename>
 <freebsdsa>SA-06:04.ipfw</freebsdsa>
 </references>
 <dates>
 <discovery>2006-01-11</discovery>
 <entry>2006-02-14</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="1613db79-8e52-11da-8426-000fea0a9611">
 <topic>kpopup -- local root exploit and local denial of service</topic>
 <affects>
 <package>
	<name>kpopup</name>
	<range><ge>0.9.1</ge><le>0.9.5</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mitre CVE reports:
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1170">
	 Format string vulnerability in main.cpp in kpopup
	 0.9.1-0.9.5pre2 allows local users to cause a denial of
	 service (segmentation fault) and possibly execute
	 arbitrary code via format string specifiers in command
	 line arguments.
	</blockquote>
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1167">
	 misc.cpp in KPopup 0.9.1 trusts the PATH variable when
	 executing killall, which allows local users to elevate
	 their privileges by modifying the PATH variable to
	 reference a malicious killall program.
	</blockquote>
	SecurityFocus credits "b0f" b0fnet@yahoo.com
 </body>
 </description>
 <references>
 <cvename>CVE-2003-1170</cvename>
 <bid>8918</bid>
 <cvename>CVE-2003-1167</cvename>
 <bid>8915</bid>
 <url>http://www.securityfocus.com/archive/1/342736</url>
 <url>http://www.henschelsoft.de/kpopup_en.html</url>
 </references>
 <dates>
 <discovery>2003-10-28</discovery>
 <entry>2006-02-07</entry>
 </dates>
 </vuln>

<vuln vid="6b0215ae-8f26-11da-8c1d-000e0c2e438a">
 <topic>cpio -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_2</lt></range>
	<range><ge>5.4</ge><lt>5.4_9</lt></range>
	<range><ge>5.3</ge><lt>5.3_24</lt></range>
	<range><ge>4.11</ge><lt>4.11_14</lt></range>
	<range><ge>4.10</ge><lt>4.10_20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description:
	A number of issues has been discovered in cpio:
	When creating a new file, cpio closes the file before setting
	 its permissions. (CVE-2005-1111)
	When extracting files cpio does not properly sanitize file
	 names to filter out ".." components, even if the
	 --no-absolute-filenames option is used. (CVE-2005-1229)
	When adding large files (larger than 4 GB) to a cpio archive
	 on 64-bit platforms an internal buffer might overflow.
	 (CVE-2005-4268)
	Impact
	The first problem can allow a local attacker to change the
	 permissions of files owned by the user executing cpio providing
	 that they have write access to the directory in which the file
	 is being extracted. (CVE-2005-1111)
	The lack of proper file name sanitation can allow an attacker
	 to overwrite arbitrary local files when extracting files from
	 a cpio archive. (CVE-2005-1229)
	The buffer-overflow on 64-bit platforms could lead cpio to a
	 Denial-of-Service situation (crash) or possibly execute
	 arbitrary code with the permissions of the user running
	 cpio. (CVE-2005-4268)
	Workaround
	Use a different utility to create and extract cpio archives,
	 for example pax(1) or (on FreeBSD 5.3 or later) tar(1). If
	 this is not possible, do not extract untrusted archives and
	 when running on 64-bit platforms do not add untrusted files
	 to cpio archives.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1111</cvename>
 <cvename>CVE-2005-1229</cvename>
 <cvename>CVE-2005-4268</cvename>
 <freebsdsa>SA-06:03.cpio</freebsdsa>
 </references>
 <dates>
 <discovery>2006-01-11</discovery>
 <entry>2006-01-27</entry>
 </dates>
 </vuln>

<vuln vid="726dd9bd-8f25-11da-8c1d-000e0c2e438a">
 <topic>ee -- temporary file privilege escalation</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_2</lt></range>
	<range><ge>5.4</ge><lt>5.4_9</lt></range>
	<range><ge>5.3</ge><lt>5.3_24</lt></range>
	<range><ge>4.11</ge><lt>4.11_14</lt></range>
	<range><ge>4.10</ge><lt>4.10_20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description
	The ispell_op function used by ee(1) while executing spell
	 check operations employs an insecure method of temporary file
	 generation. This method produces predictable file names based
	 on the process ID and fails to confirm which path will be over
	 written with the user. 
	 It should be noted that ispell does not have to be installed
	 in order for this to be exploited. The option simply needs to
	 be selected.
	Impact
	These predictable temporary file names are problematic
	 because they allow an attacker to take advantage of a race
	 condition in order to execute a symlink attack, which could
	 allow them to overwrite files on the system in the context of
	 the user running the ee(1) editor.
	Workaround
	Instead of invoking ispell through ee(1), invoke it directly.
 </body>
 </description>
 <references>
 <bid>16207</bid>
 <cvename>CVE-2006-0055</cvename>
 <freebsdsa>SA-06:02.ee</freebsdsa>
 </references>
 <dates>
 <discovery>2006-01-11</discovery>
 <entry>2006-01-27</entry>
 </dates>
 </vuln>

<vuln vid="c01a25f5-8f20-11da-8c1d-000e0c2e438a">
 <topic>texindex -- temporary file privilege escalation</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_2</lt></range>
	<range><ge>5.4</ge><lt>5.4_9</lt></range>
	<range><ge>5.3</ge><lt>5.3_24</lt></range>
	<range><ge>4.11</ge><lt>4.11_14</lt></range>
	<range><ge>4.10</ge><lt>4.10_20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description
	The "sort_offline" function used by texindex(1) employs the
	 "maketempname" function, which produces predictable file names
	 and fails to validate that the paths do not exist.
	Impact
	These predictable temporary file names are problematic because
	 they allow an attacker to take advantage of a race condition in
	 order to execute a symlink attack, which could enable them to
	 overwrite files on the system in the context of the user running
	 the texindex(1) utility.
	Workaround
	No workaround is available, but the problematic code is only
	 executed if the input file being processed is 500kB or more in
	 length; as a result, users working with documents of less than
	 several hundred pages are very unlikely to be affected.
 </body>
 </description>
 <references>
 <bid>14854</bid>
 <cvename>CAN-2005-3011</cvename>
 <freebsdsa>SA-06:01.texindex</freebsdsa>
 </references>
 <dates>
 <discovery>2006-01-11</discovery>
 <entry>2006-01-27</entry>
 </dates>
 </vuln>

<vuln vid="c5c17ead-8f23-11da-8c1d-000e0c2e438a">
 <topic>cvsbug -- race condition</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_7</lt></range>
	<range><ge>5.3</ge><lt>5.3_22</lt></range>
	<range><ge>4.11</ge><lt>4.11_12</lt></range>
	<range><ge>4.10</ge><lt>4.10_18</lt></range>
 </package>
 <package>
	<name>cvs+ipv6</name>
	<range><lt>1.11.17_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description
	A temporary file is created, used, deleted, and then
	 re-created with the same name. This creates a window during
	 which an attacker could replace the file with a link to
	 another file. While cvsbug(1) is based on the send-pr(1)
	 utility, this problem does not exist in the version of
	 send-pr(1) distributed with FreeBSD. 
	 In FreeBSD 4.10 and 5.3, some additional problems exist
	 concerning temporary file usage in both cvsbug(1) and
	 send-pr(1).
	Impact
	A local attacker could cause data to be written to any file
	 to which the user running cvsbug(1) (or send-pr(1) in FreeBSD
	 4.10 and 5.3) has write access. This may cause damage in
	 itself (e.g., by destroying important system files or
	 documents) or may be used to obtain elevated privileges.
	Workaround
	Do not use the cvsbug(1) utility on any system with untrusted
	 users. 
	 Do not use the send-pr(1) utility on a FreeBSD 4.10 or 5.3
	 system with untrusted users.
 </body>
 </description>
 <references>
 <cvename>CAN-2005-2693</cvename>
 <freebsdsa>SA-05:20.cvsbug</freebsdsa>
 </references>
 <dates>
 <discovery>2005-09-07</discovery>
 <entry>2006-01-27</entry>
 <modified>2006-11-08</modified>
 </dates>
 </vuln>

<vuln vid="57a0242d-8c4e-11da-8ddf-000ae42e9b93">
 <topic>sge -- local root exploit in bundled rsh executable</topic>
 <affects>
 <package>
	<name>sge</name>
	<name>sgeee</name>
	<range><lt>5.3.6.20040330_1</lt></range>
	<range><gt>6.*</gt><lt>6.0.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sun Microsystems reports:
	<blockquote cite="http://gridengine.sunsource.net/project/gridengine/news/SGE60u7_1-announce.html">
	 The SGE 6.0u7_1 release fixes a security bug which can
	 allow malicious users to gain root access.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://gridengine.sunsource.net/project/gridengine/news/SGE60u7_1-announce.html</url>
 </references>
 <dates>
 <discovery>2005-12-23</discovery>
 <entry>2006-01-23</entry>
 </dates>
 </vuln>

<vuln vid="f11d3b22-88c6-11da-a7b2-0060084a00e5">
 <topic>fetchmail -- crash when bouncing a message</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><ge>6.3.0</ge><lt>6.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2006-01.txt">
	 Fetchmail contains a bug that causes itself to crash when
	 bouncing a message to the originator or to the local
	 postmaster. The crash happens after the bounce message has
	 been sent, when fetchmail tries to free the dynamic array
	 of failed addresses, and calls the free() function with an
	 invalid pointer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2006-0321</cvename>
 <url>http://www.fetchmail.info/fetchmail-SA-2006-01.txt</url>
 <url>http://bugs.debian.org/348747</url>
 </references>
 <dates>
 <discovery>2006-01-22</discovery>
 <entry>2006-01-23</entry>
 </dates>
 </vuln>

<vuln vid="612a34ec-81dc-11da-a043-0002a5c3d308">
 <topic>clamav -- possible heap overflow in the UPX code</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.88</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><lt>20060110</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Zero Day Initiative reports:
	<blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-06-001.html">
	 This vulnerability allows remote attackers to execute
	 arbitrary code on vulnerable Clam AntiVirus
	 installations. Authentication is not required to exploit
	 this vulnerability.
	 This specific flaw exists within libclamav/upx.c during
	 the unpacking of executable files compressed with UPX. Due
	 to an invalid size calculation during a data copy from the
	 user-controlled file to heap allocated memory, an
	 exploitable memory corruption condition is created.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>16191</bid>
 <cvename>CVE-2006-0162</cvename>
 <mlist>http://lurker.clamav.net/message/20060109.213247.a16ae8db.en.html</mlist>
 <url>http://www.zerodayinitiative.com/advisories/ZDI-06-001.html</url>
 <url>http://secunia.com/advisories/18379/</url>
 </references>
 <dates>
 <discovery>2006-01-09</discovery>
 <entry>2006-01-10</entry>
 <modified>2006-01-15</modified>
 </dates>
 </vuln>

<vuln vid="6d9a28f8-8152-11da-817c-0001020eed82">
 <topic>milter-bogom -- headerless message crash</topic>
 <affects>
 <package>
	<name>milter-bogom</name>
	<range><lt>1.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Juan J. Marítnez reports:
	<blockquote cite="http://www.usebox.net/jjm/bogom/errata/bogom-errata-2006-1.txt">
	 The milter crashes while processing a headerless
	 message
	 Impact: bogom crashes and sendmail moves it to error
	 state
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.usebox.net/jjm/bogom/errata/bogom-errata-2006-1.txt</url>
 <mlist>http://alf.dyndns.ws/pipermail/milter/2006-January/000076.html</mlist>
 </references>
 <dates>
 <discovery>2006-01-05</discovery>
 <entry>2006-01-09</entry>
 </dates>
 </vuln>

<vuln vid="b747b2a9-7be0-11da-8ec4-0002b3b60e4c">
 <topic>bogofilter -- heap corruption through excessively long words</topic>
 <affects>
 <package>
	<name>bogofilter</name>
	<range><ge>0.96.2</ge><lt>0.96.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-02">
	 Bogofilter's/bogolexer's input handling in version 0.96.2 was not
	 keeping track of its output buffers properly and could overrun a
	 heap buffer if the input contained words whose length exceeded
	 16,384 bytes, the size of flex's input buffer. A "word" here refers
	 to a contiguous run of input octets that was not '_' and did not
	 match at least one of ispunct(), iscntrl() or isspace().
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-4592</cvename>
 <url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-02</url>
 </references>
 <dates>
 <discovery>2005-10-23</discovery>
 <entry>2006-01-07</entry>
 </dates>
 </vuln>

<vuln vid="92140bc9-7bde-11da-8ec4-0002b3b60e4c">
 <topic>bogofilter -- heap corruption through malformed input</topic>
 <affects>
 <package>
	<name>bogofilter</name>
	<range><ge>0.93.5</ge><lt>0.96.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-01">
	 When using Unicode databases (default in more recent bogofilter
	 installations), upon encountering invalid input sequences,
	 bogofilter or bogolexer could overrun a malloc()'d buffer,
	 corrupting the heap, while converting character sets. Bogofilter
	 would usually be processing untrusted data received from the
	 network at that time.

This problem was aggravated by an unrelated bug that made
	 bogofilter process binary attachments as though they were text, and
	 attempt charset conversion on them. Given the MIME default
	 character set, US-ASCII, all input octets in the range 0x80...0xff
	 were considered invalid input sequences and could trigger the heap
	 corruption.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-4591</cvename>
 <url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-01</url>
 </references>
 <dates>
 <discovery>2005-10-22</discovery>
 <entry>2006-01-07</entry>
 </dates>
 </vuln>

<vuln vid="c2fdb3bc-7d72-11da-b96e-000fb586ba73">
 <topic>rxvt-unicode -- restore permissions on tty devices</topic>
 <affects>
 <package>
	<name>rxvt-unicode</name>
	<range><lt>6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A rxvt-unicode changelog reports:
	<blockquote cite="http://dist.schmorp.de/rxvt-unicode/Changes">
	 SECURITY FIX: on systems using openpty, permissions were
	 not correctly updated on the tty device and were left as
	 world-readable and world-writable (likely in original rxvt,
	 too), and were not restored properly. Affected are only
	 systems where non-unix ptys were used (such as most BSDs).
	 Found, patched and debugged by Ryan Beasley.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://dist.schmorp.de/rxvt-unicode/Changes</url>
 </references>
 <dates>
 <discovery>2005-12-31</discovery>
 <entry>2006-01-04</entry>
 </dates>
 </vuln>

<vuln vid="9fff8dc8-7aa7-11da-bf72-00123f589060">
 <topic>apache -- mod_imap cross-site scripting flaw</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><ge>1.3</ge><lt>1.3.34_3</lt></range>
	<range><ge>2.0.35</ge><lt>2.0.55_2</lt></range>
	<range><ge>2.1</ge><lt>2.1.9_3</lt></range>
	<range><ge>2.2</ge><lt>2.2.0_3</lt></range>
 </package>
 <package>
	<name>apache+mod_perl</name>
	<range><lt>1.3.34_1</lt></range>
 </package>
 <package>
	<name>apache_fp</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>apache+ipv6</name>
	<range><lt>1.3.37</lt></range>
 </package>
 <package>
	<name>ru-apache</name>
	<range><lt>1.3.34+30.22_1</lt></range>
 </package>
 <package>
	<name>ru-apache+mod_ssl</name>
	<range><lt>1.3.34+30.22+2.8.25_1</lt></range>
 </package>
 <package>
	<name>apache+ssl</name>
	<range><ge>1.3.0</ge><lt>1.3.33.1.55_2</lt></range>
 </package>
 <package>
	<name>apache+mod_ssl</name>
	<name>apache+mod_ssl+ipv6</name>
	<name>apache+mod_ssl+mod_accel</name>
	<name>apache+mod_ssl+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_deflate</name>
	<name>apache+mod_ssl+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
	<range><lt>1.3.34+2.8.25_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache HTTP Server Project reports:
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_13.html">
	 A flaw in mod_imap when using the Referer directive with
	 image maps. In certain site configurations a remote
	 attacker could perform a cross-site scripting attack if a
	 victim can be forced to visit a malicious URL using
	 certain web browsers.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-3352</cvename>
 <bid>15834</bid>
 <url>http://www.apacheweek.com/features/security-13</url>
 <url>http://www.apacheweek.com/features/security-20</url>
 </references>
 <dates>
 <discovery>2005-11-01</discovery>
 <entry>2006-01-01</entry>
 <modified>2009-01-23</modified>
 </dates>
 </vuln>

<vuln vid="8db2f8b2-9e12-11ea-9e83-0cc47ac16c9d">
 <topic>qmail -- 64 bit integer overflows with possible remote code execution on large SMTP requests</topic>
 <affects>
 <package>
	<name>netqmail</name>
	<range><le>1.06_4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Georgi Guninski writes:
	<blockquote cite="http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html">
	 There are several issues with qmail on 64 bit platforms - classical integer overflow, pointer with signed index and signedness problem (not counting the memory consumtion dos, which just helps).
	 Update: the problem with the signed index is exploitable on Freebsd 5.4 amd64 wih a lot of virtual memory.
	</blockquote>
	The national vulnerability database summarizes:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2005-1513">
	 Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html</url>
 <url>https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-execution-qmail.txt</url>
 <cvename>CVE-2005-1513</cvename>
 <cvename>CVE-2005-1514</cvename>
 <cvename>CVE-2005-1515</cvename>
 </references>
 <dates>
 <discovery>2005-05-06</discovery>
 <entry>2005-05-11</entry>
 </dates>
 </vuln>

<vuln vid="b495af21-9e10-11ea-9e83-0cc47ac16c9d">
 <topic>qmail -- 64 bit integer overflows with possible remote code execution on large SMTP requests</topic>
 <affects>
 <package>
	<name>netqmail-tls</name>
	<range><le>1.06.20160918_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Georgi Guninski writes:
	<blockquote cite="http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html">
	 There are several issues with qmail on 64 bit platforms - classical integer overflow, pointer with signed index and signedness problem (not counting the memory consumtion dos, which just helps).
	 Update: the problem with the signed index is exploitable on Freebsd 5.4 amd64 wih a lot of virtual memory.
	</blockquote>
	The national vulnerability database summarizes:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2005-1513">
	 Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html</url>
 <url>https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-execution-qmail.txt</url>
 <cvename>CVE-2005-1513</cvename>
 <cvename>CVE-2005-1514</cvename>
 <cvename>CVE-2005-1515</cvename>
 </references>
 <dates>
 <discovery>2005-05-06</discovery>
 <entry>2005-05-11</entry>
 </dates>
 </vuln>

<vuln vid="d6540411-9e10-11ea-9e83-0cc47ac16c9d">
 <topic>qmail -- 64 bit integer overflows with possible remote code execution on large SMTP requests</topic>
 <affects>
 <package>
	<name>netqmail-mysql</name>
	<range><le>1.06.1.1.15_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Georgi Guninski writes:
	<blockquote cite="http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html">
	 There are several issues with qmail on 64 bit platforms - classical integer overflow, pointer with signed index and signedness problem (not counting the memory consumtion dos, which just helps).
	 Update: the problem with the signed index is exploitable on Freebsd 5.4 amd64 wih a lot of virtual memory.
	</blockquote>
	The national vulnerability database summarizes:
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2005-1513">
	 Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html</url>
 <url>https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-execution-qmail.txt</url>
 <cvename>CVE-2005-1513</cvename>
 <cvename>CVE-2005-1514</cvename>
 <cvename>CVE-2005-1515</cvename>
 </references>
 <dates>
 <discovery>2005-05-06</discovery>
 <entry>2005-05-11</entry>
 </dates>
 </vuln>

<vuln vid="43770b1c-72f6-11da-8c1d-000e0c2e438a">
 <topic>nbd-server -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>nbd-server</name>
	<range><lt>2.8.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kurt Fitzner reports a buffer overflow vulnerability
	 within nbd. This could potentially allow the execution
	 of arbitrary code on the nbd server.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-3534</cvename>
 <url>http://www.debian.org/security/2005/dsa-924</url>
 </references>
 <dates>
 <discovery>2005-12-21</discovery>
 <entry>2005-12-22</entry>
 <modified>2005-12-25</modified>
 </dates>
 </vuln>

<vuln vid="b5a49db7-72fc-11da-9827-021106004fd6">
 <topic>scponly -- local privilege escalation exploits</topic>
 <affects>
	<package>
	 <name>scponly</name>
	 <range><lt>4.2</lt></range>
	</package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Max Vozeler reports:
	<blockquote cite="https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html">
	 If ALL the following conditions are true, administrators using
	 scponly-4.1 or older may be at risk of a local privilege
	 escalation exploit:
	 <ul>
	 <li>the chrooted setuid scponlyc binary is installed</li>
	 <li>regular non-scponly users have interactive shell access
	 to the box</li>
	 <li>a user executable dynamically linked setuid binary
	 (such as ping) exists on the same file system mount
	 as the user's home directory</li>
	 <li>the operating system supports an LD_PRELOAD style
	 mechanism to overload dynamic library loading</li>
	 </ul>
	</blockquote>
	Pekka Pessi also reports:
	<blockquote cite="https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html">
	 If ANY the following conditions are true, administrators
	 using scponly-4.1 or older may be at risk of a local privilege
	 escalation exploit:
	 <ul>
	 <li>scp compatibility is enabled</li>
	 <li>rsync compatibility is enabled</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html</url>
 <url>http://sublimation.org/scponly/#relnotes</url>
 </references>
 <dates>
 <discovery>2005-12-21</discovery>
 <entry>2005-12-22</entry>
 </dates>
 </vuln>

<vuln vid="f7eb0b23-7099-11da-a15c-0060084a00e5">
 <topic>fetchmail -- null pointer dereference in multidrop mode with headerless email</topic>
 <affects>
	<package>
	 <name>fetchmail</name>
	 <range><lt>6.3.1</lt></range>
	</package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The fetchmail team reports:
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2005-03.txt">
	 Fetchmail contains a bug that causes an application crash
	 when fetchmail is configured for multidrop mode and the
	 upstream mail server sends a message without headers. As
	 fetchmail does not record this message as "previously fetched",
	 it will crash with the same message if it is re-executed, so it
	 cannot make progress. A malicious or broken-into upstream server
	 could thus cause a denial of service in fetchmail clients.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-4348</cvename>
 <url>http://www.fetchmail.info/fetchmail-SA-2005-03.txt</url>
 <url>http://article.gmane.org/gmane.mail.fetchmail.user/7573</url>
 <url>http://bugs.debian.org/343836</url>
 </references>
 <dates>
 <discovery>2005-12-19</discovery>
 <entry>2005-12-19</entry>
 </dates>
 </vuln>

<vuln vid="82a41084-6ce7-11da-b90c-000e0c2e438a">
 <topic>mantis -- "t_core_path" file inclusion vulnerability</topic>
 <affects>
 <package>
	<name>mantis</name>
	<range><lt>1.0.0rc3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia Research reports:
	<blockquote cite="http://secunia.com/secunia_research/2005-46/advisory/">
	 Input passed to the "t_core_path" parameter in
	 "bug_sponsorship_list_view_inc.php" isn't properly verified,
	 before it used to include files. This can be exploited to
	 include arbitrary files from external and local
	 resources.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-3335</cvename>
 <url>http://secunia.com/secunia_research/2005-46/advisory/</url>
 </references>
 <dates>
 <discovery>2005-10-26</discovery>
 <entry>2005-12-14</entry>
 </dates>
 </vuln>

<vuln vid="6e3b12e2-6ce3-11da-b90c-000e0c2e438a">
 <topic>mantis -- "view_filters_page.php" cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>mantis</name>
	<range><lt>1.0.0rc4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	r0t reports:
	<blockquote cite="http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html">
	 Mantis contains a flaw that allows a remote cross site
	 scripting attack. This flaw exists because input passed to
	 "target_field" parameter in "view_filters_page.php" isn't
	 properly sanitised before being returned to the user. This
	 could allow a user to create a specially crafted URL that
	 would execute arbitrary code in a user's browser within the
	 trust relationship between the browser and the server,
	 leading to a loss of integrity.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>15842</bid>
 <url>http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html</url>
 </references>
 <dates>
 <discovery>2005-12-13</discovery>
 <entry>2005-12-14</entry>
 </dates>
 </vuln>

<vuln vid="2506f558-6a8a-11da-b96e-000fb586ba73">
 <topic>mnemo -- Cross site scripting vulnerabilities in several of the notepad name and note data fields</topic>
 <affects>
 <package>
	<name>mnemo</name>
	<range><lt>2.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Announce of Mnemo H3 (2.0.3) (final):
	<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433279228172&amp;w=2">
	 This [2.0.3] is a security release that fixes cross site
	 scripting vulnerabilities in several of the notepad name
	 and note data fields. None of the vulnerabilities can be
	 exploited by unauthenticated users; however, we strongly
	 recommend that all users of Mnemo 2.0.2 upgrade to 2.0.3
	 as soon as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433279228172&amp;w=2</url>
 </references>
 <dates>
 <discovery>2005-12-11</discovery>
 <entry>2005-12-11</entry>
 </dates>
 </vuln>

<vuln vid="ee6b5956-6a89-11da-b96e-000fb586ba73">
 <topic>nag -- Cross site scripting vulnerabilities in several of the tasklist name and task data fields</topic>
 <affects>
 <package>
	<name>nag</name>
	<range><lt>2.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Announce of Nag H3 (2.0.4) (final):
	<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433205826731&amp;w=2">
	 This [2.0.4] is a security release that fixes cross site
	 scripting vulnerabilities in several of the tasklist name
	 and task data fields. None of the vulnerabilities can be
	 exploited by unauthenticated users; however, we strongly
	 recommend that all users of Nag 2.0.3 upgrade to 2.0.4 as
	 soon as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433205826731&amp;w=2</url>
 </references>
 <dates>
 <discovery>2005-12-11</discovery>
 <entry>2005-12-11</entry>
 </dates>
 </vuln>

<vuln vid="eeebd55d-6a88-11da-b96e-000fb586ba73">
 <topic>turba -- Cross site scripting vulnerabilities in several of the address book name and contact data fields</topic>
 <affects>
 <package>
	<name>turba</name>
	<range><lt>2.0.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Announce of Turba H3 (2.0.5) (final):
	<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433120829232&amp;w=2">
	 This [2.0.5] is a security release that fixes cross site
	 scripting vulnerabilities in several of the address book
	 name and contact data fields. None of the vulnerabilities
	 can be exploited by unauthenticated users; however, we
	 strongly recommend that all users of Turba 2.0.4 upgrade
	 to 2.0.5 as soon as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433120829232&amp;w=2</url>
 </references>
 <dates>
 <discovery>2005-12-11</discovery>
 <entry>2005-12-11</entry>
 </dates>
 </vuln>

<vuln vid="36494478-6a88-11da-b96e-000fb586ba73">
 <topic>kronolith -- Cross site scripting vulnerabilities in several of the calendar name and event data fields</topic>
 <affects>
 <package>
	<name>kronolith</name>
	<range><lt>2.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Announce of Kronolith H3 (2.0.6) (final):
	<blockquote cite="http://marc.theaimsgroup.com/?l=kronolith&amp;m=113433029822279&amp;w=2">
	 This [2.0.6] is a security release that fixes cross site
	 scripting vulnerabilities in several of the calendar name
	 and event data fields. None of the vulnerabilities can be
	 exploited by unauthenticated users; however, we strongly
	 recommend that all users of Kronolith 2.0.5 upgrade to
	 2.0.6 as soon as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://marc.theaimsgroup.com/?l=kronolith&amp;m=113433029822279&amp;w=2</url>
 </references>
 <dates>
 <discovery>2005-12-11</discovery>
 <entry>2005-12-11</entry>
 </dates>
 </vuln>

<vuln vid="01356ccc-6a87-11da-b96e-000fb586ba73">
 <topic>horde -- Cross site scripting vulnerabilities in several of Horde's templates</topic>
 <affects>
 <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><lt>3.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Announce of Horde H3 3.0.8 (final):
	<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433346726097&amp;w=2">
	 This [3.0.8] is a security release that fixes cross site
	 scripting vulnerabilities in several of Horde's templates.
	 None of the vulnerabilities can be exploited by
	 unauthenticated users; however, we strongly recommend that
	 all users of Horde 3.0.7 upgrade to 3.0.8 as soon as
	 possible.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433346726097&amp;w=2</url>
 </references>
 <dates>
 <discovery>2005-12-11</discovery>
 <entry>2005-12-11</entry>
 </dates>
 </vuln>

<vuln vid="9b4facec-6761-11da-99f6-00123ffe8333">
 <topic>curl -- URL buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><ge>7.11.2</ge><lt>7.15.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Project cURL Security Advisory reports:
	<blockquote cite="http://curl.haxx.se/docs/adv_20051207.html">
	 libcurl's URL parser function can overflow a malloced
	 buffer in two ways, if given a too long URL.
	 1 - pass in a URL with no protocol (like "http://")
	 prefix, using no slash and the string is 256 bytes or
	 longer. This leads to a single zero byte overflow of the
	 malloced buffer.
	 2 - pass in a URL with only a question mark as separator
	 (no slash) between the host and the query part of the URL.
	 This leads to a single zero byte overflow of the malloced
	 buffer.
	 Both overflows can be made with the same input string,
	 leading to two single zero byte overwrites.
	 The affected flaw cannot be triggered by a redirect, but
	 the long URL must be passed in "directly" to libcurl. It
	 makes this a "local" problem. Of course, lots of programs
	 may still pass in user-provided URLs to libcurl without doing
	 much syntax checking of their own, allowing a user to exploit
	 this vulnerability.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>15756</bid>
 <cvename>CVE-2005-4077</cvename>
 <url>http://curl.haxx.se/docs/adv_20051207.html</url>
 <url>http://www.hardened-php.net/advisory_242005.109.html</url>
 <url>http://secunia.com/advisories/17907/</url>
 </references>
 <dates>
 <discovery>2005-12-07</discovery>
 <entry>2005-12-09</entry>
 <modified>2006-01-01</modified>
 </dates>
 </vuln>

<vuln vid="23afd91f-676b-11da-99f6-00123ffe8333">
 <topic>phpmyadmin -- register_globals emulation "import_blacklist" manipulation</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.7.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/17925/">
	 Stefan Esser has reported a vulnerability in phpMyAdmin,
	 which can be exploited by malicious people to conduct
	 cross-site scripting attacks, disclose sensitive
	 information, and compromise a vulnerable system.
	 The vulnerability is caused due to an error in the
	 register_globals emulation layer in "grab_globals.php"
	 where the "import_blacklist" variable is not properly
	 protected from being overwritten. This can be exploited
	 to execute arbitrary HTML and script code in a user's
	 browser session in context of an affected site, and
	 include arbitrary files from external and local resources.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9</url>
 <url>http://www.hardened-php.net/advisory_252005.110.html</url>
 <url>http://secunia.com/advisories/17925/</url>
 </references>
 <dates>
 <discovery>2005-12-07</discovery>
 <entry>2005-12-07</entry>
 </dates>
 </vuln>

<vuln vid="59ada6e5-676a-11da-99f6-00123ffe8333">
 <topic>phpmyadmin -- XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A phpMyAdmin security advisory reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8">
	 It was possible to conduct an XSS attack via the
	 HTTP_HOST variable; also, some scripts in the libraries
	 directory that handle header generation were vulnerable
	 to XSS.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-3665</cvename>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8</url>
 <url>http://secunia.com/advisories/17895/</url>
 </references>
 <dates>
 <discovery>2005-12-05</discovery>
 <entry>2005-12-07</entry>
 </dates>
 </vuln>

<vuln vid="964161cd-6715-11da-99f6-00123ffe8333">
 <topic>ffmpeg -- libavcodec buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>ffmpeg</name>
	<range><lt>0.4.9.p1_4</lt></range>
 </package>
 <package>
	<name>ffmpeg-devel</name>
	<range><lt>0.4.9.c.2005120600</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/17892/">
	 Simon Kilvington has reported a vulnerability in
	 FFmpeg libavcodec, which can be exploited by malicious
	 people to cause a DoS (Denial of Service) and
	 potentially to compromise a user's system.
	 The vulnerability is caused due to a boundary error
	 in the "avcodec_default_get_buffer()" function of
	 "utils.c" in libavcodec. This can be exploited to
	 cause a heap-based buffer overflow when a
	 specially-crafted 1x1 ".png" file containing a palette
	 is read.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://article.gmane.org/gmane.comp.video.ffmpeg.devel/26558</url>
 <url>http://secunia.com/advisories/17892/</url>
 </references>
 <dates>
 <discovery>2005-11-30</discovery>
 <entry>2005-12-07</entry>
 </dates>
 </vuln>

<vuln vid="7289187b-66a5-11da-99f6-00123ffe8333">
 <topic>trac -- search module SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>trac</name>
	<range><lt>0.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/17894/">
	 A vulnerability has been reported in Trac, which
	 can be exploited by malicious people to conduct SQL
	 injection attacks.
	 Some unspecified input passed in the search module
	 isn't properly sanitised before being used in a SQL
	 query. This can be exploited to manipulate SQL
	 queries by injecting arbitrary SQL code.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://projects.edgewall.com/trac/wiki/ChangeLog#a0.9.2</url>
 <url>http://secunia.com/advisories/17894/</url>
 </references>
 <dates>
 <discovery>2005-12-05</discovery>
 <entry>2005-12-07</entry>
 </dates>
 </vuln>

<vuln vid="faca0843-6281-11da-8630-00123ffe8333">
 <topic>drupal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal</name>
	<range><lt>4.6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/17824/">
	 Some vulnerabilities have been reported in Drupal,
	 which can be exploited by malicious people to bypass
	 certain security restrictions, and conduct script
	 insertion and HTTP response splitting attacks.
	 1) An input validation error in the filtering of
	 HTML code can be exploited to inject arbitrary
	 JavaScript code in submitted content, which will be
	 executed in a user's browser session in context of
	 an affected site when the malicious user data is
	 viewed.
	 Successful exploitation requires that the user has
	 access to the full HTML input format.
	 Ref: sa-2005-007
	 2) An input validation error in the attachment
	 handling can be exploited to upload a malicious
	 image with embedded HTML and script content, which
	 will be executed in a user's browser session in
	 context of an affected site when viewed directly with
	 the Microsoft Internet Explorer browser.
	 This can also be exploited to inject arbitrary HTTP
	 headers, which will be included in the response sent
	 to the user.
	 Ref: sa-2005-008
	 3) The problem is that it is possible to bypass the
	 "access user profile" permission. However, this cannot
	 be exploited to modify data.
	 Successful exploitation requires that the server runs
	 PHP 5.
	 Ref: sa-2005-009
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://drupal.org/files/sa-2005-007/advisory.txt</url>
 <url>http://drupal.org/files/sa-2005-008/advisory.txt</url>
 <url>http://drupal.org/files/sa-2005-009/advisory.txt</url>
 <url>http://secunia.com/advisories/17824/</url>
 </references>
 <dates>
 <discovery>2005-12-01</discovery>
 <entry>2005-12-01</entry>
 </dates>
 </vuln>

<vuln vid="d6b092bd-61e1-11da-b64c-0001020eed82">
 <topic>opera -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><lt>8.51</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Opera reports:
	<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=819">
	 It is possible to make a form input that looks like an
	 image link. If the form input has a "title" attribute, the
	 status bar will show the "title". A "title" which looks
	 like a URL can mislead the user, since the title can say
	 http://nice.familiar.com/, while the form action can be
	 something else.
	 Opera's tooltip says "Title:" before the title text,
	 making a spoof URL less convincing. A user who has enabled
	 the status bar and disabled tooltips can be affected by
	 this. Neither of these settings are Opera's defaults.
	 This exploit is mostly of interest to users who disable
	 JavaScript. If JavaScript is enabled, any link target or
	 form action can be overridden by the script. The tooltip
	 and the statusbar can only be trusted to show the true
	 location if JavaScript is disabled.
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=817">
	 Java code using LiveConnect methods to remove a property
	 of a JavaScript object may in some cases use null pointers
	 that can make Opera crash. This crash is not exploitable
	 and such code is rare on the web.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-3699</cvename>
 <url>http://secunia.com/advisories/17571/</url>
 <url>http://www.opera.com/support/search/supsearch.dml?index=817</url>
 <url>http://www.opera.com/support/search/supsearch.dml?index=819</url>
 </references>
 <dates>
 <discovery>2005-11-16</discovery>
 <entry>2005-11-30</entry>
 </dates>
 </vuln>

<vuln vid="dfc1daa8-61de-11da-b64c-0001020eed82">
 <topic>opera -- command line URL shell command injection</topic>
 <affects>
 <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><lt>8.51</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An Opera Advisory reports:
	<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=818">
	 Opera for UNIX uses a wrapper shell script to start up
	 Opera. This shell script reads the input arguments, like
	 the file names or URLs that Opera is to open. It also
	 performs some environment checks, for example whether Java
	 is available and if so, where it is located.
	 This wrapper script can also run commands embedded in the
	 URL, so that a specially crafted URL can make arbitrary
	 commands run on the recipient's machine. Users who have
	 other programs set up to use Opera to open Web links are
	 vulnerable to this flaw. For these users, clicking a Web
	 link in for example OpenOffice.org or Evolution can run a
	 command that was put into the link.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>15521</bid>
 <cvename>CVE-2005-3750</cvename>
 <url>http://secunia.com/secunia_research/2005-57/advisory/</url>
 <url>http://www.opera.com/support/search/supsearch.dml?index=818</url>
 </references>
 <dates>
 <discovery>2005-11-17</discovery>
 <entry>2005-11-30</entry>
 </dates>
 </vuln>

<vuln vid="ffb82d3a-610f-11da-8823-00123ffe8333">
 <topic>mambo -- "register_globals" emulation layer overwrite vulnerability</topic>
 <affects>
 <package>
	<name>mambo</name>
	<range><lt>4.5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/17622/">
	 peter MC tachatte has discovered a vulnerability in Mambo,
	 which can be exploited by malicious people to manipulate
	 certain information and compromise a vulnerable system.
	 The vulnerability is caused due to an error in the
	 "register_globals" emulation layer in "globals.php" where
	 certain arrays used by the system can be overwritten. This
	 can be exploited to include arbitrary files from external
	 and local resources via the "mosConfig_absolute_path" parameter.
	 Successful exploitation requires that "register_globals"
	 is disabled.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.mamboserver.com/index.php?option=com_content&amp;task=view&amp;id=172&amp;Itemid=1</url>
 <url>http://secunia.com/advisories/17622/</url>
 </references>
 <dates>
 <discovery>2005-11-17</discovery>
 <entry>2005-11-30</entry>
 </dates>
 </vuln>

<vuln vid="27a70a01-5f6c-11da-8d54-000cf18bbe54">
 <topic>ghostscript -- insecure temporary file creation vulnerability</topic>
 <affects>
 <package>
	<name>ghostscript-gnu</name>
	<name>ghostscript-gnu-nox11</name>
	<range><lt>7.07_14</lt></range>
 </package>
 <package>
	<name>ghostscript-afpl</name>
	<name>ghostscript-afpl-nox11</name>
	<range><lt>8.53_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.securityfocus.com/bid/11285/discuss">
	 Ghostscript is affected by an insecure temporary file
	 creation vulnerability. This issue is likely due
	 to a design error that causes the application to fail
	 to verify the existence of a file before writing to it.

An attacker may leverage this issue to overwrite
	 arbitrary files with the privileges of an unsuspecting
	 user that activates the vulnerable application.
	 Reportedly this issue is unlikely to facilitate
	 privilege escalation.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>11285</bid>
 <cvename>CVE-2004-0967</cvename>
 </references>
 <dates>
 <discovery>2004-10-19</discovery>
 <entry>2005-11-27</entry>
 </dates>
 </vuln>

<vuln vid="873a6542-5b8d-11da-b96e-000fb586ba73">
 <topic>horde -- Cross site scripting vulnerabilities in MIME viewers</topic>
 <affects>
 <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><lt>3.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Announce of Horde 3.0.7 (final):
	<blockquote cite="http://lists.horde.org/archives/announce/2005/000232.html">
	 This [3.0.7] is a security release that fixes cross site
	 scripting vulnerabilities in two of Horde's MIME viewers. These
	 holes could for example be exploited by an attacker sending
	 specially crafted emails to Horde's webmail client IMP. The
	 attack could be used to steal users' identity information, taking
	 over users' sessions, or changing users' settings.
	 As a hotfix the css and tgz MIME drivers can be disabled by
	 removing their entries from the
	 $mime_drivers_map['horde']['registered'] list in
	 horde/config/mime_drivers.php.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>15535</bid>
 <cvename>CVE-2005-3759</cvename>
 <url>http://lists.horde.org/archives/announce/2005/000232.html</url>
 </references>
 <dates>
 <discovery>2005-11-22</discovery>
 <entry>2005-11-22</entry>
 <modified>2005-11-26</modified>
 </dates>
 </vuln>

<vuln vid="c55f9ed0-56a7-11da-a3f0-00123ffe8333">
 <topic>phpmyadmin -- HTTP Response Splitting vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.6.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A phpMyAdmin security advisory reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6">
	 Some scripts in phpMyAdmin are vulnerable to an
	 HTTP Response Splitting attack.
	 Severity:
	 We consider these vulnerabilities to be serious.
	 However, they can only be triggered on systems running
	 with register_globals = on.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6</url>
 <url>http://secunia.com/advisories/17578/</url>
 <url>http://www.fitsec.com/advisories/FS-05-02.txt</url>
 </references>
 <dates>
 <discovery>2005-11-15</discovery>
 <entry>2005-11-16</entry>
 </dates>
 </vuln>

<vuln vid="9c1cea79-548a-11da-b53f-0004614cc33d">
 <topic>phpSysInfo -- "register_globals" emulation layer overwrite vulnerability</topic>
 <affects>
 <package>
	<name>phpSysInfo</name>
	<range><lt>2.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/17441/">
	 Christopher Kunz has reported a vulnerability in
	 phpSysInfo, which can be exploited by malicious people
	 to manipulate certain information.
	 The vulnerability is caused due to an error in
	 the "register_globals" emulation layer where certain
	 arrays used by the system can be overwritten. This can be
	 exploited to execute arbitrary HTML and script code in
	 a user's browser session and include arbitrary files from
	 local resources.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.hardened-php.net/advisory_222005.81.html</url>
 <url>http://secunia.com/advisories/17441/</url>
 </references>
 <dates>
 <discovery>2005-11-10</discovery>
 <entry>2005-11-13</entry>
 <modified>2005-12-25</modified>
 </dates>
 </vuln>

<vuln vid="aed343b4-5480-11da-b579-001125afbed7">
 <topic>Macromedia flash player -- swf file handling arbitrary code</topic>
 <affects>
 <package>
	<name>linux-flashplugin6</name>
	<range><le>6.0r79_3</le></range>
 </package>
 <package>
	<name>linux-flashplugin7</name>
	<range><lt>7.0r61</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/17430/">
	 A vulnerability has been reported in Macromedia
	 Flash Player, which can be exploited by malicious
	 people to compromise a user's system.
	 The vulnerability is caused due to missing validation
	 of the frame type identifier that is read from
	 a SWF file. This value is used as an index in Flash.ocx
	 to reference an array of function pointers. This can be
	 exploited via a specially crafted SWF file to cause
	 the index to reference memory that is under the attacker's
	 control, which causes Flash Player to use attacker
	 supplied values as function pointers.
	 Successful exploitation allows execution of arbitrary
	 code.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.macromedia.com/devnet/security/security_zone/mpsb05-07.html</url>
 <url>http://secunia.com/advisories/17430/</url>
 <url>http://www.eeye.com/html/research/advisories/AD20051104.html</url>
 </references>
 <dates>
 <discovery>2005-06-27</discovery>
 <entry>2005-11-13</entry>
 </dates>
 </vuln>

<vuln vid="f4b95430-51d8-11da-8e93-0010dc4afb40">
 <topic>flyspray -- cross-site scripting vulnerabilities</topic>
 <affects>
 <package>
	<name>flyspray</name>
	<range><lt>0.9.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/17316/">
	 Lostmon has reported some vulnerabilities in Flyspray,
	 which can be exploited by malicious people to conduct
	 cross-site scripting attacks.
	 Some input isn't properly sanitised before being
	 returned to the user. This can be exploited to execute
	 arbitrary HTML and script code in a user's browser
	 session in context of an affected site.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>15209</bid>
 <url>http://secunia.com/advisories/17316/</url>
 <url>http://lostmon.blogspot.com/2005/10/flyspray-bug-killer-multiple-variable.html</url>
 </references>
 <dates>
 <discovery>2005-10-26</discovery>
 <entry>2005-11-10</entry>
 <modified>2005-11-29</modified>
 </dates>
 </vuln>

<vuln vid="7f3fdef7-51d2-11da-8e93-0010dc4afb40">
 <topic>p5-Mail-SpamAssassin -- long message header denial of service</topic>
 <affects>
 <package>
	<name>p5-Mail-SpamAssassin</name>
	<range><lt>3.1.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/17386/">
	 A vulnerability has been reported in SpamAssassin,
	 which can be exploited by malicious people to cause
	 a DoS (Denial of Service).
	 The vulnerability is caused due to the use of
	 an inefficient regular expression in
	 "/SpamAssassin/Message.pm" to parse email headers.
	 This can cause perl to crash when it runs out of stack
	 space and can be exploited via a malicious email that
	 contains a large number of recipients.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/17386/</url>
 <url>http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4570</url>
 </references>
 <dates>
 <discovery>2005-11-10</discovery>
 <entry>2005-11-10</entry>
 </dates>
 </vuln>

<vuln vid="eb29a575-3381-11da-8340-000e0c2e438a">
 <topic>qpopper -- multiple privilege escalation vulnerabilities</topic>
 <affects>
 <package>
	<name>qpopper</name>
	<range><ge>4.0</ge><le>4.0.5</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jens Steube reports that qpopper is vulnerable to a privilege
	 escalation vulnerability. qpopper does not properly drop root
	 privileges so that user supplied configuration and trace files
	 can be processed with root privileges. This could allow a
	 local attacker to create or modify arbitrary files.
	qpopper is also affected by improper umask settings
	 which could allow users to create group or world-writeable
	 files, possibly allowing an attacker to overwrite arbitrary
	 files.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1151</cvename>
 <cvename>CVE-2005-1152</cvename>
 <url>http://secunia.com/advisories/15475/</url>
 </references>
 <dates>
 <discovery>2005-05-26</discovery>
 <entry>2005-11-07</entry>
 <modified>2005-11-26</modified>
 </dates>
 </vuln>

<vuln vid="44e5f5bd-4d76-11da-bf37-000fb586ba73">
 <topic>pear-PEAR -- PEAR installer arbitrary code execution vulnerability</topic>
 <affects>
 <package>
	<name>pear-PEAR</name>
	<range><lt>1.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gregory Beaver reports:
	<blockquote cite="http://pear.php.net/advisory-20051104.txt">
	 A standard feature of the PEAR installer implemented in
	 all versions of PEAR can lead to the execution of
	 arbitrary PHP code upon running the "pear" command
	 or loading the Web/Gtk frontend.
	 To be vulnerable, a user must explicitly install a
	 publicly released malicious package using the PEAR
	 installer, or explicitly install a package that depends on
	 a malicious package.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://pear.php.net/advisory-20051104.txt</url>
 </references>
 <dates>
 <discovery>2005-11-01</discovery>
 <entry>2005-11-04</entry>
 </dates>
 </vuln>

<vuln vid="3de49331-0dec-422c-93e5-e4719e9869c5">
 <topic>openvpn -- potential denial-of-service on servers in TCP mode</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><ge>2.0</ge><lt>2.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	James Yonan reports:
	<blockquote cite="http://openvpn.net/changelog.html">
	 If the TCP server accept() call returns an error status, the
	 resulting exception handler may attempt to indirect through a NULL
	 pointer, causing a segfault. Affects all OpenVPN 2.0 versions.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-3409</cvename>
 <url>http://openvpn.net/changelog.html</url>
 </references>
 <dates>
 <discovery>2005-11-01</discovery>
 <entry>2005-11-01</entry>
 <modified>2005-11-04</modified>
 </dates>
 </vuln>

<vuln vid="6129fdc7-6462-456d-a3ef-8fc3fbf44d16">
 <topic>openvpn -- arbitrary code execution on client through malicious or compromised server</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><ge>2.0</ge><lt>2.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	James Yonan reports:
	<blockquote cite="http://openvpn.net/changelog.html">
	 A format string vulnerability
	 in the foreign_option function in options.c could
	 potentially allow a malicious or compromised server
	 to execute arbitrary code on the client. Only
	 non-Windows clients are affected. The vulnerability
	 only exists if (a) the client's TLS negotiation with
	 the server succeeds, (b) the server is malicious or
	 has been compromised such that it is configured to
	 push a maliciously crafted options string to the client,
	 and (c) the client indicates its willingness to accept
	 pushed options from the server by having "pull" or
	 "client" in its configuration file (Credit: Vade79).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-3393</cvename>
 <mlist>http://www.securityfocus.com/archive/1/415293/30/0/threaded</mlist>
 <url>http://openvpn.net/changelog.html</url>
 </references>
 <dates>
 <discovery>2005-10-31</discovery>
 <entry>2005-11-01</entry>
 <modified>2005-11-04</modified>
 </dates>
 </vuln>

<vuln vid="6821a2db-4ab7-11da-932d-00055d790c25">
 <topic>PHP -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mod_php4-twig</name>
	<name>php4-cgi</name>
	<name>php4-cli</name>
	<name>php4-dtc</name>
	<name>php4-horde</name>
	<name>php4-nms</name>
	<name>php4</name>
	<range><lt>4.4.1</lt></range>
 </package>
 <package>
	<name>mod_php</name>
	<name>mod_php4</name>
	<range><ge>4</ge><lt>4.4.1,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/17371/">
	 Some vulnerabilities have been reported in PHP,
	 which can be exploited by malicious people to conduct
	 cross-site scripting attacks, bypass certain security
	 restrictions, and potentially compromise a vulnerable
	 system.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/17371/</url>
 </references>
 <dates>
 <discovery>2005-10-31</discovery>
 <entry>2005-11-01</entry>
 </dates>
 </vuln>

<vuln vid="70fc13d9-4ab4-11da-932d-00055d790c25">
 <topic>skype -- multiple buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>skype</name>
	<range><lt>1.2.0.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/17305/">
	 Some vulnerabilities have been reported in Skype,
	 which can be exploited by malicious people to cause
	 a DoS or to compromise a user's system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-3265</cvename>
 <cvename>CVE-2005-3267</cvename>
 <certvu>930345</certvu>
 <certvu>668193</certvu>
 <url>http://secunia.com/advisories/17305/</url>
 <url>http://skype.com/security/skype-sb-2005-02.html</url>
 <url>http://skype.com/security/skype-sb-2005-03.html</url>
 </references>
 <dates>
 <discovery>2005-10-25</discovery>
 <entry>2005-11-01</entry>
 <modified>2005-11-02</modified>
 </dates>
 </vuln>

<vuln vid="1c3142a3-4ab2-11da-932d-00055d790c25">
 <topic>squid -- FTP server response handling denial of service</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.11_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/17271/">
	 M.A.Young has reported a vulnerability in Squid,
	 which can be exploited by malicious people to cause
	 a DoS (Denial of Service).
	 The vulnerability is caused due to an error in
	 handling certain FTP server responses. This can be
	 exploited to crash Squid by visiting a malicious FTP
	 server via the proxy.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-3258</cvename>
 <url>http://secunia.com/advisories/17271/</url>
 </references>
 <dates>
 <discovery>2005-10-19</discovery>
 <entry>2005-11-01</entry>
 </dates>
 </vuln>

<vuln vid="f38c87a5-4a3e-11da-8ba2-0004614cc33d">
 <topic>base -- PHP SQL injection vulnerability</topic>
 <affects>
 <package>
	<name>base</name>
	<range><lt>1.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/17314/">
	 Remco Verhoef has discovered a vulnerability in
	 Basic Analysis and Security Engine (BASE), which
	 can be exploited by malicious users to conduct SQL
	 injection attacks.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>15199</bid>
 <url>http://secunia.com/advisories/17314/</url>
 </references>
 <dates>
 <discovery>2005-10-25</discovery>
 <entry>2005-10-31</entry>
 </dates>
 </vuln>

<vuln vid="baf74e0b-497a-11da-a4f4-0060084a00e5">
 <topic>fetchmail -- fetchmailconf local password exposure</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><lt>6.2.5.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The fetchmail team reports:
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2005-02.txt">
	 The fetchmailconf program before and excluding version
	 1.49 opened the run control file, wrote the configuration
	 to it, and only then changed the mode to 0600 (rw-------).
	 Writing the file, which usually contains passwords, before
	 making it unreadable to other users, can expose sensitive
	 password information.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-3088</cvename>
 <url>http://www.fetchmail.info/fetchmail-SA-2005-02.txt</url>
 </references>
 <dates>
 <discovery>2005-10-21</discovery>
 <entry>2005-10-30</entry>
 </dates>
 </vuln>

<vuln vid="c01170bf-4990-11da-a1b8-000854d03344">
 <topic>lynx -- remote buffer overflow</topic>
 <affects>
 <package>
	<name>lynx</name>
	<name>ja-lynx</name>
	<range><lt>2.8.5_1</lt></range>
	<range><gt>2.8.6*</gt><lt>2.8.6d14</lt></range>
 </package>
 <package>
	<name>lynx-ssl</name>
	<range><lt>2.8.5_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ulf Härnhammar reports:
	<blockquote cite="http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html">
	 When Lynx connects to an NNTP server to fetch information
	 about the available articles in a newsgroup, it will
	 call a function called HTrjis() with the information
	 from certain article headers. The function adds missing
	 ESC characters to certain data, to support Asian character
	 sets. However, it does not check if it writes outside
	 of the char array buf, and that causes a remote stack-based
	 buffer overflow.
	</blockquote>
 </body>
 </description> <references>
 <cvename>CVE-2005-3120</cvename>
 <url>http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html</url>
 </references> <dates>
 <discovery>2005-10-17</discovery>
 <entry>2005-10-30</entry>
 <modified>2006-10-05</modified>
 </dates>
 </vuln>

<vuln vid="1daea60a-4719-11da-b5c6-0004614cc33d">
 <topic>ruby -- vulnerability in the safe level settings</topic>
 <affects>
 <package>
	<name>ruby</name>
	<name>ruby_static</name>
	<range><gt>1.6.*</gt><lt>1.6.8.2004.07.28_2</lt></range>
	<range><gt>1.8.*</gt><lt>1.8.2_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ruby home page reports:
	<blockquote cite="http://www.ruby-lang.org/en/20051003.html">
	 The Object Oriented Scripting Language Ruby supports
	 safely executing an untrusted code with two mechanisms:
	 safe level and taint flag on objects.
	 A vulnerability has been found that allows bypassing
	 these mechanisms.
	 By using the vulnerability, arbitrary code can be executed
	 beyond the restrictions specified in each safe level.
	 Therefore, Ruby has to be updated on all systems that use
	 safe level to execute untrusted code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2337</cvename>
 <url>http://www.ruby-lang.org/en/20051003.html</url>
 </references>
 <dates>
 <discovery>2005-10-02</discovery>
 <entry>2005-10-27</entry>
 </dates>
 </vuln>

<vuln vid="2f0cb4bb-416d-11da-99fe-000854d03344">
 <topic>xloadimage -- buffer overflows in NIFF image title handling</topic>
 <affects>
 <package>
	<name>xloadimage</name>
	<range><lt>4.1.15</lt></range>
 </package>
 <package>
	<name>xli</name>
	<range><lt>1.17.0_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ariel Berkman reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112862493918840&amp;w=2">
	 Unlike most of the supported image formats in xloadimage,
	 the NIFF image format can store a title name of arbitrary
	 length as part of the image file.
	 When xloadimage is processing a loaded image, it is
	 creating a new Image object and then writing the processed
	 image to it. At that point, it will also copy the title
	 from the old image to the newly created image.
	 The 'zoom', 'reduce', and 'rotate' functions are using
	 a fixed length buffer to construct the new title name
	 when an image processing is done. Since the title name
	 in a NIFF format is of varying length, and there are
	 insufficient buffer size validations, the buffer can
	 be overflowed.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>15051</bid>
 <cvename>CVE-2005-3178</cvename>
 <mlist msgid="BOEKKJLADFNHIEFBHCECMEONCFAA.aberkm1@uic.edu">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112862493918840&amp;w=2</mlist>
 </references>
 <dates>
 <discovery>2005-10-05</discovery>
 <entry>2005-10-20</entry>
 <modified>2005-10-23</modified>
 </dates>
 </vuln>

<vuln vid="97d45e95-3ffc-11da-a263-0001020eed82">
 <topic>snort -- Back Orifice preprocessor buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>snort</name>
	<range><ge>2.4.0</ge><lt>2.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jennifer Steffens reports:
	<blockquote cite="http://www.snort.org/pub-bin/snortnews.cgi#99">
	 The Back Orifice preprocessor contains a stack-based
	 buffer overflow. This vulnerability could be leveraged by
	 an attacker to execute code remotely on a Snort sensor
	 where the Back Orifice preprocessor is enabled. However,
	 there are a number of factors that make remote code
	 execution difficult to achieve across different builds of
	 Snort on different platforms, even on the same platform
	 with different compiler versions, and it is more likely
	 that an attacker could use the vulnerability as a denial
	 of service attack.
	 The Back Orifice preprocessor can be disabled by
	 commenting out the line "preprocessor bo" in
	 snort.conf. This can be done in any text editor using the
	 following procedure:
	 <ol>
	 <li>Locate the line "preprocessor bo"</li>
	 <li>Comment out this line by preceding it with a hash
	 (#). The new line will look like "#preprocessor bo"</li>
	 <li>Save the file</li>
	 <li>Restart snort</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <certvu>175500</certvu>
 <url>http://www.snort.org/pub-bin/snortnews.cgi#99</url>
 <url>http://xforce.iss.net/xforce/alerts/id/207</url>
 </references>
 <dates>
 <discovery>2005-10-18</discovery>
 <entry>2005-10-18</entry>
 </dates>
 </vuln>

<vuln vid="60f8fe7b-3cfb-11da-baa2-0004614cc33d">
 <topic>WebCalendar -- remote file inclusion vulnerability</topic>
 <affects>
 <package>
	<name>WebCalendar</name>
	<range><lt>1.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	WebCalendar is proven vulnerable to a remote file inclusion
	 vulnerability. The send_reminders.php does not properly
	 verify the "includedir" parameter, giving remote attackers
	 the possibility to include local and remote files. These
	 files can be used by the attacker to gain access to the
	 system.
 </body>
 </description>
 <references>
 <bid>14651</bid>
 <cvename>CVE-2005-2717</cvename>
 <url>http://sourceforge.net/forum/forum.php?thread_id=1342085&amp;forum_id=11587</url>
 </references>
 <dates>
 <discovery>2005-08-26</discovery>
 <entry>2005-10-15</entry>
 <modified>2005-11-08</modified>
 </dates>
 </vuln>

<vuln vid="47bdabcf-3cf9-11da-baa2-0004614cc33d">
 <topic>gallery2 -- file disclosure vulnerability</topic>
 <affects>
 <package>
	<name>gallery2</name>
	<range><lt>2.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michael Dipper wrote:
	<blockquote cite="http://dipper.info/security/20051012/">
	 A vulnerability has been discovered in gallery,
	 which allows remote users unauthorized access to files
	 on the webserver.
	 A remote user accessing gallery over the web may use
	 specially crafted HTTP parameters to access arbitrary
	 files located on the webserver. All files readable by
	 the webserver process are subject to disclosure.
	 The vulnerability is *not* restricted to the webserver's
	 document root but extends to the whole server file space.
	 The vulnerability may be used by any anonymous user,
	 there is no login to the application required.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>15108</bid>
 <cvename>CVE-2005-3251</cvename>
 <url>http://dipper.info/security/20051012/</url>
 </references>
 <dates>
 <discovery>2005-10-12</discovery>
 <entry>2005-10-15</entry>
 <modified>2005-11-08</modified>
 </dates>
 </vuln>

<vuln vid="60e26a40-3b25-11da-9484-00123ffe8333">
 <topic>openssl -- potential SSL 2.0 rollback</topic>
 <affects>
 <package>
	<name>openssl</name>
	<name>openssl-overwrite-base</name>
	<range><le>0.9.7g</le></range>
	<range><ge>0.9.8</ge><le>0.9.8_1</le></range>
	<range><ge>0.9.*_20050325</ge><le>0.9.*_20051011</le></range>
 </package>
 <package>
	<name>openssl-beta</name>
	<name>openssl-beta-overwrite-base</name>
	<range><le>0.9.8_1</le></range>
	<range><ge>0.9.*_20050325</ge><le>0.9.*_20051011</le></range>
 </package>
 <package>
	<name>compat5x-alpha</name>
	<name>compat5x-amd64</name>
	<name>compat5x-i386</name>
	<name>compat5x-sparc64</name>
	<range><lt>5.4.0.8</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><lt>4.10_19</lt></range>
	<range><ge>4.11</ge><lt>4.11_13</lt></range>
	<range><ge>5.3</ge><lt>5.3_23</lt></range>
	<range><ge>5.4</ge><lt>5.4_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Vulnerability:
	<blockquote cite="http://www.openssl.org/news/secadv_20051011.txt">
	 Such applications are affected if they use the option
	 SSL_OP_MSIE_SSLV2_RSA_PADDING. This option is implied by use of
	 SSL_OP_ALL, which is intended to work around various bugs in
	 third-party software that might prevent interoperability. The
	 SSL_OP_MSIE_SSLV2_RSA_PADDING option disables a verification step in
	 the SSL 2.0 server supposed to prevent active protocol-version
	 rollback attacks. With this verification step disabled, an attacker
	 acting as a "man in the middle" can force a client and a server to
	 negotiate the SSL 2.0 protocol even if these parties both support
	 SSL 3.0 or TLS 1.0. The SSL 2.0 protocol is known to have severe
	 cryptographic weaknesses and is supported as a fallback only.
	 Applications using neither SSL_OP_MSIE_SSLV2_RSA_PADDING nor
	 SSL_OP_ALL are not affected. Also, applications that disable
	 use of SSL 2.0 are not affected.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdsa>SA-05:21.openssl</freebsdsa>
 <cvename>CVE-2005-2969</cvename>
 <url>http://www.openssl.org/news/secadv_20051011.txt</url>
 </references>
 <dates>
 <discovery>2005-10-11</discovery>
 <entry>2005-10-12</entry>
 <modified>2005-10-25</modified>
 </dates>
 </vuln>

<vuln vid="9b7053fd-3ab5-11da-9484-00123ffe8333">
 <topic>phpmyadmin -- local file inclusion vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>2.6.4.r1</ge><le>2.6.4.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A phpMyAdmin security announcement reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4">
	 In libraries/grab_globals.lib.php, the $__redirect
	 parameter was not correctly validated, opening the door to
	 a local file inclusion attack.
	 We consider this vulnerability to be serious.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>15053</bid>
 <mlist msgid="20051010161119.1689.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112907764728209</mlist>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4</url>
 </references>
 <dates>
 <discovery>2005-10-11</discovery>
 <entry>2005-10-11</entry>
 <modified>2005-10-13</modified>
 </dates>
 </vuln>

<vuln vid="d2b80c7c-3aae-11da-9484-00123ffe8333">
 <topic>zope -- expose RestructuredText functionality to untrusted users</topic>
 <affects>
 <package>
	<name>zope</name>
	<range><ge>2.6.0</ge><lt>2.7.8</lt></range>
	<range><ge>2.8.0</ge><le>2.8.1_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Zope Hotfix Alert reports:
	<blockquote cite="http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert">
	 This hotfix resolves a security issue with docutils.
	 Affected are possibly all Zope instances that expose
	 RestructuredText functionalies to untrusted users through
	 the web.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-3323</cvename>
 <bid>15082</bid>
 <url>http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert</url>
 </references>
 <dates>
 <discovery>2005-10-09</discovery>
 <entry>2005-10-11</entry>
 <modified>2005-11-28</modified>
 </dates>
 </vuln>

<vuln vid="3bc5691e-38dd-11da-92f5-020039488e34">
 <topic>libxine -- format string vulnerability</topic>
 <affects>
 <package>
	<name>libxine</name>
	<range><lt>1.1.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gentoo Linux Security Advisory reports:
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml">
	 Ulf Harnhammar discovered a format string bug in the routines
	 handling CDDB server response contents.
	 An attacker could submit malicious information about an audio
	 CD to a public CDDB server (or impersonate a public CDDB server).
	 When the victim plays this CD on a multimedia frontend relying
	 on xine-lib, it could end up executing arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2967</cvename>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml</url>
 <url>http://xinehq.de/index.php/security/XSA-2005-1</url>
 </references>
 <dates>
 <discovery>2005-10-08</discovery>
 <entry>2005-10-09</entry>
 </dates>
 </vuln>

<vuln vid="1f6e2ade-35c2-11da-811d-0050bf27ba24">
 <topic>imap-uw -- mailbox name handling remote buffer vulnerability</topic>
 <affects>
 <package>
	<name>imap-uw</name>
	<range><lt>2004g</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	FrSIRT reports:
	<blockquote cite="http://www.frsirt.com/english/advisories/2005/1953">
	 A vulnerability has been identified in UW-IMAP, which could
	 be exploited by remote attackers to execute arbitrary commands.
	 This flaw is due to a stack overflow error in the
	 "mail_valid_net_parse_work()" [src/c-client/mail.c] function that
	 does not properly handle specially crafted mailbox names containing
	 a quote (") character, which could be exploited by authenticated
	 remote attackers to execute arbitrary commands with the privileges
	 of the IMAP server.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2933</cvename>
 <url>http://www.frsirt.com/english/advisories/2005/1953</url>
 <url>http://www.idefense.com/application/poi/display?id=313&amp;type=vulnerabilities</url>
 <url>http://www.washington.edu/imap/documentation/RELNOTES.html</url>
 </references>
 <dates>
 <discovery>2005-10-05</discovery>
 <entry>2005-10-05</entry>
 </dates>
 </vuln>

<vuln vid="d4c70df5-335d-11da-9c70-0040f42d58c6">
 <topic>weex -- remote format string vulnerability</topic>
 <affects>
 <package>
	<name>weex</name>
	<range><lt>2.6.1.5_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Emanuel Haupt reports:
	<blockquote>
	 Someone who controls an FTP server that weex will log in to
	 can set up malicious data in the account that weex will use,
	 and that will cause a format string bug that will allow remote
	 code execution. It will only happen when weex is first run or
	 when its cache files are rebuilt with the -r option,
	 though. The vulnerability was found by Ulf Harnhammar.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/86833</freebsdpr>
 </references>
 <dates>
 <discovery>2005-10-02</discovery>
 <entry>2005-10-02</entry>
 </dates>
 </vuln>

<vuln vid="8a3ece40-3315-11da-a263-0001020eed82">
 <topic>picasm -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>picasm</name>
	<range><lt>1.12c</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Shaun Colley reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111661253517089">
	 When generating error and warning messages, picasm copies
	 strings into fixed length buffers without bounds
	 checking.
	 If an attacker could trick a user into assembling a
	 source file with a malformed 'error' directive, arbitrary
	 code could be executed with the privileges of the user.
	 This could result in full system compromise.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13698</bid>
 <cvename>CVE-2005-1679</cvename>
 <mlist msgid="c522a35a0505200807744163c4@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111661253517089</mlist>
 </references>
 <dates>
 <discovery>2005-05-20</discovery>
 <entry>2005-10-02</entry>
 </dates>
 </vuln>

<vuln vid="1e606080-3293-11da-ac91-020039488e34">
 <topic>uim -- privilege escalation vulnerability</topic>
 <affects>
 <package>
	<name>ja-uim</name>
	<range><lt>0.4.9.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The uim developers reports:
	<blockquote cite="http://lists.freedesktop.org/archives/uim/2005-September/001346.html">
	 Masanari Yamamoto discovered that incorrect use
	 of environment variables in uim. This bug causes
	 privilege escalation if setuid/setgid applications
	 was linked to libuim.
	 This bug appears in 'immodule for Qt' enabled Qt.
	 (Normal Qt is also safe.) In some distribution,
	 mlterm is also an setuid/setgid application.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://lists.freedesktop.org/archives/uim/2005-September/001346.html</url>
 </references>
 <dates>
 <discovery>2005-09-28</discovery>
 <entry>2005-10-01</entry>
 </dates>
 </vuln>

<vuln vid="8688d5cd-328c-11da-a263-0001020eed82">
 <topic>cfengine -- arbitrary file overwriting vulnerability</topic>
 <affects>
 <package>
	<name>cfengine</name>
	<range><lt>2.1.6_1</lt></range>
 </package>
 <package>
	<name>cfengine2</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Debian Security Advisory reports:
	<blockquote cite="http://www.debian.org/security/2005/dsa-835">
	 Javier Fernández-Sanguino Peña discovered several
	 insecure temporary file uses in cfengine, a tool for
	 configuring and maintaining networked machines, that can
	 be exploited by a symlink attack to overwrite arbitrary
	 files owned by the user executing cfengine, which is
	 probably root.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2960</cvename>
 <bid>14994</bid>
 <url>http://www.debian.org/security/2005/dsa-835</url>
 <url>http://www.debian.org/security/2005/dsa-836</url>
 </references>
 <dates>
 <discovery>2005-10-01</discovery>
 <entry>2005-10-01</entry>
 <modified>2005-10-07</modified>
 </dates>
 </vuln>

<vuln vid="271498a9-2cd4-11da-a263-0001020eed82">
 <topic>clamav -- arbitrary code execution and DoS vulnerabilities</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.87</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><lt>20050917</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gentoo Linux Security Advisory reports:
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml">
	 Clam AntiVirus is vulnerable to a buffer overflow in
	 "libclamav/upx.c" when processing malformed UPX-packed
	 executables. It can also be sent into an infinite loop in
	 "libclamav/fsg.c" when processing specially-crafted
	 FSG-packed executables.
	 By sending a specially-crafted file an attacker could
	 execute arbitrary code with the permissions of the user
	 running Clam AntiVirus, or cause a Denial of Service.
	</blockquote>
 </body>
 </description>
 <references>
 <certvu>363713</certvu>
 <cvename>CVE-2005-2919</cvename>
 <cvename>CVE-2005-2920</cvename>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml</url>
 </references>
 <dates>
 <discovery>2005-09-16</discovery>
 <entry>2005-09-24</entry>
 <modified>2005-10-22</modified>
 </dates>
 </vuln>

<vuln vid="8f5dd74b-2c61-11da-a263-0001020eed82">
 <topic>firefox &amp; mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.7,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.0.7</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.12,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<range><lt>1.7.12</lt></range>
 </package>
 <package>
	<name>linux-mozilla-devel</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory reports of multiple
	 issues:
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-58.html">
	 <h1>Heap overrun in XBM image processing</h1>
	 jackerror reports that an improperly terminated XBM image
	 ending with space characters instead of the expected end
	 tag can lead to a heap buffer overrun. This appears to be
	 exploitable to install or run malicious code on the user's
	 machine.
	 Thunderbird does not support the XBM format and is not
	 affected by this flaw.
	 <h1>Crash on "zero-width non-joiner" sequence</h1>
	 Mats Palmgren discovered that a reported crash on Unicode
	 sequences with "zero-width non-joiner" characters was due
	 to stack corruption that may be exploitable.
	 <h1>XMLHttpRequest header spoofing</h1>
	 It was possible to add illegal and malformed headers to
	 an XMLHttpRequest. This could have been used to exploit
	 server or proxy flaws from the user's machine, or to fool
	 a server or proxy into thinking a single request was a
	 stream of separate requests. The severity of this
	 vulnerability depends on the value of servers which might
	 be vulnerable to HTTP request smuggling and similar
	 attacks, or which share an IP address (virtual hosting)
	 with the attacker's page.
	 For users connecting to the web through a proxy this flaw
	 could be used to bypass the same-origin restriction on
	 XMLHttpRequests by fooling the proxy into handling a
	 single request as multiple pipe-lined requests directed at
	 arbitrary hosts. This could be used, for example, to read
	 files on intranet servers behind a firewall.
	 <h1>Object spoofing using XBL &lt;implements&gt;</h1>
	 moz_bug_r_a4 demonstrated a DOM object spoofing bug
	 similar to <a href="http://www.mozilla.org/security/announce/mfsa2005-55.html">MFSA
	 2005-55</a> using an XBL control that &lt;implements&gt;
	 an internal interface. The severity depends on the version
	 of Firefox: investigation so far indicates Firefox 1.0.x
	 releases don't expose any vulnerable functionality to
	 interfaces spoofed in this way, but that early Deer Park
	 Alpha 1 versions did.
	 XBL was changed to no longer allow unprivileged controls
	 from web content to implement XPCOM interfaces.
	 <h1>JavaScript integer overflow</h1>
	 Georgi Guninski reported an integer overflow in the
	 JavaScript engine. We presume this could be exploited to
	 run arbitrary code under favorable conditions.
	 <h1>Privilege escalation using about: scheme</h1>
	 heatsync and shutdown report two different ways to bypass
	 the restriction on loading high privileged "chrome" pages
	 from an unprivileged "about:" page. By itself this is
	 harmless--once the "about" page's privilege is raised the
	 original page no longer has access--but should this be
	 combined with a same-origin violation this could lead to
	 arbitrary code execution.
	 <h1>Chrome window spoofing</h1>
	 moz_bug_r_a4 demonstrates a way to get a blank "chrome"
	 canvas by opening a window from a reference to a closed
	 window. The resulting window is not privileged, but the
	 normal browser UI is missing and can be used to construct
	 a spoof page without any of the safety features of the
	 browser chrome designed to alert users to phishing sites,
	 such as the address bar and the status bar.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2701</cvename>
 <cvename>CVE-2005-2702</cvename>
 <cvename>CVE-2005-2703</cvename>
 <cvename>CVE-2005-2704</cvename>
 <cvename>CVE-2005-2705</cvename>
 <cvename>CVE-2005-2706</cvename>
 <cvename>CVE-2005-2707</cvename>
 <url>http://www.mozilla.org/security/announce/mfsa2005-58.html</url>
 </references>
 <dates>
 <discovery>2005-09-22</discovery>
 <entry>2005-09-23</entry>
 <modified>2005-10-26</modified>
 </dates>
 </vuln>

<vuln vid="2e28cefb-2aee-11da-a263-0001020eed82">
 <topic>firefox &amp; mozilla -- command line URL shell command injection</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.7,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.0.7</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.12,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<range><lt>1.7.12</lt></range>
 </package>
 <package>
	<name>linux-mozilla-devel</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/16869/">
	 Peter Zelezny has discovered a vulnerability in Firefox,
	 which can be exploited by malicious people to compromise a
	 user's system.
	 The vulnerability is caused due to the shell script used
	 to launch Firefox parsing shell commands that are enclosed
	 within backticks in the URL provided via the command
	 line. This can e.g. be exploited to execute arbitrary
	 shell commands by tricking a user into following a
	 malicious link in an external application which uses
	 Firefox as the default browser.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2968</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=307185</url>
 <url>http://secunia.com/advisories/16869/</url>
 <url>http://www.mozilla.org/security/announce/mfsa2005-59.html</url>
 </references>
 <dates>
 <discovery>2005-09-06</discovery>
 <entry>2005-09-22</entry>
 <modified>2005-10-26</modified>
 </dates>
 </vuln>

<vuln vid="e936d612-253f-11da-bc01-000e0c2e438a">
 <topic>apache -- Certificate Revocation List (CRL) off-by-one vulnerability</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><gt>2.*</gt><lt>2.0.54_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marc Stern reports an off-by-one vulnerability in within
	 mod_ssl. The vulnerability lies in mod_ssl's Certificate
	 Revocation List (CRL). If Apache is configured to use a
	 CRL this could allow an attacker to crash a child process
	 causing a Denial of Service.
 </body>
 </description>
 <references>
 <bid>14366</bid>
 <cvename>CVE-2005-1268</cvename>
 </references>
 <dates>
 <discovery>2005-07-12</discovery>
 <entry>2005-09-17</entry>
 </dates>
 </vuln>

<vuln vid="7d52081f-2795-11da-bc01-000e0c2e438a">
 <topic>squirrelmail -- _$POST variable handling allows for various attacks</topic>
 <affects>
 <package>
	<name>squirrelmail</name>
	<name>ja-squirrelmail</name>
	<range><ge>1.4.0</ge><lt>1.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Squirrelmail Advisory reports:
	<blockquote cite="http://www.squirrelmail.org/security/issue/2005-07-13">
	 An extract($_POST) was done in options_identities.php which
	 allowed for an attacker to set random variables in that
	 file. This could lead to the reading (and possible
	 writing) of other people's preferences, cross site scripting
	 or writing files in webserver-writable locations.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>14254</bid>
 <cvename>CVE-2005-2095</cvename>
 <url>http://www.squirrelmail.org/security/issue/2005-07-13</url>
 </references>
 <dates>
 <discovery>2005-07-13</discovery>
 <entry>2005-09-17</entry>
 <modified>2005-09-19</modified>
 </dates>
 </vuln>

<vuln vid="a863aa74-24be-11da-8882-000e0c33c2dc">
 <topic>X11 server -- pixmap allocation vulnerability</topic>
 <affects>
 <package>
	<name>XFree86-Server</name>
	<range><lt>4.5.0_2</lt></range>
 </package>
 <package>
	<name>xorg-server</name>
	<range><lt>6.8.2_5</lt></range>
	<range><gt>6.8.99</gt><lt>6.8.99.12_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Allocating large pixmaps by a client can trigger an integer
	 overflow in the X server, potentially leading to execution of
	 arbitrary code with elevated (root) privileges.
 </body>
 </description>
 <references>
 <bid>14807</bid>
 <certvu>102441</certvu>
 <cvename>CVE-2005-2495</cvename>
 <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166856</url>
 <url>https://bugs.freedesktop.org/show_bug.cgi?id=594</url>
 </references>
 <dates>
 <discovery>2005-09-12</discovery>
 <entry>2005-09-15</entry>
 </dates>
 </vuln>

<vuln vid="9750cf22-216d-11da-bc01-000e0c2e438a">
 <topic>unzip -- permission race vulnerability</topic>
 <affects>
 <package>
	<name>unzip</name>
	<name>zh-unzip</name>
	<name>ko-unzip</name>
	<range><lt>5.52_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Imran Ghory reports a vulnerability within unzip. The
	 vulnerability is caused by a race condition between
	 extracting an archive and changing the permissions of the
	 extracted files. This would give an attacker enough time to
	 remove a file and hardlink it to another file owned by the
	 user running unzip. When unzip changes the permissions of
	 the file it could give the attacker access to files that
	 normally would not have been accessible for others.
 </body>
 </description>
 <references>
 <bid>14450</bid>
 <cvename>CVE-2005-2475</cvename>
 <mlist msgid="7389fc4b05080116031536adf7@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112300046224117</mlist>
 </references>
 <dates>
 <discovery>2005-08-02</discovery>
 <entry>2005-09-13</entry>
 </dates>
 </vuln>

<vuln vid="8665ebb9-2237-11da-978e-0001020eed82">
 <topic>firefox &amp; mozilla -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.6_5,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.0.7</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.11_1,2</lt></range>
	<range><ge>1.8.*,2</ge><lt>1.8.b1_5,2</lt></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<range><lt>1.7.12</lt></range>
 </package>
 <package>
	<name>linux-mozilla-devel</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tom Ferris reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=112624614008387">
	 A buffer overflow vulnerability exists within Firefox
	 version 1.0.6 and all other prior versions which allows
	 for an attacker to remotely execute arbitrary code on an
	 affected host.
	 The problem seems to be when a hostname which has all
	 dashes causes the NormalizeIDN call in
	 nsStandardURL::BuildNormalizedSpec to return true, but is
	 sets encHost to an empty string. Meaning, Firefox appends
	 0 to approxLen and then appends the long string of dashes
	 to the buffer instead.
	</blockquote>
	Note: It is possible to disable IDN
	 support as a workaround to protect against this buffer
	 overflow. How to do this is described on the <a href="http://www.mozilla.org/security/idn.html">What Firefox
	 and Mozilla users should know about the IDN buffer overflow
	 security issue</a> web page.
 </body>
 </description>
 <references>
 <bid>14784</bid>
 <certvu>573857</certvu>
 <cvename>CVE-2005-2871</cvename>
 <url>http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=112624614008387</url>
 <url>http://www.mozilla.org/security/idn.html</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=307259</url>
 <url>http://www.mozilla.org/security/announce/mfsa2005-57.html</url>
 </references>
 <dates>
 <discovery>2005-09-08</discovery>
 <entry>2005-09-10</entry>
 <modified>2005-10-26</modified>
 </dates>
 </vuln>

<vuln vid="673aec6f-1cae-11da-bc01-000e0c2e438a">
 <topic>htdig -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>htdig</name>
	<range><lt>3.2.0.b6_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Michael Krax reports a vulnerability within htdig. The
	 vulnerability lies within an unsanitized config parameter,
	 allowing a malicious attacker to execute arbitrary scripting
	 code on the target's browser. This might allow the attacker
	 to obtain the user's cookies which are associated with the
	 site, including cookies used for authentication.
 </body>
 </description>
 <references>
 <bid>12442</bid>
 <cvename>CVE-2005-0085</cvename>
 <url>http://www.securitytracker.com/alerts/2005/Feb/1013078.html</url>
 </references>
 <dates>
 <discovery>2005-02-03</discovery>
 <entry>2005-09-04</entry>
 <modified>2005-09-13</modified>
 </dates>
 </vuln>

<vuln vid="4e210d72-1c5c-11da-92ce-0048543d60ce">
 <topic>squid -- Denial Of Service Vulnerability in sslConnectTimeout</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.10_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The squid patches page notes:
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-sslConnectTimeout">
	 After certain slightly odd requests Squid crashes with a
	 segmentation fault in sslConnectTimeout.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>14731</bid>
 <cvename>CVE-2005-2796</cvename>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-sslConnectTimeout</url>
 <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1355</url>
 <url>http://secunia.com/advisories/16674/</url>
 </references>
 <dates>
 <discovery>2005-07-21</discovery>
 <entry>2005-09-04</entry>
 <modified>2005-10-02</modified>
 </dates>
 </vuln>

<vuln vid="0c0dc409-1c5e-11da-92ce-0048543d60ce">
 <topic>squid -- Possible Denial Of Service Vulnerability in store.c</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.10_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The squid patches page notes:
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-STORE_PENDING">
	 Squid crashes with the above assertion failure [assertion failed:
	 store.c:523: "e-&gt;store_status == STORE_PENDING"] in certain
	 conditions involving aborted requests.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>14761</bid>
 <cvename>CVE-2005-2794</cvename>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-STORE_PENDING</url>
 <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1368</url>
 <url>http://secunia.com/advisories/16708/</url>
 </references>
 <dates>
 <discovery>2005-08-02</discovery>
 <entry>2005-09-04</entry>
 <modified>2005-10-02</modified>
 </dates>
 </vuln>

<vuln vid="30e4ed7b-1ca6-11da-bc01-000e0c2e438a">
 <topic>bind9 -- denial of service</topic>
 <affects>
 <package>
	<name>bind9</name>
	<range><eq>9.3.0</eq></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.3</ge><lt>5.3_16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Problem description
	A DNSSEC-related validator function in BIND 9.3.0 contains an
	 inappropriate internal consistency test. When this test is
	 triggered, named(8) will exit.
	Impact
	On systems with DNSSEC enabled, a remote attacker may be able
	 to inject a specially crafted packet that will cause the
	 internal consistency test to trigger, and named(8) to
	 terminate. As a result, the name server will no longer be
	 available to service requests.
	Workaround
	DNSSEC is not enabled by default, and the "dnssec-enable"
	 directive is not normally present. If DNSSEC has been
	 enabled, disable it by changing the "dnssec-enable" directive
	 to "dnssec-enable no;" in the named.conf(5) configuration
	 file.
 </body>
 </description>
 <references>
 <certvu>938617</certvu>
 <cvename>CVE-2005-0034</cvename>
 <url>http://www.uniras.gov.uk/niscc/docs/al-20050125-00060.html?lang=en</url>
 <url>http://www.isc.org/sw/bind/bind9.3.php#security</url>
 </references>
 <dates>
 <discovery>2005-01-25</discovery>
 <entry>2005-09-03</entry>
 </dates>
 </vuln>

<vuln vid="947f4b14-1c89-11da-bc01-000e0c2e438a">
 <topic>bind -- buffer overrun vulnerability</topic>
 <affects>
 <package>
	<name>bind84</name>
	<range><ge>8.4.4</ge><lt>8.4.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An ISC advisory reports a buffer overrun vulnerability within
	 bind. The vulnerability could result in a Denial of Service.
	 A workaround is available by disabling recursion and glue
	 fetching.
 </body>
 </description>
 <references>
 <certvu>327633</certvu>
 <cvename>CVE-2005-0033</cvename>
 <url>http://www.uniras.gov.uk/niscc/docs/al-20050125-00059.html?lang=en</url>
 <url>http://www.isc.org/sw/bind/bind-security.php</url>
 </references>
 <dates>
 <discovery>2005-01-25</discovery>
 <entry>2005-09-03</entry>
 <modified>2005-09-21</modified>
 </dates>
 </vuln>

<vuln vid="08df5d46-1baf-11da-8038-0040f42d58c6">
 <topic>urban -- stack overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>urban</name>
	<range><lt>1.5.3_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Several filename-related stack overflow bugs allow a local
	 attacker to elevate its privileges to the games group, since
	 urban is installed setgid games.
	Issue discovered and fixed by &lt;shaun@rsc.cx&gt;.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2864</cvename>
 <mlist msgid="55104.213.107.125.108.1125844783.squirrel@webmail.rsc.cx">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112604855119036</mlist>
 </references>
 <dates>
 <discovery>2005-09-02</discovery>
 <entry>2005-09-02</entry>
 <modified>2005-09-22</modified>
 </dates>
 </vuln>

<vuln vid="6e27f3b6-189b-11da-b6be-0090274e8dbb">
 <topic>fswiki -- command injection vulnerability</topic>
 <affects>
 <package>
	<name>fswiki</name>
	<range><lt>3.5.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	There is a command injection vulnerability in admin page
	 of fswiki.
 </body>
 </description>
 <references>
 <url>http://jvn.jp/jp/JVN%2342435855/index.html</url>
 </references>
 <dates>
 <discovery>2005-08-29</discovery>
 <entry>2005-08-29</entry>
 </dates>
 </vuln>

<vuln vid="e5afdf63-1746-11da-978e-0001020eed82">
 <topic>evolution -- remote format string vulnerabilities</topic>
 <affects>
 <package>
	<name>evolution</name>
	<range><gt>1.5</gt><lt>2.2.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A SITIC Vulnerability Advisory reports:
	<blockquote cite="http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html">
	 Evolution suffers from several format string bugs when
	 handling data from remote sources. These bugs lead to
	 crashes or the execution of arbitrary assembly language
	 code.
	 <ol>
	 <li>The first format string bug occurs when viewing the
	 full vCard data attached to an e-mail message.</li>
	 <li>The second format string bug occurs when displaying
	 contact data from remote LDAP servers.</li>
	 <li>The third format string bug occurs when displaying
	 task list data from remote servers.</li>
	 <li>The fourth, and least serious, format string bug
	 occurs when the user goes to the Calendars tab to save
	 task list data that is vulnerable to problem 3
	 above. Other calendar entries that do not come from task
	 lists are also affected.</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>14532</bid>
 <cvename>CVE-2005-2549</cvename>
 <cvename>CVE-2005-2550</cvename>
 <url>http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html</url>
 </references>
 <dates>
 <discovery>2005-08-10</discovery>
 <entry>2005-08-27</entry>
 <modified>2006-03-24</modified>
 </dates>
 </vuln>

<vuln vid="38c76fcf-1744-11da-978e-0001020eed82">
 <topic>pam_ldap -- authentication bypass vulnerability</topic>
 <affects>
 <package>
	<name>pam_ldap</name>
	<range><lt>1.8.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Luke Howard reports:
	<blockquote cite="https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166163">
	 If a pam_ldap client authenticates against an LDAP server
	 that returns a passwordPolicyResponse control, but omits
	 the optional "error" field of the
	 PasswordPolicyResponseValue, then the LDAP authentication
	 result will be ignored and the authentication step will
	 always succeed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2641</cvename>
 <certvu>778916</certvu>
 <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166163</url>
 </references>
 <dates>
 <discovery>2005-08-22</discovery>
 <entry>2005-08-27</entry>
 </dates>
 </vuln>

<vuln vid="b971d2a6-1670-11da-978e-0001020eed82">
 <topic>pcre -- regular expression buffer overflow</topic>
 <affects>
 <package>
	<name>pcre</name>
	<name>pcre-utf8</name>
	<range><lt>6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The pcre library is vulnerable to a buffer overflow
	 vulnerability due to insufficient validation of quantifier
	 values. This could lead execution of arbitrary code with
	 the permissions of the program using pcre by way of a
	 specially crated regular expression.
 </body>
 </description>
 <references>
 <bid>14620</bid>
 <cvename>CVE-2005-2491</cvename>
 <url>http://www.pcre.org/changelog.txt</url>
 </references>
 <dates>
 <discovery>2005-08-01</discovery>
 <entry>2005-08-26</entry>
 </dates>
 </vuln>

<vuln vid="f66e011d-13ff-11da-af41-0004614cc33d">
 <topic>elm -- remote buffer overflow in Expires header</topic>
 <affects>
 <package>
	<name>elm</name>
	<range><lt>2.5.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ulf Harnhammar has discovered a remotely exploitable buffer
	 overflow in Elm e-mail client when parsing the Expires header
	 of an e-mail message:
	<blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html">
	 The attacker only needs to send the victim an e-mail
	 message. When the victim with that message in his or her
	 inbox starts Elm or simply views the inbox in an already
	 started copy of Elm, the buffer overflow will happen
	 immediately. The overflow is stack-based, and it gives full
	 control over EIP, EBP and EBX. It is caused by a bad
	 sscanf(3) call, using a format string containing "%s"
	 to copy from a long char array to a shorter array.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html</url>
 </references>
 <dates>
 <discovery>2005-08-20</discovery>
 <entry>2005-08-23</entry>
 </dates>
 </vuln>

<vuln vid="5ad3e437-e527-4514-b9ed-280b2ca1a8c9">
 <topic>openvpn -- multiple TCP clients connecting with the same certificate at the same time can crash the server</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><lt>2.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	James Yonan reports:
	<blockquote cite="http://openvpn.net/changelog.html">
	 If two or more client machines try to connect to the server
	 at the same time via TCP, using the same client certificate,
	 and when --duplicate-cn is not enabled on the server, a race
	 condition can crash the server with "Assertion failed at
	 mtcp.c:411"
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2534</cvename>
 <url>http://openvpn.net/changelog.html</url>
 </references>
 <dates>
 <discovery>2005-08-03</discovery>
 <entry>2005-08-19</entry>
 </dates>
 </vuln>

<vuln vid="1986449a-8b74-40fa-b7cc-0d8def8aad65">
 <topic>openvpn -- denial of service: malicious authenticated "tap" client can deplete server virtual memory</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><lt>2.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	James Yonan reports:
	<blockquote cite="http://openvpn.net/changelog.html">
	 A malicious [authenticated] client in "dev tap"
	 ethernet bridging mode could theoretically flood the server
	 with packets appearing to come from hundreds of thousands
	 of different MAC addresses, causing the OpenVPN process to
	 deplete system virtual memory as it expands its internal
	 routing table.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2533</cvename>
 <url>http://openvpn.net/changelog.html</url>
 </references>
 <dates>
 <discovery>2005-07-27</discovery>
 <entry>2005-08-19</entry>
 </dates>
 </vuln>

<vuln vid="d1c39c8e-05ab-4739-870f-765490fa2052">
 <topic>openvpn -- denial of service: undecryptable packet from authorized client can disconnect unrelated clients</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><lt>2.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	James Yonan reports:
	<blockquote cite="http://openvpn.net/changelog.html">
	 If the client sends a packet which fails to decrypt on the
	 server, the OpenSSL error queue is not properly flushed,
	 which can result in another unrelated client instance on the
	 server seeing the error and responding to it, resulting in
	 disconnection of the unrelated client.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2532</cvename>
 <url>http://openvpn.net/changelog.html</url>
 </references>
 <dates>
 <discovery>2005-07-27</discovery>
 <entry>2005-08-19</entry>
 </dates>
 </vuln>

<vuln vid="a51ad838-2077-48b2-a136-e888a7db5f8d">
 <topic>openvpn -- denial of service: client certificate validation can disconnect unrelated clients</topic>
 <affects>
 <package>
	<name>openvpn</name>
	<range><lt>2.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	James Yonan reports:
	<blockquote cite="http://openvpn.net/changelog.html">
	 DoS attack against server when run with "verb 0" and
	 without "tls-auth". If a client connection to the server
	 fails certificate verification, the OpenSSL error queue is
	 not properly flushed, which can result in another unrelated
	 client instance on the server seeing the error and
	 responding to it, resulting in disconnection of the
	 unrelated client.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2531</cvename>
 <url>http://openvpn.net/changelog.html</url>
 </references>
 <dates>
 <discovery>2005-08-03</discovery>
 <entry>2005-08-19</entry>
 </dates>
 </vuln>

<vuln vid="5fde5c30-0f4e-11da-bc01-000e0c2e438a">
 <topic>tor -- diffie-hellman handshake flaw</topic>
 <affects>
 <package>
	<name>tor</name>
	<range><lt>0.1.0.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A tor advisory reports
	<blockquote cite="http://archives.seul.org/or/announce/Aug-2005/msg00002.html">
	 Tor clients can completely loose anonymity, confidentiality,
	 and data integrity if the first Tor server in their path is
	 malicious.	Specifically, if the Tor client chooses a
	 malicious Tor server for her first hop in the circuit, that
	 server can learn all the keys she negotiates for the rest of
	 the circuit (or just spoof the whole circuit), and then read
	 and/or modify all her traffic over that circuit.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2643</cvename>
 <url>http://archives.seul.org/or/announce/Aug-2005/msg00002.html</url>
 </references>
 <dates>
 <discovery>2005-08-11</discovery>
 <entry>2005-08-17</entry>
 <modified>2005-09-21</modified>
 </dates>
 </vuln>

<vuln vid="f74dc01b-0e83-11da-bc08-0001020eed82">
 <topic>acroread -- plug-in buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>acroread</name>
	<range><lt>7.0.1</lt></range>
	<range><gt>5.*,1</gt><lt>7.0.1,1</lt></range>
 </package>
 <package>
	<name>acroread4</name>
	<name>acroread5</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>acroread7</name>
	<range><lt>7.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Adobe Security Advisory reports:
	<blockquote cite="http://www.adobe.com/support/techdocs/321644.html">
	 The identified vulnerability is a buffer overflow within
	 a core application plug-in, which is part of Adobe Acrobat
	 and Adobe Reader. If a malicious file were opened it could
	 trigger a buffer overflow as the file is being loaded into
	 Adobe Acrobat and Adobe Reader. A buffer overflow can
	 cause the application to crash and increase the risk of
	 malicious code execution.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2470</cvename>
 <url>http://www.adobe.com/support/techdocs/321644.html</url>
 </references>
 <dates>
 <discovery>2005-08-16</discovery>
 <entry>2005-08-16</entry>
 </dates>
 </vuln>

<vuln vid="e65ad1bf-0d8b-11da-90d0-00304823c0d3">
 <topic>pear-XML_RPC -- remote PHP code injection vulnerability</topic>
 <affects>
 <package>
	<name>pear-XML_RPC</name>
	<range><lt>1.4.0</lt></range>
 </package>
 <package>
	<name>phpmyfaq</name>
	<range><lt>1.4.11</lt></range>
 </package>
 <package>
	<name>drupal</name>
	<range><lt>4.6.3</lt></range>
 </package>
 <package>
	<name>eGroupWare</name>
	<range><lt>1.0.0.009</lt></range>
 </package>
 <package>
	<name>phpAdsNew</name>
	<range><lt>2.0.5</lt></range>
 </package>
 <package>
	<name>phpgroupware</name>
	<range><lt>0.9.16.007</lt></range>
 </package>
 <package>
	<name>b2evolution</name>
	<range><lt>0.9.0.12_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Hardened-PHP Project Security Advisory reports:
	<blockquote cite="http://www.hardened-php.net/advisory_142005.66.html">
	 When the library parses XMLRPC requests/responses, it constructs
	 a string of PHP code, that is later evaluated. This means any
	 failure to properly handle the construction of this string can
	 result in arbitrary execution of PHP code.
	 This new injection vulnerability is cause by not properly
	 handling the situation, when certain XML tags are nested
	 in the parsed document, that were never meant to be nested
	 at all. This can be easily exploited in a way, that
	 user-input is placed outside of string delimiters within
	 the evaluation string, which obviously results in
	 arbitrary code execution.
	</blockquote>
	Note that several applications contains an embedded version
	 on XML_RPC, therefor making them the vulnerable to the same
	 code injection vulnerability.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2498</cvename>
 <url>http://b2evolution.net/news/2005/08/31/fix_for_xml_rpc_vulnerability_again_1</url>
 <url>http://downloads.phpgroupware.org/changelog</url>
 <url>http://drupal.org/files/sa-2005-004/advisory.txt</url>
 <url>http://phpadsnew.com/two/nucleus/index.php?itemid=45</url>
 <url>http://sourceforge.net/project/shownotes.php?release_id=349626</url>
 <url>http://www.hardened-php.net/advisory_142005.66.html</url>
 <url>http://www.hardened-php.net/advisory_152005.67.html</url>
 <url>http://www.phpmyfaq.de/advisory_2005-08-15.php</url>
 </references>
 <dates>
 <discovery>2005-08-15</discovery>
 <entry>2005-08-15</entry>
 <modified>2005-09-04</modified>
 </dates>
 </vuln>

<vuln vid="e86fbb5f-0d04-11da-bc08-0001020eed82">
 <topic>awstats -- arbitrary code execution vulnerability</topic>
 <affects>
 <package>
	<name>awstats</name>
	<range><lt>6.4_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An iDEFENSE Security Advisory reports:
	<blockquote cite="http://www.idefense.com/application/poi/display?id=290&amp;type=vulnerabilities">
	 Remote exploitation of an input validation vulnerability
	 in AWStats allows remote attackers to execute arbitrary
	 commands.

The problem specifically exists because of insufficient
	 input filtering before passing user-supplied data to an
	 <code>eval()</code> function. As part of the statistics
	 reporting function, AWStats displays information about the
	 most common referrer values that caused users to visit the
	 website. The referrer data is used without proper
	 sanitation in an <code>eval()</code> statement, resulting
	 in the execution of arbitrary perl code.

Successful exploitation results in the execution of
	 arbitrary commands with permissions of the web
	 service. Exploitation will not occur until the stats page
	 has been regenerated with the tainted referrer values from
	 the http access log. Note that AWStats is only vulnerable
	 in situations where at least one URLPlugin is enabled.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1527</cvename>
 <mlist msgid="20050811155502.61E3C7A00B4@mail.idefense.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=112377934108902</mlist>
 <url>http://www.idefense.com/application/poi/display?id=290&amp;type=vulnerabilities</url>
 </references>
 <dates>
 <discovery>2005-08-09</discovery>
 <entry>2005-08-14</entry>
 <modified>2005-08-23</modified>
 </dates>
 </vuln>

<vuln vid="3b4a6982-0b24-11da-bc08-0001020eed82">
 <topic>libgadu -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.4.0_1</lt></range>
 </package>
 <package>
	<name>kdenetwork</name>
	<range><gt>3.2.2</gt><lt>3.4.2</lt></range>
 </package>
 <package>
	<name>pl-ekg</name>
	<range><lt>1.6r3,1</lt></range>
 </package>
 <package>
	<name>centericq</name>
	<range><lt>4.21.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Wojtek Kaniewski reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112198499417250">
	 Multiple vulnerabilities have been found in libgadu, a
	 library for handling Gadu-Gadu instant messaging
	 protocol. It is a part of ekg, a Gadu-Gadu client, but is
	 widely used in other clients. Also some of the user
	 contributed scripts were found to behave in an insecure
	 manner.
	 <ul>
	 <li>integer overflow in libgadu (CVE-2005-1852) that could
	 be triggered by an incomming message and lead to
	 application crash and/or remote code execution</li>
	 <li>insecure file creation (CVE-2005-1850) and shell
	 command injection (CVE-2005-1851) in other user
	 contributed scripts (discovered by Marcin Owsiany and
	 Wojtek Kaniewski)</li>
	 <li>several signedness errors in libgadu that could be
	 triggered by an incomming network data or an application
	 passing invalid user input to the library</li>
	 <li>memory alignment errors in libgadu that could be
	 triggered by an incomming message and lead to bus errors
	 on architectures like SPARC</li>
	 <li>endianness errors in libgadu that could cause invalid
	 behaviour of applications on big-endian
	 architectures</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>14345</bid>
 <cvename>CVE-2005-1850</cvename>
 <cvename>CVE-2005-1851</cvename>
 <cvename>CVE-2005-1852</cvename>
 <cvename>CVE-2005-2369</cvename>
 <cvename>CVE-2005-2370</cvename>
 <cvename>CVE-2005-2448</cvename>
 <mlist msgid="42DFF06F.7060005@toxygen.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112198499417250</mlist>
 <url>http://gaim.sourceforge.net/security/?id=20</url>
 <url>http://www.kde.org/info/security/advisory-20050721-1.txt</url>
 </references>
 <dates>
 <discovery>2005-07-21</discovery>
 <entry>2005-08-12</entry>
 <modified>2005-10-23</modified>
 </dates>
 </vuln>

<vuln vid="09db2844-0b21-11da-bc08-0001020eed82">
 <topic>gaim -- AIM/ICQ non-UTF-8 filename crash</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.4.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GAIM team reports:
	<blockquote cite="http://gaim.sourceforge.net/security/?id=21">
	 A remote user could cause Gaim to crash on some systems
	 by sending the Gaim user a file whose filename contains
	 certain invalid characters. It is unknown what combination
	 of systems are affected, but it is suspected that Windows
	 users and systems with older versions of GTK+ are
	 especially susceptible.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2102</cvename>
 <url>http://gaim.sourceforge.net/security/?id=21</url>
 </references>
 <dates>
 <discovery>2005-08-09</discovery>
 <entry>2005-08-12</entry>
 </dates>
 </vuln>

<vuln vid="6d1761d2-0b23-11da-bc08-0001020eed82">
 <topic>gaim -- AIM/ICQ away message buffer overflow</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.4.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GAIM team reports:
	<blockquote cite="http://gaim.sourceforge.net/security/?id=22">
	 A remote AIM or ICQ user can cause a buffer overflow in
	 Gaim by setting an away message containing many AIM
	 substitution strings (such as %t or %n).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2103</cvename>
 <url>http://gaim.sourceforge.net/security/?id=22</url>
 </references>
 <dates>
 <discovery>2005-08-09</discovery>
 <entry>2005-08-12</entry>
 </dates>
 </vuln>

<vuln vid="24eee285-09c7-11da-bc08-0001020eed82">
 <topic>xpdf -- disk fill DoS vulnerability</topic>
 <affects>
 <package>
	<name>xpdf</name>
	<range><lt>3.00_7</lt></range>
 </package>
 <package>
	<name>kdegraphics</name>
	<range><lt>3.4.2</lt></range>
 </package>
 <package>
	<name>gpdf</name>
	<range><lt>2.10.0_2</lt></range>
 </package>
 <package>
	<name>cups-base</name>
	<range><lt>1.1.23.0_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	xpdf is vulnerable to a denial of service vulnerability
	 which can cause xpdf to create an infinitely large file,
	 thereby filling up the /tmp partition, when opening a
	 specially crafted PDF file.
	Note that several applications contains an embedded version
	 of xpdf, therefor making them the vulnerable to the same
	 DoS.	In CUPS this vulnerability would cause the pdftops
	 filter to crash.
 </body>
 </description>
 <references>
 <bid>14529</bid>
 <cvename>CVE-2005-2097</cvename>
 <url>http://rhn.redhat.com/errata/RHSA-2005-670.html</url>
 <url>http://www.kde.org/info/security/advisory-20050809-1.txt</url>
 </references>
 <dates>
 <discovery>2005-08-09</discovery>
 <entry>2005-08-12</entry>
 <modified>2005-09-07</modified>
 </dates>
 </vuln>

<vuln vid="d7cd5015-08c9-11da-bc08-0001020eed82">
 <topic>gforge -- XSS and email flood vulnerabilities</topic>
 <affects>
 <package>
	<name>gforge</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jose Antonio Coret reports that GForge contains multiple
	 Cross Site Scripting vulnerabilities and an e-mail flood
	 vulnerability:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112259845904350">
	 The login form is also vulnerable to XSS (Cross Site
	 Scripting) attacks. This may be used to launch phising
	 attacks by sending HTML e-mails (i.e.: saying that you
	 need to upgrade to the latest GForge version due to a
	 security problem) and putting in the e-mail an HTML link
	 that points to an specially crafted url that inserts an
	 html form in the GForge login page and when the user press
	 the login button, he/she send the credentials to the
	 attackers website.

The 'forgot your password?' feature allows a remote user
	 to load a certain URL to cause the service to send a
	 validation e-mail to the specified user's e-mail address.
	 There is no limit to the number of messages sent over a
	 period of time, so a remote user can flood the target
	 user's secondary e-mail address. E-Mail Flood, E-Mail
	 bomber.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>14405</bid>
 <cvename>CVE-2005-2430</cvename>
 <cvename>CVE-2005-2431</cvename>
 <mlist msgid="1122496636.26878.2.camel@localhost.localdomain">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112259845904350</mlist>
 </references>
 <dates>
 <discovery>2005-07-27</discovery>
 <entry>2005-08-09</entry>
 </dates>
 </vuln>

<vuln vid="0274a9f1-0759-11da-bc08-0001020eed82">
 <topic>postnuke -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>postnuke</name>
	<range><lt>0.760</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Postnuke Security Announcementss reports of the following
	 vulnerabilities:
	<blockquote cite="http://news.postnuke.com/Article2691.html">
	 <ul>
	 <li>missing input validation within /modules/Messages/readpmsg.php</li>
	 <li>possible path disclosure within /user.php</li>
	 <li>possible path disclosure within /modules/News/article.php</li>
	 <li>possible remote code injection within /includes/pnMod.php</li>
	 <li>possible cross-site-scripting in /index.php</li>
	 </ul>
	</blockquote>
	<blockquote cite="http://news.postnuke.com/Article2699.html">
	 <ul>
	 <li>remote code injection via xml rpc library</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1621</cvename>
 <cvename>CVE-2005-1695</cvename>
 <cvename>CVE-2005-1696</cvename>
 <cvename>CVE-2005-1698</cvename>
 <cvename>CVE-2005-1777</cvename>
 <cvename>CVE-2005-1778</cvename>
 <cvename>CVE-2005-1921</cvename>
 <mlist msgid="20050527223753.21735.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111721364707520</mlist>
 <url>http://secunia.com/advisories/15450/</url>
 <url>http://news.postnuke.com/Article2691.html</url>
 <url>http://news.postnuke.com/Article2699.html</url>
 </references>
 <dates>
 <discovery>2005-05-27</discovery>
 <entry>2005-08-08</entry>
 </dates>
 </vuln>

<vuln vid="0bf9d7fb-05b3-11da-bc08-0001020eed82">
 <topic>mambo -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mambo</name>
	<range><lt>4.5.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/15710/">
	 Some vulnerabilities have been reported in Mambo, where
	 some have unknown impacts and others can be exploited by
	 malicious people to conduct spoofing and SQL injection
	 attacks.
	 <ol>
	 <li>Input passed to the "user_rating" parameter when
	 voting isn't properly sanitised before being used in a
	 SQL query. This can be exploited to manipulate SQL
	 queries by injecting arbitrary SQL code.</li>
	 <li>Some unspecified vulnerabilities in the "mosDBTable"
	 class and the "DOMIT" library have an unknown
	 impact.</li>
	 <li>An unspecified error in the "administrator/index3.php"
	 script can be exploited to spoof session IDs.</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13966</bid>
 <cvename>CVE-2005-2002</cvename>
 <url>http://secunia.com/advisories/15710/</url>
 </references>
 <dates>
 <discovery>2005-06-15</discovery>
 <entry>2005-08-05</entry>
 </dates>
 </vuln>

<vuln vid="2b6e47b1-0598-11da-86bc-000e0c2e438a">
 <topic>ipsec -- Incorrect key usage in AES-XCBC-MAC</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_6</lt></range>
	<range><ge>5.*</ge><lt>5.3_20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem description</h1>
	A programming error in the implementation of the
	 AES-XCBC-MAC algorithm for authentication resulted in a
	 constant key being used instead of the key specified by the
	 system administrator.
	<h1>Impact</h1>
	If the AES-XCBC-MAC algorithm is used for authentication in
	 the absence of any encryption, then an attacker may be able to
	 forge packets which appear to originate from a different
	 system and thereby succeed in establishing an IPsec session.
	 If access to sensitive information or systems is controlled
	 based on the identity of the source system, this may result
	 in information disclosure or privilege escalation.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2359</cvename>
 <freebsdsa>SA-05:19.ipsec</freebsdsa>
 </references>
 <dates>
 <discovery>2005-07-27</discovery>
 <entry>2005-08-05</entry>
 </dates>
 </vuln>

<vuln vid="837b9fb2-0595-11da-86bc-000e0c2e438a">
 <topic>zlib -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>linux_base-suse</name>
	<range><lt>9.3_1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_6</lt></range>
	<range><ge>5.3</ge><lt>5.3_20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem description</h1>
	A fixed-size buffer is used in the decompression of data
	 streams. Due to erronous analysis performed when zlib was
	 written, this buffer, which was belived to be sufficiently
	 large to handle any possible input stream, is in fact too
	 small.
	<h1>Impact</h1>
	A carefully constructed compressed data stream can result in
	 zlib overwriting some data structures. This may cause
	 applications to halt, resulting in a denial of service; or
	 it may result in an attacker gaining elevated privileges.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1849</cvename>
 <freebsdsa>SA-05:18.zlib</freebsdsa>
 </references>
 <dates>
 <discovery>2005-07-27</discovery>
 <entry>2005-08-05</entry>
 <modified>2005-09-24</modified>
 </dates>
 </vuln>

<vuln vid="7257b26f-0597-11da-86bc-000e0c2e438a">
 <topic>devfs -- ruleset bypass</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_5</lt></range>
	<range><ge>5.*</ge><lt>5.3_19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem description</h1>
	Due to insufficient parameter checking of the node type
	 during device creation, any user can expose hidden device
	 nodes on devfs mounted file systems within their jail.
	 Device nodes will be created in the jail with their normal
	 default access permissions.
	<h1>Impact</h1>
	Jailed processes can get access to restricted resources on
	 the host system. For jailed processes running with superuser
	 privileges this implies access to all devices on the system.
	 This level of access can lead to information leakage and
	 privilege escalation.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2218</cvename>
 <freebsdsa>SA-05:17.devfs</freebsdsa>
 </references>
 <dates>
 <discovery>2005-07-20</discovery>
 <entry>2005-08-05</entry>
 </dates>
 </vuln>

<vuln vid="c28f4705-043f-11da-bc08-0001020eed82">
 <topic>proftpd -- format string vulnerabilities</topic>
 <affects>
 <package>
	<name>proftpd</name>
	<name>proftpd-mysql</name>
	<range><lt>1.3.0.rc2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The ProFTPD release notes states:
	<blockquote cite="http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2">
	 sean &lt;infamous42md at hotpop.com&gt; found two format
	 string vulnerabilities, one in mod_sql's SQLShowInfo
	 directive, and one involving the 'ftpshut' utility. Both
	 can be considered low risk, as they require active
	 involvement on the part of the site administrator in order
	 to be exploited.
	</blockquote>
	These vulnerabilities could potentially lead to information
	 disclosure, a denial-of-server situation, or execution of
	 arbitrary code with the permissions of the user running
	 ProFTPD.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2390</cvename>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml</url>
 <url>http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2</url>
 </references>
 <dates>
 <discovery>2005-07-26</discovery>
 <entry>2005-08-03</entry>
 </dates>
 </vuln>

<vuln vid="debbb39c-fdb3-11d9-a30d-00b0d09acbfc">
 <topic>nbsmtp -- format string vulnerability</topic>
 <affects>
 <package>
	<name>nbsmtp</name>
	<range><lt>0.99_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	When nbsmtp is executed in debug mode, server messages
	will be printed to stdout and logged via syslog. Syslog is
	used insecurely and user-supplied format characters are
	directly fed to the syslog function, which results in a
	format string vulnerability.
	Under some circumstances, an SMTP server may be able to
	abuse this vulnerability in order to alter the nbsmtp
	process and execute malicious code.
 </body>
 </description>
 <references>
 <url>http://people.freebsd.org/~niels/issues/nbsmtp-20050726.txt</url>
 </references>
 <dates>
 <discovery>2005-07-25</discovery>
 <entry>2005-08-01</entry>
 </dates>
 </vuln>

<vuln vid="b1e8c810-01d0-11da-bc08-0001020eed82">
 <topic>sylpheed -- MIME-encoded file name buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>sylpheed</name>
	<name>sylpheed-gtk2</name>
	<name>sylpheed-claws</name>
	<range><lt>1.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sylpheed is vulnerable to a buffer overflow when displaying
	 emails with attachments that have MIME-encoded file names.
	 This could be used by a remote attacker to crash sylpheed
	 potentially allowing execution of arbitrary code with the
	 permissions of the user running sylpheed.
 </body>
 </description>
 <references>
 <bid>12934</bid>
 <cvename>CVE-2005-0926</cvename>
 <url>http://sylpheed.good-day.net/changelog.html.en</url>
 </references>
 <dates>
 <discovery>2005-03-29</discovery>
 <entry>2005-07-31</entry>
 </dates>
 </vuln>

<vuln vid="58247a96-01c8-11da-bc08-0001020eed82">
 <topic>phpmyadmin -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<name>phpMyAdmin</name>
	<range><lt>2.6.2.r1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A phpMyAdmin security announcement reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3">
	 The convcharset parameter was not correctly validated,
	 opening the door to a XSS attack.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12982</bid>
 <cvename>CVE-2005-0992</cvename>
 <mlist msgid="4f9e4516050404101223fbdeed@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111264361622660</mlist>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3</url>
 </references>
 <dates>
 <discovery>2005-04-03</discovery>
 <entry>2005-07-31</entry>
 </dates>
 </vuln>

<vuln vid="8375a73f-01bf-11da-bc08-0001020eed82">
 <topic>gnupg -- OpenPGP symmetric encryption vulnerability</topic>
 <affects>
 <package>
	<name>gnupg</name>
	<range><lt>1.4.1</lt></range>
 </package>
 <package>
	<name>p5-Crypt-OpenPGP</name>
	<range><le>1.03</le></range>
 </package>
 <package>
	<name>pgp</name>
	<range><ge>3.0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Serge Mister and Robert Zuccherato reports that the OpenPGP
	 protocol is vulnerable to a cryptographic attack when using
	 symmetric encryption in an automated way.
	David Shaw reports about the impact:
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html">
	 This attack, while very significant from a cryptographic
	 point of view, is not generally effective in the real
	 world. To be specific, unless you have your OpenPGP
	 program set up as part of an automated system to accept
	 encrypted messages, decrypt them, and then provide a
	 response to the submitter, then this does not affect you
	 at all.
	</blockquote>
	Note that the <q>fix</q> in GnuPG does note completely
	 eliminate the potential problem:
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html">
	 These patches disable a portion of the OpenPGP protocol
	 that the attack is exploiting. This change should not be
	 user visible. With the patch in place, this attack will
	 not work using a public-key encrypted message. It will
	 still work using a passphrase-encrypted message.
	</blockquote>
 </body>
 </description>
 <references>
 <certvu>303094</certvu>
 <cvename>CVE-2005-0366</cvename>
 <url>http://eprint.iacr.org/2005/033</url>
 <url>http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html</url>
 <url>http://www.pgp.com/newsroom/ctocorner/openpgp.html</url>
 </references>
 <dates>
 <discovery>2005-02-08</discovery>
 <entry>2005-07-31</entry>
 <modified>2007-04-23</modified>
 </dates>
 </vuln>

<vuln vid="81f127a8-0038-11da-86bc-000e0c2e438a">
 <topic>vim -- vulnerabilities in modeline handling: glob, expand</topic>
 <affects>
 <package>
	<name>vim</name>
	<name>vim-console</name>
	<name>vim-lite</name>
	<name>vim+ruby</name>
	<range><ge>6.3</ge><lt>6.3.82</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Georgi Guninski discovered a way to construct Vim modelines
	 that execute arbitrary shell commands. The vulnerability
	 can be exploited by including shell commands in modelines
	 that call the glob() or expand() functions. An attacker
	 could trick an user to read or edit a trojaned file with
	 modelines enabled, after which the attacker is able to
	 execute arbitrary commands with the privileges of the user.
	Note: It is generally recommended that VIM
	 users use <code>set nomodeline</code> in
	 <code>~/.vimrc</code> to avoid the possibility of trojaned
	 text files.
 </body>
 </description>
 <references>
 <bid>14374</bid>
 <cvename>CVE-2005-2368</cvename>
 <url>http://www.guninski.com/where_do_you_want_billg_to_go_today_5.html</url>
 </references>
 <dates>
 <discovery>2005-07-25</discovery>
 <entry>2005-07-31</entry>
 </dates>
 </vuln>

<vuln vid="68222076-010b-11da-bc08-0001020eed82">
 <topic>tiff -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>tiff</name>
	<range><lt>3.7.3</lt></range>
 </package>
 <package>
	<name>linux-tiff</name>
	<range><lt>3.6.1_3</lt></range>
 </package>
 <package>
	<name>pdflib</name>
	<name>pdflib-perl</name>
	<range><lt>6.0.1_2</lt></range>
 </package>
 <package>
	<name>gdal</name>
	<range><lt>1.2.1_2</lt></range>
 </package>
 <package>
	<name>ivtools</name>
	<range><lt>1.2.3</lt></range>
 </package>
 <package>
	<name>paraview</name>
	<range><lt>2.4.3</lt></range>
 </package>
 <package>
	<name>fractorama</name>
	<range><lt>1.6.7_1</lt></range>
 </package>
 <package>
	<name>iv</name>
	<name>ja-iv</name>
	<name>ja-libimg</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Gentoo Linux Security Advisory reports:
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-07.xml">
	 Tavis Ormandy of the Gentoo Linux Security Audit Team
	 discovered a stack based buffer overflow in the libTIFF
	 library when reading a TIFF image with a malformed
	 BitsPerSample tag.
	 Successful exploitation would require the victim to open
	 a specially crafted TIFF image, resulting in the execution
	 of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1544</cvename>
 <url>http://bugzilla.remotesensing.org/show_bug.cgi?id=843</url>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200505-07.xml</url>
 <url>http://www.remotesensing.org/libtiff/v3.7.3.html</url>
 </references>
 <dates>
 <discovery>2005-05-10</discovery>
 <entry>2005-07-30</entry>
 <modified>2006-06-08</modified>
 </dates>
 </vuln>

<vuln vid="934b1de4-00d7-11da-bc08-0001020eed82">
 <topic>opera -- image dragging vulnerability</topic>
 <affects>
 <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><lt>8.02</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/15756/">
	 Secunia Research has discovered a vulnerability in Opera,
	 which can be exploited by malicious people to conduct
	 cross-site scripting attacks and retrieve a user's
	 files.
	 The vulnerability is caused due to Opera allowing a user
	 to drag e.g. an image, which is actually a "javascript:"
	 URI, resulting in cross-site scripting if dropped over
	 another site. This may also be used to populate a file
	 upload form, resulting in uploading of arbitrary files to
	 a malicious web site.
	 Successful exploitation requires that the user is tricked
	 into dragging and dropping e.g. an image or a link.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/15756/</url>
 <url>http://www.opera.com/freebsd/changelogs/802/</url>
 </references>
 <dates>
 <discovery>2005-07-28</discovery>
 <entry>2005-07-30</entry>
 <modified>2006-06-08</modified>
 </dates>
 </vuln>

<vuln vid="a2aa24fd-00d4-11da-bc08-0001020eed82">
 <topic>opera -- download dialog spoofing vulnerability</topic>
 <affects>
 <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><lt>8.02</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/15870/">
	 Secunia Research has discovered a vulnerability in Opera,
	 which can be exploited by malicious people to trick users
	 into executing malicious files.
	 The vulnerability is caused due to an error in the
	 handling of extended ASCII codes in the download
	 dialog. This can be exploited to spoof the file extension
	 in the file download dialog via a specially crafted
	 "Content-Disposition" HTTP header.
	 Successful exploitation may result in users being tricked
	 into executing a malicious file via the download dialog,
	 but requires that the "Arial Unicode MS" font
	 (ARIALUNI.TTF) has been installed on the system.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/15870/</url>
 <url>http://www.opera.com/freebsd/changelogs/802/</url>
 </references>
 <dates>
 <discovery>2005-07-28</discovery>
 <entry>2005-07-30</entry>
 </dates>
 </vuln>

<vuln vid="5d51d245-00ca-11da-bc08-0001020eed82">
 <topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
 <affects>
 <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.8.5</ge><lt>0.10.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An Ethreal Security Advisories reports:
	<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00020.html">
	 Our testing program has turned up several more security
	 issues:
	 <ul>
	 <li>The LDAP dissector could free static memory and crash.</li>
	 <li>The AgentX dissector could crash.</li>
	 <li>The 802.3 dissector could go into an infinite loop.</li>
	 <li>The PER dissector could abort.</li>
	 <li>The DHCP dissector could go into an infinite loop.</li>
	 <li>The BER dissector could abort or loop infinitely.</li>
	 <li>The MEGACO dissector could go into an infinite loop.</li>
	 <li>The GIOP dissector could dereference a null pointer.</li>
	 <li>The SMB dissector was susceptible to a buffer overflow.</li>
	 <li>The WBXML could dereference a null pointer.</li>
	 <li>The H1 dissector could go into an infinite loop.</li>
	 <li>The DOCSIS dissector could cause a crash.</li>
	 <li>The SMPP dissector could go into an infinite loop.</li>
	 <li>SCTP graphs could crash.</li>
	 <li>The HTTP dissector could crash.</li>
	 <li>The SMB dissector could go into a large loop.</li>
	 <li>The DCERPC dissector could crash.</li>
	 <li>Several dissectors could crash while reassembling packets.</li>
	 </ul>
	 Steve Grubb at Red Hat found the following issues:
	 <ul>
	 <li>The CAMEL dissector could dereference a null pointer.</li>
	 <li>The DHCP dissector could crash.</li>
	 <li>The CAMEL dissector could crash.</li>
	 <li>The PER dissector could crash.</li>
	 <li>The RADIUS dissector could crash.</li>
	 <li>The Telnet dissector could crash.</li>
	 <li>The IS-IS LSP dissector could crash.</li>
	 <li>The NCP dissector could crash.</li>
	 </ul>
	 iDEFENSE found the following issues:
	 <ul>
	 <li>Several dissectors were susceptible to a format string
	 overflow.</li>
	 </ul>
	 <h1>Impact:</h1>
	 It may be possible to make Ethereal crash, use up
	 available memory, or run arbitrary code by injecting a
	 purposefully malformed packet onto the wire or by
	 convincing someone to read a malformed packet trace
	 file.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.ethereal.com/appnotes/enpa-sa-00020.html</url>
 </references>
 <dates>
 <discovery>2005-07-26</discovery>
 <entry>2005-07-30</entry>
 </dates>
 </vuln>

<vuln vid="651996e0-fe07-11d9-8329-000e0c2e438a">
 <topic>apache -- http request smuggling</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><lt>1.3.33_2</lt></range>
	<range><gt>2.*</gt><lt>2.0.54_1</lt></range>
	<range><gt>2.1.0</gt><lt>2.1.6_1</lt></range>
 </package>
 <package>
	<name>apache+ssl</name>
	<range><lt>1.3.33.1.55_1</lt></range>
 </package>
 <package>
	<name>apache+mod_perl</name>
	<range><lt>1.3.33_3</lt></range>
 </package>
 <package>
	<name>apache+mod_ssl</name>
	<name>apache+mod_ssl+ipv6</name>
	<name>apache+mod_ssl+mod_accel</name>
	<name>apache+mod_ssl+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_deflate</name>
	<name>apache+mod_ssl+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
	<range><lt>1.3.33+2.8.22_1</lt></range>
 </package>
 <package>
	<name>apache_fp</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>apache+ipv6</name>
	<range><lt>1.3.37</lt></range>
 </package>
 <package>
	<name>ru-apache</name>
	<range><lt>1.3.34+30.22</lt></range>
 </package>
 <package>
	<name>ru-apache+mod_ssl</name>
	<range><lt>1.3.34+30.22+2.8.25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Watchfire whitepaper reports an vulnerability in the
	 Apache webserver. The vulnerability can be exploited by
	 malicious people causing cross site scripting, web cache
	 poisoining, session hijacking and most importantly the
	 ability to bypass web application firewall protection.
	 Exploiting this vulnerability requires multiple carefully
	 crafted HTTP requests, taking advantage of an caching server,
	 proxy server, web application firewall etc. This only affects
	 installations where Apache is used as HTTP proxy in
	 combination with the following web servers:
	<ul>
	 <li>IIS/6.0 and 5.0</li>
	 <li>Apache 2.0.45 (as web server)</li>
	 <li>apache 1.3.29</li>
	 <li>WebSphere 5.1 and 5.0</li>
	 <li>WebLogic 8.1 SP1</li>
	 <li>Oracle9iAS web server 9.0.2</li>
	 <li>SunONE web server 6.1 SP4</li>
	</ul>
 </body>
 </description>
 <references>
 <bid>14106</bid>
 <cvename>CVE-2005-2088</cvename>
 <url>http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf</url>
 </references>
 <dates>
 <discovery>2005-07-25</discovery>
 <entry>2005-07-26</entry>
 <modified>2009-01-23</modified>
 </dates>
 </vuln>

<vuln vid="1db7ecf5-fd24-11d9-b4d6-0007e900f87b">
 <topic>clamav -- multiple remote buffer overflows</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.86.2</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><le>20050704</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/16180/">
	 Neel Mehta and Alex Wheeler have reported some
	 vulnerabilities in Clam AntiVirus, which can be exploited
	 by malicious people to cause a DoS (Denial of Service)
	 or compromise a vulnerable system.
	 <ol>
	 <li>Two integer overflow errors in "libclamav/tnef.c"
	 when processing TNEF files can be exploited to cause
	 a heap-based buffer overflow via a specially crafted
	 TNEF file with a length value of -1 in the header.</li>
	 <li>An integer overflow error in "libclamav/chmunpack.c"
	 can be exploited to cause a heap-based buffer overflow
	 via a specially crafted CHM file with a chunk entry that
	 has a filename length of -1.</li>
	 <li>A boundary error in "libclamav/fsg.c" when
	 processing a FSG compressed file can cause a heap-based
	 buffer overflow.</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.rem0te.com/public/images/clamav.pdf</url>
 <url>http://secunia.com/advisories/16180/</url>
 </references>
 <dates>
 <discovery>2005-07-24</discovery>
 <entry>2005-07-25</entry>
 </dates>
 </vuln>

<vuln vid="ccd325d2-fa08-11d9-bc08-0001020eed82">
 <topic>isc-dhcpd -- format string vulnerabilities</topic>
 <affects>
 <package>
	<name>isc-dhcp3-client</name>
	<name>isc-dhcp3-devel</name>
	<name>isc-dhcp3-relay</name>
	<name>isc-dhcp3-server</name>
	<name>isc-dhcp3</name>
	<name>isc-dhcp</name>
	<name>isc-dhcpd</name>
	<range><lt>3.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The ISC DHCP programs are vulnerable to several format
	 string vulnerabilities which may allow a remote attacker to
	 execute arbitrary code with the permissions of the DHCP
	 programs, typically root for the DHCP server.
 </body>
 </description>
 <references>
 <bid>11591</bid>
 <certvu>448384</certvu>
 <cvename>CVE-2004-1006</cvename>
 <mlist msgid="20041109003345.GG763@isc.org">http://marc.theaimsgroup.com/?l=dhcp-announce&amp;m=109996073218290</mlist>
 </references>
 <dates>
 <discovery>2004-11-08</discovery>
 <entry>2005-07-23</entry>
 </dates>
 </vuln>

<vuln vid="b4892b5b-fb1c-11d9-96ba-00909925db3e">
 <topic>egroupware -- multiple cross-site scripting (XSS) and SQL injection vulnerabilities</topic>
 <affects>
 <package>
	<name>egroupware</name>
	<range><lt>1.0.0.007</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple cross-site scripting (XSS) vulnerabilities in eGroupware
	 before 1.0.0.007 allow remote attackers to inject arbitrary web
	 script or HTML via the (1) ab_id, (2) page, (3) type,
	 or (4) lang parameter to index.php or (5) category_id parameter.
	
	Multiple SQL injection vulnerabilities in index.php in eGroupware
	 before 1.0.0.007 allow remote attackers to execute arbitrary SQL
	 commands via the (1) filter or (2) cats_app parameter.
	
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1202</cvename>
 <cvename>CVE-2005-1203</cvename>
 <url>http://sourceforge.net/project/shownotes.php?release_id=320768</url>
 </references>
 <dates>
 <discovery>2005-04-20</discovery>
 <entry>2005-07-23</entry>
 </dates>
 </vuln>

<vuln vid="3f4ac724-fa8b-11d9-afcf-0060084a00e5">
 <topic>fetchmail -- denial of service/crash from malicious POP3 server</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><eq>6.2.5.1</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	In fetchmail 6.2.5.1, the remote code injection via
	 POP3 UIDL was fixed, but a denial of service attack was
	 introduced:
	Two possible NULL-pointer dereferences allow a malicious
	 POP3 server to crash fetchmail by respondig with UID lines
	 containing only the article number but no UID (in violation
	 of RFC-1939), or a message without Message-ID when no UIDL
	 support is available.
 </body>
 </description>
 <references>
 <mlist msgid="20050721172317.GB3071@amilo.ms.mff.cuni.cz">http://lists.berlios.de/pipermail/fetchmail-devel/2005-July/000397.html</mlist>
 <url>http://www.fetchmail.info/fetchmail-SA-2005-01.txt</url>
 </references>
 <dates>
 <discovery>2005-07-21</discovery>
 <entry>2005-07-22</entry>
 </dates>
 </vuln>

<vuln vid="e72fd82b-fa01-11d9-bc08-0001020eed82">
 <topic>dnrd -- remote buffer and stack overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>dnrd</name>
	<range><lt>2.19.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Natanael Copa reports that dnrd is vulnerable to a remote
	 buffer overflow and a remote stack overflow.	These
	 vulnerabilities can be triggered by sending invalid DNS
	 packets to dnrd.
	The buffer overflow could potentially be used to execute
	 arbitrary code with the permissions of the dnrd daemon.
	 Note that dnrd runs in an chroot environment and runs as
	 non-root.
	The stack overflow vulnerability can cause dnrd to
	 crash.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2315</cvename>
 <cvename>CVE-2005-2316</cvename>
 <freebsdpr>ports/83851</freebsdpr>
 </references>
 <dates>
 <discovery>2005-07-21</discovery>
 <entry>2005-07-21</entry>
 </dates>
 </vuln>

<vuln vid="43a7b0a7-f9bc-11d9-b473-00061bc2ad93">
 <topic>PowerDNS -- LDAP backend fails to escape all queries</topic>
 <affects>
 <package>
	<name>powerdns</name>
	<range><lt>2.9.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The LDAP backend in PowerDNS has issues with escaping
	 queries which could cause connection errors.	This would
	 make it possible for a malicious user to temporarily blank
	 domains.
	<blockquote cite="http://doc.powerdns.com/security-policy.html">
	This is known to affect all releases prior to 2.9.18.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2302</cvename>
 <url>http://doc.powerdns.com/security-policy.html</url>
 <url>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112155941310297&amp;w=2</url>
 </references>
 <dates>
 <discovery>2005-07-16</discovery>
 <entry>2005-07-21</entry>
 </dates>
 </vuln>

<vuln vid="3497d7be-2fef-45f4-8162-9063751b573a">
 <topic>fetchmail -- remote root/code injection from malicious POP3 server</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><lt>6.2.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	fetchmail's POP3/UIDL code does not truncate received UIDs properly.
	 A malicious or compromised POP3 server can thus corrupt fetchmail's
	 stack and inject code when fetchmail is using UIDL, either through
	 configuration, or as a result of certain server capabilities. Note
	 that fetchmail is run as root on some sites, so an attack might
	 compromise the root account and thus the whole machine.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2335</cvename>
 <freebsdpr>ports/83805</freebsdpr>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=212762</url>
 <url>http://www.fetchmail.info/fetchmail-SA-2005-01.txt</url>
 </references>
 <dates>
 <discovery>2005-07-20</discovery>
 <entry>2005-07-20</entry>
 <modified>2005-07-21</modified>
 </dates>
 </vuln>

<vuln vid="2e116ba5-f7c3-11d9-928e-000b5d7e6dd5">
 <topic>kdebase -- Kate backup file permission leak</topic>
 <affects>
 <package>
	<name>kdebase</name>
	<range><ge>3.2.0</ge><lt>3.4.1</lt></range>
 </package>
 <package>
	<name>linux_base-suse</name>
	<range><ge>9.3</ge><lt>9.3_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A KDE Security Advisory explains:
	<blockquote cite="http://www.kde.org/info/security/advisory-20050718-1.txt">
	 Kate / Kwrite create a file backup before saving a modified
	 file. These backup files are created with default permissions,
	 even if the original file had more strict permissions set.
	 Depending on the system security settings, backup files
	 might be readable by other users. Kate / Kwrite are
	 network transparent applications and therefore this
	 vulnerability might not be restricted to local users.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1920</cvename>
 <url>https://bugs.kde.org/show_bug.cgi?id=103331</url>
 <url>http://www.kde.org/info/security/advisory-20050718-1.txt</url>
 </references>
 <dates>
 <discovery>2005-07-18</discovery>
 <entry>2005-07-18</entry>
 <modified>2005-10-09</modified>
 </dates>
 </vuln>

<vuln vid="5d72701a-f601-11d9-bcd1-02061b08fc24">
 <topic>firefox &amp; mozilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.5,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.0.5</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.9,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.9</lt></range>
	<range><ge>1.8.*</ge></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla Foundation reports of multiple security
	 vulnerabilities in Firefox and Mozilla:
	<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
	 <ul>
	 <li>MFSA 2005-56 Code execution through shared function
	 objects</li>
	 <li>MFSA 2005-55 XHTML node spoofing</li>
	 <li>MFSA 2005-54 Javascript prompt origin spoofing</li>
	 <li>MFSA 2005-53 Standalone applications can run arbitrary
	 code through the browser</li>
	 <li>MFSA 2005-52 Same origin violation: frame calling
	 top.focus()</li>
	 <li>MFSA 2005-51 The return of frame-injection
	 spoofing</li>
	 <li>MFSA 2005-50 Possibly exploitable crash in
	 InstallVersion.compareTo()</li>
	 <li>MFSA 2005-49 Script injection from Firefox sidebar
	 panel using data:</li>
	 <li>MFSA 2005-48 Same-origin violation with InstallTrigger
	 callback</li>
	 <li>MFSA 2005-47 Code execution via "Set as
	 Wallpaper"</li>
	 <li>MFSA 2005-46 XBL scripts ran even when Javascript
	 disabled</li>
	 <li>MFSA 2005-45 Content-generated event
	 vulnerabilities</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1937</cvename>
 <cvename>CVE-2005-2260</cvename>
 <cvename>CVE-2005-2261</cvename>
 <cvename>CVE-2005-2262</cvename>
 <cvename>CVE-2005-2263</cvename>
 <cvename>CVE-2005-2264</cvename>
 <cvename>CVE-2005-2265</cvename>
 <cvename>CVE-2005-2266</cvename>
 <cvename>CVE-2005-2267</cvename>
 <cvename>CVE-2005-2268</cvename>
 <cvename>CVE-2005-2269</cvename>
 <cvename>CVE-2005-2270</cvename>
 <url>http://www.mozilla.org/projects/security/known-vulnerabilities.html</url>
 <url>http://www.mozilla.org/security/announce/mfsa2005-45.html</url>
 <url>http://www.mozilla.org/security/announce/mfsa2005-46.html</url>
 <url>http://www.mozilla.org/security/announce/mfsa2005-47.html</url>
 <url>http://www.mozilla.org/security/announce/mfsa2005-48.html</url>
 <url>http://www.mozilla.org/security/announce/mfsa2005-49.html</url>
 <url>http://www.mozilla.org/security/announce/mfsa2005-50.html</url>
 <url>http://www.mozilla.org/security/announce/mfsa2005-51.html</url>
 <url>http://www.mozilla.org/security/announce/mfsa2005-52.html</url>
 <url>http://www.mozilla.org/security/announce/mfsa2005-53.html</url>
 <url>http://www.mozilla.org/security/announce/mfsa2005-54.html</url>
 <url>http://www.mozilla.org/security/announce/mfsa2005-55.html</url>
 <url>http://www.mozilla.org/security/announce/mfsa2005-56.html</url>
 </references>
 <dates>
 <discovery>2005-07-12</discovery>
 <entry>2005-07-16</entry>
 </dates>
 </vuln>

<vuln vid="f241641e-f5ea-11d9-a6db-000d608ed240">
 <topic>drupal -- PHP code execution vulnerabilities</topic>
 <affects>
 <package>
	<name>drupal</name>
	<range><lt>4.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kuba Zygmunt discovered a flaw in the input validation routines
	 of Drupal's filter mechanism. An attacker could execute
	 arbitrary PHP code on a target site when public comments or
	 postings are allowed.
 </body>
 </description>
 <references>
	<cvename>CVE-2005-1921</cvename>
	<cvename>CVE-2005-2106</cvename>
	<url>http://drupal.org/files/sa-2005-002/advisory.txt</url>
 </references>
 <dates>
 <discovery>2005-06-29</discovery>
 <entry>2005-07-16</entry>
 </dates>
 </vuln>

<vuln vid="50457509-d05e-11d9-9aed-000e0c2e438a">
 <topic>phpSysInfo -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>phpSysInfo</name>
	<range><lt>2.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Securityreason.com advisory reports that various cross
	 site scripting vulnerabilities have been found in phpSysInfo.
	 Input is not properly sanitised before it is returned to the
	 user. A malicious person could exploit this to execute
	 arbitrary HTML and script code in a users browser session.
	 Also it is possible to view the full path of certain scripts
	 by accessing them directly.
 </body>
 </description>
 <references>
 <bid>12887</bid>
 <cvename>CVE-2005-0869</cvename>
 <cvename>CVE-2005-0870</cvename>
 <mlist msgid="20050323180207.11987.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111161017209422</mlist>
 </references>
 <dates>
 <discovery>2005-03-22</discovery>
 <entry>2005-07-09</entry>
 <modified>2005-12-25</modified>
 </dates>
 </vuln>

<vuln vid="eeae6cce-d05c-11d9-9aed-000e0c2e438a">
 <topic>mysql-server -- insecure temporary file creation</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><gt>4.1</gt><lt>4.1.12</lt></range>
	<range><gt>5.0</gt><lt>5.0.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Zataz advisory reports that MySQL contains a security
	 flaw which could allow a malicious local user to inject
	 arbitrary SQL commands during the initial database creation
	 process.
	The problem lies in the mysql_install_db script which
	 creates temporary files based on the PID used by the
	 script.
 </body>
 </description>
 <references>
 <bid>13660</bid>
 <cvename>CVE-2005-1636</cvename>
 <url>http://www.zataz.net/adviso/mysql-05172005.txt</url>
 </references>
 <dates>
 <discovery>2005-05-07</discovery>
 <entry>2005-07-09</entry>
 </dates>
 </vuln>

<vuln vid="3e0072d4-d05b-11d9-9aed-000e0c2e438a">
 <topic>net-snmp -- fixproc insecure temporary file creation</topic>
 <affects>
 <package>
	<name>net-snmp</name>
	<range><lt>5.2.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Gentoo advisory reports:
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-18.xml">
	 Net-SNMP creates temporary files in an insecure manner,
	 possibly allowing the execution of arbitrary code.
	 A malicious local attacker could exploit a race condition
	 to change the content of the temporary files before they
	 are executed by fixproc, possibly leading to the execution
	 of arbitrary code.	A local attacker could also create
	 symbolic links in the temporary files directory, pointing
	 to a valid file somewhere on the filesystem. When fixproc
	 is executed, this would result in the file being
	 overwritten.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13715</bid>
 <cvename>CVE-2005-1740</cvename>
 <url>http://security.gentoo.org/glsa/glsa-200505-18.xml</url>
 </references>
 <dates>
 <discovery>2005-05-23</discovery>
 <entry>2005-07-09</entry>
 <modified>2005-07-13</modified>
 </dates>
 </vuln>

<vuln vid="326c517a-d029-11d9-9aed-000e0c2e438a">
 <topic>phpbb -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>phpbb</name>
	<range><lt>2.0.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	phpBB is vulnerable to remote exploitation of an input
	 validation vulnerability allows attackers to read the
	 contents of arbitrary system files under the privileges
	 of the webserver. This also allows remote attackers to
	 unlink arbitrary system files under the privileges of the
	 webserver.
 </body>
 </description>
 <references>
 <bid>12618</bid>
 <bid>12621</bid>
 <bid>12623</bid>
 <cvename>CVE-2005-0258</cvename>
 <cvename>CVE-2005-0259</cvename>
 <url>http://security.gentoo.org/glsa/glsa-200503-02.xml</url>
 <url>http://www.idefense.com/application/poi/display?id=205&amp;type=vulnerabilities</url>
 <url>http://www.idefense.com/application/poi/display?id=204&amp;type=vulnerabilities</url>
 </references>
 <dates>
 <discovery>2005-02-22</discovery>
 <entry>2005-07-09</entry>
 </dates>
 </vuln>

<vuln vid="6596bb80-d026-11d9-9aed-000e0c2e438a">
 <topic>shtool -- insecure temporary file creation</topic>
 <affects>
 <package>
	<name>shtool</name>
	<range><le>2.0.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Zataz advisory reports that shtool contains a security
	 flaw which could allow a malicious local user to create or
	 overwrite the contents of arbitrary files. The attacker
	 could fool a user into executing the arbitrary file possibly
	 executing arbitrary code.
 </body>
 </description>
 <references>
 <bid>13767</bid>
 <url>http://www.zataz.net/adviso/shtool-05252005.txt</url>
 </references>
 <dates>
 <discovery>2005-05-25</discovery>
 <entry>2005-07-09</entry>
 </dates>
 </vuln>

<vuln vid="88188a8c-eff6-11d9-8310-0001020eed82">
 <topic>phppgadmin -- "formLanguage" local file inclusion vulnerability</topic>
 <affects>
 <package>
	<name>phppgadmin</name>
	<range><lt>3.5.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/15941/">
	 A vulnerability has been reported in phpPgAdmin, which
	 can be exploited by malicious people to disclose sensitive
	 information.
	 Input passed to the "formLanguage" parameter in
	 "index.php" isn't properly verified, before it is used to
	 include files. This can be exploited to include arbitrary
	 files from local resources.
	 Successful exploitation requires that "magic_quotes_gpc"
	 is disabled.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>14142</bid>
 <cvename>CVE-2005-2256</cvename>
 <url>http://secunia.com/advisories/15941/</url>
 <url>http://sourceforge.net/project/shownotes.php?release_id=342261</url>
 </references>
 <dates>
 <discovery>2005-07-05</discovery>
 <entry>2005-07-08</entry>
 <modified>2005-07-21</modified>
 </dates>
 </vuln>

<vuln vid="b64481d9-eff4-11d9-8310-0001020eed82">
 <topic>pear-XML_RPC -- information disclosure vulnerabilities</topic>
 <affects>
 <package>
	<name>pear-XML_RPC</name>
	<range><lt>1.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The pear-XML_RPC release notes reports that the following
	 issues has been fixed:
	<blockquote cite="http://pear.php.net/package/XML_RPC/download/1.3.2">
	 Eliminate path disclosure vulnerabilities by suppressing
	 error messages when eval()'ing.
	 Eliminate path disclosure vulnerability by catching bogus
	 parameters submitted to
	 <code>XML_RPC_Value::serializeval()</code>.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://pear.php.net/package/XML_RPC/download/1.3.2</url>
 </references>
 <dates>
 <discovery>2005-07-07</discovery>
 <entry>2005-07-08</entry>
 </dates>
 </vuln>

<vuln vid="9a035a56-eff0-11d9-8310-0001020eed82">
 <topic>ekg -- insecure temporary file creation</topic>
 <affects>
 <package>
	<name>pl-ekg</name>
	<range><lt>1.6r2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Eric Romang reports that ekg creates temporary files in an
	 insecure manner. This can be exploited by an attacker using
	 a symlink attack to overwrite arbitrary files and possibly
	 execute arbitrary commands with the permissions of the user
	 running ekg.
 </body>
 </description>
 <references>
 <bid>14146</bid>
 <cvename>CVE-2005-1916</cvename>
 <mlist msgid="42CA2DDB.5030606@zataz.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112060146011122</mlist>
 <url>http://bugs.gentoo.org/show_bug.cgi?id=94172</url>
 </references>
 <dates>
 <discovery>2005-07-05</discovery>
 <entry>2005-07-08</entry>
 <modified>2005-07-31</modified>
 </dates>
 </vuln>

<vuln vid="6e33f4ab-efed-11d9-8310-0001020eed82">
 <topic>bugzilla -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<name>ja-bugzilla</name>
	<range><ge>2.17.1</ge><lt>2.18.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla Security Advisory reports:
	<blockquote cite="http://www.bugzilla.org/security/2.18.1/">
	 Any user can change any flag on any bug, even if they
	 don't have access to that bug, or even if they can't
	 normally make bug changes. This also allows them to expose
	 the summary of a bug.
	 Bugs are inserted into the database before they are
	 marked as private, in Bugzilla code. Thus, MySQL
	 replication can lag in between the time that the bug is
	 inserted and when it is marked as private (usually less
	 than a second). If replication lags at this point, the bug
	 summary will be accessible to all users until replication
	 catches up. Also, on a very slow machine, there may be a
	 pause longer than a second that allows users to see the
	 title of the newly-filed bug.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2173</cvename>
 <cvename>CVE-2005-2174</cvename>
 <url>http://www.bugzilla.org/security/2.18.1/</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=292544</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=293159</url>
 </references>
 <dates>
 <discovery>2005-07-07</discovery>
 <entry>2005-07-08</entry>
 <modified>2005-07-18</modified>
 </dates>
 </vuln>

<vuln vid="d177d9f9-e317-11d9-8088-00123f0f7307">
 <topic>nwclient -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>nwclient</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Insecure file permissions, network access control and DNS
	 usage put systems that use Legato NetWorker at risk.
	When the software is running, several files that contain
	 sensitive information are created with insecure permissions.
	 The information exposed include passwords and can therefore
	 be used for privilege elevation.
	An empty "servers" file, which should normally
	 contain hostnames of authorized backup servers, may allow
	 unauthorized backups to be made. Sensitive information can
	 be extracted from these backups.
	When reverse DNS fails for the Legato client IP a weak
	 authorization scheme, containing a flaw that allows
	 unauthorized access, is used. This may allow unauthorized
	 access.
 </body>
 </description>
 <references>
 <bid>3564</bid>
 <bid>3840</bid>
 <bid>3842</bid>
 <cvename>CVE-2001-0910</cvename>
 <cvename>CVE-2002-0113</cvename>
 <cvename>CVE-2002-0114</cvename>
 <url>http://portal1.legato.com/resources/bulletins/372.html</url>
 </references>
 <dates>
 <discovery>2002-01-10</discovery>
 <entry>2005-07-08</entry>
 </dates>
 </vuln>

<vuln vid="107692a1-ee6c-11d9-8310-0001020eed82">
 <topic>acroread -- insecure temporary file creation</topic>
 <affects>
 <package>
	<name>acroread4</name>
	<name>acroread5</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>acroread</name>
	<range><lt>7.0.0</lt></range>
	<range><gt>5.*,1</gt><lt>7.0.0,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia Research reports:
	<blockquote cite="http://secunia.com/secunia_research/2005-6/advisory/">
	 Secunia has discovered a security issue in Adobe Reader
	 for Linux, which can be exploited by malicious, local
	 users to gain knowledge of sensitive information.
	 The problem is caused due to temporary files being
	 created with permissions based on a user's umask in the
	 "/tmp" folder under certain circumstances when documents
	 are opened.
	 Successful exploitation allows an unprivileged user to
	 read arbitrary users' documents.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1912</cvename>
 <url>http://secunia.com/secunia_research/2005-6/advisory/</url>
 </references>
 <dates>
 <discovery>2005-06-29</discovery>
 <entry>2005-07-06</entry>
 </dates>
 </vuln>

<vuln vid="d8e1aadd-ee68-11d9-8310-0001020eed82">
 <topic>clamav -- cabinet file handling DoS vulnerability</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.86</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><lt>20050620</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An iDEFENSE Security Advisory reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006456809016">
	 Remote exploitation of an input validation error in Clam
	 AntiVirus ClamAV allows attackers to cause a denial of
	 service condition.
	 The vulnerability specifically exists due to insufficient
	 validation on cabinet file header data. The
	 <code>ENSURE_BITS()</code> macro fails to check for zero
	 length reads, allowing a carefully constructed cabinet
	 file to cause an infinite loop.
	 ClamAV is used in a number of mail gateway
	 products. Successful exploitation requires an attacker to
	 send a specially constructed CAB file through a mail
	 gateway or personal anti-virus client utilizing the ClamAV
	 scanning engine. The infinate loop will cause the ClamAV
	 software to use all available processor resources,
	 resulting in a denial of service or severe degradation to
	 system performance. Remote exploitation can be achieved by
	 sending a malicious file in an e-mail message or during an
	 HTTP session.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1923</cvename>
 <mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AB@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006456809016</mlist>
 </references>
 <dates>
 <discovery>2005-06-29</discovery>
 <entry>2005-07-06</entry>
 </dates>
 </vuln>

<vuln vid="6d18fe19-ee67-11d9-8310-0001020eed82">
 <topic>clamav -- MS-Expand file handling DoS vulnerability</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.86</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><lt>20050620</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An iDEFENSE Security Advisory reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006402411598">
	 Remote exploitation of an input validation error in Clam
	 AntiVirus ClamAV allows attackers to cause a denial of
	 service condition.
	 The vulnerability specifically exists due to improper
	 behavior during exceptional conditions.
	 Successful exploitation allows attackers to exhaust file
	 descriptors pool and memory. Anti-virus detection
	 functionality will fail if there is no file descriptors
	 available with which to open files. Remote exploitation
	 can be achieved by sending a malicious file in an e-mail
	 message or during an HTTP session.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1922</cvename>
 <mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AC@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006402411598</mlist>
 </references>
 <dates>
 <discovery>2005-06-29</discovery>
 <entry>2005-07-06</entry>
 </dates>
 </vuln>

<vuln vid="8efe93e2-ee62-11d9-8310-0001020eed82">
 <topic>zlib -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>zsync</name>
	<range><lt>0.4.1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_4</lt></range>
	<range><ge>5.3</ge><lt>5.3_18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	An error in the handling of corrupt compressed data streams
	 can result in a buffer being overflowed.
	<h1>Impact</h1>
	By carefully crafting a corrupt compressed data stream, an
	 attacker can overwrite data structures in a zlib-using
	 application.	This may cause the application to halt,
	 causing a denial of service; or it may result in the
	 attacker gaining elevated privileges.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2096</cvename>
 <freebsdsa>SA-05:16.zlib</freebsdsa>
 </references>
 <dates>
 <discovery>2005-07-06</discovery>
 <entry>2005-07-06</entry>
 <modified>2005-10-01</modified>
 </dates>
 </vuln>

<vuln vid="70c59485-ee5a-11d9-8310-0001020eed82">
 <topic>acroread -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>acroread4</name>
	<name>acroread5</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>acroread</name>
	<range><lt>7.0.0</lt></range>
	<range><gt>5.*,1</gt><lt>7.0.0,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An Adobe Security Advisory reports:
	<blockquote cite="http://www.adobe.com/support/techdocs/329083.html">
	 A vulnerability within Adobe Reader has been
	 identified. Under certain circumstances, remote
	 exploitation of a buffer overflow in Adobe Reader could
	 allow an attacker to execute arbitrary code.
	 If exploited, it could allow the execution of arbitrary
	 code under the privileges of the local user. Remote
	 exploitation is possible if the malicious PDF document is
	 sent as an email attachment or if the PDF document is
	 accessed via a web link.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1625</cvename>
 <url>http://www.adobe.com/support/techdocs/329083.html</url>
 <mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A5E2@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112059685332569</mlist>
 </references>
 <dates>
 <discovery>2005-07-05</discovery>
 <entry>2005-07-06</entry>
 </dates>
 </vuln>

<vuln vid="b2a1a3b5-ed95-11d9-8310-0001020eed82">
 <topic>net-snmp -- remote DoS vulnerability</topic>
 <affects>
 <package>
	<name>net-snmp</name>
	<range><lt>5.2.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Net-SNMP release announcement reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=net-snmp-announce&amp;m=112059518426328">
	 A security vulnerability has been found in Net-SNMP
	 releases that could allow a denial of service attack
	 against Net-SNMP agent's which have opened a stream based
	 protocol (EG, TCP but not UDP; it should be noted that
	 Net-SNMP does not by default open a TCP port).
	</blockquote>
 </body>
 </description>
 <references>
 <bid>14168</bid>
 <cvename>CVE-2005-2177</cvename>
 <mlist msgid="sdzmt5sul0.fsf@wes.hardakers.net">http://marc.theaimsgroup.com/?l=net-snmp-announce&amp;m=112059518426328</mlist>
 </references>
 <dates>
 <discovery>2005-07-02</discovery>
 <entry>2005-07-05</entry>
 <modified>2005-10-26</modified>
 </dates>
 </vuln>

<vuln vid="1cf00643-ed8a-11d9-8310-0001020eed82">
 <topic>cacti -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>0.8.6f</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Esser reports:
	<blockquote cite="http://www.hardened-php.net/advisory-032005.php">
	 Wrongly implemented user input filters lead to multiple
	 SQL Injection vulnerabilities which can lead f.e. to
	 disclosure of the admin password hash.
	</blockquote>
	<blockquote cite="http://www.hardened-php.net/advisory-042005.php">
	 Wrongly implemented user input filters allows injection
	 of user input into executed commandline.
	 Alberto Trivero posted his Remote Command Execution
	 Exploit for Cacti &lt;= 0.8.6d to Bugtraq on the 22th
	 June. Having analysed his bug we come to the conclusion,
	 that the malfunctioning input filters, which were already
	 mentioned in the previous advisory are also responsible
	 for this bug still being exploitable.
	</blockquote>
	<blockquote cite="http://www.hardened-php.net/advisory-052005.php">
	 A HTTP headers bypass switch can also be used to
	 completely bypass the authentification system of Cacti. As
	 admin it is possible to execute shell commands with the
	 permission of the webserver.
	 While looking at the source of Cacti a HTTP headers
	 bypass switch was discovered, that also switches off a
	 call to <code>session_start()</code> and the manual
	 application of <code>addslashes()</code> in case of
	 <code>magic_quotes_gpc=Off</code>.
	 When register_globals is turned on* an attacker can use
	 this switch to disables Cacti's use of PHP's session
	 support and therefore supply the session variables on his
	 own through f.e. the URL. Additionally using the switch
	 renders several SQL statements vulnerable to SQL
	 Injections attacks, when magic_quotes_gpc is turned off,
	 which is the recommended setting.
	 Logged in as an admin it is possible to issue shell
	 commands.
	 (*) register_globals is turned off by default since PHP
	 4.2 but is activated on most servers because of older
	 scripts requiring it.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist msgid="007301c57753$5ab17f60$0100a8c0@alberto">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111954136315248</mlist>
 <url>http://www.hardened-php.net/advisory-032005.php</url>
 <url>http://www.hardened-php.net/advisory-042005.php</url>
 <url>http://www.hardened-php.net/advisory-052005.php</url>
 </references>
 <dates>
 <discovery>2005-06-22</discovery>
 <entry>2005-07-05</entry>
 </dates>
 </vuln>

<vuln vid="dca0a345-ed81-11d9-8310-0001020eed82">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>1.5.1.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GulfTech Security Research reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006967221438">
	 There are a number of vulnerabilities in WordPress that
	 may allow an attacker to ultimately run arbitrary code on
	 the vulnerable system. These vulnerabilities include SQL
	 Injection, Cross Site Scripting, and also issues that may
	 aid an attacker in social engineering.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2107</cvename>
 <cvename>CVE-2005-2108</cvename>
 <cvename>CVE-2005-2109</cvename>
 <cvename>CVE-2005-2110</cvename>
 <mlist msgid="42C2BE6E.2050408@gulftech.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006967221438</mlist>
 </references>
 <dates>
 <discovery>2005-06-28</discovery>
 <entry>2005-07-05</entry>
 </dates>
 </vuln>

<vuln vid="a4955b32-ed84-11d9-8310-0001020eed82">
 <topic>wordpress -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>1.5.1.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Gentoo Linux Security Advisory reports:
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml">
	 Due to a lack of input validation, WordPress is
	 vulnerable to SQL injection and XSS attacks.
	 An attacker could use the SQL injection vulnerabilities to
	 gain information from the database. Furthermore the
	 cross-site scripting issues give an attacker the ability
	 to inject and execute malicious script code or to steal
	 cookie-based authentication credentials, potentially
	 compromising the victim's browser.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1810</cvename>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml</url>
 </references>
 <dates>
 <discovery>2005-04-12</discovery>
 <entry>2005-07-05</entry>
 </dates>
 </vuln>

<vuln vid="4afacca1-eb9d-11d9-a8bd-000cf18bbe54">
 <topic>phpbb -- remote PHP code execution vulnerability</topic>
 <affects>
 <package>
	<name>phpbb</name>
	<range><lt>2.0.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	FrSIRT Advisory reports:
	<blockquote cite="http://www.frsirt.com/english/advisories/2005/0904">
	 A vulnerability was identified in phpBB, which
	 may be exploited by attackers to compromise a vulnerable
	 web server. This flaw is due to an input validation error
	 in the "viewtopic.php" script that does not properly filter
	 the "highlight" parameter before calling the "preg_replace()"
	 function, which may be exploited by remote attackers to execute
	 arbitrary PHP commands with the privileges of the web server.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2086</cvename>
 <url>http://www.frsirt.com/english/advisories/2005/0904</url>
 <url>http://www.phpbb.com/phpBB/viewtopic.php?t=302011</url>
 </references>
 <dates>
 <discovery>2005-06-28</discovery>
 <entry>2005-07-03</entry>
 <modified>2005-07-07</modified>
 </dates>
 </vuln>

<vuln vid="523fad14-eb9d-11d9-a8bd-000cf18bbe54">
 <topic>pear-XML_RPC -- arbitrary remote code execution</topic>
 <affects>
 <package>
	<name>pear-XML_RPC</name>
	<range><lt>1.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GulfTech Security Research Team reports:
	<blockquote cite="http://www.gulftech.org/?node=research&amp;article_id=00087-07012005">
	 PEAR XML_RPC is vulnerable to a very high risk php code
	 injection vulnerability due to unsanatized data being
	 passed into an eval() call.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1921</cvename>
 <url>http://www.gulftech.org/?node=research&amp;article_id=00087-07012005</url>
 <url>http://www.hardened-php.net/advisory-022005.php</url>
 </references>
 <dates>
 <discovery>2005-06-29</discovery>
 <entry>2005-07-03</entry>
 </dates>
 </vuln>

<vuln vid="f70f8860-e8ee-11d9-b875-0001020eed82">
 <topic>kernel -- ipfw packet matching errors with address tables</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	The ipfw tables lookup code caches the result of the last
	 query. The kernel may process multiple packets
	 concurrently, performing several concurrent table lookups.
	 Due to an insufficient locking, a cached result can become
	 corrupted that could cause some addresses to be incorrectly
	 matched against a lookup table.
	<h1>Impact</h1>
	When lookup tables are used with ipfw, packets may on very
	 rare occasions incorrectly match a lookup table. This could
	 result in a packet being treated contrary to the defined
	 packet filtering ruleset. For example, a packet may be
	 allowed to pass through when it should have been
	 discarded.
	The problem can only occur on Symmetric Multi-Processor
	 (SMP) systems, or on Uni Processor (UP) systems with the
	 PREEMPTION kernel option enabled (not the default).
	<h1>Workaround</h1>
	a) Do not use lookup tables.
	OR
	b) Disable concurrent processing of packets in the network
	 stack by setting the "debug.mpsafenet=0" tunable:
	# echo "debug.mpsafenet=0" &lt;&lt; /boot/loader.conf
 </body>
 </description>
 <references>
 <cvename>CVE-2005-2019</cvename>
 <freebsdsa>SA-05:13.ipfw</freebsdsa>
 </references>
 <dates>
 <discovery>2005-06-29</discovery>
 <entry>2005-06-29</entry>
 <modified>2005-07-06</modified>
 </dates>
 </vuln>

<vuln vid="197f444f-e8ef-11d9-b875-0001020eed82">
 <topic>bzip2 -- denial of service and permission race vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_3</lt></range>
	<range><ge>5.0</ge><lt>5.3_17</lt></range>
	<range><ge>4.11</ge><lt>4.11_11</lt></range>
	<range><lt>4.10_16</lt></range>
 </package>
 <package>
	<name>bzip2</name>
	<range><lt>1.0.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	Two problems have been discovered relating to the
	 extraction of bzip2-compressed files. First, a carefully
	 constructed invalid bzip2 archive can cause bzip2 to enter
	 an infinite loop. Second, when creating a new file, bzip2
	 closes the file before setting its permissions.
	<h1>Impact</h1>
	The first problem can cause bzip2 to extract a bzip2
	 archive to an infinitely large file.	If bzip2 is used in
	 automated processing of untrusted files this could be
	 exploited by an attacker to create an denial-of-service
	 situation by exhausting disk space or by consuming all
	 available cpu time.
	The second problem can allow a local attacker to change the
	 permissions of local files owned by the user executing bzip2
	 providing that they have write access to the directory in
	 which the file is being extracted.
	<h1>Workaround</h1>
	Do not uncompress bzip2 archives from untrusted sources and
	 do not uncompress files in directories where untrusted users
	 have write access.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0953</cvename>
 <cvename>CVE-2005-1260</cvename>
 <freebsdsa>SA-05:14.bzip2</freebsdsa>
 <url>http://scary.beasts.org/security/CESA-2005-002.txt</url>
 </references>
 <dates>
 <discovery>2005-03-30</discovery>
 <entry>2005-06-29</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="3ec8f43b-e8ef-11d9-b875-0001020eed82">
 <topic>kernel -- TCP connection stall denial of service</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_3</lt></range>
	<range><ge>5.0</ge><lt>5.3_17</lt></range>
	<range><ge>4.11</ge><lt>4.11_11</lt></range>
	<range><lt>4.10_16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	Two problems have been discovered in the FreeBSD TCP stack.
	First, when a TCP packets containing a timestamp is
	 received, inadequate checking of sequence numbers is
	 performed, allowing an attacker to artificially increase the
	 internal "recent" timestamp for a connection.
	Second, a TCP packet with the SYN flag set is accepted for
	 established connections, allowing an attacker to overwrite
	 certain TCP options.
	<h1>Impact</h1>
	Using either of the two problems an attacker with knowledge
	 of the local and remote IP and port numbers associated with
	 a connection can cause a denial of service situation by
	 stalling the TCP connection. The stalled TCP connection my
	 be closed after some time by the other host.
	<h1>Workaround</h1>
	In some cases it may be possible to defend against these
	 attacks by blocking the attack packets using a firewall.
	 Packets used to effect either of these attacks would have
	 spoofed source IP addresses.
 </body>
 </description>
 <references>
 <certvu>637934</certvu>
 <cvename>CVE-2005-0356</cvename>
 <cvename>CVE-2005-2068</cvename>
 <freebsdsa>SA-05:15.tcp</freebsdsa>
 </references>
 <dates>
 <discovery>2005-06-29</discovery>
 <entry>2005-06-29</entry>
 <modified>2016-08-09</modified>
 </dates>
 </vuln>

<vuln vid="76adaab0-e4e3-11d9-b875-0001020eed82">
 <topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
 <affects>
 <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.8.14</ge><lt>0.10.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An Ethreal Security Advisories reports:
	<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00019.html">
	 An aggressive testing program as well as independent
	 discovery has turned up a multitude of security issues
	 Please reference CVE/URL list for details
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13391</bid>
 <bid>13504</bid>
 <bid>13567</bid>
 <cvename>CVE-2005-1281</cvename>
 <cvename>CVE-2005-1456</cvename>
 <cvename>CVE-2005-1457</cvename>
 <cvename>CVE-2005-1458</cvename>
 <cvename>CVE-2005-1459</cvename>
 <cvename>CVE-2005-1460</cvename>
 <cvename>CVE-2005-1461</cvename>
 <cvename>CVE-2005-1462</cvename>
 <cvename>CVE-2005-1463</cvename>
 <cvename>CVE-2005-1464</cvename>
 <cvename>CVE-2005-1465</cvename>
 <cvename>CVE-2005-1466</cvename>
 <cvename>CVE-2005-1467</cvename>
 <cvename>CVE-2005-1468</cvename>
 <cvename>CVE-2005-1469</cvename>
 <cvename>CVE-2005-1470</cvename>
 <url>http://www.ethereal.com/appnotes/enpa-sa-00019.html</url>
 </references>
 <dates>
 <discovery>2005-05-04</discovery>
 <entry>2005-06-24</entry>
 </dates>
 </vuln>

<vuln vid="691ed622-e499-11d9-a8bd-000cf18bbe54">
 <topic>tor -- information disclosure</topic>
 <affects>
 <package>
	<name>tor</name>
	<range><lt>0.1.0.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Roger Dingledine reports:
	<blockquote cite="http://archives.seul.org/or/announce/Jun-2005/msg00001.html">
	 The Tor 0.1.0.10 release from a few days ago
	 includes a fix for a bug that might allow an attacker
	 to read arbitrary memory (maybe even keys) from an exit
	 server's process space. We haven't heard any reports of
	 exploits yet, but hey.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist>http://archives.seul.org/or/announce/Jun-2005/msg00001.html</mlist>
 </references>
 <dates>
 <discovery>2005-06-16</discovery>
 <entry>2005-06-24</entry>
 </dates>
 </vuln>

<vuln vid="95ee96f2-e488-11d9-bf22-080020c11455">
 <topic>linux-realplayer -- RealText parsing heap overflow</topic>
 <affects>
 <package>
	<name>linux-realplayer</name>
	<range><le>10.0.4_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An iDEFENSE Security Advisory reports:
	<blockquote cite="http://www.idefense.com/application/poi/display?id=250&amp;type=vulnerabilities&amp;flashstatus=false">
	 Remote exploitation of a heap-based buffer
	 overflow vulnerability in the RealText file format
	 parser within various versions of RealNetworks
	 Inc.'s RealPlayer could allow attackers to
	 execute arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1277</cvename>
 <url>http://www.idefense.com/application/poi/display?id=250&amp;type=vulnerabilities&amp;flashstatus=false</url>
 <url>http://service.real.com/help/faq/security/050623_player/EN/</url>
 </references>
 <dates>
 <discovery>2005-06-23</discovery>
 <entry>2005-06-24</entry>
 </dates>
 </vuln>

<vuln vid="594eb447-e398-11d9-a8bd-000cf18bbe54">
 <topic>ruby -- arbitrary command execution on XMLRPC server</topic>
 <affects>
 <package>
	<name>ruby</name>
	<name>ruby_static</name>
	<range><gt>1.8.*</gt><lt>1.8.2_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Nobuhiro IMAI reports:
	<blockquote cite="http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237">
	 the default value modification on
	 Module#public_instance_methods (from false to true) breaks
	 s.add_handler(XMLRPC::iPIMethods("sample"), MyHandler.new) style
	 security protection.
	 This problem could allow a remote attacker to execute arbitrary
	 commands on XMLRPC server of libruby.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1992</cvename>
 <url>http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237</url>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=315064</url>
 </references>
 <dates>
 <discovery>2005-06-22</discovery>
 <entry>2005-06-23</entry>
 <modified>2005-11-06</modified>
 </dates>
 </vuln>

<vuln vid="96948a6a-e239-11d9-83cf-0010dc5df42d">
 <topic>cacti -- potential SQL injection and cross site scripting attacks</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><le>0.8.6d</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	iDEFENSE security group disclosed potential SQL injection
	 attacks from unchecked user input and two security holes
	 regarding potential cross site scripting attacks
 </body>
 </description>
 <references>
 <url>http://www.cacti.net/release_notes_0_8_6e.php</url>
 </references>
 <dates>
 <discovery>2005-06-21</discovery>
 <entry>2005-06-21</entry>
 </dates>
 </vuln>

<vuln vid="79217c9b-e1d9-11d9-b875-0001020eed82">
 <topic>opera -- XMLHttpRequest security bypass</topic>
 <affects>
 <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><gt>8.*</gt><lt>8.01</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/15008/">
	 Secunia Research has discovered a vulnerability in Opera,
	 which can be exploited by malicious people to steal
	 content or to perform actions on other web sites with the
	 privileges of the user.
	 Normally, it should not be possible for the
	 <code>XMLHttpRequest</code> object to access resources
	 from outside the domain of which the object was
	 opened. However, due to insufficient validation of server
	 side redirects, it is possible to circumvent this
	 restriction.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1475</cvename>
 <url>http://secunia.com/advisories/15008/</url>
 <url>http://secunia.com/secunia_research/2005-4/advisory/</url>
 <url>http://www.opera.com/freebsd/changelogs/801/#security</url>
 </references>
 <dates>
 <discovery>2005-06-16</discovery>
 <entry>2005-06-20</entry>
 </dates>
 </vuln>

<vuln vid="40856a51-e1d9-11d9-b875-0001020eed82">
 <topic>opera -- "javascript:" URL cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><lt>8.01</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/15411/">
	 Secunia Research has discovered a vulnerability in Opera,
	 which can be exploited by malicious people to conduct
	 cross-site scripting attacks and to read local files.
	 The vulnerability is caused due to Opera not properly
	 restricting the privileges of "javascript:" URLs when
	 opened in e.g. new windows or frames.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1669</cvename>
 <url>http://secunia.com/advisories/15411/</url>
 <url>http://www.opera.com/freebsd/changelogs/801/#security</url>
 </references>
 <dates>
 <discovery>2005-06-16</discovery>
 <entry>2005-06-20</entry>
 </dates>
 </vuln>

<vuln vid="985bfcf0-e1d7-11d9-b875-0001020eed82">
 <topic>opera -- redirection cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><gt>8.*</gt><lt>8.01</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/15423/">
	 Secunia Research has discovered a vulnerability in Opera,
	 which can be exploited by malicious people to conduct
	 cross-site scripting attacks against users.
	 The vulnerability is caused due to input not being
	 sanitised, when Opera generates a temporary page for
	 displaying a redirection when "Automatic redirection" is
	 disabled (not default setting).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/15423/</url>
 <url>http://secunia.com/secunia_research/2003-1/advisory/</url>
 <url>http://www.opera.com/freebsd/changelogs/801/#security</url>
 </references>
 <dates>
 <discovery>2005-06-16</discovery>
 <entry>2005-06-20</entry>
 </dates>
 </vuln>

<vuln vid="3bf157fa-e1c6-11d9-b875-0001020eed82">
 <topic>sudo -- local race condition vulnerability</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><lt>1.6.8.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Todd C. Miller reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928183431376">
	 A race condition in Sudo's command pathname handling
	 prior to Sudo version 1.6.8p9 that could allow a user with
	 Sudo privileges to run arbitrary commands.
	 Exploitation of the bug requires that the user be allowed
	 to run one or more commands via Sudo and be able to create
	 symbolic links in the filesystem. Furthermore, a sudoers
	 entry giving another user access to the ALL pseudo-command
	 must follow the user's sudoers entry for the race to
	 exist.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13993</bid>
 <cvename>CVE-2005-1993</cvename>
 <mlist msgid="200506201424.j5KEOhQI024645@xerxes.courtesan.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928183431376</mlist>
 </references>
 <dates>
 <discovery>2005-06-20</discovery>
 <entry>2005-06-20</entry>
 <modified>2005-11-14</modified>
 </dates>
 </vuln>

<vuln vid="b02c1d80-e1bb-11d9-b875-0001020eed82">
 <topic>trac -- file upload/download vulnerability</topic>
 <affects>
 <package>
	<name>trac</name>
	<range><lt>0.8.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Esser reports:
	<blockquote cite="http://www.hardened-php.net/advisory-012005.php">
	 Trac's wiki and ticket systems allows to add attachments
	 to wiki entries and bug tracker tickets. These attachments
	 are stored within directories that are determined by the
	 id of the corresponding ticket or wiki entry.
	 Due to a missing validation of the id parameter it is
	 possible for an attacker to supply arbitrary paths to the
	 upload and attachment viewer scripts. This means that a
	 potential attacker can retrieve any file accessible by the
	 webserver user.
	 Additionally it is possible to upload arbitrary files (up
	 to a configured file length) to any place the webserver
	 has write access too.
	 For obvious reasons this can lead to the execution of
	 arbitrary code if it possible to upload files to the
	 document root or it's subdirectories. One example of a
	 configuration would be f.e. running Trac and
	 s9y/wordpress with writeable content directories on the
	 same webserver.
	 Another potential usage of this exploit would be to abuse
	 Trac powered webservers as storage for f.e. torrent
	 files.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13990</bid>
 <url>http://www.hardened-php.net/advisory-012005.php</url>
 <url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
 </references>
 <dates>
 <discovery>2005-06-20</discovery>
 <entry>2005-06-20</entry>
 </dates>
 </vuln>

<vuln vid="85069fb6-e15b-11d9-83cf-0010dc5df42d">
 <topic>razor-agents -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>razor-agents</name>
	<range><le>2.71</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia security advisory reports:
	<blockquote cite="http://secunia.com/advisories/15739/">
	 Two vulnerabilities have been reported in Razor-agents,
	 which can be exploited by malicious people to cause a DoS
	 (Denial of Service).
	 <ol>
	 <li>An unspecified error in the preprocessing of certain
	 HTML messages can be exploited to crash the
	 application.</li>
	 <li>A bug in the discovery logic causes Razor-agents to go
	 into an infinite loop and consume a large amount of
	 memory when discovery fails.</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/15739/</url>
 </references>
 <dates>
 <discovery>2005-06-17</discovery>
 <entry>2005-06-20</entry>
 </dates>
 </vuln>

<vuln vid="cc4ce06b-e01c-11d9-a8bd-000cf18bbe54">
 <topic>p5-Mail-SpamAssassin -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>p5-Mail-SpamAssassin</name>
	<range><ge>3.0.1</ge><lt>3.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Apache SpamAssassin Security Team reports:
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e">
	 Apache SpamAssassin 3.0.4 was recently released, and
	 fixes a denial of service vulnerability in versions 3.0.1, 3.0.2,
	 and 3.0.3.	The vulnerability allows certain misformatted
	 long message headers to cause spam checking to
	 take a very long time.
	 While the exploit has yet to be seen in the wild,
	 we are concerned that there may be attempts to abuse
	 the vulnerability in the future. Therefore, we strongly
	 recommend all users of these versions upgrade to
	 Apache SpamAssassin 3.0.4 as soon as possible.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1266</cvename>
 <mlist msgid="c17072.35054.586017.822288@proton.pathname.com">http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e</mlist>
 </references>
 <dates>
 <discovery>2005-06-15</discovery>
 <entry>2005-06-18</entry>
 </dates>
 </vuln>

<vuln vid="e879ca68-e01b-11d9-a8bd-000cf18bbe54">
 <topic>squirrelmail -- Several cross site scripting vulnerabilities</topic>
 <affects>
 <package>
	<name>squirrelmail</name>
	<name>ja-squirrelmail</name>
	<range><ge>1.4.0</ge><le>1.4.4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A SquirrelMail Security Advisory reports:
	<blockquote cite="http://www.squirrelmail.org/security/issue/2005-06-15">
	 Several cross site scripting (XSS) vulnerabilities have been
	 discovered in SquirrelMail versions 1.4.0 - 1.4.4.
	 The vulnerabilities are in two categories: the majority can be
	 exploited through URL manipulation, and some by sending a specially
	 crafted email to a victim. When done very carefully,
	 this can cause the session of the user to be hijacked.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1769</cvename>
 <url>http://www.squirrelmail.org/security/issue/2005-06-15</url>
 </references>
 <dates>
 <discovery>2005-06-15</discovery>
 <entry>2005-06-18</entry>
 </dates>
 </vuln>

<vuln vid="02bc9b7c-e019-11d9-a8bd-000cf18bbe54">
 <topic>acroread -- XML External Entity vulnerability</topic>
 <affects>
 <package>
	<name>acroread7</name>
	<name>ja-acroread</name>
	<range><ge>7.0.0</ge><lt>7.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sverre H. Huseby discovered a vulnerability in Adobe Acrobat
	 and Adobe Reader.
	 Under certain circumstances, using XML scripts it is possible
	 to discover the existence of local files.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1306</cvename>
 <url>http://shh.thathost.com/secadv/adobexxe/</url>
 <url>http://www.adobe.com/support/techdocs/331710.html</url>
 <url>http://support.adobe.co.jp/faq/faq/qadoc.sv?226360+002+3</url>
 </references>
 <dates>
 <discovery>2005-06-15</discovery>
 <entry>2005-06-18</entry>
 <modified>2005-08-28</modified>
 </dates>
 </vuln>

<vuln vid="63bd4bad-dffe-11d9-b875-0001020eed82">
 <topic>gzip -- directory traversal and permission race vulnerabilities</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_2</lt></range>
	<range><ge>5.0</ge><lt>5.3_16</lt></range>
	<range><ge>4.11</ge><lt>4.11_10</lt></range>
	<range><ge>4.10</ge><lt>4.10_15</lt></range>
	<range><ge>4.9</ge><lt>4.9_18</lt></range>
	<range><lt>4.8_33</lt></range>
 </package>
 <package>
	<name>gzip</name>
	<range><lt>1.3.5_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	Two problems related to extraction of files exist in gzip:
	The first problem is that gzip does not properly sanitize
	 filenames containing "/" when uncompressing files using the
	 -N command line option.
	The second problem is that gzip does not set permissions on
	 newly extracted files until after the file has been created
	 and the file descriptor has been closed.
	<h1>Impact</h1>
	The first problem can allow an attacker to overwrite
	 arbitrary local files when uncompressing a file using the -N
	 command line option.
	The second problem can allow a local attacker to change the
	 permissions of arbitrary local files, on the same partition
	 as the one the user is uncompressing a file on, by removing
	 the file the user is uncompressing and replacing it with a
	 hardlink before the uncompress operation is finished.
	<h1>Workaround</h1>
	Do not use the -N command line option on untrusted files
	 and do not uncompress files in directories where untrusted
	 users have write access.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0988</cvename>
 <cvename>CVE-2005-1228</cvename>
 <freebsdsa>SA-05:11.gzip</freebsdsa>
 <mlist msgid="7389fc4b05040412574f819112@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111271860708210</mlist>
 <mlist msgid="7389fc4b0504201224759f31b@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111402732406477</mlist>
 </references>
 <dates>
 <discovery>2005-04-20</discovery>
 <entry>2005-06-18</entry>
 <modified>2005-07-06</modified>
 </dates>
 </vuln>

<vuln vid="9fae0f1f-df82-11d9-b875-0001020eed82">
 <topic>tcpdump -- infinite loops in protocol decoding</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_2</lt></range>
	<range><ge>5.3</ge><lt>5.3_16</lt></range>
 </package>
 <package>
	<name>tcpdump</name>
	<range><lt>3.8.3_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	Several tcpdump protocol decoders contain programming
	 errors which can cause them to go into infinite loops.
	<h1>Impact</h1>
	An attacker can inject specially crafted packets into the
	 network which, when processed by tcpdump, could lead to a
	 denial-of-service. After the attack, tcpdump would no
	 longer capture traffic, and would potentially use all
	 available processor time.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1267</cvename>
 <cvename>CVE-2005-1278</cvename>
 <cvename>CVE-2005-1279</cvename>
 <cvename>CVE-2005-1280</cvename>
 <freebsdsa>SA-05:10.tcpdump</freebsdsa>
 <mlist msgid="20050426100140.1945.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111454406222040</mlist>
 <mlist msgid="20050426100057.1748.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111454461300644</mlist>
 <mlist msgid="20050619091553.GB982@zaphod.nitro.dk">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928309502304</mlist>
 </references>
 <dates>
 <discovery>2005-06-09</discovery>
 <entry>2005-06-18</entry>
 <modified>2005-06-20</modified>
 </dates>
 </vuln>

<vuln vid="2701611f-df5c-11d9-b875-0001020eed82">
 <topic>gaim -- Yahoo! remote crash vulnerability</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jacopo Ottaviani reports that Gaim can be crashed by being
	 offered files with names containing non-ASCII
	 characters via the Yahoo! protocol.
 </body>
 </description>
 <references>
 <bid>13931</bid>
 <cvename>CVE-2005-1269</cvename>
 <url>http://gaim.sourceforge.net/security/index.php?id=18</url>
 </references>
 <dates>
 <discovery>2005-06-10</discovery>
 <entry>2005-06-17</entry>
 </dates>
 </vuln>

<vuln vid="b6612eee-df5f-11d9-b875-0001020eed82">
 <topic>gaim -- MSN Remote DoS vulnerability</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GAIM team reports:
	<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=19">
	 Remote attackers can cause a denial of service (crash)
	 via a malformed MSN message that leads to a memory
	 allocation of a large size, possibly due to an integer
	 signedness error.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13932</bid>
 <cvename>CVE-2005-1934</cvename>
 <url>http://gaim.sourceforge.net/security/index.php?id=19</url>
 </references>
 <dates>
 <discovery>2005-06-10</discovery>
 <entry>2005-06-17</entry>
 </dates>
 </vuln>

<vuln vid="12b1a62d-6056-4d90-9e21-45fcde6abae4">
 <topic>gallery -- remote code injection via HTTP_POST_VARS</topic>
 <affects>
 <package>
	<name>gallery</name>
	<range><lt>1.4.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A web server running Gallery can be exploited for arbitrary
	 PHP code execution through the use of a maliciously crafted
	 URL.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-2124</cvename>
 <mlist msgid="0c0a01c3e525$1c0ed2b0$c90c030a@bmedirattatg">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=107524414317693</mlist>
 </references>
 <dates>
 <discovery>2004-01-27</discovery>
 <entry>2005-06-17</entry>
 </dates>
 </vuln>

<vuln vid="5752a0df-60c5-4876-a872-f12f9a02fa05">
 <topic>gallery -- cross-site scripting</topic>
 <affects>
 <package>
	<name>gallery</name>
	<range><lt>1.4.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gallery includes several cross-site scripting vulnerabilities
	 that could allow malicious content to be injected.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1106</cvename>
 <cvename>CVE-2005-0219</cvename>
 <cvename>CVE-2005-0220</cvename>
 <cvename>CVE-2005-0221</cvename>
 <cvename>CVE-2005-0222</cvename>
 <bid>11602</bid>
 <url>http://gallery.menalto.com/modules.php?op=modload&amp;name=News&amp;file=article&amp;sid=147</url>
 <url>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110608459222364</url>
 </references>
 <dates>
 <discovery>2005-01-26</discovery>
 <entry>2005-06-17</entry>
 </dates>
 </vuln>

<vuln vid="0512b761-70fb-40d3-9954-aa4565528fa8">
 <topic>kstars -- exploitable set-user-ID application fliccd</topic>
 <affects>
 <package>
	<name>kdeedu</name>
	<range><lt>3.3.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A KDE Security Advisory explains:
	<blockquote cite="http://www.kde.org/info/security/advisory-20050215-1.txt">
	 <h1>Overview</h1>
	 KStars includes support for the Instrument Neutral
	 Distributed Interface (INDI). The build system of this
	 extra 3rd party software contained an installation hook to
	 install fliccd (part of INDI) as SUID root
	 application.
	 Erik Sjölund discovered that the code contains several
	 vulnerabilities that allow stack based buffer
	 overflows.
	 <h1>Impact</h1>
	 If the fliccd binary is installed as suid root, it
	 enables root privilege escalation for local users, or, if
	 the daemon is actually running (which it does not by
	 default) and is running as root, remote root privilege
	 escalation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0011</cvename>
 <url>http://www.kde.org/info/security/advisory-20050215-1.txt</url>
 </references>
 <dates>
 <discovery>2005-01-05</discovery>
 <entry>2005-06-17</entry>
 </dates>
 </vuln>

<vuln vid="4c005a5e-2541-4d95-80a0-00c76919aa66">
 <topic>fd_set -- bitmap index overflow in multiple applications</topic>
 <affects>
 <package>
	<name>gatekeeper</name>
	<range><lt>2.2.1</lt></range>
 </package>
 <package>
	<name>citadel</name>
	<range><lt>6.29</lt></range>
 </package>
 <package>
	<name>3proxy</name>
	<range><lt>0.5.b</lt></range>
 </package>
 <package>
	<name>jabber</name>
	<range><lt>1.4.3.1_1,1</lt></range>
	<range><eq>1.4.4</eq></range>
 </package>
 <package>
	<name>bnc</name>
	<range><lt>2.9.3</lt></range>
 </package>
 <package>
	<name>rinetd</name>
	<range><lt>0.62_1</lt></range>
 </package>
 <package>
	<name>dante</name>
	<range><lt>1.1.15</lt></range>
 </package>
 <package>
	<name>bld</name>
	<range><lt>0.3.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	3APA3A reports:
	<blockquote cite="http://www.security.nnov.ru/advisories/sockets.asp">
	 If programmer fails to check socket number before using
	 select() or fd_set macros, it's possible to overwrite
	 memory behind fd_set structure. Very few select() based
	 application actually check FD_SETSIZE value. [...]
	 Depending on vulnerable application it's possible to
	 overwrite portions of memory. Impact is close to
	 off-by-one overflows, code execution doesn't seems
	 exploitable.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.gotbnc.com/changes.html#2.9.3</url>
 <url>http://www.security.nnov.ru/advisories/sockets.asp</url>
 <mlist msgid="1473827718.20050124233008@security.nnov.ru">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110660879328901</mlist>
 </references>
 <dates>
 <discovery>2004-12-12</discovery>
 <entry>2005-06-17</entry>
 <modified>2006-09-03</modified>
 </dates>
 </vuln>

<vuln vid="b5ffaa2a-ee50-4498-af99-61bc1b163c00">
 <topic>leafnode -- denial of service vulnerability</topic>
 <affects>
 <package>
	<name>leafnode</name>
	<range><lt>1.11.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Matthias Andree reports:
	<blockquote cite="http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt">
	 A vulnerability was found in the fetchnews program (the NNTP
	 client) that may under some circumstances cause a wait for input
	 that never arrives, fetchnews "hangs". [...]
	 As only one fetchnews program can run at a time, subsequently
	 started fetchnews and texpire programs will terminate. [...]
	 Upgrade your leafnode package to version 1.11.3.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1911</cvename>
 <url>http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt</url>
 <freebsdpr>ports/82056</freebsdpr>
 <mlist msgid="20050608215155.GB27234@merlin.emma.line.org">http://marc.theaimsgroup.com/?l=vulnwatch&amp;m=111827180929063</mlist>
 </references>
 <dates>
 <discovery>2005-06-08</discovery>
 <entry>2005-06-09</entry>
 </dates>
 </vuln>

<vuln vid="fe903533-ff96-4c7a-bd3e-4d40efa71897">
 <topic>gforge -- directory traversal vulnerability</topic>
 <affects>
 <package>
	<name>gforge</name>
	<range><lt>4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An STG Security Advisory reports:
	 <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110627132209963">
	 GForge CVS module made by Dragos Moinescu and another
	 module made by Ronald Petty have a directory traversal
	 vulnerability. [...] malicious attackers can read
	 arbitrary directory lists.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0299</cvename>
 <bid>12318</bid>
 <mlist msgid="20050120051735.2832.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110627132209963</mlist>
 </references>
 <dates>
 <discovery>2005-01-20</discovery>
 <entry>2005-06-03</entry>
 </dates>
 </vuln>

<vuln vid="d1bbc235-c0c9-45cd-8d2d-c1b8fd22e616">
 <topic>imap-uw -- authentication bypass when CRAM-MD5 is enabled</topic>
 <affects>
 <package>
	<name>imap-uw</name>
	<range><lt>2004b,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The CRAM-MD5 authentication support of the University of
	 Washington IMAP and POP3 servers contains a vulnerability that
	 may allow an attacker to bypass authentication and impersonate
	 arbitrary users. Only installations with CRAM-MD5 support
	 configured are affected.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0198</cvename>
 <certvu>702777</certvu>
 </references>
 <dates>
 <discovery>2005-01-04</discovery>
 <entry>2005-06-03</entry>
 </dates>
 </vuln>

<vuln vid="5bf1a715-cc57-440f-b0a5-6406961c54a7">
 <topic>squid -- denial-of-service vulnerabilities</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Squid team reported several denial-of-service
	 vulnerabilities related to the handling of DNS responses and
	 NT Lan Manager messages. These may allow an attacker to crash
	 the Squid cache.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0446</cvename>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE8-dns_assert</url>
 <cvename>CVE-2005-0096</cvename>
 <cvename>CVE-2005-0097</cvename>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-fakeauth_auth</url>
 </references>
 <dates>
 <discovery>2005-01-16</discovery>
 <entry>2005-06-03</entry>
 </dates>
 </vuln>

<vuln vid="3b260179-e464-460d-bf9f-d5cda6204020">
 <topic>racoon -- remote denial-of-service</topic>
 <affects>
 <package>
	<name>racoon</name>
	<range><lt>20050510a</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sebastian Krahmer discovered that the racoon ISAKMP daemon
	 could be crashed with a maliciously crafted UDP packet. No
	 authentication is required in order to perform the attack.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0398</cvename>
 <mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=6787713&amp;forum_id=32000</mlist>
 <url>http://xforce.iss.net/xforce/xfdb/19707</url>
 <url>https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=109966&amp;action=view</url>
 </references>
 <dates>
 <discovery>2005-03-12</discovery>
 <entry>2005-06-03</entry>
 </dates>
 </vuln>

<vuln vid="bfbbd505-3bd6-409c-8c67-445d3635cf4b">
 <topic>xli -- integer overflows in image size calculations</topic>
 <affects>
 <package>
	<name>xli</name>
	<range><le>1.17.0_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tavis Ormandy discovered several integer overflows in xli's
	 image size handling.	A maliciously crafted image may be able
	 to cause a heap buffer overflow and execute arbitrary code.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0639</cvename>
 <url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
 <url>http://pantransit.reptiles.org/prog/xli/CHANGES</url>
 </references>
 <dates>
 <discovery>2005-02-08</discovery>
 <entry>2005-06-03</entry>
 </dates>
 </vuln>

<vuln vid="310d0087-0fde-4929-a41f-96f17c5adffe">
 <topic>xloadimage -- arbitrary command execution when handling compressed files</topic>
 <affects>
 <package>
	<name>xli</name>
	<range><le>1.17.0_1</le></range>
 </package>
 <package>
	<name>xloadimage</name>
	<range><le>4.1.10</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tavis Ormandy discovered that xli and xloadimage attempt to
	 decompress images by piping them through <code>gunzip</code>
	 or similar decompression tools. Unfortunately, the
	 unsanitized file name is included as part of the command.
	 This is dangerous, as in some situations, such as mailcap
	 processing, an attacker may control the input file name. As a
	 result, an attacker may be able to cause arbitrary command
	 execution.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0638</cvename>
 <url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
 </references>
 <dates>
 <discovery>2005-02-18</discovery>
 <entry>2005-06-03</entry>
 </dates>
 </vuln>

<vuln vid="8c1da77d-d3e9-11d9-8ffb-00061bc2ad93">
 <topic>xloadimage -- buffer overflow in FACES image handling</topic>
 <affects>
 <package>
	<name>xli</name>
	<range><le>1.17.0_1</le></range>
 </package>
 <package>
	<name>xloadimage</name>
	<range><lt>4.1.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	In 2001, zen-parse discovered a buffer overflow in
	 xloadimage's FACES image loader. A maliciously crafted image
	 could cause xloadimage to execute arbitrary code. A published
	 exploit exists for this vulnerability.
	In 2005, Rob Holland discovered that the same vulnerability
	 was present in xli.
 </body>
 </description>
 <references>
	<cvename>CVE-2001-0775</cvename>
	<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=99477230306845</mlist>
	<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=46186</url>
	<url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
 </references>
 <dates>
 <discovery>2000-02-19</discovery>
 <entry>2005-06-03</entry>
 </dates>
 </vuln>

<vuln vid="99b5cfa5-d3d2-11d9-8ffb-00061bc2ad93">
 <topic>yamt -- buffer overflow and directory traversal issues</topic>
 <affects>
 <package>
	<name>yamt</name>
	<range><lt>0.5_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stanislav Brabec discovered errors in yamt's path name
	 handling that lead to buffer overflows and directory traversal
	 issues. When processing a file with a maliciously crafted ID3
	 tag, yamt might overwrite arbitrary files or possibly execute
	 arbitrary code.
	The SuSE package ChangeLog contains:
	<blockquote>
	 <ul>
	 <li>Several security fixes (#49337):</li>
	 <li>directory traversal in rename</li>
	 <li>directory traversal in sort</li>
	 <li>buffer overflow in sort</li>
	 <li>buffer overflow in rename</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1846</cvename>
 <cvename>CVE-2005-1847</cvename>
 <url>http://rpmfind.net/linux/RPM/suse/updates/8.2/i386/rpm/i586/yamt-0.5-1277.i586.html</url>
 <url>ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/yamt-0.5-1277.src.rpm</url>
 </references>
 <dates>
 <discovery>2005-01-20</discovery>
 <entry>2005-06-03</entry>
 </dates>
 </vuln>

<vuln vid="ae6ec9b8-2f43-4d02-8129-c6a3a53ef09d">
 <topic>xview -- multiple buffer overflows in xv_parse_one</topic>
 <affects>
 <package>
	<name>xview</name>
	<range><lt>3.2.1_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Debian Security Advisory reports:
	<blockquote cite="http://www.debian.org/security/2005/dsa-672">
	 Erik Sjölund discovered that programs linked against xview
	 are vulnerable to a number of buffer overflows in the XView
	 library. When the overflow is triggered in a program which
	 is installed setuid root a malicious user could perhaps
	 execute arbitrary code as privileged user.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0076</cvename>
 <url>http://www.debian.org/security/2005/dsa-672</url>
 <url>http://xforce.iss.net/xforce/xfdb/19271</url>
 </references>
 <dates>
 <discovery>2005-02-09</discovery>
 <entry>2005-06-01</entry>
 </dates>
 </vuln>

<vuln vid="f7e8d2ca-410e-40b2-8748-3abd021e44a9">
 <topic>xtrlock -- X display locking bypass</topic>
 <affects>
 <package>
	<name>xtrlock</name>
	<range><lt>2.0.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The X display locking program <code>xtrlock</code> contains
	 an integer overflow bug. It is possible for an attacker with
	 physical access to the system to bypass the display lock.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0079</cvename>
 <url>http://www.debian.org/security/2005/dsa-649</url>
 <url>http://xforce.iss.net/xforce/xfdb/18991</url>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278191</url>
 </references>
 <dates>
 <discovery>2004-10-25</discovery>
 <entry>2005-06-01</entry>
 </dates>
 </vuln>

<vuln vid="bf2e7483-d3fa-440d-8c6e-8f1f2f018818">
 <topic>linux_base -- vulnerabilities in Red Hat 7.1 libraries</topic>
 <affects>
 <package>
	<name>linux_base</name>
	<range><lt>7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Trevor Johnson reported that the Red Hat Linux RPMs used
	 by linux_base contained multiple older vulnerabilities, such
	 as a DNS resolver issue and critical bugs in X font handling
	 and XPM image handling.
 </body>
 </description>
 <references>
 <url>http://fedoralegacy.org/updates/RH7.3/2004-10-23-FLSA_2004_1947__Updated_glibc_packages_fix_flaws.html</url>
 <url>http://rhn.redhat.com/errata/RHSA-2004-059.html</url>
 <url>http://rhn.redhat.com/errata/RHSA-2004-478.html</url>
 <url>http://rhn.redhat.com/errata/RHSA-2004-612.html</url>
 <cvename>CVE-2002-0029</cvename>
 <cvename>CVE-2004-0083</cvename>
 <cvename>CVE-2004-0084</cvename>
 <cvename>CVE-2004-0106</cvename>
 <cvename>CVE-2004-0687</cvename>
 <cvename>CVE-2004-0688</cvename>
 <cvename>CVE-2004-0692</cvename>
 <cvename>CVE-2004-0914</cvename>
 </references>
 <dates>
 <discovery>2004-09-27</discovery>
 <entry>2005-06-01</entry>
 </dates>
 </vuln>

<vuln vid="79630c0c-8dcc-45d0-9908-4087fe1d618c">
 <topic>squirrelmail -- XSS and remote code injection vulnerabilities</topic>
 <affects>
 <package>
	<name>squirrelmail</name>
	<name>ja-squirrelmail</name>
	<range><lt>1.4.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A SquirrelMail Security Advisory reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110702772714662">
	 SquirrelMail 1.4.4 has been released to resolve a number of
	 security issues disclosed below. It is strongly recommended
	 that all running SquirrelMail prior to 1.4.4 upgrade to the
	 latest release.
	 <h1>Remote File Inclusion</h1>
	 Manoel Zaninetti reported an issue in src/webmail.php which
	 would allow a crafted URL to include a remote web page.
	 This was assigned CAN-2005-0103 by the Common
	 Vulnerabilities and Exposures.
	 <h1>Cross Site Scripting Issues</h1>
	 A possible cross site scripting issue exists in
	 src/webmail.php that is only accessible when the PHP
	 installation is running with register_globals set to On.
	 This issue was uncovered internally by the SquirrelMail
	 Development team. This isssue was assigned CAN-2005-0104 by
	 the Common Vulnerabilities and Exposures.
	 A second issue which was resolved in the 1.4.4-rc1 release
	 was uncovered and assigned CAN-2004-1036 by the Common
	 Vulnerabilities and Exposures. This issue could allow a
	 remote user to send a specially crafted header and cause
	 execution of script (such as javascript) in the client
	 browser.
	 <h1>Local File Inclusion</h1>
	 A possible local file inclusion issue was uncovered by one
	 of our developers involving custom preference handlers.
	 This issue is only active if the PHP installation is running
	 with register_globals set to On.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1036</cvename>
 <cvename>CVE-2005-0075</cvename>
 <cvename>CVE-2005-0103</cvename>
 <cvename>CVE-2005-0104</cvename>
 <mlist msgid="47249.24.0.109.81.1106975343.squirrel@sm-14.netdork.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110702772714662</mlist>
 <url>http://www.squirrelmail.org/security/issue/2005-01-14</url>
 <url>http://www.squirrelmail.org/security/issue/2005-01-19</url>
 <url>http://www.squirrelmail.org/security/issue/2005-01-20</url>
 </references>
 <dates>
 <discovery>2005-01-29</discovery>
 <entry>2005-06-01</entry>
 </dates>
 </vuln>

<vuln vid="0d9ba03b-0dbb-42b4-ae0f-60e27af78e22">
 <topic>sympa -- buffer overflow in "queue"</topic>
 <affects>
 <package>
	<name>sympa</name>
	<range><lt>4.1.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Erik Sjölund discovered a vulnerability in Sympa. The
	 <code>queue</code> application processes messages received via
	 aliases. It contains a buffer overflow in the usage of
	 <code>sprintf</code>. In some configurations, it may allow an
	 attacker to execute arbitrary code as the <code>sympa</code>
	 user.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0073</cvename>
 <url>http://www.debian.org/security/2005/dsa-677</url>
 </references>
 <dates>
 <discovery>2005-02-11</discovery>
 <entry>2005-06-01</entry>
 </dates>
 </vuln>

<vuln vid="b3cd00f7-c0c5-452d-87bc-086c5635333e">
 <topic>mailman -- generated passwords are poor quality</topic>
 <affects>
 <package>
	<name>mailman</name>
	<name>ja-mailman</name>
	<range><lt>2.1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Florian Weimer wrote:
	<blockquote cite="http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht">
	 Mailman 2.1.5 uses weak auto-generated passwords for new
	 subscribers. These passwords are assigned when members
	 subscribe without specifying their own password (either by
	 email or the web frontend). Knowledge of this password
	 allows an attacker to gain access to the list archive even
	 though she's not a member and the archive is restricted to
	 members only. [...]
	 This means that only about 5 million different passwords
	 are ever generated, a number that is in the range of brute
	 force attacks -- you only have to guess one subscriber
	 address (which is usually not that hard).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1143</cvename>
 <mlist>http://mail.python.org/pipermail/mailman-developers/2004-December/017553.html</mlist>
 <mlist msgid="87llc0u6l8.fsf@deneb.enyo.de">http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht</mlist>
 </references>
 <dates>
 <discovery>2004-12-15</discovery>
 <entry>2005-06-01</entry>
 </dates>
 </vuln>

<vuln vid="ad9d2518-3471-4737-b60b-9a1f51023b28">
 <topic>mailman -- password disclosure</topic>
 <affects>
 <package>
	<name>mailman</name>
	<name>ja-mailman</name>
	<range><lt>2.1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Barry Warsaw reports:
	<blockquote cite="http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html">
	 Today I am releasing Mailman 2.1.5, a bug fix release
	 [...] This version also contains a fix for an exploit that
	 could allow 3rd parties to retrieve member passwords. It is
	 thus highly recommended that all existing sites upgrade to
	 the latest version.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0412</cvename>
 <mlist>http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html</mlist>
 </references>
 <dates>
 <discovery>2004-05-15</discovery>
 <entry>2005-06-01</entry>
 </dates>
 </vuln>

<vuln vid="26a08c77-32da-4dd7-a884-a76fc49aa824">
 <topic>tomcat -- Tomcat Manager cross-site scripting</topic>
 <affects>
 <package>
	<name>jakarta-tomcat</name>
	<range><ge>5.0.*</ge><lt>5.0.30_5</lt></range>
	<range><ge>5.5.*</ge><lt>5.5.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Oliver Karow discovered cross-site scripting issues in
	 the Apache Jakarta Tomcat manager. The developers refer to
	 the issues as <q>minor</q>.
 </body>
 </description>
 <references>
 <url>http://www.oliverkarow.de/research/jakarta556_xss.txt</url>
 <mlist>http://www.mail-archive.com/tomcat-dev@jakarta.apache.org/msg66978.html</mlist>
 </references>
 <dates>
 <discovery>2005-01-03</discovery>
 <entry>2005-06-01</entry>
 <modified>2006-09-12</modified>
 </dates>
 </vuln>

<vuln vid="84479a62-ca5f-11d9-b772-000c29b00e99">
 <topic>fswiki -- XSS problem in file upload form</topic>
 <affects>
 <package>
	<name>fswiki</name>
	<range><le>3.5.6</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia security advisory reports:
	<blockquote cite="http://secunia.com/advisories/15538">
	 A vulnerability has been reported in FreeStyle Wiki and
	 FSWikiLite, which can be exploited by malicious people to
	 conduct script insertion attacks.
	 Input passed in uploaded attachments is not properly
	 sanitised before being used. This can be exploited to inject
	 arbitrary HTML and script code, which will be executed in a
	 user's browser session in context of an affected site when
	 the malicious attachment is viewed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1799</cvename>
 <url>http://secunia.com/advisories/15538</url>
 <freebsdpr>ports/81520</freebsdpr>
 <url>http://fswiki.poi.jp/wiki.cgi?page=%CD%FA%CE%F2%2F2005%2D5%2D19</url>
 <url>http://jvn.jp/jp/JVN%23465742E4/index.html</url>
 </references>
 <dates>
 <discovery>2005-05-19</discovery>
 <entry>2005-05-29</entry>
 <modified>2005-06-01</modified>
 </dates>
 </vuln>

<vuln vid="2fbe16c2-cab6-11d9-9aed-000e0c2e438a">
 <topic>freeradius -- sql injection and denial of service vulnerability</topic>
 <affects>
 <package>
	<name>freeradius</name>
	<range><le>1.0.2_1</le></range>
 </package>
 <package>
	<name>freeradius-devel</name>
	<range><le>1.0.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Gentoo Advisory reports:
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml">
	 The FreeRADIUS server is vulnerable to an SQL injection
	 attack and a buffer overflow, possibly resulting in
	 disclosure and modification of data and Denial of
	 Service.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13540</bid>
 <bid>13541</bid>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml</url>
 </references>
 <dates>
 <discovery>2005-05-17</discovery>
 <entry>2005-05-22</entry>
 <modified>2008-01-20</modified>
 </dates>
 </vuln>

<vuln vid="641e8609-cab5-11d9-9aed-000e0c2e438a">
 <topic>ppxp -- local root exploit</topic>
 <affects>
 <package>
	<name>ppxp</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>ja-ppxp</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Debian Advisory reports:
	<blockquote cite="http://www.debian.org/security/2005/dsa-725">
	 Jens Steube discovered that ppxp, yet another PPP program,
	 does not release root privileges when opening potentially
	 user supplied log files. This can be tricked into opening
	 a root shell.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0392</cvename>
 <url>http://www.debian.org/security/2005/dsa-725</url>
 </references>
 <dates>
 <discovery>2005-05-19</discovery>
 <entry>2005-05-22</entry>
 </dates>
 </vuln>

<vuln vid="1033750f-cab4-11d9-9aed-000e0c2e438a">
 <topic>oops -- format string vulnerability</topic>
 <affects>
 <package>
	<name>oops</name>
	<range><le>1.5.24</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A RST/GHC Advisory reports that there is an format string
	 vulnerability in oops. The vulnerability can be found in
	 the MySQL/PgSQL authentication module. Succesful
	 exploitation may allow execution of arbitrary code.
 </body>
 </description>
 <references>
 <bid>13172</bid>
 <cvename>CVE-2005-1121</cvename>
 <url>http://rst.void.ru/papers/advisory24.txt</url>
 </references>
 <dates>
 <discovery>2005-04-14</discovery>
 <entry>2005-05-22</entry>
 </dates>
 </vuln>

<vuln vid="d51a7e6e-c546-11d9-9aed-000e0c2e438a">
 <topic>cdrdao -- unspecified privilege escalation vulnerability</topic>
 <affects>
 <package>
	<name>cdrdao</name>
	<range><lt>1.2.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The developers of cdrdao report that there is a potential
	 root exploit in the software. In order to be able to
	 succesfully exploit this vulnerability cdrdao must be
	 installed setuid root. When succesfully exploited a local
	 user might get escalated privileges.	By default this port is
	 not installed setuid root.
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/15354/</url>
 <url>http://sourceforge.net/forum/forum.php?forum_id=466399</url>
 </references>
 <dates>
 <discovery>2005-05-13</discovery>
 <entry>2005-05-19</entry>
 </dates>
 </vuln>

<vuln vid="ad5e70bb-c429-11d9-ac59-02061b08fc24">
 <topic>gaim -- MSN remote DoS vulnerability</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GAIM team reports:
	<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=17">
	 Potential remote denial of service bug resulting from not
	 checking a pointer for non-NULL before passing it to
	 strncmp, which results in a crash. This can be triggered
	 by a remote client sending an SLP message with an empty
	 body.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1262</cvename>
 <url>http://gaim.sourceforge.net/security/index.php?id=17</url>
 </references>
 <dates>
 <discovery>2005-05-10</discovery>
 <entry>2005-05-14</entry>
 </dates>
 </vuln>

<vuln vid="889061af-c427-11d9-ac59-02061b08fc24">
 <topic>gaim -- remote crash on some protocols</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.3.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GAIM team reports that GAIM is vulnerable to a
	 denial-of-service vulnerability which can cause GAIM to
	 crash:
	<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=16">
	 It is possible for a remote user to overflow a static
	 buffer by sending an IM containing a very large URL
	 (greater than 8192 bytes) to the Gaim user. This is not
	 possible on all protocols, due to message length
	 restrictions. Jabber are SILC are known to be
	 vulnerable.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1261</cvename>
 <url>http://gaim.sourceforge.net/security/index.php?id=16</url>
 </references>
 <dates>
 <discovery>2005-05-10</discovery>
 <entry>2005-05-14</entry>
 </dates>
 </vuln>

<vuln vid="180e9a38-060f-4c16-a6b7-49f3505ff22a">
 <topic>kernel -- information disclosure when using HTT</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_1</lt></range>
	<range><ge>5.0</ge><lt>5.3_15</lt></range>
	<range><ge>4.11</ge><lt>4.11_9</lt></range>
	<range><lt>4.10_14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem description and impact</h1>
	When running on processors supporting Hyper-Threading Technology, it
	 is possible for a malicious thread to monitor the execution of another
	 thread.
	Information may be disclosed to local users, allowing in many
	 cases for privilege escalation. For example, on a multi-user
	 system, it may be possible to steal cryptographic keys used in
	 applications such as OpenSSH or SSL-enabled web servers.
	NOTE: Similar problems may exist in other
	 simultaneous multithreading implementations, or even some
	 systems in the absence of simultaneous multithreading.
	 However, current research has only demonstrated this flaw in
	 Hyper-Threading Technology, where shared memory caches are
	 used.
	<h1>Workaround</h1>
	Systems not using processors with Hyper-Threading Technology
	 support are not affected by this issue. On systems which are
	 affected, the security flaw can be eliminated by setting the
	 "machdep.hlt_logical_cpus" tunable:
	<pre># echo "machdep.hlt_logical_cpus=1" &gt;&gt; /boot/loader.conf</pre>
	The system must be rebooted in order for tunables to take effect.
	Use of this workaround is not recommended on "dual-core" systems, as
	 this workaround will also disable one of the processor
	 cores.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0109</cvename>
 <freebsdsa>SA-05:09.htt</freebsdsa>
 <url>http://www.daemonology.net/hyperthreading-considered-harmful/</url>
 </references>
 <dates>
 <discovery>2005-05-13</discovery>
 <entry>2005-05-13</entry>
 </dates>
 </vuln>

<vuln vid="66dbb2ee-99b8-45b2-bb3e-640caea67a60">
 <topic>leafnode -- fetchnews denial-of-service triggered by transmission abort/timeout</topic>
 <affects>
 <package>
	<name>leafnode</name>
	<range><ge>1.9.48</ge><lt>1.11.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 When an upstream server aborts the transmission or stops sending
	 data after the fetchnews program has requested an article header
	 or body, fetchnews may crash, without querying further servers
	 that are configured. This can prevent articles from being fetched.
	
 </body>
 </description>
 <references>
 <url>http://leafnode.sourceforge.net/leafnode-SA-2005-01.txt</url>
 <cvename>CVE-2005-1453</cvename>
 <freebsdpr>ports/80663</freebsdpr>
 <bid>13489</bid>
 <bid>13492</bid>
 <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://sourceforge.net/mailarchive/forum.php?thread_id=7186974&amp;forum_id=10210</mlist>
 <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/52</mlist>
 <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://www.dt.e-technik.uni-dortmund.de/pipermail/leafnode-list/2005q2/000900.html</mlist>
 <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://www.fredi.de/maillist/msg00111.html</mlist>
 <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0037.html</mlist>
 <url>http://www.frsirt.com/english/advisories/2005/0468</url>
 <url>http://secunia.com/advisories/15252</url>
 </references>
 <dates>
 <discovery>2005-05-04</discovery>
 <entry>2005-05-13</entry>
 </dates>
 </vuln>

<vuln vid="a6427195-c2c7-11d9-89f7-02061b08fc24">
 <topic>mozilla -- privilege escalation via non-DOM property overrides</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.4,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.0.4</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.8,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.8</lt></range>
	<range><ge>1.8.*</ge></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory reports:
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-44.html">
	 Additional checks were added to make sure Javascript eval
	 and Script objects are run with the privileges of the
	 context that created them, not the potentially elevated
	 privilege of the context calling them in order to protect
	 against an additional variant of <a href="http://www.mozilla.org/security/announce/mfsa2005-41.html">MFSA
	 2005-41</a>.
	</blockquote>
	The Mozilla Foundation Security Advisory MFSA 2005-41
	 reports:
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-41.html">
	 moz_bug_r_a4 reported several exploits giving an attacker
	 the ability to install malicious code or steal data,
	 requiring only that the user do commonplace actions like
	 click on a link or open the context menu.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.mozilla.org/security/announce/mfsa2005-44.html</url>
 </references>
 <dates>
 <discovery>2005-05-11</discovery>
 <entry>2005-05-12</entry>
 </dates>
 </vuln>

<vuln vid="a81746a1-c2c7-11d9-89f7-02061b08fc24">
 <topic>mozilla -- "Wrapped" javascript: urls bypass security checks</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.4,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.0.4</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.8,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.8</lt></range>
	<range><ge>1.8.*</ge></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory reports:
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-43.html">
	 Some security checks intended to prevent script injection
	 were incorrect and could be bypassed by wrapping a
	 javascript: url in the view-source:
	 pseudo-protocol. Michael Krax demonstrated that a variant
	 of his <a href="http://www.mozilla.org/security/announce/mfsa2005-37.html">favicon</a>
	 exploit could still execute arbitrary code, and the same
	 technique could also be used to perform cross-site
	 scripting.
	 Georgi Guninski demonstrated the same flaw wrapping
	 javascript: urls with the jar: pseudo-protocol.
	 L. David Baron discovered a nested variant that defeated
	 checks in the script security manager.
	 Workaround: Disable Javascript
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.mozilla.org/security/announce/mfsa2005-43.html</url>
 </references>
 <dates>
 <discovery>2005-05-11</discovery>
 <entry>2005-05-12</entry>
 </dates>
 </vuln>

<vuln vid="eca6195a-c233-11d9-804c-02061b08fc24">
 <topic>mozilla -- code execution via javascript: IconURL vulnerability</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.4,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.0.4</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.8,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.8</lt></range>
	<range><ge>1.8.*</ge></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory reports:
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-42.html">
	 Two vulnerabilities have been discovered in Firefox,
	 which can be exploited by malicious people to conduct
	 cross-site scripting attacks and compromise a user's
	 system.
	 <ol>
	 <li>The problem is that "IFRAME" JavaScript URLs are not
	 properly protected from being executed in context of
	 another URL in the history list. This can be exploited
	 to execute arbitrary HTML and script code in a user's
	 browser session in context of an arbitrary site.</li>
	 <li>Input passed to the "IconURL" parameter in
	 "InstallTrigger.install()" is not properly verified
	 before being used. This can be exploited to execute
	 arbitrary JavaScript code with escalated privileges via
	 a specially crafted JavaScript URL.</li>
	 </ol>
	 Successful exploitation requires that the site is allowed
	 to install software (default sites are
	 "update.mozilla.org" and "addons.mozilla.org").
	 A combination of vulnerability 1 and 2 can be exploited
	 to execute arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1476</cvename>
 <cvename>CVE-2005-1477</cvename>
 <url>http://www.mozilla.org/security/announce/mfsa2005-42.html</url>
 </references>
 <dates>
 <discovery>2005-05-08</discovery>
 <entry>2005-05-11</entry>
 </dates>
 </vuln>

<vuln vid="01bb84e2-bd88-11d9-a281-02e018374e71">
 <topic>groff -- pic2graph and eqn2graph are vulnerable to symlink attack through temporary files</topic>
 <affects>
 <package>
	<name>ja-groff</name>
	<range><ge>1.18.1</ge><lt>1.18.1_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The eqn2graph and pic2graph scripts in groff 1.18.1
	 allow local users to overwrite arbitrary files via
	 a symlink attack on temporary files.
 </body>
 </description>
 <references>
 <freebsdpr>ports/80671</freebsdpr>
 <bid>12058</bid>
 <cvename>CVE-2004-1296</cvename>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286371</url>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286372</url>
 </references>
 <dates>
 <discovery>2004-12-20</discovery>
 <entry>2005-05-09</entry>
 </dates>
 </vuln>

<vuln vid="169f422f-bd88-11d9-a281-02e018374e71">
 <topic>groff -- groffer uses temporary files unsafely</topic>
 <affects>
 <package>
	<name>ja-groff</name>
	<range><ge>1.18</ge><lt>1.18.1_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The groffer script in the groff package 1.18 and later versions
	 allows local users to overwrite files via a symlink attack
	 on temporary files.
 </body>
 </description>
 <references>
 <freebsdpr>ports/80671</freebsdpr>
 <bid>11287</bid>
 <cvename>CVE-2004-0969</cvename>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278265</url>
 </references>
 <dates>
 <discovery>2004-09-30</discovery>
 <entry>2005-05-09</entry>
 </dates>
 </vuln>

<vuln vid="5f003a08-ba3c-11d9-837d-000e0c2e438a">
 <topic>sharutils -- unshar insecure temporary file creation</topic>
 <affects>
 <package>
	<name>sharutils</name>
	<range><lt>4.3.80</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An Ubuntu Advisory reports:
	<blockquote cite="http://www.ubuntulinux.org/support/documentation/usn/usn-104-1">
	 Joey Hess discovered that "unshar" created temporary files
	 in an insecure manner. This could allow a symbolic link
	 attack to create or overwrite arbitrary files with the
	 privileges of the user invoking the program.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12981</bid>
 <cvename>CVE-2005-0990</cvename>
 <url>http://www.ubuntulinux.org/support/documentation/usn/usn-104-1</url>
 </references>
 <dates>
 <discovery>2005-04-04</discovery>
 <entry>2005-05-01</entry>
 </dates>
 </vuln>

<vuln vid="8c5ad0cf-ba37-11d9-837d-000e0c2e438a">
 <topic>rsnapshot -- local privilege escalation</topic>
 <affects>
 <package>
	<name>rsnapshot</name>
	<range><lt>1.1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An rsnapshot Advisory reports:
	<blockquote cite="http://www.rsnapshot.org/security/2005/001.html">
	 The copy_symlink() subroutine in rsnapshot incorrectly
	 changes file ownership on the files pointed to by symlinks,
	 not on the symlinks themselves. This would allow, under
	 certain circumstances, an arbitrary user to take ownership
	 of a file on the main filesystem.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13095</bid>
 <cvename>CVE-2005-1064</cvename>
 <url>http://www.rsnapshot.org/security/2005/001.html</url>
 </references>
 <dates>
 <discovery>2005-04-10</discovery>
 <entry>2005-05-01</entry>
 </dates>
 </vuln>

<vuln vid="756db070-b9d4-11d9-ae81-000ae42e9b93">
 <topic>coppermine -- IP spoofing and XSS vulnerability</topic>
 <affects>
 <package>
	<name>coppermine</name>
	<range><lt>1.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GHC team reports about coppermine
	<blockquote cite="http://www.securityfocus.com/archive/1/396080">
	 The lack of sanitizing of user defined variables may
	 result in undesirable consequences such as IP spoofing
	 or XSS attack.
	 Generally users of Coppermine Gallery can post comments.
	 Remote address &amp; x-forwarded-for variables are logged
	 for admin's eyes. X-Forwarded-for variable does not pass
	 throu any filtration before logging into database. User
	 can define/redefine this variable.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist msgid="20050418122434.10438.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/396080</mlist>
 <bid>13218</bid>
 <cvename>CVE-2005-1172</cvename>
 <url>http://coppermine.sourceforge.net/board/index.php?topic=17134.0</url>
 </references>
 <dates>
 <discovery>2005-04-18</discovery>
 <entry>2005-05-01</entry>
 </dates>
 </vuln>

<vuln vid="cd286cc5-b762-11d9-bfb7-000c6ec775d9">
 <topic>ImageMagick -- ReadPNMImage() heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Damian Put reports about ImageMagick:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111445767107869">
	 Remote exploitation of a heap overflow vulnerability
	 could allow execution of arbitrary code or course denial
	 of service.
	 A heap overflow exists in ReadPNMImage() function, that
	 is used to decode a PNM image files.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13351</bid>
 <url>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111445767107869</url>
 </references>
 <dates>
 <discovery>2005-04-25</discovery>
 <entry>2005-04-27</entry>
 </dates>
 </vuln>

<vuln vid="91c606fc-b5d0-11d9-a788-0001020eed82">
 <topic>mplayer &amp; libxine -- MMS and Real RTSP buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>mplayer</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.7</lt></range>
 </package>
 <package>
	<name>libxine</name>
	<range><ge>0.9.9</ge><lt>1.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A xine security announcement reports:
	<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-8">
	 By a user receiving data from a malicious network
	 streaming server, an attacker can overrun a heap buffer,
	 which can, on some systems, lead to or help in executing
	 attacker-chosen malicious code with the permissions of the
	 user running a xine-lib based media application.
	 Both the MMS and Real RTSP streaming client code made
	 some too-strong assumptions on the transferred
	 data. Several critical bounds checks were missing,
	 resulting in the possibility of heap overflows, should the
	 remote server not adhere to these assumptions. In the MMS
	 case, a remote server could present content with too many
	 individual streams; in the RTSP case, a remote server's
	 reply could have too many lines.
	 An attacker can set up a server delivering malicious data
	 to the users. This can be used to overflow a heap buffer,
	 which can, with certain implementations of heap
	 management, lead to attacker chosen data written to the
	 stack. This can cause attacker-chosen code being executed
	 with the permissions of the user running the
	 application. By tricking users to retrieve a stream, which
	 can be as easy as providing a link on a website, this
	 vulnerability can be exploited remotely.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13270</bid>
 <bid>13271</bid>
 <cvename>CVE-2005-1195</cvename>
 <url>http://www.mplayerhq.hu/homepage/design7/news.html#vuln10</url>
 <url>http://www.mplayerhq.hu/homepage/design7/news.html#vuln11</url>
 <url>http://xinehq.de/index.php/security/XSA-2004-8</url>
 </references>
 <dates>
 <discovery>2005-04-16</discovery>
 <entry>2005-04-25</entry>
 </dates>
 </vuln>

<vuln vid="8b0e94cc-b5cd-11d9-a788-0001020eed82">
 <topic>gaim -- AIM/ICQ remote denial of service vulnerability</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GAIM team reports that GAIM is vulnerable to a
	 denial-of-service vulnerability which can cause GAIM to
	 freeze:
	<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=10">
	 Certain malformed SNAC packets sent by other AIM or ICQ
	 users can trigger an infinite loop in Gaim when parsing
	 the SNAC. The remote user would need a custom client, able
	 to generate malformed SNACs.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0472</cvename>
 <url>http://gaim.sourceforge.net/security/index.php?id=10</url>
 </references>
 <dates>
 <discovery>2005-02-17</discovery>
 <entry>2005-04-25</entry>
 </dates>
 </vuln>

<vuln vid="142353df-b5cc-11d9-a788-0001020eed82">
 <topic>gaim -- remote DoS on receiving malformed HTML</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GAIM team reports:
	<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=12">
	 Receiving malformed HTML can result in an invalid memory
	 access causing Gaim to crash.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0208</cvename>
 <cvename>CVE-2005-0473</cvename>
 <url>http://gaim.sourceforge.net/security/index.php?id=11</url>
 <url>http://gaim.sourceforge.net/security/index.php?id=12</url>
 </references>
 <dates>
 <discovery>2005-02-17</discovery>
 <entry>2005-04-25</entry>
 </dates>
 </vuln>

<vuln vid="91f1adc7-b3e9-11d9-a788-0001020eed82">
 <topic>kdewebdev -- kommander untrusted code execution vulnerability</topic>
 <affects>
 <package>
	<name>kdewebdev</name>
	<range><gt>3.2,2</gt><lt>3.4.0_1,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A KDE Security Advisory reports:
	<blockquote cite="http://www.kde.org/info/security/advisory-20050420-1.txt">
	 Kommander executes without user confirmation data files
	 from possibly untrusted locations. As they contain
	 scripts, the user might accidentally run arbitrary
	 code.
	 Impact: Remotly supplied kommander files
	 from untrusted sources are executed without
	 confirmation.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0754</cvename>
 <url>http://www.kde.org/info/security/advisory-20050420-1.txt</url>
 </references>
 <dates>
 <discovery>2005-04-20</discovery>
 <entry>2005-04-23</entry>
 <modified>2008-08-04</modified>
 </dates>
 </vuln>

<vuln vid="97edf5ab-b319-11d9-837d-000e0c2e438a">
 <topic>junkbuster -- heap corruption vulnerability and configuration modification vulnerability</topic>
 <affects>
 <package>
	<name>junkbuster</name>
	<range><lt>2.0.2_3</lt></range>
 </package>
 <package>
	<name>junkbuster-zlib</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Debian advisory reports:
	<blockquote cite="http://www.debian.org/security/2005/dsa-713">
	 James Ranson discovered that an attacker can modify the
	 referrer setting with a carefully crafted URL by accidently
	 overwriting a global variable.
	 Tavis Ormandy from the Gentoo Security Team discovered
	 several heap corruptions due to inconsistent use of an
	 internal function that can crash the daemon or possibly
	 lead to the execution of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13146</bid>
 <bid>13147</bid>
 <cvename>CVE-2005-1108</cvename>
 <cvename>CVE-2005-1109</cvename>
 <url>http://www.debian.org/security/2005/dsa-713</url>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200504-11.xml</url>
 </references>
 <dates>
 <discovery>2005-04-13</discovery>
 <entry>2005-04-22</entry>
 </dates>
 </vuln>

<vuln vid="06404241-b306-11d9-a788-0001020eed82">
 <topic>kdelibs -- kimgio input validation errors</topic>
 <affects>
 <package>
	<name>kdelibs</name>
	<range><ge>3.2</ge><lt>3.4.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A KDE Security Advisory reports:
	<blockquote cite="http://www.kde.org/info/security/advisory-20050421-1.txt">
	 kimgio contains a PCX image file format reader that does
	 not properly perform input validation. A source code audit
	 performed by the KDE security team discovered several
	 vulnerabilities in the PCX and other image file format
	 readers, some of them exploitable to execute arbitrary
	 code.
	 Impact: Remotely supplied, specially
	 crafted image files can be used to execute arbitrary
	 code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1046</cvename>
 <url>http://bugs.kde.org/102328</url>
 <url>http://www.kde.org/info/security/advisory-20050421-1.txt</url>
 </references>
 <dates>
 <discovery>2005-04-21</discovery>
 <entry>2005-04-22</entry>
 </dates>
 </vuln>

<vuln vid="6c2d4f29-af3e-11d9-837d-000e0c2e438a">
 <topic>gld -- format string and buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>gld</name>
	<range><lt>1.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gld has been found vulnerable to multiple buffer overflows as
	 well as multiple format string vulnerabilities.
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111339935903880">
	 An attacker could exploit this vulnerability to execute
	 arbitrary code with the permissions of the user running Gld,
	 the default user being root.
	</blockquote>
	The FreeBSD port defaults to running gld as the root user.
	 The risk of exploitation can be minimized by making gld
	 listen on the loopback address only, or configure it to only
	 accept connections from trusted smtp servers.
 </body>
 </description>
 <references>
 <bid>13129</bid>
 <bid>13133</bid>
 <cvename>CVE-2005-1099</cvename>
 <cvename>CVE-2005-1100</cvename>
 <mlist msgid="20050412004111.562AC7A890E@ws4-4.us4.outblaze.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111339935903880</mlist>
 <mlist msgid="20050413174736.20947.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111342432325670</mlist>
 </references>
 <dates>
 <discovery>2005-04-12</discovery>
 <entry>2005-04-19</entry>
 </dates>
 </vuln>

<vuln vid="0163b498-af54-11d9-acd0-000854d03344">
 <topic>axel -- remote buffer overflow</topic>
 <affects>
 <package>
	<name>axel</name>
	<range><lt>1.0a_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Debian Security Advisory reports:
	<blockquote cite="http://www.debian.org/security/2005/dsa-706">
	 Ulf Härnhammar from the Debian Security Audit Project
	 discovered a buffer overflow in axel, a light download
	 accelerator.	When reading remote input the program did
	 not check if a part of the input can overflow a buffer
	 and maybe trigger the execution of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13059</bid>
 <cvename>CVE-2005-0390</cvename>
 <url>http://www.debian.org/security/2005/dsa-706</url>
 </references>
 <dates>
 <discovery>2005-04-16</discovery>
 <entry>2005-04-17</entry>
 </dates>
 </vuln>

<vuln vid="ce6ac624-aec8-11d9-a788-0001020eed82">
 <topic>firefox -- PLUGINSPAGE privileged javascript execution</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.3,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory reports:
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-34.html">
	 When a webpage requires a plugin that is not installed
	 the user can click to launch the Plugin Finder Service
	 (PFS) to find an appropriate plugin. If the service does
	 not have an appropriate plugin the EMBED tag is checked
	 for a PLUGINSPAGE attribute, and if one is found the PFS
	 dialog will contain a "manual install" button that will
	 load the PLUGINSPAGE url.
	 Omar Khan reported that if the PLUGINSPAGE attribute
	 contains a javascript: url then pressing the button could
	 launch arbitrary code capable of stealing local data or
	 installing malicious code.
	 Doron Rosenberg reported a variant that injects script by
	 appending it to a malformed URL of any protocol.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0752</cvename>
 <url>http://www.mozilla.org/security/announce/mfsa2005-34.html</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=288556</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=289171</url>
 </references>
 <dates>
 <discovery>2005-03-31</discovery>
 <entry>2005-04-16</entry>
 </dates>
 </vuln>

<vuln vid="18e5428f-ae7c-11d9-837d-000e0c2e438a">
 <topic>jdk -- jar directory traversal vulnerability</topic>
 <affects>
 <package>
	<name>jdk</name>
	<range><le>1.2.2p11_3</le></range>
	<range><ge>1.3.*</ge><le>1.3.1p9_4</le></range>
	<range><ge>1.4.*</ge><le>1.4.2p7</le></range>
	<range><ge>1.5.*</ge><le>1.5.0p1_1</le></range>
 </package>
 <package>
	<name>linux-ibm-jdk</name>
	<range><le>1.4.2_1</le></range>
 </package>
 <package>
	<name>linux-sun-jdk</name>
	<range><le>1.4.2.08_1</le></range>
	<range><eq>1.5.0b1</eq></range>
	<range><eq>1.5.0b1,1</eq></range>
	<range><ge>1.5.0,2</ge><le>1.5.0.02,2</le></range>
 </package>
 <package>
	<name>linux-blackdown-jdk</name>
	<range><le>1.4.2_2</le></range>
 </package>
 <package>
	<name>diablo-jdk</name>
	<range><le>1.3.1.0_1</le></range>
 </package>
 <package>
	<name>diablo-jdk-freebsd6</name>
	<range><le>i386.1.5.0.07.00</le></range>
 </package>
 <package>
	<name>linux-jdk</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pluf has discovered a vulnerability in Sun Java JDK/SDK,
	 which potentially can be exploited by malicious people to
	 compromise a user's system.
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111331593310508">
	 The jar tool does not check properly if the files to be
	 extracted have the string "../" on its names, so it's
	 possible for an attacker to create a malicious jar file in
	 order to overwrite arbitrary files within the filesystem.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1080</cvename>
 <mlist msgid="200504120226.10559.pluf@7a69ezine.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111331593310508</mlist>
 <url>http://www.securiteam.com/securitynews/5IP0C0AFGW.html</url>
 <url>http://secunia.com/advisories/14902/</url>
 </references>
 <dates>
 <discovery>2005-04-11</discovery>
 <entry>2005-04-16</entry>
 <modified>2006-09-12</modified>
 </dates>
 </vuln>

<vuln vid="f650d5b8-ae62-11d9-a788-0001020eed82">
 <topic>mozilla -- privilege escalation via DOM property overrides</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.3,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.0.3</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.7,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.7</lt></range>
	<range><ge>1.8.*</ge></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory reports:
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-41.html">
	 moz_bug_r_a4 reported several exploits giving an attacker
	 the ability to install malicious code or steal data,
	 requiring only that the user do commonplace actions like
	 click on a link or open the context menu. The common cause
	 in each case was privileged UI code ("chrome") being
	 overly trusting of DOM nodes from the content
	 window. Scripts in the web page can override properties
	 and methods of DOM nodes and shadow the native values,
	 unless steps are taken to get the true underlying values.
	 We found that most extensions also interacted with
	 content DOM in a natural, but unsafe, manner. Changes were
	 made so that chrome code using this natural DOM coding
	 style will now automatically use the native DOM value if
	 it exists without having to use cumbersome wrapper
	 objects.
	 Most of the specific exploits involved tricking the
	 privileged code into calling eval() on an
	 attacker-supplied script string, or the equivalent using
	 the Script() object. Checks were added in the security
	 manager to make sure eval and Script objects are run with
	 the privileges of the context that created them, not the
	 potentially elevated privileges of the context calling
	 them.
	 Workaround: Disable Javascript
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.mozilla.org/security/announce/mfsa2005-41.html</url>
 </references>
 <dates>
 <discovery>2005-04-15</discovery>
 <entry>2005-04-16</entry>
 </dates>
 </vuln>

<vuln vid="1989b511-ae62-11d9-a788-0001020eed82">
 <topic>mozilla -- code execution through javascript: favicons</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.3,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.0.3</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.7,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.7</lt></range>
	<range><ge>1.8.*</ge></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory reports:
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-37.html">
	 Firefox and the Mozilla Suite support custom "favicons"
	 through the &lt;LINK rel="icon"&gt; tag. If a link tag is added
	 to the page programmatically and a javascript: url is
	 used, then script will run with elevated privileges and
	 could run or install malicious software.
	 Workaround: Disable Javascript
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.mozilla.org/security/announce/mfsa2005-37.html</url>
 </references>
 <dates>
 <discovery>2005-04-12</discovery>
 <entry>2005-04-16</entry>
 </dates>
 </vuln>

<vuln vid="45b75152-ae5f-11d9-a788-0001020eed82">
 <topic>mozilla -- javascript "lambda" replace exposes memory contents</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.3,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.0.3</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.7,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.7</lt></range>
	<range><ge>1.8.*</ge></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory reports:
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-33.html">
	 A bug in javascript's regular expression string
	 replacement when using an anonymous function as the
	 replacement argument allows a malicious script to capture
	 blocks of memory allocated to the browser. A web site
	 could capture data and transmit it to a server without
	 user interaction or knowledge.
	 Workaround: Disable Javascript
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0989</cvename>
 <url>http://www.mozilla.org/security/announce/mfsa2005-33.html</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=288688</url>
 </references>
 <dates>
 <discovery>2005-04-01</discovery>
 <entry>2005-04-16</entry>
 </dates>
 </vuln>

<vuln vid="1f2fdcff-ae60-11d9-a788-0001020eed82">
 <topic>firefox -- arbitrary code execution in sidebar panel</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.3,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory reports:
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-39.html">
	 Sites can use the _search target to open links in the
	 Firefox sidebar. Two missing security checks allow
	 malicious scripts to first open a privileged page (such as
	 about:config) and then inject script using a javascript:
	 url. This could be used to install malicious code or steal
	 data without user interaction.
	 Workaround: Disable Javascript
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.mozilla.org/security/announce/mfsa2005-39.html</url>
 </references>
 <dates>
 <discovery>2005-04-12</discovery>
 <entry>2005-04-16</entry>
 </dates>
 </vuln>

<vuln vid="b206dd82-ac67-11d9-a788-0001020eed82">
 <topic>openoffice -- DOC document heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>openoffice</name>
	<name>ar-openoffice</name>
	<name>ca-openoffice</name>
	<name>cs-openoffice</name>
	<name>de-openoffice</name>
	<name>dk-openoffice</name>
	<name>el-openoffice</name>
	<name>es-openoffice</name>
	<name>et-openoffice</name>
	<name>fi-openoffice</name>
	<name>fr-openoffice</name>
	<name>gr-openoffice</name>
	<name>hu-openoffice</name>
	<name>it-openoffice</name>
	<name>ja-openoffice</name>
	<name>ko-openoffice</name>
	<name>nl-openoffice</name>
	<name>pl-openoffice</name>
	<name>pt-openoffice</name>
	<name>pt_BR-openoffice</name>
	<name>ru-openoffice</name>
	<name>se-openoffice</name>
	<name>sk-openoffice</name>
	<name>sl-openoffice-SI</name>
	<name>tr-openoffice</name>
	<name>zh-openoffice-CN</name>
	<name>zh-openoffice-TW</name>
	
	<name>jp-openoffice</name>
	<name>kr-openoffice</name>
	<name>sl-openoffice-SL</name>
	<name>zh-openoffice</name>
	<name>zh_TW-openoffice</name>
	<range><lt>1.1.4_2</lt></range>
	<range><gt>2.*</gt><le>2.0.20050406</le></range>
 </package>
 <package>
	<name>openoffice</name>
	<name>ja-openoffice</name>
	<range><ge>6.0.a609</ge><le>6.0.a638</le></range>
	<range><ge>641c</ge><le>645</le></range>
	<range><eq>1.1RC4</eq></range>
	<range><eq>1.1rc5</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	AD-LAB reports that a heap-based buffer overflow
	 vulnerability exists in OpenOffice's handling of DOC
	 documents. When reading a DOC document 16 bit from a 32 bit
	 integer is used for memory allocation, but the full 32 bit
	 is used for further processing of the document. This can
	 allow an attacker to crash OpenOffice, or potentially
	 execute arbitrary code as the user running OpenOffice, by
	 tricking an user into opening a specially crafted DOC
	 document.
 </body>
 </description>
 <references>
 <bid>13092</bid>
 <cvename>CVE-2005-0941</cvename>
 <mlist msgid="20050412000438.17342.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111325305109137</mlist>
 <url>http://www.openoffice.org/issues/show_bug.cgi?id=46388</url>
 </references>
 <dates>
 <discovery>2005-04-11</discovery>
 <entry>2005-04-13</entry>
 <modified>2005-04-20</modified>
 </dates>
 </vuln>

<vuln vid="22f00553-a09d-11d9-a788-0001020eed82">
 <topic>portupgrade -- insecure temporary file handling vulnerability</topic>
 <affects>
 <package>
	<name>portupgrade</name>
	<range><lt>20041226_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon L. Nielsen discovered that portupgrade handles
	 temporary files in an insecure manner. This could allow an
	 unprivileged local attacker to execute arbitrary commands or
	 overwrite arbitrary files with the permissions of the user
	 running portupgrade, typically root, by way of a symlink
	 attack.
	The following issues exist where the temporary files are
	 created, by default in the world writeable directory
	 /var/tmp, with the permissions of the user running
	 portupgrade:
	<ul>
	 <li>pkg_fetch download packages with a predictable local
	 filename allowing a local attacker to overwrite arbitrary
	 local files or potentially replace the downloaded package
	 after download but before install with a package with
	 malicious content, allowing the attacker to run arbitrary
	 commands.</li>
	 <li>portupgrade will, when upgrading ports/packages, write
	 the old package to a predictable temporary file, allowing
	 an attacker to overwrite arbitrary files via a symlink
	 attack.</li>
	 <li>portupgrade will <q>touch</q> a temporary file
	 with a constant filename (pkgdb.fixme) allowing an
	 attacker to create arbitrary zero-byte files via a symlink
	 attack.</li>
	</ul>
	A workaround for these issues is to set the
	 <code>PKG_TMPDIR</code> environment variable to a directory
	 only write-able by the user running portupgrade.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0610</cvename>
 </references>
 <dates>
 <discovery>2005-04-12</discovery>
 <entry>2005-04-12</entry>
 </dates>
 </vuln>

<vuln vid="ecf68408-a9f5-11d9-a788-0001020eed82">
 <topic>gaim -- jabber remote crash</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GAIM team reports:
	<blockquote cite="http://gaim.sourceforge.net/security/?id=15">
	 A remote jabber user can cause Gaim to crash by sending a
	 specific file transfer request.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13004</bid>
 <cvename>CVE-2005-0967</cvename>
 <url>http://gaim.sourceforge.net/security/?id=15</url>
 </references>
 <dates>
 <discovery>2005-04-04</discovery>
 <entry>2005-04-10</entry>
 </dates>
 </vuln>

<vuln vid="ec09baa3-a9f5-11d9-a788-0001020eed82">
 <topic>gaim -- remote DoS on receiving certain messages over IRC</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GAIM team reports:
	<blockquote cite="http://gaim.sourceforge.net/security/?id=14">
	 The IRC protocol plugin in Gaim 1.2.0, and possibly
	 earlier versions, allows (1) remote attackers to inject
	 arbitrary Gaim markup via irc_msg_kick, irc_msg_mode,
	 irc_msg_part, irc_msg_quit, (2) remote attackers to inject
	 arbitrary Pango markup and pop up empty dialog boxes via
	 irc_msg_invite, or (3) malicious IRC servers to cause a
	 denial of service (application crash) by injecting certain
	 Pango markup into irc_msg_badmode, irc_msg_banned,
	 irc_msg_unknown, irc_msg_nochan functions.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>13003</bid>
 <cvename>CVE-2005-0966</cvename>
 <url>http://gaim.sourceforge.net/security/?id=14</url>
 </references>
 <dates>
 <discovery>2005-04-02</discovery>
 <entry>2005-04-10</entry>
 </dates>
 </vuln>

<vuln vid="3fa2b372-a9f5-11d9-a788-0001020eed82">
 <topic>gaim -- remote DoS on receiving malformed HTML</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The GAIM team reports:
	<blockquote cite="http://gaim.sourceforge.net/security/?id=13">
	 The gaim_markup_strip_html function in Gaim 1.2.0, and
	 possibly earlier versions, allows remote attackers to
	 cause a denial of service (application crash) via a string
	 that contains malformed HTML, which causes an
	 out-of-bounds read.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12999</bid>
 <cvename>CVE-2005-0965</cvename>
 <url>http://gaim.sourceforge.net/security/?id=13</url>
 </references>
 <dates>
 <discovery>2005-04-02</discovery>
 <entry>2005-04-10</entry>
 </dates>
 </vuln>

<vuln vid="07f3fe15-a9de-11d9-a788-0001020eed82">
 <topic>php -- readfile() DoS vulnerability</topic>
 <affects>
 <package>
	<name>mod_php4-twig</name>
	<name>php4-cgi</name>
	<name>php4-cli</name>
	<name>php4-dtc</name>
	<name>php4-horde</name>
	<name>php4-nms</name>
	<name>php4</name>
	<range><lt>4.3.5_7</lt></range>
 </package>
 <package>
	<name>mod_php</name>
	<name>mod_php4</name>
	<range><lt>4.3.5_7,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A SUSE Security advisory reports:
	<blockquote cite="http://www.novell.com/linux/security/advisories/2005_06_sr.html">
	 A bug in the readfile() function of php4 could be used to
	 to crash the httpd running the php4 code when accessing
	 files with a multiple of the architectures page size
	 leading to a denial of service.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12665</bid>
 <cvename>CVE-2005-0596</cvename>
 <url>http://bugs.php.net/bug.php?id=27037</url>
 <url>http://www.novell.com/linux/security/advisories/2005_06_sr.html</url>
 </references>
 <dates>
 <discovery>2004-01-25</discovery>
 <entry>2005-04-10</entry>
 </dates>
 </vuln>

<vuln vid="8dbf7894-a9a8-11d9-a788-0001020eed82">
 <topic>squid -- DoS on failed PUT/POST requests vulnerability</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><le>2.5.7_12</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The squid patches page notes:
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post">
	 An inconsistent state is entered on a failed PUT/POST
	 request making a high risk for segmentation faults or
	 other strange errors
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0718</cvename>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post</url>
 <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1224</url>
 </references>
 <dates>
 <discovery>2005-02-03</discovery>
 <entry>2005-04-10</entry>
 </dates>
 </vuln>

<vuln vid="396ee517-a607-11d9-ac72-000bdb1444a4">
 <topic>horde -- Horde Page Title Cross-Site Scripting Vulnerability</topic>
 <affects>
 <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><gt>3.*</gt><lt>3.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia Advisory: SA14730
	<blockquote cite="http://secunia.com/advisories/14730">
	 A vulnerability has been reported in Horde, which can be
	 exploited by malicious people to conduct cross-site scripting
	 attacks.
	 Input passed when setting the parent frame's page title via
	 JavaScript is not properly sanitised before being returned to
	 the user. This can be exploited to execute arbitrary HTML and
	 script code in a user's browser session in context of an affected
	 site.
	 The vulnerability has been reported in version 3.0.4-RC2. Prior
	 versions may also be affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0961</cvename>
 <mlist msgid="20050329111028.6A112117243@neo.wg.de">http://lists.horde.org/archives/announce/2005/000176.html</mlist>
 <url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.49&amp;r2=1.515.2.93&amp;ty=h</url>
 </references>
 <dates>
 <discovery>2005-03-29</discovery>
 <entry>2005-04-05</entry>
 </dates>
 </vuln>

<vuln vid="ef410571-a541-11d9-a788-0001020eed82">
 <topic>wu-ftpd -- remote globbing DoS vulnerability</topic>
 <affects>
 <package>
	<name>wu-ftpd</name>
	<range><lt>2.6.2_6</lt></range>
 </package>
 <package>
	<name>wu-ftpd+ipv6</name>
	<range><lt>2.6.2_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An iDEFENSE Security Advisory reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110935886414939">
	 Remote exploitation of an input validation vulnerability
	 in version 2.6.2 of WU-FPTD could allow for a denial of
	 service of the system by resource exhaustion.
	 The vulnerability specifically exists in the
	 <code>wu_fnmatch()</code> function in wu_fnmatch.c. When a
	 pattern containing a '*' character is supplied as input,
	 the function calls itself recursively on a smaller
	 substring. By supplying a string which contains a large
	 number of '*' characters, the system will take a long time
	 to return the results, during which time it will be using
	 a large amount of CPU time.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0256</cvename>
 <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E249AF@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110935886414939</mlist>
 </references>
 <dates>
 <discovery>2005-02-05</discovery>
 <entry>2005-04-04</entry>
 </dates>
 </vuln>

<vuln vid="5ebfe901-a3cb-11d9-b248-000854d03344">
 <topic>hashcash -- format string vulnerability</topic>
 <affects>
 <package>
	<name>hashcash</name>
	<range><lt>1.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Gentoo Linux Security Advisory reports:
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml">
	 Tavis Ormandy of the Gentoo Linux Security Audit Team
	 identified a flaw in the Hashcash utility that an attacker
	 could expose by specifying a malformed reply address.
	 Successful exploitation would permit an attacker to disrupt
	 Hashcash users, and potentially execute arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0687</cvename>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml</url>
 </references>
 <dates>
 <discovery>2005-03-06</discovery>
 <entry>2005-04-02</entry>
 <modified>2005-04-03</modified>
 </dates>
 </vuln>

<vuln vid="70b62f5e-9e2e-11d9-a256-0001020eed82">
 <topic>clamav -- zip handling DoS vulnerability</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.81</lt></range>
 </package>
 <package>
	<name>clamav-devel</name>
	<range><lt>20050408</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The clamav daemon is vulnerable to a DoS vulnerability due
	 to insufficient handling of malformed zip files which can
	 crash the clamav daemon.
 </body>
 </description>
 <references>
 <bid>12408</bid>
 <cvename>CVE-2005-0133</cvename>
 <url>http://sourceforge.net/project/shownotes.php?release_id=300116</url>
 </references>
 <dates>
 <discovery>2005-01-27</discovery>
 <entry>2005-03-26</entry>
 <modified>2005-04-09</modified>
 </dates>
 </vuln>

<vuln vid="48a59c96-9c6e-11d9-a040-000a95bc6fae">
 <topic>wine -- information disclosure due to insecure temporary file handling</topic>
 <affects>
 <package>
	<name>wine</name>
	<range><lt>20050310</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Due to insecure temporary file creation in the Wine Windows
	 emulator, it is possible for any user to read potentially
	 sensitive information from temporary registry files.
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111082537009842">
	 When a Win32 application is launched by wine, wine makes
	 a dump of the Windows registry in /tmp with name
	 regxxxxyyyy.tmp , where xxxxxx is the pid in hexadecimal
	 value of the current wine process and yyyy is an integer
	 value usually equal to zero.
	 regxxxxyyyy.tmp is created with 0644 (-rw-r--r--)
	 permissions. This could represent a security problem in a
	 multi-user environment. Indeed, any local user could
	 access to windows regstry's dump and get sensitive
	 information, like passwords and other private data.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0787</cvename>
 <mlist msgid="20050314135701.30231.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111082537009842</mlist>
 <url>http://bugs.winehq.org/show_bug.cgi?id=2715</url>
 <url>http://www.securitytracker.com/alerts/2005/Mar/1013428.html</url>
 <url>http://www.zone-h.org/advisories/read/id=7300</url>
 <url>http://www.securityfocus.com/bid/12791</url>
 <url>http://xforce.iss.net/xforce/xfdb/19697</url>
 </references>
 <dates>
 <discovery>2005-03-13</discovery>
 <entry>2005-03-24</entry>
 </dates>
 </vuln>

<vuln vid="741f8841-9c6b-11d9-9dbe-000a95bc6fae">
 <topic>firefox -- arbitrary code execution from sidebar panel</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.2,1</lt></range>
 </package>
 <package>
	<name>linux-firefox</name>
	<range><lt>1.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory states:
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-31.html">
	 If a user bookmarked a malicious page as a Firefox
	 sidebar panel that page could execute arbitrary programs
	 by opening a privileged page and injecting javascript into
	 it.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0402</cvename>
 <url>http://www.mozilla.org/security/announce/mfsa2005-31.html</url>
 </references>
 <dates>
 <discovery>2005-03-03</discovery>
 <entry>2005-03-24</entry>
 </dates>
 </vuln>

<vuln vid="7d2aac52-9c6b-11d9-99a7-000a95bc6fae">
 <topic>mozilla -- heap buffer overflow in GIF image processing</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.2,1</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<name>linux-firefox</name>
	<range><lt>1.0.2</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.6,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.6</lt></range>
	<range><ge>1.8.*</ge></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory states:
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-31.html">
	 An (sic) GIF processing error when parsing the
	 obsolete Netscape extension 2 can lead to an exploitable
	 heap overrun, allowing an attacker to run arbitrary code on
	 the user's machine.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0399</cvename>
 <url>http://www.mozilla.org/security/announce/mfsa2005-30.html</url>
 <url>http://xforce.iss.net/xforce/alerts/id/191</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=285595</url>
 </references>
 <dates>
 <discovery>2005-03-10</discovery>
 <entry>2005-03-24</entry>
 </dates>
 </vuln>

<vuln vid="f8536143-9bc4-11d9-b8b3-000a95bc6fae">
 <topic>sylpheed -- buffer overflow in header processing</topic>
 <affects>
 <package>
	<name>sylpheed</name>
	<name>sylpheed-claws</name>
	<name>sylpheed-gtk2</name>
	<range><ge>0.8.*</ge><lt>1.0.3</lt></range>
	<range><ge>1.9.*</ge><lt>1.9.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Sylpheed web site states:
	<blockquote cite="http://sylpheed.good-day.net/index.cgi.en#changes">
	 A buffer overflow which occurred when replying to a
	 message with certain headers which contain non-ascii
	 characters was fixed.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0667</cvename>
 <url>http://sylpheed.good-day.net/index.cgi.en#changes</url>
 </references>
 <dates>
 <discovery>2005-03-07</discovery>
 <entry>2005-03-23</entry>
 </dates>
 </vuln>

<vuln vid="a4bd3039-9a48-11d9-a256-0001020eed82">
 <topic>xv -- filename handling format string vulnerability</topic>
 <affects>
 <package>
	<name>xv</name>
	<name>ja-xv</name>
	<range><lt>3.10a_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Gentoo Linux Security Advisory reports:
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml">
	 Tavis Ormandy of the Gentoo Linux Security Audit Team
	 identified a flaw in the handling of image filenames by xv.
	 Successful exploitation would require a victim to process
	 a specially crafted image with a malformed filename,
	 potentially resulting in the execution of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0665</cvename>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml</url>
 </references>
 <dates>
 <discovery>2005-03-01</discovery>
 <entry>2005-03-21</entry>
 </dates>
 </vuln>

<vuln vid="972697a7-9a42-11d9-a256-0001020eed82">
 <topic>kdelibs -- local DCOP denial of service vulnerability</topic>
 <affects>
 <package>
	<name>ja-kdelibs</name>
	<name>kdelibs-nocups</name>
	<name>kdelibs</name>
	<range><lt>3.4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A KDE Security Advisory reports:
	<blockquote cite="http://www.kde.org/info/security/advisory-20050316-1.txt">
	 Sebastian Krahmer of the SUSE LINUX Security Team
	 reported a local denial of service vulnerability in KDE's
	 Desktop Communication Protocol (DCOP) daemon better known
	 as dcopserver.
	 A local user can lock up the dcopserver of arbitrary
	 other users on the same machine. This can cause a
	 significant reduction in desktop functionality for the
	 affected users including, but not limited to, the
	 inability to browse the internet and the inability to
	 start new applications.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0396</cvename>
 <url>http://www.kde.org/info/security/advisory-20050316-1.txt</url>
 </references>
 <dates>
 <discovery>2005-03-16</discovery>
 <entry>2005-03-21</entry>
 </dates>
 </vuln>

<vuln vid="6192ae3d-9595-11d9-a9e0-0001020eed82">
 <topic>phpmyadmin -- increased privilege vulnerability</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<name>phpMyAdmin</name>
	<range><lt>2.6.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpMyAdmin team reports:
	<blockquote cite="http://sourceforge.net/forum/forum.php?forum_id=450948">
	 Escaping of the "_" character was not properly done,
	 giving a wildcard privilege when editing db-specific
	 privileges with phpMyAdmin.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0653</cvename>
 <url>http://sourceforge.net/forum/forum.php?forum_id=450948</url>
 <url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1113788&amp;group_id=23067&amp;atid=377408</url>
 </references>
 <dates>
 <discovery>2005-02-01</discovery>
 <entry>2005-03-15</entry>
 </dates>
 </vuln>

<vuln vid="cb470368-94d2-11d9-a9e0-0001020eed82">
 <topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
 <affects>
 <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.9.1</ge><lt>0.10.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An Ethreal Security Advisories reports:
	<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00018.html">
	 Issues have been discovered in the following protocol
	 dissectors:
	 <ul>
	 <li>Matevz Pustisek discovered a buffer overflow in the
	 Etheric dissector. CVE: CAN-2005-0704</li>
	 <li>The GPRS-LLC dissector could crash if the "ignore
	 cipher bit" option was enabled. CVE: CAN-2005-0705</li>
	 <li>Diego Giago discovered a buffer overflow in the 3GPP2
	 A11 dissector. This flaw was later reported by Leon
	 Juranic. CVE: CAN-2005-0699</li>
	 <li>Leon Juranic discovered a buffer overflow in the IAPP dissector.
	 CVE: CAN-2005-0739</li>
	 <li>A bug in the JXTA dissector could make Ethereal crash.</li>
	 <li>A bug in the sFlow dissector could make Ethereal crash.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12759</bid>
 <cvename>CVE-2005-0699</cvename>
 <cvename>CVE-2005-0704</cvename>
 <cvename>CVE-2005-0705</cvename>
 <cvename>CVE-2005-0739</cvename>
 <url>http://www.ethereal.com/appnotes/enpa-sa-00018.html</url>
 </references>
 <dates>
 <discovery>2005-03-09</discovery>
 <entry>2005-03-14</entry>
 <modified>2005-06-24</modified>
 </dates>
 </vuln>

<vuln vid="bcf27002-94c3-11d9-a9e0-0001020eed82">
 <topic>grip -- CDDB response multiple matches buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>grip</name>
	<range><lt>3.2.0_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Joseph VanAndel reports that grip is vulnerability to a
	 buffer overflow vulnerability when receiving more than 16
	 CDDB responses. This could lead to a crash in grip and
	 potentially execution arbitrary code.
	A workaround is to disable CDDB lookups.
 </body>
 </description>
 <references>
 <bid>12770</bid>
 <cvename>CVE-2005-0706</cvename>
 <url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=834724&amp;group_id=3714&amp;atid=103714</url>
 </references>
 <dates>
 <discovery>2003-11-02</discovery>
 <entry>2005-03-14</entry>
 <modified>2005-03-18</modified>
 </dates>
 </vuln>

<vuln vid="619ef337-949a-11d9-b813-00d05964249f">
 <topic>mysql-server -- multiple remote vulnerabilities</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><ge>4.0.0</ge><lt>4.0.24</lt></range>
	<range><ge>4.1.0</ge><lt>4.1.10a</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SecurityFocus reports:
	<blockquote cite="http://www.securityfocus.com/bid/12781/discussion/">
	 MySQL is reported prone to an insecure temporary file creation
	 vulnerability.
	 Reports indicate that an attacker that has 'CREATE TEMPORARY TABLE'
	 privileges on an affected installation may leverage this
	 vulnerability to corrupt files with the privileges of the MySQL
	 process.
	 MySQL is reported prone to an input validation vulnerability that
	 can be exploited by remote users that have INSERT and DELETE
	 privileges on the 'mysql' administrative database.
	 Reports indicate that this issue may be leveraged to load an
	 execute a malicious library in the context of the MySQL process.
	 Finally, MySQL is reported prone to a remote arbitrary code
	 execution vulnerability. It is reported that the vulnerability may
	 be triggered by employing the 'CREATE FUNCTION' statement to
	 manipulate functions in order to control sensitive data
	 structures.
	 This issue may be exploited to execute arbitrary code in the
	 context of the database process.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12781</bid>
 <cvename>CVE-2005-0709</cvename>
 <cvename>CVE-2005-0710</cvename>
 <cvename>CVE-2005-0711</cvename>
 </references>
 <dates>
 <discovery>2005-03-11</discovery>
 <entry>2005-03-14</entry>
 </dates>
 </vuln>

<vuln vid="d4bd4046-93a6-11d9-8378-000bdb1444a4">
 <topic>rxvt-unicode -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>rxvt-unicode</name>
	<range><lt>5.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A rxvt-unicode changelog reports:
	<blockquote cite="http://dist.schmorp.de/rxvt-unicode/Changes">
	 Fix a bug that allowed to overflow a buffer via a long
	 escape sequence, which is probably exploitable (fix by
	 Rob Holland / Yoann Vandoorselaere / Gentoo Audit Team).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://dist.schmorp.de/rxvt-unicode/Changes</url>
 </references>
 <dates>
 <discovery>2005-03-13</discovery>
 <entry>2005-03-13</entry>
 </dates>
 </vuln>

<vuln vid="a7062952-9023-11d9-a22c-0001020eed82">
 <topic>phpmyadmin -- information disclosure vulnerability</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<name>phpMyAdmin</name>
	<range><lt>2.6.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A phpMyAdmin security announcement reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2">
	 By calling some scripts that are part of phpMyAdmin in an
	 unexpected way (especially scripts in the libraries
	 subdirectory), it is possible to trigger phpMyAdmin to
	 display a PHP error message which contains the full path
	 of the directory where phpMyAdmin is installed.
	 Mitigation factor: This path disclosure
	 is possible on servers where the recommended setting of
	 the PHP configuration directive
	 <code>display_errors</code> is set to on, which is against
	 the recommendations given in the PHP manual.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0544</cvename>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2</url>
 </references>
 <dates>
 <discovery>2005-02-22</discovery>
 <entry>2005-03-08</entry>
 </dates>
 </vuln>

<vuln vid="882ef43b-901f-11d9-a22c-0001020eed82">
 <topic>phpmyadmin -- arbitrary file include and XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>phpmyadmin</name>
	<name>phpMyAdmin</name>
	<range><gt>1.3.1</gt><lt>2.6.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A phpMyAdmin security announcement reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1">
	 We received two bug reports by Maksymilian Arciemowicz
	 about those vulnerabilities and we wish to thank him for
	 his work. The vulnerabilities apply to those points:
	 <ol>
	 <li>css/phpmyadmin.css.php was vulnerable against
	 <code>$cfg</code> and <code>GLOBALS</code> variable
	 injections. This way, a possible attacker could
	 manipulate any configuration parameter. Using
	 phpMyAdmin's theming mechanism, he was able to include
	 arbitrary files. This is especially dangerous if php is
	 not running in safe mode.</li>
	 <li>A possible attacker could manipulate phpMyAdmin's
	 localized strings via the URL and inject harmful
	 JavaScript code this way, which could be used for XSS
	 attacks.</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12644</bid>
 <bid>12645</bid>
 <cvename>CVE-2005-0543</cvename>
 <cvename>CVE-2005-0567</cvename>
 <mlist msgid="20050224190307.20197.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110929725801154</mlist>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1</url>
 </references>
 <dates>
 <discovery>2005-02-21</discovery>
 <entry>2005-03-08</entry>
 </dates>
 </vuln>

<vuln vid="624fe633-9006-11d9-a22c-0001020eed82">
 <topic>libexif -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>libexif</name>
	<range><lt>0.6.10_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sylvain Defresne reports that libexif is vulnerable to a
	 buffer overflow vulnerability due to insufficient input
	 checking. This could lead crash of applications using
	 libexif.
 </body>
 </description>
 <references>
 <bid>12744</bid>
 <cvename>CVE-2005-0664</cvename>
 <url>https://bugzilla.ubuntulinux.org/show_bug.cgi?id=7152</url>
 </references>
 <dates>
 <discovery>2005-03-03</discovery>
 <entry>2005-03-08</entry>
 </dates>
 </vuln>

<vuln vid="4a0b334d-8d8d-11d9-afa0-003048705d5a">
 <topic>phpbb -- Insuffient check against HTML code in usercp_register.php</topic>
 <affects>
 <package>
	<name>phpbb</name>
	<range><le>2.0.13</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Neo Security Team reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110987231502274">
	 If we specify a variable in the html code (any type:
	 hidden, text, radio, check, etc) with the name allowhtml,
	 allowbbcode or allowsmilies, is going to be on the html,
	 bbcode and smilies in our signature.
	</blockquote>
	This is a low risk vulnerability that allows users to bypass
	 forum-wide configuration.
 </body>
 </description>
 <references>
 <mlist msgid="20050303055339.3109.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110987231502274</mlist>
 <mlist msgid="38599.166.68.134.174.1109875231.squirrel@166.68.134.174">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110988400407204</mlist>
 </references>
 <dates>
 <discovery>2005-02-28</discovery>
 <entry>2005-03-05</entry>
 <modified>2005-03-07</modified>
 </dates>
 </vuln>

<vuln vid="f3eec2b5-8cd8-11d9-8066-000a95bc6fae">
 <topic>postnuke -- SQL injection vulnerabilities</topic>
 <affects>
 <package>
	<name>postnuke</name>
	<range><lt>0.760</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Two separate SQL injection vulnerabilities have been
	 identified in the PostNuke PHP content management
	 system. An attacker can use this vulnerability to
	 potentially insert executable PHP code into the content
	 management system (to view all files within the PHP scope,
	 for instance). Various other SQL injection vulnerabilities
	 exist, which give attackers the ability to run SQL queries
	 on any tables within the database.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0617</cvename>
 <cvename>CVE-2005-0615</cvename>
 <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110962710805864</mlist>
 <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110962819232255</mlist>
 <url>http://news.postnuke.com/Article2669.html</url>
 </references>
 <dates>
 <discovery>2005-02-28</discovery>
 <entry>2005-03-04</entry>
 </dates>
 </vuln>

<vuln vid="7e580822-8cd8-11d9-8c81-000a95bc6fae">
 <topic>postnuke -- cross-site scripting (XSS) vulnerabilities</topic>
 <affects>
 <package>
	<name>postnuke</name>
	<range><lt>0.760</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A cross-site scripting vulnerability is present in the
	 PostNuke PHP content management system. By passing data
	 injected through exploitable errors in input validation, an
	 attacker can insert code which will run on the machine of
	 anybody viewing the page. It is feasible that this attack
	 could be used to retrieve session information from cookies,
	 thereby allowing the attacker to gain administrative access
	 to the CMS.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0616</cvename>
 <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110962768300373</mlist>
 <url>http://news.postnuke.com/Article2669.html</url>
 </references>
 <dates>
 <discovery>2005-02-28</discovery>
 <entry>2005-03-04</entry>
 </dates>
 </vuln>

<vuln vid="c73305ae-8cd7-11d9-9873-000a95bc6fae">
 <topic>realplayer -- remote heap overflow</topic>
 <affects>
 <package>
	<name>linux-realplayer</name>
	<range><le>10.0.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Two exploits have been identified in the Linux RealPlayer client.
	 RealNetworks states:
	<blockquote cite="http://service.real.com/help/faq/security/050224_player/EN/">
	 RealNetworks, Inc. has addressed recently discovered
	 security vulnerabilities that offered the potential for
	 an attacker to run arbitrary or malicious code on a
	 customer's machine. RealNetworks has received no reports
	 of machines compromised as a result of the now-remedied
	 vulnerabilities. RealNetworks takes all security
	 vulnerabilities very seriously.
	 The specific exploits were:
	 <ul>
	 <li>Exploit 1: To fashion a malicious WAV
	 file to cause a buffer overflow which could have allowed
	 an attacker to execute arbitrary code on a customer's
	 machine.</li>
	 <li>Exploit 2: To fashion a malicious
	 SMIL file to cause a buffer overflow which could have
	 allowed an attacker to execute arbitrary code on a
	 customer's machine.</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0611</cvename>
 <mlist>http://marc.theaimsgroup.com/?l=vulnwatch&amp;m=110977858619314</mlist>
 <url>http://service.real.com/help/faq/security/050224_player/EN/</url>
 </references>
 <dates>
 <discovery>2005-03-01</discovery>
 <entry>2005-03-04</entry>
 </dates>
 </vuln>

<vuln vid="713c3913-8c2b-11d9-b58c-0001020eed82">
 <topic>ImageMagick -- format string vulnerability</topic>
 <affects>
 <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.2.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tavis Ormandy reports:
	<blockquote>
	 magemagick-6.2.0-3 fixes an potential issue handling
	 malformed filenames, the flaw may affect webapps or
	 scripts that use the imagemagick utilities for image
	 processing, or applications linked with libMagick.
	</blockquote>
	This vulnerability could crash ImageMagick or potentially
	 lead to the execution of arbitrary code with the permissions
	 of the user running ImageMagick.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0397</cvename>
 <url>http://www.ubuntulinux.org/support/documentation/usn/usn-90-1</url>
 </references>
 <dates>
 <discovery>2005-03-02</discovery>
 <entry>2005-03-03</entry>
 </dates>
 </vuln>

<vuln vid="fb03b1c6-8a8a-11d9-81f7-02023f003c9f">
 <topic>uim -- privilege escalation vulnerability</topic>
 <affects>
 <package>
	<name>ja-uim</name>
	<range><lt>0.4.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The uim developers reports:
	<blockquote cite="http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html">
	 Takumi ASAKI discovered that uim always trusts environment
	 variables.	But this is not correct behavior, sometimes environment
	 variables shouldn't be trusted. This bug causes privilege escalation
	 when libuim is linked against setuid/setgid application. Since GTK+
	 prohibits setuid/setgid applications, the bug appears only in
	 'immodule for Qt' enabled Qt. (Normal Qt is also safe.)
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0503</cvename>
 <mlist>http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html</mlist>
 <bid>12604</bid>
 <url>http://secunia.com/advisories/13981</url>
 </references>
 <dates>
 <discovery>2005-02-21</discovery>
 <entry>2005-03-01</entry>
 </dates>
 </vuln>

<vuln vid="bdad9ada-8a52-11d9-9e53-000a95bc6fae">
 <topic>lighttpd -- script source disclosure vulnerability</topic>
 <affects>
 <package>
	<name>lighttpd</name>
	<range><lt>1.3.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The lighttpd website reports:
	<blockquote cite="http://article.gmane.org/gmane.comp.web.lighttpd/1171">
	 In lighttpd 1.3.7 and below it is possible to fetch the source
	 files which should be handled by CGI or FastCGI applications.
	</blockquote>
	The vulnerability is in the handling of urlencoded trailing
	 NUL bytes. Installations that do not use CGI or FastCGI are
	 not affected.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0453</cvename>
 <mlist>http://article.gmane.org/gmane.comp.web.lighttpd/1171</mlist>
 <url>http://www.lighttpd.net/news/</url>
 <url>http://xforce.iss.net/xforce/xfdb/19350</url>
 <bid>12567</bid>
 </references>
 <dates>
 <discovery>2005-02-12</discovery>
 <entry>2005-03-01</entry>
 </dates>
 </vuln>

<vuln vid="53e711ed-8972-11d9-9ff8-00306e01dda2">
 <topic>phpbb -- privilege elevation and path disclosure</topic>
 <affects>
 <package>
	<name>phpbb</name>
	<range><lt>2.0.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The phpbb developer group reports:
	<blockquote cite="http://www.phpbb.com/phpBB/viewtopic.php?t=267563">
	 phpBB Group announces the release of phpBB 2.0.13, the
	 "Beware of the furries" edition. This release addresses two
	 recent security exploits, one of them critical. They were
	 reported a few days after .12 was released and no one is
	 more annoyed than us, having to release a new version ini
	 such a short period of time. Fortunately both fixes are
	 easy and in each case just one line needs to be edited.
	</blockquote>
 </body>
 </description>
 <references>
	<url>http://www.phpbb.com/phpBB/viewtopic.php?t=267563</url>
	<bid>12678</bid>
 </references>
 <dates>
 <discovery>2005-02-27</discovery>
 <entry>2005-02-28</entry>
 <modified>2005-03-05</modified>
 </dates>
 </vuln>

<vuln vid="96df5fd0-8900-11d9-aa18-0001020eed82">
 <topic>curl -- authentication buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>curl</name>
	<range><lt>7.13.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Two iDEFENSE Security Advisories reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902601221592">
	 An exploitable stack-based buffer overflow condition
	 exists when using NT Lan Manager (NTLM)
	 authentication. The problem specifically exists within
	 <code>Curl_input_ntlm()</code> defined in
	 lib/http_ntlm.c.
	 Successful exploitation allows remote attackers to
	 execute arbitrary code under the privileges of the target
	 user. Exploitation requires that an attacker either coerce
	 or force a target to connect to a malicious server using
	 NTLM authentication.
	</blockquote>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902850731457">
	 An exploitable stack-based buffer overflow condition
	 exists when using Kerberos authentication. The problem
	 specifically exists within the functions
	 <code>Curl_krb_kauth()</code> and <code>krb4_auth()</code>
	 defined in lib/krb4.c.
	 Successful exploitation allows remote attackers to
	 execute arbitrary code under the privileges of the target
	 user. Exploitation requires that an attacker either coerce
	 or force a target to connect to a malicious server using
	 Kerberos authentication.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12615</bid>
 <bid>12616</bid>
 <cvename>CVE-2005-0490</cvename>
 <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462D@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902850731457</mlist>
 <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462E@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902601221592</mlist>
 </references>
 <dates>
 <discovery>2004-12-21</discovery>
 <entry>2005-02-27</entry>
 </dates>
 </vuln>

<vuln vid="b2d248ad-88f6-11d9-aa18-0001020eed82">
 <topic>cyrus-imapd -- multiple buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>cyrus-imapd</name>
	<range><lt>2.1.18</lt></range>
	<range><gt>2.2.*</gt><lt>2.2.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Cyrus IMAP Server ChangeLog states:
	<blockquote cite="http://asg.web.cmu.edu/cyrus/download/imapd/changes.html">
	 <ul>
	 <li>Fix possible single byte overflow in mailbox handling
	 code.</li>
	 <li>Fix possible single byte overflows in the imapd
	 annotate extension.</li>
	 <li>Fix stack buffer overflows in fetchnews (exploitable
	 by peer news server), backend (exploitable by admin),
	 and in imapd (exploitable by users though only on
	 platforms where a filename may be larger than a mailbox
	 name).</li>
	 </ul>
	</blockquote>
	The 2.1.X series are reportedly only affected by the second
	 issue.
	These issues may lead to execution of arbitrary code with
	 the permissions of the user running the Cyrus IMAP
	 Server.
 </body>
 </description>
 <references>
 <bid>12636</bid>
 <cvename>CVE-2005-0546</cvename>
 <url>http://asg.web.cmu.edu/cyrus/download/imapd/changes.html</url>
 </references>
 <dates>
 <discovery>2005-02-14</discovery>
 <entry>2005-02-27</entry>
 <modified>2005-04-05</modified>
 </dates>
 </vuln>

<vuln vid="2c5757f4-88bf-11d9-8720-0007e900f87b">
 <topic>sup -- format string vulnerability</topic>
 <affects>
 <package>
	<name>sup</name>
	<range><lt>2.0.20050226</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Debian Security Advisory reports:
	<blockquote cite="http://www.securityfocus.com/advisories/6874">
	 jaguar@felinemenace.org discovered a format string
	 vulnerability in sup, a set of programs to synchronize
	 collections of files across a number of machines,
	 whereby a remote attacker could potentially cause
	 arbitrary code to be executed with the privileges
	 of the supfilesrv process (this process does not run
	 automatically by default).
	</blockquote>
 </body>
 </description>
 <references>
 <bid>10571</bid>
 <cvename>CVE-2004-0451</cvename>
 <url>http://www.securityfocus.com/advisories/6874</url>
 </references>
 <dates>
 <discovery>2004-06-19</discovery>
 <entry>2005-02-27</entry>
 </dates>
 </vuln>

<vuln vid="d022754d-8839-11d9-aa18-0001020eed82">
 <topic>mozilla -- insecure temporary directory vulnerability</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.1,1</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.6,2</lt></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.6</lt></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory reports:
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-28.html">
	 A predictable name is used for the plugin temporary
	 directory. A malicious local user could symlink this to
	 the victim's home directory and wait for the victim to run
	 Firefox. When Firefox shuts down the victim's directory
	 would be erased.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.mozilla.org/security/announce/mfsa2005-28.html</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=281284</url>
 </references>
 <dates>
 <discovery>2005-02-06</discovery>
 <entry>2005-02-26</entry>
 </dates>
 </vuln>

<vuln vid="cbfde1cd-87eb-11d9-aa18-0001020eed82">
 <topic>mozilla -- arbitrary code execution vulnerability</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.1,1</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.6,2</lt></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.6</lt></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Mozilla Foundation Security Advisory reports:
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-27.html">
	 Plugins (such as flash) can be used to load privileged
	 content into a frame. Once loaded various spoofs can be
	 applied to get the user to interact with the privileged
	 content. Michael Krax's "Fireflashing" example
	 demonstrates that an attacker can open about:config in a
	 frame, hide it with an opacity setting, and if the
	 attacker can get the victim to click at a particular spot
	 (design some kind of simple game) you could toggle boolean
	 preferences, some of which would make further attacks
	 easier.
	 The "firescrolling" example demonstrates arbitrary code
	 execution (in this case downloading a file) by convincing
	 the user to scroll twice.
	</blockquote>
	Workaround: Disable JavaScript.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0527</cvename>
 <url>http://www.mikx.de/fireflashing/</url>
 <url>http://www.mikx.de/firescrolling/</url>
 <url>http://www.mozilla.org/security/announce/mfsa2005-27.html</url>
 </references>
 <dates>
 <discovery>2005-02-24</discovery>
 <entry>2005-02-26</entry>
 </dates>
 </vuln>

<vuln vid="32d4f0f1-85c3-11d9-b6dc-0007e900f747">
 <topic>mkbold-mkitalic -- format string vulnerability</topic>
 <affects>
 <package>
	<name>mkbold-mkitalic</name>
	<range><lt>0.07</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The version 0.06_1 and prior
	 have a format string vulnerability which can be triggered
	 by using a carefully-crafted BDF font file.
 </body>
 </description>
 <references>
 <url>http://home.jp.FreeBSD.org/cgi-bin/showmail/ports-jp/15568</url>
 </references>
 <dates>
 <discovery>2005-02-23</discovery>
 <entry>2005-02-24</entry>
 </dates>
 </vuln>

<vuln vid="03653079-8594-11d9-afa0-003048705d5a">
 <topic>phpbb -- multiple information disclosure vulnerabilities</topic>
 <affects>
 <package>
	<name>phpbb</name>
	<range><lt>2.0.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	psoTFX reports:
	<blockquote cite="http://www.phpbb.com/phpBB/viewtopic.php?f=14&amp;t=265423">
	 phpBB Group are pleased to announce the release of phpBB
	 2.0.12 the "Horray for Furrywood" release. This release
	 addresses a number of bugs and a couple of potential
	 exploits. [...] one of the potential exploits addressed
	 in this release could be serious in certain situations and
	 thus we urge all users, as always, to upgrade to this
	 release as soon as possible. Mostly this release is
	 concerned with eliminating disclosures of information
	 which while useful in debug situations may allow third
	 parties to gain information which could be used to do harm
	 via unknown or unfixed exploits in this or other
	 applications.
	</blockquote>
	The ChangeLog for phpBB 2.0.12 states:
	<blockquote cite="http://www.phpbb.com/support/documents.php?mode=changelog">
	 <ul>
	 <li>Prevented full path display on critical messages</li>
	 <li>Fixed full path disclosure in username handling caused
	 by a PHP 4.3.10 bug - AnthraX101</li>
	 <li>Added exclude list to unsetting globals (if
	 register_globals is on) -
	 SpoofedExistence</li>
	 <li>Fixed arbitrary file disclosure vulnerability in avatar
	 handling functions - AnthraX101</li>
	 <li>Fixed arbitrary file unlink vulnerability in avatar
	 handling functions - AnthraX101</li>
	 <li>Fixed path disclosure bug in search.php caused by a
	 PHP 4.3.10 bug (related to AnthraX101's discovery)</li>
	 <li>Fixed path disclosure bug in viewtopic.php caused by
	 a PHP 4.3.10 bug - matrix_killer</li>
	 </ul>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.phpbb.com/support/documents.php?mode=changelog</url>
 <url>http://www.phpbb.com/phpBB/viewtopic.php?f=14&amp;t=265423</url>
 <freebsdpr>ports/77943</freebsdpr>
 </references>
 <dates>
 <discovery>2005-02-22</discovery>
 <entry>2005-02-23</entry>
 <modified>2005-02-25</modified>
 </dates>
 </vuln>

<vuln vid="1d3a2737-7eb7-11d9-acf7-000854d03344">
 <topic>unace -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>unace</name>
	<range><lt>1.2b_2</lt></range>
 </package>
 <package>
	<name>linux-unace</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ulf Härnhammar reports:
	<ul>
	 <li>There are buffer overflows when extracting, testing or
	 listing specially prepared ACE archives.</li>
	 <li>There are directory traversal bugs when extracting ACE
	 archives.</li>
	 <li>There are also buffer overflows when dealing with long
	 (&gt;17000 characters) command line arguments.</li>
	</ul>
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/14359/">
	 The vulnerabilities have been confirmed in version 1.2b.
	 One of the buffer overflow vulnerabilities have also been
	 reported in version 2.04, 2.2 and 2.5. Other versions may
	 also be affected.
	 Successful exploitation may allow execution of arbitrary
	 code.
	</blockquote>
 </body>
 </description>
 <references>
 <certvu>215006</certvu>
 <cvename>CVE-2005-0160</cvename>
 <cvename>CVE-2005-0161</cvename>
 <mlist msgid="1109113175.421bb95705d42@webmail.uu.se">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110911451613135</mlist>
 <url>http://secunia.com/advisories/14359/</url>
 </references>
 <dates>
 <discovery>2005-02-14</discovery>
 <entry>2005-02-22</entry>
 <modified>2006-09-26</modified>
 </dates>
 </vuln>

<vuln vid="a413ed94-836e-11d9-a9e7-0001020eed82">
 <topic>putty -- pscp/psftp heap corruption vulnerabilities</topic>
 <affects>
 <package>
	<name>putty</name>
	<range><lt>0.57</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Simon Tatham reports:
	<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html">
	 This version fixes a security hole in previous versions
	 of PuTTY, which can allow a malicious SFTP server to
	 attack your client. If you use either PSCP or PSFTP, you
	 should upgrade. Users of the main PuTTY program are not
	 affected. (However, note that the server must have passed
	 host key verification before this attack can be launched,
	 so a man-in-the-middle shouldn't be able to attack you if
	 you're careful.)
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12601</bid>
 <cvename>CVE-2005-0467</cvename>
 <mlist msgid="E1D2taM-0005R1-00@ixion.tartarus.org">http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html</mlist>
 <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462F@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902510713763</mlist>
 <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html</url>
 <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html</url>
 </references>
 <dates>
 <discovery>2005-02-20</discovery>
 <entry>2005-02-20</entry>
 <modified>2005-02-23</modified>
 </dates>
 </vuln>

<vuln vid="29dd0065-81fa-11d9-a9e7-0001020eed82">
 <topic>kdelibs -- insecure temporary file creation</topic>
 <affects>
 <package>
	<name>kdelibs</name>
	<name>ja-kdelibs</name>
	<range><lt>3.3.2_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Davide Madrisan reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110814653804757">
	 The `dcopidlng' script in the KDE library package
	 (kdelibs-3.3.2/dcop/dcopidlng/dcopidlng) creates temporary
	 files in a unsecure manner.
	</blockquote>
	Note: dcopidlng is only used at build
	 time, so only users installing KDE are vulnerable, not users
	 already running KDE.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0365</cvename>
 <url>http://bugs.kde.org/show_bug.cgi?id=97608</url>
 <mlist msgid="200502110916.48921.davide.madrisan@qilinux.it">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110814653804757</mlist>
 </references>
 <dates>
 <discovery>2005-01-21</discovery>
 <entry>2005-02-18</entry>
 <modified>2005-02-20</modified>
 </dates>
 </vuln>

<vuln vid="74c86a29-81ef-11d9-a9e7-0001020eed82">
 <topic>bidwatcher -- format string vulnerability</topic>
 <affects>
 <package>
	<name>bidwatcher</name>
	<range><lt>1.3.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Debian Security Advisory reports:
	<blockquote cite="http://www.debian.org/security/2005/dsa-687">
	 Ulf Härnhammer from the Debian Security Audit Project
	 discovered a format string vulnerability in bidwatcher, a
	 tool for watching and bidding on eBay auctions. This
	 problem can be triggered remotely by a web server of eBay,
	 or someone pretending to be eBay, sending certain data
	 back.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12590</bid>
 <cvename>CVE-2005-0158</cvename>
 <url>http://www.debian.org/security/2005/dsa-687</url>
 </references>
 <dates>
 <discovery>2005-02-18</discovery>
 <entry>2005-02-18</entry>
 </dates>
 </vuln>

<vuln vid="2d8cf857-81ea-11d9-a9e7-0001020eed82">
 <topic>gftp -- directory traversal vulnerability</topic>
 <affects>
 <package>
	<name>gftp</name>
	<range><lt>2.0.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Debian Security Advisory reports:
	<blockquote cite="http://www.debian.org/security/2005/dsa-686">
	 Albert Puigsech Galicia discovered a directory traversal
	 vulnerability in a proprietary FTP client (CAN-2004-1376)
	 which is also present in gftp, a GTK+ FTP client. A
	 malicious server could provide a specially crafted
	 filename that could cause arbitrary files to be
	 overwritten or created by the client.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12539</bid>
 <cvename>CVE-2005-0372</cvename>
 <url>http://www.debian.org/security/2005/dsa-686</url>
 <url>http://www.gftp.org/changelog.html</url>
 </references>
 <dates>
 <discovery>2005-02-04</discovery>
 <entry>2005-02-18</entry>
 </dates>
 </vuln>

<vuln vid="20c9bb14-81e6-11d9-a9e7-0001020eed82">
 <topic>opera -- "data:" URI handler spoofing vulnerability</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>7.54.20050131</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Advisory reports:
	<blockquote cite="http://secunia.com/advisories/13818/">
	 Michael Holzt has discovered a vulnerability in Opera,
	 which can be exploited by malicious people to trick users
	 into executing malicious files.
	 The vulnerability is caused due to an error in the
	 processing of "data:" URIs, causing wrong information to
	 be shown in a download dialog. This can be exploited by
	 e.g. a malicious website to trick users into executing a
	 malicious file by supplying a specially crafted "data:"
	 URI.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0456</cvename>
 <certvu>882926</certvu>
 <url>http://secunia.com/advisories/13818/</url>
 <url>http://www.opera.com/freebsd/changelogs/754u2/</url>
 </references>
 <dates>
 <discovery>2005-01-12</discovery>
 <entry>2005-02-18</entry>
 </dates>
 </vuln>

<vuln vid="d8e55d65-81d6-11d9-a9e7-0001020eed82">
 <topic>opera -- kfmclient exec command execution vulnerability</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>7.54.20050131</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Giovanni Delvecchio reports:
	<blockquote cite="http://www.zone-h.org/advisories/read/id=6503">
	 Opera for linux uses "kfmclient exec" as "Default
	 Application" to handle saved files. This could be used by
	 malicious remote users to execute arbitrary shell commands
	 on a target system.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1491</cvename>
 <url>http://secunia.com/advisories/13447/</url>
 <url>http://www.opera.com/freebsd/changelogs/754u2/</url>
 <url>http://www.zone-h.org/advisories/read/id=6503</url>
 </references>
 <dates>
 <discovery>2004-12-12</discovery>
 <entry>2005-02-18</entry>
 </dates>
 </vuln>

<vuln vid="6b4b0b3f-8127-11d9-a9e7-0001020eed82">
 <topic>postgresql -- multiple buffer overflows in PL/PgSQL parser</topic>
 <affects>
 <package>
	<name>postgresql</name>
	<name>postgresql-server</name>
	<name>ja-postgresql</name>
	<range><lt>7.3.9_1</lt></range>
	<range><gt>7.4.*</gt><lt>7.4.7_1</lt></range>
	<range><gt>8.*</gt><lt>8.0.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The PL/PgSQL parser in postgresql is vulnerable to several
	 buffer overflows. These could be exploited by a remote
	 attacker to execute arbitrary code with the permissions of
	 the postgresql server by running a specially crafted
	 query.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0247</cvename>
 <url>http://archives.postgresql.org/pgsql-committers/2005-02/msg00049.php</url>
 </references>
 <dates>
 <discovery>2005-02-07</discovery>
 <entry>2005-02-17</entry>
 <modified>2005-02-19</modified>
 </dates>
 </vuln>

<vuln vid="fdad8a87-7f94-11d9-a9e7-0001020eed82">
 <topic>awstats -- arbitrary command execution</topic>
 <affects>
 <package>
	<name>awstats</name>
	<range><lt>6.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Several input validation errors exist in AWStats that allow a
	 remote unauthenticated attacker to execute arbitrary commands
	 with the priviliges of the web server. These programming
	 errors involve CGI parameters including
	 <code>loadplugin</code>, <code>logfile</code>,
	 <code>pluginmode</code>, <code>update</code>, and possibly
	 others.
	Additionally, the <code>debug</code> and other CGI parameters
	 may be used to cause AWStats to disclose AWStats and system
	 configuration information.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0362</cvename>
 <cvename>CVE-2005-0363</cvename>
 <cvename>CVE-2005-0435</cvename>
 <cvename>CVE-2005-0436</cvename>
 <cvename>CVE-2005-0437</cvename>
 <cvename>CVE-2005-0438</cvename>
 <bid>12543</bid>
 <bid>12545</bid>
 <mlist msgid="20050214081040.3370.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110840530924124</mlist>
 <url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488</url>
 <url>http://packetstormsecurity.nl/0501-exploits/AWStatsVulnAnalysis.pdf</url>
 </references>
 <dates>
 <discovery>2005-02-10</discovery>
 <entry>2005-02-16</entry>
 <modified>2005-02-23</modified>
 </dates>
 </vuln>

<vuln vid="5a5422fd-7e1a-11d9-a9e7-0001020eed82">
 <topic>powerdns -- DoS vulnerability</topic>
 <affects>
 <package>
	<name>powerdns</name>
	<range><lt>2.9.17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	PowerDNS is vulnerable to a temporary denial-of-service
	 vulnerability that can be triggered using a random stream of
	 bytes.
 </body>
 </description>
 <references>
 <bid>12446</bid>
 <url>http://ds9a.nl/cgi-bin/cvstrac/pdns/tktview?tn=21</url>
 <url>http://doc.powerdns.com/changelog.html#CHANGELOG-2-9-17</url>
 </references>
 <dates>
 <discovery>2004-09-18</discovery>
 <entry>2005-02-14</entry>
 </dates>
 </vuln>

<vuln vid="3e3c860d-7dae-11d9-a9e7-0001020eed82">
 <topic>emacs -- movemail format string vulnerability</topic>
 <affects>
 <package>
	<name>movemail</name>
	<range><le>1.0</le></range>
 </package>
 <package>
	<name>zh-emacs</name>
	<name>emacs</name>
	<range><lt>20.7_4</lt></range>
	<range><gt>21.*</gt><lt>21.3_4</lt></range>
 </package>
 <package>
	<name>xemacs</name>
	<name>xemacs-mule</name>
	<name>zh-xemacs</name>
	<name>zh-xemacs-mule</name>
	<range><lt>21.4.17</lt></range>
 </package>
 <package>
	<name>xemacs-devel</name>
	<range><lt>21.5.b19,1</lt></range>
 </package>
 <package>
	<name>xemacs-devel-21.5</name>
	<range><eq>b11</eq></range>
 </package>
 <package>
	<name>xemacs-devel-mule</name>
	<range><lt>21.5.b19</lt></range>
 </package>
 <package>
	<name>mule-common</name>
	<name>hanemacs</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Max Vozeler discovered several format string
	 vulnerabilities in the movemail utility of Emacs. They can
	 be exploited when connecting to a malicious POP server and
	 can allow an attacker can execute arbitrary code under the
	 privileges of the user running Emacs.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0100</cvename>
 <bid>12462</bid>
 </references>
 <dates>
 <discovery>2005-01-31</discovery>
 <entry>2005-02-14</entry>
 </dates>
 </vuln>

<vuln vid="bc4a7efa-7d9a-11d9-a9e7-0001020eed82">
 <topic>ngircd -- format string vulnerability</topic>
 <affects>
 <package>
	<name>ngircd</name>
	<range><lt>0.8.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A No System Group security advisory reports that ngircd is
	 vulnerable to a format string vulnerability in the
	 <code>Log_Resolver()</code> function of log.c, if IDENT
	 support is enabled. This could allow a remote attacker to
	 execute arbitrary code with the permissions of the ngircd
	 daemon, which is <q>root</q> by default.
	Note: By default the FreeBSD ngircd port
	 does not enable IDENT support.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0226</cvename>
 <bid>12434</bid>
 <mlist msgid="20050203020909.21785.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110746413108183</mlist>
 </references>
 <dates>
 <discovery>2005-02-03</discovery>
 <entry>2005-02-13</entry>
 </dates>
 </vuln>

<vuln vid="7f6dd1bd-7d99-11d9-a9e7-0001020eed82">
 <topic>ngircd -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>ngircd</name>
	<range><lt>0.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Florian Westphal discovered a buffer overflow in ngircd
	 which can be used remotely crash the server and possibly
	 execute arbitrary code.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0199</cvename>
 <bid>12397</bid>
 <mlist>http://arthur.ath.cx/pipermail/ngircd-ml/2005-January/000228.html</mlist>
 </references>
 <dates>
 <discovery>2005-01-26</discovery>
 <entry>2005-02-13</entry>
 </dates>
 </vuln>

<vuln vid="5192e7ca-7d4f-11d9-a9e7-0001020eed82">
 <topic>mod_python -- information leakage vulnerability</topic>
 <affects>
 <package>
	<name>mod_python</name>
	<range><lt>2.7.11</lt></range>
	<range><gt>3.*</gt><lt>3.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mark J Cox reports:
	<blockquote>
	 Graham Dumpleton discovered a flaw which can affect
	 anyone using the publisher handle of the Apache Software
	 Foundation mod_python. The publisher handle lets you
	 publish objects inside modules to make them callable via
	 URL. The flaw allows a carefully crafted URL to obtain
	 extra information that should not be visible (information
	 leak).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0088</cvename>
 </references>
 <dates>
 <discovery>2005-01-30</discovery>
 <entry>2005-02-13</entry>
 </dates>
 </vuln>

<vuln vid="c7ccc33f-7d31-11d9-a9e7-0001020eed82">
 <topic>mailman -- directory traversal vulnerability</topic>
 <affects>
 <package>
	<name>mailman</name>
	<name>ja-mailman</name>
	<range><lt>2.1.5_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A directory traversal vulnerability in mailman allow remote
	 attackers to read arbitrary files due to inadequate input
	 sanitizing. This could, among other things, lead remote
	 attackers to gaining access to the mailman configuration
	 database (which contains subscriber email addresses and
	 passwords) or to the mail archives for private lists.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0202</cvename>
 <mlist msgid="20050209181502.GA26136@grok.org.uk">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110797575304304</mlist>
 </references>
 <dates>
 <discovery>2005-01-02</discovery>
 <entry>2005-02-12</entry>
 </dates>
 </vuln>

<vuln vid="72da8af6-7c75-11d9-8cc5-000854d03344">
 <topic>enscript -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>enscript-a4</name>
	<name>enscript-letter</name>
	<name>enscript-letterdj</name>
	<range><lt>1.6.4_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Erik Sjölund discovered several issues in enscript:
	 it suffers from several buffer overflows, quotes and shell
	 escape characters are insufficiently sanitized in filenames,
	 and it supported taking input from an arbitrary command
	 pipe, with unwanted side effects.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1184</cvename>
 <cvename>CVE-2004-1185</cvename>
 <cvename>CVE-2004-1186</cvename>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200502-03.xml</url>
 </references>
 <dates>
 <discovery>2005-02-02</discovery>
 <entry>2005-02-11</entry>
 </dates>
 </vuln>

<vuln vid="5d425189-7a03-11d9-a9e7-0001020eed82">
 <topic>postgresql -- privilege escalation vulnerability</topic>
 <affects>
 <package>
	<name>postgresql</name>
	<name>postgresql-server</name>
	<name>ja-postgresql</name>
	<range><lt>7.3.9</lt></range>
	<range><gt>7.4.*</gt><lt>7.4.7</lt></range>
	<range><gt>8.*</gt><lt>8.0.1</lt></range>
 </package>
 <package>
	<name>postgresql-devel</name>
	<range><le>8.0.1,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	John Heasman and others disovered that non-privileged users
	 could use the <q>LOAD</q> extension to load arbitrary
	 libraries into the postgres server process space. This
	 could be used by non-privileged local users to execute
	 arbitrary code with the privileges of the postgresql
	 server.
 </body>
 </description>
 <references>
 <bid>12411</bid>
 <cvename>CVE-2005-0227</cvename>
 <mlist>http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php</mlist>
 <mlist>http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php</mlist>
 </references>
 <dates>
 <discovery>2005-01-21</discovery>
 <entry>2005-02-08</entry>
 </dates>
 </vuln>

<vuln vid="831a6a66-79fa-11d9-a9e7-0001020eed82">
 <topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
 <affects>
 <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.8.10</ge><lt>0.10.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An Ethreal Security Advisories reports:
	<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00017.html">
	 Issues have been discovered in the following protocol
	 dissectors:
	 <ul>
	 <li>The COPS dissector could go into an infinite
	 loop. CVE: CAN-2005-0006</li>
	 <li>The DLSw dissector could cause an assertion. CVE:
	 CAN-2005-0007</li>
	 <li>The DNP dissector could cause memory corruption. CVE:
	 CAN-2005-0008</li>
	 <li>The Gnutella dissector could cuase an assertion. CVE:
	 CAN-2005-0009</li>
	 <li>The MMSE dissector could free statically-allocated
	 memory. CVE: CAN-2005-0010</li>
	 <li>The X11 dissector is vulnerable to a string buffer
	 overflow. CVE: CAN-2005-0084</li>
	 </ul>
	 Impact: It may be possible to make Ethereal crash or run
	 arbitrary code by injecting a purposefully malformed
	 packet onto the wire or by convincing someone to read a
	 malformed packet trace file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0006</cvename>
 <cvename>CVE-2005-0007</cvename>
 <cvename>CVE-2005-0008</cvename>
 <cvename>CVE-2005-0009</cvename>
 <cvename>CVE-2005-0010</cvename>
 <cvename>CVE-2005-0084</cvename>
 <bid>12326</bid>
 <url>http://www.ethereal.com/appnotes/enpa-sa-00017.html</url>
 </references>
 <dates>
 <discovery>2005-01-18</discovery>
 <entry>2005-02-08</entry>
 </dates>
 </vuln>

<vuln vid="bfda39de-7467-11d9-9e1e-c296ac722cb3">
 <topic>squid -- correct handling of oversized HTTP reply headers</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.7_12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The squid patches page notes:
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch">
	 This patch addresses a HTTP protocol mismatch related to oversized
	 reply headers. In addition it enhances the cache.log reporting on
	 reply header parsing failures to make it easier to track down which
	 sites are malfunctioning.
	</blockquote>
	It is believed that this bug may lead to cache pollution or
	 allow access controls to be bypassed.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0241</cvename>
 <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1216</url>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch</url>
 <freebsdpr>ports/76967</freebsdpr>
 <certvu>823350</certvu>
 </references>
 <dates>
 <discovery>2005-01-31</discovery>
 <entry>2005-02-08</entry>
 </dates>
 </vuln>

<vuln vid="6afa87d3-764b-11d9-b0e7-0000e249a0a2">
 <topic>python -- SimpleXMLRPCServer.py allows unrestricted traversal</topic>
 <affects>
 <package>
	<name>python</name>
	<name>python+ipv6</name>
	<range><ge>2.2</ge><lt>2.2.3_7</lt></range>
	<range><ge>2.3</ge><lt>2.3.4_4</lt></range>
	<range><ge>2.4</ge><lt>2.4_1</lt></range>
	<range><ge>2.5.a0.20050129</ge><lt>2.5.a0.20050129_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	According to Python Security Advisory PSF-2005-001,
	<blockquote cite="http://www.python.org/security/PSF-2005-001/">
	 The Python development team has discovered a flaw in
	 the <code>SimpleXMLRPCServer</code> library module which
	 can give remote attackers access to internals of the
	 registered object or its module or possibly other modules.
	 The flaw only affects Python XML-RPC servers that use the
	 <code>register_instance()</code> method to register an object
	 without a <code>_dispatch()</code> method.	Servers using
	 only <code>register_function()</code> are not affected.
	 On vulnerable XML-RPC servers, a remote attacker may
	 be able to view or modify globals of the module(s)
	 containing the registered instance's class(es), potentially
	 leading to data loss or arbitrary code execution. If the
	 registered object is a module, the danger is particularly
	 serious. For example, if the registered module imports
	 the <code>os</code> module, an attacker could invoke the
	 <code>os.system()</code> function.
	</blockquote>
	Note: This vulnerability affects your
	 system only if you're running
	 <code>SimpleXMLRPCServer</code>-based server. This isn't
	 harmful at all if you don't run any internet server written
	 in Python or your server doesn't serve in XML-RPC protocol.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0089</cvename>
 <url>http://www.python.org/security/PSF-2005-001/</url>
 </references>
 <dates>
 <discovery>2005-02-03</discovery>
 <entry>2005-02-03</entry>
 <modified>2006-10-08</modified>
 </dates>
 </vuln>

<vuln vid="a5eb760a-753c-11d9-a36f-000a95bc6fae">
 <topic>perl -- vulnerabilities in PERLIO_DEBUG handling</topic>
 <affects>
 <package>
	<name>perl</name>
	<name>perl-threaded</name>
	<range><ge>5.8</ge><lt>5.8.6_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kevin Finisterre discovered bugs in perl's I/O debug support:
	<ul>
	 <li>The environmental variable PERLIO_DEBUG is honored even
	 by the set-user-ID perl command (usually
	 named <code>sperl</code> or <code>suidperl</code>). As a
	 result, a local attacker may be able to gain elevated
	 privileges. (CVE-2005-0155)</li>
	 <li>A buffer overflow may occur in threaded versions of perl
	 when the full pathname of the script being executed is
	 very long. (CVE-2005-0156).</li>
	</ul>
	Note: By default, no set-user-ID perl
	 binary is installed.	An administrator must enable it
	 manually at build time with the <code>ENABLE_SUIDPERL</code>
	 port flag.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0155</cvename>
 <cvename>CVE-2005-0156</cvename>
 </references>
 <dates>
 <discovery>2005-02-02</discovery>
 <entry>2005-02-02</entry>
 <modified>2007-11-07</modified>
 </dates>
 </vuln>

<vuln vid="cd7e260a-6bff-11d9-a5df-00065be4b5b6">
 <topic>newsgrab -- insecure file and directory creation</topic>
 <affects>
 <package>
 <name>newsgrab</name>
 <range><le>0.4.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 The newsgrab script uses insecure permissions during the
 creation of the local output directory and downloaded files.
 After a file is created, permissions on it are set using the mode
 value of the newsgroup posting. This can potentially be a problem
 when the mode is not restrictive enough. In addition, the output
 directory is created with world writable permissions allowing other
 users to drop symlinks or other files at that location.
 </body>
 </description>
 <references>
 <url>http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt</url>
 <url>http://sourceforge.net/project/shownotes.php?release_id=300562</url>
 <cvename>CVE-2005-0154</cvename>
 </references>
 <dates>
 <discovery>2005-01-18</discovery>
 <entry>2005-02-01</entry>
 </dates>
 </vuln>

<vuln vid="35f6093c-73c3-11d9-8a93-00065be4b5b6">
 <topic>newsgrab -- directory traversal vulnerability</topic>
 <affects>
 <package>
 <name>newsgrab</name>
 <range><le>0.4.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 The newsgrab script creates files by using the names provided
 in the newsgroup messages in a perl open() call. This is done
 without performing any security checks to prevent a
 directory traversal. A specially crafted newsgroup message
 could cause newsgrab to drop an attachment anywhere on the
 file system using the permissions of the user running the
 script.
 </body>
 </description>
 <references>
 <url>http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt</url>
 <url>http://sourceforge.net/project/shownotes.php?release_id=300562</url>
 <cvename>CVE-2005-0153</cvename>
 </references>
 <dates>
 <discovery>2005-01-18</discovery>
 <entry>2005-02-01</entry>
 </dates>
 </vuln>

<vuln vid="7f13607b-6948-11d9-8937-00065be4b5b6">
 <topic>newspost -- server response buffer overflow vulnerability</topic>
 <affects>
 <package>
 <name>newspost</name>
 <range><le>2.1.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 The newspost program uses a function named socket_getline to read
	server responses from the network socket. Unfortunately this function
	does not check the length of the buffer in which the read data is stored
	and only stops reading when a newline character is found.
 A malicious NNTP server could use this bug to cause a buffer overflow
	by sending an overly long response. Such an overflow allows arbitrary
	code to be executed, with the privileges of the newspost process, on the
	affected systems.
 </body>
 </description>
 <references>
 <url>http://people.freebsd.org/~niels/issues/newspost-20050114.txt</url>
 <cvename>CVE-2005-0101</cvename>
 </references>
 <dates>
 <discovery>2005-01-14</discovery>
 <entry>2005-02-01</entry>
 </dates>
 </vuln>

<vuln vid="76e0b133-6bfd-11d9-a5df-00065be4b5b6">
 <topic>newsfetch -- server response buffer overflow vulnerability</topic>
 <affects>
 <package>
 <name>newsfetch</name>
 <range><le>1.21_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 The newsfetch program uses the sscanf function to read information
 from server responses into static memory buffers. Unfortunately
 this is done without any proper bounds checking. As a result long
 server responses may cause an overflow when a newsgroup listing is
 requested from an NNTP server.
 </body>
 </description>
 <references>
 <url>http://people.freebsd.org/~niels/issues/newsfetch-20050119.txt</url>
 <cvename>CVE-2005-0132</cvename>
 </references>
 <dates>
 <discovery>2005-01-18</discovery>
 <entry>2005-02-01</entry>
 </dates>
 </vuln>

<vuln vid="23fb5a04-722b-11d9-9e1e-c296ac722cb3">
 <topic>squid -- buffer overflow in WCCP recvfrom() call</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.7_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	According to the Squid Proxy Cache Security Update Advisory
	 SQUID-2005:3,
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2005_3.txt">
	 The WCCP recvfrom() call accepts more data than will fit in
	 the allocated buffer. An attacker may send a larger-than-normal
	 WCCP message to Squid and overflow this buffer.
	 Severity:
	 The bug is important because it allows remote attackers to crash
	 Squid, causing a disription in service. However, the bug is
	 exploitable only if you have configured Squid to send WCCP messages
	 to, and expect WCCP replies from, a router.
	 Sites that do not use WCCP are not vulnerable.
	</blockquote>
	Note that while the default configuration of the FreeBSD squid port
	 enables WCCP support in general, the default configuration
	 supplied does not actually configure squid to send and receive WCCP
	 messages.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0211</cvename>
 <certvu>886006</certvu>
 <url>http://www.squid-cache.org/Advisories/SQUID-2005_3.txt</url>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_buffer_overflow</url>
 <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1217</url>
 </references>
 <dates>
 <discovery>2005-01-28</discovery>
 <entry>2005-01-28</entry>
 <modified>2005-02-13</modified>
 </dates>
 </vuln>

<vuln vid="f755545e-6fcd-11d9-abec-00061bd2d56f">
 <topic>xpdf -- makeFileKey2() buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>xpdf</name>
	<range><lt>3.00_6</lt></range>
 </package>
 <package>
	<name>kdegraphics</name>
	<range><lt>3.3.2_2</lt></range>
 </package>
 <package>
	<name>gpdf</name>
	<range><lt>2.8.3</lt></range>
 </package>
 <package>
	<name>teTeX-base</name>
	<range><lt>2.0.2_9</lt></range>
 </package>
 <package>
	<name>cups-base</name>
	<range><lt>1.1.23.0_3</lt></range>
 </package>
 <package>
	<name>koffice</name>
	<range><lt>1.3.5_2,1</lt></range>
 </package>
 <package>
	<name>pdftohtml</name>
	<range><lt>0.36_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An iDEFENSE Security Advisory reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110608898221554">
	 Remote exploitation of a buffer overflow vulnerability in
	 the xpdf PDF viewer included in multiple Unix and Linux
	 distributions could allow for arbitrary code execution as
	 the user viewing a PDF file.
	 The vulnerability specifically exists due to insufficient
	 bounds checking while processing a PDF file that provides
	 malicious values in the /Encrypt /Length tag. The
	 offending code can be found in the
	 <code>Decrypt::makeFileKey2</code> function in the source
	 file xpdf/Decrypt.cc.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0064</cvename>
 <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503C8B298@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110608898221554</mlist>
 <url>http://www.koffice.org/security/advisory-20050120-1.txt</url>
 </references>
 <dates>
 <discovery>2005-01-06</discovery>
 <entry>2005-01-26</entry>
 <modified>2005-02-03</modified>
 </dates>
 </vuln>

<vuln vid="d371b627-6ed5-11d9-bd18-000a95bc6fae">
 <topic>zhcon -- unauthorized file access</topic>
 <affects>
 <package>
	<name>zhcon</name>
	<name>zh-zhcon</name>
	<range><lt>0.2.3_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Martin <q>Joey</q> Schulze reports:
	<blockquote>
	 Erik Sjöund discovered that zhcon, a fast console CJK
	 system using the Linux framebuffer, accesses a
	 user-controlled configuration file with elevated
	 privileges. Thus, it is possible to read arbitrary files.
	</blockquote>
	When installed from the FreeBSD Ports Collection, zhcon is
	 installed set-user-ID root.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0072</cvename>
 </references>
 <dates>
 <discovery>2005-01-25</discovery>
 <entry>2005-01-25</entry>
 </dates>
 </vuln>

<vuln vid="b8943e61-6e68-11d9-a9e7-0001020eed82">
 <topic>evolution -- arbitrary code execution vulnerability</topic>
 <affects>
 <package>
	<name>evolution</name>
	<range><lt>2.0.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Martin <q>Joey</q> Schulze reports:
	<blockquote>
	 Max Vozeler discovered an integer overflow in the helper
	 application camel-lock-helper which runs setuid root or
	 setgid mail inside of Evolution, a free groupware suite.
	 A local attacker can cause the setuid root helper to
	 execute arbitrary code with elevated privileges via a
	 malicious POP server.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12354</bid>
 <cvename>CVE-2005-0102</cvename>
 <url>http://cvs.gnome.org/viewcvs/evolution/camel/camel-lock-helper.c?rev=1.7&amp;view=log#rev1.5.74.1</url>
 </references>
 <dates>
 <discovery>2005-01-20</discovery>
 <entry>2005-01-25</entry>
 <modified>2005-02-02</modified>
 </dates>
 </vuln>

<vuln vid="88ff90f2-6e43-11d9-8c87-000a95bc6fae">
 <topic>mod_dosevasive -- insecure temporary file creation</topic>
 <affects>
 <package>
	<name>mod_dosevasive20</name>
	<range><lt>1.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An LSS Security Advisory reports:
	<blockquote cite="http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2005-01-01">
	 When a denial of service attack is detected,
	 mod_dosevasive will, among other things, create a
	 temporary file which it will use to trace actions from the
	 offensive IP address. This file is insecurely created in
	 /tmp and it's name is easily predictable.
	 It is then easy for an attacker to create arbitrary files
	 in any directory that the user under which apache runs has
	 privileges to write.
	 [...] once the target file is opened, there is a
	 race attack (although difficult to exploit) which can lead
	 to mod_dosevasive overwriting any file that the user under
	 which apache runs has privileges to write.
	</blockquote>
 </body>
 </description>
 <references>
 <freebsdpr>ports/77513</freebsdpr>
 <url>http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2005-01-01</url>
 </references>
 <dates>
 <discovery>2005-01-04</discovery>
 <entry>2005-01-24</entry>
 <modified>2005-02-22</modified>
 </dates>
 </vuln>

<vuln vid="b4d94fa0-6e38-11d9-9e1e-c296ac722cb3">
 <topic>squid -- possible cache-poisoning via malformed HTTP responses</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.7_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The squid patches page notes:
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing">
	 This patch makes Squid considerably stricter while
	 parsing the HTTP protocol.
	 <ol>
	 <li>A Content-length header should only appear once in a
	 valid request or response. Multiple Content-length
	 headers, in conjunction with specially crafted requests,
	 may allow Squid's cache to be poisoned with bad content
	 in certain situations.</li>
	 <li>CR characters is only allowed as part of the CR NL
	 line terminator, not alone. This to ensure that all
	 involved agrees on the structure of HTTP headers.</li>
	 <li>Rejects requests/responses that have whitespace in an
	 HTTP header name.</li>
	 </ol>
	</blockquote>
	To enable these strict parsing rules, update to at least
	 squid-2.5.7_9 and specify <code>relaxed_header_parser
	 off</code> in squid.conf.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0174</cvename>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing</url>
 <certvu>768702</certvu>
 </references>
 <dates>
 <discovery>2005-01-24</discovery>
 <entry>2005-01-24</entry>
 <modified>2006-01-02</modified>
 </dates>
 </vuln>

<vuln vid="97c3a452-6e36-11d9-8324-000a95bc6fae">
 <topic>bugzilla -- cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>bugzilla</name>
	<name>ja-bugzilla</name>
	<range><lt>2.16.8</lt></range>
	<range><ge>2.17.*</ge><lt>2.18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Bugzilla advisory states:
	<blockquote cite="http://www.bugzilla.org/security/2.16.7-nr/">
	 This advisory covers a single cross-site scripting issue
	 that has recently been discovered and fixed in the
	 Bugzilla code: If a malicious user links to a Bugzilla
	 site using a specially crafted URL, a script in the error
	 page generated by Bugzilla will display the URL unaltered
	 in the page, allowing scripts embedded in the URL to
	 execute.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1061</cvename>
 <url>http://www.bugzilla.org/security/2.16.7-nr/</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=272620</url>
 </references>
 <dates>
 <discovery>2004-12-01</discovery>
 <entry>2005-01-24</entry>
 </dates>
 </vuln>

<vuln vid="b0911985-6e2a-11d9-9557-000a95bc6fae">
 <topic>web browsers -- window injection vulnerabilities</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>1.0.1,1</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.6,2</lt></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.6</lt></range>
 </package>
 <package>
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<name>de-netscape7</name>
	<name>fr-netscape7</name>
	<name>ja-netscape7</name>
	<name>netscape7</name>
	<name>pt_BR-netscape7</name>
	<name>mozilla-gtk1</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>fr-linux-netscape</name>
	<name>ja-linux-netscape</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>kdebase</name>
	<name>kdelibs</name>
	<range><lt>3.3.2</lt></range>
 </package>
 <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>7.54.20050131</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Research advisory reports:
	<blockquote cite="http://secunia.com/secunia_research/2004-13/advisory/">
	 Secunia Research has reported a vulnerability in multiple
	 browsers, which can be exploited by malicious people to
	 spoof the content of websites.
	 The problem is that a website can inject content into
	 another site's window if the target name of the window is
	 known. This can e.g. be exploited by a malicious website
	 to spoof the content of a pop-up window opened on a
	 trusted website.
	 Secunia has constructed a test, which can be used to
	 check if your browser is affected by this issue:
	 <a href="http://secunia.com/multiple_browsers_window_injection_vulnerability_test/">http://secunia.com/multiple_browsers_window_injection_vulnerability_test/</a>
	</blockquote>
	A <a href="http://mozillanews.org/?article_date=2004-12-08+06-48-46">workaround
	 for Mozilla-based browsers</a> is available.
 </body>
 </description>
 <references>
 <url>http://secunia.com/secunia_research/2004-13/advisory/</url>
 <url>http://secunia.com/multiple_browsers_window_injection_vulnerability_test/</url>
 
 <cvename>CVE-2004-1156</cvename>
 <url>http://secunia.com/advisories/13129/</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=273699</url>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=103638</url>
 <url>http://mozillanews.org/?article_date=2004-12-08+06-48-46</url>
 
 <cvename>CVE-2004-1157</cvename>
 <url>http://secunia.com/advisories/13253/</url>
 
 <cvename>CVE-2004-1158</cvename>
 <url>http://secunia.com/advisories/13254/</url>
 <url>http://www.kde.org/info/security/advisory-20041213-1.txt</url>
 
 <cvename>CVE-2004-1160</cvename>
 <url>http://secunia.com/advisories/13402/</url>
 </references>
 <dates>
 <discovery>2004-12-08</discovery>
 <entry>2005-01-24</entry>
 <modified>2005-02-26</modified>
 </dates>
 </vuln>

<vuln vid="d4a7054a-6d96-11d9-a9e7-0001020eed82">
 <topic>yamt -- arbitrary command execution vulnerability</topic>
 <affects>
 <package>
	<name>yamt</name>
	<range><lt>0.5_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Manigandan Radhakrishnan discovered a security
	 vulnerability in YAMT which can lead to execution of
	 arbitrary commands with the privileges of the user running
	 YAMT when sorting based on MP3 tags.	The problem exist in
	 the <code>id3tag_sort()</code> routine which does not
	 properly sanitize the artist tag from the MP3 file before
	 using it as an argument to the mv command.
 </body>
 </description>
 <references>
 <bid>11999</bid>
 <cvename>CVE-2004-1302</cvename>
 <url>http://tigger.uic.edu/~jlongs2/holes/yamt.txt</url>
 </references>
 <dates>
 <discovery>2004-12-15</discovery>
 <entry>2005-01-23</entry>
 <modified>2005-01-25</modified>
 </dates>
 </vuln>

<vuln vid="4e4bd2c2-6bd5-11d9-9e1e-c296ac722cb3">
 <topic>squid -- HTTP response splitting cache pollution attack</topic>
 <affects>
 <package>
	 <name>squid</name>
	 <range><lt>2.5.7_8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 According to a whitepaper published by Sanctum, Inc., it
	 is possible to mount cache poisoning attacks against, among others,
	 squid proxies by inserting false replies into the HTTP stream.
	 The squid patches page notes:
	 <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting">
	 This patch additionally strengthens Squid from the HTTP response
	 attack described by Sanctum.
	 </blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0175</cvename>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting</url>
 <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1200</url>
 <url>https://www.watchfire.com/securearea/whitepapers.aspx?id=8</url>
 <certvu>625878</certvu>
 </references>
 <dates>
 <discovery>2004-03-01</discovery>
 <entry>2005-01-22</entry>
 <modified>2005-02-07</modified>
 </dates>
 </vuln>

<vuln vid="338d1723-5f03-11d9-92a7-000bdb1444a4">
 <topic>horde -- XSS vulnerabilities</topic>
 <affects>
 <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><gt>3.*</gt><lt>3.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Hyperdose Security Advisory reports:
	<blockquote cite="http://lists.horde.org/archives/announce/2005/000159.html">
	 Horde contains two XSS attacks that can be exploited
	 through GET requests. Once exploited, these requests
	 could be used to execute any javascript commands in the
	 context of that user, potentially including but not
	 limited to reading and deleting email, and stealing auth
	 tokens.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12255</bid>
 <mlist msgid="1105593825.8638@mx249a.mysite4now.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110564059322774</mlist>
 <mlist>http://lists.horde.org/archives/announce/2005/000159.html</mlist>
 </references>
 <dates>
 <discovery>2005-01-04</discovery>
 <entry>2005-01-22</entry>
 </dates>
 </vuln>

<vuln vid="2b2b333b-6bd3-11d9-95f8-000a95bc6fae">
 <topic>mc -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mc</name>
	<range><lt>4.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Andrew V. Samoilov reported several vulnerabilities that
	 were corrected in MidnightCommand 4.6.0:
	<ul>
	 <li>Format string issues (CVE-2004-1004)</li>
	 <li>Buffer overflows (CVE-2004-1005)</li>
	 <li>Denial-of-service, infinite loop (CVE-2004-1009)</li>
	 <li>Denial-of-service, corrupted section header
	 (CVE-2004-1090)</li>
	 <li>Denial-of-service, null pointer dereference (CVE-2004-1091)</li>
	 <li>Freeing unallocated memory (CVE-2004-1092)</li>
	 <li>Using already freed memory (CVE-2004-1093)</li>
	</ul>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1004</cvename>
 <cvename>CVE-2004-1005</cvename>
 <cvename>CVE-2004-1009</cvename>
 <cvename>CVE-2004-1090</cvename>
 <cvename>CVE-2004-1091</cvename>
 <cvename>CVE-2004-1092</cvename>
 <cvename>CVE-2004-1093</cvename>
 </references>
 <dates>
 <discovery>2004-12-01</discovery>
 <entry>2005-01-21</entry>
 </dates>
 </vuln>

<vuln vid="c418d472-6bd1-11d9-93ca-000a95bc6fae">
 <topic>perl -- File::Path insecure file/directory permissions</topic>
 <affects>
 <package>
	<name>perl</name>
	<name>perl-threaded</name>
	<range><ge>0</ge><lt>5.6.2</lt></range>
	<range><ge>5.8.0</ge><lt>5.8.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jeroen van Wolffelaar reports that the Perl module File::Path
	 contains a race condition wherein traversed directories and files
	 are temporarily made world-readable/writable.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0452</cvename>
 <url>http://www.debian.org/security/2004/dsa-620</url>
 <url>http://xforce.iss.net/xforce/xfdb/18650</url>
 </references>
 <dates>
 <discovery>2004-12-30</discovery>
 <entry>2005-01-21</entry>
 <modified>2007-11-07</modified>
 </dates>
 </vuln>

<vuln vid="1489df94-6bcb-11d9-a21e-000a95bc6fae">
 <topic>opera -- multiple vulnerabilities in Java implementation</topic>
 <affects>
 <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>7.54.20041210</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marc Schoenefeld reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110088923127820">
	 Opera 7.54 is vulnerable to leakage of the java sandbox,
	 allowing malicious applets to gain unacceptable
	 privileges. This allows them to be used for information
	 gathering (spying) of local identity information and
	 system configurations as well as causing annoying crash
	 effects.
	 Opera 754 [sic] which was released Aug 5,2004 is
	 vulnerable to the XSLT processor covert channel attack,
	 which was corrected with JRE 1.4.2_05 [released in July
	 04], but in disadvantage to the users the opera packaging
	 guys chose to bundle the JRE 1.4.2_04 [...]
	 Internal pointer DoS exploitation: Opera.jar contains the
	 opera replacement of the java plugin. It therefore handles
	 communication between javascript and the Java VM via the
	 liveconnect protocol. The public class EcmaScriptObject
	 exposes a system memory pointer to the java address space,
	 by constructing a special variant of this type an internal
	 cache table can be polluted by false entries that infer
	 proper function of the JSObject class and in the following
	 proof-of-concept crash the browser.
	 Exposure of location of local java installation Sniffing
	 the URL classpath allows to retrieve the URLs of the
	 bootstrap class path and therefore the JDK installation
	 directory.
	 Exposure of local user name to an untrusted applet An
	 attacker could use the sun.security.krb5.Credentials class
	 to retrieve the name of the currently logged in user and
	 parse his home directory from the information which is
	 provided by the thrown
	 java.security.AccessControlException.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist msgid="Pine.A41.4.58.0411191800510.57436@zivunix.uni-muenster.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110088923127820</mlist>
 </references>
 <dates>
 <discovery>2004-11-19</discovery>
 <entry>2005-01-24</entry>
 </dates>
 </vuln>

<vuln vid="045944a0-6bca-11d9-aaa6-000a95bc6fae">
 <topic>sudo -- environmental variable CDPATH is not cleared</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><lt>1.6.8.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A sudo bug report says:
	<blockquote cite="http://www.sudo.ws/bugs/show_bug.cgi?id=155">
	 sudo doesn't unset the CDPATH variable, which leads to
	 possible security problems.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.sudo.ws/bugs/show_bug.cgi?id=155</url>
 <mlist>http://www.sudo.ws/pipermail/sudo-announce/2004-November/000044.html</mlist>
 </references>
 <dates>
 <discovery>2004-10-18</discovery>
 <entry>2005-01-21</entry>
 <modified>2013-06-19</modified>
 </dates>
 </vuln>

<vuln vid="e480ccb2-6bc8-11d9-8dbe-000a95bc6fae">
 <topic>fcron -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>fcron</name>
	<range><lt>2.9.5.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An iDEFENSE Security Advisory states:
	<blockquote cite="http://www.idefense.com/application/poi/display?id=157&amp;type=vulnerabilities&amp;flashstatus=false">
	 Multiple vulnerabilities have been found in Fcron.
	 <ol>
	 <li>File contents disclosure</li>
	 <li>Configuration Bypass Vulnerability</li>
	 <li>File Removal and Empty File Creation Vulnerability</li>
	 <li>Information Disclosure Vulnerability</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.idefense.com/application/poi/display?id=157&amp;type=vulnerabilities&amp;flashstatus=false</url>
 <cvename>CVE-2004-1030</cvename>
 <cvename>CVE-2004-1031</cvename>
 <cvename>CVE-2004-1032</cvename>
 <cvename>CVE-2004-1033</cvename>
 </references>
 <dates>
 <discovery>2004-11-15</discovery>
 <entry>2005-01-21</entry>
 </dates>
 </vuln>

<vuln vid="02274fd9-6bc5-11d9-8edb-000a95bc6fae">
 <topic>realplayer -- arbitrary file deletion and other vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-realplayer</name>
	<range><lt>10.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An NGSSoftware Insight Security Research Advisory reports:
	<blockquote cite="http://www.ngssoftware.com/advisories/real-03full.txt">
	 Two vulnerabilities have been discovered in RealPlayer
	 which may potentially be leveraged to allow remote code
	 execution, or may used in combination with the Real
	 Metadata Package File Deletion vulnerability to reliably
	 delete files from a users system.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.ngssoftware.com/advisories/real-02full.txt</url>
 <url>http://www.ngssoftware.com/advisories/real-03full.txt</url>
 <url>http://service.real.com/help/faq/security/040928_player/EN/</url>
 </references>
 <dates>
 <discovery>2004-10-06</discovery>
 <entry>2005-01-21</entry>
 </dates>
 </vuln>

<vuln vid="2001103a-6bbd-11d9-851d-000a95bc6fae">
 <topic>imlib -- xpm heap buffer overflows and integer overflows</topic>
 <affects>
 <package>
	<name>imlib</name>
	<range><lt>1.9.15_2</lt></range>
 </package>
 <package>
	<name>imlib2</name>
	<range><lt>1.1.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pavel Kankovsky reports:
	<blockquote cite="https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11">
	 Imlib affected by a variant of CAN-2004-0782 too.
	 I've discovered more vulnerabilities in Imlib
	 (1.9.13). In particular, it appears to be affected by a
	 variant of Chris Evans' libXpm flaw #1 (CAN-2004-0782, see
	 http://scary.beasts.org/security/CESA-2004-003.txt). Look
	 at the attached image, it kills ee on my 7.3.
	</blockquote>
	The flaws also affect imlib2.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1025</cvename>
 <cvename>CVE-2004-1026</cvename>
 <bid>11830</bid>
 <url>https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11</url>
 <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=138516</url>
 <url>http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/src/modules/loaders/loader_xpm.c#rev1.3</url>
 </references>
 <dates>
 <discovery>2004-12-06</discovery>
 <entry>2005-01-21</entry>
 </dates>
 </vuln>

<vuln vid="39953788-6bbb-11d9-8bc9-000a95bc6fae">
 <topic>egroupware -- arbitrary file download in JiNN</topic>
 <affects>
 <package>
	<name>eGroupWare</name>
	<range><lt>1.0.0.006</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	eGroupWare contains a bug in the JiNN component that allows
	 a remote attacker to download arbitrary files.
 </body>
 </description>
 <references>
 <url>http://cvs.sourceforge.net/viewcvs.py/egroupware/jinn/CHANGELOG#rev1.24</url>
 <mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=5915445&amp;forum_id=35178</mlist>
 </references>
 <dates>
 <discovery>2004-10-15</discovery>
 <entry>2005-01-21</entry>
 </dates>
 </vuln>

<vuln vid="2c25e762-6bb9-11d9-93db-000a95bc6fae">
 <topic>quake2 -- multiple critical vulnerabilities</topic>
 <affects>
 <package>
	<name>quake2forge</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>quake2lnx</name>
	<range><lt>0.16.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An advisory published by Richard Stanway describes numerous
	 critical vulnerabilities in the Quake II engine:
	<blockquote cite="http://secur1ty.net/advisories/001">
	 Due to unchecked input at various stages in the server,
	 remote users are able to cause the server to crash, reveal
	 sensitive information or potentially execute arbitrary
	 code.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secur1ty.net/advisories/001</url>
 <mlist msgid="NGEHLEPKOGIHAIJAMDPKOEHJCGAA.bugtraq@secur1ty.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109892527321706</mlist>
 </references>
 <dates>
 <discovery>2004-10-27</discovery>
 <entry>2005-01-21</entry>
 <modified>2005-03-15</modified>
 </dates>
 </vuln>

<vuln vid="5c7bb4dd-6a56-11d9-97ec-000c6e8f12ef">
 <topic>konversation -- shell script command injection</topic>
 <affects>
 <package>
	<name>konversation</name>
	<range><lt>0.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Konversation comes with Perl scripts that do not properly escape
	 shell characters on executing a script. This makes it possible
	 to attack Konversation with shell script command injection.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0129</cvename>
 <cvename>CVE-2005-0130</cvename>
 <cvename>CVE-2005-0131</cvename>
 <mlist msgid="200501191739.56585.wouter@coekaerts.be">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110616016509114</mlist>
 </references>
 <dates>
 <discovery>2005-01-19</discovery>
 <entry>2005-01-19</entry>
 <modified>2005-01-21</modified>
 </dates>
 </vuln>

<vuln vid="7a921e9e-68b1-11d9-9e1e-c296ac722cb3">
 <topic>squid -- no sanity check of usernames in squid_ldap_auth</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.7_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The LDAP authentication helper did not strip
	 leading or trailing spaces from the login name.
	 According to the squid patches page:
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces">
	 LDAP is very forgiving about spaces in search
	 filters and this could be abused to log in
	 using several variants of the login name,
	 possibly bypassing explicit access controls
	 or confusing accounting.
	 Workaround: Block logins with spaces
	 <pre>
	 acl login_with_spaces proxy_auth_regex [:space:]
		 http_access deny login_with_spaces
	 </pre>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0173</cvename>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces</url>
 <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1187</url>
 <certvu>924198</certvu>
 </references>
 <dates>
 <discovery>2005-01-10</discovery>
 <entry>2005-01-19</entry>
 <modified>2005-02-08</modified>
 </dates>
 </vuln>

<vuln vid="990cf07e-6988-11d9-a9e7-0001020eed82">
 <topic>cups-base -- CUPS server remote DoS vulnerability</topic>
 <affects>
 <package>
	<name>cups-base</name>
	<range><ge>1.1.21</ge><lt>1.1.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kenshi Muto discovered that the CUPS server would enter an
	 infinite loop when processing a URL containing
	 <q><code>/..</code></q>.
 </body>
 </description>
 <references>
 <bid>12200</bid>
 <cvename>CVE-2005-2874</cvename>
 <url>http://www.cups.org/str.php?L1042</url>
 </references>
 <dates>
 <discovery>2004-12-30</discovery>
 <entry>2005-01-18</entry>
 <modified>2005-09-21</modified>
 </dates>
 </vuln>

<vuln vid="b58ff497-6977-11d9-ae49-000c41e2cdad">
 <topic>tiff -- divide-by-zero denial-of-service</topic>
 <affects>
 <package>
	<name>tiff</name>
	<name>linux-tiff</name>
	<range><lt>3.6.0</lt></range>
 </package>
 <package>
	<name>pdflib</name>
	<name>pdflib-perl</name>
	<range><lt>6.0.1</lt></range>
 </package>
 <package>
	<name>gdal</name>
	<range><lt>1.2.1_2</lt></range>
 </package>
 <package>
	<name>ivtools</name>
	<range><lt>1.2.3</lt></range>
 </package>
 <package>
	<name>paraview</name>
	<range><lt>2.4.3</lt></range>
 </package>
 <package>
	<name>fractorama</name>
	<range><lt>1.6.7_1</lt></range>
 </package>
 <package>
	<name>iv</name>
	<name>ja-iv</name>
	<name>ja-libimg</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A US-CERT vulnerability note reports:
	<blockquote cite="http://www.kb.cert.org/vuls/id/555304">
	 An Integer overflow in the LibTIFF library may allow a
	 remote attacker to cause a divide-by-zero error that results
	 in a denial-of-service condition.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0804</cvename>
 <certvu>555304</certvu>
 <url>http://bugzilla.remotesensing.org/show_bug.cgi?id=111</url>
 </references>
 <dates>
 <discovery>2002-03-27</discovery>
 <entry>2005-01-18</entry>
 <modified>2006-06-08</modified>
 </dates>
 </vuln>

<vuln vid="249a8c42-6973-11d9-ae49-000c41e2cdad">
 <topic>zgv -- exploitable heap overflows</topic>
 <affects>
 <package>
	<name>zgv</name>
	<range><lt>5.8_1</lt></range>
 </package>
 <package>
	<name>xzgv</name>
	<range><lt>0.8_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	infamous41md reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109886210702781">
	 zgv uses malloc() frequently to allocate memory for storing
	 image data. When calculating how much to allocate, user
	 supplied data from image headers is multiplied and/or added
	 without any checks for arithmetic overflows. We can
	 overflow numerous calculations, and cause small buffers to
	 be allocated. Then we can overflow the buffer, and
	 eventually execute code. There are a total of
	 11 overflows that are exploitable to execute arbitrary
	 code.
	</blockquote>
	These bugs exist in both zgv and xzgv.
 </body>
 </description>
 <references>
 <mlist msgid="20041025210717.2799d9c1.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109886210702781</mlist>
 <mlist msgid="20041027233907.A3678@netdirect.ca">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109898111915661</mlist>
 <url>http://rus.members.beeb.net/xzgv.html</url>
 <url>http://www.svgalib.org/rus/zgv/</url>
 <cvename>CVE-2004-0994</cvename>
 <url>http://www.idefense.com/application/poi/display?id=160&amp;type=vulnerabilities&amp;flashstatus=false</url>
 </references>
 <dates>
 <discovery>2004-10-26</discovery>
 <entry>2005-01-18</entry>
 <modified>2005-01-21</modified>
 </dates>
 </vuln>

<vuln vid="a77849a5-696f-11d9-ae49-000c41e2cdad">
 <topic>mozilla -- insecure permissions for some downloaded files</topic>
 <affects>
 <package>
	<name>thunderbird</name>
	<range><lt>0.9</lt></range>
 </package>
 <package>
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>firefox</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><lt>1.0.r2,1</lt></range>
 </package>
 <package>
	<name>de-netscape7</name>
	<name>fr-netscape7</name>
	<name>ja-netscape7</name>
	<name>netscape7</name>
	<name>pt_BR-netscape7</name>
	<range><le>7.2</le></range>
 </package>
 <package>
	<name>mozilla-gtk1</name>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.5</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.5,2</lt></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>fr-linux-netscape</name>
	<name>ja-linux-netscape</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	In a Mozilla bug report, Daniel Kleinsinger writes:
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=251297">
	 I was comparing treatment of attachments opened directly
	 from emails on different platforms. I discovered that Linux
	 builds save attachments in /tmp with world readable rights.
	 This doesn't seem like a good thing. Couldn't someone else
	 logged onto the same machine read your attachments?
	</blockquote>
	This could expose the contents of downloaded files or email
	 attachments to other users on a multi-user system.
 </body>
 </description>
 <references>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=251297</url>
 <mlist msgid="417C19F1.2040107@ptraced.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109865078103911</mlist>
 </references>
 <dates>
 <discovery>2004-07-13</discovery>
 <entry>2005-01-18</entry>
 </dates>
 </vuln>

<vuln vid="0f5a2b4d-694b-11d9-a9e7-0001020eed82">
 <topic>awstats -- remote command execution vulnerability</topic>
 <affects>
 <package>
	<name>awstats</name>
	<range><lt>6.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An iDEFENSE Security Advisory reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110600949323439">
	 Remote exploitation of an input validation vulnerability
	 in AWStats allows attackers to execute arbitrary commands
	 under the privileges of the web server.
	 The problem specifically exists when the application is
	 running as a CGI script on a web server. The "configdir"
	 parameter contains unfiltered user-supplied data that is
	 utilized in a call to the Perl routine open()...
	 Successful exploitation allows remote attackers to
	 execute arbitrary commands under the privileges of the web
	 server. This can lead to further compromise as it provides
	 remote attackers with local access.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12270</bid>
 <cvename>CVE-2005-0116</cvename>
 <certvu>272296</certvu>
 <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503C8B20C@idserv04.idef.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110600949323439</mlist>
 <url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
 <url>http://www.idefense.com/application/poi/display?id=185&amp;type=vulnerabilities&amp;flashstatus=false</url>
 </references>
 <dates>
 <discovery>2004-10-21</discovery>
 <entry>2005-01-18</entry>
 <modified>2005-02-23</modified>
 </dates>
 </vuln>

<vuln vid="597e2bee-68ea-11d9-a9e7-0001020eed82">
 <topic>ImageMagick -- PSD handler heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.1.8.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An iDEFENSE Security Advisory reports:
	<blockquote cite="http://www.idefense.com/application/poi/display?id=184&amp;type=vulnerabilities">
	 Remote exploitation of a buffer overflow vulnerability in
	 The ImageMagick's Project's ImageMagick PSD image-decoding
	 module could allow an attacker to execute arbitrary
	 code.
	 Exploitation may allow attackers to run arbitrary code on
	 a victim's computer if the victim opens a specially
	 formatted image. Such images could be delivered by e-mail
	 or HTML, in some cases, and would likely not raise
	 suspicion on the victim's part. Exploitation is also
	 possible when a web-based application uses ImageMagick to
	 process user-uploaded image files.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0005</cvename>
 <url>http://www.idefense.com/application/poi/display?id=184&amp;type=vulnerabilities</url>
 </references>
 <dates>
 <discovery>2004-12-21</discovery>
 <entry>2005-01-18</entry>
 </dates>
 </vuln>

<vuln vid="7850a238-680a-11d9-a9e7-0001020eed82">
 <topic>cups-lpr -- lppasswd multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cups-lpr</name>
	<name>fr-cups-lpr</name>
	<range><lt>1.1.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	D. J. Bernstein reports that Bartlomiej Sieka has
	 discovered several security vulnerabilities in lppasswd,
	 which is part of CUPS. In the following excerpt from
	 Bernstein's email, CVE names have been added for each issue:
	<blockquote cite="http://tigger.uic.edu/~jlongs2/holes/cups2.txt">
	 First, lppasswd blithely ignores write errors in
	 fputs(line,outfile) at lines 311 and 315 of lppasswd.c,
	 and in fprintf(...) at line 346. An attacker who fills up
	 the disk at the right moment can arrange for
	 /usr/local/etc/cups/passwd to be truncated.
	 (CAN-2004-1268)
	 Second, if lppasswd bumps into a file-size resource limit
	 while writing passwd.new, it leaves passwd.new in place,
	 disabling all subsequent invocations of lppasswd. Any
	 local user can thus disable lppasswd...
	 (CAN-2004-1269)
	 Third, line 306 of lppasswd.c prints an error message to
	 stderr but does not exit. This is not a problem on systems
	 that ensure that file descriptors 0, 1, and 2 are open for
	 setuid programs, but it is a problem on other systems;
	 lppasswd does not check that passwd.new is different from
	 stderr, so it ends up writing a user-controlled error
	 message to passwd if the user closes file descriptor
	 2. (CAN-2004-1270)
	</blockquote>
	Note: The third issue, CVE-2004-1270, does
	 not affect FreeBSD 4.6-RELEASE or later systems, as these
	 systems ensure that the file descriptors 0, 1, and 2 are
	 always open for set-user-ID and set-group-ID programs.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1268</cvename>
 <cvename>CVE-2004-1269</cvename>
 <cvename>CVE-2004-1270</cvename>
 <bid>12007</bid>
 <bid>12004</bid>
 <url>http://www.cups.org/str.php?L1023</url>
 <url>http://tigger.uic.edu/~jlongs2/holes/cups2.txt</url>
 </references>
 <dates>
 <discovery>2004-12-11</discovery>
 <entry>2005-01-17</entry>
 </dates>
 </vuln>

<vuln vid="40a3bca2-6809-11d9-a9e7-0001020eed82">
 <topic>cups-base -- HPGL buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>cups-base</name>
	<name>fr-cups-base</name>
	<range><lt>1.1.22.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ariel Berkman has discovered a buffer overflow
	 vulnerability in CUPS's HPGL input driver. This
	 vulnerability could be exploited to execute arbitrary code
	 with the permission of the CUPS server by printing a
	 specially crated HPGL file.
 </body>
 </description>
 <references>
 <bid>11968</bid>
 <cvename>CVE-2004-1267</cvename>
 <url>http://tigger.uic.edu/~jlongs2/holes/cups.txt</url>
 <url>http://www.cups.org/str.php?L1024</url>
 </references>
 <dates>
 <discovery>2004-12-15</discovery>
 <entry>2005-01-17</entry>
 </dates>
 </vuln>

<vuln vid="ce109fd4-67f3-11d9-a9e7-0001020eed82">
 <topic>mysql-scripts -- mysqlaccess insecure temporary file creation</topic>
 <affects>
 <package>
	<name>mysql-scripts</name>
	<range><lt>3.23.58_2</lt></range>
	<range><gt>4.*</gt><lt>4.0.23a_1</lt></range>
	<range><gt>4.1.*</gt><lt>4.1.9_1</lt></range>
	<range><gt>5.*</gt><lt>5.0.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Debian Security Team reports:
	<blockquote>
	 Javier Fernández-Sanguino Peña from the Debian Security
	 Audit Project discovered a temporary file vulnerability in
	 the mysqlaccess script of MySQL that could allow an
	 unprivileged user to let root overwrite arbitrary files
	 via a symlink attack and could also could unveil the
	 contents of a temporary file which might contain sensitive
	 information.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0004</cvename>
 <url>http://lists.mysql.com/internals/20600</url>
 </references>
 <dates>
 <discovery>2005-01-12</discovery>
 <entry>2005-01-16</entry>
 <modified>2005-01-17</modified>
 </dates>
 </vuln>

<vuln vid="f2d5e56e-67eb-11d9-a9e7-0001020eed82">
 <topic>unrtf -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>unrtf</name>
	<range><lt>0.19.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Yosef Klein and Limin Wang have found a buffer overflow
	 vulnerability in unrtf that can allow an attacker to execute
	 arbitrary code with the permissions of the user running
	 unrtf, by running unrtf on a specially crafted rtf
	 document.
 </body>
 </description>
 <references>
 <bid>12030</bid>
 <cvename>CVE-2004-1297</cvename>
 <url>http://tigger.uic.edu/~jlongs2/holes/unrtf.txt</url>
 </references>
 <dates>
 <discovery>2004-12-15</discovery>
 <entry>2005-01-16</entry>
 <modified>2005-02-11</modified>
 </dates>
 </vuln>

<vuln vid="3fbf9db2-658b-11d9-abad-000a95bc6fae">
 <topic>mozilla -- heap overflow in NNTP handler</topic>
 <affects>
 <package>
	<name>de-netscape7</name>
	<name>fr-netscape7</name>
	<name>ja-netscape7</name>
	<name>netscape7</name>
	<name>pt_BR-netscape7</name>
	<range><gt>0</gt></range>
 </package>
 <package>
	<name>mozilla-gtk1</name>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.5</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.5,2</lt></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>fr-linux-netscape</name>
	<name>ja-linux-netscape</name>
	<name>linux-netscape</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Maurycy Prodeus reports a critical vulnerability in
	 Mozilla-based browsers:
	<blockquote cite="http://isec.pl/vulnerabilities/isec-0020-mozilla.txt">
	 Mozilla browser supports NNTP urls. Remote side is able to
	 trigger news:// connection to any server. I found a flaw in
	 NNTP handling code which may cause heap overflow and allow
	 remote attacker to execute arbitrary code on client
	 machine.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1316</cvename>
 <url>http://isec.pl/vulnerabilities/isec-0020-mozilla.txt</url>
 <mlist msgid="Pine.LNX.4.44.0412292228440.19239-200000@isec.pl">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110436284718949</mlist>
 </references>
 <dates>
 <discovery>2004-12-29</discovery>
 <entry>2005-01-13</entry>
 </dates>
 </vuln>

<vuln vid="3cc84400-6576-11d9-a9e7-0001020eed82">
 <topic>mpg123 -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>mpg123</name>
	<name>mpg123-nas</name>
	<name>mpg123-esound</name>
	<range><lt>0.59r_17</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Yuri D'Elia has found a buffer overflow vulnerability in
	 mpg123's parsing of frame headers in input streams. This
	 vulnerability can potentially lead to execution of arbitrary
	 code with the permissions of the user running mpg123, if the
	 user runs mpg123 on a specially crafted MP2 or MP3 file.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0991</cvename>
 </references>
 <dates>
 <discovery>2005-01-01</discovery>
 <entry>2005-01-13</entry>
 </dates>
 </vuln>

<vuln vid="5fe7e27a-64cb-11d9-9e1e-c296ac722cb3">
 <topic>squid -- denial of service with forged WCCP messages</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.7_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The squid patches page notes:
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service">
	 WCCP_I_SEE_YOU messages contain a 'number of caches'
	 field which should be between 1 and 32. Values outside
	 that range may crash Squid if WCCP is enabled, and if an
	 attacker can spoof UDP packets with the WCCP router's IP
	 address.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0095</cvename>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service</url>
 <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1190</url>
 <url>http://www.squid-cache.org/Advisories/SQUID-2005_2.txt</url>
 </references>
 <dates>
 <discovery>2005-01-07</discovery>
 <entry>2005-01-12</entry>
 <modified>2005-01-22</modified>
 </dates>
 </vuln>

<vuln vid="184ab9e0-64cd-11d9-9e1e-c296ac722cb3">
 <topic>squid -- buffer overflow vulnerability in gopherToHTML</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.7_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The squid patches page notes:
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing">
	 A malicious gopher server may return a response with very
	 long lines that cause a buffer overflow in Squid.
	 Workaround: Since gopher is very obscure these days, do
	 not allow Squid to any gopher servers. Use an ACL rule
	 like:
	 <pre>acl Gopher proto gopher
http_access deny Gopher</pre>
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0094</cvename>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing</url>
 <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1189</url>
 <url>http://www.squid-cache.org/Advisories/SQUID-2005_1.txt</url>
 </references>
 <dates>
 <discovery>2005-01-11</discovery>
 <entry>2005-01-12</entry>
 <modified>2005-01-22</modified>
 </dates>
 </vuln>

<vuln vid="131bd7c4-64a3-11d9-829a-000a95bc6fae">
 <topic>libxine -- DVD subpicture decoder heap overflow</topic>
 <affects>
 <package>
	<name>libxine</name>
	<range><lt>1.0.r6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A xine security announcement states:
	<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-5">
	 A heap overflow has been found in the DVD subpicture
	 decoder of xine-lib. This can be used for a remote heap
	 overflow exploit, which can, on some systems, lead to or
	 help in executing malicious code with the permissions of the
	 user running a xine-lib based media application.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1379</cvename>
 <url>http://xinehq.de/index.php/security/XSA-2004-5</url>
 </references>
 <dates>
 <discovery>2004-09-06</discovery>
 <entry>2005-01-12</entry>
 <modified>2005-01-19</modified>
 </dates>
 </vuln>

<vuln vid="b6939d5b-64a1-11d9-9106-000a95bc6fae">
 <topic>libxine -- multiple vulnerabilities in VideoCD handling</topic>
 <affects>
 <package>
	<name>libxine</name>
	<range><ge>1.0.r2</ge><lt>1.0.r6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A xine security announcement states:
	<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-4">
	 Several string overflows on the stack have been fixed in
	 xine-lib, some of them can be used for remote buffer
	 overflow exploits leading to the execution of arbitrary code
	 with the permissions of the user running a xine-lib based
	 media application.
	 Stack-based string overflows have been found:
	 <ol>
	 <li>in the code which handles VideoCD MRLs</li>
	 <li>in VideoCD code reading the disc label</li>
	 <li>in the code which parses text subtitles and prepares
	 them for display</li>
	 </ol>
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://xinehq.de/index.php/security/XSA-2004-4</url>
 </references>
 <dates>
 <discovery>2004-09-07</discovery>
 <entry>2005-01-12</entry>
 </dates>
 </vuln>

<vuln vid="1b70bef4-649f-11d9-a30e-000a95bc6fae">
 <topic>libxine -- multiple buffer overflows in RTSP</topic>
 <affects>
 <package>
	<name>mplayer</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.4</lt></range>
 </package>
 <package>
	<name>libxine</name>
	<range><lt>1.0.r4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A xine security announcement states:
	<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-3">
	 Multiple vulnerabilities have been found and fixed in the
	 Real-Time Streaming Protocol (RTSP) client for RealNetworks
	 servers, including a series of potentially remotely
	 exploitable buffer overflows. This is a joint advisory by
	 the MPlayer and xine teams as the code in question is common
	 to these projects.
	 Severity: High (arbitrary remote code execution under the
	 user ID running the player) when playing Real RTSP streams.
	 At this time, there is no known exploit for these
	 vulnerabilities.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0433</cvename>
 <url>http://xinehq.de/index.php/security/XSA-2004-3</url>
 <url>http://xforce.iss.net/xforce/xfdb/16019</url>
 <bid>10245</bid>
 </references>
 <dates>
 <discovery>2004-05-25</discovery>
 <entry>2005-01-12</entry>
 </dates>
 </vuln>

<vuln vid="8eabaad9-641f-11d9-92a7-000a95bc6fae">
 <topic>hylafax -- unauthorized login vulnerability</topic>
 <affects>
 <package>
	<name>hylafax</name>
	<range><lt>4.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A flaw in HylaFAX may allow an attacker to bypass normal
	 authentication by spoofing their DNS PTR records.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1182</cvename>
 <mlist msgid="20050111155949.GU9853@bilbo.x101.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110546971307585</mlist>
 </references>
 <dates>
 <discovery>2005-01-11</discovery>
 <entry>2005-01-11</entry>
 </dates>
 </vuln>

<vuln vid="56971fa6-641c-11d9-a097-000854d03344">
 <topic>xshisen -- local buffer overflows</topic>
 <affects>
 <package>
	<name>xshisen</name>
	<range><lt>1.36_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Steve Kemp has found buffer overflows in the handling
	 of the command line flag -KCONV and the XSHISENLIB environment
	 variable. Ulf Härnhammer has detected an unbounded copy from
	 the GECOS field to a char array. All overflows can be exploited
	 to gain group games privileges.
 </body>
 </description>
 <references>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=213957</url>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=289784</url>
 <cvename>CVE-2003-1053</cvename>
 <cvename>CVE-2005-0117</cvename>
 </references>
 <dates>
 <discovery>2005-01-11</discovery>
 <entry>2005-01-11</entry>
 <modified>2005-01-19</modified>
 </dates>
 </vuln>

<vuln vid="0cf3480d-5fdf-11d9-b721-00065be4b5b6">
 <topic>helvis -- arbitrary file deletion problem</topic>
 <affects>
 <package>
	<name>ko-helvis</name>
	<range><le>1.8h2_1</le></range>
 </package>
 <package>
	<name>helvis</name>
	<range><le>1.8h2_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The setuid root elvprsv utility, used to preserve
	 recovery helvis files, can be abused by local users to delete
	with root privileges.
	The problem is that elvprsv deletes files when it thinks they
	have become corrupt. When elvprsv is pointed to a normal file then
	it will almost always think the file is corrupt and deletes it.
	This behavior may be exploited by local attackers to delete critical
	files.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0120</cvename>
 <url>http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt</url>
 </references>
 <dates>
 <discovery>2004-11-24</discovery>
 <entry>2005-01-10</entry>
 <modified>2005-01-19</modified>
 </dates>
 </vuln>

<vuln vid="bb99f803-5fde-11d9-b721-00065be4b5b6">
 <topic>helvis -- information leak vulnerabilities</topic>
 <affects>
 <package>
	<name>ko-helvis</name>
	<range><le>1.8h2_1</le></range>
 </package>
 <package>
	<name>helvis</name>
	<range><le>1.8h2_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Once a recovery file has been preserved by the setuid root elvprsv
	utility it is placed in a worldreadable directory with worldreadable
	permissions. This possibly allows sensitive information to leak.
	In addition to this information leak, it is possible for users
	to recover files that belong to other users by using elvrec, another
	setuid root binary.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0118</cvename>
 <cvename>CVE-2005-0119</cvename>
 <url>http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt</url>
 </references>
 <dates>
 <discovery>2004-11-24</discovery>
 <entry>2005-01-10</entry>
 <modified>2005-01-19</modified>
 </dates>
 </vuln>

<vuln vid="28ab7ddf-61ab-11d9-a9e7-0001020eed82">
 <topic>dillo -- format string vulnerability</topic>
 <affects>
 <package>
	<name>dillo</name>
	<range><lt>0.8.3_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	dillo contains a format string vulnerability which could
	 lead to execution of arbitrary code simply by viewing a web
	 page or opening a HTML file.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0012</cvename>
 <url>http://bugs.gentoo.org/show_bug.cgi?id=76665</url>
 </references>
 <dates>
 <discovery>2005-01-04</discovery>
 <entry>2005-01-08</entry>
 </dates>
 </vuln>

<vuln vid="f92e1bbc-5e18-11d9-839a-0050da134090">
 <topic>tnftp -- mget does not check for directory escapes</topic>
 <affects>
 <package>
	<name>tnftp</name>
	<range><lt>20050103</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	When downloading a batch of files from an FTP server the
	 mget command does not check for directory escapes. A
	 specially crafted file on the FTP server could then
	 potentially overwrite an existing file of the user.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1294</cvename>
 <url>http://tigger.uic.edu/~jlongs2/holes/tnftp.txt</url>
 <url>http://cvsweb.netbsd.org/bsdweb.cgi/othersrc/usr.bin/tnftp/src/cmds.c?rev=1.1.1.3&amp;content-type=text/x-cvsweb-markup</url>
 <url>http://it.slashdot.org/article.pl?sid=04/12/15/2113202</url>
 <mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110321888413132</mlist>
 </references>
 <dates>
 <discovery>2004-12-15</discovery>
 <entry>2005-01-07</entry>
 <modified>2005-01-13</modified>
 </dates>
 </vuln>

<vuln vid="8f86d8b5-6025-11d9-a9e7-0001020eed82">
 <topic>tiff -- tiffdump integer overflow vulnerability</topic>
 <affects>
 <package>
	<name>tiff</name>
	<range><lt>3.7.1_2</lt></range>
 </package>
 <package>
	<name>linux-tiff</name>
	<range><lt>3.6.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dmitry V. Levin found a potential integer overflow in the
	 tiffdump utility which could lead to execution of arbitrary
	 code. This could be exploited by tricking an user into
	 executing tiffdump on a specially crafted tiff image.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1183</cvename>
 </references>
 <dates>
 <discovery>2005-01-06</discovery>
 <entry>2005-01-06</entry>
 <modified>2005-03-01</modified>
 </dates>
 </vuln>

<vuln vid="fc7e6a42-6012-11d9-a9e7-0001020eed82">
 <topic>tiff -- directory entry count integer overflow vulnerability</topic>
 <affects>
 <package>
	<name>tiff</name>
	<range><lt>3.7.1</lt></range>
 </package>
 <package>
	<name>linux-tiff</name>
	<range><lt>3.6.1_1</lt></range>
 </package>
 <package>
	<name>pdflib</name>
	<name>pdflib-perl</name>
	<range><lt>6.0.1_1</lt></range>
 </package>
 <package>
	<name>gdal</name>
	<range><lt>1.2.1_2</lt></range>
 </package>
 <package>
	<name>ivtools</name>
	<range><lt>1.2.3</lt></range>
 </package>
 <package>
	<name>paraview</name>
	<range><lt>2.4.3</lt></range>
 </package>
 <package>
	<name>fractorama</name>
	<range><lt>1.6.7_1</lt></range>
 </package>
 <package>
	<name>iv</name>
	<name>ja-iv</name>
	<name>ja-libimg</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	In an iDEFENSE Security Advisory infamous41md reports:
	<blockquote cite="http://www.idefense.com/application/poi/display?id=174&amp;type=vulnerabilities">
	 Remote exploitation of a heap-based buffer overflow
	 vulnerability within the LibTIFF package could allow
	 attackers to execute arbitrary code.
	 The vulnerability specifically exists due to insufficient
	 validation of user-supplied data when calculating the size
	 of a directory entry. A TIFF file includes a number of
	 directory entry header fields that describe the data in
	 the file. Included in these entries is an entry count and
	 offset value that are calculated to determine the size and
	 location of the data for that entry.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>12075</bid>
 <cvename>CVE-2004-1308</cvename>
 <url>http://www.idefense.com/application/poi/display?id=174&amp;type=vulnerabilities</url>
 <certvu>125598</certvu>
 </references>
 <dates>
 <discovery>2004-12-17</discovery>
 <entry>2005-01-06</entry>
 <modified>2006-06-08</modified>
 </dates>
 </vuln>

<vuln vid="bd9fc2bf-5ffe-11d9-a11a-000a95bc6fae">
 <topic>vim -- vulnerabilities in modeline handling</topic>
 <affects>
 <package>
	<name>vim</name>
	<name>vim-console</name>
	<name>vim-lite</name>
	<name>vim+ruby</name>
	<range><lt>6.3.45</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ciaran McCreesh discovered news ways in which a VIM modeline
	 can be used to trojan a text file. The patch by Bram
	 Moolenaar reads:
	<blockquote cite="ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.045">
	 Problem: Unusual characters in an option value may cause
	 unexpected behavior, especially for a modeline. (Ciaran
	 McCreesh)
	 Solution: Don't allow setting termcap options or
	 'printdevice' or 'titleold' in a modeline. Don't list
	 options for "termcap" and "all" in a modeline. Don't allow
	 unusual characters in 'filetype', 'syntax', 'backupext',
	 'keymap', 'patchmode' and 'langmenu'.
	</blockquote>
	Note: It is generally recommended that VIM
	 users use <code>set nomodeline</code> in
	 <code>~/.vimrc</code> to avoid the possibility of trojaned
	 text files.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1138</cvename>
 <url>ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.045</url>
 <mlist>http://groups.yahoo.com/group/vimdev/message/38084</mlist>
 </references>
 <dates>
 <discovery>2004-12-09</discovery>
 <entry>2005-01-06</entry>
 <modified>2005-01-13</modified>
 </dates>
 </vuln>

<vuln vid="58fc2752-5f74-11d9-a9e7-0001020eed82">
 <topic>pcal -- buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>pcal</name>
	<range><lt>4.8.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Danny Lungstrom has found two buffer overflow
	 vulnerabilities in pcal which can lead to execution of
	 arbitrary code by making a user run pcal on a specially
	 crafted calendar file.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1289</cvename>
 <bid>12035</bid>
 <bid>12036</bid>
 <mlist msgid="20041215083219.56092.qmail@cr.yp.to">http://securesoftware.list.cr.yp.to/archive/0/46</mlist>
 </references>
 <dates>
 <discovery>2004-12-15</discovery>
 <entry>2005-01-06</entry>
 </dates>
 </vuln>

<vuln vid="ca9ce879-5ebb-11d9-a01c-0050569f0001">
 <topic>exim -- two buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>exim</name>
	<name>exim-ldap</name>
	<name>exim-ldap2</name>
	<name>exim-mysql</name>
	<name>exim-postgresql</name>
	<name>exim-sa-exim</name>
	<range><lt>4.43+28_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	1. The function host_aton() can overflow a buffer
	 if it is presented with an illegal IPv6 address
	 that has more than 8 components.
	2. The second report described a buffer overflow
	 in the function spa_base64_to_bits(), which is part
	 of the code for SPA authentication.
 </body>
 </description>
 <references>
 <mlist msgid="Pine.SOC.4.61.0501041452540.1114@draco.cus.cam.ac.uk">http://www.exim.org/mail-archives/exim-announce/2005/msg00000.html</mlist>
 <mlist msgid="1CE07882ECEE894CA2D5A89B8DEBC4011CFDE5@porgy.admin.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110573573800377</mlist>
 <cvename>CVE-2005-0021</cvename>
 <cvename>CVE-2005-0022</cvename>
 <bid>12185</bid>
 <bid>12188</bid>
 <bid>12268</bid>
 </references>
 <dates>
 <discovery>2005-01-05</discovery>
 <entry>2005-01-05</entry>
 <modified>2005-01-18</modified>
 </dates>
 </vuln>

<vuln vid="877e918e-5362-11d9-96d4-00065be4b5b6">
 <topic>mpg123 -- playlist processing buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>mpg123</name>
	<name>mpg123-nas</name>
	<name>mpg123-esound</name>
	<range><le>0.59r_15</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A buffer overflow vulnerability exists in the playlist
	 processing of mpg123. A specially crafted playlist entry
	 can cause a stack overflow that can be used to inject
	 arbitrary code into the mpg123 process.
	Note that a malicious playlist, demonstrating this
	 vulnerability, was released by the bug finder and may be
	 used as a template by attackers.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1284</cvename>
 <url>http://tigger.uic.edu/~jlongs2/holes/mpg123.txt</url>
 <url>http://secunia.com/advisories/13511/</url>
 <url>http://xforce.iss.net/xforce/xfdb/18626</url>
 <bid>11958</bid>
 <mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110321888413132</mlist>
 </references>
 <dates>
 <discovery>2004-12-15</discovery>
 <entry>2005-01-03</entry>
 <modified>2005-01-13</modified>
 </dates>
 </vuln>

<vuln vid="bd579366-5290-11d9-ac20-00065be4b5b6">
 <topic>greed -- insecure GRX file processing</topic>
 <affects>
 <package>
	<name>greed</name>
	<range><le>0.81p</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A buffer overflow vulnerability has been detected in the greed
	URL handling code. This bug can especially be a problem when greed is
	used to process GRX (GetRight) files that originate from untrusted
	sources.
	The bug finder, Manigandan Radhakrishnan, gave the following
	 description:
	<blockquote cite="http://tigger.uic.edu/~jlongs2/holes/greed.txt">
	 Here are the bugs. First, in main.c, DownloadLoop() uses strcat()
	 to copy an input filename to the end of a 128-byte COMMAND array.
	 Second, DownloadLoop() passes the input filename to system() without
	 checking for special characters such as semicolons.</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1273</cvename>
 <cvename>CVE-2004-1274</cvename>
 <url>http://tigger.uic.edu/~jlongs2/holes/greed.txt</url>
 <url>http://secunia.com/advisories/13534/</url>
 <mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110321888413132</mlist>
 </references>
 <dates>
 <discovery>2004-12-15</discovery>
 <entry>2005-01-03</entry>
 <modified>2005-01-13</modified>
 </dates>
 </vuln>

<vuln vid="949c470e-528f-11d9-ac20-00065be4b5b6">
 <topic>golddig -- local buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>golddig</name>
	<range><le>2.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Two buffer overflow vulnerabilities where detected. Both issues can
	 be used by local users to gain group games privileges on affected
	 systems.
	The first overflow exists in the map name handling and can be
	 triggered when a very long name is given to the program during
	 command-line execution
	The second overflow exists in the username processing while writing
	 the players score to disk. Excessivly long usernames, set via the USER
	 environment variable, are stored without any length checks in a memory
	 buffer.
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0121</cvename>
 <mlist msgid="200412021055.iB2AtweU067125@repoman.freebsd.org">http://docs.FreeBSD.org/cgi/mid.cgi?200412021055.iB2AtweU067125</mlist>
 </references>
 <dates>
 <discovery>2004-11-11</discovery>
 <entry>2005-01-03</entry>
 <modified>2005-01-19</modified>
 </dates>
 </vuln>

<vuln vid="927743d4-5ca9-11d9-a9e7-0001020eed82">
 <topic>up-imapproxy -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>up-imapproxy</name>
	<range><lt>1.2.4</lt></range>
 </package>
 <package>
	<name>pop3proxy</name>
	<range><le>1.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Timo Sirainen reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109995749510773">
	 There are various bugs in up-imapproxy which can crash
	 it. Since up-imapproxy runs in a single process with each
	 connection handled in a separate thread, any crash kills
	 all the connections and stops listening for new ones.
	 In 64bit systems it might be possible to make it leak
	 data (mails, passwords, ..) from other connections to
	 attacker's connection. However I don't think up-imapproxy
	 actually works in any 64bit system so this is just a
	 theoretical problem.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1035</cvename>
 <bid>11630</bid>
 <mlist msgid="1099851138.3716.3.camel@hurina">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109995749510773</mlist>
 </references>
 <dates>
 <discovery>2004-11-17</discovery>
 <entry>2005-01-02</entry>
 <modified>2008-02-27</modified>
 </dates>
 </vuln>

<vuln vid="832e9d75-5bfc-11d9-a9e7-0001020eed82">
 <topic>kdelibs3 -- konqueror FTP command injection vulnerability</topic>
 <affects>
 <package>
	<name>ja-kdelibs</name>
	<name>kdelibs</name>
	<range><lt>3.3.2_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Albert Puigsech Galicia reports that Konqueror (more
	 specifically kio_ftp) and Microsoft Internet Explorer are
	 vulnerable to a FTP command injection vulnerability which
	 can be exploited by tricking an user into clicking a
	 specially crafted FTP URI.
	It is also reported by Ian Gulliver and Emanuele Balla that
	 this vulnerability can be used to tricking a client into
	 sending out emails without user interaction.
 </body>
 </description>
 <references>
 <bid>11827</bid>
 <cvename>CVE-2004-1165</cvename>
 <mlist msgid="200412051011.54045.ripe@7a69ezine.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110245752232681</mlist>
 <mlist msgid="20041223235620.GA2846@penguinhosting.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110387390226693</mlist>
 <mlist msgid="20041224142506.GB12939@penguinhosting.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110390734925183</mlist>
 <url>http://www.kde.org/info/security/advisory-20050101-1.txt</url>
 </references>
 <dates>
 <discovery>2004-12-01</discovery>
 <entry>2005-01-01</entry>
 <modified>2005-01-04</modified>
 </dates>
 </vuln>

<vuln vid="a395397c-c7c8-11d9-9e1e-c296ac722cb3">
 <topic>squid -- possible abuse of cachemgr.cgi</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The squid patches page notes:
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf">
	 This patch adds access controls to the cachemgr.cgi script,
	 preventing it from being abused to reach other servers than
	 allowed in a local configuration file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-1999-0710</cvename>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf</url>
 <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1094</url>
 </references>
 <dates>
 <discovery>1999-07-29</discovery>
 <entry>2005-05-19</entry>
 </dates>
 </vuln>

<vuln vid="7e97b288-c7ca-11d9-9e1e-c296ac722cb3">
 <topic>squid -- DNS lookup spoofing vulnerability</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The squid patches page notes:
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_query">
	 Malicious users may spoof DNS lookups if the DNS client UDP port
	 (random, assigned by OS as startup) is unfiltered and your network
	 is not protected from IP spoofing.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-1519</cvename>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_reply</url>
 <url>http://secunia.com/advisories/15294</url>
 </references>
 <dates>
 <discovery>2005-05-11</discovery>
 <entry>2005-05-19</entry>
 </dates>
 </vuln>

<vuln vid="55041d37-ff62-11d9-a9a5-000ae4641456">
 <topic>jabberd -- 3 buffer overflows</topic>
 <affects>
 <package>
	<name>jabberd</name>
	<range><lt>2.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	There are 3 buffer overflows in jid.c that are triggered
	 during parsing of JID strings when components (user, host or
	 resource) are too long.
	<ol>
	 <li>jid.c, line 103: overflow in `str' buffer through
	 <code>strcpy()</code> when "user" part is too long.</li>
	 <li>jid.c, line 115: overflow in `str' buffer through
	 <code>strcpy()</code> when "host" part is too long.</li>
	 <li>jid.c, line 127: overflow in `str' buffer through
	 <code>strcpy()</code> when "resource" part is too
	 long.</li>
	</ol>
	These overflows can be used to perform a DoS attack on the
	 server (sm process segfaults) and can possible be used for
	 arbitrary code execution.
 </body>
 </description>
 <references>
 <url>http://j2.openaether.org/bugzilla/show_bug.cgi?id=99</url>
 </references>
 <dates>
 <discovery>2005-07-25</discovery>
 <entry>2005-07-30</entry>
 </dates>
 </vuln>

<vuln vid="44e7764c-2614-11da-9e1e-c296ac722cb3">
 <topic>squid -- possible denial of service condition regarding NTLM authentication</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.10_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The squid patches page notes:
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-NTLM-scheme_assert">
	 Squid may crash with the above error [FATAL: Incorrect scheme in
	 auth header] when given certain request sentences.
	 Workaround: disable NTLM authentication.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>14977</bid>
 <cvename>CVE-2005-2917</cvename>
 <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1391</url>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-NTLM-scheme_assert</url>
 <url>http://secunia.com/advisories/16992/</url>
 </references>
 <dates>
 <discovery>2005-09-12</discovery>
 <entry>2005-09-15</entry>
 <modified>2005-10-02</modified>
 </dates>
 </vuln>

<vuln vid="c6b9aee8-3071-11da-af18-000ae4641456">
 <topic>phpmyfaq -- SQL injection, takeover, path disclosure, remote code execution</topic>
 <affects>
 <package>
	<name>phpmyfaq</name>
	<range><lt>1.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	If magic quotes are off there's a SQL injection when
	 sending a forgotten password. It's possible to overwrite
	 the admin password and to take over the whole system. In
	 some files in the admin section there are some cross site
	 scripting vulnerabilities. In the public frontend it's
	 possible to include arbitrary php files.
 </body>
 </description>
 <references>
 <bid>14927</bid>
 <bid>14928</bid>
 <bid>14929</bid>
 <bid>14930</bid>
 <cvename>CVE-2005-3046</cvename>
 <cvename>CVE-2005-3047</cvename>
 <cvename>CVE-2005-3048</cvename>
 <cvename>CVE-2005-3049</cvename>
 <cvename>CVE-2005-3050</cvename>
 <url>http://www.phpmyfaq.de/advisory_2005-09-23.php</url>
 </references>
 <dates>
 <discovery>2005-09-23</discovery>
 <entry>2005-09-29</entry>
 </dates>
 </vuln>

<vuln vid="9168253c-5a6d-11d9-a9e7-0001020eed82">
 <topic>a2ps -- insecure temporary file creation</topic>
 <affects>
 <package>
	<name>a2ps-a4</name>
	<name>a2ps-letter</name>
	<name>a2ps-letterdj</name>
	<range><lt>4.13b_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Secunia Security Advisory reports that Javier
	 Fernández-Sanguino Peña has found temporary file
	 creation vulnerabilities in the fixps and psmandup scripts
	 which are part of a2ps. These vulnerabilities could lead to
	 an attacker overwriting arbitrary files with the credentials
	 of the user running the vulnerable scripts.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1377</cvename>
 <bid>12108</bid>
 <bid>12109</bid>
 <url>http://secunia.com/advisories/13641/</url>
 </references>
 <dates>
 <discovery>2004-12-27</discovery>
 <entry>2004-12-30</entry>
 <modified>2005-01-19</modified>
 </dates>
 </vuln>

<vuln vid="64c8cc2a-59b1-11d9-8a99-000c6e8f12ef">
 <topic>libxine -- buffer-overflow vulnerability in aiff support</topic>
 <affects>
 <package>
	<name>libxine</name>
	<range><le>1.0.r5_3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Due to a buffer overflow in the open_aiff_file function in
	 demux_aiff.c, a remote attacker is able to execute arbitrary
	 code via a modified AIFF file.</body>
 </description>
 <references>
 <cvename>CVE-2004-1300</cvename>
 <url>http://tigger.uic.edu/~jlongs2/holes/xine-lib.txt</url>
 <url>http://xinehq.de/index.php/security/XSA-2004-7</url>
 </references>
 <dates>
 <discovery>2004-12-15</discovery>
 <entry>2004-12-29</entry>
 <modified>2005-01-12</modified>
 </dates>
 </vuln>

<vuln vid="2e25d38b-54d1-11d9-b612-000c6e8f12ef">
 <topic>jabberd -- denial-of-service vulnerability</topic>
 <affects>
 <package>
	<name>jabber</name>
	<range><lt>1.4.3.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	José Antonio Calvo discovered a bug in the Jabber 1.x server.
	 According to Matthias Wimmer:
	<blockquote cite="http://devel.amessage.info/jabberd14/README.html">
	 Without this patch, it is possible to remotly crash
	 jabberd14, if there is access to one of the following types
	 of network sockets:
	 <ul>
	 <li>Socket accepting client connections</li>
	 <li>Socket accepting connections from other servers</li>
	 <li>Socket connecting to an other Jabber server</li>
	 <li>Socket accepting connections from server components</li>
	 <li>Socket connecting to server components</li>
	 </ul>
	 This is any socket on which the jabberd server parses
	 XML!
	 The problem existed in the included expat XML parser code.
	 This patch removes the included expat code from jabberd14
	 and links jabberd against an installed version of expat.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1378</cvename>
 <url>http://devel.amessage.info/jabberd14/README.html</url>
 <url>http://mail.jabber.org/pipermail/jabberd/2004-September/002004.html</url>
 </references>
 <dates>
 <discovery>2004-09-19</discovery>
 <entry>2004-12-26</entry>
 <modified>2005-01-19</modified>
 </dates>
 </vuln>

<vuln vid="a30e5e44-5440-11d9-9e1e-c296ac722cb3">
 <topic>squid -- confusing results on empty acl declarations</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.7_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Applying an empty ACL list results in unexpected behavior:
	 anything will match an empty ACL list. For example,
	<blockquote cite="http://www.squid-cache.org/bugs/show_bug.cgi?id=1166">
	 The meaning of the configuration gets very confusing when
	 we encounter empty ACLs such as
	 <code>acl something src "/path/to/empty_file.txt" 
	 http_access allow something somewhere</code>
	 gets parsed (with warnings) as
	 <code>http_access allow somewhere</code>
	 And similarily if you are using proxy_auth acls without
	 having any auth schemes defined.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2005-0194</cvename>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-empty_acls</url>
 <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1166</url>
 </references>
 <dates>
 <discovery>2004-12-21</discovery>
 <entry>2004-12-23</entry>
 <modified>2005-02-08</modified>
 </dates>
 </vuln>

<vuln vid="efa1344b-5477-11d9-a9e7-0001020eed82">
 <topic>ethereal -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><lt>0.10.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An Ethreal Security Advisories reports:
	<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00016.html">
	 Issues have been discovered in the following protocol
	 dissectors:
	 <ul>
	 <li>Matthew Bing discovered a bug in DICOM dissection that
	 could make Ethereal crash.</li>
	 <li>An invalid RTP timestamp could make Ethereal hang and
	 create a large temporary file, possibly filling
	 available disk space.</li>
	 <li>The HTTP dissector could access previously-freed
	 memory, causing a crash.</li>
	 <li>Brian Caswell discovered that an improperly formatted
	 SMB packet could make Ethereal hang, maximizing CPU
	 utilization.</li>
	 </ul>
	 Impact: It may be possible to make Ethereal crash or run
	 arbitrary code by injecting a purposefully malformed
	 packet onto the wire or by convincing someone to read a
	 malformed packet trace file.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1139</cvename>
 <cvename>CVE-2004-1140</cvename>
 <cvename>CVE-2004-1141</cvename>
 <cvename>CVE-2004-1142</cvename>
 <url>http://www.ethereal.com/appnotes/enpa-sa-00016.html</url>
 </references>
 <dates>
 <discovery>2004-12-14</discovery>
 <entry>2004-12-23</entry>
 </dates>
 </vuln>

<vuln vid="e3e266e9-5473-11d9-a9e7-0001020eed82">
 <topic>xpdf -- buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>xpdf</name>
	<range><lt>3.00_5</lt></range>
 </package>
 <package>
	<name>kdegraphics</name>
	<range><lt>3.3.2_1</lt></range>
 </package>
 <package>
	<name>gpdf</name>
	<range><le>2.8.1</le></range>
 </package>
 <package>
	<name>teTeX-base</name>
	<range><le>2.0.2_6</le></range>
 </package>
 <package>
	<name>cups-base</name>
	<range><le>1.1.22.0</le></range>
 </package>
 <package>
	<name>koffice</name>
	<range><le>1.3.5,1</le></range>
 </package>
 <package>
	<name>pdftohtml</name>
	<range><lt>0.36_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An iDEFENSE Security Advisory reports:
	<blockquote cite="http://www.idefense.com/application/poi/display?id=172&amp;type=vulnerabilities">
	 Remote exploitation of a buffer overflow vulnerability in
	 the xpdf PDF viewer, as included in multiple Linux
	 distributions, could allow attackers to execute arbitrary
	 code as the user viewing a PDF file. The offending code
	 can be found in the Gfx::doImage() function in the source
	 file xpdf/Gfx.cc.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1125</cvename>
 <url>http://www.idefense.com/application/poi/display?id=172&amp;type=vulnerabilities</url>
 </references>
 <dates>
 <discovery>2004-11-23</discovery>
 <entry>2004-12-23</entry>
 <modified>2005-01-13</modified>
 </dates>
 </vuln>

<vuln vid="28e93883-539f-11d9-a9e7-0001020eed82">
 <topic>acroread5 -- mailListIsPdf() buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>acroread</name>
	<name>acroread4</name>
	<name>acroread5</name>
	<range><lt>5.10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An iDEFENSE Security Advisory reports:
	<blockquote cite="http://www.idefense.com/application/poi/display?id=161&amp;type=vulnerabilities">
	 Remote exploitation of a buffer overflow in version 5.09
	 of Adobe Acrobat Reader for Unix could allow for execution
	 of arbitrary code.
	 The vulnerability specifically exists in a the function
	 mailListIsPdf(). This function checks if the input file
	 is an email message containing a PDF. It unsafely copies
	 user supplied data using strcat into a fixed sized
	 buffer.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1152</cvename>
 <certvu>253024</certvu>
 <url>http://www.adobe.com/support/techdocs/331153.html</url>
 <url>http://www.idefense.com/application/poi/display?id=161&amp;type=vulnerabilities</url>
 </references>
 <dates>
 <discovery>2004-10-14</discovery>
 <entry>2004-12-21</entry>
 <modified>2005-01-06</modified>
 </dates>
 </vuln>

<vuln vid="be543d74-539a-11d9-a9e7-0001020eed82">
 <topic>ecartis -- unauthorised access to admin interface</topic>
 <affects>
 <package>
	<name>ecartis</name>
	<range><lt>1.0.0.s20031228_2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Debian security advisory reports:
	<blockquote cite="http://www.debian.org/security/2004/dsa-572">
	 A problem has been discovered in ecartis, a mailing-list
	 manager, which allows an attacker in the same domain as
	 the list admin to gain administrator privileges and alter
	 list settings.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0913</cvename>
 <url>http://www.debian.org/security/2004/dsa-572</url>
 <url>http://secunia.com/advisories/12918/</url>
 </references>
 <dates>
 <discovery>2004-10-12</discovery>
 <entry>2004-12-21</entry>
 </dates>
 </vuln>

<vuln vid="85d76f02-5380-11d9-a9e7-0001020eed82">
 <topic>mplayer -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mplayer</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.5_5</lt></range>
 </package>
 <package>
	<name>libxine</name>
	<range><le>1.0.r5_3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	iDEFENSE and the MPlayer Team have found multiple
	 vulnerabilities in MPlayer:
	<ul>
	 <li>Potential heap overflow in Real RTSP streaming code</li>
	 <li>Potential stack overflow in MMST streaming code</li>
	 <li>Multiple buffer overflows in BMP demuxer</li>
	 <li>Potential heap overflow in pnm streaming code</li>
	 <li>Potential buffer overflow in mp3lib</li>
	</ul>
	These vulnerabilities could allow a remote attacker to
	 execute arbitrary code as the user running MPlayer. The
	 problem in the pnm streaming code also affects xine.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1187</cvename>
 <cvename>CVE-2004-1188</cvename>
 <url>http://mplayerhq.hu/homepage/design7/news.html#mplayer10pre5try2</url>
 <mlist msgid="IDSERV04yz5b6KZmcK80000000c@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110322526210300</mlist>
 <url>http://www.idefense.com/application/poi/display?id=166</url>
 <mlist msgid="IDSERV04FVjCRGryWtI0000000f@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110322829807443</mlist>
 <url>http://www.idefense.com/application/poi/display?id=167</url>
 <mlist msgid="IDSERV046beUzmRf6Ci00000012@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110323022605345</mlist>
 <url>http://www.idefense.com/application/poi/display?id=168</url>
 <url>http://xinehq.de/index.php/security/XSA-2004-6</url>
 </references>
 <dates>
 <discovery>2004-12-10</discovery>
 <entry>2004-12-21</entry>
 <modified>2005-01-12</modified>
 </dates>
 </vuln>

<vuln vid="0bb7677d-52f3-11d9-a9e7-0001020eed82">
 <topic>krb5 -- heap buffer overflow vulnerability in libkadm5srv</topic>
 <affects>
 <package>
	<name>krb5</name>
	<name>krb5-beta</name>
	<range><lt>1.3.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A MIT krb5 Security Advisory reports:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt">
	 The MIT Kerberos 5 administration library (libkadm5srv)
	 contains a heap buffer overflow in password history
	 handling code which could be exploited to execute
	 arbitrary code on a Key Distribution Center (KDC)
	 host. The overflow occurs during a password change of a
	 principal with a certain password history state. An
	 administrator must have performed a certain password
	 policy change in order to create the vulnerable state.
	 An authenticated user, not necessarily one with
	 administrative privileges, could execute arbitrary code on
	 the KDC host, compromising an entire Kerberos realm.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1189</cvename>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt</url>
 </references>
 <dates>
 <discovery>2004-12-06</discovery>
 <entry>2004-12-21</entry>
 </dates>
 </vuln>

<vuln vid="3b3676be-52e1-11d9-a9e7-0001020eed82">
 <topic>samba -- integer overflow vulnerability</topic>
 <affects>
 <package>
	<name>samba</name>
	<range><lt>3.0.10</lt></range>
	<range><gt>*,1</gt><lt>3.0.10,1</lt></range>
 </package>
 <package>
	<name>ja-samba</name>
	<range><lt>2.2.12.j1.0beta1_2</lt></range>
	<range><gt>3.*</gt><lt>3.0.10</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.10,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Greg MacManus, iDEFENSE Labs reports:
	<blockquote cite="http://www.samba.org/samba/security/CAN-2004-1154.html">
	 Remote exploitation of an integer overflow vulnerability
	 in the smbd daemon included in Samba 2.0.x, Samba 2.2.x,
	 and Samba 3.0.x prior to and including 3.0.9 could allow
	 an attacker to cause controllable heap corruption, leading
	 to execution of arbitrary commands with root
	 privileges.
	 Successful remote exploitation allows an attacker to gain
	 root privileges on a vulnerable system. In order to
	 exploit this vulnerability an attacker must possess
	 credentials that allow access to a share on the Samba
	 server. Unsuccessful exploitation attempts will cause the
	 process serving the request to crash with signal 11, and
	 may leave evidence of an attack in logs.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1154</cvename>
 <url>http://www.idefense.com/application/poi/display?id=165&amp;type=vulnerabilities</url>
 <url>http://www.samba.org/samba/security/CAN-2004-1154.html</url>
 </references>
 <dates>
 <discovery>2004-12-02</discovery>
 <entry>2004-12-21</entry>
 <modified>2008-09-26</modified>
 </dates>
 </vuln>

<vuln vid="d47e9d19-5016-11d9-9b5f-0050569f0001">
 <topic>php -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>mod_php4-twig</name>
	<name>php4-cgi</name>
	<name>php4-cli</name>
	<name>php4-dtc</name>
	<name>php4-horde</name>
	<name>php4-nms</name>
	<name>php4</name>
	<range><lt>4.3.10</lt></range>
 </package>
 <package>
	<name>mod_php</name>
	<name>mod_php4</name>
	<range><ge>4</ge><lt>4.3.10,1</lt></range>
 </package>
 <package>
	<name>php5</name>
	<name>php5-cgi</name>
	<name>php5-cli</name>
	<range><lt>5.0.3</lt></range>
 </package>
 <package>
	<name>mod_php5</name>
	<range><lt>5.0.3,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Secunia reports:
	<blockquote cite="http://secunia.com/advisories/13481/">
	 Multiple vulnerabilities have been reported in PHP,
	 which can be exploited to gain escalated privileges,
	 bypass certain security restrictions, gain knowledge
	 of sensitive information, or compromise a vulnerable
	 system.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://secunia.com/advisories/13481/</url>
 <cvename>CVE-2004-1019</cvename>
 <cvename>CVE-2004-1065</cvename>
 <url>http://www.php.net/release_4_3_10.php</url>
 <url>http://www.hardened-php.net/advisories/012004.txt</url>
 </references>
 <dates>
 <discovery>2004-12-16</discovery>
 <entry>2004-12-17</entry>
 <modified>2004-12-18</modified>
 </dates>
 </vuln>

<vuln vid="01c231cd-4393-11d9-8bb9-00065be4b5b6">
 <topic>mysql -- GRANT access restriction problem</topic>
 <affects>
 <package>
	 <name>mysql-server</name>
	 <range><le>3.23.58_3</le></range>
	 <range><ge>4.*</ge><lt>4.0.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 When a user is granted access to a database with a name containing
	 an underscore and the underscore is not escaped then that user might
	 also be able to access other, similarly named, databases on the
	 affected system.
	 The problem is that the underscore is seen as a wildcard by MySQL
	 and therefore it is possible that an admin might accidently GRANT a
	 user access to multiple databases.
 </body>
 </description>
 <references>
	<cvename>CVE-2004-0957</cvename>
	<bid>11435</bid>
	<url>http://bugs.mysql.com/bug.php?id=3933</url>
	<url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
	<url>http://www.openpkg.org/security/OpenPKG-SA-2004.045-mysql.html</url>
 </references>
 <dates>
 <discovery>2004-03-29</discovery>
 <entry>2004-12-16</entry>
 <modified>2005-03-15</modified>
 </dates>
 </vuln>

<vuln vid="06a6b2cf-484b-11d9-813c-00065be4b5b6">
 <topic>mysql -- ALTER MERGE denial of service vulnerability</topic>
 <affects>
 <package>
	 <name>mysql-server</name>
	 <range><le>3.23.58_3</le></range>
	 <range><ge>4.*</ge><lt>4.0.21</lt></range>
	 <range><ge>4.1.*</ge><lt>4.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 Dean Ellis reported a denial of service vulnerability in the MySQL
	 server:
	 <blockquote cite="http://bugs.mysql.com/bug.php?id=4017">
	 Multiple threads ALTERing the same (or different) MERGE tables to
	 change the UNION eventually crash the server or hang the individual
	 threads.
	 </blockquote>
	 Note that a script demonstrating the problem is included in the
	 MySQL bug report. Attackers that have control of a MySQL account can
	 easily use a modified version of that script during an attack.
 </body>
 </description>
 <references>
	<cvename>CVE-2004-0837</cvename>
	<bid>11357</bid>
	<url>http://bugs.mysql.com/bug.php?id=2408</url>
	<url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
 </references>
 <dates>
 <discovery>2004-01-15</discovery>
 <entry>2004-12-16</entry>
 <modified>2005-03-15</modified>
 </dates>
 </vuln>

<vuln vid="29edd807-438d-11d9-8bb9-00065be4b5b6">
 <topic>mysql -- FTS request denial of service vulnerability</topic>
 <affects>
 <package>
	 <name>mysql-server</name>
	 <range><ge>4.*</ge><lt>4.0.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 A special crafted MySQL FTS request can cause the server to crash.
	 Malicious MySQL users can abuse this bug in a denial of service
	 attack against systems running an affected MySQL daemon.
	 Note that because this bug is related to the parsing of requests,
	 it may happen that this bug is triggered accidently by a user when he
	 or she makes a typo.
 </body>
 </description>
 <references>
 <url>http://bugs.mysql.com/bug.php?id=3870</url>
 <cvename>CVE-2004-0956</cvename>
 <bid>11432</bid>
 </references>
 <dates>
 <discovery>2004-03-23</discovery>
 <entry>2004-12-16</entry>
 </dates>
 </vuln>

<vuln vid="835256b8-46ed-11d9-8ce0-00065be4b5b6">
 <topic>mysql -- mysql_real_connect buffer overflow vulnerability</topic>
 <affects>
 <package>
	 <name>mysql-server</name>
	 <range><le>3.23.58_3</le></range>
	 <range><ge>4.*</ge><lt>4.0.21</lt></range>
 </package>
 <package>
	 <name>mysql-client</name>
	 <range><le>3.23.58_3</le></range>
	 <range><ge>4.*</ge><lt>4.0.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 The mysql_real_connect function doesn't properly handle DNS replies
	 by copying the IP address into a buffer without any length checking.
	 A specially crafted DNS reply may therefore be used to cause a buffer
	 overflow on affected systems.
	 Note that whether this issue can be exploitable depends on the
	 system library responsible for the gethostbyname function. The bug
	 finder, Lukasz Wojtow, explaines this with the following words:
	 <blockquote cite="http://bugs.mysql.com/bug.php?id=4017">
	 In glibc there is a limitation for an IP address to have only 4
	 bytes (obviously), but generally speaking the length of the address
	 comes with a response for dns query (i know it sounds funny but
	 read rfc1035 if you don't believe). This bug can occur on libraries
	 where gethostbyname function takes length from dns's response
	 </blockquote>
 </body>
 </description>
 <references>
	<cvename>CVE-2004-0836</cvename>
	<bid>10981</bid>
	<url>http://bugs.mysql.com/bug.php?id=4017</url>
	<url>http://lists.mysql.com/internals/14726</url>
	<url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
	<url>http://www.osvdb.org/displayvuln.php?osvdb_id=10658</url>
 </references>
 <dates>
 <discovery>2004-06-04</discovery>
 <entry>2004-12-16</entry>
 <modified>2005-03-15</modified>
 </dates>
 </vuln>

<vuln vid="035d17b2-484a-11d9-813c-00065be4b5b6">
 <topic>mysql -- erroneous access restrictions applied to table renames</topic>
 <affects>
 <package>
	 <name>mysql-server</name>
	 <range><le>3.23.58_3</le></range>
	 <range><ge>4.*</ge><lt>4.0.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Red Hat advisory reports:
	<blockquote cite="http://rhn.redhat.com/errata/RHSA-2004-611.html">
	 Oleksandr Byelkin discovered that "ALTER TABLE ... RENAME" checked
	 the CREATE/INSERT rights of the old table instead of the new
	 one.
	</blockquote>
	Table access restrictions, on the affected MySQL servers, may
	 accidently or intentially be bypassed due to this bug.
 </body>
 </description>
 <references>
	<cvename>CVE-2004-0835</cvename>
	<bid>11357</bid>
	<url>http://bugs.mysql.com/bug.php?id=3270</url>
	<url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
	<url>http://xforce.iss.net/xforce/xfdb/17666</url>
 </references>
 <dates>
 <discovery>2004-03-23</discovery>
 <entry>2004-12-16</entry>
 <modified>2005-03-15</modified>
 </dates>
 </vuln>

<vuln vid="0ff0e9a6-4ee0-11d9-a9e7-0001020eed82">
 <topic>phpmyadmin -- command execution vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><ge>2.6.0.2</ge><lt>2.6.1.r1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A phpMyAdmin security announcement reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4">
	 Command execution: since phpMyAdmin 2.6.0-pl2, on a
	 system where external MIME-based transformations are
	 activated, an attacker can put into MySQL data an
	 offensive value that starts a shell command when
	 browsed.
	</blockquote>
	Enabling <q>PHP safe mode</q> on the server can be used as
	 a workaround for this vulnerability.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1147</cvename>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4</url>
 <url>http://www.exaprobe.com/labs/advisories/esa-2004-1213.html</url>
 </references>
 <dates>
 <discovery>2004-12-13</discovery>
 <entry>2004-12-15</entry>
 <modified>2004-12-19</modified>
 </dates>
 </vuln>

<vuln vid="9f0a405e-4edd-11d9-a9e7-0001020eed82">
 <topic>phpmyadmin -- file disclosure vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.6.1.r1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A phpMyAdmin security announcement reports:
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4">
	 File disclosure: on systems where the UploadDir mecanism
	 is active, read_dump.php can be called with a crafted
	 form; using the fact that the sql_localfile variable is
	 not sanitized can lead to a file disclosure.
	</blockquote>
	Enabling <q>PHP safe mode</q> on the server can be used as
	 a workaround for this vulnerability.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1148</cvename>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4</url>
 <url>http://www.exaprobe.com/labs/advisories/esa-2004-1213.html</url>
 </references>
 <dates>
 <discovery>2004-12-13</discovery>
 <entry>2004-12-15</entry>
 <modified>2004-12-19</modified>
 </dates>
 </vuln>

<vuln vid="06f142ff-4df3-11d9-a9e7-0001020eed82">
 <topic>wget -- multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>wget</name>
	<name>wget-devel</name>
	<range><lt>1.10.a1</lt></range>
 </package>
 <package>
	<name>wgetpro</name>
	<name>wget+ipv6</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jan Minar reports that there exists multiple
	 vulnerabilities in wget:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110269474112384">
	 Wget erroneously thinks that the current directory is a
	 fair game, and will happily write in any file in and below
	 it. Malicious HTTP response or malicious HTML file can
	 redirect wget to a file that is vital to the system, and
	 wget will create/append/overwrite it.
	 Wget apparently has at least two methods of
	 ``sanitizing'' the potentially malicious data it receives
	 from the HTTP stream, therefore a malicious redirects can
	 pass the check. We haven't find a way to trick wget into
	 writing above the parent directory, which doesn't mean
	 it's not possible.
	 Malicious HTTP response can overwrite parts of the
	 terminal so that the user will not notice anything wrong,
	 or will believe the error was not fatal.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1487</cvename>
 <cvename>CVE-2004-1488</cvename>
 <bid>11871</bid>
 <mlist msgid="20041209091438.GA15010@kontryhel.haltyr.dyndns.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110269474112384</mlist>
 <url>http://bugs.debian.org/261755</url>
 </references>
 <dates>
 <discovery>2004-12-09</discovery>
 <entry>2004-12-14</entry>
 <modified>2005-04-15</modified>
 </dates>
 </vuln>

<vuln vid="4593cb09-4c81-11d9-983e-000c6e8f12ef">
 <topic>konqueror -- Password Disclosure for SMB Shares</topic>
 <affects>
 <package>
	<name>kdebase</name>
	<name>kdelibs</name>
	<range><ge>3.2.0</ge><le>3.3.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	When browsing SMB shares with Konqueror, shares with
	 authentication show up with hidden password in the browser
	 bar.	It is possible to store the URL as a shortcut on the
	 desktop where the password is then available in plain text.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1171</cvename>
 <certvu>305294</certvu>
 <url>http://www.kde.org/info/security/advisory-20041209-1.txt</url>
 <mlist msgid="ICEEJPLEDKODPNFKJEGAIEBJGFAA.df@sec-consult.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110178786809694</mlist>
 </references>
 <dates>
 <discovery>2004-10-06</discovery>
 <entry>2004-12-12</entry>
 <modified>2005-01-13</modified>
 </dates>
 </vuln>

<vuln vid="af747389-42ba-11d9-bd37-00065be4b5b6">
 <topic>mod_access_referer -- null pointer dereference vulnerability</topic>
 <affects>
 <package>
	<name>mod_access_referer</name>
	<range><lt>1.0.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A malformed <q>Referer</q> header field causes the Apache
	 ap_parse_uri_components function to discard it with the
	 result that a pointer is not initialized. The
	 mod_access_referer module does not take this into account
	 with the result that it may use such a pointer.
	The null pointer vulnerability may possibly be used in a
	 remote denial of service attack against affected Apache
	 servers.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-1054</cvename>
 <bid>7375</bid>
 <url>http://secunia.com/advisories/8612/</url>
 <mlist>http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=105053485515811</mlist>
 </references>
 <dates>
 <discovery>2003-04-16</discovery>
 <entry>2004-12-11</entry>
 <modified>2005-01-19</modified>
 </dates>
 </vuln>

<vuln vid="f0db930b-496b-11d9-bf86-0050569f0001">
 <topic>squid -- possible information disclosure</topic>
 <affects>
	<package>
	 <name>squid</name>
	 <range><lt>2.5.7_4</lt></range>
	</package>
 </affects>
 <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	 The squid-2.5 patches pages notes:
	 <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-dothost">
	 In certain conditions Squid returns random data as error messages
	 in response to malformed host name, possibly leaking random
	 internal information which may come from other requests.
	 </blockquote>
	</body>
 </description>
 <references>
	<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-dothost</url>
 </references>
 <dates>
	<discovery>2004-11-23</discovery>
	<entry>2004-12-09</entry>
 </dates>
 </vuln>

<vuln vid="323784cf-48a6-11d9-a9e7-0001020eed82">
 <topic>viewcvs -- information leakage</topic>
 <affects>
 <package>
	<name>viewcvs</name>
	<range><lt>0.9.2_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The <code>hide_cvsroot</code> and <code>forbidden</code>
	 configuration options are not properly honored by viewcvs
	 when exporting to a tar file which can lead to information
	 leakage.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0915</cvename>
 <bid>11819</bid>
 </references>
 <dates>
 <discovery>2004-11-25</discovery>
 <entry>2004-12-08</entry>
 <modified>2004-12-12</modified>
 </dates>
 </vuln>

<vuln vid="a7bfd423-484f-11d9-a9e7-0001020eed82">
 <topic>cscope -- symlink attack vulnerability</topic>
 <affects>
 <package>
	<name>cscope</name>
	<range><lt>15.5_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cscope is vulnerable to a symlink attack which could lead
	 to an attacker overwriting arbitrary files with the
	 permissions of the user running cscope.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0996</cvename>
 <bid>11697</bid>
 <mlist msgid="20041124025903.9337.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110133485519690</mlist>
 <mlist msgid="20041118012718.78b07d79.research@rexotec.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110072752707293</mlist>
 <url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1062807&amp;group_id=4664&amp;atid=104664</url>
 </references>
 <dates>
 <discovery>2003-04-03</discovery>
 <entry>2004-12-07</entry>
 </dates>
 </vuln>

<vuln vid="9be819c6-4633-11d9-a9e7-0001020eed82">
 <topic>bnc -- remotely exploitable buffer overflow in getnickuserhost</topic>
 <affects>
 <package>
	<name>bnc</name>
	<range><lt>2.9.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A LSS Security Advisory reports:
	<blockquote cite="http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2004-11-03">
	 There is a buffer overflow vulnerability in
	 getnickuserhost() function that is called when BNC is
	 processing response from IRC server.
	 Vulnerability can be exploited if attacker tricks user to
	 connect to his fake IRC server that will exploit this
	 vulnerability. If the attacker has access to BNC proxy
	 server, this vulnerability can be used to gain shell
	 access on machine where BNC proxy server is set.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1052</cvename>
 <mlist msgid="20041110131046.GA21604@cecilija.zesoi.fer.hr">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110011817627839</mlist>
 <url>http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2004-11-03</url>
 <url>http://www.gotbnc.com/changes.html</url>
 </references>
 <dates>
 <discovery>2004-11-10</discovery>
 <entry>2004-12-04</entry>
 <modified>2005-02-22</modified>
 </dates>
 </vuln>

<vuln vid="f11b219a-44b6-11d9-ae2f-021106004fd6">
 <topic>rssh &amp; scponly -- arbitrary command execution</topic>
 <affects>
 <package>
	<name>rssh</name>
	<range><le>2.2.2</le></range>
 </package>
 <package>
	<name>scponly</name>
	<range><lt>4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jason Wies identified both rssh &amp; scponly have a vulnerability
	 that allows arbitrary command execution. He reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110202047507273">
	 The problem is compounded when you recognize that the main use of
	 rssh and scponly is to allow file transfers, which in turn allows a
	 malicious user to transfer and execute entire custom scripts on the
	 remote machine.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>11791</bid>
 <bid>11792</bid>
 <freebsdpr>ports/74633</freebsdpr>
 <mlist msgid="20041202135143.GA7105@xc.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110202047507273</mlist>
 </references>
 <dates>
 <discovery>2004-11-28</discovery>
 <entry>2004-12-02</entry>
 <modified>2004-12-12</modified>
 </dates>
 </vuln>

<vuln vid="2b4d5288-447e-11d9-9ebb-000854d03344">
 <topic>rockdodger -- buffer overflows</topic>
 <affects>
 <package>
	<name>rockdodger</name>
	<range><lt>0.6_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The environment variable HOME is copied without regard
	 to buffer size, which can be used to gain elevated privilege
	 if the binary is installed setgid games, and a string is
	 read from the high score file without bounds check.
	The port installs the binary without setgid, but with a
	 world-writable high score file.
 </body>
 </description>
 <references>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278878</url>
 </references>
 <dates>
 <discovery>2004-10-29</discovery>
 <entry>2004-12-02</entry>
 </dates>
 </vuln>

<vuln vid="40549bbf-43b5-11d9-a9e7-0001020eed82">
 <topic>zip -- long path buffer overflow</topic>
 <affects>
 <package>
	<name>zip</name>
	<range><lt>2.3_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A HexView security advisory reports:
	<blockquote cite="http://www.hexview.com/docs/20041103-1.txt">
	 When zip performs recursive folder compression, it does
	 not check for the length of resulting path. If the path is
	 too long, a buffer overflow occurs leading to stack
	 corruption and segmentation fault.	It is possible to
	 exploit this vulnerability by embedding a shellcode in
	 directory or file name. While the issue is not of primary
	 concern for regular users, it can be critical for
	 environments where zip archives are re-compressed
	 automatically using Info-Zip application.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1010</cvename>
 <bid>11603</bid>
 <url>http://www.hexview.com/docs/20041103-1.txt</url>
 </references>
 <dates>
 <discovery>2004-10-03</discovery>
 <entry>2004-12-01</entry>
 <modified>2004-12-12</modified>
 </dates>
 </vuln>

<vuln vid="85edfb6a-43a5-11d9-a9e7-0001020eed82">
 <topic>sudoscript -- signal delivery vulnerability</topic>
 <affects>
 <package>
	<name>sudoscript</name>
	<range><lt>2.1.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	If non-root access is enabled in sudoscript, any member of
	 the ssers group can send a SIGHUP signal to any process.
 </body>
 </description>
 <references>
 <url>http://egbok.com/sudoscript/archives/2004/11/sudoscript_212.html</url>
 </references>
 <dates>
 <discovery>2004-11-14</discovery>
 <entry>2004-12-01</entry>
 </dates>
 </vuln>

<vuln vid="553224e7-4325-11d9-a3d5-000c6e8f12ef">
 <topic>jabberd -- remote buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>jabberd</name>
	<range><ge>2.*</ge><le>2.0.4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Caused by improper bounds-checking of username
	 and password in the C2S module, it is possible
	 for an attacker to cause a remote buffer overflow.
	 The server directly handles the userinput with
	 SQL backend functions - malicious input may lead
	 to buffer overflow.
 </body>
 </description>
 <references>
 <mlist msgid="41A3FEE1.5030701@0x557.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110144303826709</mlist>
 </references>
 <dates>
 <discovery>2004-11-24</discovery>
 <entry>2004-11-30</entry>
 </dates>
 </vuln>

<vuln vid="cdf14b68-3ff9-11d9-8405-00065be4b5b6">
 <topic>Open DC Hub -- remote buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>opendchub</name>
	<range><lt>0.7.14_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Donato Ferrante reported an exploitable buffer overflow in
	 this software package. Any user that can login with 'admin'
	 privileges can abuse it, trough the $RedirectAll command,
	 to execute arbitrary code.
 </body>
 </description>
 <references>
 <mlist msgid="20041124155429.893852455E@chernobyl.investici.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110144606411674</mlist>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200411-37.xml</url>
 </references>
 <dates>
 <discovery>2004-11-24</discovery>
 <entry>2004-11-27</entry>
 <modified>2005-02-13</modified>
 </dates>
 </vuln>

<vuln vid="a163baff-3fe1-11d9-a9e7-0001020eed82">
 <topic>unarj -- long filename buffer overflow</topic>
 <affects>
 <package>
	<name>unarj</name>
	<range><lt>2.43_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ludwig Nussel has discovered a buffer overflow
	 vulnerability in unarj's handling of long filenames which
	 could potentially lead to execution of arbitrary code with
	 the permissions of the user running unarj.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0947</cvename>
 <bid>11665</bid>
 </references>
 <dates>
 <discovery>2004-11-09</discovery>
 <entry>2004-11-26</entry>
 </dates>
 </vuln>

<vuln vid="1f922de0-3fe5-11d9-a9e7-0001020eed82">
 <topic>unarj -- directory traversal vulnerability</topic>
 <affects>
 <package>
	<name>unarj</name>
	<range><lt>2.43_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	unarj has insufficient checks for filenames that contain
	 <q>..</q>. This can allow an attacker to overwrite
	 arbitrary files with the permissions of the user running
	 unarj.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1027</cvename>
 <bid>11436</bid>
 <mlist msgid="200410102243.i9AMhA9F083398@mailserver2.hushmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109748984030292</mlist>
 </references>
 <dates>
 <discovery>2004-10-10</discovery>
 <entry>2004-11-26</entry>
 </dates>
 </vuln>

<vuln vid="ac619d06-3ef8-11d9-8741-c942c075aa41">
 <topic>jdk/jre -- Security Vulnerability With Java Plugin</topic>
 <affects>
 <package>
	<name>jdk</name>
	<range><ge>1.4.0</ge><le>1.4.2p6_6</le></range>
	<range><ge>1.3.0</ge><le>1.3.1p9_5</le></range>
 </package>
 <package>
	<name>linux-jdk</name>
	<name>linux-sun-jdk</name>
	<range><ge>1.4.0</ge><le>1.4.2.05</le></range>
	<range><ge>1.3.0</ge><le>1.3.1.13</le></range>
 </package>
 <package>
	<name>linux-blackdown-jdk</name>
	<range><ge>1.3.0</ge><le>1.4.2</le></range>
 </package>
 <package>
	<name>linux-ibm-jdk</name>
	<range><ge>1.3.0</ge><le>1.4.2</le></range>
 </package>
 <package>
	<name>diablo-jdk</name>
	<name>diablo-jre</name>
	<range><ge>1.3.1.0</ge><le>1.3.1.0_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Sun Java Plugin capability in Java 2 Runtime Environment
	 (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does
	 not properly restrict access between Javascript and Java
	 applets during data transfer, which allows remote attackers to
	 load unsafe classes and execute arbitrary code.
 </body>
 </description>
 <references>
 <url>http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1&amp;searchclause=%22category:security%22%20%22availability,%20security%22</url>
 <url>http://www.securityfocus.com/archive/1/382072</url>
 <cvename>CVE-2004-1029</cvename>
 <mlist msgid="20041123070248.GA25385@jouko.iki.fi">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110125046627909</mlist>
 </references>
 <dates>
 <discovery>2004-11-24</discovery>
 <entry>2004-11-25</entry>
 <modified>2005-04-27</modified>
 </dates>
 </vuln>

<vuln vid="1a32e8ee-3edb-11d9-8699-00065be4b5b6">
 <topic>ProZilla -- server response buffer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>prozilla</name>
	<range><le>1.3.6_3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Buffer overflow vulnerabilities have been reported to exist
	 in this software package. The vulnerabilities can be triggered by
	 a remote server and can be used to inject malicious code in the
	 ProZilla process.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1120</cvename>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200411-31.xml</url>
 <url>http://bugs.gentoo.org/show_bug.cgi?id=70090</url>
 <mlist msgid="41A411E0.2010907@gmx.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110136626320497</mlist>
 </references>
 <dates>
 <discovery>2004-11-23</discovery>
 <entry>2004-11-25</entry>
 <modified>2005-10-01</modified>
 </dates>
 </vuln>

<vuln vid="31952117-3d17-11d9-8818-008088034841">
 <topic>Cyrus IMAPd -- APPEND command uses undefined programming construct</topic>
 <affects>
 <package>
	<name>cyrus-imapd</name>
	<range><ge>2.2.7</ge><le>2.2.8</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	To support MULTIAPPENDS the cmd_append handler uses the
	 global stage array. This array is one of the things that gets
	 destructed when the fatal() function is triggered. When the
	 Cyrus IMAP code adds new entries to this array this is done
	 with the help of the postfix increment operator in combination
	 with memory allocation functions. The increment is performed
	 on a global variable counting the number of allocated
	 stages. Because the memory allocation function can fail and
	 therefore internally call fatal() this construct is undefined
	 arcording to ANSI C. This means that it is not clearly defined
	 if the numstage counter is already increased when fatal() is
	 called or not. While older gcc versions increase the counter
	 after the memory allocation function has returned, on newer
	 gcc versions (3.x) the counter gets actually increased
	 before. In such a case the stage destructing process will try
	 to free an uninitialised and maybe attacker supplied
	 pointer. Which again could lead to remote code
	 execution. (Because it is hard for an attacker to let the
	 memory allocation functions fail in the right moment no PoC
	 code for this problem was designed)
 </body>
 </description>
 <references>
 <url>http://security.e-matters.de/advisories/152004.html</url>
 </references>
 <dates>
 <discovery>2004-11-06</discovery>
 <entry>2004-11-22</entry>
 </dates>
 </vuln>

<vuln vid="c0a269d5-3d16-11d9-8818-008088034841">
 <topic>Cyrus IMAPd -- FETCH command out of bounds memory corruption</topic>
 <affects>
 <package>
	<name>cyrus-imapd</name>
	<range><lt>2.1.17</lt></range>
	<range><ge>2.2.*</ge><le>2.2.8</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The argument parser of the fetch command suffers a bug very
	 similiar to the partial command problem. Arguments like
	 "body[p", "binary[p" or "binary[p" will be wrongly detected
	 and the bufferposition can point outside of the allocated
	 buffer for the rest of the parsing process. When the parser
	 triggers the PARSE_PARTIAL macro after such a malformed
	 argument was received this can lead to a similiar one byte
	 memory corruption and allows remote code execution, when the
	 heap layout was successfully controlled by the attacker.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1013</cvename>
 <url>http://security.e-matters.de/advisories/152004.html</url>
 </references>
 <dates>
 <discovery>2004-11-06</discovery>
 <entry>2004-11-22</entry>
 <modified>2004-11-24</modified>
 </dates>
 </vuln>

<vuln vid="114d70f3-3d16-11d9-8818-008088034841">
 <topic>Cyrus IMAPd -- PARTIAL command out of bounds memory corruption</topic>
 <affects>
 <package>
	<name>cyrus-imapd</name>
	<range><lt>2.1.17</lt></range>
	<range><ge>2.2.*</ge><le>2.2.6</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Due to a bug within the argument parser of the partial
	 command an argument like "body[p" will be wrongly detected as
	 "body.peek". Because of this the bufferposition gets increased
	 by 10 instead of 5 and could therefore point outside the
	 allocated memory buffer for the rest of the parsing
	 process. In imapd versions prior to 2.2.7 the handling of
	 "body" or "bodypeek" arguments was broken so that the
	 terminating ']' got overwritten by a '\0'. Combined the two
	 problems allow a potential attacker to overwrite a single byte
	 of malloc() control structures, which leads to remote code
	 execution if the attacker successfully controls the heap
	 layout.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1012</cvename>
 <url>http://security.e-matters.de/advisories/152004.html</url>
 </references>
 <dates>
 <discovery>2004-11-06</discovery>
 <entry>2004-11-22</entry>
 <modified>2004-11-24</modified>
 </dates>
 </vuln>

<vuln vid="816fdd8b-3d14-11d9-8818-008088034841">
 <topic>Cyrus IMAPd -- IMAPMAGICPLUS preauthentification overflow</topic>
 <affects>
 <package>
	<name>cyrus-imapd</name>
	<range><ge>2.2.4</ge><le>2.2.8</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	When the option imapmagicplus is activated on a server the
	 PROXY and LOGIN commands suffer a standard stack overflow,
	 because the username is not checked against a maximum length
	 when it is copied into a temporary stack buffer. This bug is
	 especially dangerous because it can be triggered before any
	 kind of authentification took place.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1011</cvename>
 <url>http://security.e-matters.de/advisories/152004.html</url>
 </references>
 <dates>
 <discovery>2004-11-06</discovery>
 <entry>2004-11-22</entry>
 </dates>
 </vuln>

<vuln vid="6a33477e-3a9c-11d9-84ad-000c6e8f12ef">
 <topic>phpMyAdmin -- cross-site scripting vulnerabilities</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><le>2.6.0.2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple cross-site scripting vulnerabilities, caused
	 by improper input parameter sanitizing, were
	 detected in phpMyAdmin, which may enable an attacker
	 to do cross-site scripting attacks.
 </body>
 </description>
 <references>
 <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3</url>
 </references>
 <dates>
 <discovery>2004-11-18</discovery>
 <entry>2004-11-20</entry>
 </dates>
 </vuln>

<vuln vid="759b8dfe-3972-11d9-a9e7-0001020eed82">
 <topic>Overflow error in fetch</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.3</ge><lt>5.3_1</lt></range>
	<range><ge>5.2.1</ge><lt>5.2.1_12</lt></range>
	<range><ge>5.1</ge><lt>5.1_18</lt></range>
	<range><ge>5.0</ge><lt>5.0_22</lt></range>
	<range><ge>4.10</ge><lt>4.10_4</lt></range>
	<range><ge>4.9</ge><lt>4.9_13</lt></range>
	<range><ge>4.8</ge><lt>4.8_26</lt></range>
	<range><lt>4.7_28</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An integer overflow condition in <a href="http://www.freebsd.org/cgi/man.cgi?query=fetch">fetch(1)</a>
	 in the processing of HTTP headers can result in a buffer
	 overflow.
	A malicious server or CGI script can respond to an HTTP or
	 HTTPS request in such a manner as to cause arbitrary
	 portions of the client's memory to be overwritten, allowing
	 for arbitrary code execution.
 </body>
 </description>
 <references>
 <freebsdsa>SA-04:16.fetch</freebsdsa>
 <cvename>CVE-2004-1053</cvename>
 <bid>11702</bid>
 </references>
 <dates>
 <discovery>2004-11-14</discovery>
 <entry>2004-11-18</entry>
 </dates>
 </vuln>

<vuln vid="f3d3f621-38d8-11d9-8fff-000c6e8f12ef">
 <topic>smbd -- buffer-overrun vulnerability</topic>
 <affects>
 <package>
	<name>samba</name>
	<range><ge>3.*</ge><lt>3.0.8</lt></range>
	<range><ge>3.*,1</ge><lt>3.0.8,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Caused by improper bounds checking of certain trans2
	 requests, there is a possible buffer overrun in smbd.
	 The attacker needs to be able to create files with
	 very specific Unicode filenames on the share to take
	 advantage of this issue.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0882</cvename>
 <bid>11678</bid>
 <mlist msgid="4198AE84.7020509@samba.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110055646329581</mlist>
 </references>
 <dates>
 <discovery>2004-11-15</discovery>
 <entry>2004-11-17</entry>
 <modified>2008-09-26</modified>
 </dates>
 </vuln>

<vuln vid="b4af3ede-36e9-11d9-a9e7-0001020eed82">
 <topic>twiki -- arbitrary shell command execution</topic>
 <affects>
 <package>
	<name>twiki</name>
	<range><lt>20040902</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Hans Ulrich Niedermann reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110037207516456">
	 The TWiki search function uses a user supplied search
	 string to compose a command line executed by the Perl
	 backtick (``) operator.
	 The search string is not checked properly for shell
	 metacharacters and is thus vulnerable to search string
	 containing quotes and shell commands.
	 IMPACT: An attacker is able to execute arbitrary shell
	 commands with the privileges of the TWiki process.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1037</cvename>
 <mlist msgid="86zn1mhchx.fsf@n-dimensional.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110037207516456</mlist>
 <url>http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch</url>
 </references>
 <dates>
 <discovery>2004-11-12</discovery>
 <entry>2004-11-15</entry>
 <modified>2004-11-23</modified>
 </dates>
 </vuln>

<vuln vid="50744596-368f-11d9-a9e7-0001020eed82">
 <topic>proxytunnel -- format string vulnerability</topic>
 <affects>
 <package>
	<name>proxytunnel</name>
	<range><lt>1.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Gentoo Linux Security Advisory reports:
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200411-07.xml">
	 Florian Schilhabel of the Gentoo Linux Security Audit
	 project found a format string vulnerability in
	 Proxytunnel. When the program is started in daemon mode
	 (-a [port]), it improperly logs invalid proxy answers to
	 syslog.
	 A malicious remote server could send specially-crafted
	 invalid answers to exploit the format string
	 vulnerability, potentially allowing the execution of
	 arbitrary code on the tunnelling host with the rights of
	 the Proxytunnel process.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0992</cvename>
 <url>http://proxytunnel.sourceforge.net/news.html</url>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200411-07.xml</url>
 </references>
 <dates>
 <discovery>2004-11-01</discovery>
 <entry>2004-11-15</entry>
 </dates>
 </vuln>

<vuln vid="bdd1537b-354c-11d9-a9e7-0001020eed82">
 <topic>sudo -- privilege escalation with bash scripts</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><lt>1.6.8.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Sudo Security Alerts reports:
	<blockquote cite="http://www.courtesan.com/sudo/alerts/bash_functions.html">
	 A flaw in exists in sudo's environment sanitizing prior
	 to sudo version 1.6.8p2 that could allow a malicious user
	 with permission to run a shell script that utilized the
	 bash shell to run arbitrary commands.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.courtesan.com/sudo/alerts/bash_functions.html</url>
 </references>
 <dates>
 <discovery>2004-11-11</discovery>
 <entry>2004-11-13</entry>
 </dates>
 </vuln>

<vuln vid="d656296b-33ff-11d9-a9e7-0001020eed82">
 <topic>ruby -- CGI DoS</topic>
 <affects>
 <package>
	<name>ruby</name>
	<name>ruby_r</name>
	<range><gt>1.7.*</gt><lt>1.8.2.p2_2</lt></range>
	<range><lt>1.6.8.2004.07.28_1</lt></range>
 </package>
 <package>
	<name>ruby-1.7.0</name>
	<range><ge>a2001.05.12</ge><le>a2001.05.26</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Ruby CGI.rb module contains a bug which can cause the
	 CGI module to go into an infinite loop, thereby causing a
	 denial-of-service situation on the web server by using all
	 available CPU time.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0983</cvename>
 <url>http://www.debian.org/security/2004/dsa-586</url>
 </references>
 <dates>
 <discovery>2004-11-06</discovery>
 <entry>2004-11-13</entry>
 <modified>2004-11-25</modified>
 </dates>
 </vuln>

<vuln vid="ba13dc13-340d-11d9-ac1b-000d614f7fad">
 <topic>samba -- potential remote DoS vulnerability</topic>
 <affects>
 <package>
	<name>samba</name>
	<range><gt>3.*</gt><lt>3.0.8</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.8,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
 Karol Wiesek at iDEFENSE reports:
	<blockquote cite="http://us4.samba.org/samba/security/CAN-2004-0930.html">
	 A remote attacker could cause an smbd process to consume
	 abnormal amounts of system resources due to an input
	 validation error when matching filenames containing
	 wildcard characters.
	</blockquote>
	Although samba.org classifies this as a DoS vulnerability,
	 several members of the security community believe it may be
	 exploitable for arbitrary code execution.
 </body>
 </description>
 <references>
 <freebsdpr>ports/73701</freebsdpr>
 <cvename>CVE-2004-0930</cvename>
 <url>http://us4.samba.org/samba/security/CAN-2004-0930.html</url>
 </references>
 <dates>
 <discovery>2004-09-30</discovery>
 <entry>2004-11-12</entry>
 <modified>2008-09-26</modified>
 </dates>
 </vuln>

<vuln vid="fc99c736-3499-11d9-98a7-0090962cff2a">
 <topic>gnats -- format string vulnerability</topic>
 <affects>
 <package>
	<name>gnats</name>
	<range><ge>4.*</ge><le>4.0_2</le></range>
	<range><le>3.113.1_9</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gnats suffers from a format string bug, which may enable an
	 attacker to execute arbitary code.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0623</cvename>
 <mlist msgid="20040625164231.7437.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108820000823191</mlist>
 </references>
 <dates>
 <discovery>2004-06-21</discovery>
 <entry>2004-11-12</entry>
 </dates>
 </vuln>

<vuln vid="7fbfe159-3438-11d9-a9e7-0001020eed82">
 <topic>squirrelmail -- cross site scripting vulnerability</topic>
 <affects>
 <package>
	<name>ja-squirrelmail</name>
	<range><lt>1.4.3a_4,2</lt></range>
 </package>
 <package>
	<name>squirrelmail</name>
	<range><lt>1.4.3a_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A SquirrelMail Security Notice reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110012133608004">
	 There is a cross site scripting issue in the decoding of
	 encoded text in certain headers. SquirrelMail correctly
	 decodes the specially crafted header, but doesn't sanitize
	 the decoded strings.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist msgid="544475695.20041110000451@netdork.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110012133608004</mlist>
 </references>
 <dates>
 <discovery>2004-11-03</discovery>
 <entry>2004-11-12</entry>
 </dates>
 </vuln>

<vuln vid="027380b7-3404-11d9-ac1b-000d614f7fad">
 <topic>hafiye -- lack of terminal escape sequence filtering</topic>
 <affects>
 <package>
	<name>hafiye</name>
	<range><lt>1.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A siyahsapka.org advisory reads:
	<blockquote cite="http://deicide.siyahsapka.org/hafiye_esc.txt">
	 Hafiye-1.0 doesnt filter the payload when printing it to
	 the terminal. A malicious attacker can send packets with
	 escape sequence payloads to exploit this vulnerability.
	 If Hafiye has been started with -n packet count option ,
	 the vulnerability could allow remote code execution. For
	 remote code execution the victim must press Enter after
	 program exit.
	</blockquote>
	Note that it appears that this bug can only be exploited in
	 conjunction with a terminal emulator that honors the
	 appropriate escape sequences.
 </body>
 </description>
 <references>
 <freebsdpr>ports/70978</freebsdpr>
 <url>http://deicide.siyahsapka.org/hafiye_esc.txt</url>
 <url>http://www.enderunix.org/hafiye/</url>
 </references>
 <dates>
 <discovery>2004-08-23</discovery>
 <entry>2004-11-11</entry>
 </dates>
 </vuln>

<vuln vid="e69ba632-326f-11d9-b5b7-000854d03344">
 <topic>ez-ipupdate -- format string vulnerability</topic>
 <affects>
 <package>
	 <name>ez-ipupdate</name>
	 <range><lt>3.0.11b8_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Data supplied by a remote server is used as the format string
	 instead of as parameters in a syslog() call.	This may lead
	 to crashes or potential running of arbitrary code. It is
	 only a problem when running in daemon mode (very common) and
	 when using some service types.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0980</cvename>
 <mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-November/028590.html</mlist>
 </references>
 <dates>
 <discovery>2004-11-11</discovery>
 <entry>2004-11-11</entry>
 </dates>
 </vuln>

<vuln vid="eeb1c128-33e7-11d9-a9e7-0001020eed82">
 <topic>ImageMagick -- EXIF parser buffer overflow</topic>
 <affects>
 <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	There exists a buffer overflow vulnerability in
	 ImageMagick's EXIF parsing code which may lead to execution
	 of arbitrary code.
 </body>
 </description>
 <references>
 <bid>11548</bid>
 <cvename>CVE-2004-0981</cvename>
 <url>http://secunia.com/advisories/12995/</url>
 <url>http://www.imagemagick.org/www/Changelog.html</url>
 </references>
 <dates>
 <discovery>2004-10-25</discovery>
 <entry>2004-11-11</entry>
 <modified>2004-12-12</modified>
 </dates>
 </vuln>

<vuln vid="282dfea0-3378-11d9-b404-000c6e8f12ef">
 <topic>apache2 multiple space header denial-of-service vulnerability</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><gt>2.*</gt><le>2.0.52_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	It is possible for remote attackers to cause a denial-of-service
	 scenario on Apache 2.0.52 and earlier by sending an HTTP GET
	 request with a MIME header containing multiple lines full of
	 whitespaces.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0942</cvename>
 <mlist msgid="a62f45480411010157571febcc.mail@gmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109930632317208</mlist>
 </references>
 <dates>
 <discovery>2004-11-01</discovery>
 <entry>2004-11-10</entry>
 <modified>2004-11-11</modified>
 </dates>
 </vuln>

<vuln vid="f3017ce1-32a4-11d9-a9e7-0001020eed82">
 <topic>socat -- format string vulnerability</topic>
 <affects>
 <package>
	<name>socat</name>
	<range><lt>1.4.0.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Socat Security Advisory 1 states:
	<blockquote cite="http://www.dest-unreach.org/socat/advisory/socat-adv-1.html">
	 socat up to version 1.4.0.2 contains a syslog() based
	 format string vulnerability. This issue was originally
	 reported by CoKi on 19 Oct.2004 <a href="http://www.nosystem.com.ar/advisories/advisory-07.txt">http://www.nosystem.com.ar/advisories/advisory-07.txt</a>.
	 Further investigation showed that this vulnerability could
	 under some circumstances lead to local or remote execution
	 of arbitrary code with the privileges of the socat
	 process.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.dest-unreach.org/socat/advisory/socat-adv-1.html</url>
 <url>http://www.nosystem.com.ar/advisories/advisory-07.txt</url>
 </references>
 <dates>
 <discovery>2004-10-18</discovery>
 <entry>2004-11-10</entry>
 </dates>
 </vuln>

<vuln vid="9ff4c91e-328c-11d9-a9e7-0001020eed82">
 <topic>libxml -- remote buffer overflows</topic>
 <affects>
 <package>
	<name>libxml</name>
	<range><lt>1.8.17_3</lt></range>
 </package>
 <package>
	<name>libxml2</name>
	<range><lt>2.6.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<q>infamous41md</q> reports that libxml contains multiple
	 buffer overflows in the URL parsing and DNS name resolving
	 functions. These vulnerabilities could lead to execution of
	 arbitrary code.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0989</cvename>
 <bid>11526</bid>
 <mlist msgid="20041025205132.1f1620a8.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109880813013482</mlist>
 <url>http://www.debian.org/security/2004/dsa-582</url>
 </references>
 <dates>
 <discovery>2004-10-26</discovery>
 <entry>2004-11-09</entry>
 <modified>2004-11-10</modified>
 </dates>
 </vuln>

<vuln vid="a5742055-300a-11d9-a9e7-0001020eed82">
 <topic>p5-Archive-Zip -- virus detection evasion</topic>
 <affects>
 <package>
	<name>p5-Archive-Zip</name>
	<range><lt>1.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An AMaViS Security Announcement reports that a
	 vulnerability exist in the Archive::Zip Perl module which
	 may lead to bypass of malicious code in anti-virus programs
	 by creating specially crafted ZIP files.
 </body>
 </description>
 <references>
 <url>http://www.idefense.com/application/poi/display?id=153&amp;type=vulnerabilities</url>
 <url>http://www.amavis.org/security/asa-2004-6.txt</url>
 <url>http://rt.cpan.org/NoAuth/Bug.html?id=8077</url>
 </references>
 <dates>
 <discovery>2004-10-18</discovery>
 <entry>2004-11-08</entry>
 </dates>
 </vuln>

<vuln vid="6e6a6b8a-2fde-11d9-b3a2-0050fc56d258">
 <topic>apache mod_include buffer overflow vulnerability</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><lt>1.3.33</lt></range>
 </package>
 <package>
	<name>apache+mod_ssl</name>
	<range><lt>1.3.32+2.8.21_1</lt></range>
 </package>
 <package>
	<name>apache+mod_ssl+ipv6</name>
	<range><lt>1.3.32+2.8.21_1</lt></range>
 </package>
 <package>
	<name>apache+mod_perl</name>
	<range><le>1.3.31</le></range>
 </package>
 <package>
	<name>apache+ipv6</name>
	<range><lt>1.3.33</lt></range>
 </package>
 <package>
	<name>apache+ssl</name>
	<range><le>1.3.29.1.55</le></range>
 </package>
 <package>
	<name>ru-apache</name>
	<range><lt>1.3.33+30.21</lt></range>
 </package>
 <package>
	<name>ru-apache+mod_ssl</name>
	<range><lt>1.3.33+30.21+2.8.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	There is a buffer overflow in a function used by mod_include
	 that may enable a local user to gain privileges of a httpd
	 child. Only users that are able to create SSI documents can
	 take advantage of that vulnerability.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0940</cvename>
 <url>http://www.securitylab.ru/48807.html</url>
 </references>
 <dates>
 <discovery>2004-10-22</discovery>
 <entry>2004-11-06</entry>
 </dates>
 </vuln>

<vuln vid="6a164d84-2f7f-11d9-a9e7-0001020eed82">
 <topic>postgresql-contrib -- insecure temporary file creation</topic>
 <affects>
 <package>
	<name>postgresql-contrib</name>
	<range><lt>7.2.6</lt></range>
	<range><gt>7.3.*</gt><lt>7.3.8</lt></range>
	<range><gt>7.4.*</gt><lt>7.4.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The make_oidjoins_check script in the PostgreSQL RDBMS has
	 insecure handling of temporary files, which could lead to an
	 attacker overwriting arbitrary files with the credentials of
	 the user running the make_oidjoins_check script.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0977</cvename>
 <bid>11295</bid>
 <url>http://www.postgresql.org/news/234.html</url>
 <url>http://www.trustix.net/errata/2004/0050/</url>
 </references>
 <dates>
 <discovery>2004-09-10</discovery>
 <entry>2004-11-06</entry>
 </dates>
 </vuln>

<vuln vid="62239968-2f2a-11d9-a9e7-0001020eed82">
 <topic>gd -- integer overflow</topic>
 <affects>
 <package>
	<name>gd</name>
	<name>uk-gd</name>
	<name>ja-gd</name>
	<range><lt>2.0.29,1</lt></range>
	<range><gt>1.*,2</gt><lt>2.*,2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	infamous41md reports about the GD Graphics Library:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109882489302099">
	 There is an integer overflow when allocating memory in
	 the routine that handles loading PNG image files. This
	 later leads to heap data structures being overwritten. If
	 an attacker tricked a user into loading a malicious PNG
	 image, they could leverage this into executing arbitrary
	 code in the context of the user opening image.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>11523</bid>
 <cvename>CVE-2004-0990</cvename>
 <mlist msgid="20041025204303.4341d907.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109882489302099</mlist>
 <url>http://www.boutell.com/gd/manual2.0.29.html#whatsnew2.0.29</url>
 </references>
 <dates>
 <discovery>2004-10-26</discovery>
 <entry>2004-11-05</entry>
 </dates>
 </vuln>

<vuln vid="19518d22-2d05-11d9-8943-0050fc56d258">
 <topic>putty -- buffer overflow vulnerability in ssh2 support</topic>
 <affects>
 <package>
	<name>putty</name>
	<range><lt>0.56</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	There is a bug in SSH2 support that allows a server to execute
	 malicious code on a connecting PuTTY client.
	 This attack can be performed before host key verification happens,
	 so a different machine -- man in the middle attack -- could fake
	 the machine you are connecting to.
 </body>
 </description>
 <references>
	<mlist msgid="1CE07882ECEE894CA2D5A89B8DEBC4010A2DD2@porgy.admin.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109890310929207</mlist>
	<url>http://www.gentoo.org/security/en/glsa/glsa-200410-29.xml</url>
	<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ssh2-debug.html</url>
 </references>
 <dates>
	<discovery>2004-10-26</discovery>
	<entry>2004-11-04</entry>
	<modified>2005-01-19</modified>
 </dates>
 </vuln>

<vuln vid="e0070221-2dd8-11d9-a9e7-0001020eed82">
 <topic>wzdftpd -- remote DoS</topic>
 <affects>
 <package>
	<name>wzdftpd</name>
	<range><lt>0.4.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	wzdftpd contains a potential remote Denial-of-Service.
 </body>
 </description>
 <references>
 <url>http://sourceforge.net/project/shownotes.php?release_id=263573</url>
 </references>
 <dates>
 <discovery>2004-10-28</discovery>
 <entry>2004-11-03</entry>
 </dates>
 </vuln>

<vuln vid="1f826757-26be-11d9-ad2d-0050fc56d258">
 <topic>rssh -- format string vulnerability</topic>
 <affects>
 <package>
	<name>rssh</name>
	<range><le>2.2.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	There is a format string bug in rssh that enables an attacker
	 to execute arbitrary code from an account configured to use
	 rssh. On FreeBSD it is only possible to compromise the rssh
	 running account, not root.
 </body>
 </description>
 <references>
 <url>http://www.pizzashack.org/rssh/security.shtml</url>
 <mlist msgid="20041023084829.GA16819@sophic.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109855982425122</mlist>
 </references>
 <dates>
	<discovery>2004-10-23</discovery>
	<entry>2004-10-25</entry>
 </dates>
 </vuln>

<vuln vid="ed1d404d-2784-11d9-b954-000bdb1444a4">
 <topic>horde -- cross-site scripting vulnerability in help window</topic>
 <affects>
 <package>
	<name>horde</name>
	<name>horde-devel</name>
	<range><lt>2.2.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Horde Team announcement states that a potential cross-site
	 scripting vulnerability in the help window has been
	 corrected. The vulnerability appears to involve the handling
	 of the <code>topic</code> and <code>module</code> parameters
	 of the help window template.
 </body>
 </description>
 <references>
 <mlist msgid="20041026115303.10FBEC046E@neo.wg.de">http://marc.theaimsgroup.com/?l=horde-announce&amp;m=109879164718625</mlist>
 </references>
 <dates>
 <discovery>2004-10-06</discovery>
 <entry>2004-10-27</entry>
 </dates>
 </vuln>

<vuln vid="f4428842-a583-4a4c-89b7-297c3459a1c3">
 <topic>bogofilter -- RFC 2047 decoder denial-of-service vulnerability</topic>
 <affects>
 <package>
	<name>bogofilter</name>
	<name>bogofilter-qdbm</name>
	<name>bogofilter-tdb</name>
	<name>ru-bogofilter</name>
	<range><ge>0.17.4</ge><lt>0.92.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The bogofilter team has been provided with a test case of a
	 malformatted (non-conformant) RFC-2047 encoded word that can cause
	 bogofilter versions 0.92.7 and prior to try to write a NUL byte into
	 a memory location that is either one byte past the end of a flex
	 buffer or to a location that is the negative of the encoded word's
	 start of payload data, causing a segmentation fault.
 </body>
 </description>
 <references>
 <freebsdpr>ports/73144</freebsdpr>
 <cvename>CVE-2004-1007</cvename>
 <mlist msgid="20041008143604.GA14934@scowler.net">http://article.gmane.org/gmane.mail.bogofilter.devel/3308</mlist>
 <mlist msgid="m3r7o892vj.fsf@merlin.emma.line.org">http://article.gmane.org/gmane.mail.bogofilter.devel/3317</mlist>
 <url>http://bugs.debian.org/275373</url>
 <url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2004-01</url>
 </references>
 <dates>
 <discovery>2004-10-09</discovery>
 <entry>2004-10-26</entry>
 <modified>2015-09-28</modified>
 </dates>
 </vuln>

<vuln vid="ad2f3337-26bf-11d9-9289-000c41e2cdad">
 <topic>xpdf -- integer overflow vulnerabilities</topic>
 <affects>
 <package>
	<name>gpdf</name>
	<name>cups-base</name>
	<range><lt>1.1.22.0</lt></range>
 </package>
 <package>
	<name>xpdf</name>
	<range><lt>3.00_4</lt></range>
 </package>
 <package>
	<name>kdegraphics</name>
	<range><lt>3.3.0_1</lt></range>
 </package>
 <package>
	<name>koffice</name>
	<range><lt>1.3.2_1,1</lt></range>
 </package>
 <package>
	<name>teTeX-base</name>
	<range><lt>2.0.2_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chris Evans discovered several integer arithmetic overflows
	 in the xpdf 2 and xpdf 3 code bases.	The flaws have impacts
	 ranging from denial-of-service to arbitrary code execution.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0888</cvename>
 <cvename>CVE-2004-0889</cvename>
 <url>http://scary.beasts.org/security/CESA-2004-002.txt</url>
 <url>http://scary.beasts.org/security/CESA-2004-007.txt</url>
 <url>http://www.kde.org/info/security/advisory-20041021-1.txt</url>
 </references>
 <dates>
 <discovery>2004-10-21</discovery>
 <entry>2004-10-25</entry>
 </dates>
 </vuln>

<vuln vid="f2d6a5e1-26b9-11d9-9289-000c41e2cdad">
 <topic>gaim -- MSN denial-of-service vulnerabilities</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.0.2</lt></range>
 </package>
 <package>
	<name>gaim</name>
	<range><gt>20030000</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gaim team discovered denial-of-service vulnerabilities in
	 the MSN protocol handler:
	<blockquote cite="http://gaim.sourceforge.net/security/?id=7">
	 After accepting a file transfer request, Gaim will attempt
	 to allocate a buffer of a size equal to the entire filesize,
	 this allocation attempt will cause Gaim to crash if the size
	 exceeds the amount of available memory.
	</blockquote>
	<blockquote cite="http://gaim.sourceforge.net/security/?id=8">
	 Gaim allocates a buffer for the payload of each message
	 received based on the size field in the header of the
	 message. A malicious peer could specify an invalid size that
	 exceeds the amount of available memory.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://gaim.sourceforge.net/security/?id=7</url>
 <url>http://gaim.sourceforge.net/security/?id=8</url>
 </references>
 <dates>
 <discovery>2004-10-19</discovery>
 <entry>2004-10-25</entry>
 </dates>
 </vuln>

<vuln vid="ad61657d-26b9-11d9-9289-000c41e2cdad">
 <topic>gaim -- Content-Length header denial-of-service vulnerability</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>0.82</lt></range>
 </package>
 <package>
	<name>gaim</name>
	<range><gt>20030000</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sean <q>infamous42md</q> reports:
	<blockquote cite="http://gaim.sourceforge.net/security/?id=6">
	 When a remote server provides a large "content-length"
	 header value, Gaim will attempt to allocate a buffer to
	 store the content, however this allocation attempt will
	 cause Gaim to crash if the length exceeds the amount of
	 possible memory. This happens when reading profile
	 information on some protocols. It also happens when smiley
	 themes are installed via drag and drop.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://gaim.sourceforge.net/security/?id=6</url>
 </references>
 <dates>
 <discovery>2004-08-26</discovery>
 <entry>2004-10-25</entry>
 </dates>
 </vuln>

<vuln vid="4260eacb-26b8-11d9-9289-000c41e2cdad">
 <topic>gaim -- multiple buffer overflows</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>0.82</lt></range>
 </package>
 <package>
	<name>gaim</name>
	<range><gt>20030000</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sean <q>infamous42md</q> reports several situations in gaim
	 that may result in exploitable buffer overflows:
	<ul>
	 <li>Rich Text Format (RTF) messages in Novell GroupWise
	 protocol</li>
	 <li>Unsafe use of gethostbyname in zephyr protocol</li>
	 <li>URLs which are over 2048 bytes long once decoded</li>
	</ul>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0785</cvename>
 <url>http://gaim.sourceforge.net/security/?id=3</url>
 <url>http://gaim.sourceforge.net/security/?id=4</url>
 <url>http://gaim.sourceforge.net/security/?id=5</url>
 </references>
 <dates>
 <discovery>2004-08-26</discovery>
 <entry>2004-10-25</entry>
 </dates>
 </vuln>

<vuln vid="e16293f0-26b7-11d9-9289-000c41e2cdad">
 <topic>gaim -- heap overflow exploitable by malicious GroupWise server</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>0.82</lt></range>
 </package>
 <package>
	<name>gaim</name>
	<range><gt>20030000</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sean <q>infamous42md</q> reports that a malicious GroupWise
	 messaging server may be able to exploit a heap buffer
	 overflow in gaim, leading to arbitrary code execution.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0754</cvename>
 <url>http://gaim.sourceforge.net/security/?id=2</url>
 </references>
 <dates>
 <discovery>2004-08-26</discovery>
 <entry>2004-10-25</entry>
 </dates>
 </vuln>

<vuln vid="635bf5f4-26b7-11d9-9289-000c41e2cdad">
 <topic>gaim -- malicious smiley themes</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>0.82</lt></range>
 </package>
 <package>
	<name>gaim</name>
	<range><gt>20030000</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Gaim Security Issues page documents a problem with
	 installing smiley themes from an untrusted source:
	<blockquote cite="http://gaim.sourceforge.net/security/?id=1">
	 To install a new smiley theme, a user can drag a tarball
	 from a graphical file manager, or a hypertext link to one
	 from a web browser. When a tarball is dragged, Gaim executes
	 a shell command to untar it. However, it does not escape the
	 filename before sending it to the shell. Thus, a specially
	 crafted filename could execute arbitrary commands if the
	 user could be convinced to drag a file into the smiley theme
	 selector.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0784</cvename>
 <url>http://gaim.sourceforge.net/security/?id=1</url>
 </references>
 <dates>
 <discovery>2004-08-22</discovery>
 <entry>2004-10-25</entry>
 </dates>
 </vuln>

<vuln vid="1e6c4008-245f-11d9-b584-0050fc56d258">
 <topic>gaim -- buffer overflow in MSN protocol support</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ru-gaim</name>
	<range><ge>0.79</ge><le>1.0.1</le></range>
 </package>
 <package>
	<name>gaim</name>
	<range><gt>20030000</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Due to a buffer overflow in the MSN protocol support for
	 gaim 0.79 to 1.0.1, it is possible for remote clients to do a
	 denial-of-service attack on the application.
	 This is caused by an unbounded copy operation, which writes
	 to the wrong buffer.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0891</cvename>
 <url>http://gaim.sourceforge.net/security/?id=9</url>
 </references>
 <dates>
 <discovery>2004-10-19</discovery>
 <entry>2004-10-25</entry>
 </dates>
 </vuln>

<vuln vid="4238151d-207a-11d9-bfe2-0090962cff2a">
 <topic>mod_ssl -- SSLCipherSuite bypass</topic>
 <affects>
 <package>
	<name>ru-apache+mod_ssl</name>
	<range><le>1.3.31+30.20+2.8.18</le></range>
 </package>
 <package>
	<name>apache+mod_ssl</name>
	<range><lt>1.3.31+2.8.20</lt></range>
 </package>
 <package>
	<name>apache+mod_ssl+ipv6</name>
	<range><le>1.3.31+2.8.18_4</le></range>
 </package>
 <package>
	<name>apache2</name>
	<range><le>2.0.52_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	It is possible for clients to use any cipher suite configured by
	 the virtual host, whether or not a certain cipher suite is selected
	 for a specific directory. This might result in clients using a
	 weaker encryption than originally configured.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0885</cvename>
 <mlist msgid="20041008152510.GE8385@redhat.com">http://marc.theaimsgroup.com/?l=apache-modssl&amp;m=109724918128044</mlist>
 <url>http://issues.apache.org/bugzilla/show_bug.cgi?id=31505</url>
 </references>
 <dates>
 <discovery>2004-10-01</discovery>
 <entry>2004-10-23</entry>
 </dates>
 </vuln>

<vuln vid="20d16518-2477-11d9-814e-0001020eed82">
 <topic>mpg123 -- buffer overflow in URL handling</topic>
 <affects>
 <package>
	<name>mpg123</name>
	<name>mpg123-nas</name>
	<name>mpg123-esound</name>
	<range><lt>0.59r_15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Carlos Barros reports that mpg123 contains two buffer
	 overflows. These vulnerabilities can potentially lead to
	 execution of arbitrary code.
	The first buffer overflow can occur when mpg123 parses a
	 URL with a user-name/password field that is more than 256
	 characters long. This problem can be triggered either
	 locally or remotely via a specially crafted play list. The
	 second potential buffer overflow may be triggered locally by
	 a specially crafted symlink to the mpg123 binary. This
	 problem is not as serious, since mpg123 is not installed
	 setuid by default.
 </body>
 </description>
 <references>
 <bid>11468</bid>
 <cvename>CVE-2004-0982</cvename>
 <mlist msgid="200410200119.42801.barros@barrossecurity.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109834486312407</mlist>
 </references>
 <dates>
 <discovery>2004-10-02</discovery>
 <entry>2004-10-23</entry>
 <modified>2004-12-30</modified>
 </dates>
 </vuln>

<vuln vid="7b81fc47-239f-11d9-814e-0001020eed82">
 <topic>apache2 -- SSL remote DoS</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><gt>2.0</gt><lt>2.0.51</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache HTTP Server 2.0.51 release notes report that the
	 following issues have been fixed:
	<blockquote cite="http://marc.theaimsgroup.com/?l=apache-httpd-announce&amp;m=109527608022322">
	 A segfault in mod_ssl which can be triggered by a
	 malicious remote server, if proxying to SSL servers has
	 been configured. [CAN-2004-0751]
	 A potential infinite loop in mod_ssl which could be
	 triggered given particular timing of a connection
	 abort. [CAN-2004-0748]
	</blockquote>
 </body>
 </description>
 <references>
 <bid>11094</bid>
 <bid>11154</bid>
 <cvename>CVE-2004-0748</cvename>
 <cvename>CVE-2004-0751</cvename>
 <mlist msgid="029f01c49b54$dec30f20$1500a8c0@Cougar">http://marc.theaimsgroup.com/?l=apache-httpd-announce&amp;m=109527608022322</mlist>
 <url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=29964</url>
 <url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=30134</url>
 </references>
 <dates>
 <discovery>2004-07-07</discovery>
 <entry>2004-10-21</entry>
 </dates>
 </vuln>

<vuln vid="fc07c9ca-22ce-11d9-814e-0001020eed82">
 <topic>phpmyadmin -- remote command execution vulnerability</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<name>phpmyadmin</name>
	<range><lt>2.6.0.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	From the phpMyAdmin 2.6.0p2 release notes:
	<blockquote cite="http://sourceforge.net/project/shownotes.php?release_id=274709">
	 If PHP is not running in safe mode, a problem in the
	 MIME-based transformation system (with an "external"
	 transformation) allows to execute any command with the
	 privileges of the web server's user.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>11391</bid>
 <url>http://sourceforge.net/project/shownotes.php?release_id=274709</url>
 <url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1044864&amp;group_id=23067&amp;atid=377408</url>
 </references>
 <dates>
 <discovery>2004-10-11</discovery>
 <entry>2004-10-20</entry>
 </dates>
 </vuln>

<vuln vid="61480a9a-22b2-11d9-814e-0001020eed82">
 <topic>cabextract -- insecure directory handling</topic>
 <affects>
 <package>
	<name>cabextract</name>
	<range><lt>1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	cabextract has insufficient checks for file names that
	 contain <q>../</q>. This can cause files to be extracted to
	 the parent directory.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0916</cvename>
 <url>http://www.kyz.uklinux.net/cabextract.php#changes</url>
 </references>
 <dates>
 <discovery>2004-10-18</discovery>
 <entry>2004-10-20</entry>
 <modified>2004-10-22</modified>
 </dates>
 </vuln>

<vuln vid="8091fcea-f35e-11d8-81b0-000347a4fa7d">
 <topic>a2ps -- insecure command line argument handling</topic>
 <affects>
 <package>
	<name>a2ps-a4</name>
	<range><lt>4.13b_2</lt></range>
 </package>
 <package>
	<name>a2ps-letter</name>
	<range><lt>4.13b_2</lt></range>
 </package>
 <package>
	<name>a2ps-letterdj</name>
	<range><lt>4.13b_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Rudolf Polzer reports:
	<blockquote>
	 a2ps builds a command line for file() containing an
	 unescaped version of the file name, thus might call
	 external programs described by the file name. Running a
	 cronjob over a public writable directory a2ps-ing all
	 files in it - or simply typing "a2ps *.txt" in /tmp - is
	 therefore dangerous.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1170</cvename>
 <freebsdpr>ports/70618</freebsdpr>
 <bid>11025</bid>
 <url>http://www.osvdb.org/9176</url>
 <mlist msgid="e5312d6a040824040119840c7c@mail.gmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109334851517137</mlist>
 </references>
 <dates>
 <discovery>2004-08-18</discovery>
 <entry>2004-10-20</entry>
 <modified>2004-12-30</modified>
 </dates>
 </vuln>

<vuln vid="746ca1ac-21ec-11d9-9289-000c41e2cdad">
 <topic>ifmail -- unsafe set-user-ID application</topic>
 <affects>
 <package>
	<name>ifmail</name>
	<range><le>2.15_4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Niels Heinen reports that ifmail allows one to specify
	 a configuration file. Since ifmail runs set-user-ID `news',
	 this may allow a local attacker to write to arbitrary files
	 or execute arbitrary commands as the `news' user.
 </body>
 </description>
 <references>
 <url>https://svnweb.freebsd.org/changeset/ports/120295</url>
 </references>
 <dates>
 <discovery>2004-08-23</discovery>
 <entry>2004-10-19</entry>
 <modified>2015-05-01</modified>
 </dates>
 </vuln>

<vuln vid="e31d44a2-21e3-11d9-9289-000c41e2cdad">
 <topic>imwheel -- insecure handling of PID file</topic>
 <affects>
 <package>
	<name>imwheel</name>
	<range><lt>1.0.0.p12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A Computer Academic Underground advisory describes the
	 consequences of imwheel's handling of the process ID file (PID
	 file):
	<blockquote cite="http://www.caughq.org/advisories/CAU-2004-0002.txt">
	 imwheel exclusively uses a predictably named PID file for
	 management of multiple imwheel processes. A race condition
	 exists when the -k command-line option is used to kill
	 existing imwheel processes. This race condition may be
	 used by a local user to Denial of Service another user
	 using imwheel, lead to resource exhaustion of the host
	 system, or append data to arbitrary files.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.caughq.org/advisories/CAU-2004-0002.txt</url>
 <url>http://imwheel.sourceforge.net/files/DEVELOPMENT.txt</url>
 </references>
 <dates>
 <discovery>2004-08-20</discovery>
 <entry>2004-10-19</entry>
 </dates>
 </vuln>

<vuln vid="064225c5-1f53-11d9-836a-0090962cff2a">
 <topic>squid -- NTLM authentication denial-of-service vulnerability</topic>
 <affects>
	<package>
	 <name>squid</name>
	 <range><lt>2.5.7</lt></range>
	</package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A remote attacker is able to cause a denial-of-service
	 situation, when NTLM authentication is enabled in squid.
	 NTLM authentication uses two functions which lack correct
	 offset checking.
 </body>
 </description>
 <references>
	<cvename>CVE-2004-0832</cvename>
	<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1045</url>
 </references>
 <dates>
 <discovery>2004-08-18</discovery>
 <entry>2004-10-18</entry>
 </dates>
 </vuln>

<vuln vid="ca543e06-207a-11d9-814e-0001020eed82">
 <topic>cacti -- SQL injection</topic>
 <affects>
 <package>
	<name>cacti</name>
	<range><lt>0.8.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Fernando Quintero reports that Cacti 0.8.5a suffers from a
	 SQL injection attack where an attacker can change the
	 password for any Cacti user.	This attack is not possible if
	 the PHP option magic_quotes_gpc is set to On, which is the
	 default for PHP in FreeBSD.
 </body>
 </description>
 <references>
 <mlist msgid="1092686621.818.8.camel@mitnick.nadied.org">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109269427427368</mlist>
 </references>
 <dates>
 <discovery>2004-08-16</discovery>
 <entry>2004-10-17</entry>
 </dates>
 </vuln>

<vuln vid="18974c8a-1fbd-11d9-814e-0001020eed82">
 <topic>apache13-modssl -- format string vulnerability in proxy support</topic>
 <affects>
 <package>
	<name>apache+mod_ssl</name>
	<range><lt>1.3.31+2.8.19</lt></range>
 </package>
 <package>
	<name>apache+mod_ssl+ipv6</name>
	<range><lt>1.3.31+2.8.19</lt></range>
 </package>
 <package>
	<name>ru-apache+mod_ssl</name>
	<range><lt>1.3.31+30.20+2.8.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A OpenPKG Security Advisory reports:
	<blockquote cite="http://www.openpkg.org/security/OpenPKG-SA-2004.032-apache.html">
	 Triggered by a report to Packet Storm from Virulent, a
	 format string vulnerability was found in mod_ssl, the
	 Apache SSL/TLS interface to OpenSSL, version (up to and
	 including) 2.8.18 for Apache 1.3. The mod_ssl in Apache
	 2.x is not affected. The vulnerability could be
	 exploitable if Apache is used as a proxy for HTTPS URLs
	 and the attacker established a own specially prepared DNS
	 and origin server environment.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>10736</bid>
 <certvu>303448</certvu>
 <cvename>CVE-2004-0700</cvename>
 <url>http://www.openpkg.org/security/OpenPKG-SA-2004.032-apache.html</url>
 <url>http://packetstormsecurity.org/0407-advisories/modsslFormat.txt</url>
 <mlist msgid="20040716204207.GA45678@engelschall.com">http://marc.theaimsgroup.com/?l=apache-modssl&amp;m=109001100906749</mlist>
 </references>
 <dates>
 <discovery>2004-07-16</discovery>
 <entry>2004-10-17</entry>
 </dates>
 </vuln>

<vuln vid="8e2e6ad8-1720-11d9-9fb9-00902788733b">
 <topic>tor -- remote DoS and loss of anonymity</topic>
 <affects>
 <package>
	<name>tor</name>
	<range><lt>0.0.8.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Tor has various remote crashes which could lead to a remote
	 denial-of-service and be used to defeat clients anonymity.
	 It is not expected that these vulnerabilities are
	 exploitable for arbitrary code execution.
 </body>
 </description>
 <references>
 <mlist>http://archives.seul.org/or/announce/Aug-2004/msg00001.html</mlist>
 <mlist>http://archives.seul.org/or/announce/Oct-2004/msg00000.html</mlist>
 </references>
 <dates>
 <discovery>2004-08-25</discovery>
 <entry>2004-10-15</entry>
 </dates>
 </vuln>

<vuln vid="b2cfb400-1df0-11d9-a859-0050fc56d258">
 <topic>icecast -- Cross-Site Scripting Vulnerability</topic>
 <affects>
 <package>
	<name>icecast</name>
	<range><lt>1.3.12_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Caused by improper filtering of HTML code in the
	 status display, it is possible for a remote user
	 to execute scripting code in the target user's
	 browser.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0781</cvename>
 <url>http://www.securitytracker.com/alerts/2004/Aug/1011047.html</url>
 </references>
 <dates>
 <discovery>2004-08-24</discovery>
 <entry>2004-10-13</entry>
 </dates>
 </vuln>

<vuln vid="741c3957-1d69-11d9-a804-0050fc56d258">
 <topic>icecast -- HTTP header overflow</topic>
 <affects>
 <package>
	<name>icecast2</name>
	<range><lt>2.0.2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	It is possible to execute remote code simply using
	HTTP request plus 31 headers followed by a shellcode that will be
	executed directly.
 </body>
 </description>
 <references>
 <mlist msgid="20040928184943.0a82b6f6.aluigi@autistici.org">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109646043512722</mlist>
 </references>
 <dates>
 <discovery>2004-09-29</discovery>
 <entry>2004-10-13</entry>
 </dates>
 </vuln>

<vuln vid="20dfd134-1d39-11d9-9be9-000c6e8f12ef">
 <topic>freeradius -- denial-of-service vulnerability</topic>
 <affects>
 <package>
	<name>freeradius</name>
	<range><ge>0.8.0</ge><lt>1.0.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A remote attacker may be able to crash the freeRADIUS Server
	 due to three independant bugs in the function which does
	 improper checking values while processing RADIUS
	 attributes.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0938</cvename>
 <cvename>CVE-2004-0960</cvename>
 <cvename>CVE-2004-0961</cvename>
 <url>http://www.securitytracker.com/alerts/2004/Sep/1011364.html</url>
 <certvu>541574</certvu>
 <bid>11222</bid>
 </references>
 <dates>
 <discovery>2004-09-20</discovery>
 <entry>2004-10-13</entry>
 <modified>2004-10-19</modified>
 </dates>
 </vuln>

<vuln vid="76301302-1d59-11d9-814e-0001020eed82">
 <topic>xerces-c2 -- Attribute blowup denial-of-service</topic>
 <affects>
 <package>
	<name>xerces-c2</name>
	<range><lt>2.6.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Amit Klein reports about Xerces-C++:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109674050017645">
	 An attacker can craft a malicious XML document, which
	 uses XML attributes in a way that inflicts a denial of
	 service condition on the target machine (XML parser). The
	 result of this attack is that the XML parser consumes all
	 the CPU.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>11312</bid>
 <mlist msgid="415F00A8.13029.1FAADB7@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109674050017645</mlist>
 </references>
 <dates>
 <discovery>2004-10-02</discovery>
 <entry>2004-10-13</entry>
 <modified>2004-10-14</modified>
 </dates>
 </vuln>

<vuln vid="12b7b4cf-1d53-11d9-814e-0001020eed82">
 <topic>wordpress -- XSS in administration panel</topic>
 <affects>
 <package>
	<name>wordpress</name>
	<range><lt>1.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pages in the administration panel of Wordpress are
	 vulnerable for XSS attacks.
 </body>
 </description>
 <references>
 <url>http://wordpress.org/development/2004/10/wp-121/</url>
 <mlist msgid="20040927231608.19365.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109641484723194</mlist>
 </references>
 <dates>
 <discovery>2004-09-27</discovery>
 <entry>2004-10-13</entry>
 </dates>
 </vuln>

<vuln vid="3897a2f8-1d57-11d9-bc4a-000c41e2cdad">
 <topic>tiff -- multiple integer overflows</topic>
 <affects>
 <package>
	<name>tiff</name>
	<range><le>3.6.1_2</le></range>
 </package>
 <package>
	<name>linux-tiff</name>
	<range><lt>3.6.1</lt></range>
 </package>
 <package>
	<name>pdflib</name>
	<name>pdflib-perl</name>
	<range><lt>6.0.1</lt></range>
 </package>
 <package>
	<name>gdal</name>
	<range><lt>1.2.1_2</lt></range>
 </package>
 <package>
	<name>ivtools</name>
	<range><lt>1.2.3</lt></range>
 </package>
 <package>
	<name>paraview</name>
	<range><lt>2.4.3</lt></range>
 </package>
 <package>
	<name>fractorama</name>
	<range><lt>1.6.7_1</lt></range>
 </package>
 <package>
	<name>iv</name>
	<name>ja-iv</name>
	<name>ja-libimg</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dmitry V. Levin discovered numerous integer overflow bugs in
	 libtiff. Most of these bugs are related to memory management,
	 and are believed to be exploitable for arbitrary code
	 execution.
 </body>
 </description>
 <references>
 <certvu>687568</certvu>
 <cvename>CVE-2004-0886</cvename>
 <url>http://www.idefense.com/application/poi/display?id=173&amp;type=vulnerabilities</url>
 </references>
 <dates>
 <discovery>2004-10-13</discovery>
 <entry>2004-10-13</entry>
 <modified>2006-06-08</modified>
 </dates>
 </vuln>

<vuln vid="30cea6be-1d0c-11d9-814e-0001020eed82">
 <topic>CUPS -- local information disclosure</topic>
 <affects>
 <package>
	<name>cups-base</name>
	<range><lt>1.1.22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Certain methods of authenticated remote printing in CUPS
	 can disclose user names and passwords in the log files.
	A workaround for this problem is to set more strict
	 access permissions on the CUPS logfiles.
 </body>
 </description>
 <references>
 <url>http://docs.info.apple.com/article.html?artnum=61798</url>
 <url>http://secunia.com/advisories/12690/</url>
 <url>http://www.cups.org/str.php?L920</url>
 <cvename>CVE-2004-0923</cvename>
 <certvu>557062</certvu>
 </references>
 <dates>
 <discovery>2004-09-23</discovery>
 <entry>2004-10-13</entry>
 </dates>
 </vuln>

<vuln vid="30cf9485-1c2c-11d9-9ecb-000c6e8f12ef">
 <topic>zinf -- potential buffer overflow playlist support</topic>
 <affects>
 <package>
	<name>zinf</name>
	<range><lt>2.2.5</lt></range>
 </package>
 <package>
	<name>freeamp</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The audio player Zinf is vulnerable to a buffer-overflow
	 bug in the management of the playlist files.
 </body>
 </description>
 <references>
 <mlist msgid="20040924213102.7fb91138.aluigi@autistici.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109608092609200</mlist>
 </references>
 <dates>
	<discovery>2004-09-24</discovery>
	<entry>2004-10-12</entry>
 </dates>
 </vuln>

<vuln vid="f6680c03-0bd8-11d9-8a8a-000c41e2cdad">
 <topic>tiff -- RLE decoder heap overflows</topic>
 <affects>
 <package>
	<name>tiff</name>
	<range><le>3.6.1_1</le></range>
 </package>
 <package>
	<name>linux-tiff</name>
	<range><lt>3.6.1</lt></range>
 </package>
 <package>
	<name>pdflib</name>
	<name>pdflib-perl</name>
	<range><lt>6.0.1</lt></range>
 </package>
 <package>
	<name>gdal</name>
	<range><lt>1.2.1_2</lt></range>
 </package>
 <package>
	<name>ivtools</name>
	<range><lt>1.2.3</lt></range>
 </package>
 <package>
	<name>paraview</name>
	<range><lt>2.4.3</lt></range>
 </package>
 <package>
	<name>fractorama</name>
	<range><lt>1.6.7_1</lt></range>
 </package>
 <package>
	<name>iv</name>
	<name>ja-iv</name>
	<name>ja-libimg</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chris Evans discovered several heap buffer overflows in
	 libtiff's RLE decoder. These overflows could be triggered
	 by a specially-crafted TIFF image file, resulting in an
	 application crash and possibly arbitrary code execution.
 </body>
 </description>
 <references>
 <certvu>948752</certvu>
 <cvename>CVE-2004-0803</cvename>
 <url>http://scary.beasts.org/security/CESA-2004-006.txt</url>
 </references>
 <dates>
 <discovery>2004-10-13</discovery>
 <entry>2004-10-13</entry>
 <modified>2006-06-08</modified>
 </dates>
 </vuln>

<vuln vid="26c9e8c6-1c99-11d9-814e-0001020eed82">
 <topic>sharutils -- buffer overflows</topic>
 <affects>
 <package>
	<name>sharutils</name>
	<range><lt>4.2.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	From Gentoo advisory GLSA 200410-01:
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200410-01.xml">
	 sharutils contains two buffer overflows. Ulf Harnhammar
	 discovered a buffer overflow in shar.c, where the length
	 of data returned by the wc command is not checked.
	 Florian Schilhabel discovered another buffer overflow in
	 unshar.c.
	 An attacker could exploit these vulnerabilities to
	 execute arbitrary code as the user running one of the
	 sharutils programs.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>11298</bid>
 <url>http://www.gentoo.org/security/en/glsa/glsa-200410-01.xml</url>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=265904</url>
 </references>
 <dates>
 <discovery>2004-08-15</discovery>
 <entry>2004-10-13</entry>
 </dates>
 </vuln>

<vuln vid="3030ae22-1c7f-11d9-81a4-0050fc56d258">
 <topic>mail-notification -- denial-of-service vulnerability</topic>
 <affects>
 <package>
	<name>mail-notification</name>
	<range><lt>0.7.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Caused by an untested return value, and a resulting
	 null pointer dereference, it is possible for an attacker
	 to crash the application. However, the attacker must first
	 hijack the connection between Mail Notification and the
	 Gmail or IMAP server.
 </body>
 </description>
 <references>
 <url>http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:2.asc</url>
 <url>http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:3.asc</url>
 </references>
 <dates>
 <discovery>2004-10-06</discovery>
 <entry>2004-10-12</entry>
 </dates>
 </vuln>

<vuln vid="65e99f52-1c5f-11d9-bc4a-000c41e2cdad">
 <topic>squid -- SNMP module denial-of-service vulnerability</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.7</lt></range>
	<range><ge>3.0.0</ge><lt>3.0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Squid-2.5 patches page notes:
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump">
	 If a certain malformed SNMP request is received squid
	 restarts with a Segmentation Fault error.
	</blockquote>
	This only affects squid installations where SNMP is
	 explicitly enabled via "make config". As a workaround,
	 SNMP can be disabled by defining "snmp_port 0" in
	 squid.conf.
	Squid security advisory SQUID-2008:1 explains that Squid-3 versions
	 up to and including Squid-3.0.STABLE6 are affected by this error,
	 too.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0918</cvename>
 <url>http://www.idefense.com/application/poi/display?id=152&amp;type=vulnerabilities</url>
 <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump</url>
 <url>http://www.squid-cache.org/Advisories/SQUID-2004_3.txt</url>
 <url>http://www.squid-cache.org/Advisories/SQUID-2008_1.txt</url>
 </references>
 <dates>
 <discovery>2004-09-29</discovery>
 <entry>2004-10-12</entry>
 <modified>2008-06-28</modified>
 </dates>
 </vuln>

<vuln vid="0c592c4a-1bcc-11d9-a3ec-00061bd2d56f">
 <topic>cyrus-sasl -- potential buffer overflow in DIGEST-MD5 plugin</topic>
 <affects>
 <package>
	<name>cyrus-sasl</name>
	<range><ge>2.*</ge><lt>2.1.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Cyrus SASL DIGEST-MD5 plugin contains a potential
	 buffer overflow when quoting is required in the output.
 </body>
 </description>
 <references>
 <url>https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c#rev1.171</url>
 </references>
 <dates>
 <discovery>2004-07-06</discovery>
 <entry>2004-10-12</entry>
 </dates>
 </vuln>

<vuln vid="92268205-1947-11d9-bc4a-000c41e2cdad">
 <topic>cyrus-sasl -- dynamic library loading and set-user-ID applications</topic>
 <affects>
 <package>
	<name>cyrus-sasl</name>
	<range><le>1.5.28_3</le></range>
	<range><ge>2.*</ge><le>2.1.19</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Cyrus SASL library, libsasl, contains functions which
	 may load dynamic libraries. These libraries may be loaded
	 from the path specified by the environmental variable
	 SASL_PATH, which in some situations may be fully controlled
	 by a local attacker.	Thus, if a set-user-ID application
	 (such as chsh) utilizes libsasl, it may be possible for a
	 local attacker to gain superuser privileges.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0884</cvename>
 <url>https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/lib/common.c#rev1.104</url>
 </references>
 <dates>
 <discovery>2004-09-22</discovery>
 <entry>2004-10-08</entry>
 </dates>
 </vuln>

<vuln vid="efc4819b-0b2d-11d9-bfe1-000bdb1444a4">
 <topic>imp3 -- XSS hole in the HTML viewer</topic>
 <affects>
 <package>
	<name>imp</name>
	<range><lt>3.2.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The script vulnerabilities can only be exposed with
	 certain browsers and allow XSS attacks when viewing
	 HTML messages with the HTML MIME viewer
 </body>
 </description>
 <references>
 <url>http://thread.gmane.org/gmane.comp.horde.imp/15488</url>
 <url>http://cvs.horde.org/diff.php/imp/docs/CHANGES?r1=1.389.2.109&amp;r2=1.389.2.111&amp;ty=h</url>
 </references>
 <dates>
 <discovery>2004-08-20</discovery>
 <entry>2004-10-05</entry>
 </dates>
 </vuln>

<vuln vid="938f357c-16dd-11d9-bc4a-000c41e2cdad">
 <topic>bmon -- unsafe set-user-ID application</topic>
 <affects>
 <package>
	<name>bmon</name>
	<range><lt>1.2.1_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jon Nistor reported that the FreeBSD port of bmon was
	 installed set-user-ID root, and executes commands using
	 relative paths. This could allow local user to easily obtain
	 root privileges.
 </body>
 </description>
 <references>
 <freebsdpr>ports/67340</freebsdpr>
 </references>
 <dates>
 <discovery>2004-05-29</discovery>
 <entry>2004-10-05</entry>
 </dates>
 </vuln>

<vuln vid="84ab58cf-e4ac-11d8-9b0a-000347a4fa7d">
 <topic>gnutls -- certificate chain verification DoS</topic>
 <affects>
 <package>
	<name>gnutls</name>
	<range><lt>1.0.17</lt></range>
 </package>
 <package>
	<name>gnutls-devel</name>
	<range><ge>1.1.*</ge><lt>1.1.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Patric Hornik reports on a problem in the certificate chain
	 verification procedures of GnuTLS that may result in a
	 denial-of-service vulnerability:
	<blockquote cite="http://www.hornik.sk/SA/SA-20040802.txt">
	 The certificate chain should be verified from last root
	 certificate to the first certificate. Otherwise a lot
	 of unauthorized CPU processing can be forced to check
	 certificate signatures signed with arbitrary RSA/DSA keys
	 chosen by attacker.
	 In GnuTLS the signatures are checked from first to last
	 certificate, there is no limit on size of keys and no
	 limit on length of certificate chain.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.hornik.sk/SA/SA-20040802.txt</url>
 <url>http://secunia.com/advisories/12156</url>
 </references>
 <dates>
 <discovery>2004-08-02</discovery>
 <entry>2004-10-05</entry>
 </dates>
 </vuln>

<vuln vid="562a3fdf-16d6-11d9-bc4a-000c41e2cdad">
 <topic>php -- vulnerability in RFC 1867 file upload processing</topic>
 <affects>
 <package>
	<name>php4</name>
	<name>php4-cgi</name>
	<range><le>4.3.8_2</le></range>
 </package>
 <package>
	<name>mod_php4</name>
	<range><le>4.3.8_2,1</le></range>
 </package>
 <package>
	<name>php5</name>
	<name>php5-cgi</name>
	<range><le>5.0.1</le></range>
 </package>
 <package>
	<name>mod_php5</name>
	<range><le>5.0.1,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefano Di Paola discovered an issue with PHP that
	 could allow someone to upload a file to any directory
	 writeable by the httpd process. Any sanitizing performed on
	 the prepended directory path is ignored. This bug can only
	 be triggered if the $_FILES element name contains an
	 underscore.
 </body>
 </description>
 <references>
 <mlist msgid="1095268057.2818.20.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109534848430404</mlist>
 <mlist msgid="1096478151.3220.6.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109648426331965</mlist>
 </references>
 <dates>
 <discovery>2004-09-15</discovery>
 <entry>2004-09-15</entry>
 <modified>2004-10-12</modified>
 </dates>
 </vuln>

<vuln vid="ad74a1bd-16d2-11d9-bc4a-000c41e2cdad">
 <topic>php -- php_variables memory disclosure</topic>
 <affects>
 <package>
	<name>mod_php4-twig</name>
	<name>php4-cgi</name>
	<name>php4-cli</name>
	<name>php4-dtc</name>
	<name>php4-horde</name>
	<name>php4-nms</name>
	<name>php4</name>
	<range><le>4.3.8_2</le></range>
 </package>
 <package>
	<name>mod_php</name>
	<name>mod_php4</name>
	<range><ge>4</ge><le>4.3.8_2,1</le></range>
 </package>
 <package>
	<name>php5</name>
	<name>php5-cgi</name>
	<name>php5-cli</name>
	<range><le>5.0.1</le></range>
 </package>
 <package>
	<name>mod_php5</name>
	<range><le>5.0.1,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefano Di Paola reports:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109527531130492">
	 Bad array parsing in php_variables.c could lead to show
	 arbitrary memory content such as pieces of php code
	 and other data. This affects all GET, POST or COOKIES
	 variables.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist msgid="1095267581.2818.13.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109527531130492</mlist>
 </references>
 <dates>
 <discovery>2004-09-15</discovery>
 <entry>2004-10-05</entry>
 </dates>
 </vuln>

<vuln vid="fffacc93-16cb-11d9-bc4a-000c41e2cdad">
 <topic>xv -- exploitable buffer overflows</topic>
 <affects>
 <package>
	<name>xv</name>
	<name>xv-m17n</name>
	<range><lt>3.10a_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	In a Bugtraq posting, infamous41md(at)hotpop.com reported:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109302498125092">
	 there are at least 5 exploitable buffer and heap
	 overflows in the image handling code. this allows someone
	 to craft a malicious image, trick a user into viewing the
	 file in xv, and upon viewing that image execute arbitrary
	 code under privileges of the user viewing image. note
	 the AT LEAST part of the above sentence. there is such a
	 plethora of bad code that I just stopped reading after
	 a while. there are at least 100 calls to sprintf() and
	 strcpy() with no regards for bounds of buffers. 95% of
	 these deal with program arguments or filenames, so they
	 are of no interest to exploit. however I just got sick of
	 reading this code after not too long. so im sure there are
	 still other overflows in the image handling code for other
	 image types.
	</blockquote>
	The posting also included an exploit.
 </body>
 </description>
 <references>
 <mlist msgid="20040820032605.360e43e3.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109302498125092</mlist>
 </references>
 <dates>
 <discovery>2004-08-20</discovery>
 <entry>2004-10-05</entry>
 <modified>2004-10-12</modified>
 </dates>
 </vuln>

<vuln vid="8c33b299-163b-11d9-ac1b-000d614f7fad">
 <topic>getmail -- symlink vulnerability during maildir delivery</topic>
 <affects>
	<package>
	 <name>getmail</name>
	 <range><lt>3.2.5</lt></range>
	</package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	David Watson reports a symlink vulnerability in getmail.
	 If run as root (not the recommended mode of operation), a
	 local user may be able to cause getmail to write files in
	 arbitrary directories via a symlink attack on subdirectories
	 of the maildir.
 </body>
 </description>
 <references>
 <mlist msgid="200409191532.38997.baikie@ehwat.freeserve.co.uk">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109571883130372</mlist>
 <cvename>CVE-2004-0881</cvename>
 <bid>11224</bid>
 </references>
 <dates>
 <discovery>2004-09-19</discovery>
 <entry>2004-10-04</entry>
 </dates>
 </vuln>

<vuln vid="67710833-1626-11d9-bc4a-000c41e2cdad">
 <topic>Boundary checking errors in syscons</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.0</ge><lt>5.2.1_11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The syscons CONS_SCRSHOT <a href="http://www.freebsd.org/cgi/man.cgi?query=ioctl">ioctl(2)</a>
	 does insufficient validation of its input arguments.	In
	 particular, negative coordinates or large coordinates may
	 cause unexpected behavior.
	It may be possible to cause the CONS_SCRSHOT ioctl to
	 return portions of kernel memory. Such memory might
	 contain sensitive information, such as portions of the
	 file cache or terminal buffers. This information might be
	 directly useful, or it might be leveraged to obtain elevated
	 privileges in some way. For example, a terminal buffer
	 might include a user-entered password.
	This bug may be exploitable by users who have access to the
	 physical console or can otherwise open a /dev/ttyv* device
	 node.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0919</cvename>
 <freebsdsa>SA-04:15.syscons</freebsdsa>
 <url>https://svnweb.freebsd.org/changeset/base/135942</url>
 </references>
 <dates>
 <discovery>2004-09-30</discovery>
 <entry>2004-10-04</entry>
 </dates>
 </vuln>

<vuln vid="2328adef-157c-11d9-8402-000d93664d5c">
 <topic>racoon -- improper certificate handling</topic>
 <affects>
 <package>
	<name>racoon</name>
	<range><lt>20040818a</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Thomas Walpuski noted when OpenSSL would detect an error
	 condition for a peer certificate, racoon mistakenly ignored
	 the error. This could allow five invalid certificate states
	 to properly be used for authentication.
 </body>
 </description>
 <references>
 <mlist msgid="20040614185623.GA10290@unproved.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108726102304507</mlist>
 <url>http://www.kame.net/racoon/racoon-ml/msg00517.html</url>
 </references>
 <dates>
 <discovery>2004-01-31</discovery>
 <entry>2004-10-03</entry>
 </dates>
 </vuln>

<vuln vid="e8d4800f-1547-11d9-90a3-00010327614a">
 <topic>distcc -- incorrect parsing of IP access control rules</topic>
 <affects>
 <package>
	<name>distcc</name>
	<range><lt>2.16</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://distcc.samba.org/ftp/distcc/distcc-2.16.NEWS">
	 Fix bug that might cause IP-based access control rules not to
	 be interpreted correctly on 64-bit platforms.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0601</cvename>
 <url>http://distcc.samba.org/ftp/distcc/distcc-2.16.NEWS</url>
 </references>
 <dates>
 <discovery>2004-06-23</discovery>
 <entry>2004-10-03</entry>
 </dates>
 </vuln>

<vuln vid="b2e6d1d6-1339-11d9-bc4a-000c41e2cdad">
 <topic>mozilla -- scripting vulnerabilities</topic>
 <affects>
 <package>
	<name>thunderbird</name>
	<range><lt>0.8</lt></range>
 </package>
 <package>
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>firefox</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><lt>1.p</lt></range>
 </package>
 <package>
	<name>de-netscape7</name>
	<name>fr-netscape7</name>
	<name>ja-netscape7</name>
	<name>netscape7</name>
	<name>pt_BR-netscape7</name>
	<range><le>7.2</le></range>
 </package>
 <package>
	<name>mozilla-gtk1</name>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.3</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.3,2</lt></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>fr-linux-netscape</name>
	<name>ja-linux-netscape</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Several scripting vulnerabilities were discovered and
	 corrected in Mozilla:
	<dl>
	 <dt>CVE-2004-0905</dt>
	 <dd>
	 <blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
	 javascript; links dragged onto another frame or
		page allows an attacker to steal or modify sensitive
		information from other sites. The user could be convinced
		to drag obscurred links in the context of a game or even a
		fake scrollbar. If the user could be convinced to drag two
		links in sequence into a separate window (not frame) the
		attacker would be able to run arbitrary programs.
	 </blockquote>
	 </dd>
	 <dt>CVE-2004-0908</dt>
	 <dd>
	 <blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
	 Untrusted javascript code can read and write to the
		clipboard, stealing any sensitive data the user might
		have copied. Workaround: disable
		javascript
	 </blockquote>
	 </dd>
	 <dt>CVE-2004-0909</dt>
	 <dd>
	 <blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
	 Signed scripts requesting enhanced abilities could
		construct the request in a way that led to a confusing
		grant dialog, possibly fooling the user into thinking
		the privilege requested was inconsequential while
		actually obtaining explicit permission to run and
		install software. Workaround: Never
		grant enhanced abilities of any kind to untrusted web
		pages.
	 </blockquote>
	 </dd>
	</dl>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0905</cvename>
 <cvename>CVE-2004-0908</cvename>
 <cvename>CVE-2004-0909</cvename>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=250862</url>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=257523</url>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=253942</url>
 </references>
 <dates>
 <discovery>2004-09-13</discovery>
 <entry>2004-09-30</entry>
 </dates>
 </vuln>

<vuln vid="a7e0d783-131b-11d9-bc4a-000c41e2cdad">
 <topic>mozilla -- users may be lured into bypassing security dialogs</topic>
 <affects>
 <package>
	<name>thunderbird</name>
	<range><lt>0.7</lt></range>
 </package>
 <package>
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>firefox</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><lt>0.9.2</lt></range>
 </package>
 <package>
	<name>de-netscape7</name>
	<name>fr-netscape7</name>
	<name>ja-netscape7</name>
	<name>netscape7</name>
	<name>pt_BR-netscape7</name>
	<range><le>7.2</le></range>
 </package>
 <package>
	<name>mozilla-gtk1</name>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7,2</lt></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>fr-linux-netscape</name>
	<name>ja-linux-netscape</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	According to the Mozilla project:
	<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
	 An attacker who could lure users into clicking in
	 particular places, or typing specific text, could cause a
	 security permission or software installation dialog to pop
	 up under the user's mouse click, clicking on the grant (or
	 install) button.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0762</cvename>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=162020</url>
 </references>
 <dates>
 <discovery>2004-06-05</discovery>
 <entry>2004-09-30</entry>
 </dates>
 </vuln>

<vuln vid="5360a659-131c-11d9-bc4a-000c41e2cdad">
 <topic>mozilla -- hostname spoofing bug</topic>
 <affects>
 <package>
	<name>thunderbird</name>
	<range><lt>0.7</lt></range>
 </package>
 <package>
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>firefox</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><lt>0.9.2</lt></range>
 </package>
 <package>
	<name>de-netscape7</name>
	<name>fr-netscape7</name>
	<name>ja-netscape7</name>
	<name>netscape7</name>
	<name>pt_BR-netscape7</name>
	<range><le>7.2</le></range>
 </package>
 <package>
	<name>mozilla-gtk1</name>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7,2</lt></range>
 </package>
 <package>
	
	<name>de-linux-netscape</name>
	<name>fr-linux-netscape</name>
	<name>ja-linux-netscape</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	When processing URIs that contain an unqualified host name--
	 specifically, a domain name of only one component--
	 Mozilla will perform matching against the first component
	 of the domain name in SSL certificates. In other words, in
	 some situations, a certificate issued to "www.example.com"
	 will be accepted as matching "www".
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0765</cvename>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=234058</url>
 </references>
 <dates>
 <discovery>2004-02-12</discovery>
 <entry>2004-09-30</entry>
 </dates>
 </vuln>

<vuln vid="de16b056-132e-11d9-bc4a-000c41e2cdad">
 <topic>samba -- remote file disclosure</topic>
 <affects>
 <package>
	<name>samba</name>
	<range><lt>2.2.12</lt></range>
	<range><gt>3.*</gt><le>3.0.2a</le></range>
	<range><gt>3.*,1</gt><le>3.0.2a_1,1</le></range>
 </package>
 <package>
	<name>ja-samba</name>
	<range><lt>2.2.11.j1.0_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	According to a Samba Team security notice:
	<blockquote cite="http://www.samba.org/samba/news/#security_2.2.12">
	 A security vulnerability has been located in Samba
	 2.2.x &lt;= 2.2.11 and Samba 3.0.x &lt;= 3.0.5. A remote
	 attacker may be able to gain access to files which exist
	 outside of the share's defined path. Such files must still
	 be readable by the account used for the connection.
	</blockquote>
	<blockquote cite="http://www.samba.org/samba/news/#errata_05oct">
	 The original notice for CAN-2004-0815 indicated that
	 Samba 3.0.x &lt;= 3.0.5 was vulnerable to the security
	 issue. After further research, Samba developers have
	 confirmed that only Samba 3.0.2a and earlier releases
	 contain the exploitable code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0815</cvename>
 <url>http://www.samba.org/samba/news/#security_2.2.12</url>
 </references>
 <dates>
 <discovery>2004-09-30</discovery>
 <entry>2004-09-30</entry>
 <modified>2008-09-26</modified>
 </dates>
 </vuln>

<vuln vid="ab9c559e-115a-11d9-bc4a-000c41e2cdad">
 <topic>mozilla -- BMP decoder vulnerabilities</topic>
 <affects>
 <package>
	<name>thunderbird</name>
	<range><lt>0.7.3_1</lt></range>
 </package>
 <package>
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>firefox</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>linux-phoenix</name>
	<name>phoenix</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><lt>0.9.3_1</lt></range>
 </package>
 <package>
	<name>de-netscape7</name>
	<name>fr-netscape7</name>
	<name>ja-netscape7</name>
	<name>netscape7</name>
	<name>pt_BR-netscape7</name>
	<range><le>7.2</le></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.3</lt></range>
 </package>
 <package>
	<name>mozilla-gtk1</name>
	<range><lt>1.7.2_3</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.2_2,2</lt></range>
	<range><ge>1.8.a,2</ge><lt>1.8.a3_1,2</lt></range>
 </package>
 <package>
	
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-thunderbird</name>
	<name>linux-netscape</name>
	<name>de-linux-netscape</name>
	<name>fr-linux-netscape</name>
	<name>ja-linux-netscape</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Gael Delalleau discovered several integer overflows in
	 Mozilla's BMP decoder that can result in denial-of-service or
	 arbitrary code execution.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0904</cvename>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=255067</url>
 <uscertta>TA04-261A</uscertta>
 <certvu>847200</certvu>
 </references>
 <dates>
 <discovery>2004-09-13</discovery>
 <entry>2004-09-28</entry>
 <modified>2004-09-30</modified>
 </dates>
 </vuln>

<vuln vid="da690355-1159-11d9-bc4a-000c41e2cdad">
 <topic>mozilla -- vCard stack buffer overflow</topic>
 <affects>
 <package>
	<name>thunderbird</name>
	<range><lt>0.7.3_1</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.2_2,2</lt></range>
	<range><ge>1.8.a,2</ge><lt>1.8.a3_1,2</lt></range>
 </package>
 <package>
	<name>mozilla-gtk1</name>
	<range><lt>1.7.2_3</lt></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<range><lt>1.7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Georgi Guninski discovered a stack buffer overflow which
	 may be triggered when viewing email messages with vCard
	 attachments.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0903</cvename>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=257314</url>
 <uscertta>TA04-261A</uscertta>
 <certvu>414240</certvu>
 </references>
 <dates>
 <discovery>2004-09-13</discovery>
 <entry>2004-09-28</entry>
 <modified>2004-09-30</modified>
 </dates>
 </vuln>

<vuln vid="93d6162f-1153-11d9-bc4a-000c41e2cdad">
 <topic>mozilla -- multiple heap buffer overflows</topic>
 <affects>
 <package>
	<name>thunderbird</name>
	<range><lt>0.7.3_1</lt></range>
 </package>
 <package>
	<name>firefox</name>
	<range><lt>0.9.3_1</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.2_2,2</lt></range>
	<range><ge>1.8.a,2</ge><lt>1.8.a3_1,2</lt></range>
 </package>
 <package>
	<name>mozilla-gtk1</name>
	<range><lt>1.7.2_3</lt></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<range><lt>1.7.3</lt></range>
 </package>
 <package>
	<name>linux-mozillafirebird</name>
	<range><ge>0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Several heap buffer overflows were discovered and fixed in the
	 most recent versions of Mozilla, Firefox, and Thunderbird.
	 These overflows may occur when:
	<ul>
	 <li>Using the "Send Page" function.</li>
	 <li>Checking mail on a malicious POP3 server.</li>
	 <li>Processing non-ASCII URLs.</li>
	</ul>
	Each of these vulnerabilities may be exploited for remote
	 code execution.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0902</cvename>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=258005</url>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=245066</url>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=226669</url>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=256316</url>
 <uscertta>TA04-261A</uscertta>
 </references>
 <dates>
 <discovery>2004-09-13</discovery>
 <entry>2004-09-28</entry>
 </dates>
 </vuln>

<vuln vid="edf61c61-0f07-11d9-8393-000103ccf9d6">
 <topic>php -- strip_tags cross-site scripting vulnerability</topic>
 <affects>
 <package>
	<name>mod_php4-twig</name>
	<name>php4</name>
	<name>php4-cgi</name>
	<name>php4-cli</name>
	<name>php4-dtc</name>
	<name>php4-horde</name>
	<name>php4-nms</name>
	<range><le>4.3.7_3</le></range>
 </package>
 <package>
	<name>mod_php4</name>
	<range><le>4.3.7_3,1</le></range>
 </package>
 <package>
	<name>php5</name>
	<name>php5-cgi</name>
	<name>php5-cli</name>
	<range><le>5.0.0.r3_2</le></range>
 </package>
 <package>
	<name>mod_php5</name>
	<range><le>5.0.0.r3_2,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Esser of e-matters discovered that PHP's strip_tags()
	 function would ignore certain characters during parsing of tags,
	 allowing these tags to pass through. Select browsers could then
	 parse these tags, possibly allowing cross-site scripting attacks.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0595</cvename>
 <mlist msgid="20040713225525.GB26865@e-matters.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108981589117423</mlist>
 <url>http://security.e-matters.de/advisories/122004.html</url>
 <bid>10724</bid>
 </references>
 <dates>
 <discovery>2004-07-07</discovery>
 <entry>2004-09-27</entry>
 <modified>2013-06-19</modified>
 </dates>
 </vuln>

<vuln vid="dd7aa4f1-102f-11d9-8a8a-000c41e2cdad">
 <topic>php -- memory_limit related vulnerability</topic>
 <affects>
 <package>
	<name>mod_php4-twig</name>
	<name>php4</name>
	<name>php4-cgi</name>
	<name>php4-cli</name>
	<name>php4-dtc</name>
	<name>php4-horde</name>
	<name>php4-nms</name>
	<range><le>4.3.7_3</le></range>
 </package>
 <package>
	<name>mod_php4</name>
	<range><le>4.3.7_3,1</le></range>
 </package>
 <package>
	<name>php5</name>
	<name>php5-cgi</name>
	<name>php5-cli</name>
	<range><le>5.0.0.r3_2</le></range>
 </package>
 <package>
	<name>mod_php5</name>
	<range><le>5.0.0.r3_2,1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Esser of e-matters discovered a condition within PHP
	 that may lead to remote execution of arbitrary code.	The
	 memory_limit facility is used to notify functions when memory
	 contraints have been met. Under certain conditions, the entry
	 into this facility is able to interrupt functions such as
	 zend_hash_init() at locations not suitable for interruption.
	 The result would leave these functions in a vulnerable state.
	<blockquote cite="http://security.e-matters.de/advisories/112004.html">
	 An attacker that is able to trigger the memory_limit abort
	 within zend_hash_init() and is additionally able to control
	 the heap before the HashTable itself is allocated, is able to
	 supply his own HashTable destructor pointer. [...]
	 All mentioned places outside of the extensions are quite easy
	 to exploit, because the memory allocation up to those places
	 is deterministic and quite static throughout different PHP
	 versions. [...]
	 Because the exploit itself consist of supplying an arbitrary
	 destructor pointer this bug is exploitable on any platform.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0594</cvename>
 <mlist msgid="20040713225329.GA26865@e-matters.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108981780109154</mlist>
 <url>http://security.e-matters.de/advisories/112004.html</url>
 <bid>10725</bid>
 </references>
 <dates>
 <discovery>2004-07-07</discovery>
 <entry>2004-09-27</entry>
 <modified>2004-10-02</modified>
 </dates>
 </vuln>

<vuln vid="184f5d0b-0fe8-11d9-8a8a-000c41e2cdad">
 <topic>subversion -- WebDAV fails to protect metadata</topic>
 <affects>
 <package>
	<name>subversion</name>
	<name>subversion-perl</name>
	<name>subversion-python</name>
	<range><lt>1.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	In some situations, subversion metadata may be unexpectedly
	 disclosed via WebDAV. A subversion advisory states:
	<blockquote cite="http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt">
	 mod_authz_svn, the Apache httpd module which does path-based
	 authorization on Subversion repositories, is not correctly
	 protecting all metadata on unreadable paths.
	 This security issue is not about revealing the contents
	 of protected files: it only reveals metadata about
	 protected areas such as paths and log messages. This may
	 or may not be important to your organization, depending
	 on how you're using path-based authorization, and the
	 sensitivity of the metadata.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0749</cvename>
 <url>http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt</url>
 </references>
 <dates>
 <discovery>2004-09-15</discovery>
 <entry>2004-09-26</entry>
 </dates>
 </vuln>

<vuln vid="273cc1a3-0d6b-11d9-8a8a-000c41e2cdad">
 <topic>lha -- numerous vulnerabilities when extracting archives</topic>
 <affects>
 <package>
	<name>lha</name>
	<range><lt>1.14i_6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Source code reviews of lha by Lukasz Wojtow, Thomas Biege,
	 and others uncovered a number of vulnerabilities affecting
	 lha:
	<ul>
	 <li>Buffer overflows when handling archives and filenames.
	 (CVE-2004-0694)</li>
	 <li>Possible command execution via shell meta-characters when
	 built with NOMKDIR. (CVE-2004-0745)</li>
	 <li>Buffer overflow resulting in arbitrary code execution when
	 handling long pathnames in LHZ archives. (CVE-2004-0769)</li>
	 <li>Buffer overflow in the extract_one. (CVE-2004-0771)</li>
	</ul>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0694</cvename>
 <cvename>CVE-2004-0745</cvename>
 <cvename>CVE-2004-0769</cvename>
 <cvename>CVE-2004-0771</cvename>
 <mlist msgid="20040515110900.24784.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108464470103227</mlist>
 <mlist msgid="20040606162856.29866.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108668791510153</mlist>
 <url>http://bugs.gentoo.org/show_bug.cgi?id=51285</url>
 <url>http://xforce.iss.net/xforce/xfdb/16196</url>
 <bid>10354</bid>
 </references>
 <dates>
 <discovery>2004-05-17</discovery>
 <entry>2004-09-23</entry>
 </dates>
 </vuln>

<vuln vid="77420ebb-0cf4-11d9-8a8a-000c41e2cdad">
 <topic>mysql -- heap buffer overflow with prepared statements</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<name>mysql-client</name>
	<range><ge>4.1.0</ge><le>4.1.4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	There is a buffer overflow in the prepared statements API
	 (libmysqlclient) when a statement containing thousands of
	 placeholders is executed.
 </body>
 </description>
 <references>
 <url>http://bugs.mysql.com/bug.php?id=5194</url>
 <url>http://dev.mysql.com/doc/mysql/en/News-4.1.5.html</url>
 <url>http://mysql.bkbits.net:8080/mysql-4.1/cset@1.1932.152.4</url>
 </references>
 <dates>
 <discovery>2004-09-08</discovery>
 <entry>2004-09-23</entry>
 </dates>
 </vuln>

<vuln vid="e9f9d232-0cb2-11d9-8a8a-000c41e2cdad">
 <topic>mozilla -- security icon spoofing</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>0.9</lt></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7,2</lt></range>
 </package>
 <package>
	<name>mozilla-gtk1</name>
	<range><lt>1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Under certain situations it is possible for the security icon
	 which Mozilla displays when connected to a site using SSL to
	 be spoofed. This could be used to make so-called "phishing
	 attacks" more difficult to detect.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0761</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=240053</url>
 </references>
 <dates>
 <discovery>2004-04-08</discovery>
 <entry>2004-09-22</entry>
 </dates>
 </vuln>

<vuln vid="7c188c55-0cb0-11d9-8a8a-000c41e2cdad">
 <topic>mozilla -- NULL bytes in FTP URLs</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>0.9.3</lt></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.2</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.2,2</lt></range>
	<range><ge>1.8.a,2</ge></range>
 </package>
 <package>
	<name>mozilla-gtk1</name>
	<range><lt>1.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	When handling FTP URLs containing NULL bytes, Mozilla will
	 interpret the file content as HTML. This may allow unexpected
	 execution of Javascript when viewing plain text or other file
	 types via FTP.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0760</cvename>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=250906</url>
 </references>
 <dates>
 <discovery>2004-07-11</discovery>
 <entry>2004-09-22</entry>
 <modified>2004-09-24</modified>
 </dates>
 </vuln>

<vuln vid="6e740881-0cae-11d9-8a8a-000c41e2cdad">
 <topic>mozilla -- automated file upload</topic>
 <affects>
 <package>
	<name>mozilla</name>
	<range><ge>1.7.a,2</ge><lt>1.7,2</lt></range>
	<range><ge>1.8.a,2</ge><lt>1.8.a2,2</lt></range>
 </package>
 <package>
	<name>mozilla-gtk1</name>
	<range><ge>1.7.a</ge><lt>1.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A malicious web page can cause an automated file upload
	 from the victim's machine when viewed with Mozilla with
	 Javascript enabled. This is due to a bug permitting
	 default values for type="file" &lt;input&gt; elements in
	 certain situations.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0759</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=241924</url>
 </references>
 <dates>
 <discovery>2004-04-28</discovery>
 <entry>2004-09-22</entry>
 <modified>2004-09-26</modified>
 </dates>
 </vuln>

<vuln vid="8d823883-0ca9-11d9-8a8a-000c41e2cdad">
 <topic>mozilla -- built-in CA certificates may be overridden</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>0.9.3</lt></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.2</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.2,2</lt></range>
	<range><ge>1.8.a,2</ge></range>
 </package>
 <package>
	<name>mozilla-gtk1</name>
	<range><lt>1.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Under some situations, Mozilla will automatically import
	 a certificate from an email message or web site. This
	 behavior can be used as a denial-of-service attack: if the
	 certificate has a distinguished name (DN) identical to one
	 of the built-in Certificate Authorities (CAs), then Mozilla
	 will no longer be able to certify sites with certificates
	 issued from that CA.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0758</cvename>
 <url>https://bugzilla.mozilla.org/show_bug.cgi?id=249004</url>
 <certvu>160360</certvu>
 <url>http://banquo.inf.ethz.ch:8080/</url>
 </references>
 <dates>
 <discovery>2004-06-29</discovery>
 <entry>2004-09-22</entry>
 </dates>
 </vuln>

<vuln vid="a4815970-c5cc-11d8-8898-000d6111a684">
 <topic>rssh -- file name disclosure bug</topic>
 <affects>
 <package>
	<name>rssh</name>
	<range><lt>2.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	rssh expands command line paramters before invoking chroot.
	 This could result in the disclosure to the client of file
	 names outside of the chroot directory. A posting by the rssh
	 author explains:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108787373022844">
	 The cause of the problem identified by Mr. McCaw is that
	 rssh expanded command-line arguments prior to entering
	 the chroot jail. This bug DOES NOT allow a user to
	 access any of the files outside the jail, but can allow
	 them to discover what files are in a directory which is
	 outside the jail, if their credentials on the server would
	 normally allow them read/execute access in the specified
	 directory.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0609</cvename>
 <mlist msgid="20040619074141.GG13649@sophic.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108787373022844</mlist>
 <bid>10574</bid>
 <url>http://www.osvdb.org/7239</url>
 </references>
 <dates>
 <discovery>2004-06-19</discovery>
 <entry>2004-09-21</entry>
 </dates>
 </vuln>

<vuln vid="e6f0edd8-0b40-11d9-8a8a-000c41e2cdad">
 <topic>gnu-radius -- SNMP-related denial-of-service</topic>
 <affects>
 <package>
	<name>gnu-radius</name>
	<range><lt>1.2.94</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An iDEFENSE security advisory reports:
	<blockquote cite="http://www.idefense.com/application/poi/display?id=141&amp;type=vulnerabilities">
	 Remote exploitation of an input validation error in
	 version 1.2 of GNU radiusd could allow a denial of
	 service.
	 The vulnerability specifically exists within
	 the asn_decode_string() function defined in
	 snmplib/asn1.c. When a very large unsigned number is
	 supplied, it is possible that an integer overflow will
	 occur in the bounds-checking code. The daemon will then
	 attempt to reference unallocated memory, resulting in an
	 access violation that causes the process to terminate.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0849</cvename>
 <url>http://www.idefense.com/application/poi/display?id=141&amp;type=vulnerabilities</url>
 </references>
 <dates>
 <discovery>2004-09-15</discovery>
 <entry>2004-09-20</entry>
 <modified>2005-05-03</modified>
 </dates>
 </vuln>

<vuln vid="a268ef4a-0b35-11d9-8a8a-000c41e2cdad">
 <topic>sudo -- sudoedit information disclosure</topic>
 <affects>
 <package>
	<name>sudo</name>
	<range><eq>1.6.8</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A new feature of sudo 1.6.8 called "sudoedit" (a safe
	 editing facility) may allow users to read files to which
	 they normally have no access.
 </body>
 </description>
 <references>
 <url>http://www.sudo.ws/sudo/alerts/sudoedit.html</url>
 </references>
 <dates>
 <discovery>2004-09-18</discovery>
 <entry>2004-09-20</entry>
 </dates>
 </vuln>

<vuln vid="ca6c8f35-0a5f-11d9-ad6f-00061bc2ad93">
 <topic>apache -- heap overflow in mod_proxy</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><lt>1.3.31_1</lt></range>
 </package>
 <package>
	<name>apache13-ssl</name>
	<range><le>1.3.29.1.53_2</le></range>
 </package>
 <package>
	<name>apache13-modssl</name>
	<range><lt>1.3.31+2.8.18_4</lt></range>
 </package>
 <package>
	<name>apache13+ipv6</name>
	<range><le>1.3.29_2</le></range>
 </package>
 <package>
	<name>apache13-modperl</name>
	<range><le>1.3.31</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A buffer overflow exists in mod_proxy which may
	 allow an attacker to launch local DoS attacks
	 and possibly execute arbitrary code.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0492</cvename>
 <url>http://www.guninski.com/modproxy1.html</url>
 </references>
 <dates>
 <discovery>2004-06-10</discovery>
 <entry>2004-09-19</entry>
 <modified>2004-10-05</modified>
 </dates>
 </vuln>

<vuln vid="d2102505-f03d-11d8-81b0-000347a4fa7d">
 <topic>cvs -- numerous vulnerabilities</topic>
 <affects>
 <package>
	<name>cvs+ipv6</name>
	<range><lt>1.11.17</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.2</ge><lt>5.2.1_10</lt></range>
	<range><ge>4.10</ge><lt>4.10_3</lt></range>
	<range><ge>4.9</ge><lt>4.9_12</lt></range>
	<range><ge>4.8</ge><lt>4.8_25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A number of vulnerabilities were discovered in CVS by
	 Stefan Esser, Sebastian Krahmer, and Derek Price.
	<ul>
	 <li>Insufficient input validation while processing "Entry"
	 lines. (CVE-2004-0414)</li>
	 <li>A double-free resulting from erroneous state handling while
	 processing "Argumentx" commands. (CVE-2004-0416)</li>
	 <li>Integer overflow while processing "Max-dotdot" commands.
	 (CVE-2004-0417)</li>
	 <li>Erroneous handling of empty entries handled while processing
	 "Notify" commands. (CVE-2004-0418)</li>
	 <li>A format string bug while processing CVS wrappers.</li>
	 <li>Single-byte buffer underflows while processing configuration files
	 from CVSROOT.</li>
	 <li>Various other integer overflows.</li>
	</ul>
	Additionally, iDEFENSE reports an undocumented command-line
	 flag used in debugging does not perform input validation on
	 the given path names.
	CVS servers ("cvs server" or :pserver: modes) are
	 affected by these vulnerabilities. They vary in impact
	 but include information disclosure (the iDEFENSE-reported
	 bug), denial-of-service (CVE-2004-0414, CVE-2004-0416,
	 CVE-2004-0417 and other bugs), or possibly arbitrary code
	 execution (CVE-2004-0418). In very special situations where
	 the attacker may somehow influence the contents of CVS
	 configuration files in CVSROOT, additional attacks may be
	 possible.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0414</cvename>
 <cvename>CVE-2004-0416</cvename>
 <cvename>CVE-2004-0417</cvename>
 <cvename>CVE-2004-0418</cvename>
 <cvename>CVE-2004-0778</cvename>
 <url>http://secunia.com/advisories/11817</url>
 <url>http://secunia.com/advisories/12309</url>
 <url>http://security.e-matters.de/advisories/092004.html</url>
 <url>http://www.idefense.com/application/poi/display?id=130&amp;type=vulnerabilities&amp;flashstatus=false</url>
 <url>https://ccvs.cvshome.org/source/browse/ccvs/NEWS?rev=1.116.2.104</url>
 <url>http://www.osvdb.org/6830</url>
 <url>http://www.osvdb.org/6831</url>
 <url>http://www.osvdb.org/6832</url>
 <url>http://www.osvdb.org/6833</url>
 <url>http://www.osvdb.org/6834</url>
 <url>http://www.osvdb.org/6835</url>
 <url>http://www.osvdb.org/6836</url>
 <bid>10499</bid>
 <freebsdsa>SA-04:14.cvs</freebsdsa>
 </references>
 <dates>
 <discovery>2004-05-20</discovery>
 <entry>2004-08-17</entry>
 <modified>2004-09-19</modified>
 </dates>
 </vuln>

<vuln vid="3d1e9267-073f-11d9-b45d-000c41e2cdad">
 <topic>gdk-pixbuf -- image decoding vulnerabilities</topic>
 <affects>
 <package>
	<name>linux-gdk-pixbuf</name>
	<range><lt>0.22.0.11.3.5</lt></range>
 </package>
 <package>
	<name>gtk</name>
	<range><ge>2.0</ge><lt>2.4.9_1</lt></range>
 </package>
 <package>
	<name>gdk-pixbuf</name>
	<range><lt>0.22.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chris Evans discovered several flaws in the gdk-pixbuf
	 XPM image decoder:
	<ul>
	 <li>Heap-based overflow in pixbuf_create_from_xpm</li>
	 <li>Stack-based overflow in xpm_extract_color</li>
	 <li>Integer overflows in io-ico.c</li>
	</ul>
	Some of these flaws are believed to be exploitable.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0782</cvename>
 <cvename>CVE-2004-0783</cvename>
 <cvename>CVE-2004-0788</cvename>
 <url>http://scary.beasts.org/security/CESA-2004-005.txt</url>
 </references>
 <dates>
 <discovery>2004-09-15</discovery>
 <entry>2004-09-15</entry>
 <modified>2004-11-09</modified>
 </dates>
 </vuln>

<vuln vid="ef253f8b-0727-11d9-b45d-000c41e2cdad">
 <topic>xpm -- image decoding vulnerabilities</topic>
 <affects>
 <package>
	<name>agenda-snow-libs</name>
	<name>linux_base</name>
	<name>mupad</name>
	<name>zh-cle_base</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>open-motif-devel</name>
	<range><lt>2022.08.05</lt></range>
 </package>
 <package>
	<name>libXpm</name>
	<range><lt>3.5.1_1</lt></range>
 </package>
 <package>
	<name>XFree86-libraries</name>
	<range><lt>4.4.0_1</lt></range>
 </package>
 <package>
	<name>xorg-libraries</name>
	<range><lt>6.7.0_2</lt></range>
 </package>
 <package>
	<name>lesstif</name>
	<range><lt>0.93.96,2</lt></range>
 </package>
 <package>
	<name>xpm</name>
	<range><lt>3.4k_1</lt></range>
 </package>
 <package>
	<name>linux-openmotif</name>
	<range><lt>2.2.4</lt></range>
 </package>
 <package>
	<name>open-motif</name>
	<range><lt>2.2.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chris Evans discovered several vulnerabilities in the libXpm
	 image decoder:
	<ul>
	 <li>A stack-based buffer overflow in xpmParseColors</li>
	 <li>An integer overflow in xpmParseColors</li>
	 <li>A stack-based buffer overflow in ParsePixels and
	 ParseAndPutPixels</li>
	</ul>
	The X11R6.8.1 release announcement reads:
	<blockquote cite="http://freedesktop.org/pipermail/xorg/2004-September/003172.html">
	 This version is purely a security release, addressing
	 multiple integer and stack overflows in libXpm, the X
	 Pixmap library; all known versions of X (both XFree86
	 and X.Org) are affected, so all users of X are strongly
	 encouraged to upgrade.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0687</cvename>
 <cvename>CVE-2004-0688</cvename>
 <url>http://freedesktop.org/pipermail/xorg/2004-September/003172.html</url>
 <url>http://scary.beasts.org/security/CESA-2004-003.txt</url>
 <certvu>537878</certvu>
 <certvu>882750</certvu>
 </references>
 <dates>
 <discovery>2004-09-15</discovery>
 <entry>2004-09-15</entry>
 <modified>2005-01-03</modified>
 </dates>
 </vuln>

<vuln vid="05dcf751-0733-11d9-b45d-000c41e2cdad">
 <topic>cups -- print queue browser denial-of-service</topic>
 <affects>
 <package>
	<name>cups-base</name>
	<range><lt>1.1.21</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	If the CUPS server (cupsd) receives a zero-length UDP
	 message, it will disable its print queue browser service.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0558</cvename>
 <url>http://www.cups.org/str.php?L863</url>
 </references>
 <dates>
 <discovery>2004-08-23</discovery>
 <entry>2004-09-15</entry>
 </dates>
 </vuln>

<vuln vid="762d1c6d-0722-11d9-b45d-000c41e2cdad">
 <topic>apache -- apr_uri_parse IPv6 address handling vulnerability</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><ge>2.0</ge><lt>2.0.50_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Apache Software Foundation Security Team discovered a
	 programming error in the apr-util library function apr_uri_parse.
	 When parsing IPv6 literal addresses, it is possible that a
	 length is incorrectly calculated to be negative, and this
	 value is passed to memcpy. This may result in an exploitable
	 vulnerability on some platforms, including FreeBSD.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0786</cvename>
 <url>http://httpd.apache.org</url>
 </references>
 <dates>
 <discovery>2004-09-15</discovery>
 <entry>2004-09-15</entry>
 </dates>
 </vuln>

<vuln vid="013fa252-0724-11d9-b45d-000c41e2cdad">
 <topic>mod_dav -- lock related denial-of-service</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><ge>2.0</ge><lt>2.0.50_3</lt></range>
 </package>
 <package>
	<name>mod_dav</name>
	<range><le>1.0.3_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A malicious user with DAV write privileges can trigger a null
	 pointer dereference in the Apache mod_dav module. This
	 could cause the server to become unavailable.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0809</cvename>
 <url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=31183</url>
 </references>
 <dates>
 <discovery>2004-09-15</discovery>
 <entry>2004-09-15</entry>
 </dates>
 </vuln>

<vuln vid="4d49f4ba-071f-11d9-b45d-000c41e2cdad">
 <topic>apache -- ap_resolve_env buffer overflow</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><ge>2.0</ge><lt>2.0.50_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SITIC discovered a vulnerability in Apache 2's handling of
	 environmental variable settings in the httpd configuration
	 files (the main `httpd.conf' and `.htaccess' files).
	 According to a SITIC advisory:
	<blockquote cite="http://lists.netsys.com/pipermail/full-disclosure/2004-September/026463.html">
	 The buffer overflow occurs when expanding ${ENVVAR}
	 constructs in .htaccess or httpd.conf files. The function
	 ap_resolve_env() in server/util.c copies data from
	 environment variables to the character array tmp with
	 strcat(3), leading to a buffer overflow.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0747</cvename>
 <mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-September/026463.html</mlist>
 </references>
 <dates>
 <discovery>2004-09-15</discovery>
 <entry>2004-09-15</entry>
 </dates>
 </vuln>

<vuln vid="ae7b7f65-05c7-11d9-b45d-000c41e2cdad">
 <topic>webmin -- insecure temporary file creation at installation time</topic>
 <affects>
 <package>
	<name>webmin</name>
	<range><lt>1.150_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Webmin developers documented a security issue in the
	 release notes for version 1.160:
	<blockquote cite="http://www.webmin.com/changes-1.160.html">
	 Fixed a security hole in the maketemp.pl script, used
	 to create the /tmp/.webmin directory at install time. If
	 an un-trusted user creates this directory before Webmin
	 is installed, he could create in it a symbolic link
	 pointing to a critical file on the system, which would be
	 overwritten when Webmin writes to the link filename.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0559</cvename>
 <url>http://www.webmin.com/changes-1.160.html</url>
 </references>
 <dates>
 <discovery>2004-09-05</discovery>
 <entry>2004-09-14</entry>
 <modified>2004-09-15</modified>
 </dates>
 </vuln>

<vuln vid="a711de5c-05fa-11d9-a9b2-00061bc2ad93">
 <topic>samba3 DoS attack</topic>
 <affects>
 <package>
	<name>samba3</name>
	<range><lt>3.0.7</lt></range>
	<range><gt>*,1</gt><lt>3.0.7,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Code found in nmbd and smbd may allow a remote attacker
	 to effectively crash the nmbd server or use the smbd
	 server to exhaust the system memory.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0807</cvename>
 <cvename>CVE-2004-0808</cvename>
 <url>http://www.idefense.com/application/poi/display?id=139&amp;type=vulnerabilities</url>
 </references>
 <dates>
 <discovery>2004-09-02</discovery>
 <entry>2004-09-14</entry>
 <modified>2008-09-26</modified>
 </dates>
 </vuln>

<vuln vid="c1d97a8b-05ed-11d9-b45d-000c41e2cdad">
 <topic>mozilla -- POP client heap overflow</topic>
 <affects>
 <package>
	<name>mozilla</name>
	<range><lt>1.7,2</lt></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<range><lt>1.7</lt></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><lt>7.2</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>0.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	zen-parse discovered a heap buffer overflow in Mozilla's
	 POP client implementation. A malicious POP server
	 could exploit this vulnerability to cause Mozilla to execute
	 arbitrary code.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0757</cvename>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=229374</url>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=157644</url>
 </references>
 <dates>
 <discovery>2004-07-22</discovery>
 <entry>2004-09-14</entry>
 </dates>
 </vuln>

<vuln vid="a4fd8f53-05eb-11d9-b45d-000c41e2cdad">
 <topic>mozilla -- SOAPParameter integer overflow</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><lt>0.9</lt></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<name>mozilla-gtk1</name>
	<range><lt>1.7</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7,2</lt></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><lt>7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	zen-parse discovered and iDEFENSE reported an exploitable
	 integer overflow in a scriptable Mozilla component
	 `SOAPParameter':
	<blockquote cite="http://www.idefense.com/application/poi/display?id=117&amp;type=vulnerabilities">
	 Improper input validation to the SOAPParameter object
	 constructor in Netscape and Mozilla allows execution of
	 arbitrary code. The SOAPParameter object's constructor
	 contains an integer overflow which allows controllable
	 heap corruption. A web page can be constructed to
	 leverage this into remote execution of arbitrary code.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0722</cvename>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=236618</url>
 </references>
 <dates>
 <discovery>2004-08-02</discovery>
 <entry>2004-09-14</entry>
 <modified>2004-09-22</modified>
 </dates>
 </vuln>

<vuln vid="c62dc69f-05c8-11d9-b45d-000c41e2cdad">
 <topic>openoffice -- document disclosure</topic>
 <affects>
 <package>
	<name>openoffice</name>
	<name>ar-openoffice</name>
	<name>ca-openoffice</name>
	<name>cs-openoffice</name>
	<name>de-openoffice</name>
	<name>dk-openoffice</name>
	<name>el-openoffice</name>
	<name>es-openoffice</name>
	<name>et-openoffice</name>
	<name>fi-openoffice</name>
	<name>fr-openoffice</name>
	<name>gr-openoffice</name>
	<name>hu-openoffice</name>
	<name>it-openoffice</name>
	<name>ja-openoffice</name>
	<name>ko-openoffice</name>
	<name>nl-openoffice</name>
	<name>pl-openoffice</name>
	<name>pt-openoffice</name>
	<name>pt_BR-openoffice</name>
	<name>ru-openoffice</name>
	<name>se-openoffice</name>
	<name>sk-openoffice</name>
	<name>sl-openoffice-SI</name>
	<name>tr-openoffice</name>
	<name>zh-openoffice-CN</name>
	<name>zh-openoffice-TW</name>
	<range><lt>1.1.2_1</lt></range>
	<range><ge>2.0</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	OpenOffice creates a working directory in /tmp on startup,
	 and uses this directory to temporarily store document
	 content. However, the permissions of the created directory
	 may allow other user on the system to read these files,
	 potentially exposing information the user likely assumed was
	 inaccessible.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0752</cvename>
 <url>http://www.openoffice.org/issues/show_bug.cgi?id=33357</url>
 <url>http://securitytracker.com/alerts/2004/Sep/1011205.html</url>
 <mlist msgid="20040910152759.7739.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109483308421566</mlist>
 </references>
 <dates>
 <discovery>2004-08-24</discovery>
 <entry>2004-09-14</entry>
 </dates>
 </vuln>

<vuln vid="15e0e963-02ed-11d9-a209-00061bc2ad93">
 <topic>mpg123 buffer overflow</topic>
 <affects>
 <package>
	<name>mpg123</name>
	<name>mpg123-nas</name>
	<name>mpg123-esound</name>
	<range><le>0.59r</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The mpg123 software version 0.59r contains a
	 buffer overflow vulnerability which may permit
	 the execution of arbitrary code as the owner of
	 the mpg123 process.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0805</cvename>
 <url>http://www.alighieri.org/advisories/advisory-mpg123.txt</url>
 </references>
 <dates>
 <discovery>2003-08-16</discovery>
 <entry>2004-09-14</entry>
 </dates>
 </vuln>

<vuln vid="b6cad7f3-fb59-11d8-9837-000c41e2cdad">
 <topic>ImageMagick -- BMP decoder buffer overflow</topic>
 <affects>
 <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.0.6.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marcus Meissner discovered that ImageMagick's BMP decoder would
	 crash when loading the test BMP file created by Chris Evans
	 for testing the previous Qt vulnerability.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0827</cvename>
 <url>http://www.imagemagick.org/www/Changelog.html</url>
 </references>
 <dates>
 <discovery>2004-08-25</discovery>
 <entry>2004-08-31</entry>
 <modified>2004-09-14</modified>
 </dates>
 </vuln>

<vuln vid="641859e8-eca1-11d8-b913-000c41e2cdad">
 <topic>Mutiple browser frame injection vulnerability</topic>
 <affects>
 <package>
	<name>kdelibs</name>
	<range><lt>3.2.3_3</lt></range>
 </package>
 <package>
	<name>kdebase</name>
	<range><lt>3.2.3_1</lt></range>
 </package>
 <package>
	<name>linux-opera</name>
	<name>opera</name>
	<range><ge>7.50</ge><lt>7.52</lt></range>
 </package>
 <package>
	<name>firefox</name>
	<range><lt>0.9</lt></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<name>mozilla-gtk1</name>
	<range><lt>1.7</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7,2</lt></range>
 </package>
 <package>
	<name>netscape7</name>
	<range><lt>7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A class of bugs affecting many web browsers in the same way
	 was discovered. A Secunia advisory reports:
	<blockquote cite="http://secunia.com/advisories/11978">
	 The problem is that the browsers don't check if a target
	 frame belongs to a website containing a malicious link,
	 which therefore doesn't prevent one browser window from
	 loading content in a named frame in another window.
	 Successful exploitation allows a malicious website to load
	 arbitrary content in an arbitrary frame in another browser
	 window owned by e.g. a trusted site.
	</blockquote>
	A KDE Security Advisory reports:
	<blockquote cite="http://www.kde.org/info/security/advisory-20040811-3.txt">
	 A malicious website could abuse Konqueror to insert
	 its own frames into the page of an otherwise trusted
	 website. As a result the user may unknowingly send
	 confidential information intended for the trusted website
	 to the malicious website.
	</blockquote>
	Secunia has provided a demonstration of the vulnerability at <a href="http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/">http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/</a>.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0717</cvename>
 <cvename>CVE-2004-0718</cvename>
 <cvename>CVE-2004-0721</cvename>
 <url>http://secunia.com/advisories/11978/</url>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=246448</url>
 <url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-htmlframes.patch</url>
 <url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdebase-htmlframes.patch</url>
 </references>
 <dates>
 <discovery>2004-08-11</discovery>
 <entry>2004-08-12</entry>
 <modified>2004-09-14</modified>
 </dates>
 </vuln>

<vuln vid="b7cb488c-8349-11d8-a41f-0020ed76ef5a">
 <topic>isakmpd payload handling denial-of-service vulnerabilities</topic>
 <affects>
 <package>
	<name>isakmpd</name>
	<range><le>20030903</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Numerous errors in isakmpd's input packet validation lead to
	 denial-of-service vulnerabilities. From the Rapid7 advisory:
	<blockquote cite="http://www.rapid7.com/advisories/R7-0018.html">
	 The ISAKMP packet processing functions in OpenBSD's
	 isakmpd daemon contain multiple payload handling flaws
	 that allow a remote attacker to launch a denial of
	 service attack against the daemon.
	 Carefully crafted ISAKMP packets will cause the isakmpd
	 daemon to attempt out-of-bounds reads, exhaust available
	 memory, or loop endlessly (consuming 100% of the CPU).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0218</cvename>
 <cvename>CVE-2004-0219</cvename>
 <cvename>CVE-2004-0220</cvename>
 <cvename>CVE-2004-0221</cvename>
 <cvename>CVE-2004-0222</cvename>
 <url>http://www.rapid7.com/advisories/R7-0018.html</url>
 <url>http://www.openbsd.org/errata34.html</url>
 </references>
 <dates>
 <discovery>2004-03-17</discovery>
 <entry>2004-03-31</entry>
 <modified>2004-09-14</modified>
 </dates>
 </vuln>

<vuln vid="00644f03-fb58-11d8-9837-000c41e2cdad">
 <topic>imlib -- BMP decoder heap buffer overflow</topic>
 <affects>
 <package>
	<name>imlib</name>
	<range><lt>1.9.14_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marcus Meissner discovered that imlib's BMP decoder would
	 crash when loading the test BMP file created by Chris Evans
	 for testing the previous Qt vulnerability. It is believed
	 that this bug could be exploited for arbitrary code execution.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0817</cvename>
 <url>http://bugzilla.gnome.org/show_bug.cgi?id=151034</url>
 </references>
 <dates>
 <discovery>2004-08-25</discovery>
 <entry>2004-08-31</entry>
 <modified>2004-09-02</modified>
 </dates>
 </vuln>

<vuln vid="86a98b57-fb8e-11d8-9343-000a95bc6fae">
 <topic>krb5 -- double-free vulnerabilities</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><le>1.3.4_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An advisory published by the MIT Kerberos team says:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt">
	 The MIT Kerberos 5 implementation's Key Distribution Center
	 (KDC) program contains a double-free vulnerability that
	 potentially allows a remote attacker to execute arbitrary code.
	 Compromise of a KDC host compromises the security of the entire
	 authentication realm served by the KDC. Additionally, double-free
	 vulnerabilities exist in MIT Kerberos 5 library code, making
	 client programs and application servers vulnerable.
	</blockquote>
	Double-free vulnerabilities of this type are not believed to be
	 exploitable for code execution on FreeBSD systems. However,
	 the potential for other ill effects may exist.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0642</cvename>
 <cvename>CVE-2004-0643</cvename>
 <cvename>CVE-2004-0772</cvename>
 <certvu>795632</certvu>
 <certvu>866472</certvu>
 <certvu>350792</certvu>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt</url>
 </references>
 <dates>
 <discovery>2004-08-31</discovery>
 <entry>2004-08-31</entry>
 </dates>
 </vuln>

<vuln vid="bd60922b-fb8d-11d8-a13e-000a95bc6fae">
 <topic>krb5 -- ASN.1 decoder denial-of-service vulnerability</topic>
 <affects>
 <package>
	<name>krb5</name>
	<range><ge>1.2.2</ge><le>1.3.4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An advisory published by the MIT Kerberos team says:
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-003-asn1.txt">
	 The ASN.1 decoder library in the MIT Kerberos 5 distribution
	 is vulnerable to a denial-of-service attack causing an infinite
	 loop in the decoder. The KDC is vulnerable to this attack.
	 An unauthenticated remote attacker can cause a KDC or application
	 server to hang inside an infinite loop.
	 An attacker impersonating a legitimate KDC or application
	 server may cause a client program to hang inside an infinite
	 loop.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0644</cvename>
 <certvu>550464</certvu>
 <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-003-asn1.txt</url>
 </references>
 <dates>
 <discovery>2004-08-31</discovery>
 <entry>2004-08-31</entry>
 </dates>
 </vuln>

<vuln vid="ba005226-fb5b-11d8-9837-000c41e2cdad">
 <topic>imlib2 -- BMP decoder buffer overflow</topic>
 <affects>
 <package>
	<name>imlib2</name>
	<range><le>1.1.1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Marcus Meissner discovered that imlib2's BMP decoder would
	 crash when loading the test BMP file created by Chris Evans
	 for testing the previous Qt vulnerability. There appears to
	 be both a stack-based and a heap-based buffer overflow that
	 are believed to be exploitable for arbitrary code execution.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0802</cvename>
 <url>http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/ChangeLog?rev=1.20&amp;view=markup</url>
 </references>
 <dates>
 <discovery>2004-08-31</discovery>
 <entry>2004-08-31</entry>
 </dates>
 </vuln>

<vuln vid="0d3a5148-f512-11d8-9837-000c41e2cdad">
 <topic>SpamAssassin -- denial-of-service in tokenize_headers</topic>
 <affects>
 <package>
	<name>p5-Mail-SpamAssassin</name>
	<range><lt>2.64</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	According to the SpamAssassin 2.64 release announcement:
	<blockquote cite="http://marc.theaimsgroup.com/?l=spamassassin-announce&amp;m=109168121628767">
	 Security fix prevents a denial of service attack open
	 to certain malformed messages; this DoS affects all
	 SpamAssassin 2.5x and 2.6x versions to date.
	</blockquote>
	The issue appears to be triggered by overly long message
	 headers.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0796</cvename>
 <bid>10957</bid>
 <mlist>http://marc.theaimsgroup.com/?l=spamassassin-announce&amp;m=109168121628767</mlist>
 <url>http://search.cpan.org/src/JMASON/Mail-SpamAssassin-2.64/Changes</url>
 </references>
 <dates>
 <discovery>2004-08-04</discovery>
 <entry>2004-08-23</entry>
 <modified>2004-08-28</modified>
 </dates>
 </vuln>

<vuln vid="c4b025bb-f05d-11d8-9837-000c41e2cdad">
 <topic>tnftpd -- remotely exploitable vulnerability</topic>
 <affects>
 <package>
	<name>tnftpd</name>
	<range><lt>20040810</lt></range>
 </package>
 <package>
	<name>lukemftpd</name>
	<range><ge>0</ge></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><le>4.7</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	lukemftpd(8) is an enhanced BSD FTP server produced
	 within the NetBSD project. The sources for lukemftpd are
	 shipped with some versions of FreeBSD, however it is not
	 built or installed by default. The build system option
	 WANT_LUKEMFTPD must be set to build and install lukemftpd.
	 [NOTE: An exception is FreeBSD 4.7-RELEASE,
	 wherein lukemftpd was installed, but not enabled, by
	 default.]
	Przemyslaw Frasunek discovered several vulnerabilities
	 in lukemftpd arising from races in the out-of-band signal
	 handling code used to implement the ABOR command. As a
	 result of these races, the internal state of the FTP server
	 may be manipulated in unexpected ways.
	A remote attacker may be able to cause FTP commands to
	 be executed with the privileges of the running lukemftpd
	 process. This may be a low-privilege `ftp' user if the `-r'
	 command line option is specified, or it may be superuser
	 privileges if `-r' is *not* specified.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0794</cvename>
 <bid>10967</bid>
 <url>http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpd.c#rev1.158</url>
 <url>ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-009.txt.asc</url>
 <mlist msgid="412239E7.1070807@freebsd.lublin.pl">http://lists.netsys.com/pipermail/full-disclosure/2004-August/025418.html</mlist>
 </references>
 <dates>
 <discovery>2004-08-17</discovery>
 <entry>2004-08-17</entry>
 <modified>2016-08-11</modified>
 </dates>
 </vuln>

<vuln vid="e5e2883d-ceb9-11d8-8898-000d6111a684">
 <topic>MySQL authentication bypass / buffer overflow</topic>
 <affects>
 <package>
	<name>mysql-server</name>
	<range><ge>4.1</ge><lt>4.1.3</lt></range>
	<range><ge>5</ge><le>5.0.0_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	By submitting a carefully crafted authentication packet, it is
	 possible for an attacker to bypass password authentication in MySQL
	 4.1. Using a similar method, a stack buffer used in the authentication
	 mechanism can be overflowed.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0627</cvename>
 <cvename>CVE-2004-0628</cvename>
 <certvu>184030</certvu>
 <certvu>645326</certvu>
 <url>http://www.nextgenss.com/advisories/mysql-authbypass.txt</url>
 <url>http://dev.mysql.com/doc/mysql/en/News-4.1.3.html</url>
 <url>http://secunia.com/advisories/12020</url>
 <url>http://www.osvdb.org/7475</url>
 <url>http://www.osvdb.org/7476</url>
 <mlist msgid="Pine.LNX.4.44.0407080940550.9602-200000@pineapple.shacknet.nu">http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0003.html</mlist>
 </references>
 <dates>
 <discovery>2004-07-01</discovery>
 <entry>2004-07-05</entry>
 <modified>2004-08-28</modified>
 </dates>
 </vuln>

<vuln vid="e811aaf1-f015-11d8-876f-00902714cc7c">
 <topic>Ruby insecure file permissions in the CGI session management</topic>
 <affects>
 <package>
	<name>ruby</name>
	<range><lt>1.6.8.2004.07.26</lt></range>
	<range><ge>1.7.0</ge><lt>1.8.1.2004.07.23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	According to a Debian Security Advisory:
	<blockquote cite="http://www.debian.org/security/2004/dsa-537">
	 Andres Salomon noticed a problem in the CGI session
	 management of Ruby, an object-oriented scripting language.
	 CGI::Session's FileStore (and presumably PStore [...])
	 implementations store session information insecurely.
	 They simply create files, ignoring permission issues.
	 This can lead an attacker who has also shell access to the
	 webserver to take over a session.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0755</cvename>
 <url>http://xforce.iss.net/xforce/xfdb/16996</url>
 <url>http://www.debian.org/security/2004/dsa-537</url>
 <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109267579822250&amp;w=2</mlist>
 </references>
 <dates>
 <discovery>2004-08-16</discovery>
 <entry>2004-08-16</entry>
 <modified>2004-08-28</modified>
 </dates>
 </vuln>

<vuln vid="207f8ff3-f697-11d8-81b0-000347a4fa7d">
 <topic>nss -- exploitable buffer overflow in SSLv2 protocol handler</topic>
 <affects>
 <package>
	<name>nss</name>
	<range><lt>3.9.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ISS X-Force reports that a remotely exploitable buffer
	 overflow exists in the Netscape Security Services (NSS)
	 library's implementation of SSLv2. From their advisory:
	<blockquote cite="http://xforce.iss.net/xforce/alerts/id/180">
	 The NSS library contains a flaw in SSLv2 record parsing
	 that may lead to remote compromise. When parsing the
	 first record in an SSLv2 negotiation, the client hello
	 message, the server fails to validate the length of a
	 record field. As a result, it is possible for an attacker
	 to trigger a heap-based overflow of arbitrary length.
	</blockquote>
	Note that the vulnerable NSS library is also present in
	 Mozilla-based browsers. However, it is not believed that
	 browsers are affected, as the vulnerability is present only in
	 code used by SSLv2 *servers*.
 </body>
 </description>
 <references>
 <url>http://xforce.iss.net/xforce/alerts/id/180</url>
 <url>http://www.osvdb.org/9116</url>
 <url>http://secunia.com/advisories/12362</url>
 <bid>11015</bid>
 </references>
 <dates>
 <discovery>2004-08-23</discovery>
 <entry>2004-08-27</entry>
 </dates>
 </vuln>

<vuln vid="85e19dff-e606-11d8-9b0a-000347a4fa7d">
 <topic>ripMIME -- decoding bug allowing content filter bypass</topic>
 <affects>
 <package>
	<name>ripmime</name>
	<range><lt>1.3.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	ripMIME may prematurely terminate decoding Base64 encoded
	 messages when it encounters multiple blank lines or other
	 non-standard Base64 constructs. Virus scanning and content
	 filtering tools that use ripMIME may therefore be
	 bypassed.
	The ripMIME CHANGELOG file says:
	<blockquote cite="http://www.pldaniels.com/ripmime/CHANGELOG">
	 There's viruses going around exploiting the ability to
	 hide the majority of their data in an attachment by using
	 blank lines and other tricks to make scanning systems
	 prematurely terminate their base64 decoding.
	</blockquote>
 </body>
 </description>
 <references>
 <bid>10848</bid>
 <url>http://www.osvdb.org/8287</url>
 <url>http://www.pldaniels.com/ripmime/CHANGELOG</url>
 <url>http://secunia.com/advisories/12201</url>
 <url>http://xforce.iss.net/xforce/xfdb/16867</url>
 </references>
 <dates>
 <discovery>2004-07-30</discovery>
 <entry>2004-08-27</entry>
 </dates>
 </vuln>

<vuln vid="1ecf4ca1-f7ad-11d8-96c9-00061bc2ad93">
 <topic>moinmoin -- ACL group bypass</topic>
 <affects>
 <package>
	<name>moinmoin</name>
	<range><lt>1.2.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The moinmoin package contains two bugs with ACLs and anonymous
	 users. Both bugs may permit anonymous users to gain access to
	 administrative functions; for example the delete function.
	There is no known workaround, the vulnerability exists regardless
	 if a site is using ACLs or not.
 </body>
 </description>
 <references>
 <url>http://www.osvdb.org/8194</url>
 <url>http://www.osvdb.org/8195</url>
 <url>http://security.gentoo.org/glsa/glsa-200408-25.xml</url>
 <url>http://secunia.com/advisories/11832</url>
 <bid>10805</bid>
 <bid>10801</bid>
 </references>
 <dates>
 <discovery>2004-07-21</discovery>
 <entry>2004-08-26</entry>
 </dates>
 </vuln>

<vuln vid="2689f4cb-ec4c-11d8-9440-000347a4fa7d">
 <topic>rsync -- path sanitizing vulnerability</topic>
 <affects>
 <package>
	<name>rsync</name>
	<range><lt>2.6.2_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An rsync security advisory reports:
	<blockquote cite="http://samba.org/rsync/#security_aug04">
	 There is a path-sanitizing bug that affects daemon mode in
	 all recent rsync versions (including 2.6.2) but only if
	 chroot is disabled.
	</blockquote>
	The bug may allow a remote user to access files outside
	 of an rsync module's configured path with the privileges
	 configured for that module.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0792</cvename>
 <url>http://samba.org/rsync/#security_aug04</url>
 <mlist>http://lists.samba.org/archive/rsync-announce/2004/000017.html</mlist>
 <url>http://secunia.com/advisories/12294</url>
 <url>http://www.osvdb.org/8829</url>
 </references>
 <dates>
 <discovery>2004-08-12</discovery>
 <entry>2004-08-26</entry>
 </dates>
 </vuln>

<vuln vid="7884d56f-f7a1-11d8-9837-000c41e2cdad">
 <topic>gnomevfs -- unsafe URI handling</topic>
 <affects>
 <package>
	<name>gnomevfs2</name>
	<range><lt>2.6.2_1</lt></range>
 </package>
 <package>
	<name>gnomevfs</name>
	<range><lt>1.0.5_6</lt></range>
 </package>
 <package>
	<name>mc</name>
	<range><le>4.6.0_12</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Alexander Larsson reports that some versions of gnome-vfs and
	 MidnightCommander contain a number of `extfs' scripts that do not
	 properly validate user input. If an attacker can cause her
	 victim to process a specially-crafted URI, arbitrary commands
	 can be executed with the privileges of the victim.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0494</cvename>
 <bid>10864</bid>
 <url>http://www.ciac.org/ciac/bulletins/o-194.shtml</url>
 <url>http://xforce.iss.net/xforce/xfdb/16897</url>
 <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127263</url>
 </references>
 <dates>
 <discovery>2004-08-04</discovery>
 <entry>2004-08-26</entry>
 </dates>
 </vuln>

<vuln vid="3e4ffe76-e0d4-11d8-9b0a-000347a4fa7d">
 <topic>SoX buffer overflows when handling .WAV files</topic>
 <affects>
 <package>
	<name>sox</name>
	<range><gt>12.17.1</gt><le>12.17.4_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ulf Härnhammar discovered a pair of buffer overflows in the
	 WAV file handling code of SoX. If an attacker can cause her
	 victim to process a specially-crafted WAV file with SoX (e.g.
	 through social engineering or through some other program that
	 relies on SoX), arbitrary code can be executed with the
	 privileges of the victim.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0557</cvename>
 <mlist msgid="1091040793.4107f6193d81a@webmail.uu.se">http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0014.html</mlist>
 <url>http://secunia.com/advisories/12175</url>
 <url>http://www.osvdb.org/8267</url>
 </references>
 <dates>
 <discovery>2004-07-28</discovery>
 <entry>2004-08-26</entry>
 </dates>
 </vuln>

<vuln vid="2797b27a-f55b-11d8-81b0-000347a4fa7d">
 <topic>kdelibs -- konqueror cross-domain cookie injection</topic>
 <affects>
 <package>
	<name>kdelibs</name>
	<range><lt>3.2.3_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	According to a KDE Security Advisory:
	<blockquote cite="http://www.kde.org/info/security/advisory-20040823-1.txt">
	 WESTPOINT internet reconnaissance services alerted the
	 KDE security team that the KDE web browser Konqueror
	 allows websites to set cookies for certain country
	 specific secondary top level domains.
	 Web sites operating under the affected domains can
	 set HTTP cookies in such a way that the Konqueror web
	 browser will send them to all other web sites operating
	 under the same domain. A malicious website can use
	 this as part of a session fixation attack. See e.g.
	 http://www.acros.si/papers/session_fixation.pdf
	 Affected are all country specific secondary top level
	 domains that use more than 2 characters in the secondary
	 part of the domain name and that use a secondary part other
	 than com, net, mil, org, gov, edu or int. Examples of
	 affected domains are .ltd.uk, .plc.uk and .firm.in
	It should be noted that popular domains such as .co.uk, .co.in
	 and .com are NOT affected.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0746</cvename>
 <url>http://www.kde.org/info/security/advisory-20040823-1.txt</url>
 <url>http://www.osvdb.org/9117</url>
 <url>http://secunia.com/advisories/12341</url>
 <url>http://www.acros.si/papers/session_fixation.pdf</url>
 <bid>10991</bid>
 </references>
 <dates>
 <discovery>2004-08-23</discovery>
 <entry>2004-08-26</entry>
 </dates>
 </vuln>

<vuln vid="3243e839-f489-11d8-9837-000c41e2cdad">
 <topic>fidogate -- write files as `news' user</topic>
 <affects>
 <package>
	<name>fidogate</name>
	<range><lt>4.4.9_3</lt></range>
 </package>
 <package>
	<name>fidogate-ds</name>
	<range><lt>5.1.1_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Neils Heinen reports that the setuid `news' binaries
	 installed as part of fidogate may be used to create files or
	 append to file with the privileges of the `news' user by
	 setting the LOGFILE environmental variable.
 </body>
 </description>
 <references>
 <url>http://cvs.sourceforge.net/viewcvs.py/fidogate/fidogate/ChangeLog?rev=4.320&amp;view=markup</url>
 </references>
 <dates>
 <discovery>2004-08-21</discovery>
 <entry>2004-08-22</entry>
 <modified>2004-08-23</modified>
 </dates>
 </vuln>

<vuln vid="65a17a3f-ed6e-11d8-aff1-00061bc2ad93">
 <topic>Arbitrary code execution via a format string vulnerability in jftpgw</topic>
 <affects>
 <package>
	<name>jftpgw</name>
	<range><lt>0.13.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The log functions in jftpgw may allow
	 remotely authenticated user to execute
	 arbitrary code via the format string
	 specifiers in certain syslog messages.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0448</cvename>
 <url>http://www.debian.org/security/2004/dsa-510</url>
 <bid>10438</bid>
 <url>http://xforce.iss.net/xforce/xfdb/16271</url>
 </references>
 <dates>
 <discovery>2004-05-30</discovery>
 <entry>2004-08-13</entry>
 <modified>2004-08-23</modified>
 </dates>
 </vuln>

<vuln vid="ebffe27a-f48c-11d8-9837-000c41e2cdad">
 <topic>qt -- image loader vulnerabilities</topic>
 <affects>
 <package>
	<name>qt</name>
	<range><lt>3.3.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Qt contains several vulnerabilities related to image
	 loading, including possible crashes when loading corrupt
	 GIF, BMP, or JPEG images. Most seriously, Chris Evans
	 reports that the BMP crash is actually due to a heap
	 buffer overflow. It is believed that an attacker may be
	 able to construct a BMP image that could cause a Qt-using
	 application to execute arbitrary code when it is loaded.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0691</cvename>
 <cvename>CVE-2004-0692</cvename>
 <cvename>CVE-2004-0693</cvename>
 <url>http://www.trolltech.com/developer/changes/changes-3.3.3.html</url>
 <url>http://scary.beasts.org/security/CESA-2004-004.txt</url>
 </references>
 <dates>
 <discovery>2004-08-11</discovery>
 <entry>2004-08-22</entry>
 </dates>
 </vuln>

<vuln vid="616cf823-f48b-11d8-9837-000c41e2cdad">
 <topic>courier-imap -- format string vulnerability in debug mode</topic>
 <affects>
 <package>
	<name>courier-imap</name>
	<range><lt>3.0.7,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An iDEFENSE security advisory describes a format string
	 vulnerability that could be exploited when Courier-IMAP is run
	 in debug mode (DEBUG_LOGIN set).
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0777</cvename>
 <mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-August/025478.html</mlist>
 <url>http://www.idefense.com/application/poi/display?id=131&amp;type=vulnerabilities&amp;flashstatus=false</url>
 <bid>10976</bid>
 </references>
 <dates>
 <discovery>2004-08-18</discovery>
 <entry>2004-08-22</entry>
 <modified>2013-06-19</modified>
 </dates>
 </vuln>

<vuln vid="0c4d5973-f2ab-11d8-9837-000c41e2cdad">
 <topic>mysql -- mysqlhotcopy insecure temporary file creation</topic>
 <affects>
 <package>
	<name>mysql-scripts</name>
	<range><le>3.23.58</le></range>
	<range><gt>4</gt><le>4.0.20</le></range>
	<range><gt>4.1</gt><le>4.1.3</le></range>
	<range><gt>5</gt><le>5.0.0_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	According to Christian Hammers:
	<blockquote cite="http://packages.debian.org/changelogs/pool/main/m/mysql-dfsg/mysql-dfsg_4.0.20-11/changelog">
	 [mysqlhotcopy created] temporary files in /tmp which
	 had predictable filenames and such could be used for a
	 tempfile run attack.
	</blockquote>
	Jeroen van Wolffelaar is credited with discovering the issue.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0457</cvename>
 <url>http://www.debian.org/security/2004/dsa-540</url>
 <mlist>http://lists.mysql.com/internals/15185</mlist>
 </references>
 <dates>
 <discovery>2004-08-18</discovery>
 <entry>2004-08-22</entry>
 </dates>
 </vuln>

<vuln vid="2de14f7a-dad9-11d8-b59a-00061bc2ad93">
 <topic>Multiple Potential Buffer Overruns in Samba</topic>
 <affects>
 <package>
	<name>samba</name>
	<range><gt>3.*</gt><lt>3.0.5</lt></range>
	<range><gt>3.*,1</gt><lt>3.0.5,1</lt></range>
	<range><lt>2.2.10</lt></range>
 </package>
 <package>
	<name>ja-samba</name>
	<range><lt>2.2.10.j1.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Evgeny Demidov discovered that the Samba server has a
	 buffer overflow in the Samba Web Administration Tool (SWAT)
	 on decoding Base64 data during HTTP Basic Authentication.
	 Versions 3.0.2 through 3.0.4 are affected.
	Another buffer overflow bug has been found in the code
	 used to support the "mangling method = hash" smb.conf
	 option. The default setting for this parameter is "mangling
	 method = hash2" and therefore not vulnerable. Versions
	 between 2.2.0 through 2.2.9 and 3.0.0 through 3.0.4 are affected.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0600</cvename>
 <cvename>CVE-2004-0686</cvename>
 <mlist msgid="web-53121174@cgp.agava.net">http://www.securityfocus.com/archive/1/369698</mlist>
 <mlist msgid="200407222031.25086.bugtraq@beyondsecurity.com">http://www.securityfocus.com/archive/1/369706</mlist>
 <url>http://www.samba.org/samba/whatsnew/samba-3.0.5.html</url>
 <url>http://www.samba.org/samba/whatsnew/samba-2.2.10.html</url>
 <url>http://www.osvdb.org/8190</url>
 <url>http://www.osvdb.org/8191</url>
 <url>http://secunia.com/advisories/12130</url>
 </references>
 <dates>
 <discovery>2004-07-14</discovery>
 <entry>2004-07-21</entry>
 <modified>2008-09-26</modified>
 </dates>
 </vuln>

<vuln vid="730db824-e216-11d8-9b0a-000347a4fa7d">
 <topic>Mozilla / Firefox user interface spoofing vulnerability</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><le>0.9.1_1</le></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<range><le>1.7.1</le></range>
 </package>
 <package>
	<name>linux-mozilla-devel</name>
	<range><le>1.7.1</le></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><le>1.7.1,2</le></range>
	<range><ge>1.8.a,2</ge><le>1.8.a2,2</le></range>
 </package>
 <package>
	<name>mozilla-gtk1</name>
	<range><le>1.7.1_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Mozilla project's family of browsers contain a design
	 flaw that can allow a website to spoof almost perfectly any
	 part of the Mozilla user interface, including spoofing web
	 sites for phishing or internal elements such as the "Master
	 Password" dialog box. This achieved by manipulating "chrome"
	 through remote XUL content. Recent versions of Mozilla have
	 been fixed to not allow untrusted documents to utilize
	 "chrome" in this way.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0764</cvename>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=22183</url>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=244965</url>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=252198</url>
 <url>http://www.nd.edu/~jsmith30/xul/test/spoof.html</url>
 <url>http://secunia.com/advisories/12188</url>
 <bid>10832</bid>
 </references>
 <dates>
 <discovery>2004-07-19</discovery>
 <entry>2004-07-30</entry>
 <modified>2004-08-15</modified>
 </dates>
 </vuln>

<vuln vid="f9e3e60b-e650-11d8-9b0a-000347a4fa7d">
 <topic>libpng stack-based buffer overflow and other code concerns</topic>
 <affects>
 <package>
	<name>png</name>
	<range><le>1.2.5_7</le></range>
 </package>
 <package>
	<name>linux-png</name>
	<range><le>1.0.14_3</le></range>
	<range><ge>1.2</ge><le>1.2.2</le></range>
 </package>
 <package>
	<name>firefox</name>
	<range><lt>0.9.3</lt></range>
 </package>
 <package>
	<name>thunderbird</name>
	<range><lt>0.7.3</lt></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<range><lt>1.7.2</lt></range>
 </package>
 <package>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.2</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.2,2</lt></range>
	<range><ge>1.8.a,2</ge><le>1.8.a2,2</le></range>
 </package>
 <package>
	<name>mozilla-gtk1</name>
	<range><lt>1.7.2</lt></range>
 </package>
 <package>
	<name>netscape-communicator</name>
	<name>netscape-navigator</name>
	<range><le>4.78</le></range>
 </package>
 <package>
	<name>linux-netscape-communicator</name>
	<name>linux-netscape-navigator</name>
	<name>ko-netscape-navigator-linux</name>
	<name>ko-netscape-communicator-linux</name>
	<name>ja-netscape-communicator-linux</name>
	<name>ja-netscape-navigator-linux</name>
	<range><le>4.8</le></range>
 </package>
 <package>
	<name>netscape7</name>
	<name>ja-netscape7</name>
	<range><le>7.1</le></range>
 </package>
 <package>
	<name>pt_BR-netscape7</name>
	<name>fr-netscape7</name>
	<name>de-netscape7</name>
	<range><le>7.02</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chris Evans has discovered multiple vulnerabilities in libpng,
	 which can be exploited by malicious people to compromise a
	 vulnerable system or cause a DoS (Denial of Service).
 </body>
 </description>
 <references>
 <mlist msgid="Pine.LNX.4.58.0408041840080.20655@sphinx.mythic-beasts.com">http://www.securityfocus.com/archive/1/370853</mlist>
 <url>http://scary.beasts.org/security/CESA-2004-001.txt</url>
 <url>http://www.osvdb.org/8312</url>
 <url>http://www.osvdb.org/8313</url>
 <url>http://www.osvdb.org/8314</url>
 <url>http://www.osvdb.org/8315</url>
 <url>http://www.osvdb.org/8316</url>
 <cvename>CVE-2004-0597</cvename>
 <cvename>CVE-2004-0598</cvename>
 <cvename>CVE-2004-0599</cvename>
 <certvu>388984</certvu>
 <certvu>236656</certvu>
 <certvu>160448</certvu>
 <certvu>477512</certvu>
 <certvu>817368</certvu>
 <certvu>286464</certvu>
 <url>http://secunia.com/advisories/12219</url>
 <url>http://secunia.com/advisories/12232</url>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=251381</url>
 <uscertta>TA04-217A</uscertta>
 <url>http://dl.sourceforge.net/sourceforge/libpng/ADVISORY.txt</url>
 </references>
 <dates>
 <discovery>2004-08-04</discovery>
 <entry>2004-08-04</entry>
 <modified>2004-08-15</modified>
 </dates>
 </vuln>

<vuln vid="603fe36d-ec9d-11d8-b913-000c41e2cdad">
 <topic>kdelibs insecure temporary file handling</topic>
 <affects>
 <package>
	<name>kdelibs</name>
	<range><le>3.2.3_3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	According to a KDE Security Advisory, KDE may sometimes
	 create temporary files without properly checking the ownership
	 and type of the target path.	This could allow a local
	 attacker to cause KDE applications to overwrite arbitrary
	 files.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0689</cvename>
 <cvename>CVE-2004-0690</cvename>
 <url>http://www.kde.org/info/security/advisory-20040811-1.txt</url>
 <url>http://www.kde.org/info/security/advisory-20040811-2.txt</url>
 <url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-kstandarddirs.patch</url>
 <url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-dcopserver.patch</url>
 </references>
 <dates>
 <discovery>2004-08-11</discovery>
 <entry>2004-08-12</entry>
 </dates>
 </vuln>

<vuln vid="5b8f9a02-ec93-11d8-b913-000c41e2cdad">
 <topic>gaim remotely exploitable vulnerabilities in MSN component</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>0.81_1</lt></range>
 </package>
 <package>
	<name>gaim</name>
	<range><ge>20030000</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Sebastian Krahmer discovered several remotely exploitable
	 buffer overflow vulnerabilities in the MSN component of
	 gaim.
	<blockquote cite="http://gaim.sourceforge.net/security/?id=0">
	 In two places in the MSN protocol plugins (object.c and
	 slp.c), strncpy was used incorrectly; the size of the array
	 was not checked before copying to it. Both bugs affect MSN's
	 MSNSLP protocol, which is peer-to-peer, so this could
	 potentially be easy to exploit.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0500</cvename>
 <url>http://gaim.sourceforge.net/security/?id=0</url>
 </references>
 <dates>
 <discovery>2004-08-12</discovery>
 <entry>2004-08-12</entry>
 <modified>2004-10-25</modified>
 </dates>
 </vuln>

<vuln vid="78348ea2-ec91-11d8-b913-000c41e2cdad">
 <topic>acroread uudecoder input validation error</topic>
 <affects>
 <package>
	<name>acroread</name>
	<name>acroread4</name>
	<name>acroread5</name>
	<range><lt>5.0.9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An iDEFENSE security advisory reports:
	<blockquote cite="www.idefense.com/application/poi/display?id=124&amp;type=vulnerabilities">
	 Remote exploitation of an input validation error in the
	 uudecoding feature of Adobe Acrobat Reader (Unix) 5.0
	 allows an attacker to execute arbitrary code.
	 The Unix and Linux versions of Adobe Acrobat Reader 5.0
	 automatically attempt to convert uuencoded documents
	 back into their original format. The vulnerability
	 specifically exists in the failure of Acrobat Reader to
	 check for the backtick shell metacharacter in the filename
	 before executing a command with a shell. This allows a
	 maliciously constructed filename to execute arbitrary
	 programs.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0630</cvename>
 <url>http://www.idefense.com/application/poi/display?id=124&amp;type=vulnerabilities</url>
 </references>
 <dates>
 <discovery>2004-08-12</discovery>
 <entry>2004-08-12</entry>
 <modified>2005-01-06</modified>
 </dates>
 </vuln>

<vuln vid="12c7b7ae-ec90-11d8-b913-000c41e2cdad">
 <topic>popfile file disclosure</topic>
 <affects>
 <package>
	<name>popfile</name>
	<range><le>0.21.1_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	John Graham-Cumming reports that certain configurations of
	 POPFile may allow the retrieval of any files with the
	 extensions .gif, .png, .ico, .css, as well as some files with
	 the extension .html.
 </body>
 </description>
 <references>
 <mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=5248725&amp;forum_id=12356</mlist>
 </references>
 <dates>
 <discovery>2004-08-02</discovery>
 <entry>2004-08-12</entry>
 </dates>
 </vuln>

<vuln vid="7a9d5dfe-c507-11d8-8898-000d6111a684">
 <topic>isc-dhcp3-server buffer overflow in logging mechanism</topic>
 <affects>
 <package>
	<name>isc-dhcp3-relay</name>
	<name>isc-dhcp3-server</name>
	<range><ge>3.0.1.r12</ge><lt>3.0.1.r14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A buffer overflow exists in the logging functionality
	 of the DHCP daemon which could lead to Denial of Service
	 attacks and has the potential to allow attackers to
	 execute arbitrary code.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0460</cvename>
 <url>http://www.osvdb.org/7237</url>
 <uscertta>TA04-174A</uscertta>
 <certvu>317350</certvu>
 <mlist msgid="BAY13-F94UHMuEEkHMz0005c4f7@hotmail.com">http://www.securityfocus.com/archive/1/366801</mlist>
 <mlist msgid="40DFAB69.1060909@sympatico.ca">http://www.securityfocus.com/archive/1/367286</mlist>
 </references>
 <dates>
 <discovery>2004-06-22</discovery>
 <entry>2004-06-25</entry>
 <modified>2004-08-12</modified>
 </dates>
 </vuln>

<vuln vid="3a408f6f-9c52-11d8-9366-0020ed76ef5a">
 <topic>libpng denial-of-service</topic>
 <affects>
 <package>
	<name>linux-png</name>
	<range><le>1.0.14_3</le></range>
	<range><ge>1.2</ge><le>1.2.2</le></range>
 </package>
 <package>
	<name>png</name>
	<range><lt>1.2.5_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Steve Grubb reports a buffer read overrun in
	 libpng's png_format_buffer function.	A specially
	 constructed PNG image processed by an application using
	 libpng may trigger the buffer read overrun and possibly
	 result in an application crash.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0421</cvename>
 <url>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=120508</url>
 <url>http://rhn.redhat.com/errata/RHSA-2004-181.html</url>
 <url>http://secunia.com/advisories/11505</url>
 <url>http://www.osvdb.org/5726</url>
 <bid>10244</bid>
 </references>
 <dates>
 <discovery>2004-04-29</discovery>
 <entry>2004-05-02</entry>
 <modified>2004-08-12</modified>
 </dates>
 </vuln>

<vuln vid="abe47a5a-e23c-11d8-9b0a-000347a4fa7d">
 <topic>Mozilla certificate spoofing</topic>
 <affects>
 <package>
	<name>firefox</name>
	<range><ge>0.9.1</ge><le>0.9.2</le></range>
 </package>
 <package>
	<name>linux-mozilla</name>
	<range><lt>1.7.2</lt></range>
 </package>
 <package>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.2</lt></range>
 </package>
 <package>
	<name>mozilla</name>
	<range><lt>1.7.2,2</lt></range>
	<range><ge>1.8,2</ge><le>1.8.a2,2</le></range>
 </package>
 <package>
	<name>mozilla-gtk1</name>
	<range><lt>1.7.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mozilla and Mozilla Firefox contains a flaw that may
	 allow a malicious user to spoof SSL certification.
 </body>
 </description>
 <references>
 <mlist msgid="003a01c472ba$b2060900$6501a8c0@sec">http://www.securityfocus.com/archive/1/369953</mlist>
 <url>http://www.cipher.org.uk/index.php?p=advisories/Certificate_Spoofing_Mozilla_FireFox_25-07-2004.advisory</url>
 <url>http://secunia.com/advisories/12160</url>
 <url>http://bugzilla.mozilla.org/show_bug.cgi?id=253121</url>
 <url>http://www.osvdb.org/8238</url>
 <bid>10796</bid>
 <cvename>CVE-2004-0763</cvename>
 </references>
 <dates>
 <discovery>2004-07-25</discovery>
 <entry>2004-07-30</entry>
 <modified>2004-08-12</modified>
 </dates>
 </vuln>

<vuln vid="a713c0f9-ec54-11d8-9440-000347a4fa7d">
 <topic>ImageMagick png vulnerability fix</topic>
 <affects>
 <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.0.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Glenn Randers-Pehrson has contributed a fix for the png
	 vulnerabilities discovered by Chris Evans.
 </body>
 </description>
 <references>
 <url>http://studio.imagemagick.org/pipermail/magick-users/2004-August/013218.html</url>
 <url>http://freshmeat.net/releases/169228</url>
 <url>http://secunia.com/advisories/12236</url>
 <url>http://www.freebsd.org/ports/portaudit/f9e3e60b-e650-11d8-9b0a-000347a4fa7d.html</url>
 </references>
 <dates>
 <discovery>2004-08-04</discovery>
 <entry>2004-08-04</entry>
 <modified>2004-08-12</modified>
 </dates>
 </vuln>

<vuln vid="98bd69c3-834b-11d8-a41f-0020ed76ef5a">
 <topic>Courier mail services: remotely exploitable buffer overflows</topic>
 <affects>
 <package>
	<name>courier</name>
	<range><lt>0.45</lt></range>
 </package>
 <package>
	<name>courier-imap</name>
	<range><lt>3.0,1</lt></range>
 </package>
 <package>
	<name>sqwebmail</name>
	<range><lt>4.0</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Courier set of mail services use a common Unicode
	 library. This library contains buffer overflows in the
	 converters for two popular Japanese character encodings.
	 These overflows may be remotely exploitable, triggered by
	 a maliciously formatted email message that is later processed
	 by one of the Courier mail services.
	 From the release notes for the corrected versions of the
	 Courier set of mail services:
	<blockquote>
	 iso2022jp.c: Converters became (upper-)compatible with
	 ISO-2022-JP (RFC1468 / JIS X 0208:1997 Annex 2) and
	 ISO-2022-JP-1 (RFC2237). Buffer overflow vulnerability
	 (when Unicode character is out of BMP range) has been
	 closed. Convert error handling was implemented.
	 shiftjis.c: Broken SHIFT_JIS converters has been fixed
	 and became (upper-)compatible with Shifted Encoding Method
	 (JIS X 0208:1997 Annex 1). Buffer overflow vulnerability
	 (when Unicode character is out of BMP range) has been
	 closed. Convert error handling was implemented.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0224</cvename>
 <url>http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/iso2022jp.c?rev=1.10&amp;view=markup</url>
 <url>http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/shiftjis.c?rev=1.6&amp;view=markup</url>
 <bid>9845</bid>
 <url>http://secunia.com/advisories/11087</url>
 <url>http://www.osvdb.org/4194</url>
 <url>http://www.osvdb.org/6927</url>
 </references>
 <dates>
 <discovery>2004-02-01</discovery>
 <entry>2004-03-31</entry>
 <modified>2004-07-16</modified>
 </dates>
 </vuln>

<vuln vid="cdf18ed9-7f4a-11d8-9645-0020ed76ef5a">
 <topic>multiple vulnerabilities in ethereal</topic>
 <affects>
 <package>
	<name>ethereal</name>
	<name>tethereal</name>
	<range><lt>0.10.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Esser of e-matters Security discovered a baker's dozen
	 of buffer overflows in Ethereal's decoders, including:
	<ul>
	 <li>NetFlow</li>
	 <li>IGAP</li>
	 <li>EIGRP</li>
	 <li>PGM</li>
	 <li>IRDA</li>
	 <li>BGP</li>
	 <li>ISUP</li>
	 <li>TCAP</li>
	 <li>UCP</li>
	</ul>
	In addition, a vulnerability in the RADIUS decoder was found
	 by Jonathan Heusser.
	Finally, there is one uncredited vulnerability described by the
	 Ethereal team as:
	<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00013.html">
	 A zero-length Presentation protocol selector could make
	 Ethereal crash.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.ethereal.com/appnotes/enpa-sa-00013.html</url>
 <cvename>CVE-2004-0176</cvename>
 <cvename>CVE-2004-0365</cvename>
 <cvename>CVE-2004-0367</cvename>
 <certvu>119876</certvu>
 <certvu>124454</certvu>
 <certvu>125156</certvu>
 <certvu>433596</certvu>
 <certvu>591820</certvu>
 <certvu>644886</certvu>
 <certvu>659140</certvu>
 <certvu>695486</certvu>
 <certvu>740188</certvu>
 <certvu>792286</certvu>
 <certvu>864884</certvu>
 <certvu>931588</certvu>
 <url>http://security.e-matters.de/advisories/032004.html</url>
 <url>http://secunia.com/advisories/11185</url>
 <bid>9952</bid>
 <url>http://www.osvdb.org/4462</url>
 <url>http://www.osvdb.org/4463</url>
 <url>http://www.osvdb.org/4464</url>
 </references>
 <dates>
 <discovery>2004-03-23</discovery>
 <entry>2004-03-26</entry>
 <modified>2004-07-11</modified>
 </dates>
 </vuln>

<vuln vid="74d06b67-d2cf-11d8-b479-02e0185c0b53">
 <topic>multiple vulnerabilities in ethereal</topic>
 <affects>
 <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><lt>0.10.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Issues have been discovered in multiple protocol dissectors.
 </body>
 </description>
 <references>
 <url>http://www.ethereal.com/appnotes/enpa-sa-00014.html</url>
 <cvename>CVE-2004-0504</cvename>
 <cvename>CVE-2004-0505</cvename>
 <cvename>CVE-2004-0506</cvename>
 <cvename>CVE-2004-0507</cvename>
 <url>http://secunia.com/advisories/11608</url>
 <bid>10347</bid>
 <url>http://www.osvdb.org/6131</url>
 <url>http://www.osvdb.org/6132</url>
 <url>http://www.osvdb.org/6133</url>
 <url>http://www.osvdb.org/6134</url>
 </references>
 <dates>
 <discovery>2004-05-13</discovery>
 <entry>2004-07-11</entry>
 </dates>
 </vuln>

<vuln vid="265c8b00-d2d0-11d8-b479-02e0185c0b53">
 <topic>multiple vulnerabilities in ethereal</topic>
 <affects>
 <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><lt>0.10.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Issues have been discovered in multiple protocol dissectors.
 </body>
 </description>
 <references>
 <url>http://www.ethereal.com/appnotes/enpa-sa-00015.html</url>
 <cvename>CVE-2004-0633</cvename>
 <cvename>CVE-2004-0634</cvename>
 <cvename>CVE-2004-0635</cvename>
 <url>http://secunia.com/advisories/12024</url>
 <bid>10672</bid>
 <url>http://www.osvdb.org/7536</url>
 <url>http://www.osvdb.org/7537</url>
 <url>http://www.osvdb.org/7538</url>
 </references>
 <dates>
 <discovery>2004-07-06</discovery>
 <entry>2004-07-11</entry>
 </dates>
 </vuln>

<vuln vid="4aec9d58-ce7b-11d8-858d-000d610a3b12">
 <topic>Format string vulnerability in SSLtelnet</topic>
 <affects>
 <package>
	<name>SSLtelnet</name>
	<range><le>0.13_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	SSLtelnet contains a format string vulnerability that could
	 allow remote code execution and privilege escalation.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0640</cvename>
 <url>http://www.idefense.com/application/poi/display?id=114&amp;type=vulnerabilities</url>
 </references>
 <dates>
 <discovery>2003-04-03</discovery>
 <entry>2004-07-05</entry>
 </dates>
 </vuln>

<vuln vid="c5519420-cec2-11d8-8898-000d6111a684">
 <topic>"Content-Type" XSS vulnerability affecting other webmail systems</topic>
 <affects>
 <package>
	<name>openwebmail</name>
	<range><le>2.32</le></range>
 </package>
 <package>
	<name>ilohamail</name>
	<range><lt>0.8.13</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Roman Medina-Heigl Hernandez did a survey which other webmail systems
	 where vulnerable to a bug he discovered in SquirrelMail. This advisory
	 summarizes the results.
 </body>
 </description>
 <references>
 <url>http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-2.txt</url>
 <url>http://www.freebsd.org/ports/portaudit/89a0de27-bf66-11d8-a252-02e0185c0b53.html</url>
 <url>http://www.freebsd.org/ports/portaudit/911f1b19-bd20-11d8-84f9-000bdb1444a4.html</url>
 <url>http://www.freebsd.org/ports/portaudit/c3e56efa-c42f-11d8-864c-02e0185c0b53.html</url>
 <cvename>CVE-2004-0519</cvename>
 </references>
 <dates>
 <discovery>2004-05-29</discovery>
 <entry>2004-07-05</entry>
 </dates>
 </vuln>

<vuln vid="76904dce-ccf3-11d8-babb-000854d03344">
 <topic>Pavuk HTTP Location header overflow</topic>
 <affects>
 <package>
	<name>pavuk</name>
	<range><lt>0.9.28_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	When pavuk sends a request to a web server and the server
	 sends back the HTTP status code 305 (Use Proxy), pavuk
	 copies data from the HTTP Location header in an unsafe
	 manner. This leads to a stack-based buffer overflow with
	 control over EIP.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0456</cvename>
 <mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-July/023322.html</mlist>
 <url>http://www.osvdb.org/7319</url>
 </references>
 <dates>
 <discovery>2004-06-30</discovery>
 <entry>2004-07-03</entry>
 </dates>
 </vuln>

<vuln vid="33ab4a47-bfc1-11d8-b00e-000347a4fa7d">
 <topic>Several vulnerabilities found in PHPNuke</topic>
 <affects>
 <package>
	<name>phpnuke</name>
	<range><lt>7.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Janek Vind "waraxe" reports that several issues in the
	 PHPNuke software may be exploited via carefully crafted
	 URL requests. These URLs will permit the injection of
	 SQL code, cookie theft, and the readability of the
	 PHPNuke administrator account.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0279</cvename>
 <cvename>CVE-2003-0318</cvename>
 <cvename>CVE-2004-0266</cvename>
 <cvename>CVE-2004-0269</cvename>
 <url>http://www.waraxe.us/index.php?modname=sa&amp;id=27</url>
 <url>http://secunia.com/advisories/11920</url>
 </references>
 <dates>
 <discovery>2004-05-05</discovery>
 <entry>2004-07-03</entry>
 <modified>2004-09-28</modified>
 </dates>
 </vuln>

<vuln vid="0d4c31ac-cb91-11d8-8898-000d6111a684">
 <topic>Remote code injection in phpMyAdmin</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><lt>2.5.7.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	This vulnerability would allow remote user to inject PHP code
	 to be executed by eval() function. This vulnerability is only
	 exploitable if variable $cfg['LeftFrameLight'] is set to FALSE (in
	 file config.inc.php).
 </body>
 </description>
 <references>
 <url>http://sf.net/forum/forum.php?forum_id=387635</url>
 <mlist msgid="20040629025752.976.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/367486</mlist>
 <url>http://secunia.com/advisories/11974</url>
 <url>http://eagle.kecapi.com/sec/fd/phpMyAdmin.html</url>
 </references>
 <dates>
 <discovery>2004-06-29</discovery>
 <entry>2004-07-02</entry>
 <modified>2004-09-28</modified>
 </dates>
 </vuln>

<vuln vid="4d837296-cc28-11d8-a54c-02e0185c0b53">
 <topic>GNATS local privilege elevation</topic>
 <affects>
 <package>
	<name>gnats</name>
	<range><le>3.113.1_9</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	GNATS 3.113.1 contains multiple buffer overflows, through which a
	 local attacker could gain elevated privileges on the system.
 </body>
 </description>
 <references>
 <freebsdpr>ports/56006</freebsdpr>
 <mlist msgid="20040625164231.7437.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/326337</mlist>
 <url>http://www.securiteam.com/unixfocus/5CP0N0UAAA.html</url>
 <url>http://secunia.com/advisories/9096</url>
 <url>http://x82.inetcop.org/h0me/adv1sor1es/INCSA.2003-0x82-018-GNATS-bt.txt</url>
 <url>http://www.gnu.org/software/gnats/gnats.html</url>
 <url>http://www.osvdb.org/2190</url>
 <url>http://www.osvdb.org/4600</url>
 <url>http://www.osvdb.org/4601</url>
 <url>http://www.osvdb.org/4607</url>
 </references>
 <dates>
 <discovery>2003-06-21</discovery>
 <entry>2004-07-02</entry>
 </dates>
 </vuln>

<vuln vid="8ecaaca2-cc07-11d8-858d-000d610a3b12">
 <topic>Linux binary compatibility mode input validation error</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>4.9</ge><lt>4.9_10</lt></range>
	<range><ge>4.8</ge><lt>4.8_23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A programming error in the handling of some Linux system
	 calls may result in memory locations being accessed without
	 proper validation.
	It may be possible for a local attacker to read and/or
	 overwrite portions of kernel memory, resulting in disclosure
	 of sensitive information or potential privilege escalation.
	 A local attacker can cause a system panic.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0602</cvename>
 <freebsdsa>SA-04:13.linux</freebsdsa>
 </references>
 <dates>
 <discovery>2004-06-18</discovery>
 <entry>2004-06-30</entry>
 </dates>
 </vuln>

<vuln vid="1f738bda-c6ac-11d8-8898-000d6111a684">
 <topic>Remote Denial of Service of HTTP server and client</topic>
 <affects>
 <package>
	<name>giFT-FastTrack</name>
	<range><lt>0.8.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	giFT-FastTrack is susceptible to a remote
	 Denial of Service attack which could allow
	 a remote attacker to render HTTP services
	 unusable. According to the developers, no
	 code execution is possible; however, they
	 recommend an immediate upgrade.
 </body>
 </description>
 <references>
 <url>http://developer.berlios.de/forum/forum.php?forum_id=5814</url>
 <url>http://www.osvdb.org/7266</url>
 <url>http://secunia.com/advisories/11941</url>
 <bid>10604</bid>
 </references>
 <dates>
 <discovery>2004-06-19</discovery>
 <entry>2004-06-25</entry>
 <modified>2004-06-29</modified>
 </dates>
 </vuln>

<vuln vid="ff00f2ce-c54c-11d8-b708-00061bc2ad93">
 <topic>XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0</topic>
 <affects>
 <package>
	<name>xorg-clients</name>
	<range><eq>6.7.0</eq></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	When the IPv6 code was added to xdm a critical
	 test to disable xdmcp was accidentally removed. This
	 caused xdm to create the chooser socket regardless if
	 DisplayManager.requestPort was disabled in xdm-config
	 or not.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0419</cvename>
 <url>http://bugs.xfree86.org/show_bug.cgi?id=1376</url>
 <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=124900</url>
 </references>
 <dates>
 <discovery>2004-05-19</discovery>
 <entry>2004-06-28</entry>
 <modified>2004-06-28</modified>
 </dates>
 </vuln>

<vuln vid="da9e6438-bfc0-11d8-b00e-000347a4fa7d">
 <topic>MoinMoin administrative group name privilege escalation vulnerability</topic>
 <affects>
 <package>
	<name>moinmoin</name>
	<range><lt>1.2.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A serious flaw exists in the MoinMoin software
	 which may allow a malicious user to gain access to
	 unauthorized privileges.
 </body>
 </description>
 <references>
 <url>http://www.osvdb.org/6704</url>
 <cvename>CVE-2004-0708</cvename>
 <bid>10568</bid>
 <url>http://secunia.com/advisories/11807</url>
 </references>
 <dates>
 <discovery>2004-05-04</discovery>
 <entry>2004-06-28</entry>
 </dates>
 </vuln>

<vuln vid="35f6fdf8-a425-11d8-9c6d-0020ed76ef5a">
 <topic>Cyrus IMAP pre-authentication heap overflow vulnerability</topic>
 <affects>
 <package>
	<name>cyrus-imapd</name>
	<range><lt>2.0.17</lt></range>
	<range><ge>2.1</ge><lt>2.1.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	In December 2002, Timo Sirainen reported:
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=103886607825605">
	 Cyrus IMAP server has a remotely exploitable pre-login
	 buffer overflow. [...] Note that you don't have to log in
	 before exploiting this, and since Cyrus
	 runs everything under one UID, it's possible to read every
	 user's mail in the system.
	</blockquote>
	It is unknown whether this vulnerability is exploitable for code
	 execution on FreeBSD systems.
 </body>
 </description>
 <references>
 <cvename>CVE-2002-1580</cvename>
 <bid>6298</bid>
 <certvu>740169</certvu>
 <mlist msgid="20021202175606.GA26254@irccrew.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=103886607825605</mlist>
 <mlist>http://asg.web.cmu.edu/archive/message.php?mailbox=archive.info-cyrus&amp;msg=19349</mlist>
 </references>
 <dates>
 <discovery>2002-12-02</discovery>
 <entry>2004-05-12</entry>
 <modified>2004-06-27</modified>
 </dates>
 </vuln>

<vuln vid="700d43b4-a42a-11d8-9c6d-0020ed76ef5a">
 <topic>Cyrus IMSPd multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>cyrus-imspd</name>
	<range><lt>1.6a5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Cyrus team reported multiple vulnerabilities in older
	 versions of Cyrus IMSPd:
	<blockquote cite="http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&amp;msg=25">
	 These releases correct a recently discovered buffer
	 overflow vulnerability, as well as clean up a significant
	 amount of buffer handling throughout the code.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist>http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&amp;msg=25</mlist>
 </references>
 <dates>
 <discovery>2004-05-12</discovery>
 <entry>2004-09-20</entry>
 <modified>2013-06-19</modified>
 </dates>
 </vuln>

<vuln vid="5e7f58c3-b3f8-4258-aeb8-795e5e940ff8">
 <topic>mplayer heap overflow in http requests</topic>
 <affects>
 <package>
	<name>mplayer</name>
	<name>mplayer-gtk</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk-esound</name>
	<range><lt>0.92.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A remotely exploitable heap buffer overflow vulnerability was
	 found in MPlayer's URL decoding code. If an attacker can
	 cause MPlayer to visit a specially crafted URL, arbitrary code
	 execution with the privileges of the user running MPlayer may
	 occur. A `visit' might be caused by social engineering, or a
	 malicious web server could use HTTP redirects which MPlayer
	 would then process.
 </body>
 </description>
 <references>
 <url>http://www.mplayerhq.hu/homepage/design6/news.html</url>
 <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108066964709058</mlist>
 <freebsdpr>ports/64974</freebsdpr>
 </references>
 <dates>
 <discovery>2004-03-30</discovery>
 <entry>2004-03-31</entry>
 <modified>2004-06-27</modified>
 </dates>
 </vuln>

<vuln vid="3e9be8c4-8192-11d8-9645-0020ed76ef5a">
 <topic>ecartis buffer overflows and input validation bugs</topic>
 <affects>
 <package>
	<name>ecartis</name>
	<range><lt>1.0.0.s20030814,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Timo Sirainen reports multiple buffer overflows that may be
	 triggered while parsing messages, as well as input validation
	 errors that could result in disclosure of mailing list
	 passwords.
	These bugs were resolved in the August 2003 snapshot of
	 ecartis.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0781</cvename>
 <cvename>CVE-2003-0782</cvename>
 <url>http://www.securiteam.com/unixfocus/5YP0H2AAUY.html</url>
 <freebsdpr>ports/57082</freebsdpr>
 </references>
 <dates>
 <discovery>2003-08-14</discovery>
 <entry>2004-03-29</entry>
 <modified>2004-06-27</modified>
 </dates>
 </vuln>

<vuln vid="c2e10368-77ab-11d8-b9e8-00e04ccb0a62">
 <topic>ModSecurity for Apache 2.x remote off-by-one overflow</topic>
 <affects>
 <package>
	<name>mod_security</name>
	<range><lt>1.7.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	When the directive "SecFilterScanPost" is enabled,
	 the Apache 2.x version of ModSecurity is vulnerable
	 to an off-by-one overflow
 </body>
 </description>
 <references>
 <url>http://www.s-quadra.com/advisories/Adv-20040315.txt</url>
 <bid>9885</bid>
 <url>http://secunia.com/advisories/11138</url>
 <certvu>779438</certvu>
 </references>
 <dates>
 <discovery>2004-02-09</discovery>
 <entry>2004-03-17</entry>
 <modified>2004-06-27</modified>
 </dates>
 </vuln>

<vuln vid="74a9541d-5d6c-11d8-80e3-0020ed76ef5a">
 <topic>clamav remote denial-of-service</topic>
 <affects>
 <package>
	<name>clamav</name>
	<range><lt>0.65_7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	clamav will exit when a programming
	 assertion is not met. A malformed uuencoded message can
	 trigger this assertion, allowing an attacker to trivially
	 crash clamd or other components of clamav.
 </body>
 </description>
 <references>
 <freebsdpr>ports/62586</freebsdpr>
 <mlist msgid="40279811.9050407@fillmore-labs.com">http://www.securityfocus.com/archive/1/353186</mlist>
 <url>http://www.osvdb.org/3894</url>
 <bid>9610</bid>
 <url>http://secunia.com/advisories/10826</url>
 <cvename>CVE-2004-0270</cvename>
 <url>http://xforce.iss.net/xforce/xfdb/15077</url>
 </references>
 <dates>
 <discovery>2004-02-09</discovery>
 <entry>2004-02-12</entry>
 <modified>2004-06-27</modified>
 </dates>
 </vuln>

<vuln vid="8d075001-a9ce-11d8-9c6d-0020ed76ef5a">
 <topic>neon date parsing vulnerability</topic>
 <affects>
 <package>
	<name>neon</name>
	<range><lt>0.24.5_1</lt></range>
 </package>
 <package>
	<name>sitecopy</name>
	<range><le>0.13.4_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Esser reports:
	<blockquote cite="http://security.e-matters.de/advisories/062004.html">
	 A vulnerability within a libneon date parsing function
	 could cause a heap overflow which could lead to remote
	 code execution, depending on the application using
	 libneon.
	</blockquote>
	The vulnerability is in the function ne_rfc1036_parse,
	 which is in turn used by the function ne_httpdate_parse.
	 Applications using either of these neon functions may be
	 vulnerable.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0398</cvename>
 <url>http://security.e-matters.de/advisories/062004.html</url>
 <url>http://secunia.com/advisories/11785</url>
 </references>
 <dates>
 <discovery>2004-05-19</discovery>
 <entry>2004-05-19</entry>
 <modified>2004-06-25</modified>
 </dates>
 </vuln>

<vuln vid="84237895-8f39-11d8-8b29-0020ed76ef5a">
 <topic>neon format string vulnerabilities</topic>
 <affects>
 <package>
	<name>neon</name>
	<range><lt>0.24.5</lt></range>
 </package>
 <package>
	<name>tla</name>
	<range><lt>1.2_1</lt></range>
 </package>
 <package>
	<name>sitecopy</name>
	<range><le>0.13.4_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Greuff reports that the neon WebDAV client library contains
	 several format string bugs within error reporting code. A
	 malicious server may exploit these bugs by sending specially
	 crafted PROPFIND or PROPPATCH responses.
	Although several applications include neon, such as cadaver and
	 subversion, the FreeBSD Ports of these applications are not
	 impacted. They are specifically configured to NOT use the
	 included neon. Only packages listed as affected in this
	 notice are believed to be impacted.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0179</cvename>
 <url>http://www.webdav.org/neon/</url>
 <url>http://secunia.com/advisories/11785</url>
 </references>
 <dates>
 <discovery>2004-04-14</discovery>
 <entry>2004-04-15</entry>
 <modified>2004-06-25</modified>
 </dates>
 </vuln>

<vuln vid="253ea131-bd12-11d8-b071-00e08110b673">
 <topic>Gallery 1.4.3 and ealier user authentication bypass</topic>
 <affects>
 <package>
	<name>gallery</name>
	<range><lt>1.4.3.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A flaw exists in Gallery versions previous to
	 1.4.3-pl1 and post 1.2 which may give an attacker
	 the potential to log in under the "admin" account.
	 Data outside of the gallery is unaffected and the
	 attacker cannot modify any data other than the
	 photos or photo albums.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0522</cvename>
 <url>http://gallery.menalto.com/modules.php?op=modload&amp;name=News&amp;file=article&amp;sid=123</url>
 <url>http://secunia.com/advisories/11752</url>
 </references>
 <dates>
 <discovery>2004-06-01</discovery>
 <entry>2004-06-24</entry>
 </dates>
 </vuln>

<vuln vid="0c6f3fde-9c51-11d8-9366-0020ed76ef5a">
 <topic>Midnight Commander buffer overflows, format string bugs, and insecure temporary file handling</topic>
 <affects>
 <package>
	<name>mc</name>
	<range><lt>4.6.0_10</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jakub Jelinek reports several security related bugs in
	 Midnight Commander, including:
	<ul>
	 <li>Multiple buffer overflows (CVE-2004-0226)</li>
	 <li>Insecure temporary file handling (CVE-2004-0231)</li>
	 <li>Format string bug (CVE-2004-0232)</li>
	</ul>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0226</cvename>
 <cvename>CVE-2004-0231</cvename>
 <cvename>CVE-2004-0232</cvename>
 </references>
 <dates>
 <discovery>2004-04-29</discovery>
 <entry>2004-05-02</entry>
 <modified>2004-06-14</modified>
 </dates>
 </vuln>

<vuln vid="6f955451-ba54-11d8-b88c-000d610a3b12">
 <topic>Buffer overflow in Squid NTLM authentication helper</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.5_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Remote exploitation of a buffer overflow vulnerability in
	 the NTLM authentication helper routine of the Squid Web
	 Proxy Cache could allow a remote attacker to execute
	 arbitrary code. A remote attacker can compromise a target
	 system if the Squid Proxy is configured to use the NTLM
	 authentication helper. The attacker can send an overly long
	 password to overflow the buffer and execute arbitrary
	 code.
 </body>
 </description>
 <references>
 <url>http://www.idefense.com/application/poi/display?id=107&amp;type=vulnerabilities&amp;flashstatus=false</url>
 <cvename>CVE-2004-0541</cvename>
 <url>http://www.osvdb.org/6791</url>
 <url>http://secunia.com/advisories/11804</url>
 <bid>10500</bid>
 <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=998</url>
 </references>
 <dates>
 <discovery>2004-05-20</discovery>
 <entry>2004-06-09</entry>
 </dates>
 </vuln>

<vuln vid="27c331d5-64c7-11d8-80e3-0020ed76ef5a">
 <topic>Vulnerabilities in H.323 implementations</topic>
 <affects>
 <package>
	<name>pwlib</name>
	<range><lt>1.5.0_5</lt></range>
 </package>
 <package>
	<name>asterisk</name>
	<range><le>0.7.2</le></range>
 </package>
 <package>
	<name>openh323</name>
	<range><lt>1.12.0_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The <a href="http://www.niscc.gov.uk/">NISCC</a> and the <a href="http://www.ee.oulu.fi/research/ouspg/">OUSPG</a>
	 developed a test suite for the H.323 protocol. This test
	 suite has uncovered vulnerabilities in several H.323
	 implementations with impacts ranging from denial-of-service
	 to arbitrary code execution.
	In the FreeBSD Ports Collection, `pwlib' is directly
	 affected. Other applications such as `asterisk' and
	 `openh323' incorporate `pwlib' statically and so are also
	 independently affected.
 </body>
 </description>
 <references>
 
 <url>http://www.uniras.gov.uk/vuls/2004/006489/h323.htm</url>
 <url>http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/h2250v4/index.html</url>
 <certsa>CA-2004-01</certsa>
 <certvu>749342</certvu>
 
 <cvename>CVE-2004-0097</cvename>
 <url>http://www.southeren.com/blog/archives/000055.html</url>
 </references>
 <dates>
 <discovery>2004-01-13</discovery>
 <entry>2004-02-22</entry>
 <modified>2004-06-08</modified>
 </dates>
 </vuln>

<vuln vid="fb5e227e-b8c6-11d8-b88c-000d610a3b12">
 <topic>jailed processes can manipulate host routing tables</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>4.9</ge><lt>4.9_10</lt></range>
	<range><ge>4.8</ge><lt>4.8_23</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A programming error resulting in a failure to verify that
	 an attempt to manipulate routing tables originated from a
	 non-jailed process.

Jailed processes running with superuser privileges could
	 modify host routing tables. This could result in a variety
	 of consequences including packets being sent via an
	 incorrect network interface and packets being discarded
	 entirely.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0125</cvename>
 <freebsdsa>SA-04:12.jailroute</freebsdsa>
 </references>
 <dates>
 <discovery>2004-02-03</discovery>
 <entry>2004-06-07</entry>
 </dates>
 </vuln>

<vuln vid="1db1ed59-af07-11d8-acb9-000d610a3b12">
 <topic>buffer cache invalidation implementation issues</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.0</ge><lt>5.2_8</lt></range>
	<range><ge>4.9</ge><lt>4.9_9</lt></range>
	<range><ge>4.0</ge><lt>4.8_22</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Programming errors in the implementation of the msync(2)
	 system call involving the MS_INVALIDATE operation lead to
	 cache consistency problems between the virtual memory system
	 and on-disk contents.

In some situations, a user with read access to a file may
	 be able to prevent changes to that file from being committed
	 to disk.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0435</cvename>
 <freebsdsa>SA-04:11.msync</freebsdsa>
 </references>
 <dates>
 <discovery>2004-04-24</discovery>
 <entry>2004-05-26</entry>
 </dates>
 </vuln>

<vuln vid="f7a3b18c-624c-4703-9756-b6b27429e5b0">
 <topic>leafnode denial-of-service triggered by article request</topic>
 <affects>
 <package>
	<name>leafnode</name>
	<range><ge>1.9.20</ge><lt>1.9.30</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The leafnode NNTP server may go into an unterminated loop with 100%
	 CPU use when an article is requested by Message-ID that has been
	 crossposted to several news groups when one of the group names is the
	 prefix of another group name that the article was cross-posted
	 to. Found by Jan Knutar.
 </body>
 </description>
 <references>
 <url>http://leafnode.sourceforge.net/leafnode-SA-2002-01.txt</url>
 <cvename>CVE-2002-1661</cvename>
 <mlist msgid="20021229205023.GA5216@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=2796226</mlist>
 <mlist msgid="20021229205023.GA5216@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/8</mlist>
 <bid>6490</bid>
 <freebsdpr>ports/46613</freebsdpr>
 </references>
 <dates>
 <discovery>2002-11-06</discovery>
 <entry>2004-05-21</entry>
 <modified>2005-05-13</modified>
 </dates>
 </vuln>

<vuln vid="7b0208ff-3f65-4e16-8d4d-48fd9851f085">
 <topic>leafnode fetchnews denial-of-service triggered by missing header</topic>
 <affects>
 <package>
	<name>leafnode</name>
	<range><ge>1.9.3</ge><le>1.9.41</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Fetchnews could hang when a news article to be downloaded lacked one
	 of the mandatory headers. Found by Joshua Crawford.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0744</cvename>
 <url>http://leafnode.sourceforge.net/leafnode-SA-2003-01.txt</url>
 <mlist msgid="20030904011904.GB12350@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=5975563</mlist>
 <mlist msgid="20030904011904.GB12350@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/21</mlist>
 <bid>8541</bid>
 <freebsdpr>ports/53838</freebsdpr>
 </references>
 <dates>
 <discovery>2003-06-20</discovery>
 <entry>2004-05-21</entry>
 <modified>2005-05-13</modified>
 </dates>
 </vuln>

<vuln vid="a051a4ec-3aa1-4dd1-9bdc-a61eb5700153">
 <topic>leafnode fetchnews denial-of-service triggered by truncated transmission</topic>
 <affects>
 <package>
	<name>leafnode</name>
	<range><le>1.9.47</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	When a downloaded news article ends prematurely, i. e. when the
	 server sends [CR]LF.[CR]LF before sending a blank line, fetchnews may
	 wait indefinitely for data that never arrives. Workaround: configure
	 "minlines=1" (or use a bigger value) in the configuration file. Found
	 by Toni Viemerö.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-2068</cvename>
 <url>http://leafnode.sourceforge.net/leafnode-SA-2004-01.txt</url>
 <url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=873149&amp;group_id=57767&amp;atid=485349</url>
 <mlist msgid="20040109015625.GA12319@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/32</mlist>
 <mlist msgid="20040109015625.GA12319@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=6922570</mlist>
 <freebsdpr>ports/61105</freebsdpr>
 </references>
 <dates>
 <discovery>2004-01-08</discovery>
 <entry>2004-05-21</entry>
 <modified>2005-05-13</modified>
 </dates>
 </vuln>

<vuln vid="2e129846-8fbb-11d8-8b29-0020ed76ef5a">
 <topic>MySQL insecure temporary file creation (mysqlbug)</topic>
 <affects>
 <package>
	<name>mysql-client</name>
	<range><ge>4.0</ge><lt>4.0.20</lt></range>
	<range><ge>4.1</ge><lt>4.1.1_2</lt></range>
	<range><ge>5.0</ge><lt>5.0.0_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	 Shaun Colley reports that the script `mysqlbug' included
	 with MySQL sometimes creates temporary files in an unsafe
	 manner. As a result, an attacker may create a symlink in
	 /tmp so that if another user invokes `mysqlbug' and quits
	 without making any changes, an
	 arbitrary file may be overwritten with the bug report
	 template.
 </body>
 </description>
 <references>
 <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108023246916294&amp;w=2</mlist>
 <url>http://bugs.mysql.com/bug.php?id=3284</url>
 <bid>9976</bid>
 <cvename>CVE-2004-0381</cvename>
 </references>
 <dates>
 <discovery>2004-03-25</discovery>
 <entry>2004-04-16</entry>
 <modified>2004-05-21</modified>
 </dates>
 </vuln>

<vuln vid="5d36ef32-a9cf-11d8-9c6d-0020ed76ef5a">
 <topic>subversion date parsing vulnerability</topic>
 <affects>
 <package>
	<name>subversion</name>
	<range><lt>1.0.2_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Esser reports:
	<blockquote cite="http://security.e-matters.de/advisories/082004.html">
	 Subversion versions up to 1.0.2 are vulnerable to a date
	 parsing vulnerability which can be abused to allow remote
	 code execution on Subversion servers and therefore could
	 lead to a repository compromise.
	</blockquote>
	NOTE: This vulnerability is similar to the date
	 parsing issue that affected neon. However, it is a different
	 and distinct bug.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0397</cvename>
 <url>http://security.e-matters.de/advisories/082004.html</url>
 </references>
 <dates>
 <discovery>2004-05-19</discovery>
 <entry>2004-05-19</entry>
 </dates>
 </vuln>

<vuln vid="f93be979-a992-11d8-aecc-000d610a3b12">
 <topic>cvs pserver remote heap buffer overflow</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.2</ge><lt>5.2_7</lt></range>
	<range><ge>5.1</ge><lt>5.1_17</lt></range>
	<range><ge>5.0</ge><lt>5.0_21</lt></range>
	<range><ge>4.9</ge><lt>4.9_8</lt></range>
	<range><ge>4.8</ge><lt>4.8_21</lt></range>
	<range><ge>4.0</ge><lt>4.7_27</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Due to a programming error in code used to parse data
	 received from the client, malformed data can cause a heap
	 buffer to overflow, allowing the client to overwrite
	 arbitrary portions of the server's memory.
	A malicious CVS client can exploit this to run arbitrary
	 code on the server at the privilege level of the CVS server
	 software.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0396</cvename>
 <freebsdsa>SA-04:10.cvs</freebsdsa>
 </references>
 <dates>
 <discovery>2004-05-02</discovery>
 <entry>2004-05-19</entry>
 </dates>
 </vuln>

<vuln vid="492f8896-70fa-11d8-873f-0020ed76ef5a">
 <topic>Apache 2 mod_ssl denial-of-service</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><ge>2.0</ge><le>2.0.48_3</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Joe Orton reports a memory leak in Apache 2's mod_ssl.
	 A remote attacker may issue HTTP requests on an HTTPS
	 port, causing an error. Due to a bug in processing this
	 condition, memory associated with the connection is
	 not freed. Repeated requests can result in consuming
	 all available memory resources, probably resulting in
	 termination of the Apache process.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0113</cvename>
 <url>http://www.apacheweek.com/features/security-20</url>
 <url>http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_engine_io.c?r1=1.100.2.11&amp;r2=1.100.2.12</url>
 <mlist>http://marc.theaimsgroup.com/?l=apache-cvs&amp;m=107869699329638</mlist>
 <url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=27106</url>
 <bid>9826</bid>
 </references>
 <dates>
 <discovery>2004-02-20</discovery>
 <entry>2004-03-08</entry>
 <modified>2004-05-19</modified>
 </dates>
 </vuln>

<vuln vid="df333ede-a8ce-11d8-9c6d-0020ed76ef5a">
 <topic>URI handler vulnerabilities in several browsers</topic>
 <affects>
 <package>
	<name>linux-opera</name>
	<name>opera</name>
	<range><lt>7.50</lt></range>
 </package>
 <package>
	<name>kdelibs</name>
	<range><lt>3.2.2_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Karol Wiesek and Greg MacManus reported via iDEFENSE that the
	 Opera web browser contains a flaw in the handling of
	 certain URIs. When presented with these URIs, Opera would
	 invoke external commands to process them after some
	 validation. However, if the hostname component of a URI
	 begins with a `-', it may be treated as an option by an external
	 command. This could have undesirable side-effects, from
	 denial-of-service to code execution.	The impact is very
	 dependent on local configuration.
	After the iDEFENSE advisory was published, the KDE team
	 discovered similar problems in KDE's URI handlers.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0411</cvename>
 <url>http://www.idefense.com/application/poi/display?id=104&amp;type=vulnerabilities</url>
 <url>http://www.kde.org/info/security/advisory-20040517-1.txt</url>
 <url>http://freebsd.kde.org/index.php#n20040517</url>
 </references>
 <dates>
 <discovery>2004-05-12</discovery>
 <entry>2004-05-18</entry>
 </dates>
 </vuln>

<vuln vid="20be2982-4aae-11d8-96f2-0020ed76ef5a">
 <topic>fsp buffer overflow and directory traversal vulnerabilities</topic>
 <affects>
 <package>
	<name>fspd</name>
	<range><lt>2.8.1.19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The <a href="http://www.debian.org/security">Debian
	security team</a> reported a pair of vulnerabilities in
	fsp:
	<blockquote cite="http://www.debian.org/security/2004/dsa-416">
	 A vulnerability was discovered in fsp, client utilities
	 for File Service Protocol (FSP), whereby a remote user could
	 both escape from the FSP root directory (CAN-2003-1022), and
	 also overflow a fixed-length buffer to execute arbitrary
	 code (CAN-2004-0011).
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2003-1022</cvename>
 <cvename>CVE-2004-0011</cvename>
 <url>http://www.debian.org/security/2004/dsa-416</url>
 </references>
 <dates>
 <discovery>2004-01-06</discovery>
 <entry>2004-01-19</entry>
 <modified>2004-05-17</modified>
 </dates>
 </vuln>

<vuln vid="cb6c6c29-9c4f-11d8-9366-0020ed76ef5a">
 <topic>proftpd IP address access control list breakage</topic>
 <affects>
 <package>
	<name>proftpd</name>
	<range><ge>1.2.9</ge><lt>1.2.10.r1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jindrich Makovicka reports a regression in proftpd's
	 handling of IP address access control lists (IP ACLs). Due
	 to this regression, some IP ACLs are treated as ``allow
	 all''.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0432</cvename>
 <url>http://bugs.proftpd.org/show_bug.cgi?id=2267</url>
 </references>
 <dates>
 <discovery>2003-11-04</discovery>
 <entry>2004-05-02</entry>
 <modified>2004-05-15</modified>
 </dates>
 </vuln>

<vuln vid="fde53204-7ea6-11d8-9645-0020ed76ef5a">
 <topic>insecure temporary file creation in xine-check, xine-bugreport</topic>
 <affects>
 <package>
	<name>xine</name>
	<range><lt>0.9.23_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Some scripts installed with xine create temporary files
	 insecurely. It is recommended that these scripts (xine-check,
	 xine-bugreport) not be used.	They are not needed for normal
	 operation.
 </body>
 </description>
 <references>
 <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=107997911025558</mlist>
 <bid>9939</bid>
 </references>
 <dates>
 <discovery>2004-03-20</discovery>
 <entry>2004-03-26</entry>
 <modified>2004-05-09</modified>
 </dates>
 </vuln>

<vuln vid="5f29c2e4-9f6a-11d8-abbc-00e08110b673">
 <topic>exim buffer overflow when verify = header_syntax is used</topic>
 <affects>
 <package>
	<name>exim</name>
	<name>exim-ldap2</name>
	<name>exim-mysql</name>
	<name>exim-postgresql</name>
	<range><lt>4.33+20_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A remote exploitable buffer overflow has been discovered
	 in exim when verify = header_syntax is used in the
	 configuration file. This does not affect the default
	 configuration.
 </body>
 </description>
 <references>
 <url>http://www.guninski.com/exim1.html</url>
 <cvename>CVE-2004-0400</cvename>
 </references>
 <dates>
 <discovery>2004-05-06</discovery>
 <entry>2004-05-06</entry>
 </dates>
 </vuln>

<vuln vid="a56a72bb-9f72-11d8-9585-0020ed76ef5a">
 <topic>phpBB session table exhaustion</topic>
 <affects>
 <package>
	<name>phpbb</name>
	<range><le>2.0.8_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The includes/sessions.php unnecessarily adds session item into
	 session table and therefore vulnerable to a denial-of-service
	 attack.
	</body>
 </description>
 <references>
 <mlist msgid="20040421011055.GA1448@frontfree.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108256462710010</mlist>
 </references>
 <dates>
 <discovery>2004-03-05</discovery>
 <entry>2004-05-06</entry>
 </dates>
 </vuln>

<vuln vid="446dbecb-9edc-11d8-9366-0020ed76ef5a">
 <topic>heimdal kadmind remote heap buffer overflow</topic>
 <affects>
 <package>
	<name>heimdal</name>
	<range><lt>0.6.1_1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>4.9</ge><lt>4.9_7</lt></range>
	<range><ge>4.0</ge><lt>4.8_20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An input validation error was discovered in the kadmind
	 code that handles the framing of Kerberos 4 compatibility
	 administration requests. The code assumed that the length
	 given in the framing was always two or more bytes. Smaller
	 lengths will cause kadmind to read an arbitrary amount of
	 data into a minimally-sized buffer on the heap.
	A remote attacker may send a specially formatted message
	 to kadmind, causing it to crash or possibly resulting in
	 arbitrary code execution.
	The kadmind daemon is part of Kerberos 5 support. However,
	 this bug will only be present if kadmind was built with
	 additional Kerberos 4 support. Thus, only systems that have
	 *both* Heimdal Kerberos 5 and Kerberos 4 installed might
	 be affected.
	NOTE: On FreeBSD 4 systems, `kadmind' may be
	 installed as `k5admind'.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0434</cvename>
 <freebsdsa>SA-04:09.kadmind</freebsdsa>
 </references>
 <dates>
 <discovery>2004-05-05</discovery>
 <entry>2004-05-05</entry>
 </dates>
 </vuln>

<vuln vid="0792e7a7-8e37-11d8-90d1-0020ed76ef5a">
 <topic>CVS path validation errors</topic>
 <affects>
 <package>
	<name>cvs+ipv6</name>
	<range><le>1.11.5_1</le></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.2</ge><lt>5.2.1_5</lt></range>
	<range><ge>4.9</ge><lt>4.9_5</lt></range>
	<range><ge>4.8</ge><lt>4.8_18</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Two programming errors were discovered in which path names
	 handled by CVS were not properly validated. In one case,
	 the CVS client accepts absolute path names from the server
	 when determining which files to update. In another case,
	 the CVS server accepts relative path names from the client
	 when determining which files to transmit, including those
	 containing references to parent directories (`../').
	These programming errors generally only have a security
	 impact when dealing with remote CVS repositories.
	A malicious CVS server may cause a CVS client to overwrite
	 arbitrary files on the client's system.
	A CVS client may request RCS files from a remote system
	 other than those in the repository specified by $CVSROOT.
	 These RCS files need not be part of any CVS repository
	 themselves.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0180</cvename>
 <cvename>CVE-2004-0405</cvename>
 <url>http://ccvs.cvshome.org/servlets/NewsItemView?newsID=102</url>
 <freebsdsa>SA-04:07.cvs</freebsdsa>
 </references>
 <dates>
 <discovery>2004-04-14</discovery>
 <entry>2004-04-14</entry>
 <modified>2004-05-05</modified>
 </dates>
 </vuln>

<vuln vid="7229d900-88af-11d8-90d1-0020ed76ef5a">
 <topic>mksnap_ffs clears file system options</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.2</ge><lt>5.2_1</lt></range>
	<range><ge>5.1</ge><lt>5.1_12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The kernel interface for creating a snapshot of a
	 filesystem is the same as that for changing the flags on
	 that filesystem. Due to an oversight, the <a href="http://www.freebsd.org/cgi/man.cgi?query=mksnap_ffs">mksnap_ffs(8)</a>
	 command called that interface with only the snapshot flag
	 set, causing all other flags to be reset to the default
	 value.
	A regularly scheduled backup of a live filesystem, or
	 any other process that uses the mksnap_ffs command
	 (for instance, to provide a rough undelete functionality
	 on a file server), will clear any flags in effect on the
	 filesystem being snapshot. Possible consequences depend
	 on local usage, but can include disabling extended access
	 control lists or enabling the use of setuid executables
	 stored on an untrusted filesystem.
	The mksnap_ffs command is normally only available to
	 the superuser and members of the `operator' group. There
	 is therefore no risk of a user gaining elevated privileges
	 directly through use of the mksnap_ffs command unless
	 it has been intentionally made available to unprivileged
	 users.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0099</cvename>
 <freebsdsa>SA-04:01.mksnap_ffs</freebsdsa>
 </references>
 <dates>
 <discovery>2004-01-30</discovery>
 <entry>2004-04-07</entry>
 <modified>2004-05-05</modified>
 </dates>
 </vuln>

<vuln vid="f95a9005-88ae-11d8-90d1-0020ed76ef5a">
 <topic>shmat reference counting bug</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.2</ge><lt>5.2_2</lt></range>
	<range><ge>5.1</ge><lt>5.1_14</lt></range>
	<range><ge>5.0</ge><lt>5.0_20</lt></range>
	<range><ge>4.9</ge><lt>4.9_2</lt></range>
	<range><ge>4.8</ge><lt>4.8_15</lt></range>
	<range><lt>4.7_25</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A programming error in the <a href="http://www.freebsd.org/cgi/man.cgi?query=shmat">shmat(2)</a> system call can result
	 in a shared memory segment's reference count being erroneously
	 incremented.
	It may be possible to cause a shared memory segment to
	 reference unallocated kernel memory, but remain valid.
	 This could allow a local attacker to gain read or write
	 access to a portion of kernel memory, resulting in sensitive
	 information disclosure, bypass of access control mechanisms,
	 or privilege escalation.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0114</cvename>
 <freebsdsa>SA-04:02.shmat</freebsdsa>
 <url>http://www.pine.nl/press/pine-cert-20040201.txt</url>
 </references>
 <dates>
 <discovery>2004-02-01</discovery>
 <entry>2004-04-07</entry>
 <modified>2004-05-05</modified>
 </dates>
 </vuln>

<vuln vid="9082a85a-88ae-11d8-90d1-0020ed76ef5a">
 <topic>jailed processes can attach to other jails</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.1</ge><lt>5.1_14</lt></range>
	<range><ge>5.2</ge><lt>5.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A programming error has been found in the <a href="http://www.freebsd.org/cgi/man.cgi?query=jail_attach">jail_attach(2)</a>
	 system call which affects the way that system call verifies
	 the privilege level of the calling process. Instead of
	 failing immediately if the calling process was already
	 jailed, the jail_attach system call would fail only after
	 changing the calling process's root directory.
	A process with superuser privileges inside a jail could
	 change its root directory to that of a different jail,
	 and thus gain full read and write access to files and
	 directories within the target jail.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0126</cvename>
 <freebsdsa>SA-04:03.jail</freebsdsa>
 </references>
 <dates>
 <discovery>2004-02-19</discovery>
 <entry>2004-04-07</entry>
 <modified>2004-05-05</modified>
 </dates>
 </vuln>

<vuln vid="e289f7fd-88ac-11d8-90d1-0020ed76ef5a">
 <topic>many out-of-sequence TCP packets denial-of-service</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.2</ge><lt>5.2.1_2</lt></range>
	<range><ge>5.0</ge><lt>5.1_15</lt></range>
	<range><ge>4.9</ge><lt>4.9_3</lt></range>
	<range><ge>4.8</ge><lt>4.8_16</lt></range>
	<range><lt>4.7_26</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	FreeBSD does not limit the number of TCP segments that
	may be held in a reassembly queue. A remote attacker may
	conduct a low-bandwidth denial-of-service attack against
	a machine providing services based on TCP (there are many
	such services, including HTTP, SMTP, and FTP).	By sending
	many out-of-sequence TCP segments, the attacker can cause
	the target machine to consume all available memory buffers
	(``mbufs''), likely leading to a system crash.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0171</cvename>
 <freebsdsa>SA-04:04.tcp</freebsdsa>
 <url>http://www.idefense.com/application/poi/display?id=78&amp;type=vulnerabilities</url>
 </references>
 <dates>
 <discovery>2004-02-18</discovery>
 <entry>2004-04-07</entry>
 <modified>2004-05-05</modified>
 </dates>
 </vuln>

<vuln vid="2c6acefd-8194-11d8-9645-0020ed76ef5a">
 <topic>setsockopt(2) IPv6 sockets input validation error</topic>
 <affects>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.2</ge><lt>5.2.1_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	From the FreeBSD Security Advisory:
	<blockquote>
	 A programming error in the handling of some IPv6 socket
	 options within the <a href="http://www.freebsd.org/cgi/man.cgi?query=setsockopt">setsockopt(2)</a> system call may result
	 in memory locations being accessed without proper
	 validation.
	 It may be possible for a local attacker to read portions
	 of kernel memory, resulting in disclosure of sensitive
	 information. A local attacker can cause a system
	 panic.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0370</cvename>
 <freebsdsa>SA-04:06.ipv6</freebsdsa>
 </references>
 <dates>
 <discovery>2004-03-29</discovery>
 <entry>2004-03-29</entry>
 <modified>2004-05-05</modified>
 </dates>
 </vuln>

<vuln vid="68233cba-7774-11d8-89ed-0020ed76ef5a">
 <topic>OpenSSL ChangeCipherSpec denial-of-service vulnerability</topic>
 <affects>
 <package>
	<name>openssl</name>
	<name>openssl-beta</name>
	<range><lt>0.9.7d</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>4.0</ge><lt>4.8_17</lt></range>
	<range><ge>4.9</ge><lt>4.9_4</lt></range>
	<range><ge>5.0</ge><lt>5.1_16</lt></range>
	<range><ge>5.2</ge><lt>5.2.1_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A remote attacker could cause an application using OpenSSL to
	 crash by performing a specially crafted SSL/TLS handshake.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0079</cvename>
 <url>http://www.openssl.org/news/secadv_20040317.txt</url>
 <freebsdsa>SA-04:05.openssl</freebsdsa>
 <certvu>288574</certvu>
 <bid>9899</bid>
 </references>
 <dates>
 <discovery>2004-03-17</discovery>
 <entry>2004-03-17</entry>
 <modified>2004-05-05</modified>
 </dates>
 </vuln>

<vuln vid="bfb36941-84fa-11d8-a41f-0020ed76ef5a">
 <topic>Incorrect cross-realm trust handling in Heimdal</topic>
 <affects>
 <package>
	<name>heimdal</name>
	<range><lt>0.6.1</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.0</ge><lt>5.2_6</lt></range>
	<range><ge>4.9</ge><lt>4.9_6</lt></range>
	<range><ge>4.0</ge><lt>4.8_19</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Heimdal does not correctly validate the `transited' field of
	 Kerberos tickets when computing the authentication path. This
	 could allow a rogue KDC with which cross-realm relationships
	 have been established to impersonate any KDC in the
	 authentication path.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0371</cvename>
 <freebsdsa>SA-04:08.heimdal</freebsdsa>
 <url>http://www.pdc.kth.se/heimdal/advisory/2004-04-01/</url>
 </references>
 <dates>
 <discovery>2004-04-01</discovery>
 <entry>2004-04-02</entry>
 <modified>2004-05-05</modified>
 </dates>
 </vuln>

<vuln vid="a2ffb627-9c53-11d8-9366-0020ed76ef5a">
 <topic>lha buffer overflows and path traversal issues</topic>
 <affects>
 <package>
	<name>lha</name>
	<range><lt>1.14i_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ulf Härnhammar discovered several vulnerabilities in
	 LHa for UNIX's path name handling code. Specially constructed
	 archive files may cause LHa to overwrite files or
	 execute arbitrary code with the privileges of the user
	 invoking LHa. This could be particularly harmful for
	 automated systems that might handle archives such as
	 virus scanning processes.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0234</cvename>
 <cvename>CVE-2004-0235</cvename>
 </references>
 <dates>
 <discovery>2004-04-29</discovery>
 <entry>2004-05-02</entry>
 <modified>2004-05-03</modified>
 </dates>
 </vuln>

<vuln vid="8338a20f-9573-11d8-9366-0020ed76ef5a">
 <topic>xchat remotely exploitable buffer overflow (Socks5)</topic>
 <affects>
 <package>
	<name>xchat2</name>
	<range><ge>1.8</ge><lt>2.0.8_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A straightforward stack buffer overflow exists in XChat's
	 Socks5 proxy support.
	The XChat developers report that `tsifra' discovered this
	 issue.
	NOTE: XChat Socks5 support is disabled by support in the
	 FreeBSD Ports Collection.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0409</cvename>
 <url>http://xchat.org/files/source/2.0/patches/xc208-fixsocks5.diff</url>
 <mlist msgid="20040405171305.04f19c44.zed@xchat.org">http://marc.theaimsgroup.com/?l=xchat-announce&amp;m=108114935507357</mlist>
 </references>
 <dates>
 <discovery>2004-04-05</discovery>
 <entry>2004-04-23</entry>
 <modified>2004-05-03</modified>
 </dates>
 </vuln>

<vuln vid="73ea0706-9c57-11d8-9366-0020ed76ef5a">
 <topic>rsync path traversal issue</topic>
 <affects>
 <package>
	<name>rsync</name>
	<range><lt>2.6.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	When running rsync in daemon mode, no checks were made
	 to prevent clients from writing outside of a module's
	`path' setting.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0426</cvename>
 <url>http://rsync.samba.org/#security_apr04</url>
 </references>
 <dates>
 <discovery>2004-04-26</discovery>
 <entry>2004-05-02</entry>
 </dates>
 </vuln>

<vuln vid="e50b04e8-9c55-11d8-9366-0020ed76ef5a">
 <topic>xine-lib arbitrary file overwrite</topic>
 <affects>
 <package>
	<name>libxine</name>
	<range><gt>0.9</gt><lt>1.0.r3_5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	From the xinehq advisory:
	<blockquote cite="http://www.xinehq.de/index.php/security/XSA-2004-1">
	 By opening a malicious MRL in any xine-lib based media
	 player, an attacker can write arbitrary content to an
	 arbitrary file, only restricted by the permissions of the
	 user running the application.
	</blockquote>
	The flaw is a result of a feature that allows MRLs (media
	 resource locator URIs) to specify arbitrary configuration
	 options.
 </body>
 </description>
 <references>
 <bid>10193</bid>
 <url>http://www.xinehq.de/index.php/security/XSA-2004-1</url>
 </references>
 <dates>
 <discovery>2004-04-20</discovery>
 <entry>2004-05-02</entry>
 </dates>
 </vuln>

<vuln vid="fb521119-9bc4-11d8-9366-0020ed76ef5a">
 <topic>pound remotely exploitable vulnerability</topic>
 <affects>
 <package>
	<name>pound</name>
	<range><lt>1.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An unknown remotely exploitable vulnerability was disclosed.
	 Robert Segall writes:
	<blockquote cite="http://www.apsis.ch/pound/pound_list/archive/2003/2003-12/1070234315000">
	 a security vulnerability was brought to my attention
	 (many thanks to Akira Higuchi). Everyone running any
	 previous version should upgrade to 1.6 immediately - the
	 vulnerability may allow a remote exploit. No exploits are
	 currently known and none have been observed in the wild
	 till now. The danger is minimised if you run Pound in a
	 root jail and/or you run Pound as non-root user.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist>http://www.apsis.ch/pound/pound_list/archive/2003/2003-12/1070234315000</mlist>
 </references>
 <dates>
 <discovery>2003-12-01</discovery>
 <entry>2004-05-02</entry>
 </dates>
 </vuln>

<vuln vid="cfe17ca6-6858-4805-ba1d-a60a61ec9b4d">
 <topic>phpBB IP address spoofing</topic>
 <affects>
 <package>
	<name>phpbb</name>
	<range><le>2.0.8_2</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The common.php script always trusts the `X-Forwarded-For'
	header in the client's HTTP request. A remote user could
	forge this header in order to bypass any IP address access
	control lists (ACLs).
 </body>
 </description>
 <references>
 <mlist msgid="20040419000129.28917.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108239864203144</mlist>
 </references>
 <dates>
 <discovery>2004-04-18</discovery>
 <entry>2004-04-23</entry>
 </dates>
 </vuln>

<vuln vid="99230277-8fb4-11d8-8b29-0020ed76ef5a">
 <topic>ident2 double byte buffer overflow</topic>
 <affects>
 <package>
	<name>ident2</name>
	<range><le>1.04</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jack of RaptureSecurity reported a double byte buffer
	 overflow in ident2. The bug may allow a remote attacker to
	 execute arbitrary code within the context of the ident2
	 daemon. The daemon typically runs as user-ID `nobody', but
	 with group-ID `wheel'.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0408</cvename>
 </references>
 <dates>
 <discovery>2004-04-15</discovery>
 <entry>2004-04-23</entry>
 </dates>
 </vuln>

<vuln vid="da6f265b-8f3d-11d8-8b29-0020ed76ef5a">
 <topic>kdepim exploitable buffer overflow in VCF reader</topic>
 <affects>
 <package>
	<name>kdepim</name>
	<range><ge>3.1.0</ge><lt>3.1.4_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A buffer overflow is present in some versions of the KDE
	 personal information manager (kdepim) which may be triggered
	 when processing a specially crafted VCF file.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0988</cvename>
 <url>http://www.kde.org/info/security/advisory-20040114-1.txt</url>
 </references>
 <dates>
 <discovery>2004-01-14</discovery>
 <entry>2004-04-15</entry>
 </dates>
 </vuln>

<vuln vid="ccd698df-8e20-11d8-90d1-0020ed76ef5a">
 <topic>racoon remote denial of service vulnerability (ISAKMP header length field)</topic>
 <affects>
 <package>
	<name>racoon</name>
	<range><lt>20040408a</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	When racoon receives an ISAKMP header, it will attempt to
	 allocate sufficient memory for the entire ISAKMP message
	 according to the header's length field. If an attacker
	 crafts an ISAKMP header with a ridiculously large value
	 in the length field, racoon may exceed operating system
	 resource limits and be terminated, resulting in a denial of
	 service.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0403</cvename>
 <url>http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/isakmp.c.diff?r1=1.180&amp;r2=1.181</url>
 </references>
 <dates>
 <discovery>2004-03-31</discovery>
 <entry>2004-04-14</entry>
 </dates>
 </vuln>

<vuln vid="40fcf20f-8891-11d8-90d1-0020ed76ef5a">
 <topic>racoon remote denial of service vulnerability (IKE Generic Payload Header)</topic>
 <affects>
 <package>
	<name>racoon</name>
	<range><lt>20040407b</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	When racoon receives an IKE message with an incorrectly
	 constructed Generic Payload Header, it may behave erratically,
	 going into a tight loop and dropping connections.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0392</cvename>
 <url>http://orange.kame.net/dev/query-pr.cgi?pr=555</url>
 </references>
 <dates>
 <discovery>2003-12-03</discovery>
 <entry>2004-04-07</entry>
 <modified>2004-04-14</modified>
 </dates>
 </vuln>

<vuln vid="f8551668-de09-4d7b-9720-f1360929df07">
 <topic>tcpdump ISAKMP payload handling remote denial-of-service</topic>
 <affects>
 <package>
	<name>tcpdump</name>
	<range><lt>3.8.3</lt></range>
 </package>
 <package>
	<name>racoon</name>
	<range><lt>20040408a</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><lt>5.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Chad Loder has discovered vulnerabilities in tcpdump's
	 ISAKMP protocol handler. During an audit to repair these
	 issues, Bill Fenner discovered some related problems.
	These vulnerabilities may be used by an attacker to crash a
	 running `tcpdump' process. They can only be triggered if
	 the `-v' command line option is being used.
	NOTE: the racoon ISAKMP/IKE daemon incorporates the ISAKMP
	 protocol handler from tcpdump, and so is also affected by
	 this issue.
 </body>
 </description>
 <references>
 <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108067265931525</mlist>
 <url>http://www.rapid7.com/advisories/R7-0017.html</url>
 <cvename>CVE-2004-0183</cvename>
 <cvename>CVE-2004-0184</cvename>
 </references>
 <dates>
 <discovery>2004-03-12</discovery>
 <entry>2004-03-31</entry>
 <modified>2016-08-11</modified>
 </dates>
 </vuln>

<vuln vid="322d4ff6-85c3-11d8-a41f-0020ed76ef5a">
 <topic>Midnight Commander buffer overflow during symlink resolution</topic>
 <affects>
 <package>
	<name>mc</name>
	<range><lt>4.6.0_9</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Midnight Commander uses a fixed sized stack buffer while
	 resolving symbolic links within file archives (tar or cpio).
	 If an attacker can cause a user to process a specially
	 crafted file archive with Midnight Commander,
	 the attacker may be able to obtain the privileges of the
	 target user.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-1023</cvename>
 <mlist msgid="E1A0LbX-000NPk-00.alienhard-mail-ru@f9.mail.ru">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=106399528518704</mlist>
 <bid>8658</bid>
 </references>
 <dates>
 <discovery>2003-09-19</discovery>
 <entry>2004-04-03</entry>
 <modified>2004-04-13</modified>
 </dates>
 </vuln>

<vuln vid="d8769838-8814-11d8-90d1-0020ed76ef5a">
 <topic>racoon fails to verify signature during Phase 1</topic>
 <affects>
 <package>
	<name>racoon</name>
	<range><lt>20040407b</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ralf Spenneberg discovered a serious flaw in racoon.
	 When using Phase 1 main or aggressive mode, racoon does
	 not verify the client's RSA signature. Any installations
	 using X.509 authentication are strongly
	 urged to upgrade.
	Installations using pre-shared keys are believed
	 to be unaffected.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0155</cvename>
 <url>http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/crypto_openssl.c?rev=1.84&amp;content-type=text/x-cvsweb-markup</url>
 </references>
 <dates>
 <discovery>2004-04-05</discovery>
 <entry>2004-04-07</entry>
 </dates>
 </vuln>

<vuln vid="6fd02439-5d70-11d8-80e3-0020ed76ef5a">
 <topic>Several remotely exploitable buffer overflows in gaim</topic>
 <affects>
 <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>0.75_3</lt></range>
	<range><eq>0.75_5</eq></range>
	<range><eq>0.76</eq></range>
 </package>
 <package>
	<name>gaim</name>
	<range><ge>20030000</ge></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Stefan Esser of e-matters found almost a dozen remotely
	 exploitable vulnerabilities in Gaim.	From the e-matters
	 advisory:
	<blockquote cite="http://security.e-matters.de/advisories/012004.txt">
	 While developing a custom add-on, an integer overflow
	 in the handling of AIM DirectIM packets was revealed that
	 could lead to a remote compromise of the IM client. After
	 disclosing this bug to the vendor, they had to make a
	 hurried release because of a change in the Yahoo connection
	 procedure that rendered GAIM useless. Unfourtunately at the
	 same time a closer look onto the sourcecode revealed 11 more
	 vulnerabilities.

The 12 identified problems range from simple standard
	 stack overflows, over heap overflows to an integer overflow
	 that can be abused to cause a heap overflow. Due to the
	 nature of instant messaging many of these bugs require
	 man-in-the-middle attacks between client and server. But the
	 underlying protocols are easy to implement and MIM attacks
	 on ordinary TCP sessions is a fairly simple task.

In combination with the latest kernel vulnerabilities or
	 the habit of users to work as root/administrator these bugs
	 can result in remote root compromises.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://security.e-matters.de/advisories/012004.txt</url>
 <cvename>CVE-2004-0005</cvename>
 <cvename>CVE-2004-0006</cvename>
 <cvename>CVE-2004-0007</cvename>
 <cvename>CVE-2004-0008</cvename>
 </references>
 <dates>
 <discovery>2004-01-26</discovery>
 <entry>2004-02-12</entry>
 <modified>2004-10-25</modified>
 </dates>
 </vuln>

<vuln vid="290d81b9-80f1-11d8-9645-0020ed76ef5a">
 <topic>oftpd denial-of-service vulnerability (PORT command)</topic>
 <affects>
 <package>
	<name>oftpd</name>
	<range><lt>0.3.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Philippe Oechslin reported a denial-of-service vulnerability
	 in oftpd. The oftpd server can be crashed by sending a PORT
	 command containing an integer over 8 bits long (over 255).
 </body>
 </description>
 <references>
 <url>http://www.time-travellers.org/oftpd/oftpd-dos.html</url>
 <bid>9980</bid>
 <cvename>CVE-2004-0376</cvename>
 </references>
 <dates>
 <discovery>2004-03-04</discovery>
 <entry>2004-03-28</entry>
 <modified>2004-04-05</modified>
 </dates>
 </vuln>

<vuln vid="705e003a-7f36-11d8-9645-0020ed76ef5a">
 <topic>squid ACL bypass due to URL decoding bug</topic>
 <affects>
 <package>
	<name>squid</name>
	<range><lt>2.5.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	From the Squid advisory:
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2004_1.txt">
	 Squid versions 2.5.STABLE4 and earlier contain a bug
	 in the "%xx" URL decoding function. It may insert a NUL
	 character into decoded URLs, which may allow users to bypass
	 url_regex ACLs.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.squid-cache.org/Advisories/SQUID-2004_1.txt</url>
 <cvename>CVE-2004-0189</cvename>
 </references>
 <dates>
 <discovery>2004-02-29</discovery>
 <entry>2004-03-26</entry>
 <modified>2015-05-01</modified>
 </dates>
 </vuln>

<vuln vid="cad045c0-81a5-11d8-9645-0020ed76ef5a">
 <topic>zebra/quagga denial of service vulnerability</topic>
 <affects>
 <package>
	<name>zebra</name>
	<range><lt>0.93b_7</lt></range>
 </package>
 <package>
	<name>quagga</name>
	<range><lt>0.96.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A remote attacker could cause zebra/quagga to crash by
	 sending a malformed telnet command to their management
	 port.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0858</cvename>
 <url>http://rhn.redhat.com/errata/RHSA-2003-305.html</url>
 <url>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=107140</url>
 <mlist>http://lists.quagga.net/pipermail/quagga-users/2003-November/000906.html</mlist>
 </references>
 <dates>
 <discovery>2003-11-20</discovery>
 <entry>2004-03-29</entry>
 </dates>
 </vuln>

<vuln vid="c551ae17-7f00-11d8-868e-000347dd607f">
 <topic>multiple vulnerabilities in phpBB</topic>
 <affects>
 <package>
	<name>phpbb</name>
	<range><lt>2.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Users with admin rights can severly damage an phpBB installation,
	 potentially triggered by viewing a page with a malicious link sent
	 by an attacker.
 </body>
 </description>
 <references>
 <url>http://www.gulftech.org/03202004.php</url>
 <url>http://www.phpbb.com/phpBB/viewtopic.php?t=183982</url>
 <bid>9942</bid>
 </references>
 <dates>
 <discovery>2004-03-20</discovery>
 <entry>2004-03-26</entry>
 <modified>2004-03-29</modified>
 </dates>
 </vuln>

<vuln vid="c480eb5e-7f00-11d8-868e-000347dd607f">
 <topic>ezbounce remote format string vulnerability</topic>
 <affects>
 <package>
	<name>ezbounce</name>
	<range><lt>1.04.a_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A security hole exists that can be used to crash the proxy and
	 execute arbitrary code. An exploit is circulating that takes
	 advantage of this, and in some cases succeeds in obtaining a login
	 shell on the machine.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0510</cvename>
 <url>http://ezbounce.dc-team.com/</url>
 <bid>8071</bid>
 </references>
 <dates>
 <discovery>2003-07-01</discovery>
 <entry>2004-03-26</entry>
 <modified>2004-03-29</modified>
 </dates>
 </vuln>

<vuln vid="739bb51d-7e82-11d8-9645-0020ed76ef5a">
 <topic>racoon security association deletion vulnerability</topic>
 <affects>
 <package>
	<name>racoon</name>
	<range><lt>20040116a</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A remote attacker may use specially crafted IKE/ISAKMP
	 messages to cause racoon to delete security associations.
	 This could result in denial-of-service or possibly cause
	 sensitive traffic to be transmitted in plaintext, depending
	 upon configuration.
 </body>
 </description>
 <references>
 <mlist msgid="20040113213940.GA1727@hzeroseven.org">http://www.securityfocus.com/archive/1/349756</mlist>
 <bid>9416</bid>
 <bid>9417</bid>
 <cvename>CVE-2004-0164</cvename>
 </references>
 <dates>
 <discovery>2004-01-13</discovery>
 <entry>2004-03-25</entry>
 <modified>2004-03-29</modified>
 </dates>
 </vuln>

<vuln vid="3b7c7f6c-7102-11d8-873f-0020ed76ef5a">
 <topic>wu-ftpd ftpaccess `restricted-uid'/`restricted-gid' directive may be bypassed</topic>
 <affects>
 <package>
	<name>wu-ftpd</name>
	<range><le>2.6.2_3</le></range>
 </package>
 <package>
	<name>wu-ftpd+ipv6</name>
	<range><le>2.6.2_5</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Glenn Stewart reports a bug in wu-ftpd's ftpaccess
	 `restricted-uid'/`restricted-gid' directives:
	<blockquote>
	 Users can get around the restriction to their home
	 directory by issuing a simple chmod command on their home
	 directory. On the next ftp log in, the user will have '/'
	 as their root directory.
	</blockquote>
	Matt Zimmerman discovered that the cause of the bug was a
	 missing check for a restricted user within a code path that
	 is executed only when a certain error is encountered.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0148</cvename>
 <bid>9832</bid>
 </references>
 <dates>
 <discovery>2004-02-17</discovery>
 <entry>2004-03-08</entry>
 <modified>2004-03-29</modified>
 </dates>
 </vuln>

<vuln vid="8471bb85-6fb0-11d8-873f-0020ed76ef5a">
 <topic>GNU Anubis buffer overflows and format string vulnerabilities</topic>
 <affects>
 <package>
	<name>anubis</name>
	<range><le>3.6.2_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ulf Härnhammar discovered several vulnerabilities in GNU
	 Anubis.
	<ul>
	 <li>Unsafe uses of `sscanf'.	The `%s' format specifier is
	 used, which allows a classical buffer overflow. (auth.c)</li>
	 <li>Format string bugs invoking `syslog'. (log.c, errs.c,
	 ssl.c)</li>
	</ul>
	Ulf notes that these vulnerabilities can be exploited by a
	 malicious IDENT server as a denial-of-service attack.
 </body>
 </description>
 <references>
 <mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-March/018290.html</mlist>
 <bid>9772</bid>
 <cvename>CVE-2004-0353</cvename>
 <cvename>CVE-2004-0354</cvename>
 </references>
 <dates>
 <discovery>2004-03-04</discovery>
 <entry>2004-03-06</entry>
 <modified>2004-03-29</modified>
 </dates>
 </vuln>

<vuln vid="3837f462-5d6b-11d8-80e3-0020ed76ef5a">
 <topic>Buffer overflows in XFree86 servers</topic>
 <affects>
 <package>
	<name>XFree86-Server</name>
	<range><le>4.3.0_13</le></range>
	<range><ge>4.3.99</ge><le>4.3.99.15_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A number of buffer overflows were recently discovered in
	 XFree86, prompted by initial discoveries by iDEFENSE. These
	 buffer overflows are present in the font alias handling. An
	 attacker with authenticated access to a running X server may
	 exploit these vulnerabilities to obtain root privileges on
	 the machine running the X server.
 </body>
 </description>
 <references>
 <url>http://www.idefense.com/application/poi/display?id=72</url>
 <url>http://www.idefense.com/application/poi/display?id=73</url>
 <cvename>CVE-2004-0083</cvename>
 <cvename>CVE-2004-0084</cvename>
 <cvename>CVE-2004-0106</cvename>
 <bid>9636</bid>
 <bid>9652</bid>
 <bid>9655</bid>
 </references>
 <dates>
 <discovery>2004-02-10</discovery>
 <entry>2004-02-12</entry>
 <modified>2004-03-29</modified>
 </dates>
 </vuln>

<vuln vid="e25566d5-6d3f-11d8-83a4-000a95bc6fae">
 <topic>multiple buffer overflows in xboing</topic>
 <affects>
 <package>
	<name>xboing</name>
	<range><lt>2.4_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Steve Kemp reports (in a Debian bug submission):
	<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=174924">
	 Due to improper bounds checking it is possible for a
	 malicious user to gain a shell with membership group
	 'games'. (The binary is installed setgid games).
	 Environmental variables are used without being bounds-checked
	 in any way, from the source code:
<pre>
highscore.c:
 /* Use the environment variable if it exists */
 if ((str = getenv("XBOING_SCORE_FILE")) != NULL)
	strcpy(filename, str);
 else
	strcpy(filename, HIGH_SCORE_FILE);

misc.c:
 if ((ptr = getenv("HOME")) != NULL)
	(void) strcpy(dest, ptr);
</pre>
	Neither of these checks are boundschecked, and will allow
	 arbitary shell code to be run.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0149</cvename>
 <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=174924</url>
 <bid>9764</bid>
 </references>
 <dates>
 <discovery>2003-01-01</discovery>
 <entry>2004-03-05</entry>
 <modified>2004-03-29</modified>
 </dates>
 </vuln>

<vuln vid="a20082c3-6255-11d8-80e3-0020ed76ef5a">
 <topic>metamail format string bugs and buffer overflows</topic>
 <affects>
 <package>
	<name>metamail</name>
	<range><lt>2.7_2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ulf Härnhammar reported four bugs in metamail: two are format
	 string bugs and two are buffer overflows. The bugs are in
	 SaveSquirrelFile(), PrintHeader(), and ShareThisHeader().
	These vulnerabilities could be triggered by a maliciously
	 formatted email message if `metamail' or `splitmail' is used
	 to process it, possibly resulting in arbitrary code execution
	 with the privileges of the user reading mail.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0104</cvename>
 <cvename>CVE-2004-0105</cvename>
 <bid>9692</bid>
 </references>
 <dates>
 <discovery>2004-02-18</discovery>
 <entry>2004-02-18</entry>
 <modified>2004-03-29</modified>
 </dates>
 </vuln>

<vuln vid="ce46b93a-80f2-11d8-9645-0020ed76ef5a">
 <topic>Buffer overflows and format string bugs in Emil</topic>
 <affects>
 <package>
	<name>emil</name>
	<range><le>2.1b9</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ulf Härnhammar reports multiple buffer overflows in
	 Emil, some of which are triggered during the parsing
	 of attachment filenames. In addition, some format string bugs
	 are present in the error reporting code.
	Depending upon local configuration, these vulnerabilities
	 may be exploited using specially crafted messages in order
	 to execute arbitrary code running with the privileges of
	 the user invoking Emil.
 </body>
 </description>
 <references>
 <mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-March/019325.html</mlist>
 <url>http://www.debian.org/security/2004/dsa-468</url>
 <cvename>CVE-2004-0152</cvename>
 <cvename>CVE-2004-0153</cvename>
 </references>
 <dates>
 <discovery>2004-03-24</discovery>
 <entry>2004-03-28</entry>
 </dates>
 </vuln>

<vuln vid="70f5b3c6-80f0-11d8-9645-0020ed76ef5a">
 <topic>Critical SQL injection in phpBB</topic>
 <affects>
 <package>
	<name>phpbb</name>
	<range><le>2.0.8</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Anyone can get admin's username and password's md5 hash via a
	 single web request.
	 A working example is provided in the advisory.
 </body>
 </description>
 <references>
 <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108032454818873</mlist>
 <bid>9984</bid>
 </references>
 <dates>
 <discovery>2004-03-26</discovery>
 <entry>2004-03-28</entry>
 </dates>
 </vuln>

<vuln vid="6c7661ff-7912-11d8-9645-0020ed76ef5a">
 <topic>uudeview buffer overflows</topic>
 <affects>
 <package>
	<name>uulib</name>
	<name>uudeview</name>
	<name>xdeview</name>
	<range><lt>0.5.20</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The authors of UUDeview report repairing two buffer
	 overflows in their software.
 </body>
 </description>
 <references>
 <url>http://www.fpx.de/fp/Software/UUDeview/HISTORY.txt</url>
 </references>
 <dates>
 <discovery>2004-03-01</discovery>
 <entry>2004-03-18</entry>
 <modified>2004-03-25</modified>
 </dates>
 </vuln>

<vuln vid="09d418db-70fd-11d8-873f-0020ed76ef5a">
 <topic>Apache 1.3 IP address access control failure on some 64-bit platforms</topic>
 <affects>
 <package>
	<name>apache</name>
	<range><lt>1.3.29_2</lt></range>
 </package>
 <package>
	<name>apache+mod_ssl</name>
	<range><lt>1.3.29+2.8.16_1</lt></range>
 </package>
 <package>
	<name>apache+ssl</name>
	<range><lt>1.3.29.1.53_1</lt></range>
 </package>
 <package>
	<name>ru-apache</name>
	<range><lt>1.3.29+30.19_1</lt></range>
 </package>
 <package>
	<name>ru-apache+mod_ssl</name>
	<range><lt>1.3.29+30.19+2.8.16_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Henning Brauer discovered a programming error in Apache
	 1.3's mod_access that results in the netmasks in IP address
	 access control rules being interpreted incorrectly on
	 64-bit, big-endian platforms. In some cases, this could
	 cause a `deny from' IP address access control rule including
	 a netmask to fail.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0993</cvename>
 <url>http://cvs.apache.org/viewcvs.cgi/apache-1.3/src/modules/standard/mod_access.c?r1=1.46&amp;r2=1.47</url>
 <url>http://www.apacheweek.com/features/security-13</url>
 <url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=23850</url>
 <mlist>http://marc.theaimsgroup.com/?l=apache-cvs&amp;m=107869603013722</mlist>
 <bid>9829</bid>
 </references>
 <dates>
 <discovery>2004-03-07</discovery>
 <entry>2004-03-08</entry>
 <modified>2004-03-12</modified>
 </dates>
 </vuln>

<vuln vid="1a448eb7-6988-11d8-873f-0020ed76ef5a">
 <topic>mod_python denial-of-service vulnerability in parse_qs</topic>
 <affects>
 <package>
	<name>mod_python</name>
	<range><ge>2.7</ge><lt>2.7.10</lt></range>
	<range><ge>3.0</ge><lt>3.0.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An attacker may cause Apache with mod_python to crash
	 by using a specially constructed query string.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0973</cvename>
 <bid>9129</bid>
 <url>http://www.modpython.org/pipermail/mod_python/2003-November/014532.html</url>
 <url>http://www.modpython.org/pipermail/mod_python/2004-January/014879.html</url>
 </references>
 <dates>
 <discovery>2003-11-28</discovery>
 <entry>2004-03-03</entry>
 <modified>2004-03-11</modified>
 </dates>
 </vuln>

<vuln vid="9fccad5a-7096-11d8-873f-0020ed76ef5a">
 <topic>mpg123 vulnerabilities</topic>
 <affects>
 <package>
	<name>mpg123</name>
	<name>mpg123-nas</name>
	<name>mpg123-esound</name>
	<range><le>0.59r_12</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	In 2003, two vulnerabilities were discovered in mpg123
	 that could result in remote code execution when using
	 untrusted input or streaming from an untrusted server.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0577</cvename>
 <cvename>CVE-2003-0865</cvename>
 <bid>6629</bid>
 <bid>8680</bid>
 </references>
 <dates>
 <discovery>2003-01-16</discovery>
 <entry>2004-03-07</entry>
 </dates>
 </vuln>

<vuln vid="ac4b9d18-67a9-11d8-80e3-0020ed76ef5a">
 <topic>fetchmail -- denial-of-service vulnerability</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><lt>6.2.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dave Jones discovered a denial-of-service vulnerability
	 in fetchmail. An email message containing a very long line
	 could cause fetchmail to segfault due to missing NUL
	 termination in transact.c.
	Eric Raymond decided not to mention this issue in the
	 release notes for fetchmail 6.2.5, but it was fixed
	 there.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0792</cvename>
 <bid>8843</bid>
 <url>http://xforce.iss.net/xforce/xfdb/13450</url>
 <url>http://www.openbsd.org/cgi-bin/cvsweb/ports/mail/fetchmail/patches/Attic/patch-rfc822_c?rev=1.1</url>
 </references>
 <dates>
 <discovery>2003-10-16</discovery>
 <entry>2004-02-25</entry>
 <modified>2012-09-04</modified>
 </dates>
 </vuln>

<vuln vid="b0e76877-67a8-11d8-80e3-0020ed76ef5a">
 <topic>mailman denial-of-service vulnerability in MailCommandHandler</topic>
 <affects>
 <package>
	<name>mailman</name>
	<range><lt>2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A malformed message could cause mailman to crash.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0991</cvename>
 <url>http://umn.dl.sourceforge.net/sourceforge/mailman/mailman-2.0.13-2.0.14-diff.txt</url>
 </references>
 <dates>
 <discovery>2003-11-18</discovery>
 <entry>2004-02-25</entry>
 </dates>
 </vuln>

<vuln vid="3cb88bb2-67a6-11d8-80e3-0020ed76ef5a">
 <topic>mailman XSS in admin script</topic>
 <affects>
 <package>
	<name>mailman</name>
	<range><lt>2.1.4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Dirk Mueller reports:
	 <blockquote>I've found a cross-site scripting
	 vulnerability in the admin interface of mailman 2.1.3 that
	 allows, under certain circumstances, for anyone to retrieve
	 the (valid) session cookie.</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0965</cvename>
 <url>http://mail.python.org/pipermail/mailman-announce/2003-December/000066.html</url>
 <url>http://xforce.iss.net/xforce/xfdb/14121</url>
 </references>
 <dates>
 <discovery>2003-12-31</discovery>
 <entry>2004-02-25</entry>
 </dates>
 </vuln>

<vuln vid="429249d2-67a7-11d8-80e3-0020ed76ef5a">
 <topic>mailman XSS in create script</topic>
 <affects>
 <package>
	<name>mailman</name>
	<range><lt>2.1.3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	From the 2.1.3 release notes:
	<blockquote>Closed a cross-site scripting exploit in the
	create cgi script.</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0992</cvename>
 <url>http://mail.python.org/pipermail/mailman-announce/2003-September/000061.html</url>
 </references>
 <dates>
 <discovery>2003-09-28</discovery>
 <entry>2004-02-25</entry>
 </dates>
 </vuln>

<vuln vid="00263aa3-67a8-11d8-80e3-0020ed76ef5a">
 <topic>mailman XSS in user options page</topic>
 <affects>
 <package>
	<name>mailman</name>
	<range><lt>2.1.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	From the 2.1.1 release notes:
	<blockquote>Closed a cross-site scripting vulnerability in
	the user options page.</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0038</cvename>
 <url>http://mail.python.org/pipermail/mailman-announce/2003-February/000056.html</url>
 </references>
 <dates>
 <discovery>2003-02-08</discovery>
 <entry>2004-02-25</entry>
 </dates>
 </vuln>

<vuln vid="75770425-67a2-11d8-80e3-0020ed76ef5a">
 <topic>SQL injection vulnerability in phpnuke</topic>
 <affects>
 <package>
	<name>phpnuke</name>
	<range><le>6.9</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Multiple researchers have discovered multiple SQL injection
	 vulnerabilities in some versions of Php-Nuke. These
	 vulnerabilities may lead to information disclosure, compromise
	 of the Php-Nuke site, or compromise of the back-end
	 database.
 </body>
 </description>
 <references>
 <url>http://security.nnov.ru/search/document.asp?docid=5748</url>
 <mlist>http://www.securityfocus.com/archive/1/348375</mlist>
 <url>http://www.security-corporation.com/advisories-027.html</url>
 <mlist>http://www.securityfocus.com/archive/1/353201</mlist>
 </references>
 <dates>
 <discovery>2003-12-12</discovery>
 <entry>2004-02-25</entry>
 </dates>
 </vuln>

<vuln vid="ad4f6ca4-6720-11d8-9fb5-000a95bc6fae">
 <topic>lbreakout2 vulnerability in environment variable handling</topic>
 <affects>
 <package>
	<name>lbreakout2</name>
	<range><le>2.2.2_1</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ulf Härnhammar discovered an exploitable vulnerability in
	 lbreakout2's environmental variable handling. In several
	 instances, the contents of the HOME environmental variable
	 are copied to a stack or global buffer without range
	 checking. A local attacker may use this vulnerability to
	 acquire group-ID `games' privileges.
	An exploit for this vulnerability has been published by
	 ``Li0n7 voila fr''.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0158</cvename>
 <url>http://www.debian.org/security/2004/dsa-445</url>
 <mlist>http://www.securityfocus.com/archive/1/354760</mlist>
 </references>
 <dates>
 <discovery>2004-02-21</discovery>
 <entry>2004-02-25</entry>
 </dates>
 </vuln>

<vuln vid="316e1c9b-671c-11d8-9aad-000a95bc6fae">
 <topic>hsftp format string vulnerabilities</topic>
 <affects>
 <package>
	<name>hsftp</name>
	<range><lt>1.14</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Ulf Härnhammar discovered a format string bug in hsftp's file
	 listing code may allow a malicious server to cause arbitrary
	 code execution by the client.
 </body>
 </description>
 <references>
 <mlist>http://lists.debian.org/debian-security-announce/debian-security-announce-2004/msg00044.html</mlist>
 </references>
 <dates>
 <discovery>2004-02-22</discovery>
 <entry>2004-02-25</entry>
 </dates>
 </vuln>

<vuln vid="c7cad0f0-671a-11d8-bdeb-000a95bc6fae">
 <topic>Darwin Streaming Server denial-of-service vulnerability</topic>
 <affects>
 <package>
	<name>DarwinStreamingServer</name>
	<range><le>4.1.3g</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An attacker can cause an assertion to trigger by sending
	 a long User-Agent field in a request.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0169</cvename>
 <url>http://www.idefense.com/application/poi/display?id=75</url>
 </references>
 <dates>
 <discovery>2004-02-23</discovery>
 <entry>2004-02-25</entry>
 </dates>
 </vuln>

<vuln vid="847ade05-6717-11d8-b321-000a95bc6fae">
 <topic>libxml2 stack buffer overflow in URI parsing</topic>
 <affects>
 <package>
	<name>libxml2</name>
	<range><lt>2.6.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Yuuichi Teranishi reported a crash in libxml2's URI handling
	 when a long URL is supplied.	The implementation in nanohttp.c
	 and nanoftp.c uses a 4K stack buffer, and longer URLs will
	 overwrite the stack.	This could result in denial-of-service
	 or arbitrary code execution in applications using libxml2
	 to parse documents.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0110</cvename>
 <url>http://www.xmlsoft.org/news.html</url>
 <url>http://mail.gnome.org/archives/xml/2004-February/msg00070.html</url>
 </references>
 <dates>
 <discovery>2004-02-08</discovery>
 <entry>2004-02-25</entry>
 </dates>
 </vuln>

<vuln vid="cc0fb686-6550-11d8-80e3-0020ed76ef5a">
 <topic>file disclosure in phpMyAdmin</topic>
 <affects>
 <package>
	<name>phpMyAdmin</name>
	<range><le>2.5.4</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Lack of proper input validation in phpMyAdmin may allow an
	 attacker to obtain the contents of any file on the target
	 system that is readable by the web server.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0129</cvename>
 <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=107582619125932&amp;w=2</mlist>
 <url>http://cvs.sourceforge.net/viewcvs.py/phpmyadmin/phpMyAdmin/export.php#rev2.3.2.1</url>
 </references>
 <dates>
 <discovery>2004-02-17</discovery>
 <entry>2004-02-22</entry>
 </dates>
 </vuln>

<vuln vid="87cc48fd-5fdd-11d8-80e3-0020ed76ef5a">
 <topic>mnGoSearch buffer overflow in UdmDocToTextBuf()</topic>
 <affects>
 <package>
	<name>mnogosearch</name>
	<range><ge>3.2.*</ge><lt>3.2.15</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jedi/Sector One &lt;j@pureftpd.org&gt; reported the following
	 on the full-disclosure list:
	<blockquote>
	 Every document is stored in multiple parts according to
	 its sections (description, body, etc) in databases. And
	 when the content has to be sent to the client,
	 UdmDocToTextBuf() concatenates those parts together and
	 skips metadata.
	 Unfortunately, that function lacks bounds checking and
	 a buffer overflow can be triggered by indexing a large
	 enough document.
	 'len' is fixed to 10K [in UdmDocToTextBuf] in searchd.c
	 . S-&gt;val length depends on the length of the original
	 document and on the indexer settings (the sample
	 configuration file has low limits that work around the
	 bug, though).
	 Exploitation should be easy, moreover textbuf points to
	 the stack.
	</blockquote>
 </body>
 </description>
 <references>
 <mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-February/017366.html</mlist>
 </references>
 <dates>
 <discovery>2004-02-15</discovery>
 <entry>2004-02-15</entry>
 </dates>
 </vuln>

<vuln vid="cacaffbc-5e64-11d8-80e3-0020ed76ef5a">
 <topic>GNU libtool insecure temporary file handling</topic>
 <affects>
 <package>
	<name>libtool</name>
	<range><ge>1.3</ge><lt>1.3.5_2</lt></range>
	<range><ge>1.4</ge><lt>1.4.3_3</lt></range>
	<range><ge>1.5</ge><lt>1.5.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libtool attempts to create a temporary directory in
	 which to write scratch files needed during processing. A
	 malicious user may create a symlink and then manipulate
	 the directory so as to write to files to which she normally
	 has no permissions.
	This has been reported as a ``symlink vulnerability'',
	 although I do not think that is an accurate description.
	This vulnerability could possibly be used on a multi-user
	 system to gain elevated privileges, e.g. root builds some
	 packages, and another user successfully exploits this
	 vulnerability to write to a system file.
 </body>
 </description>
 <references>
 <mlist>http://www.geocrawler.com/mail/msg.php3?msg_id=3438808&amp;list=405</mlist>
 <mlist>http://www.securityfocus.com/archive/1/352333</mlist>
 </references>
 <dates>
 <discovery>2004-01-30</discovery>
 <entry>2004-02-13</entry>
 </dates>
 </vuln>

<vuln vid="0e154a9c-5d7a-11d8-80e3-0020ed76ef5a">
 <topic>seti@home remotely exploitable buffer overflow</topic>
 <affects>
 <package>
	<name>setiathome</name>
	<range><lt>3.0.8</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The seti@home client contains a buffer overflow in the HTTP
	 response handler. A malicious, spoofed seti@home server can
	 exploit this buffer overflow to cause remote code execution
	 on the client. Exploit programs are widely available.
 </body>
 </description>
 <references>
 <url>http://setiathome.berkeley.edu/version308.html</url>
 <url>http://web.archive.org/web/20030609204812/http://spoor12.edup.tudelft.nl/</url>
 </references>
 <dates>
 <discovery>2003-04-08</discovery>
 <entry>2004-02-12</entry>
 </dates>
 </vuln>

<vuln vid="5e92e8a2-5d7b-11d8-80e3-0020ed76ef5a">
 <topic>icecast 1.x multiple vulnerabilities</topic>
 <affects>
 <package>
	<name>icecast</name>
	<range><lt>1.3.12</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	icecast 1.3.11 and earlier contained numerous security
	 vulnerabilities, the most severe allowing a remote attacker
	 to execute arbitrary code as root.
 </body>
 </description>
 <references>
 <cvename>CVE-2002-0177</cvename>
 <cvename>CVE-2001-1230</cvename>
 <cvename>CVE-2001-1229</cvename>
 <cvename>CVE-2001-1083</cvename>
 <cvename>CVE-2001-0784</cvename>
 <bid>4415</bid>
 <bid>2933</bid>
 </references>
 <dates>
 <discovery>2002-04-28</discovery>
 <entry>2004-02-12</entry>
 </dates>
 </vuln>

<vuln vid="83119e27-5d7c-11d8-80e3-0020ed76ef5a">
 <topic>nap allows arbitrary file access</topic>
 <affects>
 <package>
	<name>nap</name>
	<range><lt>1.4.5</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	According to the author:
	<blockquote>
	 Fixed security loophole which allowed remote
	 clients to access arbitrary files on our
	 system.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://quasar.mathstat.uottawa.ca/~selinger/nap/NEWS</url>
 </references>
 <dates>
 <discovery>2001-04-12</discovery>
 <entry>2004-02-12</entry>
 </dates>
 </vuln>

<vuln vid="a736deab-5d7d-11d8-80e3-0020ed76ef5a">
 <topic>CCE contains exploitable buffer overflows</topic>
 <affects>
 <package>
	<name>zh-cce</name>
	<range><lt>0.40</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The Chinese Console Environment contains exploitable buffer
	 overflows.
 </body>
 </description>
 <references>
 <url>http://programmer.lib.sjtu.edu.cn/cce/cce.html</url>
 </references>
 <dates>
 <discovery>2000-06-22</discovery>
 <entry>2004-02-12</entry>
 </dates>
 </vuln>

<vuln vid="49ad1bf8-5d7e-11d8-80e3-0020ed76ef5a">
 <topic>ChiTeX/ChiLaTeX unsafe set-user-id root</topic>
 <affects>
 <package>
	<name>zh-chitex</name>
	<range><gt>0</gt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Niels Heinen reports that ChiTeX installs set-user-id root
	 executables that invoked system(3) without setting up the
	 environment, trivially allowing local root compromise.
 </body>
 </description>
 <references>
 <url>https://docs.freebsd.org/cgi/mid.cgi?200303251301.h2PD1m9Y053389</url>
 </references>
 <dates>
 <discovery>2003-04-25</discovery>
 <entry>2004-02-12</entry>
 </dates>
 </vuln>

<vuln vid="5789a92e-5d7f-11d8-80e3-0020ed76ef5a">
 <topic>pine remotely exploitable buffer overflow in newmail.c</topic>
 <affects>
 <package>
	<name>zh-pine</name>
	<name>iw-pine</name>
	<name>pine</name>
	<name>pine4-ssl</name>
	<range><le>4.21</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Kris Kennaway reports a remotely exploitable buffer overflow
	 in newmail.c. Mike Silbersack submitted the fix.
 </body>
 </description>
 <references>
 <url>https://docs.freebsd.org/cgi/mid.cgi?200009290728.AAA69097</url>
 </references>
 <dates>
 <discovery>2000-09-29</discovery>
 <entry>2004-02-12</entry>
 </dates>
 </vuln>

<vuln vid="34134fd4-5d81-11d8-80e3-0020ed76ef5a">
 <topic>pine insecure URL handling</topic>
 <affects>
 <package>
	<name>pine</name>
	<name>zh-pine</name>
	<name>iw-pine</name>
	<range><lt>4.44</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An attacker may send an email message containing a specially
	 constructed URL that will execute arbitrary commands when
	 viewed.
 </body>
 </description>
 <references>
 <freebsdsa>SA-02:05.pine</freebsdsa>
 </references>
 <dates>
 <discovery>2002-01-04</discovery>
 <entry>2004-02-12</entry>
 </dates>
 </vuln>

<vuln vid="5abfee2d-5d82-11d8-80e3-0020ed76ef5a">
 <topic>pine remote denial-of-service attack</topic>
 <affects>
 <package>
	<name>pine</name>
	<name>zh-pine</name>
	<name>iw-pine</name>
	<range><lt>4.50</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An attacker may send a specially-formatted email message
	 that will cause pine to crash.
 </body>
 </description>
 <references>
 <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=103668430620531&amp;w=2</mlist>
 <cvename>CVE-2002-1320</cvename>
 </references>
 <dates>
 <discovery>2002-10-23</discovery>
 <entry>2004-02-12</entry>
 </dates>
 </vuln>

<vuln vid="39bd57e6-5d83-11d8-80e3-0020ed76ef5a">
 <topic>pine remotely exploitable vulnerabilities</topic>
 <affects>
 <package>
	<name>pine</name>
	<name>zh-pine</name>
	<name>iw-pine</name>
	<range><lt>4.58</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Pine versions prior to 4.58 are affected by two
	 vulnerabilities discovered by iDEFENSE, a buffer overflow
	 in mailview.c and an integer overflow in strings.c. Both
	 vulnerabilities can result in arbitrary code execution
	 when processing a malicious message.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0720</cvename>
 <cvename>CVE-2003-0721</cvename>
 <url>http://www.idefense.com/application/poi/display?id=5</url>
 </references>
 <dates>
 <discovery>2003-09-10</discovery>
 <entry>2004-02-12</entry>
 </dates>
 </vuln>

<vuln vid="5729b8ed-5d75-11d8-80e3-0020ed76ef5a">
 <topic>rsync buffer overflow in server mode</topic>
 <affects>
 <package>
	<name>rsync</name>
	<range><lt>2.5.7</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	When rsync is run in server mode, a buffer overflow could
	 allow a remote attacker to execute arbitrary code with the
	 privileges of the rsync server. Anonymous rsync servers are
	 at the highest risk.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0962</cvename>
 <mlist>http://lists.samba.org/archive/rsync-announce/2003/000011.html</mlist>
 <url>http://rsync.samba.org/#security</url>
 </references>
 <dates>
 <discovery>2003-12-04</discovery>
 <entry>2004-02-12</entry>
 </dates>
 </vuln>

<vuln vid="3388eff9-5d6e-11d8-80e3-0020ed76ef5a">
 <topic>Samba 3.0.x password initialization bug</topic>
 <affects>
 <package>
	<name>samba</name>
	<range><ge>3.0,1</ge><lt>3.0.1_2,1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	From the Samba 3.0.2 release notes:
	<blockquote cite="http://www.samba.org/samba/whatsnew/samba-3.0.2.html">
	 Security Announcement: It has been confirmed that
	 previous versions of Samba 3.0 are susceptible to a password
	 initialization bug that could grant an attacker unauthorized
	 access to a user account created by the mksmbpasswd.sh shell
	 script.
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.samba.org/samba/whatsnew/samba-3.0.2.html</url>
 <cvename>CVE-2004-0082</cvename>
 </references>
 <dates>
 <discovery>2004-02-09</discovery>
 <entry>2004-02-12</entry>
 </dates>
 </vuln>

<vuln vid="67c05283-5d62-11d8-80e3-0020ed76ef5a">
 <topic>Buffer overflow in Mutt 1.4</topic>
 <affects>
 <package>
	<name>mutt</name>
	<name>ja-mutt</name>
	<range><ge>1.4</ge><lt>1.4.2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mutt 1.4 contains a buffer overflow that could be exploited
	 with a specially formed message, causing Mutt to crash or
	 possibly execute arbitrary code.
 </body>
 </description>
 <references>
 <cvename>CVE-2004-0078</cvename>
 <url>http://www.mutt.org/news.html</url>
 </references>
 <dates>
 <discovery>2004-02-11</discovery>
 <entry>2004-02-12</entry>
 </dates>
 </vuln>

<vuln vid="7557a2b1-5d63-11d8-80e3-0020ed76ef5a">
 <topic>Apache-SSL optional client certificate vulnerability</topic>
 <affects>
 <package>
	<name>apache+ssl</name>
	<range><lt>1.3.29.1.53</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	From the Apache-SSL security advisory:
	<blockquote>
	 If configured with SSLVerifyClient set to 1 or 3 (client
	 certificates optional) and SSLFakeBasicAuth, Apache-SSL
	 1.3.28+1.52 and all earlier versions would permit a
	 client to use real basic authentication to forge a client
	 certificate.

All the attacker needed is the "one-line DN" of a valid
	 user, as used by faked basic auth in Apache-SSL, and the
	 fixed password ("password" by default).
	</blockquote>
 </body>
 </description>
 <references>
 <url>http://www.apache-ssl.org/advisory-20040206.txt</url>
 </references>
 <dates>
 <discovery>2004-02-06</discovery>
 <entry>2004-02-10</entry>
 </dates>
 </vuln>

<vuln vid="96ba2dae-4ab0-11d8-96f2-0020ed76ef5a">
 <topic>L2TP, ISAKMP, and RADIUS parsing vulnerabilities in tcpdump</topic>
 <affects>
 <package>
	<name>tcpdump</name>
	<range><lt>3.8.1_351</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><lt>5.2.1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Jonathan Heusser discovered vulnerabilities in tcpdump's
	L2TP, ISAKMP, and RADIUS protocol handlers. These
	vulnerabilities may be used by an attacker to crash a running
	`tcpdump' process.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0989</cvename>
 <cvename>CVE-2003-1029</cvename>
 <cvename>CVE-2004-0057</cvename>
 <mlist>http://www.tcpdump.org/lists/workers/2003/12/msg00083.html</mlist>
 <mlist>http://marc.theaimsgroup.com/?l=tcpdump-workers&amp;m=107325073018070&amp;w=2</mlist>
 </references>
 <dates>
 <discovery>2003-12-24</discovery>
 <entry>2004-01-19</entry>
 </dates>
 </vuln>

<vuln vid="fd376b8b-41e1-11d8-b096-0020ed76ef5a">
 <topic>Buffer overflow in INN control message handling</topic>
 <affects>
 <package>
	<name>inn</name>
	<range><ge>2.4.*</ge><lt>2.4.1</lt></range>
 </package>
 <package>
	<name>inn-stable</name>
	<range><lt>20031022_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A small, fixed-size stack buffer is used to construct a
	 filename based on a received control message. This could
	 result in a stack buffer overflow.
 </body>
 </description>
 <references>
 <mlist msgid="87d69v7222.fsf@windlord.stanford.edu">http://marc.theaimsgroup.com/?l=inn-workers&amp;m=107351974008605</mlist>
 </references>
 <dates>
 <discovery>2004-01-07</discovery>
 <entry>2004-01-08</entry>
 <modified>2004-10-21</modified>
 </dates>
 </vuln>

<vuln vid="cf0fb426-3f96-11d8-b096-0020ed76ef5a">
 <topic>ProFTPD ASCII translation bug resulting in remote root compromise</topic>
 <affects>
 <package>
	<name>proftpd</name>
	<range><lt>1.2.8_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A buffer overflow exists in the ProFTPD code that handles
	 translation of newline characters during ASCII-mode file
	 uploads. An attacker may exploit this buffer overflow by
	 uploading a specially crafted file, resulting in code
	 execution and ultimately a remote root compromise.
 </body>
 </description>
 <references>
 <url>http://xforce.iss.net/xforce/alerts/id/154</url>
 <cvename>CVE-2003-0831</cvename>
 </references>
 <dates>
 <discovery>2003-09-23</discovery>
 <entry>2004-01-05</entry>
 </dates>
 </vuln>

<vuln vid="e3cf89f0-53da-11d9-92b7-ceadd4ac2edd">
 <topic>phpbb -- arbitrary command execution and other vulnerabilities</topic>
 <affects>
 <package>
	<name>phpbb</name>
	<range><lt>2.0.11</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	The ChangeLog for phpBB 2.0.11 states:
	<blockquote cite="http://www.phpbb.com/support/documents.php?mode=changelog">
	 Changes since 2.0.10
	 <ul>
	 <li>Fixed vulnerability in highlighting code (very
	 high severity, please update your installation as soon
	 as possible)</li>
	 <li>Fixed unsetting global vars - Matt
	 Kavanagh</li>
	 <li>Fixed XSS vulnerability in username handling
	 - AnthraX101</li>
	 <li>Fixed not confirmed sql injection in username handling
	 - warmth</li>
	 <li>Added check for empty topic id in topic_review
	 function</li>
	 <li>Added visual confirmation mod to code base</li>
	 </ul>
	</blockquote>
	Additionally, a US-CERT Technical Cyber Security Alert reports:
	<blockquote cite="http://www.us-cert.gov/cas/techalerts/TA04-356A.html">
	 phpBB contains an user input validation problem with
	 regard to the parsing of the URL. An intruder can deface a
	 phpBB website, execute arbitrary commands, or gain
	 administrative privileges on a compromised bulletin
	 board.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2004-1315</cvename>
 <freebsdpr>ports/74106</freebsdpr>
 <uscertta>TA04-356A</uscertta>
 <certvu>497400</certvu>
 <url>http://www.phpbb.com/support/documents.php?mode=changelog</url>
 <mlist msgid="20041113030542.11396.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110029415208724</mlist>
 <mlist msgid="20041118123055.28647.qmail@mail.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110079436714518</mlist>
 <url>http://www.phpbb.com/phpBB/viewtopic.php?f=14&amp;t=240636</url>
 </references>
 <dates>
 <discovery>2004-11-18</discovery>
 <entry>2004-12-22</entry>
 <modified>2005-01-24</modified>
 </dates>
 </vuln>

<vuln vid="81313647-2d03-11d8-9355-0020ed76ef5a">
 <topic>ElGamal sign+encrypt keys created by GnuPG can be compromised</topic>
 <affects>
 <package>
	<name>gnupg</name>
	<range><ge>1.0.2</ge><lt>1.2.3_4</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Any ElGamal sign+encrypt keys created by GnuPG contain a
	 cryptographic weakness that may allow someone to obtain
	 the private key. These keys should be considered
	 unusable and should be revoked.
	The following summary was written by Werner Koch, GnuPG
	 author:
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-devel/2003-November/020570.html">
	 Phong Nguyen identified a severe bug in the way GnuPG
	 creates and uses ElGamal keys for signing.	This is
	 a significant security failure which can lead to a
	 compromise of almost all ElGamal keys used for signing.
	 Note that this is a real world vulnerability which will
	 reveal your private key within a few seconds.
	 ...
	 Please take immediate action and revoke your ElGamal
	 signing keys.	Furthermore you should take whatever
	 measures necessary to limit the damage done for signed or
	 encrypted documents using that key.
	 Note that the standard keys as generated by GnuPG (DSA
	 and ElGamal encryption) as well as RSA keys are NOT
	 vulnerable. Note also that ElGamal signing keys cannot
	 be generated without the use of a special flag to enable
	 hidden options and even then overriding a warning message
	 about this key type. See below for details on how to
	 identify vulnerable keys.
	</blockquote>
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0971</cvename>
 <mlist>http://lists.gnupg.org/pipermail/gnupg-devel/2003-November/020570.html</mlist>
 </references>
 <dates>
 <discovery>2003-11-27</discovery>
 <entry>2003-12-12</entry>
 </dates>
 </vuln>

<vuln vid="f04cc5cb-2d0b-11d8-beaf-000a95c4d922">
 <topic>bind8 negative cache poison attack</topic>
 <affects>
 <package>
	<name>bind</name>
	<range><ge>8.3</ge><lt>8.3.7</lt></range>
	<range><ge>8.4</ge><lt>8.4.3</lt></range>
 </package>
 <package>
	<name>FreeBSD</name>
	<range><ge>5.1</ge><lt>5.1_11</lt></range>
	<range><ge>5.0</ge><lt>5.0_19</lt></range>
	<range><ge>4.9</ge><lt>4.9_1</lt></range>
	<range><ge>4.8</ge><lt>4.8_14</lt></range>
	<range><ge>4.7</ge><lt>4.7_24</lt></range>
	<range><ge>4.6</ge><lt>4.6.2_27</lt></range>
	<range><ge>4.5</ge><lt>4.5_37</lt></range>
	<range><lt>4.4_47</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A programming error in BIND 8 named can result in a DNS
	message being incorrectly cached as a negative response. As
	a result, an attacker may arrange for malicious DNS messages
	to be delivered to a target name server, and cause that name
	server to cache a negative response for some target domain
	name. The name server would thereafter respond negatively
	to legitimate queries for that domain name, resulting in a
	denial-of-service for applications that require DNS.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0914</cvename>
 <freebsdsa>SA-03:19.bind</freebsdsa>
 <certvu>734644</certvu>
 </references>
 <dates>
 <discovery>2003-11-28</discovery>
 <entry>2003-12-12</entry>
 <modified>2004-05-05</modified>
 </dates>
 </vuln>

<vuln vid="96fdbf5b-2cfd-11d8-9355-0020ed76ef5a">
 <topic>Mathopd buffer overflow</topic>
 <affects>
 <package>
	<name>mathopd</name>
	<range><lt>1.4p2</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Mathopd contains a buffer overflow in the prepare_reply()
	 function that may be remotely exploitable.
 </body>
 </description>
 <references>
 <url>http://www.mail-archive.com/mathopd%40mathopd.org/msg00136.html</url>
 </references>
 <dates>
 <discovery>2003-12-04</discovery>
 <entry>2003-12-12</entry>
 </dates>
 </vuln>

<vuln vid="d7af61c8-2cc0-11d8-9355-0020ed76ef5a">
 <topic>lftp HTML parsing vulnerability</topic>
 <affects>
 <package>
	<name>lftp</name>
	<range><le>2.6.10</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	A buffer overflow exists in lftp which may be triggered when
	 requesting a directory listing from a malicious server over
	 HTTP.
 </body>
 </description>
 <references>
 <cvename>CVE-2003-0963</cvename>
 <url>http://lftp.yar.ru/news.html#2.6.10</url>
 </references>
 <dates>
 <discovery>2003-12-11</discovery>
 <entry>2003-12-12</entry>
 </dates>
 </vuln>

<vuln vid="ebdf65c7-2ca6-11d8-9355-0020ed76ef5a">
 <topic>qpopper format string vulnerability</topic>
 <affects>
 <package>
	<name>qpopper</name>
	<range><lt>2.53_1</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	An authenticated user may trigger a format string
	 vulnerability present in qpopper's UIDL code, resulting
	 in arbitrary code execution with group ID `mail'
	 privileges.
 </body>
 </description>
 <references>
 <bid>1241</bid>
 <cvename>CVE-2000-0442</cvename>
 <url>http://www.netsys.com/suse-linux-security/2000-May/att-0137/01-b0f5-Qpopper.txt</url>
 </references>
 <dates>
 <discovery>2000-05-23</discovery>
 <entry>2003-12-12</entry>
 </dates>
 </vuln>

<vuln vid="af0296be-2455-11d8-82e5-0020ed76ef5a">
 <topic>fetchmail -- address parsing vulnerability</topic>
 <affects>
 <package>
	<name>fetchmail</name>
	<range><le>6.2.0</le></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Fetchmail can be crashed by a malicious email message.
 </body>
 </description>
 <references>
 <url>http://security.e-matters.de/advisories/052002.html</url>
 </references>
 <dates>
 <discovery>2003-10-25</discovery>
 <entry>2003-10-25</entry>
 <modified>2012-09-04</modified>
 </dates>
 </vuln>

<vuln vid="2bcd2d24-24ca-11d8-82e5-0020ed76ef5a">
 <topic>Buffer overflow in pam_smb password handling</topic>
 <affects>
 <package>
	<name>pam_smb</name>
	<range><lt>1.9.9_3</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	Applications utilizing pam_smb can be compromised by
	 any user who can enter a password. In many cases,
	 this is a remote root compromise.
 </body>
 </description>
 <references>
 <url>http://www.skynet.ie/~airlied/pam_smb/</url>
 <cvename>CVE-2003-0686</cvename>
 </references>
 <dates>
 <discovery>2003-10-25</discovery>
 <entry>2003-10-25</entry>
 <modified>2003-10-25</modified>
 </dates>
 </vuln>

<vuln vid="c4b7badf-24ca-11d8-82e5-0020ed76ef5a">
 <topic>Buffer overflows in libmcrypt</topic>
 <affects>
 <package>
	<name>libmcrypt</name>
	<range><lt>2.5.6</lt></range>
 </package>
 </affects>
 <description>
 <body xmlns="http://www.w3.org/1999/xhtml">
	libmcrypt does incomplete input validation, leading to
	 several buffer overflows. Additionally,
	 a memory leak is present. Both of these problems may be
	 exploited in a denial-of-service attack.
 </body>
 </description>
 <references>
 <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=104162752401212&amp;w=2</mlist>
 <cvename>CVE-2003-0031</cvename>
 <cvename>CVE-2003-0032</cvename>
 </references>
 <dates>
 <discovery>2003-10-25</discovery>
 <entry>2003-10-25</entry>
 <modified>2003-10-25</modified>
 </dates>
 </vuln>

003 File Manager

Editing: vuln.xml

Upload File

Create Folder